DEFENDING DIGITAL DEMOCRACY PROJECT Catching Swedish Phish How Sweden is Protecting its 2018 Elections Gabriel Cederberg PAPER AUGUST 2018 Belfer Center for Science and International Affairs Harvard Kennedy School 79 JFK Street Cambridge, MA 02138 www.belfercenter.org Statements and views expressed in this report are solely those of the author and do not imply endorsement by Harvard University, the Harvard Kennedy School, the Belfer Center for Science and International Affairs, or the U.S. Goverment. Design & layout by Andrew Facini Cover photo: Eleven days before the 2018 election, the back side of the Swedish parliament is reflected in the water in Stockholm, Sweden. (AP Photo/Michael Probst) Copyright 2018, President and Fellows of Harvard College Printed in the United States of America DEFENDING DIGITAL DEMOCRACY PROJECT Catching Swedish Phish How Sweden is Protecting its 2018 Elections Gabriel Cederberg PAPER AUGUST 2018 About the Author Gabriel Cederberg is a rising sophomore at Harvard College, studying Government with a secondary in Economics. He has grown up speaking Swedish at home in Minnesota and has visited family in Sweden throughout his life. Since December 2017, he has worked as a Research Assistant at the Belfer Center’s Defending Digital Democracy Project. Acknowledgments I would like to thank Eric Rosenbach and the Belfer Center for support- ing my research. I am also grateful to Simon Jones for his help during the final editing process. Finally, a big thank you to everyone—both named and unnamed in this report—who took time during the busiest part of the election cycle to speak with me. Your insights have helped me navigate this research process. ii Catching Swedish Phish: How Sweden is Protecting its 2018 Elections Table of Contents Executive Summary ...........................................................................1 Introduction and Project Approach ................................................. 3 Strategic Context ..............................................................................4 Threat Overview ............................................................................................................ 4 Sweden as a Strategic Target ..................................................................................... 7 Malign Actors ................................................................................................................ 9 Part 1: Fortifying the Government ................................................. 11 1.1 Clear Communication Around Cyber Threats ................................................... 11 1.2 Cyber Defense Investment .................................................................................13 1.3 A High-Level National Forum for Cyber Coordination ......................................15 1.4 Expanding Military Force Posture .......................................................................16 1.5 Bolstering Campaign Cybersecurity .................................................................19 1.6 Decentralized Election Administration ...............................................................21 Part 2: Strengthening the Traditional Media ...............................23 2.1 Government Coordination with Mass Media .................................................... 23 2.2 High-Visibility Fact Checking .............................................................................. 24 2.3 Mitigating Information Operations on Social Media .......................................26 Part 3: Empowering the People .....................................................28 3.1 Educating People to be Conscious Media Users .............................................28 3.2 Preparing for the Worst ......................................................................................29 Shortcomings and Challenges .......................................................30 Conclusion .......................................................................................33 Glossary ....................................................................................................................... 35 Endnotes .....................................................................................................................38 Belfer Center for Science and International Affairs | Harvard Kennedy School iii Eleven days before the 2018 election, the back side of the Swedish parliament is reflected in the water in Stockholm, Sweden. (AP Photo/Michael Probst) Executive Summary Alarmed by Russia’s brazen interference in the 2016 US Election, Sweden began preparing for its September 2018 election in earnest. Over the past year and a half, Sweden has created a comprehen- sive strategy based on a clear understanding of the threat; it has learned lessons from other targeted elections; and it has developed a whole-of-society defense—mobilizing not just the government, but also the Swedish media and Swedish citizens. Going forward, countries around the world should study and imple- ment these eight key components of Sweden’s whole-of-society election defense: • Clear condemnation of election interference. The Swedish Prime Minister explicitly stated in January 2018 that any foreign interference in the election would not be tolerated. This condemnation set the national tone towards election interference. • Prioritizing election infrastructure. Sweden has designated its election systems as a component of critical infrastructure by appointing the Swedish government’s crisis preparation and response agency as the head authority for election coor- dination. The agency’s efforts have included comprehensive threat analysis and penetration testing of election systems, as well as the training of over 10,000 civil servants and election administrators to recognize ongoing influence operations. • High-level interagency coordination. Sweden created a national forum between four key security agencies dedicated to coordinating the 2018 election. While the reporting lines between these organizations have not been altered as a result of the forum, the forum serves as a national platform for election planning, preparation, and protection. • Efforts to improve public media literacy. Sweden’s numerous public and private sector efforts to improve media literacy Belfer Center for Science and International Affairs | Harvard Kennedy School 1 have bolstered the public’s psychological defense to information operations. The nationwide high school “fake news” curriculum is an unprecedented commitment to confronting influence operations long-term. • Strengthening military force posture. By re-introducing military conscription, increasing the military budget, performing large-scale military exercises, and signing new international defense agree- ments, Sweden has raised the perceived cost of election interference for potential adversaries. • Improving cyber detection and response capabilities. Sweden’s National Defense Radio Establishment has evolved into a high-powered cyber detection group. The agency has also begun cooperating with the Swedish Armed Forces on critical cyber threats. • Coordination with the traditional media. The Swedish government’s continuous discussion about cybersecurity and crisis-preparation with traditional media outlets has the potential to be a crucial stabilizing force in the event of a national crisis— election related or otherwise. • High-visibility fact-checking collaboration. Five of Sweden’s largest media outlets have created a fact-checking collaborative to bring increased attention to each organization’s independent fact-checking efforts. 2 Catching Swedish Phish: How Sweden is Protecting its 2018 Elections Introduction and Project Approach For Sweden’s 2018 election, the stakes are extremely high. The election is not just about letting a country of 10 million decide which parties they want in parliament for the next four years. It is about determining whether a whole-of-society approach to election security can protect an election that is firmly in Russia’s crosshairs. The objective of this report is to first examine the actions and aspects of Sweden’s whole-of-society defense against foreign interference in the 2018 election and then to extract key strategic takeaways for protecting demo- cratic processes going forward. Over the course of writing this report, I consulted articles, research reports, government publications, and pieces of legislation. I watched interviews, panel discussions, and political speeches. I visited Swedish government agencies, political campaign headquarters, media offices, think tanks, and cybersecurity consultancies to speak with 18 experts and operatives who comprise Sweden’s frontline defense from day to day. Following the Strategic Context, this report is divided into three main sec- tions, corresponding to the three components of Sweden’s whole-of-society defense: fortifying the government, strengthening the traditional media, and empowering the Swedish people. Agency names, acronyms, and tech- nical terms are defined in the Glossary. Belfer Center for Science and International Affairs | Harvard Kennedy School 3 Strategic Context In recent years, cyber and information operations have increasingly been used to undermine democratic processes around the world. Because of Sweden’s non-membership in the North Atlantic Treaty Organization (NATO), as well as its important role in international diplomacy, Sweden is a tactical target for election meddling. Already experiencing its own domestic tensions, Sweden