40 million UK voters had their personal details stolen three years ago when the Electoral Commission was hacked – but the British government has waited to place the blame (Picture: Birgit Korber/Getty Images/iStockphoto)
The UK has sanctioned Chinese-backed hackers after the personal details of 40 million voters were compromised.
Deputy Prime Minister Oliver Dowden pinned the blame on APT31, a ‘Chinese state-affiliated’ group, responsible for ‘malicious cyber activity’.
The group accessed the data of 40 million voters by hacking the Electoral Commission’s email and file-sharing systems, which contained copies of the electoral register, between 2021 and 2022.
It also tried to spy on MPs and peers in 2021.
‘This is the latest in a clear pattern of hostile activities originating in China’, Dowden told the House of Commons in a statement on Monday.
‘While it is obviously concerning’, he explained, ‘the compromise has not affected the security of UK elections’.
He said the government is imposing sanctions on two individuals and one entity linked with APT31.
Deputy Prime Minister Oliver Dowden is expected to blame China for the hacking of the Electoral Commission in 2021 (Picture: Daniel LEAL / AFP)
The attacks are no surprise to Professor Alan Woodward, a cyber security expert at the University of Surrey who advises the EU’s law enforcement agency Europol.
‘Part of [China’s] overseas policy has always been to try and undermine Western democracies’, he told Metro.co.uk.
‘I don’t know what good the electoral register is going to do them.’
The hack was only revealed to the public last year, despite the Electoral Commission being legally obliged to notify people whose data was compromised.
MPs and peers who have been critical of China are also believed to have been targeted in cyber attacks.
Prof Woodward doubts sanctions will make a difference, saying: ‘We’ve had sanctions against Russia for ages because of Ukraine.
‘But they still mount disinformation and misinformation campaigns and try and break into infrastructure.
‘The Chinese do exactly the same thing.’
Who hacked the Electoral Commission?
Dowden named APT31 as the group responsible for hacking the Electoral Commission and attempting reconnaissance on parliamentarians.
An APT – advanced persistent threat – is a state or state-sponsored hacker who gains unauthorised access to networks.
Countries like China and Russia often outsource their hacking campaigns to such ‘mercenaries’ so they can maintain ‘plausible deniability’, Prof Woodward said.
The government has previously sounded the alarm about the hacking activities of another group, APT10, also known as Stone Panda or Red Apollo.
It is linked with China’s Ministry of State Security.
Russia’s Vladimir Putin and China’s Xi Jinping have been accused of overseeing campaigns of hacking, misinformation and election interference around the world (Picture: Alexei Druzhinin / Sputnik / AFP)
The UK government said ATP10 was responsible for ‘one of the most significant and widespread cyber intrusions against the UK and allies’ all the way back in 2018.
Active since at least 2009, the group has used phishing and malware to target organisations in the aerospace, defence, energy and engineering sectors, Forbes reported.
What data was accessed in the Electoral Commission hack?
The accessed data includes the names, email addresses, home addresses and phone numbers of people registered to vote in the UK.
Much of this is already available to anyone who wants to buy a copy, but people can opt out of inclusion on this ‘open register’.
It would be ‘very hard’ for hackers to use the accessed data to influence the UK’s paper-based elections, the Electoral Commission said.
Why would China want voters’ data?
While the breach itself does not ‘present a high risk to individuals’, the commission did admit the data could be combined with other information that’s publicly available, for example on social media.
By doing so, they could be able to ‘infer patterns of behaviour or to identify and profile individuals’.
‘The Chinese have a reputation for wanting to suck up as much information as possible’, Prof Woodward said.
‘They’ve got more of a vacuum cleaner approach rather than a particularly targeted one.’
He added: ‘If you vacuum up a lot of data, you can consolidate it and then use that for mass targeting of demographics.’
Data harvesting may have landed Donald Trump in office by allowing his campaign to target swing voters with Facebook adverts (Picture: Wilfredo Lee/AP)
Targeting of swing voters in marginal areas may have helped Donald Trump win the US presidential election in 2016.
Cambridge Analytica harvested data from the Facebook profiles of millions of US voters to build software to predict their votes and influence them through targeted adverts on the social media platform.
More than 50 million profiles were harvested by the company headed by Trump ally Steve Bannon and owned by the hedge fund billionaire Robert Mercer, The Guardian reported.
Facebook has improved transparency around political adverts since then.
It requires political advertises to live in the country they’re targeting, and adverts must clearly name the person or organisation funding them.
But social media adverts are also increasingly important in political campaigns.
Labour and the Conservatives have spent nearly £1.8million on Facebook and Instagram adverts so far this year, according to data compiled by Who Targets Me.
This is nearly ten times higher than the same period last year when they spent £191,348.
Exploiting political advertising on social media would be difficult ‘if all you’ve got is a name and address and no voting intention’, Prof Woodward said.
How did hackers access the electoral register?
Hackers use ransomware and phishing to gain access to trade secrets and personal date (Picture: Moment RF/ witthaya_prasongsin via Getty)
Talk of hackers may conjure up images of hooded figures huddled around computers, typing frantically until they bust through a network’s defence system.
But most attacks ‘are not sophisticated at all’, Prof Woodward said.
Roughly 90% of successful hacks are due ‘social engineering’, such as when people give away their login details in phishing scams, he said.
Weak passwords used for multiple logins, a lack of two-factor authentication, and other seemingly minor vulnerabilities are also easy to exploit.
‘It’s the equivalent of burglars going around rattling door handles – eventually they’ll find one that’s open’, he told Metro.co.uk.
‘You could be successful in defending 99 times out of 100, but that one time that they get through, they can walk away with a lot of data.’
How can you protect yourself from state-sponsored hackers?
‘Assume nothing, believe no one, and check everything’, Prof Woodward said of the ‘classic ABCs’ when you receive an email or visit a website.
That means you should be careful who you provide information to and keep yourself protected with anti-virus software.
Another step is to use a password manager instead of relying on the same password for multiple accounts.
More Trending
‘The best password is one you can’t remember, so you really should have something like a password manager,’ he added.
‘It will generate strong passwords and keep track of a different password for every account.’
Get in touch with our news team by emailing us at webnews@metro.co.uk.
For more stories like this, check our news page.