Partnering to Protect Political Campaigns in Latin America Against Cybersecurity Threats
From Argentina to Mexico, political campaigns are battling cyberattacks in Latin America. This year, the International Republican Institute (IRI) continues its partnership with digital democracy pioneers to help political campaigns combat cybersecurity threats in Latin America and beyond.
Cybersecurity threats pose a risk to political campaigns worldwide and have the potential to undermine democracy and election integrity in the process. To counteract these threats in Argentina, IRI partnered with the National Democratic Institute (NDI) and the Harvard Kennedy School’s Belfer Center to launch the Defending Digital Democracy (D3P)’s “Cybersecurity Campaign Playbook: Spanish Edition” on August 26, 2019 in Buenos Aires, Argentina.
In recent years, domestic and foreign cyberattacks have become an increasing problem in Latin America. In fact, the number of reported ransomware cases grew by 131 percent in 2016 alone. One study by Kaspersky Lab revealed that in the past year there were a registered 45 cyberattacks per second. As recently as August 2019, hackers leaked 700 GB of the Argentine government’s data using the Twitter account LaGorraLeaks2.0. The hackers targeted the Argentine Federal Police, leaking confidential documents, wiretaps, biometric information and the personal data of police officers. These same attackers also hacked the Argentine naval prefecture’s Twitter account and used it to announce a false British attack on Argentine ships.
Other cyberattacks in Latin America have targeted political campaigns and elections to undermine the democratic process in the region. In 2018, for instance, hackers launched a distributed denial of service (DDoS) attack during the final Mexican presidential election debate between Ricardo Anaya, the candidate of the National Action Party (Partido Acción Nacional, PAN), and front-runner Andres Manuel Lopez Obrador. The attack corrupted PAN’s website moments after Anaya announced the website contained documents that proved Lopez Obrador’s corruption. During Brazil’s 2018 general elections, cybersecurity firm FireEye exposed a coordinated Russian cyber interference campaign. Using Twitter, the attackers amplified discussions that questioned and undermined the elections’ legitimacy.
Campaigns in Latin America and around the world are largely unprepared for these emerging cybersecurity threats. The nature of campaigns — fast moving, low resource and limited infrastructure — can make cybersecurity seem like a low priority. However, cyberattacks increasingly have the capacity to derail a campaign by corrupting important communication channels, compromising sensitive information, and shifting narratives or distracting candidates at critical moments during election cycles.
After the Russian-sponsored hack during the 2016 elections in the United States, a bipartisan team led by prominent U.S. campaign strategists Matt Rhoades and Robby Mook developed the “Cybersecurity Campaign Playbook.” Experts in cybersecurity, politics and law helped Rhoades and Mook design the playbook by outlining a simple yet actionable plan to counter the growing cyber threat. The playbook helps campaigns implement a cybersecurity framework that will protect their parties from the most common cyber security threats despite the resource and time limitations campaigns face. This work is important to IRI’s efforts to strengthen the capacity of political parties and democratic institutions worldwide in the digital age. IRI, NDI and the Belfer Center previously partnered to launch D3P’s “Cybersecurity Campaign Playbook: European Edition” in 2018 and The Cybersecurity Campaign Playbook: India Edition” earlier this year.
Like its companions, the “Cybersecurity Campaign Playbook: Spanish Edition” is designed for campaigns that do not have the resources to hire full-time, professional security staff. It provides a framework for a cybersecurity risk mitigation strategy that people without technical training can implement. Included in the playbook is a list of recommendations, such as the “Top Five Checklist”:
- Establish a culture of information security awareness
- Use the cloud
- Use two-factor authentication
- Use encrypted messaging for sensitive conversations
- Plan and prepare
The August cyberattack on Argentina shows the continued need for effective cybersecurity and a culture that promotes cybersecurity awareness. For example, the Argentine navy prefecture’s Twitter account did not have a two-factor authentication, which made the account vulnerable to cyberattacks. The hackers also leaked personal information, documents and messages that could have been better secured on the cloud or through encrypted messages. To address future threats, campaigns and governments alike must implement the strategies outlined in the “Cybersecurity Campaign Playbook: Spanish Edition” to not only protect their personal information, but the democratic processes and institutions of their countries.
The more than 100 legislators, representatives of the Argentine executive branch and civil society organizations, members of political parties, academics and the general public, who attended the playbook’s Buenos Aires launch indicate a high level of interest in this topic. IRI and NDI will work to help campaign teams in Argentina and across the region understand the tools and practices required to ensure campaign cybersecurity, drawing on the lessons of “Cybersecurity Campaign Playbook: Spanish Edition.” IRI will also conduct cybersecurity campaign programming ahead of this year’s general elections in Bolivia and local elections in Colombia. And we look forward to working with digital democracy pioneers worldwide to equip political campaigns with practical advice and tools necessary to counter cybersecurity threats.
Top