The cyber-attacks come in hundreds of different shapes and forms:
They come as doctored photos circulating on Telegram
as fake accounts on Twitter or as malicious data crashing websites.
As Germany is about to elect a new parliament, cyber-attacks like that loom large over the
campaign.
Some of them deploy brand-new technology — while others rely on methods that have been tested
for decades.
So how do you hack an election? And what can be done to protect them?
To understand the kind of cyber-threats hanging over elections, it helps to break them down
into three categories — the three levels of election hacking.
And on level 1, we start with what’s most obvious: hacking.
Attackers can directly hack into the computers used to run campaign events or the election
itself.
Angela Merkel’s conservative Christian Democrats experienced that first-hand when they met
online to elect a new party chief.
Again and again, hackers flooded their website with internet traffic, until at some point,
it collapsed.
After about an hour, the party manged to expel the intruders, and the site went back online.
But the incident raised concerns whether similar methods could also be used to disrupt the
vote itself?
Here in Germany, at least, that seems unlikely:
Unlike countries like the US, where electronic voting machines are used, Germans still cast
their vote with pen and paper.
That paper trail makes it practically impossible to hack the final result.
But there still is a weak link: On election night, early results are reported electronically.
After votes are counted in roughly 87,000 wards, a software is used to send the numbers
to about 11,000 local authorities; from there to 299 election districts; then to 16 regional
authorities; and finally, to Germany's federal returning officer, who announces them to the
public.
If hackers manage to hack into it, that could delay the announcement and create chaos.
Authorities say, they’ve got things under control:
So all good? Not really.
Because even the best cybersecurity measures are of little help once we get to level 2
of election hacking:
Disinformation — damaging information, which is spread deliberately to sway public opinion
against certain candidates or parties.
In April 2021, hours after Germany’s Green Party announced who it was sending into the
race for chancellor, photos began circulating online. They allegedly
showed candidate Annalena Baerbock hugging colleagues, at the height of the coronavirus
pandemic — without a mask.
But the photos were fake.
They came from footage shot years earlier, before the pandemic.
"We do see disinformation campaigns against us.”
"I am secretary general of the German Greens, and I am in charge of the campaign."
"I give you another example, if you allow me”
Shortly after, fake quotes of Baerbock’s appeared online, suggesting that she wants
to prohibit kids from having pets at home.
"We don't want to forbid pets, but that was circulating on Telegram, WhatsApp, and whatsoever."
The party released a statement and spoke with Google to make sure that when people in Germany
google "Annalena Baerbock" and “pets,” the top search results would debunk the fake
news.
But months later, rumours persist that the Greens want to ban pets — which, to be completely
clear, they don’t.
"Just yesterday, I was campaigning myself and an old lady spoke about this topic — it's
just unbelievable nonsense."
And disinformation isn’t only spread about candidates. It’s also spread to raise doubts
over the election itself — something we saw in June during a regional election in
the state of Saxony-Anhalt.
Ahead of the vote, a Twitter user claimed to be an election worker determined to invalidate
votes for the far-right AfD. Soon after, the tweet was shared by a top party official.
But the photo posted with it did not show German election workers.
It came from footage shot during the 2020 US elections.
These examples illustrate how easy it has become for anyone today to produce and spread
disinformation: All you need are basic photoshop skills and a social media account.
And although you can debunk such "cheap fakes" with one Google search, they still do damage.
Now, there are ways how to fight back – and we’ll get to that later.
But first, let’s talk about far more professional disinformation campaigns, which are run by
highly sophisticated players or even entire countries.
It’s a forbidding world of spies and secret operations, and in normal times, it's impossible
to keep track of what’s going on.
But sometimes, history allows us a glimpse of the methods that are used.
Over four decades, communist East Germany ran some of the most successful disinformation
campaigns in the world.
Here, from its headquarters in East Berlin, the country's "Stasi" intelligence service
bombarded West Germany with disinformation.
During Germany's peaceful revolution of 1989 and 90, civil rights activists prevented many
Stasi files from being destroyed.
Today, those documents provide unparalleled insights into how a secret service manipulated
elections for decades.
They show how, for example, during West Germany's 1961 election campaign, the Stasi tried to
discredit Social Democratic candidate Willy Brandt by spreading rumours about what he
did while he was living in exile during the Nazi regime.
That's typical for successful disinformation campaigns: They usually don't spread stories
that are completely made-up — rather, they center on half-truths and bend facts to fit
the narrative.
Two decades later, the Stasi struck anew.
In 1980, West German Chancellor Helmut Schmidt was running against die-hard conservative
Franz-Josef Strauss — and the prospect of the Bavarian taking over the chancellery divided
the country, bringing people to the streets.
What people in West Germany did not know was that across the iron curtain, the Stasi had
a plan for adding fuel to the fire.
The agency forged a 13-page document that looked like it came from inside Strauss' CSU
party — suggesting that the Bavarians would split away from their conservative bloc after
the election.
...and the magazine printed it a few days ahead of the
election. This made Strauss’ conservatives look in disarray —
and they ended up scoring their worst result in 30 years.
To this day, disinformation is often spread by third parties, who have no idea that they’re
being instrumentalized.
Back in the Cold War, those were often journalists. Today, in the age of social media, it can
be anyone — and yet, journalists still play a crucial rule.
Which brings us to the best-known cyber disinformation campaign to this day.
In 2016, emails sent and received by Hillary Clinton's campaign chairman, which had been
stolen by Russian hackers, were dumped on WikiLeaks.
You probably remember the week-long debate about the emails? What do you think?
Would they have had the impact they did — had they not been mentioned by journalists over
and over again?
“Another batch of stolen emails published today by Wikileaks”
“More than 1,900 emails just this morning.”
“For two weeks now, John Podesta’s emails have provided Trump with a steady stream of
new material.”
Most media analysts say they wouldn’t.
And here we are, on level 3 of election hacking:
sophisticated “hybrid cyber operations,” which blend hacking attacks with disinformation
campaigns — and often run several of them simultaneously.
And the threat of similar campaigns remains real, according to the head of Germany’s
domestic intelligence service.
And observations from Germany’s neighbours, the Netherlands — which held elections earlier
this year — suggest that German authorities do have reason for concern.
"There was considerable effort to influence the public opinion — …
"I am a former digital campaigner and I have watched the Dutch elections in my capacity
as the founder and executive director of a foundation called Defend Democracy.”
When Alice Stollmeyer's team monitored social media ahead of the vote, they identified dozens
of small cyber operations:
In one instance, someone set up what pretended to be the official Telegram channel of a left-wing
party and used it to spread falsehoods.
Elsewhere, fake profiles popped up on Twitter, pretending to be Greens politicians and provoking
controversy.
Alice Stollmeyer:
“Bad actors are so creative in finding endless new ways of doing bad stuff.”
The Dutch parties denounced the profiles as fake. But the damage was done, and some posts
kept circulating.
Which brings us back to what we said earlier: Even if disinformation is debunked as fake,
traces of doubt persist.
And over time, those doubts can add up, slowly eroding trust in democracy — a death by
a thousand cuts, if you will.
Depressing? Yes — and no. Because there are ways to tackle election meddling:
When it comes to level-1, hacking, everyone, including politicians, can set up safeguards
to better protect themselves — by using safe passwords, for example.
But was about the disinformation on level-2 and level-3? Identifying it online and debunking
it alone won’t do the job, as we’ve seen.
So what else could be done?
Alexander Sängerlaub:
"The resiliency of a society is connected to a lot of things."
“I’m director of an organization called FuturEins, it’s a think-and-do tank that
deals with the digital sphere.”
"First of all: the platforms. The platforms really don't care as much about disinformation
as they should."
Since 2018, when the world learned that consultancy Cambridge Analytica had used social media
to sway elections from Nigeria to the US, tech giants have been under unprecedented
scrutiny for how they deal with disinformation on their platforms.
They have launched efforts to fight disinformation on their platforms. But particularly on encrypted
messaging services, a wildfire of disinformation rages on.
And that’s why experts say people also need to learn how to better spot information that
is designed to deceive them.
The question is: how and where do you teach people such media literacy?
Alexander Sängerlaub:
“It has to be in schools …”
Finland, for example, already teaches media literacy in elementary schools.
Alexander Sängerlaub:
"…in education for elder people…"
Something where less work has been done, so far.
Alexander Sängerlaub:
"…but it also has to be a part of the media itself, because media can explain a lot to
the people. And when they’re talking about disinformation, they can describe how it’s
created and how it works.”
Well — we try our best.
In all seriousness: Hacking elections, our research showed us, is no new phenomenon.
What’s different today is that the internet, social media and messaging apps have made
it easier and cheaper than ever.
And new deepfake technology, which allows you to produce videos in which people do or
say things they never did, will supercharge this development in the coming years.
Already today, cyber-attacks in different shapes and forms are all around us, and it's
time to boost media literacy to help people identify them.
But: When it comes to big operations run by specialists or even entire countries — how
much do we actually know?