Foreign cyberattack may have been behind Brexit website crash, says MPs report

A foreign cyberattack could have been behind the crash of the UK's voter registration website in the run up to the European Union referendum.

The Register to Vote website crashed on the evening of 7 June 2016, just hours before the deadline for registration ahead of last summer's vote. There were 514,256 online applications to register to vote on 7 June and the crash led to the deadline for voter registration being extended by another day.

While the UK government blames the crash on a surge in demand following the Brexit TV debates and voters leaving it until the last minute to sign up, in a new report into lessons learned from the EU referendum, MPs on the Public Administration and Constitutional Affairs Committee (PACAC) say the possibility of foreign cyberattackers being behind the crash still remains.

"PACAC does not rule out the possibility that the crash may have been caused by a DDOS (Distributed Denial of Service) using botnets," the report said.

While PACAC's chairman Bernard Jenkin MP acknowledges the government's line that there was no interference in the election, he told the Press Association: "We have taken our own advice and have concluded from that advice that it cannot be ruled out."

"After all, it has happened in other countries," he added, potentially referring to alleged Russian interference in the election of Donald Trump as US president last year.

However, the government remains convinced the website was brought down by a rush of users, not foreign agents: "We have been very clear about the cause of the website outage in June 2016. It was due to a spike in users just before the registration deadline. There is no evidence to suggest malign intervention," a Cabinet Office spokesperson told ZDNet.

While the PACAC report states that any potential attack didn't have "any material effect on the outcome of the EU referendum", it said there are lessons around protecting against foreign cyberattacks against "IT systems that are critical for the functioning of the democratic process" which must be learned.

One of those is the establishment of a permanent body involving the Cabinet Office, the Electoral Commission, local government, GCHQ, and the new National Cyber Security Centre for managing potential cyber risks to the election process.

Such a body should hold permanent responsibility for "monitoring cyber activity in respect of elections and referendums" and "promoting cybersecurity and reliance from potential attacks" as well as responding and containing to attacks if they occur.

The committee's report also suggests that protecting elections from cyberattacks can't just focus on the technical nature of protecting IT systems from interference -- but also must prevent foreign attempts to influence public opinion in the run-up to elections via social media and fake news.

"Russia and China use a cognitive approach based on understanding of mass psychology and of how to exploit individuals. The implications of this different understanding of cyber-attack, as purely technical or as reaching beyond the digital to influence public opinion, for the interference in elections and referendums are clear," the report says.

"PACAC is deeply concerned about these allegations about foreign interference," it adds.

However, one cybersecurity expert warned against hurrying to blame foreign powers. "There seems to be a fashion developing to rush to blame any system outage on hackers, and then to extrapolate that further by claiming it is foreign actors. I could be convinced but only with proof," Professor Alan Woodward, visiting professor at the University of Surrey's department of computing, told ZDNet.

"There is a real danger that if we collectively keep raising the spectre of hackers whenever a system goes down there will be so much background noise on the subject that when a serious attack happens no one will listen. There is a danger of crying wolf," he adds.

READ MORE ON CYBERSECURITY

• Russian hackers pose a threat to UK elections, GCHQ warns
• UK to review its cybersecurity after US election hacks [CNET]
• Cyberattacks threaten democracy itself, warns NATO
• Visualizing the Russian cyberattack [TechRepublic]
• The hackers that never went away: Brace for more state-backed attacks, leaks and copycats this year