Alongside traditional canvassing, political parties can now get their messages across using the internet and social media, tools that have not only made it possible to reach large numbers of people but also, increasingly, to micro-target individuals with tailormade messages. This should, in theory, mean an electorate better informed than ever before.
But those same tools can easily be hijacked by malicious actors – both state and non-state – to subvert our democratic systems and be used as a weapon against us. And unfortunately, such interference has become increasingly common in the past few years, be it regarding a referendum on an EU agreement with Ukraine or a US presidential election.
Preventing our democratic processes, the very building blocks of our society, from being affected is not a concern for the future. It is a task of the utmost importance now, one that requires immediate action.
Indeed, we have been working on addressing this threat for a while and are looking to step up our response, together with our member states.
Attacks on elections and electoral campaigns fall into two main categories: those based on systems and those based on behaviours. The first category includes cyber-attacks that manipulate the electoral process or voting technology to change the number of voters or the number of votes.
But the second category of threat is much more subtle and harmful – attempts at manipulating voting behaviour. In my view, this can take three forms: hacks and leaks designed to change public opinion by revealing damaging information at a crucial point during a campaign; the use of fake news to sway public opinion and influence results; and the misuse of targeted messaging based on psychometrics derived from mined user personality trait data, such as in the Cambridge Analytica case.
So how are we responding to these challenges?
In terms of the systems threat, we drew up with member states a set of common guidelines on how to secure the whole election lifecycle from cyber-attacks. This work, carried out by member states under the leadership of Estonia and Czech Republic in the context of the NIS Cooperation Group, has resulted in a concrete set of recommendations and measures for national authorities in order to protect against “physical” cyber threats, ie the hacking of electronic tools, systems and databases used in the election process.
They are a compendium of practical measures that can be taken by cybersecurity organisations and election management bodies to secure the technology involved in elections, including electronic tools used in gathering votes; digital tools to transmit, process and count votes; and systems to publish election results. We now strongly encourage member states to make full use of them.
To counter behavioural threats, the European commission proposed a number of measures in April against disinformation and behavioural manipulation, including important steps that we expect the internet platforms to take to ensure that social media cannot be turned into a weapon against democracies.
We want to see genuine transparency, traceability and accountability online. Users should know who has created the content they are seeing, who might gain from it and why it is being shown to them.
We want platforms to step up their efforts to identify and delete fake accounts and establish clear rules around bots so that they cannot be passed off as human online. We want to make it easier for users to assess the trustworthiness of content, while also reducing the visibility of disinformation. And we would like to see greater clarity around how algorithms work.
Most pressingly, the measures include a code of practice to be adopted by internet platforms, which will require them to improve how adverts are placed, to restrict targeting options for political advertising and to reduce the revenues made by those behind disinformation. It will also promote greater transparency around sponsored content – marking it clearly as such and stating who has paid for it.
The code is being drawn up by representatives of the platforms, the advertising industry and advertisers. A first draft was presented to the commission earlier this month and it represents an important step forward, although it is not yet satisfactory and further work needs to be done in short time with a view to implementing the code by September. A sounding board of fact-checkers, academics, media and civil society organisations is now assessing the draft code and identifying areas for improvement.
In addition, we are organising a series of events for member states and other stakeholders to share best practices on how to keep our democratic processes secure. In October, we will convene a high-level meeting, bringing together national players in order to take stock of progress on the various fronts and to identify and share best practices for election security. This will in turn feed into the annual Colloquium on Fundamental Rights, hosted by my colleague Frans Timmermans, which this year will focus on democracy in the EU.
Beyond our efforts, there are many initiatives at national level where member states are taking measures in the light of forthcoming elections, while there is also strong transatlantic cooperation on this issue, which is discussed in the EU/US security and cyber dialogues and in the context of the Transatlantic Commission on Election Integrity.
We now need to step up this work and ensure that public authorities, as well as other actors – both public and private – are as prepared as possible. That means establishing plans at national level to guard against cyber-attacks and election interference.
To this end, we need every member state to assess comprehensively the threat to their democratic processes and institutions, whether from more traditional cyber-attacks or from the manipulation of information. Political parties themselves need to set an example – they could, for example, consider committing to certain standards of transparency and openness when it comes to their own online campaigns, such as the targeting of political messages via social media, in order to set the right example.
This is an ongoing and urgent issue, not least with the European elections coming up next May, and we are not resting on our laurels – we are constantly in the process of analysing the situation to see if we need to take any more action. Because while elections in Europe may have changed in their appearance over the past decade or so, the underlying need to ensure they are free, fair and without interference has not.