{"id":338159,"date":"2017-04-12T19:16:59","date_gmt":"2017-04-12T11:16:59","guid":{"rendered":"http:\/\/techcrunch.com\/?p=1475847"},"modified":"2017-04-12T19:16:59","modified_gmt":"2017-04-12T11:16:59","slug":"brexit-voter-registration-website-crash-could-have-been-a-ddos-says-report","status":"publish","type":"post","link":"https:\/\/people.utm.my\/asmawisham\/brexit-voter-registration-website-crash-could-have-been-a-ddos-says-report\/","title":{"rendered":"Brexit voter registration website crash could have been a DDoS, says report"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/tctechcrunch2011.files.wordpress.com\/2015\/03\/6881735515_d8c12f00ea_b.jpg?w=738\" class=\"\"\/><\/p>\n<p>A government voter registration\u00a0website in the UK that crashed in the hours before the deadline for registering to vote ahead of last year\u2019s <a target=\"_blank\" href=\"https:\/\/techcrunch.com\/2016\/12\/18\/wtf-is-brexit\/\">Brexit<\/a> referendum could have been targeted by a denial of service attack.<\/p>\n<p>The observation is contained in a\u00a0<a target=\"_blank\" href=\"https:\/\/www.publications.parliament.uk\/pa\/cm201617\/cmselect\/cmpubadm\/496\/49602.htm\">report<\/a>\u00a0by the\u00a0Public Administration and Constitutional Affairs Committee (PACAC), entitled <em>Lessons from the EU referendum.\u00a0<\/em><\/p>\n<p>In a section discussing software problems, the committee describes the website crash as the \u201cmost significant example of software failure\u201d, and says it cannot rule out the possibility that\u00a0the\u00a0\u201cexceptional surge in demand\u201d to register for votes ahead of the deadline last June was\u00a0caused by a distributed denial of service\u00a0(DDoS) attack using botnets.<\/p>\n<p>The report\u00a0says\u00a0the crash has\u00a0\u201cindications of being a DDOS\u201d \u2014 based\u00a0on what the committee dubs as\u00a0\u201ckey indicants\u201d for such an attack: \u201ctiming and relative volume rate\u201d.<\/p>\n<p>According to the\u00a0report there were\u00a0515,256 online applications to register to vote recorded on 7 June, with the previous record for the largest number of online applications received in a day being\u00a0469,047 on April 20, 2015 (ahead of the May 2015 general election).<\/p>\n<p>The committee says\u00a0it has no direct evidence of foreign interference in the voter registration process, but goes\u00a0on to express deep concern about allegations of foreign powers such as Russia and China seeking to influence public opinion elsewhere via psychological cyber attacks in order to subvert democratic processes.<\/p>\n<p>\u201cLessons in respect of the protection and resilience against possible foreign interference in IT systems that are critical for the functioning of the democratic process must extend beyond the technical,\u201d the committee writes. \u201cThe US and UK understanding of \u2018cyber\u2019 is predominantly technical and computer-network based. For example, Russia and China use a cognitive approach based on understanding of mass psychology and of how to exploit individuals.<\/p>\n<p>\u201cThe implications of this different understanding of cyber-attack, as purely technical or as reaching beyond the digital to influence public opinion, for the interference in elections and referendums are clear. PACAC is deeply concerned about these allegations about foreign interference.\u201d<\/p>\n<p>The committee is\u00a0therefore recommending that the government takes specific measures aimed at\u00a0bolstering the cyber security of election and referendum processes\u00a0in light of the risk of foreign powers seeking to influence outcomes, while also lauding the UK\u2019s prioritizing of cyber security\u00a0in recent years (back in <a target=\"_blank\" href=\"https:\/\/techcrunch.com\/2015\/11\/18\/uk-gov-to-invest-in-security-startups\/\">2015<\/a> former chancellor George Osborne named cyber security\u00a0a priority, and announced a plan to double spending over the next five years).<\/p>\n<p><span class=\"Recommendation\">\u201cWe commend the government for promoting cyber security as a major issue for the UK. We recommend that Cabinet Office,<\/span> <span class=\"Recommendation\">the Electoral Commission, local government, GCHQ and the new government<\/span> <span class=\"Recommendation\">Cyber Security Centre establish permanent machinery for monitoring cyber activity<\/span> <span class=\"Recommendation\">in respect of elections and referendums, for promoting cyber security<\/span> <span class=\"Recommendation\">and resilience from potential attacks, and to put plans and<\/span> <span class=\"Recommendation\">machinery in place to respond to and to contain such<\/span> <span class=\"Recommendation\">attacks if they occur,\u201d the committee\u00a0writes. \u201cWe recommend that the government presents<\/span> <span class=\"Recommendation\">regular annual reports to parliament on these matters.\u201d<\/span><\/p>\n<p>The report also indicates\u00a0that the\u00a0voter surge ahead of the Brexit vote could have been exacerbated by the spread of \u2018fake news\u2019 on Facebook \u2014 with the UK\u2019s Electoral Commission\u00a0flagging up\u00a0an incorrect rumor spread via Facebook during the Brexit referendum campaign which suggested\u00a0voters needed to re-register in order to be able to vote. Which was not true.<\/p>\n<p>The report notes that an earlier report by the Commission\u00a0found that\u00a038 per cent of voter registration applications made during the campaign were duplicates, while an even higher proportion (46 per cent) were found to be duplicates during the period between the\u00a0original cut off for voter registrations\u00a0(midnight June 7) and the extended deadline of midnight June 9, after\u00a0the government allowed more time for registrations owing to \u201cunprecedented demand\u201d to register.<\/p>\n<p>\u201cJenny Watson [chair of the Electoral Commission], indicated that the situation was not helped by the existence, at one point in the referendum, of a Facebook rumour that incorrectly said that voters had to re-register to make sure they could vote in the referendum,\u201d the committee notes.<\/p>\n<p>The body\u00a0has previously recommended the government develops an online service enabling UK citizens\u00a0to check whether they are already correctly registered to vote. The committee says it endorses that\u00a0<span class=\"Recommendation\">recommendation.\u00a0<\/span><\/p>\n<p>\u201cDuplicate applications pose an unnecessary administrative burden on electoral registration officers and are an equally unnecessary drain on the time of electors themselves,\u201d it writes, adding: \u201c<span class=\"Recommendation\">While PACAC is aware of<\/span> <span class=\"Recommendation\">the technical issues that would need to be overcome to<\/span> <span class=\"Recommendation\">deliver such a service, it would be of invaluable assistance<\/span> <span class=\"Recommendation\">in preventing the Register to Vote website from collapsing due<\/span> <span class=\"Recommendation\">to high levels of demand again ahead of future elections<\/span> <span class=\"Recommendation\">and referendums.\u201d<\/span><\/p>\n<p>The report also criticizes\u00a0the government for failing to undertake adequate levels of load testing of the official voter registration website \u2014 which it argues\u00a0could have flagged problems ahead of time and mitigated the\u00a0surge in demand.<\/p>\n<p>\u201cThe government clearly failed to undertake the necessary level of testing and precautions required to mitigate against any such surge in applications. It is worrying that when testing identified issues in system performance, mistaken assumptions meant that these issues were not investigated further and corrected.\u201d<\/p>\n<p>The EU referendum, which was held on\u00a0June 23\u00a0last year,\u00a0resulted\u00a0in a public vote to leave the EU\u00a0by 52 per cent to\u00a048 per cent. The UK government triggered the start of the two-year negotiation process over the terms of Brexit last month.<\/p>\n<p><small>Featured Image: <a target=\"_blank\" href=\"https:\/\/www.flickr.com\/photos\/martinrobson\/6881735515\/in\/photolist-bu7Gdk-9URmpF-peuqvf-JRn6Z-qC6J1V-ezF3vM-c5t2A1-eeSQ9W-fc7eY2-r2psv5-ouumk3-b9bvUe-b3pyu-dhqhMW-bDuZnk-b9SCeX-dMejZp-cyEAi3-em6CGJ-9URmZt-dT4tHb-6ykcHX-2LNCqY-bHfXSR-6yprvU-oTL2J3-hBg1p3-r2psoS-85UVCg-eeM8ii-a1ZLTB-oBifew-oTMV7p-hBgN2K-oLUkQT-r2psnj-8AFdBa-2LPdoC-bu7GST-2LLL8R-6ykvmg-JRn7a-r2psym-bqA3uo-r2udjT-2LJM4F-976qMF-3Qwsn3-cyCaq9-6UC26c\">Martin Robson<\/a>\/<a target=\"_blank\" href=\"https:\/\/www.flickr.com\/\">Flickr<\/a> UNDER A <a target=\"_blank\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/2.0\/\">CC BY-SA 2.0<\/a> LICENSE<\/small><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" width=\"680\" height=\"588\" src=\"https:\/\/tctechcrunch2011.files.wordpress.com\/2015\/03\/6881735515_d8c12f00ea_b.jpg?w=680\" class=\"attachment-large size-large wp-post-image\" alt=\"\" srcset=\"https:\/\/tctechcrunch2011.files.wordpress.com\/2015\/03\/6881735515_d8c12f00ea_b.jpg?w=680 680w, https:\/\/tctechcrunch2011.files.wordpress.com\/2015\/03\/6881735515_d8c12f00ea_b.jpg?w=150 150w, https:\/\/tctechcrunch2011.files.wordpress.com\/2015\/03\/6881735515_d8c12f00ea_b.jpg?w=300 300w, https:\/\/tctechcrunch2011.files.wordpress.com\/2015\/03\/6881735515_d8c12f00ea_b.jpg?w=768 768w, https:\/\/tctechcrunch2011.files.wordpress.com\/2015\/03\/6881735515_d8c12f00ea_b.jpg 1024w\" sizes=\"(max-width: 680px) 100vw, 680px\" \/>&nbsp;A government voter registration website in the UK that crashed in the hours before the deadline for registering to vote ahead of last year&#8217;s Brexit referendum could have been targeted by a denial of service attack. <a href=\"https:\/\/techcrunch.com\/2017\/04\/12\/brexit-voter-registration-website-crash-could-have-been-a-ddos-says-report\/?ncid=rss\">Read More<\/a><\/p>\n<div class=\"feedflare\">\n<a href=\"http:\/\/feeds.feedburner.com\/~ff\/Techcrunch?a=Hcg_8IUJSio:a0CdozBYMuo:2mJPEYqXBVI\"><img decoding=\"async\" src=\"http:\/\/feeds.feedburner.com\/~ff\/Techcrunch?d=2mJPEYqXBVI\" border=\"0\"><\/img><\/a> <a href=\"http:\/\/feeds.feedburner.com\/~ff\/Techcrunch?a=Hcg_8IUJSio:a0CdozBYMuo:7Q72WNTAKBA\"><img decoding=\"async\" src=\"http:\/\/feeds.feedburner.com\/~ff\/Techcrunch?d=7Q72WNTAKBA\" border=\"0\"><\/img><\/a> <a href=\"http:\/\/feeds.feedburner.com\/~ff\/Techcrunch?a=Hcg_8IUJSio:a0CdozBYMuo:yIl2AUoC8zA\"><img decoding=\"async\" src=\"http:\/\/feeds.feedburner.com\/~ff\/Techcrunch?d=yIl2AUoC8zA\" border=\"0\"><\/img><\/a> <a href=\"http:\/\/feeds.feedburner.com\/~ff\/Techcrunch?a=Hcg_8IUJSio:a0CdozBYMuo:-BTjWOF_DHI\"><img decoding=\"async\" src=\"http:\/\/feeds.feedburner.com\/~ff\/Techcrunch?i=Hcg_8IUJSio:a0CdozBYMuo:-BTjWOF_DHI\" border=\"0\"><\/img><\/a> <a href=\"http:\/\/feeds.feedburner.com\/~ff\/Techcrunch?a=Hcg_8IUJSio:a0CdozBYMuo:D7DqB2pKExk\"><img decoding=\"async\" src=\"http:\/\/feeds.feedburner.com\/~ff\/Techcrunch?i=Hcg_8IUJSio:a0CdozBYMuo:D7DqB2pKExk\" border=\"0\"><\/img><\/a> <a href=\"http:\/\/feeds.feedburner.com\/~ff\/Techcrunch?a=Hcg_8IUJSio:a0CdozBYMuo:qj6IDK7rITs\"><img decoding=\"async\" src=\"http:\/\/feeds.feedburner.com\/~ff\/Techcrunch?d=qj6IDK7rITs\" border=\"0\"><\/img><\/a>\n<\/div>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/feeds.feedburner.com\/~r\/Techcrunch\/~4\/Hcg_8IUJSio\" height=\"1\" width=\"1\" alt=\"\"\/> <\/p>\n","protected":false},"author":5817,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[25],"tags":[59,66,26],"class_list":["post-338159","post","type-post","status-publish","format-standard","hentry","category-technology","tag-media","tag-techcrunch","tag-technology"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/338159","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/users\/5817"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/comments?post=338159"}],"version-history":[{"count":0,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/338159\/revisions"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/media?parent=338159"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/categories?post=338159"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/tags?post=338159"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}