Attacks against elections are inevitable – Estonia shows what can be done

Preparing to defend
This recent Estonian election was largely unaffected by cyberattacks or coordinated information operations. Some of the reason is likely because the country and its people have improved their understanding of the problems, and their defenses against it, over the past couple of decades.

Back in 2007, the relocation of a Soviet-era memorial in the Estonian capital Tallinn resulted in public protests and several waves of coordinated distributed denial of service attacks. These did not steal citizens’ data, but they did shut down many digital services for a number of hours on each of several days. This highlighted both the public’s increasing reliance on digital technology and the weaknesses of online systems.

The digital systems that Estonian governments and businesses have developed in the years since 2007 are strong, secure and trusted by users – who welcome further digitization of their lives because it is convenient and safe. Electronic banking systems, digital medication prescriptions, e-schools and thousands of other online services rely heavily on government-backed secure digital identity, a digital population registry and a robust data exchange layer between databases and services.

These systems also facilitate the digital elements of elections, including internet voting.

Comprehensive cyber defenses
A key lesson from Estonia is that with so many different threats, no single defense can protect every part of a democratic system and society. Rather, defenders must evaluate what attackers are likely to be after – and what’s at stake.

In 2017, two Estonian government agencies, the State Electoral Office and the Information System Authority – where one of us, Liisa Past, was chief research officer for cybersecurity – joined forces to comprehensively analyze the threats and risks to local elections. In addition to the technical risks, like failures in connections or flaws in software, the team paid close attention to issues in management as well as the possibilities for information warfare.

The Estonian government engaged in similar analyses in the lead-up to the 2019 elections. In addition, the agencies took a lesson from the French and U.S. experience in 2016 and taught political parties and individual candidates how to protect themselves and their information online.

Similarly, governments across the European Union are sharing their best ideas about designing trustworthy election systems. Logging and monitoring network access, for example, can help computer administrators quickly detect and respond to unauthorized activity.

Understanding the double threat of information operations
Estonia’s lessons may be useful elsewhere. In the past five years, Russian attacks have targeted both election-specific systems, like the Ukrainian national election commission website in 2014, and the larger public discussion around the election and current political issues.

Online efforts seeking to manipulate people’s views in the run-up to the 2016 Brexit vote, as well as during presidential campaigns in the U.S. and France, are quite similar to Cold War tactics known as “information operations.”

The practitioners use 21st-century tools like social media and automation to plant false stories and exploit social divisions. They don’t necessarily seek to break through network firewalls or compromise any secure government systems, but rather appear to unwitting online audiences as authentic fellow contributors in a free, open debate.

Bots’ characteristic behaviors can give them away. Yet there are so many of them that they can crowd out human voices and undermine the democratic principle of real participation by actual people.

Defense in depth
Elections’ legitimacy depends on more than just technical security. They must also be seen to be free of external influence. Governments should take comprehensive views of their security, and threats to it – accounting for elements as diverse as cyber defenses of essential systems and the effects of information warfare on voters.

It’s a worldwide problem, with Russia exerting influence not just in the U.S. and Estonia but also Egypt, and China attacking Australia’s political system.

The response, therefore, has to include open, healthy public debate and media literacy as well as preventing, detecting and mitigating the effects of cyberattacks on the confidentiality, availability and integrity at the very core of democratic systems.

Liisa Past is Next Generation Leader, McCain Institute for International Leadership, Arizona State University. Keith Brown is Professor of Politics and Global Studies, Arizona State University. This article is published courtesy of The Conversation.