Cyber Threats to Canada’s Democratic Process: 2023 update

Trend 2: Russia and China continue to conduct most of the attributed cyber threat activity targeting foreign elections

We observe that state-sponsored cyber threat actors with links to Russia and China continue to conduct most of the attributed cyber threat activity targeting foreign elections since 2021. Russia has consistently been responsible for observed cyber threat activity interfering with foreign elections since 2016, and China has been active every year since 2015, with the exception of 2017 and 2021 (Figure 2). Russia and China’s cyber threat activity includes attempted DDoS attacks against election authority websites, accessing voter personal information or information relating to the election, and vulnerability scanning on online election systems.

Figure 2: Proportion of cyber incidents attributed to countries targeting foreign national-level elections by year

Long description - Figure 2

A bar chart of foreign cyber incidents per year and broken down by attributed perpetrator. For each year between and including 2015-2022, there is a vertical bar with up to 4 colours and all bars add up to 100%. Each of the colours represent the percentage of foreign cyber incidents that was attributed to a single type of actor, either Russia, China, Other, or Unknown.

The data for this chart is as follows:

Election Year	China Percentage	Russia Percentage	Other Percentage	Unknown Percentage
2015	12.5	0	0	87.5
2016	15.0	35.0	5.0	45.0
2017	0	46.2	0	53.8
2018	14.3	7.1	0	78.6
2019	3.9	34.6	11.5	50.0
2020	20.0	23.3	23.3	33.4
2021	0	11.1	0	88.9
2022	6.1	9.1	0	84.8

We assess that attributed cyber threat activity is almost certainly focused on influencing elections to fulfill strategic objectives in geopolitical regions of interest to Russia and China. In some cases, cyber activity is politically motivated and will target a country’s democratic processes as a form of retribution. For example, pro-Russia state-affiliated cyber actors have targeted elections of countries who have provided assistance to Ukraine. We assess it very likely that Russia and China will continue to be responsible for most of the attributed cyber threat activity targeting foreign elections and will focus on targeting countries of strategic significance to them. We note that upcoming European elections in 2023 and 2024 could be a significant target for Russia due to the military and economic importance of Europe’s support to Ukraine.

Trend 3: The majority of cyber threat activity targeting elections is unattributed

Since the publication of the Cyber Threats to Canada’s Democratic Process: July 2021 update, more than half of the perpetrators of cyber threat activity targeting national elections were unknown. In 2022, 85% of cyber threat activity targeting elections was unattributed, meaning that these cyber incidents are not ascribed or credited to a state-sponsored cyber threat actor. We assess it very likely that cyber threat actors are increasingly using obfuscation techniques and/or are outsourcing their cyber activities in order to hide their identities or links to foreign governments.

By outsourcing malicious cyber threat activities, foreign adversaries can avoid public attribution and diplomatic consequences. Foreign adversaries have been increasing their use of non-state cyber threat groups to avoid cyber activities being linked back to their government. Non-state cyber threat groups have less government oversight, do not abide by the same conventions and norms, and can organize cyber activities, such as distributed denial-of-service (DDoS) attacks, quickly and with little warning. Foreign adversaries are also using influence-for-hire firms to conduct influence operations under the radar. Since 2011, at least 27 online information operations have been partially or wholly attributed to commercial public relations or marketing firms.^{Footnote 6} Services related to election interference represent a growing market, and if the use of third-party proxies continues, we assess that in the next two years, governments will likely have difficulties linking cyber threat activities targeting elections back to the foreign adversaries responsible.^{Footnote 7}

Trend 4: Generative AI is increasingly being used to influence elections

Cyber threat actors are using generative AI technologies to shape the future of democratic debate online. In August 2019, researchers found that there has been an increase in dark web source activities, as well as an increase in advertising for customized deepfake service offerings.^{Footnote 8}Since the publication of the Cyber Threats to Canada’s Democratic Process: July 2021 update, we have detected an increase in the amount of synthetic content (e.g. deepfakes) relating to elections, almost certainly due to the increased accessibility of many of these technologies. However, we note that the number of reported cases where synthetic content is being used to spread disinformation about elections remains relatively low compared to the amount of synthetic content observed online. We assess that AI synthetic content generation related to national elections will almost certainly increase in the next two years, as this technology becomes more widely available. As synthetic content generation increases and becomes more widespread, it will almost certainly become more difficult to detect, making it harder for Canadians to trust online information about politicians or elections.

Cyber threat activity and election influence campaigns

Cyber threat activity can generate disinformation that influences voters ahead of elections. This disinformation can be part of a wider election influence campaign, where cyber threat actors use social engineering tactics and techniques to manipulate voters’ emotions and behaviours.^{Footnote 17} Gaining unauthorized access to privileged information can influence public discourse online and potentially affect voters’ opinions and voting preferences. This type of cyber threat activity can include a hack-and-leak of sensitive information from a political party’s database, hacking into a politician’s social media account to post disinformation, or defacing a political party’s website with disinformation. Rather than targeting election infrastructure directly, cyber threat actors will use cyber capabilities to try to influence or manipulate the electorate.

Cyber activity against democratic processes worldwide is more often conducted to influence the electorate prior to elections rather than to target election infrastructure (Figure 4). Based on these findings, we assess that on average, cyber threat actors targeting elections favour manipulating the information environment over attempts to directly impact the voting process.

Figure 4: Number of observed incidents targeting national-level elections via election infrastructure vs. social engineering by year

Long description - Figure 4

A bar chart of number of incidents targeting either election infrastructure or involving social engineering. For each year between and including 2015-2022, there are two vertical bars, in different colours, the height of which indicates the number of incidents.

The data for this chart is as follows:

Election Year	Incidents involving social engineering	Incidents involving election infrastructure
2015	1	3
2016	5	2
2017	6	2
2018	5	2
2019	7	5
2020	10	9
2021	9	6
2022	14	2

There are several reasons why cyber threat actors conduct social engineering rather than target election infrastructure. These include:

• having a broader set of targets to choose from
• needing fewer bespoke techniques, tactics, and procedures (TTPs) to gain access to privileged information
• targeting sources of information that do not have the protection of an IT team (e.g. obtaining information from a political staffer’s personal email account)
• justifying hack-and-leaks as being altruistic and providing the public with important information that they “should know about”
• being able to outsource influence activities to a marketing or PR firm
• having more plausible deniability; targeting the electorate is less direct, and harder to trace

Foreign adversaries conducting influence campaigns

Foreign adversaries will use cyber threat activity to influence elections by creating, circulating, and/or amplifying disinformation in online public spaces. They do this to manipulate a country’s population covertly in the hopes that the outcome of the election will align with their strategic objectives abroad. Foreign adversaries may also consider targeting another country’s electorate as being less escalatory than targeting the country’s election infrastructure. Nevertheless, foreign adversaries will attempt to obfuscate their involvement in influence campaigns and the cyber activities that feed into these influence campaigns. Geo-spoofing and encrypted messaging platforms make it extremely difficult to identify disinformation’s origin.^{Footnote 18} In some cases, they will hire a third party to conduct influence campaigns to target elections. These third parties are commonly referred to as “influence-for-hire” firms and are part of a thriving industry that has grown since 2019.^{Footnote 19} Researchers at the Oxford Internet Institute found 48 instances of states working with influence-for-hire firms from 2019 to 2020, a 128% increase since the 2017 to 2018 period.^{Footnote 19} Foreign adversaries will also use social botnets to amplify certain narratives online and push content onto voters with the same political views, worsening the effect of political echo chambers and increasing political polarization ahead of elections.^{Footnote 20} We assess almost certainly that influence campaigns propagated by state-sponsored cyber threat actors represent an ongoing, persistent threat to Canadians.

Generative AI threatens democratic processes

Generative artificial intelligence can produce various types of content, including text, images, audio, and video, sometimes referred to as “deepfakes.” This synthetic content can be used in influence campaigns to covertly manipulate information online, and as a result, influence voter opinions and behaviours. Despite the potential creative benefits of generative AI, its ability to pollute the information ecosystem with disinformation threatens democratic processes worldwide.

In recent years, generative AI has become increasingly popular as its ability to generate synthetic content (text, images, or videos) has become accessible through large tech companies like OpenAI, Meta, and Google. Unfortunately, cyber threat actors are also using these capabilities to generate or amplify disinformation online. Between August 2019 and January 2021, third-party monitoring recorded an uptick in dark web source activities on deepfake-related topics as well as an increase in advertising for customized deepfake service offerings.^{Footnote 23} We assess it very likely that cyber threat actors will increasingly use generative AI in influence campaigns targeting elections.

Figure 5: Types of synthetic content created by Generative AI

Long description - Figure 5

Three separate circles each representing the different types of synthetic content that generative AI can create: 1) Text, 2) Image, 3) Video

In most cases, it is unclear who is behind AI-generated disinformation. However, we assess it very likely that foreign adversaries or hacktivists will use generative AI to influence voters ahead of Canada’s next federal election. We have observed that cyber threat actors are already using this technology to pursue strategic political objectives abroad. For example, pro-Russia cyber threat actors have used generative AI to create a deepfake of Ukrainian President Zelenskyy surrendering following Russia’s invasion of Ukraine.^{Footnote 24} We assess that foreign adversaries and hacktivists are likely to weaponize generative AI within the next two years to create deepfake videos and images depicting politicians and government officials and to further amplify and automate inauthentic social botnets using text and image generators.

Deepfake videos influencing elections

The term “deepfake video” – combining “deep learning” and “fake” – refers to machine learning models that use image and audio synthesis techniques to generate fake videos that can appear realistic and genuine to viewers. Generative AI is used to reverse engineer real audio or video of a person to convincingly mimic their image and style of speech, producing a video of events that never actually occurred.^{Footnote 25} Deepfake videos of political figures risk deceiving voters and creating further political polarization. For example, in February of 2023, a deepfake was circulated on social media depicting Joe Biden making anti-transgender comments, despite his administration’s public support for the LGBTQ community.^{Footnote 26} This example is only one among thousands of deepfakes of politicians circulating on social media, making it harder for voters to distinguish between real and fake political messaging.^{Footnote 27} The public’s own understanding of the prevalence of deepfake videos online can also bring into question legitimate sources of information. For example, political debates can be a source of crucial information for voters in the lead up to the election since they present political party platforms and have been shown to change swing voters’ candidate preferences.^{Footnote 28} However, if cyber threat actors circulate deepfakes altering debate content, voters may be deceived. Even if the truth is made clear later on, the damage may lead voters to question the legitimacy of political debates in the future. While most social media platforms, such as Instagram, Facebook, and YouTube, are making efforts to flag and remove deepfakes from their platforms, they are not always able to detect and remove deepfake content quickly before it can be widely circulated.

Social media companies’ ability to detect and remove deepfakes is further complicated by considerations about creativity and freedom of speech. Political parties are themselves using generative AI capabilities as part of their campaigns, for example, to create videos depicting “future scenarios” if a political rival is elected.^{Footnote 29} While disclaimers are used to identify the video as a deepfake, very little regulation currently exists in Canada and the US on the extent to which generative AI can be used in political advertising.^{Footnote 30}

Social botnets augmented by AI capabilities

Cyber threat actors use fake social media profiles to disseminate or amplify disinformation ahead of elections.^{Footnote 31} A cluster of fake profiles operated by software robots, or “social botnets”, can “control online social network accounts and mimic the actions of real users”.^{Footnote 32} Social botnets can influence and/or misrepresent popular opinion and researchers have found that bots accounted for as much as 10% of accounts participating in conversations on certain topics, such as crisis events.^{Footnote 33} Social botnets have also been known to amplify domestic narratives or disinformation to contribute to a country’s political polarization. As such, they are often part of larger influence campaigns and several “influence-for-hire” firms list this as one of their offered services.^{Footnote 34}

We assess that generative AI will almost certainly be increasingly used to further automate and augment social botnet functions in the next two years. AI text generators, like ChatGPT and Bard, are capable of generating paragraphs of coherent text that are virtually impossible to tell apart from human writing.^{Footnote 35} These generative AI capabilities can be applied to social botnets to improve their posts and make them sound more believably human.^{Footnote 36} Moreover, AI image generators, like GAN Lab, Midjourney or DALL-E, can fabricate fake images that are in some cases almost impossible to tell apart from real ones.^{Footnote 37} These capabilities can be used to generate fake profile pictures for botnet social media accounts, or to generate misleading content for posts. For example, in March 2023 a pro-Chinese government influence campaign used several AI-generated images to support narratives negatively portraying US leaders.^{Footnote 38} Differentiating between what is real and what is AI-generated will become more difficult for voters as social botnets continue to evolve and as generative AI capabilities become increasingly available.

We assess it very likely that the capacity to generate deepfakes exceeds our ability to detect them. Current publicly available detection models struggle to reliably distinguish between deepfakes and real content. Given the ineffectiveness of deepfake detection models, and the increasing availability of generative AI, it is likely that influence campaigns using generative AI that target voters will increasingly go undetected by the general public. We also assess that it is very likely that as technology develops, it will become better at fooling detection models, which will make it more difficult for social media companies to detect and automatically remove synthetic content before it reaches voters.

Implications for Canada

Based on our findings, we assess that disinformation about the next federal election will almost certainly be found online and that foreign adversaries will likely use generative AI to target Canada’s federal election in the next two years. We assess that, overall, Canada is a lower priority target for cyber threat activity than some of its allies, such as the US and UK. However, Canada does not exist in a vacuum and cyber activity affecting our allies’ democratic processes will likely have an impact on Canada as well. For example, a high percentage of Canadians use US social media platforms and are often exposed to the same deepfakes and foreign influence campaigns targeting US citizens.^{Footnote 39}

We also note that the four global trends we identified have implications for Canada. The percentage of elections targeted by cyber threat activity has increased globally and, based on this trend, we assess cyber incidents are also more likely to happen in Canada’s next federal election than they have been in the past. As stated in the National Cyber Threat Assessment 2023-2024, cyber threat activity has become an important tool for states to influence events without reaching the threshold of conflict. We judge that cyber threat activity targeting democratic processes are likely viewed by foreign adversaries such as China and Russia as an obscure and risk-averse way of impacting Canada’s policy outcomes. We also note that identifying the perpetrators of cyber threat activity targeting elections is becoming increasingly difficult as obfuscation techniques and third-party contracting become widespread. We judge it likely that this will also mean that it will become increasingly difficult for Canada to attribute cyber threat activity targeting its democratic processes.

In Canada, technology is used throughout the national election process and can be an important part of making elections efficient and accurate, however, not having physical paper ballots presents some risks. Relying on digital forensic teams to assess election interference presents challenges including flagging non-fraudulent voting abnormalities as fraud and not being able to distinguish cyber compromises from system malfunctions. Currently, Canada’s national elections are paper based, however, some provincial, territorial, Indigenous and municipal governments are deliberating the benefits and drawbacks of online voting.^{Footnote 40} The Northwest Territories conducted its 2019 territorial elections using online voting and a large percentage of municipalities in Ontario and Nova Scotia are adopting online voting practices. As of September 15, 2023, we found that 217 of Ontario’s 444 municipalities (49%) and 42 of Nova Scotia’s 49 municipalities (86%) used online voting in at least one of their past elections. (Figure 6)

Figure 6: Map of electronic voting in Canada

Long description - Figure 6

A map of Canada, with the provinces and territories slightly separated. They are all uniformly coloured, except for the Northwest Territories, Ontario, and Nova Scotia. The Northwest Territories has a dotted pattern, which indicates it had one territorial election with online voting. Ontario and Nova Scotia have two colours, the amount of each colour being proportional to the number of municipalities using online voting. For Ontario, this is 49% and for Nova Scotia, this is 86%.

Potential election interference and suspected election result tampering can put into question the legitimacy of an election and result in investigations into the election process. Disproving false narratives relating to election interference can be difficult: the technical components of cyber threat activity are not always easily understood by voters and the extent of cyber compromises can be misunderstood or misinterpreted.

Looking ahead

Cyber threat activity continues to be used to target democratic processes globally, and the Government of Canada, CSE, and the Cyber Centre produce advice and guidance to help inform Canadians about the cyber threats to Canada’s elections.

The Cyber Centre provides cyber security advice and guidance to all major political parties, in part through publications such as the Cyber Security Guide for Campaign Teams and Cyber Security Advice for Political Candidates.

The Cyber Centre has also published the following:

• Cyber Security Guidance for Elections Authorities
• Cyber Security Guidance on Generative Artificial Intelligence (AI)
• Guide on Security Considerations When Using Social Media in Your Organization

The Cyber Centre also works closely with Elections Canada to protect its infrastructure, including publishing a report on Security Considerations for Electronic Poll Book Systems.

We encourage Canadians to consult the Cyber Centre’s resources including the National Cyber Threat Assessment 2023-2024, and the How to Identify Misinformation, Disinformation, and Malinformation publication, as well as the Fact Sheet for Canadian Voters. CSE’s Get Cyber Safe campaign will also continue to publish relevant advice and guidance to inform Canadians about cyber security and the steps they can take to protect themselves online.