The UK’s Electoral Commission has been the subject of an online attack that may have exposed the names and addresses of voters, as well as the Commission’s email system and unspecified other systems.
In a public notice on its site, the Commission said that the intrusion was identified in October 2022, after suspicious activity was detected on its systems, but that it was clear that the attackers had first accessed those systems more than a year earlier, in August 2021.
The Electoral Commission is an independent agency tasked with overseeing elections and regulating political financing in Britain. Its role is to ensure the integrity and transparency of party and election finance, and to oversee the electoral registration process.
It doesn’t help if the organization responsible for the integrity of elections gets hacked
As a consequence of its systems being penetrated, the attackers had access to the servers that host the Commission’s email, control systems, and copies of the electoral registers covering the entire country.
During the time period covered by the attack, the electoral registers held information including the name and address of anyone in the UK who registered to vote between 2014 and 2022, as well as the names of those registered as overseas voters. The registers did not include the details of anyone who registered anonymously.
The Commission told The Register in an email today that it is “currently under investigation by the Information Commissioner’s Office” and “cannot release any information that could compromise their investigation.” It did note, however, that the cyber-attack “included access to the Commission’s Exchange server, which holds our email system. This means that anyone who has contacted the Electoral Commission via email or through the webform on our website, will have provided data that was accessible as part of this attack.”
Since the attack was discovered, the Commission said it reported the incident to the National Cyber Security Centre (NCSC) and has been working with security specialists to investigate the incident. It has also taken action to secure its systems and reduce the risk of future attacks.
The Commission said it does not know who is responsible for the attack, and that no groups or individuals have so far claimed responsibility.
There is no suggestion that the breach allowed the attackers to alter the outcome of an election, as these are still based on the counting of paper ballots, and the electoral registers used for elections are held and maintained by individual Electoral Registration Officers in each local authority area.
However, the Commission said that this incident highlights that organizations involved in elections remain a target and need to remain vigilant.
“We regret that sufficient protections were not in place to prevent this cyber-attack,” Electoral Commission Chief Executive Shaun McNally said in a statement. “Since identifying it we have taken significant steps, with the support of specialists, to improve the security, resilience, and reliability of our IT systems.”
The Commission has downplayed the seriousness of the attack for ordinary citizens, with McNally saying that the data contained in the electoral registers is limited, and much of it is already in the public domain.
But it concedes that the data held in the registers could be combined with other data in the public domain, such as that which individuals choose to share themselves, to infer patterns of behavior or to identify and profile individuals.
It also advises that anyone who has been in contact with the Commission, or who was registered to vote between 2014 and 2022, should remain vigilant for unauthorized use or release of their personal data.
Professor Alan Woodward, a computer scientist at the University of Surrey who specializes in security, told us that he didn’t think individuals have much to worry about.
“There’s not enough information there for someone to go and cast a vote as you, and certainly not enough information to conduct ID theft.”
However, Woodward said what was more concerning was the reputational damage to the Electoral Commission and the effect the incident might have on eroding public confidence in the democratic process.
“It doesn’t help if the organization responsible for the integrity of elections gets hacked,” he said, adding that this suggested that the perpetrator was most likely a hostile nation state rather than a gang of criminals.
Also worrying is the fact that the attackers had access to the Electoral Commission email system.
“Email is like the keys to the digital kingdom,” Woodward told us, saying that it could potentially have given away a lot of information about the Electoral Commission and the way it works, and enable the attackers to target election officials. “It’s worrying and unsettling,” he said.
Other experts questioned how the attack could have gone unnoticed for so long and why the Electoral Commission waited until now to come clean about it.
“The way this attack has been handled should be questioned. How can it be that the incident was identified in October 2022, but that the general public – those impacted – are only hearing about it now?” asked Dominic Trott, director of Strategy and Alliances at Orange Cyberdefense.
“What remains more worrying is that the attack went undiscovered for 15 months and yet the authorities were not alerted of any abnormalities on their systems in that time. Cybercriminals work best in stealth mode but rarely are they undetected for this length of time,” said Jake Moore, Global Cybersecurity Advisor for security outfit ESET.
The Electoral Commission declined to provide information on whether it knew how many times its systems had been accessed during the 15-month period, if there was any evidence that its email system had been accessed in any way, and what the control systems are that the attackers supposedly had access to. ®