In perhaps the most prominent instance in recent memory, the leadup to the 2016 US Presidential elections saw the use of both cyber and information operations. Cyberattacks on the Democratic National Committee (DNC) targeted staffers from Hilary Clinton’s campaign, using phishing emails (fishy-looking emails containing conspicuous links to click) to gain access to, and later leak, files and emails. These cyberattacks were later deemed to have been carried out by two hacking groups, nicknamed Cosy Bear and Fancy Bear, each of which is believed to be a GRU (the military intelligence wing of the Russian Federation) unit operating out of Moscow.

The leadup to the same 2016 US Presidential elections also saw wide-reaching information operations targeting US citizens, using various online means to either implicitly or explicit encourage voters to support Donald Trump. This deeply institutionalised campaign originated from the St. Petersburg-based Internet Research Agency; nicknamed ‘The Troll Factory’ this Kremlin-backed agency had 400 staff, of whom 80 reportedly focused on American targets. Using both paid advertising and ‘organic’ reach (via actual people behind computer screens, posing as Americans), the Internet Research Agency is believed to have reached as many as 126 million people on Facebook and 1.4 million people on Twitter. These campaigns are believed to date back to 2015, a year prior to the election.

The use of cyber and information operations in US elections are far from new. Much more recently, the deployment of such tactics could be seen in the leadup to Moldova’s vote on its presidency and a constitutional clause to name EU membership as the country’s goal. Indeed, Moldova’s Central Election Commission faced cyberattacks in November 2023, while high-level politicians, including its Minister of Justice and Presidential Advisor, have been subjected to hack-and-leak cyberattacks. Just days before the vote, the European Parliament condemned Russia’s interference in Moldova’s elections, citing voter fraud schemes, cyber operations, and information warfare, in a manner that ‘undermines’ Moldova’s sovereignty. Ultimately, a mere 0.92% of the vote made the difference; the ‘yes’ vote in favour of the constitutional clause prevailed in the election. However, the presidential vote will go to a second round on 3rd November, the result of which remains to be seen.

What is difficult, if not nearly impossible, to measure is whether cyber and information operations actually, fundamentally alter the outcome of elections. There is no true way to measure an alternative outcome; if Russia had not employed cyber and information operations in 2016, might Clinton have won the presidency? We cannot know. What we do know is that these tactics have not gone away, and that they continue to pervade election campaigns to date. From 2016 to 2024, what remains consistent is that foreign actors continue to meddle in elections, in the US and elsewhere, deploying similar tactics to those described above. What, then, is the antidote?

There is no such thing as a 100% foolproof response, either in cybersecurity or information warfare. But there are certainly measures that can be undertaken to bolster a nation’s defences to these tactics. To combat cyber operations, governments and those involved in the electoral process – from political parties to electoral management boards – would be wise to invest in up-to-date cybersecurity protections, to ensure that their systems are optimally secure.  

However, at the same time, the human side of cybersecurity is equally, if not more, important. A general cyber awareness is critical: the ability of personnel involved in the electoral process to identify and avoid phishing emails, clicking on suspicious links, or providing their credentials, among myriad tactics used to target the unwitting average person. The same goes for discerning disinformation: media literacy is crucial, so that consumers of new media and users of social media platforms can identify and critically analyse the information before them. Ultimately, governments across the world must grapple with this questions: how can they protect themselves, and how can they educate and best equip their citizens? Their response requires investment and creativity.

The role and impact of cyber and information operations remains a question across many of the ongoing elections during this unusually busy election year. To what extent will cyber and information impact the US elections, the ongoing Moldovan Presidential elections, and the countless others taking place this year? It is practically without question that these tactics will continue to be present, but only time will tell the ways in which these technologies shape this unprecedented year’s elections.