UK voter data within reach of miscreants who hacked Electoral Commission – Source: go.theregister.com

The IT infrastructure of the UK’s Electoral Commission was broken into by miscreants, who will have had access to names and addresses of voters, as well as the election oversight body’s email and unspecified other systems.

In a public notice on its website, the commission today said the intrusion was identified in October 2022, after suspicious activity was detected on its systems, though it was clear the attackers had first accessed those computers more than a year earlier, in August 2021.

The Electoral Commission is an independent agency tasked with overseeing elections and regulating political financing in Britain. Its role is to ensure the integrity and transparency of party and election finance, and to oversee the electoral registration process.

It doesn’t help if the organization responsible for the integrity of elections gets hacked

As a consequence of the systems being penetrated, the attackers had access to the servers that host the commission’s email, control systems, and copies of the electoral registers covering the entire country.

During the time period covered by the attack, the electoral registers held information including the name and address of anyone in the UK who registered to vote between 2014 and 2022, as well as the names of those registered as overseas voters. The registers did not include the details of anyone who registered anonymously.

The commission told The Register in an email today it is “currently under investigation by the Information Commissioner’s Office” and “cannot release any information that could compromise their investigation.” It did note, however, that the cyberattack “included access to the commission’s Exchange server, which holds our email system. This means that anyone who has contacted the Electoral Commission via email or through the webform on our website, will have provided data that was accessible as part of this attack.”

After the break-in was discovered, the commission reported it to the National Cyber Security Centre (NCSC) and is still working with security specialists to investigate the snafu. It has also taken action to secure its systems and reduce the risk of future attacks, allegedly.

The commission said it does not know who is responsible for the attack, and that no groups or individuals have so far claimed responsibility.

There is no suggestion that the security breach allowed the attackers to alter the outcome of an election, as these are still based on the counting of paper ballots, and the electoral registers used for elections are held and maintained by individual Electoral Registration Officers in each local authority area.

However, the commission said the security breach highlights that organizations involved in elections remain a target and need to be ever vigilant.

“We regret that sufficient protections were not in place to prevent this cyber-attack,” Electoral Commission Chief Executive Shaun McNally said in a statement. “Since identifying it we have taken significant steps, with the support of specialists, to improve the security, resilience, and reliability of our IT systems.”

The oversight body has downplayed the seriousness of the attack for ordinary citizens, with McNally saying the data contained in the electoral registers is limited, and much of it is already in the public domain.

However the info held in the registers could be combined with other data in the public domain, such as that which individuals choose to share themselves, to infer patterns of behavior or to identify and profile individuals, the commission conceded.

Anyone who has been in contact with the commission, or who was registered to vote between 2014 and 2022, should remain vigilant for unauthorized use or release of their personal data, it added.

Professor Alan Woodward, a computer scientist at the University of Surrey in England who specializes in security, told us he didn’t think individuals have much to worry about: “There’s not enough information there for someone to go and cast a vote as you, and certainly not enough information to conduct ID theft.”

However, Prof Woodward said what was more concerning was the reputational damage to the Electoral Commission and the effect the incident might have on eroding public confidence in the democratic process.

“It doesn’t help if the organization responsible for the integrity of elections gets hacked,” he said, suggesting also that the perpetrator could be a hostile nation state rather than a gang of criminals.

• Election Excel blunder declared a ‘low point’ for Austrian social democracy
• Here come the riled MPs (it’s private, huh), Facebook’s a digital ‘gangster’ (‘disingen-u-ous’). Zuckerberg he is a failure (on sharing data)
• India explores blockchain-powered voting but not to enable online elections
• Let white-hat hackers stick a probe in those voting machines, say senators

Also worrying is the fact that the attackers had access to the Electoral Commission email system.

“Email is like the keys to the digital kingdom,” Prof Woodward told us, saying that it could potentially have given away a lot of information about the Electoral Commission and the way it works, and enable the intruders to target election officials. “It’s worrying and unsettling,” he said.

Other experts questioned how the attack could have gone unnoticed for so long and why the Electoral Commission waited until now to come clean about it.

“The way this attack has been handled should be questioned. How can it be that the incident was identified in October 2022, but that the general public – those impacted – are only hearing about it now?” asked Dominic Trott, director of Strategy and Alliances at Orange Cyberdefense.

“What remains more worrying is that the attack went undiscovered for 15 months and yet the authorities were not alerted of any abnormalities on their systems in that time,” said Jake Moore, Global Cybersecurity Advisor for security outfit ESET. “Cybercriminals work best in stealth mode but rarely are they undetected for this length of time.”

The Electoral Commission declined to provide information on whether it knew how many times its systems had been accessed during the 15-month period, if there was any evidence that its email system had been accessed in any way, and what the control systems are that the attackers supposedly had access to. ®