Cybersecurity in Elections Models of Interagency Collaboration Sam van der Staak and Peter Wolf © 2019 International Institute for Democracy and Electoral Assistance This publication is independent of specific national or political interests. Views expressed in this publication do not necessarily represent the views of International IDEA, its Board or its Council members. The electronic version of this publication is available under a Creative Commons Attribute- NonCommercial-ShareAlike 3.0 (CC BY-NC-SA 3.0) licence. You are free to copy, distribute and transmit the publication as well as to remix and adapt it, provided it is only for non-commercial purposes, that you appropriately attribute the publication, and that you distribute it under an identical licence. For more information on this licence visit the Creative Commons website: <http://creativecommons.org/licenses/ by-nc-sa/3.0/>. International IDEA Strömsborg SE–103 34 Stockholm Sweden Telephone: +46 8 698 37 00 Email: [email protected] Website: <http://www.idea.int> Design and layout: International IDEA Cover image: ID 125793633 © Blackboard373 | Dreamstime.com DOI: <https://doi.org/10.31752/idea.2019.23> ISBN: 978-91-7671-255-9 Created with Booktype: <https://www.booktype.pro> International IDEA Contents Preface ......................................................................................................................... 6 Acknowledgements .................................................................................................... 7 Abbreviations ............................................................................................................. 8 Definitions and scope of this document ................................................................ 10 1. Introduction .......................................................................................................... 12 2. Cyberthreats throughout the electoral cycle ..................................................... 15 2.1. Attacks targeting election-related technologies ................................................ 15 2.2. Vulnerabilities ................................................................................................ 18 2.3. Disinformation targeting the perceived integrity of the electoral process ........ 19 2.4. Adversaries ..................................................................................................... 23 2.5. Mitigation measures ....................................................................................... 24 2.6. The need for interagency collaboration .......................................................... 25 3. Models of interagency collaboration ................................................................. 27 3.1. Number and type of agencies involved ........................................................... 27 3.2. Dedicated forums and administrative bodies .................................................. 29 3.3. Cooperation between different levels of the EMB .......................................... 29 3.4. Cooperation with non-state agencies .............................................................. 30 4. Operationalizing interagency collaboration ..................................................... 32 4.1. Focus areas ..................................................................................................... 32 4.2. Setting up and facilitating interagency collaboration ...................................... 36 5. Conclusions and recommendations .................................................................. 40 Annex A: Case studies ............................................................................................. 43 Australia ................................................................................................................ 43 Austria .................................................................................................................. 45 Bulgaria ................................................................................................................. 46 Canada .................................................................................................................. 49 Denmark ............................................................................................................... 54 Estonia .................................................................................................................. 57 European Union ................................................................................................... 60 Finland ................................................................................................................. 63 Georgia ................................................................................................................. 67 Latvia .................................................................................................................... 69 Mexico .................................................................................................................. 71 Moldova ................................................................................................................ 73 The Netherlands ................................................................................................... 74 Norway ................................................................................................................. 76 Romania ............................................................................................................... 77 South Africa .......................................................................................................... 79 Sweden .................................................................................................................. 81 Ukraine ................................................................................................................. 84 United Kingdom ................................................................................................... 86 United States of America ....................................................................................... 89 References and further reading .............................................................................. 93 About the authors .................................................................................................... 98 About International IDEA ......................................................................................... 99 Cybersecurity in Elections Preface Information and communication technologies are increasingly prevalent in electoral management and democratic processes. These technologies offer numerous new opportunities, but also new threats. Cybersecurity is currently one of the greatest electoral challenges, even for countries without any form of electronic voting. It involves a broad range of actors, including electoral management bodies, cybersecurity expert bodies and security agencies. Many countries have found that interagency collaboration is essential for defending elections against digital threats. In recent years significant advances have been made in organizing such collaboration at the domestic and international levels. This guide tracks how countries are making progress on improving cybersecurity in elections. Based on an extensive collection of 20 case studies from all over the world, it provides lessons for those wanting to strengthen their defences against cyberattacks. As digital developments affect more of our societies every day, all countries will need to invest in protecting their elections from cyberthreats. We hope this guide will succeed in sharing these cybersecurity experiences with audiences far beyond the countries that had an opportunity to participate in our activities. International IDEA 6 International IDEA Acknowledgements Acknowledgements This Guide was developed in cooperation between the International IDEA’s Regional Europe Programme and Global Programme. Invaluable input, case study interviews and presentations were provided by individuals at a range of institutions, including the Australian Electoral Commission, the Austrian Federal Ministry of Interior, the Central Election Commission of the Republic of Bulgaria, Election Canada, the Ministry of Economic Affairs and the Interior in Denmark, the State Electoral Office of Estonia, the Cybersecurity Branch of the Estonian Information System Authority, the Finnish Legal Register Centre, the Georgian Central Election Commission, the State Chancellery of Latvia, the Central Election Commission of Latvia, the Central Election Commission of Lithuania, the Instituto Nacional Electoral of Mexico, the Central Electoral Commission of the Republic of Moldova, the Dutch Electoral Council, the Permanent Election Authority of Romania, the Independent Election Commission of South Africa, the Swedish Election Authority and the Swedish Civil Contingencies Agency, the Security Service of Ukraine, the UK Electoral Commission, the UK National Cybersecurity Centre and the US Election Assistance Commission. The Guide benefited from valuable input and suggestions from colleagues at International IDEA, including Therese Pearce Laanela and Adina Trunk, as well as diligent editing and note taking by Alyssa Bittner-Gibbs, Oliver Joseph, Dominika Michalak and Maryam Safi. We also extend our appreciation to Lisa Hagman and Lucy Smith for overseeing the production of this Guide. International IDEA 7 Cybersecurity in Elections Abbreviations CEC Central