IT sector advises Swedish government on elections and voting system

The security measures assembled and implemented around the 2018 election in Sweden were devised in consultation with leading actors within Sweden’s private IT sector.

The primary role of the IT suppliers was to advise government panels, which included the national security service (Säpo), the National Police Board (Rikspolisstyrelsen), the National Civil Contingencies Agency and the National Election Authority.

Säpo was at the head of a government-commissioned election taskforce that organised an IT-based protective shield around the voting process and implemented measures to minimise hostile external inference.

The main threats come by way of malicious attacks against IT-voting infrastructure from cyber space, or the potential risk of foreign-based entities launching propaganda and misinformation wars against political parties or individual politicians.  

The level of security expertise mobilised to protect the trustworthiness of the election result in Sweden ranged from a direct collaborative input from the Swedish Defence Force’s Cyber Defence Centre to creating consulting roles for leading companies operating within Sweden’s cyber security domain.

The higher level of security in the 2018 election reflected deep and genuine concerns within government quarters regarding the potential for serious external interference to distort the nature of political information and policy messages circulated by campaigning parties.

Moreover, the election task force feared active manipulation of the election result through electronic interference with the national voting system. Such concerns were deemed to be more than justified given the well-documented efforts by external forces to disrupt parliamentary votes and elections both in Europe and the United States since 2014.

Despite the added layers of new security measures built into the 2018 election system, Säpo continued to observe events and combat attempts to damage confidence in the national voting process as Swedes headed to polling stations on 9 September.

“The activities we saw are within the range of what we expected,” said Linda Escar, the deputy chief of Säpo’s Protective Security Unit. “The important thing is that the election and result were well protected.”

The malicious activities identified by Säpo included the use of hijacked and fake social media accounts; disinformation spread over social media to polarise the political loyalties of voters; and DDoS attacks and hacking attempts that targeted both political parties and key election services.

There were some notable pre-election strikes by malicious entities from cyber space. A series of DDoS attacks were launched against the website of the ruling centre-left Social Democratic Party in August. The attacks were tracked to IP addresses which both Säpo and the SDP’s IT security team believe were located in Russia and North Korea.

“The attacks were serious, but because we were well prepared, it [only] forced the website offline for short periods,” said Helena Salomonson, the SDP’s director of communications. “We can only suspect the hackers were trying to access and disrupt information about our campaign strategies and policies.”

The election taskforce’s consultations with the private ICT-sector covered all core security enhancement areas, with a special focus on how best to enable government agencies and political parties to protect their critical functions from IT attacks.

“What we can now see is that the preventive efforts we have engaged in since early 2017 have paid off,” said Säpo’s Escar. “The public is more aware and alert than before, and this has increased national resilience. We have an election system that is difficult to influence, and this will continue to ensure a legitimate election result.”