Holding safe elections under Coronavirus

The Covid-19 pandemic has added another layer of complexity to securing democratic elections.

Every country conducting an election during the pandemic must recognise that complexity and adjust accordingly, so that it can effectively defend against, detect and recover from any potential attacks, whether they are from foreign adversaries or cybercriminals.

Transatlantic democracies must recognise how changes in election administration in response to Covid-19 — such as mail-in ballot expansion — could impact the security of their elections.

Implementing new voting technologies and procedures for processing ballots, especially right before an election, can introduce new security risks.

How not to do it - Poland

For example, Poland, the first nation to hold a presidential election since the coronavirus outbreak, initially sought to hold its presidential election on short notice, entirely by mail, upon facing challenges with holding an in-person election during its coronavirus lockdown.

As part of this effort, Polish officials mandated that its postal service receive the country's voter-registration data.

The Polish postal service, which had no previous experience administering elections, then made the mistake of requesting voters' personal identifiable information via email from cities without implementing adequate security precautions, which could have made that information accessible to bad actors.

The presidential election was subsequently postponed and administered in a different manner, but such hasty decision-making should serve as a cautionary tale for other countries: altering election infrastructure without concurrently designing security and resiliency measures is likely to create additional vulnerabilities that adversaries can exploit.

Democracies must also ensure that measures to respond to public health concerns do not sacrifice election security.

If elections officials modify or expand their election infrastructure, unforeseen challenges may arise.

During the Washington, DC, primary election, the DC Board of Elections became "inundated with complaints from voters who said they didn't receive absentee ballots in the mail."

In a last-minute decision, driven in part by a desire to limit long lines, large crowds and a higher risk of Covid-19 spread, the Board of Elections allowed voters to submit ballots by email.

While election officials made this pronouncement with good intentions, returning ballots electronically is a highly insecure process.

As election officials move swiftly to alter their election systems in response to the pandemic, they should take proven measures to ensure that their voting processes are as secure as possible, such as bolstering their mail and/or in-person voting processes.

It is essential that democracies take steps to evaluate their current election infrastructure, through stress-testing and auditing, and take meaningful steps to fix any discovered gaps.

North Macedonia cyberattacks

This includes learning from other nations' challenges, such as North Macedonia, which suffered from high-profile cyberattacks during its July parliamentary elections and is in the midst of investigating the elections more broadly, and working to secure the digital election infrastructure.

Finally, democracies must encourage relevant stakeholders to seek out resources early and often.

Entities like the US Department of Homeland Security, France's National Cybersecurity Agency, and the UK's Centre for the Protection of National Infrastructure and National Cyber Security Centre play a key role in protecting the mechanics of their respective country's elections, even if they do not administer them.

They inform officials of improvements to electoral management software and provide protective security advice to election administrators and political parties.

Relevant stakeholders in upcoming elections, including government agencies, civil society actors and the private sector, should continually seek out these resources in the coming months.

Doing so will enable them to adopt incident response plans, so that they have the necessary skills and information to communicate and manage the election security challenges they could face.

In many transatlantic democracies, tensions are running high, due in no small part to Covid-19.

Any disruptions to the voting process risk inflaming these tensions further. Steps taken to address the public health risks associated with Covid-19 should make elections more secure, not less.

Doing otherwise could needlessly risk democracy's legitimacy.