GCHQ to protect politicians and election candidates from cyber-attacks

Political candidates, election officials and others at high risk of being targeted online are being offered protection against phishing and malware attacks in the run-up to the next general election.

The move follows attempts by Russian intelligence services and hacking groups linked to China to target institutions, high-profile individuals and parliamentarians in the UK.

The UK’s National Cyber Security Centre, part of the GCHQ signals intelligence agency, is to provide the service, known as Personal Internet Protection, to high profile individuals considered at risk from attack by hostile states.

Security officials say that the mobile phone accounts of candidates and election officials, and their work accounts are “almost certainly” attractive targets for hostile nation states.

The government confirmed in 2023 that a hacking group linked to Russia’s FSB security service has targeted MPs from all parties with spear phishing hacking attacks since at least 2015.

And in March 2024, it emerged that a Chinese state hacking group had targeted the email accounts of over 40 UK parliamentarians that had spoken out against China or were members of the Inter-Parliamentary Alliance on China (IPAC).

The NCSC now plans to offer parliamentarians and other high-risk individuals an opt-in cyber protection service that will alert people if malicious activity is detected on their email accounts or devices.

The service, based on the NCSC’s Protective DNS service (PDNS), which became available in 2017, blocks access to  malicious web domains including phishing sites, spyware and malware.

Concerns about the risks of disruption to elections by hostile nation states were identified as a top threat facing countries by the World Economic Forum in January 2024.

Jonathon Ellison, NCSC Director for National Resilience and Future Technology, said: “Individuals who play important roles in our democracy are an attractive target for cyber actors seeking to disrupt or otherwise undermine our open and free society”.

The NCSC has also issued guidance to civil society groups who may be targeted by malicious hackers, including journalists, activists, academics, lawyers and dissidents.

The publication follows a meeting of agencies from 10 countries in Birmingham today at the NCSC’s CyberUK conference.

Computer Weekly identified the hacking group known as Callisto, ColdRiver, Tag-53, TA446 and BlueCharlie, which targeted high-profile individuals, including politicians in the UK as a Russian FSB operation in 2023.

Victims include the former head of MI6 Richard Dearlove, who’s emails were hacked an leaked from an encrypted email service in 2022 and left wing freelance journalist, Paul Mason, who has frequently criticised Putin’s war against Ukraine.

In February 2023, Scottish National Party MP Stewart McDonald disclosed that his emails had been hacked by the Russian hacking group. Other MPs have also been targeted.

The Protective DNS service, which is used by public sector organisations, currently handles more than 2.5 trillion site requests and prevents access to 1.5 million malicious domains, the NCSC said.