Was The German Election Hacked?

On September 24th, 2017, federal elections took place in Germany to elect Germany’s next parliament, the 19th Bundestag. 

The Christian Democratic Union (CDU) won the majority of votes with 33%, making this Angela Merkel’s fourth term in office.

Merkel has been a steadfast supporter of the European Union, and much of the EU’s viability can be credited to Germany’s economic prowess and political stability. This made Germany an appealing yet somewhat challenging target for the likes of Russian President Vladimir Putin, whose interference in Western elections has unfolded in a dramatic and unprecedented fashion. The question on much of the world’s mind was, could the German election successfully be hacked?

There are two primary ways that modern elections can be interfered with:

  • The most direct method is to attack the election apparatus itself which is often easier said than done unless you happen to be a dictator in control of the entities delivering election results. 
  • The other method, and the one that has been the most prolific, is to attempt to influence the electorate to support or oppose candidates or initiatives of the attacker’s choosing. 

With the rise of the Internet and social media, it’s not hard to spool up tons of fake social media accounts and use them to spread rumors, lies, or even amplify real news when it benefits attackers’ motives. It’s often hard to gauge the true impact of these efforts on election results, however; even for the attackers.
A Tale of Election Software

Many German states use a software created by vote iT to count votes from local and national elections, called PC-Wahl. IT specialists Thorsten Schröder, Linus Neumann and Martin Tschirsich analysed the software and found numerous security flaws. Neumann is quoted as stating 
"We did this in our spare time. Everybody's worried about state sponsors and professional hackers, if we can do this in a couple of evenings of sitting around in our apartments, you can imagine how easily this could be accomplished by a state actor."

Vote iT told German news magazine Der Spiegel that there were “no security-related weaknesses in the software.” Nevertheless, patches were soon issued.  German hacker collective Chaos Computer Club (CCC) corroborated these findings, releasing a report warning that this software is easily manipulated. Passwords were either found online or easily guessed, and encryption methods were out of date. Germany’s top technology security agency, BSI, later ordered PC-Wahl’s security to be improved.

CCC previously uncovered vulnerabilities in German election voting systems in 2006 by circumventing their security measures and reprogramming voting computers to play chess. The German Federal Constitutional Court has since eliminated use of voting computers, resulting in the return to pen and paper votes.

As a result of the move back to pen and paper, attacking the election apparatus in German elections poses a particular challenge. This analog system would require significant resources to affect the outcome of the election if trying to boost numbers directly at the polls.  

Each voter casts two votes in a system that blends an additional member system with elements of a first-past-the-post system. Parties must win at least 5% of the second vote to enter parliament, a mandate put down to prevent splinter parties from bogging down the government such as with the Weimar Republic of the 1920s. The Weimar Republic was characterised by instability and short governing terms due to a large number of political parties that failed to compromise on key issues.
Individual voters, therefore, do not directly cast a ballot for the new chancellor as voters do for the President of the United States. Within the US a disparity of results between the popular vote and electoral college is a sometimes expected, if not frustrating event for many voters. 

Any disparity of reported results and actual votes in Germany would instead incite a resoundingly more chaotic result, potentially leading to calls for another election.

Should someone look to meddle with the German election, their only realistic option would be to interfere with the software responsible for tallying or reporting the results. 

Votes are collected and disseminated through digitised means determined by each region. And, although the paper votes could always be recounted, any strife would likely degrade confidence in the democratic system. 

As a result of suspected interference in recent elections, we now find ourselves wondering if attackers will attempt to manipulate each major election. It may be the case that, for whatever reasoning, the recent German election seems to have been spared of any significant attempts at outside manipulation. 

Regardless, there will be more major elections soon in Western countries and we will once again be asking ourselves if attackers will try to influence the results. 

Anomali

You Might Also Read: 

Fake Facebook Ads Surged During The US Presidential Election:

Germany May Go Offensive After Russian Cyber Attacks:

Angela Merkel’s Ally Caught In Cyber Attack As Elections Loom:

Germany Gets Tough On Social Media:

 

« Deloitte Hit by Cyber Attack: Clients' Private Data Exposed
Could the US Use A Cyber Attack To Take Down N. Korea? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Uniken

Uniken

Uniken REL-ID is a safe, simple, and scalable security platform that tightly integrates your identity, authentication, and channel security.

BetterCloud

BetterCloud

BetterCloud puts IT in control of the modern workplace through user lifecycle management, data discovery, and IT and security automation purpose-built for SaaS.

CRU Data Security Group (CDSG)

CRU Data Security Group (CDSG)

CRU is a pioneer in devices for data mobility, data security, encryption, and digital investigation.

Cyber Defense Initiative Conference (CDIC)

Cyber Defense Initiative Conference (CDIC)

Cyber Defense Initiative Conference (CDIC) is one of the most distinguished Cybersecurity, Privacy and Information Security Conference in Thailand and Southeast Asia.

Charterhouse Müller UK

Charterhouse Müller UK

Charterhouse Müller UK are a leading service provider for end of life IT services including data erasure and secure IT asset disposal.

Belle de Mai Incubator

Belle de Mai Incubator

Belle de Mai Incubator supports and funds innovative startup ideas in digital industries.

Cyble

Cyble

Cyble Vision enables faster detection of cyber threats and focuses on identifying and analysing the motivations, methods, capabilities and tools of adversaries.

Informatics International

Informatics International

Informatics is a leading ICT provider in Sri Lanka, providing cutting-edge software & infrastructure solutions and services including cyber security.

European Center for CyberSecurity in Aviation (ECCSA)

European Center for CyberSecurity in Aviation (ECCSA)

ECCSA is a cooperative partnership within the aviation community to better understand emerging cybersecurity risks in aviation and provide collective support in dealing with cybersecurity incidents.

Open Data Security (ODS)

Open Data Security (ODS)

Open Data Security is a market leader in the information security sector, offering services to companies, governments and individuals, helping them shield from hackers and cyber attacks.

Institute for Pervasive Cybersecurity - Boise State University

Institute for Pervasive Cybersecurity - Boise State University

Boise State University’s Institute for Pervasive Cybersecurity is a leader of innovative cybersecurity research and advancement in Idaho and the region.

vCISO Services

vCISO Services

vCISO Services is a small, specialized, veteran-owned firm focused on the needs of SMBs only.

Cyber Risk International

Cyber Risk International

Cyber Risk International offer CyberPrism, a B2B SaaS solution that empowers businesses to perform a self-assessment of their cyber security program.

Indian Cyber Security Solutions (ICSS)

Indian Cyber Security Solutions (ICSS)

Indian Cyber Security Solutions is an Enterprise Cyber Security Platforms company offering Cyber Security & Technical Education and Compliance & Penetration Testing Services.

Crispmind

Crispmind

Crispmind creates innovative solutions to some of today’s most challenging technology problems.

Techtron Business IT Services

Techtron Business IT Services

TECHTRON has been providing business IT services since 2004. Our focus is on SMBs and we are good at it. Our customers trust us, they love our high levels of service, and they love what we stand for.