Abstract

Election security stands as an indispensable pillar of democratic governance, underpinning the legitimacy of elected officials, the integrity of policy-making, and the foundational trust citizens place in their institutions. The digital transformation of electoral processes, while offering enhanced efficiency and accessibility, has simultaneously introduced a complex array of sophisticated threats that transcend traditional physical vulnerabilities. Recent significant incidents, such as the protracted 2021–2022 cyberattack on the UK’s Electoral Commission, unequivocally highlight the global, pervasive, and multifaceted challenges confronting nations in their efforts to safeguard the electoral ecosystem. This extensive report meticulously examines the diverse spectrum of threats imperiling election security, including the evolving sophistication of cyberattacks, the pervasive influence of disinformation and misinformation campaigns, subtle and overt forms of voter manipulation, and the persistent risk of physical interference. It further delves into the imperative implementation of robust cybersecurity best practices tailored for electoral bodies, explores the critical role of multilateral international cooperation in a borderless threat landscape, and delineates strategic approaches for building, restoring, and steadfastly maintaining public trust in electoral outcomes amidst an era characterised by continuous, advanced, and often state-sponsored adversarial activities. By synthesising lessons from high-profile incidents, scholarly research, and expert recommendations, this report aims to provide a comprehensive and nuanced analysis essential for practitioners, policymakers, and academics engaged in preserving democratic integrity.

1. Introduction

The integrity of electoral processes forms the bedrock upon which democratic societies are constructed. It is the mechanism through which citizens express their collective will, bestow legitimacy upon their leadership, and ultimately shape the trajectory of their nations. Without fair, transparent, and secure elections, the principles of self-governance and popular sovereignty are fundamentally undermined, leading to civic disengagement, political instability, and a pervasive erosion of public confidence in the democratic system itself. In the contemporary era, the increasing reliance on digital technologies across every stage of the electoral lifecycle—from voter registration and ballot casting to tabulation and results dissemination—has dramatically reshaped the landscape of election security. This technological integration, while streamlining operations and enhancing accessibility, has simultaneously exposed democratic infrastructures to an unprecedented array of sophisticated and dynamic threats that necessitate a profound and holistic understanding.

This report undertakes a comprehensive examination of the multifaceted nature of election security in the 21st century. It transcends a mere catalogue of threats to offer an in-depth analysis of the systemic vulnerabilities inherent in modern electoral systems and the advanced capabilities of malicious actors. Drawing upon insights gleaned from critical recent incidents, such as the extensive cyber breach of the UK’s Electoral Commission, alongside a robust body of scholarly research, government reports, and expert analyses, this document seeks to provide a nuanced perspective on the current state of electoral vulnerabilities globally. The objective is to elucidate the intricate interplay between technological safeguards, human factors, and institutional resilience required to protect the democratic process. By meticulously dissecting prevalent threats, proposing actionable best practices in cybersecurity, underscoring the indispensable value of international collaboration, and outlining strategies for fostering and preserving public trust, this report aims to furnish a foundational resource for strengthening the integrity and resilience of elections worldwide.

2. The Evolving Landscape of Election Security

Many thanks to our sponsor Esdebe who helped us prepare this research report.

2.1 Historical Context of Electoral Threats

Historically, the security of elections was predominantly conceptualised through a lens of physical vulnerabilities and direct human intervention. Concerns largely revolved around tangible acts of manipulation designed to alter outcomes or suppress participation. Early forms of election interference included explicit ballot stuffing, where fraudulent votes were added to ballot boxes; chain voting, a method involving the removal of blank ballots from polling places to be marked elsewhere and then illegally inserted; and the intentional miscounting or altering of vote totals by corrupt election officials. Voter intimidation was also a rampant issue, manifesting through threats of violence, economic repercussions, or social ostracisation, particularly targeting marginalised communities to dissuade them from exercising their franchise.

Throughout the 19th and early 20th centuries, political machines, such as New York’s Tammany Hall, notoriously perfected methods of electoral fraud, exploiting loosely regulated systems to maintain power through patronage and corruption. Countermeasures during this era primarily involved increasing the physical security of ballot boxes, implementing rudimentary voter registration systems, introducing independent poll watchers to observe proceedings, and enacting stricter election laws. The advent of mechanical voting machines in the late 19th century and lever machines in the early 20th century aimed to automate counting and reduce human error and physical tampering, yet these, too, presented their own vulnerabilities, often susceptible to mechanical rigging or deliberate miscalibration. The infamous ‘hanging chad’ controversy during the 2000 US presidential election, a direct consequence of flawed punch-card ballot designs, starkly highlighted that even seemingly simple technological failures could have profound and far-reaching impacts on election outcomes and public confidence, preceding the widespread adoption of purely electronic systems. This historical evolution underscores a continuous adaptation by adversaries and guardians of democracy, a pattern that has only intensified with digital transformation.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

2.2 Technological Advancements and New Vulnerabilities

The late 20th and early 21st centuries witnessed a profound shift in election administration, driven by the pervasive integration of digital technologies. While promising increased efficiency, accessibility, and transparency, this technological embrace simultaneously introduced an entirely new, complex, and often invisible layer of vulnerabilities. The digital infrastructure supporting modern elections is no longer confined to isolated voting machines; it encompasses sophisticated networks of voter registration databases, electronic poll books, election management systems for ballot creation and tabulation, websites for voter information and results reporting, and even election night reporting systems. Each of these components represents a potential vector for attack, creating an expansive attack surface that demands rigorous and continuous protection.

2.2.1 The Case of the UK’s Electoral Commission Cyberattack (2021–2022)

The cyberattack on the UK’s Electoral Commission, initially detected in October 2022 but found to have commenced in August 2021, serves as a stark contemporary illustration of these emergent vulnerabilities and the profound consequences of their exploitation. The incident involved sophisticated threat actors exploiting unpatched software vulnerabilities in the Commission’s Microsoft Exchange Server system, a critical piece of infrastructure managing internal communications and potentially external-facing services. This exploit allowed the attackers to gain unauthorised access and maintain persistent presence within the Commission’s network for an extended period of over a year, during which time they exfiltrated sensitive personal data pertaining to approximately 40 million registered voters. This dataset included names, addresses, email addresses, phone numbers, and images of some voters, alongside non-electoral Commission email systems, which could contain highly sensitive organisational data (ico.org.uk, electoralcommission.org.uk).

The protracted nature of the breach, its belated detection, and the sheer volume of compromised data highlighted significant operational and technical deficiencies within the Electoral Commission’s cybersecurity posture. The Information Commissioner’s Office (ICO) reprimanded the Commission, citing specific failings in its implementation of robust security patching mechanisms and its password management protocols. The ICO noted that the attack was ‘entirely preventable’ had fundamental cybersecurity measures been in place and rigorously enforced (ico.org.uk, techcrunch.com). The UK government, in a rare move, publicly attributed the attack to Chinese state-linked actors, specifically the Advanced Persistent Threat (APT) group known as APT31, alongside another entity, in a coordinated response with international partners including the US, New Zealand, and Australia (gov.uk). This attribution underscored the reality of state-sponsored cyber warfare targeting democratic institutions, aiming not necessarily to alter election results directly, but to sow distrust, gather intelligence for future influence operations, and demonstrate capabilities.

The consequences of such a breach extend far beyond the immediate technical compromise. The exfiltrated data, particularly voter registration details, can be leveraged for sophisticated phishing campaigns, targeted disinformation efforts aimed at specific demographics, or even identity theft, thereby undermining individual privacy and electoral integrity. Moreover, the incident significantly eroded public trust in the Electoral Commission’s ability to protect sensitive citizen data and safeguard the democratic process, prompting calls for enhanced governmental oversight and substantial investment in cybersecurity infrastructure for critical national entities (techradar.com). The UK Electoral Commission incident serves as a critical global case study, illustrating the profound risks associated with technological reliance in elections without commensurate, continuously updated, and robust cybersecurity defences.

3. Threats to Election Security

The spectrum of threats to election security is expansive and dynamic, continuously evolving in sophistication and methodology. These threats emanate from a diverse range of actors, including state-sponsored groups, cybercriminal organisations, hacktivists, and even domestic political actors. Understanding the distinct characteristics and potential impacts of these threats is paramount for developing effective countermeasures.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

3.1 Cyberattacks on Electoral Systems and Infrastructure

Cyberattacks constitute one of the most significant and rapidly evolving threats to contemporary election security. These attacks target various components of the electoral infrastructure, ranging from voter registration databases to election night reporting systems. Their primary objectives often include data exfiltration, disruption of operations, manipulation of information, or erosion of public confidence.

3.1.1 Types of Cyberattacks and Their Impact

• Data Breaches and Exfiltration: As exemplified by the UK’s Electoral Commission incident, adversaries frequently target voter registration databases, which contain extensive personal information (names, addresses, birthdates, electoral history). Such breaches can facilitate identity theft, enable highly granular targeted disinformation campaigns, and provide valuable intelligence for future influence operations. Beyond voter data, attacks may target databases holding information on election workers, political parties, or campaign donors, potentially leading to blackmail, internal disruption, or compromised campaign strategies.

• Ransomware Attacks: These attacks involve encrypting critical electoral systems or data and demanding a ransom for their release. A successful ransomware attack on voter registration systems, electronic poll books, or tabulation software could severely disrupt election day operations, delay results, or even force a reliance on less efficient manual processes. While typically financially motivated by criminal groups, state actors could employ ransomware to create chaos and undermine trust in the democratic process without direct vote manipulation (cisa.gov).

• Distributed Denial-of-Service (DDoS) Attacks: DDoS attacks aim to overwhelm election-related websites or online services with a flood of malicious traffic, rendering them inaccessible. This could include voter information portals, candidate registration sites, or election night results reporting websites. While not directly altering votes, DDoS attacks can create confusion, prevent voters from accessing critical information, suppress turnout by making it harder to find polling places, and fuel narratives of a dysfunctional or compromised election.

• Malware and System Compromise: Adversaries might deploy malware to gain persistent access to electoral networks, monitor activities, or even subtly alter system functionalities. Such compromises could target election management systems responsible for programming voting machines or consolidating results, creating opportunities for more direct, albeit highly difficult to detect, vote manipulation. The sophisticated nature of these attacks often requires advanced forensic capabilities to uncover.

• Insider Threats: While external attacks dominate headlines, insider threats—whether malicious, negligent, or compromised employees—pose a significant risk. An individual with privileged access could intentionally alter data, introduce vulnerabilities, or inadvertently expose systems due to poor security practices. Robust access controls, background checks, and continuous monitoring are crucial for mitigating this internal vector.

• Supply Chain Attacks: Modern electoral systems often rely on a complex ecosystem of third-party hardware, software, and service providers. A supply chain attack, where an adversary compromises one of these vendors, can introduce vulnerabilities into the electoral system before it even reaches election officials. This was famously demonstrated by the SolarWinds attack, which impacted numerous government agencies, underscoring the interconnectedness and inherent risks of digital supply chains.

The cumulative impact of cyberattacks extends beyond technical damage. Even if an attack does not directly alter vote counts, the perception of a compromised system can severely erode public confidence in the legitimacy of the election, regardless of the actual outcome. This erosion of trust is often a primary strategic objective of sophisticated state-sponsored actors.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

3.2 Disinformation and Misinformation Campaigns

The digital age, particularly the proliferation of social media platforms, has created an unprecedented environment for the rapid and widespread dissemination of disinformation and misinformation. While often used interchangeably, it is crucial to distinguish between the two: disinformation refers to intentionally false or misleading information spread with malicious intent, whereas misinformation refers to false or inaccurate information spread without malicious intent, often due to genuine misunderstanding or error.

3.2.1 Methods and Objectives

• Social Media Manipulation: Bots, troll farms, and coordinated inauthentic behaviour are deployed to amplify false narratives, sow discord, and target specific demographics with divisive content. These campaigns can create artificial trends, make fringe views appear mainstream, and overwhelm legitimate information sources.

• Deepfakes and Synthetic Media: Advances in artificial intelligence have enabled the creation of highly realistic but fabricated audio, video, and images (deepfakes). These can be used to impersonate candidates, spread fabricated scandalous statements, or create convincing but entirely false narratives designed to influence public opinion or delegitimise opponents. The ‘cheapfake,’ a simpler form of manipulated media often created with readily available tools, also poses a significant threat due to its ease of production and potential for rapid spread.

• Exploitation of Traditional Media and News Cycles: Adversaries often attempt to inject disinformation into legitimate news ecosystems, hoping it will be picked up by unsuspecting journalists or spread virally before fact-checking mechanisms can react. This strategy leverages the perceived credibility of traditional media to legitimise false narratives.

• Voter Suppression Narratives: Disinformation campaigns frequently target specific voter groups with false information about polling locations, election dates, eligibility requirements, or voting methods (e.g., claiming online voting is available when it is not). The objective is to confuse voters, discourage participation, or direct them to incorrect resources.

• Delegitimisation of Electoral Processes: A common tactic involves spreading narratives that question the integrity of the voting process itself, claiming widespread fraud, machine rigging, or conspiracy theories. These efforts aim to undermine public trust in the election results, regardless of their accuracy, and can contribute to post-election unrest or non-acceptance of outcomes.

3.2.2 The Global Challenge and Industry Response

The global scale of this threat prompted a significant response in 2024, when leading technology companies, including Adobe, Amazon, Google, IBM, Meta, Microsoft, OpenAI, and TikTok, signed a voluntary agreement to combat AI-generated election disinformation. This initiative, while a welcome step, highlights the immense challenge of detecting, labelling, and responding to rapidly evolving synthetic media and misleading content at scale (apnews.com). The challenge lies not only in technological detection but also in addressing the psychological vulnerabilities that make individuals susceptible to such content, especially when it aligns with pre-existing biases or reinforces existing grievances. Effective countermeasures require a multi-pronged approach involving technological solutions, media literacy education, robust fact-checking, and rapid, transparent communication from electoral authorities.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

3.3 Voter Manipulation

Voter manipulation encompasses a range of deceptive tactics designed to influence voter behaviour, participation, or preferences through illicit or unethical means. Distinct from disinformation, which primarily focuses on information content, voter manipulation often involves direct actions or strategies that specifically target the act of voting or the perceived fairness of the process.

3.3.1 Tactics and Mechanisms

• Targeted Micro-targeting with Deceptive Content: Leveraging vast amounts of personal data, potentially acquired through data breaches (like the UK Electoral Commission incident), political actors or adversaries can micro-target specific demographics with tailored deceptive messages designed to suppress their vote or shift their allegiance. This can involve creating highly personalised advertisements or social media content that appeals to individual anxieties or biases.

• False Information about Voting Procedures: This tactic involves actively disseminating incorrect information regarding polling place locations, hours of operation, voter registration deadlines, or required identification. Such misinformation, whether spread online, via misleading phone calls, or through flyers, aims to disenfranchise voters by making it difficult or impossible for them to cast a legitimate ballot.

• Ballot Harvesting (Where Illegal): In jurisdictions where it is prohibited, ‘ballot harvesting’ refers to the practice of third parties collecting and submitting absentee or mail-in ballots on behalf of other voters. While sometimes legal and practiced by campaigns, when conducted illegally, it can open avenues for coercion, fraud, or tampering with ballots, compromising the sanctity of the vote.

• Challenging Legitimate Voters: Organised efforts to challenge the eligibility of legitimate voters at polling places, often based on spurious grounds, can create long lines, intimidate voters, and ultimately prevent eligible citizens from casting their ballots. This tactic disproportionately affects minority groups and those with less access to resources to resolve such challenges.

• Vote Buying and Coercion: Although less common in mature democracies, vote buying (exchanging votes for money or favours) and coercion (using threats or intimidation to force a vote) remain significant forms of manipulation in certain contexts, particularly in regions with less robust electoral oversight or where poverty makes individuals vulnerable to exploitation.

3.3.2 Impact on Democratic Principles

Voter manipulation fundamentally undermines the democratic principle of free and fair choice. It distorts the will of the electorate by interfering with informed decision-making and equal participation. The misuse of personal data, in particular, raises significant ethical and privacy concerns, as it allows sophisticated actors to exploit individual vulnerabilities for political gain. The long-term effect is a severe degradation of public confidence in the fairness of the democratic contest, leading to a perception that outcomes are engineered rather than genuinely representative of popular will.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

3.4 Physical Interference and Hybrid Threats

While the digital realm increasingly dominates discussions on election security, traditional physical threats remain pertinent, particularly in contexts where digital safeguards are nascent or where adversaries seek direct, tangible disruption. Furthermore, the modern threat landscape often presents a ‘hybrid’ challenge, where physical and cyber tactics are combined to achieve maximum impact.

3.4.1 Manifestations of Physical Interference

• Ballot Tampering: This includes direct alteration of physical ballots, illegal substitution of pre-marked ballots, or destruction of legitimate ballots. Such acts often occur during periods of ballot transport, storage, or manual counting, underscoring the importance of robust chain-of-custody protocols.

• Voter Intimidation at Polling Places: Beyond the historical context, modern forms of intimidation include aggressive behaviour by partisan poll watchers, organised protests near polling entrances, or even implicit threats designed to deter voters. The presence of armed groups or individuals near polling sites has become a growing concern in some jurisdictions, particularly in the United States, raising questions about election worker safety and voter accessibility.

• Damage or Theft of Voting Equipment: Physical attacks on polling stations or election offices can involve damaging voting machines, electronic poll books, ballot boxes, or computer servers. The theft of equipment, particularly sensitive devices that store voter data or are used for vote tabulation, presents risks for both disruption and potential future system compromise.

• Disruption of Election Day Operations: This can manifest as organised protests blocking access to polling places, deliberate creation of chaos, or even acts of violence targeting election staff or voters. Such disruptions aim to suppress turnout, create an atmosphere of fear, and delegitimise the election process through visible disorder.

• Targeting Election Workers: There has been a concerning increase in threats, harassment, and even violence directed at election officials and poll workers. These attacks, often fuelled by online disinformation, aim to deter dedicated public servants from participating in election administration, thereby weakening the institutional capacity to conduct secure elections (eac.gov).

3.4.2 The Hybrid Threat Nexus

The most dangerous scenarios often involve a convergence of physical and cyber threats. For instance, a cyberattack could be launched to disrupt voter registration systems just as physical intimidation tactics are deployed at polling stations, creating a synergistic effect of chaos and confusion. Online disinformation campaigns might incite physical protests or calls for violence against election officials, transforming digital narratives into real-world threats. This hybrid approach leverages the anonymity and reach of the internet to coordinate and amplify physical disruptions, making detection and mitigation significantly more complex. Safeguarding against these evolving hybrid threats requires a comprehensive security strategy that integrates both physical security protocols and robust cybersecurity measures, alongside strong intelligence gathering and law enforcement capabilities.

4. Best Practices in Cybersecurity for Electoral Bodies

Protecting the integrity of elections in the digital age requires electoral bodies to adopt a proactive, comprehensive, and continuously evolving cybersecurity posture. This involves not only implementing cutting-edge technologies but also fostering a culture of security awareness, establishing robust processes, and ensuring resilient infrastructure. The US Cybersecurity and Infrastructure Security Agency (CISA) provides a valuable framework for these best practices, which can be adapted globally (cisa.gov).

Many thanks to our sponsor Esdebe who helped us prepare this research report.

4.1 Implementing Comprehensive Cybersecurity Frameworks

Electoral bodies must move beyond ad-hoc security measures towards the adoption of recognised, holistic cybersecurity frameworks. These frameworks provide a structured approach to identifying, protecting, detecting, responding to, and recovering from cyber threats.

• NIST Cybersecurity Framework: The National Institute of Standards and Technology (NIST) Cybersecurity Framework offers a flexible, risk-based approach that can be tailored to the unique context of election systems. It guides organisations in managing cybersecurity risks, improving communication, and fostering a shared understanding of threats.

• ISO 27001: Adherence to international standards like ISO 27001 provides a robust foundation for an Information Security Management System (ISMS). This standard mandates a systematic approach to managing sensitive company information so that it remains secure, encompassing people, processes, and IT systems.

• Specific CISA Guidelines: CISA advocates for several critical practices, including:

  • Credential Management: Implementing strong, unique passwords for all accounts, mandating regular password changes, and strictly enforcing multi-factor authentication (MFA) across all systems, especially for administrative access and remote connections. MFA significantly reduces the risk of unauthorised access even if credentials are stolen.
  • Network Segmentation: Isolating critical election systems (e.g., voter registration databases, tabulation servers) from less secure general administrative networks. This ‘air gap’ or logical separation prevents the lateral movement of adversaries once they gain access to a less sensitive part of the network.
  • Principle of Least Privilege: Granting users and systems only the minimum necessary access rights required to perform their functions. This limits the damage an attacker can inflict if a particular account or system is compromised.
  • Data Encryption: Encrypting sensitive data both in transit (e.g., using TLS/SSL for web communications) and at rest (e.g., encrypting hard drives storing voter data) adds a crucial layer of protection against unauthorised access and exfiltration.
  • Regular Risk Assessments: Continuous identification, evaluation, and prioritisation of risks, followed by the coordinated and economical application of resources to minimise, monitor, and control the probability or impact of unfortunate events. This iterative process ensures that security measures evolve with the threat landscape.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

4.2 Architecture and Design for Resilience

Beyond specific controls, the underlying architecture of electoral systems must be designed with resilience and security as core tenets.

• Secure System Development Lifecycle (SSDLC): For any custom software developed for electoral purposes, integrating security considerations at every stage of the development lifecycle—from design and coding to testing and deployment—is essential. This includes secure coding practices, vulnerability testing, and peer reviews.

• Redundancy and Backup Strategies: Implementing robust backup and recovery plans for all critical data and systems. This includes offsite backups, immutable backups, and testing recovery procedures regularly. Redundancy in hardware and network infrastructure ensures continuity of operations in the event of a system failure or attack.

• Physical Security of IT Assets: Ensuring that critical servers, network devices, and voting equipment are housed in physically secure locations with restricted access, surveillance, and environmental controls. This guards against direct physical tampering or theft, complementing cyber defences.

• Auditability: Designing systems to be fully auditable, allowing for independent verification of results and processes. This includes robust logging mechanisms for all system activities, which are critical for forensic analysis after an incident.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

4.3 Supply Chain Security

Given the reliance on third-party vendors for electoral hardware, software, and services, managing supply chain risk is paramount. A vulnerability or compromise in a vendor’s product can have downstream effects on electoral integrity.

• Thorough Vendor Vetting: Electoral bodies must conduct rigorous due diligence on all potential vendors, assessing their cybersecurity posture, reputation, and adherence to security standards. This includes audits of their internal security controls and incident response capabilities.

• Contractual Security Requirements: Contracts with vendors should explicitly define stringent security requirements, including regular security audits, vulnerability disclosure policies, incident response obligations, and data handling protocols. Penalties for non-compliance should be clearly articulated.

• Software Bill of Materials (SBOMs): Requiring vendors to provide an SBOM for all software components used in their products increases transparency and allows electoral bodies to identify potential vulnerabilities within the software supply chain more effectively.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

4.4 Incident Response and Recovery

No system is perfectly impenetrable. Therefore, having a well-defined and frequently tested incident response (IR) plan is crucial for managing and mitigating the impact of successful attacks.

• Detailed Incident Response Plans: These plans should outline specific procedures for detection, analysis, containment, eradication, recovery, and post-incident review for various types of cyber incidents. Clear roles, responsibilities, and communication channels must be established.

• Tabletop Exercises and Drills: Regular simulation exercises, involving all relevant stakeholders (IT staff, election officials, legal counsel, communications team), help identify weaknesses in the IR plan and improve coordination under pressure. These exercises should simulate realistic attack scenarios, including data breaches, ransomware, and disinformation campaigns.

• Forensic Capabilities: Ensuring the ability to conduct thorough forensic investigations after an incident to understand the attack’s scope, methods, and impact, which is vital for recovery and preventing future attacks.

• Public Communication Strategy: Developing a transparent and timely communication plan for informing the public and stakeholders during and after a cyber incident. This is crucial for managing public perception, maintaining trust, and countering potential misinformation (as learned from the UK Electoral Commission’s initial delayed disclosure).

Many thanks to our sponsor Esdebe who helped us prepare this research report.

4.5 Staff Training and Awareness

The human element often represents the weakest link in any security chain. Continuous training and fostering a security-conscious culture are therefore indispensable.

• Layered Training Programs: Implementing comprehensive training for all staff, from basic cyber hygiene (e.g., strong passwords, phishing recognition) for general employees to advanced technical training for IT security personnel. Training should be ongoing, not a one-time event.

• Phishing Simulations: Regularly conducting simulated phishing attacks helps employees recognise and report suspicious emails, thereby reducing the likelihood of successful social engineering attacks.

• Cultivating a Security Culture: Encouraging employees to view security as a shared responsibility, not just an IT department concern. This involves fostering an environment where security concerns are reported without fear of reprisal and where best practices are habitually followed.

By integrating these best practices, electoral bodies can significantly enhance their resilience against sophisticated cyber threats, ensuring the continuity and integrity of democratic processes.

5. The Role of International Cooperation

Cyber threats to election security are inherently borderless. Malicious actors, often state-sponsored, operate across national boundaries, making a purely domestic defence strategy insufficient. International cooperation is therefore not merely beneficial but an absolute imperative for effective election security. This collaboration takes various forms, from sharing threat intelligence to coordinating diplomatic responses.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

5.1 Global Threat Landscape and Shared Vulnerabilities

The digital interconnectedness of the world means that a cyberattack on one nation’s electoral infrastructure can provide valuable insights and tactics to adversaries targeting others. The tools, techniques, and procedures (TTPs) developed and refined by state-sponsored actors against one target are often repurposed or adapted for campaigns against other democratic nations. Furthermore, the supply chains for electoral technology are frequently international, meaning a vulnerability introduced by a manufacturer in one country can affect systems globally. This shared vulnerability underscores the need for collective defence and mutual assistance.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

5.2 Sharing Threat Intelligence

Effective threat intelligence sharing is arguably the cornerstone of international cooperation in cybersecurity. It enables nations to proactively anticipate and counteract cyber threats by learning from the experiences of others.

• Mechanisms for Exchange: This includes bilateral agreements between national cybersecurity agencies (e.g., CISA in the US, NCSC in the UK), multilateral forums such as the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE), the European Union Agency for Cybersecurity (ENISA), and various United Nations initiatives focused on cyberspace. These platforms facilitate the exchange of Indicators of Compromise (IOCs), threat actor profiles, attack methodologies, and defensive strategies.

• Benefits: By pooling information, countries can build a more comprehensive picture of the global threat landscape, identify emerging attack vectors, and develop more robust, standardised security protocols. This intelligence allows for faster detection and more effective mitigation of attacks, reducing the window of opportunity for adversaries. For instance, if one nation identifies a specific vulnerability being exploited, sharing that information allows others to patch their systems before they are targeted.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

5.3 Coordinated Response and Deterrence

When a cyberattack occurs, particularly one attributed to a state actor, a coordinated international response can significantly enhance deterrence and accountability.

• Attribution Challenges: One of the most significant challenges in cyber warfare is attribution – definitively identifying the perpetrator of an attack. This requires sophisticated forensic analysis, intelligence gathering, and often, political will. International collaboration in forensic analysis can strengthen attribution confidence, making it harder for state actors to operate with impunity.

• International Norms and Laws: Efforts are underway in forums like the UN to establish international norms of responsible state behaviour in cyberspace, including prohibitions against interference in other nations’ critical infrastructure, such as electoral systems. While consensus remains elusive on many fronts, these discussions aim to build a framework for acceptable conduct and deter malicious activities.

• Sanctions and Diplomatic Pressure: A coordinated international response can include diplomatic condemnation, targeted sanctions against individuals or entities linked to cyberattacks, and even legal action. The UK’s decision to publicly attribute the 2021–2022 cyberattack on its Electoral Commission to Chinese state-linked actors, and subsequently impose sanctions in coordination with the US and other allies, serves as a powerful example of this strategy (gov.uk). Such unified actions demonstrate a collective commitment to upholding international law and democratic principles, aiming to impose costs on malicious actors and deter future attacks.

• Capacity Building: Many developing nations lack the sophisticated cybersecurity infrastructure and expertise to defend against advanced persistent threats. International cooperation includes capacity-building initiatives, where more technologically advanced nations provide training, resources, and technical assistance to help others strengthen their election security. This elevates the overall global security posture and reduces the number of potential weak links in the democratic chain.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

5.4 Standardisation and Best Practice Sharing

International bodies and collaborative forums play a crucial role in developing common standards and sharing best practices for electoral technology and security. This includes guidelines for secure voting machine procurement, robust audit procedures, and effective incident response protocols. Peer learning and exchange programs among election officials and cybersecurity experts from different countries foster a deeper understanding of diverse challenges and solutions, ultimately contributing to a more resilient global democratic infrastructure.

By leveraging these various avenues of cooperation, the international community can create a more formidable collective defence against the evolving and pervasive threats to election security, ensuring that democratic processes remain safeguarded against those who seek to undermine them.

6. Building and Maintaining Public Trust

In an era marked by sophisticated cyber threats, pervasive disinformation, and increasing political polarisation, building and maintaining public trust in electoral processes is as critical as the technical safeguards themselves. Without public confidence, even perfectly secure elections can be perceived as illegitimate, leading to social unrest, political instability, and a breakdown of democratic norms. This requires a multi-faceted approach centred on transparency, proactive communication, public engagement, and robust accountability mechanisms.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

6.1 Transparency and Open Communication

Transparency is the cornerstone of public trust. Electoral bodies must move beyond merely conducting elections to actively educating the public about the integrity of their processes.

• Proactive Information Dissemination: Providing clear, accessible, and comprehensive information about every stage of the electoral process – from voter registration and ballot design to voting machine certification, security measures, and tabulation procedures. This includes publishing detailed reports on security audits, vulnerabilities identified, and mitigation strategies implemented. Websites, public service announcements, and informational campaigns can be utilised.

• Post-Election Audits and Verification: Implementing and transparently communicating robust post-election audit procedures is vital. Risk-limiting audits (RLAs), for instance, statistically verify the accuracy of election outcomes by comparing paper ballots to machine counts, providing a high level of assurance. Making the methodology and results of these audits publicly accessible, and even inviting independent observers, significantly bolsters confidence (eac.gov).

• Addressing Concerns Promptly and Factually: When allegations of fraud or irregularities arise, electoral bodies must respond swiftly, transparently, and with verifiable facts. This involves directly refuting false claims with evidence, explaining complex technical processes in understandable terms, and engaging with media to correct misinformation. A rapid and authoritative response can prevent misinformation from taking root and becoming widely accepted.

• Crisis Communication Strategy: Having a predefined, well-rehearsed communication plan for cyber incidents or other disruptions is essential. As observed in the UK Electoral Commission’s case, delays in disclosure or vague communication can exacerbate public anxiety and erode trust. Clear, honest, and timely communication during a crisis demonstrates accountability and professionalism, even when facing significant challenges.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

6.2 Voter Education and Media Literacy

An informed citizenry is the best defence against disinformation and manipulation. Empowering voters with the skills to critically evaluate information sources is a long-term investment in democratic resilience.

• Empowering Citizens to Identify Disinformation: Educational campaigns should equip voters with tools to identify common disinformation tactics, such as sensational headlines, lack of credible sources, emotional appeals, and deepfakes. Encouraging source verification and critical thinking skills is paramount.

• Role of Media and Fact-Checking: Responsible journalism plays a critical role in combating disinformation. Electoral bodies should actively collaborate with reputable media organisations and independent fact-checkers to amplify accurate information and debunk false narratives. Supporting initiatives that promote media literacy in schools and communities is also important.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

6.3 Engaging Stakeholders

Building trust is a collaborative effort involving various societal actors beyond the electoral commission itself.

• Civil Society Organisations (CSOs): Engaging CSOs, including election observation groups, advocacy bodies, and academic institutions, in monitoring elections, conducting voter education, and advocating for electoral reforms can provide an additional layer of oversight and credibility. Independent observation lends legitimacy to the process.

• Political Parties and Candidates: Encouraging political parties and candidates to adhere to ethical campaigning standards, refrain from spreading misinformation, and accept legitimate election results is crucial for maintaining a healthy democratic discourse. Public commitments to these principles can help de-escalate post-election tensions.

• Technology Companies: Collaborative efforts with social media platforms and technology providers are necessary to detect and mitigate disinformation campaigns. This includes developing tools for content moderation, fact-checking integration, and transparency around political advertising.

Many thanks to our sponsor Esdebe who helped us prepare this research report.

6.4 Legal Frameworks and Accountability

Robust legal frameworks provide the necessary deterrents and mechanisms for accountability, reinforcing the commitment to election integrity.

• Modernising Election Laws: Existing election laws may not adequately address the complexities of digital threats. Modernising these frameworks to define and penalise cyber interference, disinformation, and the misuse of voter data is essential. This includes clarifying the legal authority of electoral bodies to respond to such threats.

• Independent Oversight: Ensuring that electoral commissions and data protection authorities (like the ICO in the UK) operate with sufficient independence and resources to investigate breaches, impose penalties, and enforce regulations. Their ability to hold perpetrators accountable reinforces the rule of law and deters malicious activities.

• Prosecuting Offenders and Imposing Sanctions: Demonstrating that electoral interference has real consequences, both domestically and internationally, is a powerful deterrent. The prosecution of individuals involved in voter fraud or cyberattacks, coupled with international sanctions against state-sponsored actors (as seen with the UK’s response to the Electoral Commission hack), sends a clear message that such actions will not be tolerated (ico.org.uk).

• Data Protection Legislation: Strict data protection laws, such as the General Data Protection Regulation (GDPR) in Europe or the California Consumer Privacy Act (CCPA) in the US, provide a legal foundation for protecting sensitive voter data and holding institutions accountable for its mismanagement. These laws mandate security standards and dictate notification requirements in the event of a breach, which are critical for transparency and trust.

By systematically addressing these aspects, electoral bodies can proactively build and continuously reinforce the public’s confidence, ensuring that the legitimacy of democratic outcomes remains unassailable, even in the face of persistent and evolving threats.

7. Conclusion

Election security, in its broadest sense, is not merely a technical challenge; it is a profound and dynamic imperative for the preservation of democratic governance in the 21st century. The digital transformation of electoral processes, while offering undeniable efficiencies and enhancing accessibility, has simultaneously broadened the attack surface, introducing an intricate web of cyber, informational, and hybrid threats that demand unwavering vigilance and adaptive strategies. From sophisticated state-sponsored cyberattacks aiming to exfiltrate voter data and disrupt critical infrastructure, as vividly illustrated by the 2021–2022 breach of the UK’s Electoral Commission, to pervasive disinformation campaigns and nuanced forms of voter manipulation, the adversaries of democracy are relentlessly innovating their tactics.

This report has meticulously detailed the evolving landscape of these threats, underscoring the shift from traditional physical interference to a complex interplay of digital and psychological warfare. It has emphasised that a robust defence requires electoral bodies to adopt comprehensive cybersecurity frameworks, integrate resilience into system design, rigorously manage supply chain risks, develop rapid and transparent incident response capabilities, and cultivate a security-first culture through continuous staff training. These best practices are not static solutions but rather a dynamic set of principles that must evolve in parallel with the threats they aim to counter.

Crucially, the borderless nature of cyber threats necessitates a concerted global effort. International cooperation, manifested through the sharing of threat intelligence, the coordination of diplomatic responses and sanctions, and collaborative capacity-building initiatives, forms an indispensable layer of defence. A unified front not only enhances collective resilience but also imposes tangible costs on malicious actors, thereby strengthening deterrence and reinforcing international norms of responsible state behaviour in cyberspace.

Ultimately, the foundation of election security rests upon public trust. Transparency, proactive and honest communication from electoral authorities, robust post-election audits, and a commitment to voter education and media literacy are paramount in an age of pervasive doubt and deliberate misinformation. Furthermore, strong legal frameworks that hold perpetrators accountable and modernise election laws to address digital challenges are essential for reinforcing the integrity of the democratic process. Engaging civil society, political parties, and technology companies in this shared endeavour ensures a multi-stakeholder approach to safeguarding democratic legitimacy.

In summation, the journey towards truly secure elections is continuous and multifaceted, requiring sustained investment, innovative solutions, and unwavering commitment from all stakeholders. It is a perpetual struggle against adaptive adversaries. By embracing a holistic strategy that integrates cutting-edge technology, human expertise, international solidarity, and an unyielding dedication to transparency, democratic nations can enhance the resilience of their electoral systems, maintain public confidence, and ensure that the voice of the people remains the true sovereign force in shaping their collective future.

References

• Associated Press. (2022). Electronic pollbook security raises concerns going into 2024. Retrieved from apnews.com

• Associated Press. (2023). Cybersecurity head says there’s no chance a foreign adversary can change US election results. Retrieved from apnews.com

• Associated Press. (2024). Tech companies sign accord to combat AI-generated election trickery. Retrieved from apnews.com

• Chouhan, S., & Sharma, G. (2025). A New Era of Elections: Leveraging Blockchain for Fair and Transparent Voting. arXiv preprint. Retrieved from arxiv.org

• CISA. (2024). Best Practices for Securing Election Systems. Retrieved from cisa.gov

• Data (Use and Access) Act 2025. (2025). In Wikipedia. Retrieved from en.wikipedia.org

• Electoral Commission. (2023). Information about the cyber-attack. Retrieved from electoralcommission.org.uk

• Electoral Commission. (2024). Public notification of cyber-attack on Electoral Commission systems. Retrieved from electoralcommission.org.uk

• GOV.UK. (2024). UK government sanctions Chinese state-backed entities and individuals for malicious cyber activity. Retrieved from gov.uk

• Information Commissioner’s Office. (2024). ICO reprimands the Electoral Commission after cyber attack compromises servers. Retrieved from ico.org.uk

• Kido International cyberattack. (2025). In Wikipedia. Retrieved from en.wikipedia.org

• TechRadar. (2025). UK Electoral Commission finally recovered from China hack after three years and £250,000 grant. Retrieved from techradar.com

• TechCrunch. (2024). How the theft of 40 million UK voter register records was ‘entirely preventable’. Retrieved from techcrunch.com

• U.S. Election Assistance Commission. (2024). Clearinghouse Resources on Election Security. Retrieved from eac.gov