Hackers from rogue states could attempt to discredit the Conservative leadership contest with spurious claims about the integrity of an online members’ vote, experts have said.
If there are two candidates remaining in the race after Monday, Tory party members will take part in an online vote to decide the new prime minister.
The National Cyber Security Centre, an arm of the GCHQ spy agency, contacted the Conservative party over its leadership voting preparations on Thursday, having also intervened before the previous leader ballot.
That August intervention resulted in the party enhancing security around the voting process, but it is understood that NCSC has not advised changes to the voting system this time.
Cybersecurity experts contacted by the Guardian said altering the leadership result would be difficult for any hostile foreign state, including Russia. However, they said disrupting the process via false claims about the integrity of the process, or hampering the vote with a distributed denial of service (DDoS) attack, could have an impact among the wider electorate by discrediting the ballot.
Jamie Collier, a consultant at the cybersecurity firm Mandiant, said: “There could be an attempt at sowing disinformation after the vote. Even if there is no security compromise, I wouldn’t be surprised if Russia starts pumping out narratives that it was compromised, in order to undermine the result and the integrity of the process.”
Alan Woodward, a professor of cybersecurity at the University of Surrey, said altering the result of the leadership ballot would “take some doing”, but discrediting the process would be easier. “You can discredit the process with disinformation,” Woodward said. “It’s not easy to hack and change the result, but it’s quite easy to get people to distrust the system.”
Steven Murdoch, a professor of security engineering at University College London, said electronic ballots were highly risky ventures, especially when choosing a new national leader. Murdoch pointed to an Electoral Commission report on trial electronic voting at English local elections in 2007, which said: “The level of risk placed on the availability and integrity of the electoral process was unacceptable.”
Murdoch said a DDoS attack, in which websites are disabled by being bombarded with traffic, could be launched to disrupt and discredit a vote. “There could be genuine disruption, and that could cause people to question the legitimacy of the election.”
A Conservative party spokesperson said: “We ran online voting just a few months ago in the last leadership contest. We worked with the National Cyber Security Centre, followed their security recommendations, and it proved to be secure. We continue to work with the NCSC to once again run a secure online ballot.”
An NCSC spokesperson said: “As the UK’s national technical authority for cybersecurity, we continue to provide advice to the Conservative party, including on security considerations for online leadership voting.”
