Think Election Hacking is Bad? It's Only Going to Get Worse.

Elections were taking place in certain 'democratic' Middle Eastern country (take your pick), so a dutiful citizen went to cast his vote at the polling station. When he came home, his wife asked who he voted for. He replied that this year he had decided to give the opposition a chance. His wife yelled at him “What? Are you crazy?? They’ll kill us if we don’t vote for the President, go straight back to the polling station and change it!” Begrudgingly, the man returned to the polling station. Upon arrival he explained to the guards there had been a mistake and he’d like to change his vote. “It’s alright sir”, the guard replied with a smile, “We’ve done it for you.”

While interference in elections, both domestic and foreign, is far from a joke, it is also not a new phenomenon. In fact, election hacking comes in many guises and has been taking place in one form or another since the 1940s.

In today’s age of cyber warfare, though, it has become arguably the most powerful weapon a nation-state threat actor has to attack another nation-state. With the Israeli elections coming up and over 90 regional or national elections taking place this year, it's worth looking deeper into what is driving this raging trend and how it can be tamed.

The Subtle Art of Manipulation

As seen in part of the notorious alleged Russian meddling campaign in the 2016 US elections, the most high profile method for hacking an election involves the tampering of computerized voting systems. Indeed, this is the method many would recognize due to heavy reporting on the topic.

One such report was of how an 11-year-old boy found vulnerabilities in a mock-up of Florida’s state election website and managed to break into the fake site to alter the vote totals recorded there. It took him less than 10 minutes.

However, there are more subtle, yet no less damaging, approaches for a foreign or domestic actor to bend, break or reinvent the rules to suit their own liking without needing to go anywhere near a voting machine. 

Since 2016, digital propaganda and misinformation campaigns have become increasingly sophisticated. This is partially due to foreign actors taking a greater interest in exploiting the vulnerabilities of international voting systems, and partially because social media is particularly prone to organized misinformation campaign. The controversy surrounding the political consulting firm, Cambridge Analytica, which became a dominant player in these efforts, is a clear example of this.

Many may believe that the thousands of fake accounts on Twitter or Facebook are to blame for tilting the results, but this is only partly true.

Take the (other) recent Israeli elections in May 2019, for example. According to some estimates, it requires 100,000 people to vote for a particular political party there to achieve just one parliamentary candidate seat. Indeed, it’s actually difficult to persuade voters to even go out and vote at all, let alone vote for a particular candidate. It’s also an expensive approach, as seen by the $5 billion spent on the 2018 US mid-term elections, considered to be the most expensive elections ever held.

The reason for this is that in the weeks leading up to Election Day, voters are inundated with political messages, and the resulting barrage limits the impact of any one individual message, good or bad.

Instead, a more subtle, yet more efficient and powerful, approach is to influence the news narrative itself. By doing so, outside forces can have a significant impact on setting the agenda by amplifying specific stories in the news cycle, via social media, and thus sway the political outcome.

It’s All in the Timing

Voters often come with already preconceived ideas and cognitive biases as to which way they are planning to vote. For this reason, according to a 1972 research paper into political communication, "the media may not be successful much of the time in telling people what to think, but it is stunningly successful in telling its readers what to think about."

Furthermore, as noted by David Karpf, one cognitive bias that can be influenced is the recency bias, "the phenomenon that the headlines dominating the news in the weeks leading up to Election Day become the issues that voters care about most." News stories focusing on migrants, for example, will be the key issue that voters can be swayed to focus on when choosing between a populist or non-populist electoral candidate.

Because of this, it is not necessarily bots posting thousands of messages about a particular issue that are most effective for hacking an election. Instead it is well timed scandals strategically placed at the right time before an election that could have the most impact by dominating the narrative. In this way, foreign bodies can clandestinely attempt to inject news, either true or false, into popular consciousness.

Fake It ‘Til You Make It

As mentioned earlier, misinformation during elections is nothing new. But in today's cyber threat landscape, misinformation and fake news in general is now propagated in ever more sophisticated ways. Due to the development in technology, tools that began as crude, fake accounts on social media spamming unsophisticated messages en-masse, have now reached far greater levels of maturity.

At the heart of this development is Artificial Intelligence (AI), bringing an ability for a computer to adapt in real time and create content that is increasingly more believable and natural. So much so, that we have arrived at a point where these tools are being recognized by their authors as being too dangerous for release. Such is the case with GPT-2, an AI based machine that, built on machine-learning algorithms and big data, can generate highly coherent paragraphs of text, unsupervised. Another example is Project Debator, a computer that's able to generate original and persuasive content in real time and in response to alternative arguments presented to it.

These tools are not only available for text content either. Milestones have also been reached in the creation of fake video content that is almost indistinguishable from the genuine article. When video is now the preferred medium for hundreds of millions worldwide, thanks primarily to smartphone usage, a threat actor using ‘Deep Fake’ videos can dictate the narrative by imposing the image of a political candidate into situations where they never in fact appeared. Yet, by the time the truth and facts are finally uncovered, the damage is already done.

The most recent example of this was a video that targeted the speaker of US House of Representatives, Nancy Pelosi, to show her stammering through a speech that in fact had no such speech impediment included in reality. The video was seen by 2.5 million people on YouTube and even tweeted by President Trump.

Real or Fake Video - Can you tell the difference?

When these tools are combined with the viral potential that social media platforms offer, the results are chilling to consider. In fact, the use of altered videos has led U.S. intelligence officials to issue a warning ahead of the 2020 elections and this year's Worldwide Threat Assessment said "adversaries and strategic competitors would likely attempt to use deep fakes" to influence campaigns in the U.S. but they could also be used for other nefarious reasons.

While there are some who are challenging the current level of misinformation that floods our news feeds on an hourly basis, one can’t help but feel they are lagging behind the advances being made on the front line of today’s cyber threats.

One reason why this might be is that these tools lack the amount of data and visibility held by the social media platforms that disseminate this misleading and fake content. While it is currently a hot debate as to what extent these platforms are responsible for policing the content shared on them, what is clear is a need for cooperation and collaboration between them and third parties, whether governments or private companies, that have an interest in quelling the potential damage that can be done to users. Without such action, it is likely we will see more attacks on all stages of the voting process and the fallout from such damaging outside interference will only increase.

Conclusion

From Canada to Israel and India to New Zealand, more than 90 regional or general elections have already run or are planned to take place in 2019, and the fear of foreign intervention looms large. 

However, free elections are crucial to the functioning of democratic institutions. Cyber attacks on these institutions have therefore become a choice option to any state or non-state threat actor looking to sway their results and undermine democracy itself.

At the core of this option, though, whether it be attacking the computerized voting systems themselves or manipulating voters through misinformation, is technology. Accordingly, as with all forms of cyber attacks, the required response to threats that leverage technology to cause mass harm are solutions that leverage alternative, yet no less advanced, technology to prevent such damage.