Author: Laurens Cerulus
Posted: March 5th 2017
THE HAGUE, Netherlands — Better safe than sorry.
That’s the Dutch government’s approach to dealing with the fear of Russian election hacking. The tech-savvy country scaled back the use of computers to count votes and opted for an all-paper, all-manual election this month. It is one of the more drastic responses to a threat that France and Germany, which also hold elections this year, have also started to grapple with.
The Dutch government has known about some of the vulnerabilities in the voting software since 2006 and banned electronic voting in 2007, but has been publicly — and frequently — reminded ever since by academics and hackers of vulnerabilities in the software used to count the votes. A decade later, the country still hasn’t come up with a secure tech system to cast and count votes.
It was only after the U.S. blamed Russia for hacking during the presidential election cycle last year that the Netherlands announced it was dropping computers entirely. The country’s almost 13 million voters will line up March 15 at more than 9,000 polling stations to tick the box for their candidate with pencils, and these votes will be counted by hand. It’s unclear how long it will take officials to get it done.
‘Haunting the election’
“I don’t want a shadow of doubt over the result in a political climate like the one we know today,” Interior Minister Ronald Plasterk said. “I can imagine some party or professor somewhere will say there is a remaining risk that it was hacked.
“And that would keep haunting the election outcome.”
Dutch officials fear Russian meddling following years of tensions with Moscow. The countries have sparred diplomatically over the downing of a Malaysia Airlines civilian airplane in 2014 by a surface-to-air missile, allegedly launched by Russian-backed forces in eastern Ukraine, that killed 298 people, most of them Dutch. Some Dutch officials saw a Russian hand in last year’s referendum on an EU treaty with Ukraine, which voters here rejected.
France, which holds elections in the spring, is also on guard. Both countries have Russia-friendly contenders on the ballot who want to sever ties with the European Union, Geert Wilders in the Netherlands and Marine Le Pen in France.
Dutch officials say the threat extends beyond voting: Politicians’ computers could be hacked and fake news could infiltrate media and blogs, they say.
In early February, Rob Bertholee, head of Dutch intelligence agency AIVD, said his services had identified hundreds of attacks by Russia targeting government systems that were intended to steal confidential documents.
“We’re talking about reports at the heart of government,” he said, adding that “it is a race to stay on top of things.”
The warnings aren’t sinking in as quickly as those issuing them would like.
In January, members of the Hague Security Delta — a cluster of businesses and governments — offered free IT support and education for politicians and the government. The response was near silence. One security firm, RedSocks Security, said only one MP turned up for a short introduction session to cybersecurity. Digital Infrastructure Association, an association of cloud, data storage and network companies, extended a similar offer and also generated little interest.
A few weeks ago, so-called benevolent hacker Sijmen Ruwhof told the newspaper NRC that several parties, including Prime Minister Mark Rutte’s People’s Party for Freedom and Democracy and its junior coalition partner the Labor Party, and Wilders’ Freedom Party, hadn’t installed security updates on their party websites for more than a year.
Cyber experts first sounded the alarm over politicians’ sloppiness back in 2006. A group led by hacker Rop Gonggrijp published a paper showing how easy it was to install software on the computers used in voting booths to change the results.
A campaign called “We don’t trust voting computers” sparked a controversy that lasts to this day.
The campaign successfully got politicians to ban voting computers in 2007. Since then, the Dutch have voted on pen and paper, but computers and electronic devices like flash drives were still used to count the votes and transfer the results from local polling stations to The Hague.
Today, the distrust has spread to anything electronic in the election process.
The government in early February said people counting the paper ballots will do it manually at every step. Volunteers will go through each vote by hand. The polling station official will carry a piece of paper with the final tally to the local commune, which will aggregate the tallies by hand and run with another piece of paper to one of 20 regional constituency offices, where officials will do the same and then rush to The Hague’s electoral council building to file the results — on paper. It’s unclear how long the counting will take, as even the electoral council is still figuring out the new system.
In mid-February, Interior Minister Plasterk reversed his position on one point and said he would allow communes to use a computer with a spreadsheet program to count the votes, but the computer cannot be connected to a network.
A series of hacks in the past decade destroyed Dutch people’s trust in computers when voting.
— Hacker Rop Gonggrijp breaks into a voting computer.
— A campaign to ban voting computers kicks off.
— Dutch intelligence agency AIVD delivers report spotlighting weaknesses in voting computers.
— Dutch interior minister nullifies a key order allowing voting computers in elections.
— Dutch elections for their European parliamentary seats return to pen-and-paper voting only.
— Student Maarten Engberts publishes study showing the IT system used to count votes is flawed.
— Investigatory committee delivers report saying voting computers can return with changes. The report is met with protests.
— RTL Nieuws hacks social media accounts of two politicians.
— Hacker Sijmen Ruwhof finds party websites are not up-to-date and badly secured.
— Engberts criticizes the government for failing to fix the holes he discovered in 2011.
— Dutch government bans computers from process of counting votes.
The fury over the election computers shows how sensitive the Dutch are to the issue.
“Paper always works, it’s the safest bet,” said Rutger Regtop and Milan Beltman, two first-time voters from the north of the country visiting The Hague. “It’s too easy for hackers to get into a computer — like we saw on the news.”
From Russia without love
Tensions between Russia and the Netherlands over the downing of the Malaysian plane over Ukraine haven’t eased. But last April’s referendum on the EU-Ukraine deal was to some here a Russian shot across the bow.
Russia waged a successful propaganda campaign to influence the conversation around the Ukraine referendum, according to Kees Verhoeven, an MP for the liberal D66 party. “Russia has clear strategic interest,” he said.
As he spoke with POLITICO in his office in the parliament, Verhoeven’s inbox was flooded with hundreds of emails as part of a mass online campaign calling on MPs to respect the Dutch rejection of the Ukraine referendum.
At the end of February, in spite of the referendum rejection, the lower house of the Dutch parliament approved the deal after a declaration was added to make clear the agreement is not a step toward Ukraine joining the EU. The deal is expected to be ratified in the Dutch upper house in the weeks following the election.