With the U.S. congressional midterm elections and Taiwan's local elections approaching this November, election-related cybersecurity concerns extend beyond voting systems themselves. Political organizations, media outlets, and government agencies also warrant attention because they hold information that cyber attackers may seek. Meanwhile, online platforms that enable political discussion and information sharing can also be exploited to circulate misleading information.

Why Political Information Becomes a Target

Political information can be valuable in its own right. A previous case in the United States [1] showed that attackers gained access to accounts associated with a presidential campaign and stole nonpublic campaign documents and emails. The case shows that organizations do not need to administer elections to become targets; possessing information that interests attackers can be enough.

Current affairs can also provide effective cover for social engineering. Attackers may use elections or political events to create highly relevant email content and lure recipients into opening malicious links or files. [2] But an email that closely reflects a current political issue does not make the sender or attachment trustworthy.

Another less visible risk is information manipulation. Past influence operations have used websites and online profiles designed to closely imitate legitimate news outlets, borrowing the credibility of established media organizations to make deceptive content appear trustworthy. [3] These operations do more than fabricate content. They exploit people's trust in familiar sources of information.

This is why one question matters whenever we encounter political information: where did it really come from?

Even when the same claim appears across multiple platforms or is published on an authoritative-looking website, that does not make it authentic. Identifying who published the information and examining the publisher's possible intent can provide important context for assessing its credibility. [4]

Cyber espionage and information manipulation serve different objectives, but both demonstrate how political information can be exploited. The former may involve unauthorized access to sensitive information, while the latter seeks to influence public perception.

What Past Election Threats Reveal About Target Selection

TeamT5's observations of Taiwan's 2024 presidential and legislative elections found that China-nexus cyber espionage targeted media organizations across different perceived political affiliations, including outlets regarded as sympathetic to China. [5]

This finding challenges a common assumption: whether an organization becomes a target for intelligence collection is not determined simply by its perceived political position. The information an organization actually holds may itself make it a target for attackers.

Defending against these risks starts with three practical questions: Who is trying to access the information? Why does the message appear credible? Where did the information actually come from?

Want to understand more about the threats observed during Taiwan's elections? Request TeamT5's complete white paper, Cyber Threats against Taiwan's 2024 Presidential Election, for detailed findings and investigations.

References

  1. U.S. Department of Justice. Three IRGC Cyber Actors Indicted for 'Hack-and-Leak' Operation Designed to Influence the 2024 U.S. Presidential Election. September 27, 2024.

  2. Cybersecurity and Infrastructure Security Agency (CISA). Cybersecurity Toolkit and Resources to Protect Elections. Category 1: Phishing.

  3. European External Action Service (EEAS). Fighting Foreign Interference to Protect Our Democracy.

  4. Federal Bureau of Investigation (FBI). Election Crimes and Security. Section: Protect Your Vote.

  5. TeamT5. Cyber Threats against Taiwan's 2024 Presidential Election. Research Highlights, Item 2.