Tag: Electoral Commission

Posted on

Parsing the UK voter register cyberattack

A catastrophic breach of the United Kingdom electoral register affects tens of millions of residents following a cyberattack at the U.K. Electoral Commission.

With data on more than 40 million voters accessed by unnamed hackers, the cyberattack is already one of the U.K.’s largest ever hacks.

The Electoral Commission said the hackers accessed a “high volume” of personal information of people registered to vote in the U.K. between 2014 and 2022, including names and home addresses. The information is used for research and conducting checks on political donors. The Commission said there was no impact on the integrity of elections or any voter’s registration since “live” electoral registers are handled by local election authorities.

The cyberattack was disclosed Tuesday, more than nine months after the organization said it discovered “suspicious activity” on its network in October 2022. The Commission said the hackers first gained access more than a year earlier in August 2021.

Why the U.K. public is first hearing about it now is anybody’s guess. The Electoral Commission declined to answer our specific questions, citing an ongoing investigation by the U.K. data protection authority, the Information Commissioner’s Office. When reached, an ICO spokesperson would not say why the Commission took nine months to disclose the cyberattack.

The Electoral Commission’s website has limited details about the incident.

TechCrunch has annotated the Commission’s data breach notice 🖍 with our analysis of what it says and what was left out, just as we did with the security incidents at LastPass and Samsung last year. You can tap each 🖍 link and it’ll open the notice for you to follow along. Knowing what to look for when organizations publicly disclose their security incidents can help shed light on what happened.

What the Electoral Commission said in its data breach notice

The Commission is “unable” to ascertain if data was actually stolen

It’s not disputed that the hackers gained access to the Commission’s network, including its file sharing systems and email server 🖍. It’s that the Commission does not know if data was taken or exfiltrated from its systems. The Commission’s notice specifically notes: “We have been unable to ascertain whether the attackers read or copied personal data.” 🖍

The question really is, what monitoring and logging did the Commission have in place, if any, to detect or identify a data breach?

Accessed data includes voters’ names, addresses, and non-public voter information

According to the notice, the personal data accessed by the hackers includes names, email addresses and postal addresses, phone numbers 🖍 and any correspondence that voters had with the Commission, including emails (more on that below). Voters registered to vote anonymously are not affected by the cyberattack, the Commission confirmed.

The compromised data does, however, include information on voters who opted out of having their information published in the public voter registers, which are available to anyone wanting to purchase.

Commission said suspicious logins flagged the hack

Buried in its notice, the Commission said it was first alerted to the attack “by a suspicious pattern of log-in requests to our systems” 🖍 in October 2022. Once the Commission identified the suspicious pattern of logins, presumably the initial access was then traced back to August 2021. This means that the hackers were in the Commission’s systems for more than a year before they were noticed, and likely longer until they were fully expelled.

As a result of the security incident, the Commission said it “strengthened our network login requirements” 🖍 but did not say specifically how. That could be anything from implementing two-factor authentication to simply improving their existing security protections.

“Hostile actor” likely suggests evidence of malice

The Commission described the hackers as “hostile actors,” 🖍 citing its unnamed cybersecurity partners, presumably incident response with knowledge of investigating cyberattacks. We don’t know what the evidence is, or what the Commission constitutes “hostile.” Given this, we can likely conclude that whatever access or activity that the hacker gained suggests a level of malice not typically carried out by good-faith security researchers in the pursuit of reporting and fixing security flaws.

What we don’t know about the Electoral Commission hack

The Commission does not know who is behind the breach

We don’t know what the motivations of the hackers are, or whether they are financially driven or a state-backed hacker conducting espionage.

The Commission said nobody has “claimed responsibility” 🖍 for the hack, suggesting that the hackers have not contacted the Commission with an extortion demand, such as a ransom to return encrypted or stolen data. The Commission also said that “we do not know who is responsible for the attack.” 🖍

This is important as it suggests neither the hackers have claimed responsibility nor has the Commission heard from the hackers. Where there isn’t a financial motivation for a cyberattack, one might instead wonder what value this data has to an adversarial nation.

It’s not known how the Commission’s email server was compromised

A key part of this cyberattack was the hackers’ access to the Commission’s email server. According to the notice, the hackers gained access to copies of the electoral registers 🖍 and its email servers, which the Commission said contains “a broad range of information and data,” 🖍 without specifying more.

Commission spokesperson Andreea Ghita said that as a result anyone who contacted the Commission by email or through its web form “will have provided data that was accessible as part of this attack.”

The Commission runs largely a Windows-based environment. TechCrunch identified that the Commission’s email server is a self-hosted Exchange email server, which was online until at least August 2022, per its listing in Shodan, a database for public servers and databases. The Exchange server was also fully patched at the time it was listed, according to security researcher Kevin Beaumont, who checked our findings.

However, August 2022 was the same month that hackers began exploiting a then-unpatched zero-day flaw affecting Exchange on-premise servers called ProxyNotShell, which can be abused to gain full control of an email server. At the time, there were no patches for ProxyNotShell until months later in November 2022, Beaumont said. Exploitation of ProxyNotShell was widespread across the internet.

A key question will be if the hackers gained access to the Commission’s network and then its email server, or if the email server was compromised first and used to pivot and gain access to the Commission’s network. It’s a missing detail that could be important in understanding how the cyberattack was carried out.

Why did it take nine months to go public?

The Commission confirmed that it reported the hack 🖍 to the Information Commissioner’s Office within the statutory 72 hours from the time of initial discovery of a cyberattack as required by U.K. data protection law.

The big question is why it took the Electoral Commission nine months to tell the public — whose information was ultimately affected — with the cyberattack. The Commission declined to comment citing the ICO’s ongoing investigation. It’s also unclear why the nine-month delay was permitted by the ICO, which declined to comment when reached by TechCrunch.

The Commission said that it had to take “several steps” 🖍 before it could make the incident public, such as expelling the hackers from its systems, assess the damage, and put in place new security measures to prevent a similar attack.

Those nine months of silence will likely face considerable scrutiny from those investigating the incident.

Posted on

UK gov’t asleep at the wheel on Russia cyber ops threat, report warns

The UK lacks a comprehensive and cohesive high level strategy to respond to the cyber threat posed by Russia and other hostile states using online disinformation and influence ops to target democratic institutions and values, a parliamentary committee has warned in a long-delayed report that’s finally been published today.

“The UK is clearly a target for Russia’s disinformation campaigns and political influence operations and must therefore equip itself to counter such efforts,” the committee warns, calling for legislation to tackle the multi-pronged threat posed by hostile foreign influence operations in the digital era.

The report also urges the government to do the leg work of attributing state-backed cyber attacks — recommending a tactic of ‘naming and shaming’ perpetrators, while recognizing that UK agencies have, since the WannaCry attack, been more willing to publicly attribute a cyber attack to a state actor like Russia than they were in decades past. (Last week the government did just that in relation to COVID-19 vaccine R&D efforts — attacking Russia for targeting the work with custom malware, as UK ministers sought to get out ahead of the committee’s recommendations.)

“Russia’s cyber capability, when combined with its willingness to deploy it in a malicious capacity, is a matter of grave concern, and poses an immediate and urgent threat to our national security,” the committee warns.

On the threat posed to democracy by state-backed online disinformation and influence campaigns, the committee also points a finger of blame at social media giants for “failing to play their part”.

“It is the social media companies which hold the key and yet are failing to play their part,” the committee writes, urging the government to establish “a protocol” with platform giants to ensure they “take covert hostile state use of their platforms seriously, and have clear timescales within which they commit to removing such material”.

“Government should ‘name and shame’ those which fail to act,” the committee adds, suggesting such a protocol could be “usefully expanded” to other areas where the government is seeking action from platforms giants.

Russia report

The Intelligence and Security Committee (ISC) prepared the dossier for publication last year, after conducting a lengthy enquiry into Russian state influence in the UK — including examining how money from Russian oligarchs flows into the country, and especially into London, via wealthy ex-pats and their establishment links; as well as looking at Russia’s use of hostile cyber operations to attempt to influence UK elections.

UK prime minister Boris Johnson blocked publication ahead of last year’s general election — meaning it’s taken a full nine months for the report to make it into the public domain, despite then committee chair urging publication ahead of polling day. The UK’s next election, meanwhile, is not likely for some half a decade’s time. (Related: Johnson was able to capitalize on unregulated social media ads during his own election campaign last year, so, er… )

The DCMS committee, which was one of the bodies that submitted evidence to the ISC’s inquiry, has similarly been warning for years about the threats posed to democracy by online disinformation and political targeting — as have the national data watchdog and others. Yet successive Conservative-led governments have failed to act on urgent recommendations in this area.

Last year ministers set out a proposal to regulate a broad swathe of ‘online harms’, although the focus is not specifically on political disinformation — and draft legislation still hasn’t been laid before parliament.

“The clearest requirement for immediate action is for new legislation,” the ISC committee writes of the threat posed by Russia. “The Intelligence Community must be given the tools it needs and be put in the best possible position if it is to tackle this very capable adversary, and this means a new statutory framework to tackle espionage, the illicit financial dealings of the Russian elite and the ‘enablers’ who support this activity.”

The report labels foreign disinformation operations and online influence campaigns something of a “hot potato” no UK agency wants to handle. A key gap the report highlights is this lack of ministerial responsibility for combating the democratic threat posed by hostile foreign states, leveraging connectivity to spread propaganda or deploy malware.

“Protecting our democratic discourse and processes from hostile foreign interference is a central responsibility of Government, and should be a ministerial priority,” the committee writes, flagging both the lack of central, ministerial responsibility and a reluctance by the UK’s intelligence and security agencies to involve themselves in actively defending democratic processes.

“Whilst we understand the nervousness around any suggestion that the intelligence and security Agencies might be involved in democratic processes – certainly a fear that is writ large in other countries – that cannot apply when it comes to the protection of those processes. And without seeking in any way to imply that DCMS [the Department for Digital, Culture, Media and Sport] is not capable, or that the Electoral Commission is not a staunch defender of democracy, it is a question of scale and access. DCMS is a small Whitehall policy department and the Electoral Commission is an arm’s length body; neither is in the central position required to tackle a major hostile state threat to our democracy.”

Last July the government did announce what it called its Defending Democracy programme, which — per the ISC committee report — is intended to “co-ordinate work on protecting democratic discourse and processes from interference under the leadership of the Cabinet Office, with the Chancellor of the Duchy of Lancaster and the Deputy National Security Adviser holding overall responsibility at ministerial and official level respectively”.

However the committee points out this structure is “still rather fragmented”, noting that at least ten separate teams are involved across government.

It also questions the level of priority being attached to the issue, writing that: “It seems to have been afforded a rather low priority: it was signed off by the National Security Council only in February 2019, almost three years after the EU referendum campaign and the US presidential election which brought these issues to the fore.”

“In the Committee’s view, a foreign power seeking to interfere in our democratic processes – whether it is successful or not – cannot be taken lightly; our democracy is intrinsic to our country’s success and well-being and any threat to it must be treated as a serious national security issue by those tasked with defending us,” it adds.

The lack of an overarching ministerial body invested with central responsibility to tackle online threats to democracy goes a long way to explaining the damp squib of a response around breaches of UK election law which relate to the Brexit vote — when social media platforms were used to funnel in dark money to fund digital ads aimed at influencing the outcome of what should have been a UK-only vote.

(A redacted footnote in the report touches on the £8M donation by Arron Banks to the Leave.EU campaign — “the biggest donor in British political history”; noting how the Electoral Commission, which had been investigating the source of the donation, referred the case to the National Crime Agency — “which investigated it ***” [redacting any committee commentary on what was or was not found by the NCA]; before adding: “In September 2019, the National Crime Agency announced that it had concluded the investigation, having found no evidence that any criminal offences had been committed under the Political Parties, Elections and Referendums Act 2000 or company law by any of the individuals or organisations referred to it by the Electoral Commission.”)

“The regulation of political advertising falls outside this Committee’s remit,” the ISC report adds, under a brief section on ‘Political advertising on social media’. “We agree, however, with the DCMS Select Committee’s conclusion that the regulatory framework needs urgent review if it is to be fit for purpose in the age of widespread social media.

“In particular, we note and affirm the Select Committee’s recommendation that all online political adverts should include an imprint stating who is paying for it. We would add to that a requirement for social media companies to co-operate with MI5 where it is suspected that a hostile foreign state may be covertly running a campaign.”

On Brexit itself, and the heavily polarizing question of how much influence Russia was able to exert over the UK’s vote to leave the European Union, the committee suggests this would be “difficult” or even “impossible” to assess. But it emphasizes: “it is important to establish whether a hostile state took deliberate action with the aim of influencing a UK democratic process, irrespective of whether it was successful or not.”

The report then goes on to query the lack of evidence of an attempt by the UK government or security agencies to do just that.

In one interesting — and heavily redacted paragraph — the committee notes it sought to ascertain whether UK intelligence agencies hold “secret intelligence” that might support or supplement open source studies that have pointed to attempts by Russia to influence the Brexit vote — but was sent only a very brief response.

Here the committee writes:

In response to our request for written evidence at the outset of the Inquiry, MI5 initially provided just six lines of text. It stated that ***, before referring to academic studies. This was noteworthy in terms of the way it was couched (***) and the reference to open source studies ***. The brevity was also, to us, again, indicative of the extreme caution amongst the intelligence and security Agencies at the thought that they might have any role in relation to the UK’s democratic processes, and particularly one as contentious as the EU referendum. We repeat that this attitude is illogical; this is about the protection of the process and mechanism from hostile state interference, which should fall to our intelligence and security Agencies.

The report also records a gap in the government’s response on this issue — with the committee being told of no active attempt by government to understand whether or not UK elections have been targeted by Russia.

“The written evidence provided to us appeared to suggest that HMG had not seen or sought evidence of successful interference in UK democratic processes or any activity that has had a material impact on an election, for example influencing results,” it writes.

A later redacted paragraph indicates an assessment by the committee that the government failed to fully take into account open source material which had indicated attempts to influence Brexit (such as the studies of attempts to influence the referendum using Russia state mouthpieces RT and Sputnik; or via social media campaigns).

“Given that the Committee has previously been informed that open source material is now fully represented in the Government’s understanding of the threat picture, it was surprising to us that in this instance it was not,” the committee adds.

The committee also raises an eyebrow at the lack of any post-referendum analysis of Russian attempts to influence the vote by UK intelligence agencies — which it describes as in “stark contrast” to the US agency response following the revelations of Russian disops targeted at the 2016 US presidential election.

“Whilst the issues at stake in the EU referendum campaign are less clear-cut, it is nonetheless the Committee’s view that the UK Intelligence Community should produce an analogous assessment of potential Russian interference in the EU referendum and that an unclassified summary of it be published,” it suggests.

In other recommendations related to Russia’s “offensive cyber” capabilities, the committee reiterates that there’s a need for “a common international approach” to tackling the threat.

“It is clear there is now a pressing requirement for the introduction of a doctrine, or set of protocols, to ensure that there is a common approach to Offensive Cyber. While the UN has agreed that international law, and in particular the UN Charter, applies in cyberspace, there is still a need for a greater global understanding of how this should work in practice,” it writes, noting that it made the same recommendation in its 2016-17 annual
report.

“It is imperative that there are now tangible developments in this area in light of the increasing threat from Russia (and others, including China, Iran and the Democratic People’s Republic of Korea). Achieving a consensus on this common approach will be a challenging process, but as a leading proponent of the Rules Based International Order it is essential that the UK helps to promote and shape Rules of Engagement, working
with our allies.”

The security-cleared committee notes that the public report is a redacted summary of a more detailed dossier it felt unable to publish on account of classified information and the risk of Russia being able to use it to glean too much intelligence on the level of UK intelligence of its activities. Hence opting for a more truncated (and redacted) document than it would usually publish — which again raises questions over why Johnson sought repeatedly to delay publication.

Plenty of sections of the report contain a string of asterisk at a crucial point, eliding strategic specifics (e.g. this paragraph on exactly how Russia is targeting critical UK infrastructure: “Russia has also undertaken cyber pre-positioning activity on other nations’ Critical National Infrastructure (CNI). The National Cyber Security Centre (NCSC) has advised that there is *** Russian cyber intrusion into the UK’s CNI – particularly marked in the *** sectors.)”)

Most recently Number 10 sought to influence the election of the ISC committee chair by seeking to parachute a preferred candidate into the seat — which could have further delayed publication of the report. However the attempt at stacking the committee was thwarted when new chair, Conservative MP Julian Lewis, sided with opposition MPs to vote for himself. After which the newly elected committee voted unanimously to release the Russia report before the summer recess of parliament, avoiding another multi-month delay.

Another major chunk of the report, which tackles the topic of Russian expatriate oligarchs and their money; how they’ve been welcomed into UK society with “open arms”, enabling their illicit finance to be recycled through “the London ‘laundromat’, and to find its way inexorably into political party coffers, may explain the government’s reluctance for the report to be made public.

The committee’s commentary here makes particularly awkward reading for a political party with major Russian donors. And a prime minister with Russian oligarch friends…

“It is widely recognised that the key to London’s appeal was the exploitation of the UK’s investor visa scheme, introduced in 1994, followed by the promotion of a light and limited touch to regulation, with London’s strong capital and housing markets offering sound investment opportunities,” the committee writes, further noting that Russian money was also invested in “extending patronage and building influence across a wide sphere of the British establishment – PR firms, charities, political interests, academia and cultural institutions were all willing beneficiaries of Russian money, contributing to a ‘reputation laundering’ process”.

“In brief, Russian influence in the UK is ‘the new normal’, and there are a lot of Russians with very close links to Putin who are well integrated into the UK business and social scene, and accepted because of their wealth,” it adds.

You can read the full report here.

Posted on

Brexit means clear your cookies for democracy

Brexit looks set to further sink the already battered reputation of tracking cookies after a Buzzfeed report yesterday revealed what appears to be a plan by the UK’s minority government to use official government websites to harvest personal data on UK citizens for targeting purposes.

According to leaked government documents obtained by the news site, the prime minister has instructed government departments to share website usage data that’s collected via gov.uk websites with ministers on a cabinet committee tasked with preparing for a ‘no deal’ Brexit.

It’s not clear how linking up citizens use of essential government portals could further ‘no deal’ prep.

Rather the suspicion is it’s a massive, consent-less voter data grab by party political forces preparing for an inevitable general election in which the current Tory PM plans to campaign on a pro-Brexit message.

The instruction to pool gov.uk usage data as a “top priority” is also being justified internally in instructions to civil servants as necessary to accelerate plans for a digital revolution in public services — an odd ASAP to be claiming at a time of national, Brexit-induced crisis when there are plenty more pressing priorities (given the October 31 EU exit date looming).

A government spokesperson nonetheless told Buzzfeed the data is being collected to improve service delivery. They also claimed it’s “anonymized” data.

“Individual government departments currently collect anonymised user data when people use gov.uk. The Government Digital Service is working on a project to bring this anonymous data together to make sure people can access all the services they need as easily as possible,” the spokesperson said, further claiming: “No personal data is collected at any point during the process, and all activity is fully compliant with our legal and ethical obligations.”

However privacy experts quickly pointed out the nonsense of trying to pretend that joined up user data given a shared identifier is in any way anonymous.

 

For those struggling to keep up with the blistering pace of UK political developments engendered by Brexit, this is a government led by a new (and unelected) prime minister, Boris ‘Brexit: Do or Die’ Johnson, and his special advisor, digital guru Dominic Cummings, of election law-breaking Vote Leave campaign fame.

Back in 2015 and 2016, Cummings, then the director of the official Vote Leave campaign, masterminded a plan to win the EU referendum by using social media data to profile voters — blitzing them with millions of targeted ads in final days of the Brexit campaign.

Vote Leave was later found to have channelled money to Cambridge Analytica-linked Canadian data firm Aggregate IQ to target pro-Brexit ads via Facebook’s platform. Many of which were subsequently revealed to have used blatantly xenophobic messaging to push racist anti-EU messaging when Facebook finally handed over the ad data.

Setting aside the use of xenophobic dark ads to whip up racist sentiment to sell Brexit to voters, and ongoing questions about exactly how Vote Leave acquired data on UK voters for targeting them with political ads (including ethical questions about the use of a football quiz touting a £50M prize run on social media as a mass voter data-harvesting exercise), last year the UK’s Electoral Commission found Vote Leave had breached campaign spending limits through undeclared joint working with another pro-Brexit campaign — via which almost half a million pounds was illegally channeled into Facebook ads.

The Vote Leave campaign was fined £61k by the Electoral Commission, and referred to the police. (An investigation is possibly ongoing.)

Cummings, the ‘huge brain’ behind Vote Leave’s digital strategy, did not suffer a dent in his career as a consequence of all this — on the contrary, he was appointed by Johnson as senior advisor this summer, after Johnson won the Conservative leader contest and so became the third UK PM since the 2016 vote for Brexit.

With Cummings at his side, it’s been full steam ahead for Johnson on social media ads and data grabs, as we reported last month — paving the way for a hoped for general election campaign, fuelled by ‘no holds barred’ data science. Democratic ethics? Not in this digitally disruptive administration!

UK watchdog eyeing PM Boris Johnson’s Facebook ads data grab

The Johnson-Cummings pact ignores entirely the loud misgivings sounded by the UK’s information commissioner — which a year ago warned that political microtargeting risks undermining trust in democracy. The ICO called then for an ethical pause. Instead Johnson stuck up a proverbial finger by installing Cummings in No.10.

The UK’s Digital, Culture, Media and Sport parliamentary committee, which tried and failed to get Cummings to testify before it last year as part of a wide-ranging enquiry into online disinformation (a snub for which Cummings was later found in contempt of parliament), also urged the government to update election law as a priority last summer — saying it was essential to act to defend democracy against data-fuelled misinformation and disinformation. A call that was met with cold water.

This means the same old laws that failed to prevent ethically dubious voter data-harvesting during the EU referendum campaign, and failed to prevent social media ad platforms and online payment platforms (hi, Paypal!) from being the conduit for illegal foreign donations into UK campaigns, are now apparently incapable of responding to another voter data heist trick, this time cooked up at the heart of government on the umbrella pretext of ‘preparing for Brexit’.

The repurposing of government departments under Johnson-Cummings for pro-Brexit propaganda messaging also looks decidedly whiffy…

Asked about the legality of the data pooling gov.uk plan as reported by Buzzfeed, an ICO spokesperson told us: “People should be able to make informed choices about the way their data is used. That’s why organisations have to ensure that they process personal information fairly, legally and transparently. When that doesn’t happen, the ICO can take action.”

Can — but hasn’t yet.

It’s also not clear what action the ICO could end up taking to purge UK voter data that’s already been (or is in the process of being) sucked out of the Internet to be repurposed for party political purposes — including, judging by the Vote Leave playbook, for microtargeted ads that promote a no holds barred ‘no deal’ Brexit agenda.

One thing is clear: Any action would need to be swiftly enacted and robustly enforced if it were to have a meaningful chance of defending democracy from ethics-free data-targeting.

Sadly, the ICO has yet to show an appetite for swift and robust action where political parties are concerned.

Likely because a report it put out last fall essentially called out all UK political parties for misusing people’s data. It followed up saying it would audit the political parties starting early this year — but has yet to publish its findings.

Concerned opposition MPs are left tweeting into the regulatory abyss — decrying the ‘coup’ and forlornly pressing for action… Though if the political boot were on the other foot it might well be a different story.

Among the cookies used on gov.uk sites are Google Analytics cookies which store information on how visitors got to the site; the pages visited and length of time spent on them; and items clicked on. Which could certainly enable rich profiles to be attached to single visitors IDs.

Visitors to gov.uk properties can switch off Google Analytics measurement cookies, as well as denying gov.uk communications and marketing cookies, and cookies that store preferences — with only “strictly necessary” cookies (which remember form progress and serve notifications) lacking a user toggle.

What should concerned UK citizens to do to defend democracy against the data science folks we’re told are being thrown at the Johnson-Cummings GSD data pooling project? Practice good privacy hygiene.

Clear your cookies. Indeed, switch off gov.uk cookies. Deny access wherever and whenever possible.

It’s probably also a good idea to use a fresh (incognito) browser session each time you need to visit a government website and close the session (with cookies set to clear) immediately you’re done. And use a good tracker blocker.

When the laws have so spectacularly failed to keep up with the data processors, limiting how your information is gathered online is the only way to be sure. Though as we’ve written before it’s not easy.

Privacy is personal and unfortunately, with the laws lagging, the personal is now trivially cheap and easy to weaponize for political dark arts that treat democracy as a game of PR, debasing the entire system in the process.

Posted on

Brexit backer’s insurance firm and leave campaign fined £120k by data watchdog

The UK’s data protection watchdog has issued fines against a pro-Brexit campaign, Leave.EU, and an insurance company owned by the largest individual donor to the leave cause, Arron Banks’ Eldon Insurance.

The penalties have been handed down for what the Information Commissioner’s Office (ICO) dubs “serious breaches of electronic marketing laws” during the 2016 referendum on the UK’s European Union membership. 

The fines — served under the Privacy and Electronic Communications Regulations 2003, which governs electronic marketing — total £120,000 (~$157k); with Leave.EU fined a total of £60k (covering two incidents) and Eldon Insurance £60k.

The ICO’s investigation found the two entities were closely linked and it says systems for segregating the personal data of insurance customers’ from that of political subscribers’ were “ineffective”.

Leave.EU used Eldon Insurance customers’ details unlawfully to send almost 300,000 political marketing messages, according to the ICO’s probe.

Eldon Insurance was also found to have carried out two unlawful direct marketing campaigns which involved the sending of more than a million emails to Leave.EU subscribers without “sufficient consent”.

The ICO says it will now review how both entities are complying with data protection laws by carrying out audits — to observe how personal data is processed; what policies and procedures are in place; and look at the types of training made available for staff.

Key employees across both organisations will also be interviewed, including directors, staff and their data protection officers.

The ICO adds that it will publish its findings when it concludes the audits.

Commenting in a statement, information commissioner Elizabeth Denham, said: “It is deeply concerning that sensitive personal data gathered for political purposes was later used for insurance purposes; and vice versa. It should never have happened. We have been told both organisations have made improvements and learned from these events. But the ICO will now audit the organisations to determine how they are using customers’ personal information.”

The ICO issued a preliminary enforcement notice and three notices of intent to fine Leave.EU and Eldon Insurance trading as Go Skippy Insurance, last November, as part of a wide-ranging investigation into data analytics for political purposes.

“After considering the companies’ representations, the ICO has issued the fines, confirming a change to one amount, with the other two remaining unchanged,” it writes today. “The regulator has also issued two assessment notices to Leave.EU and Eldon Insurance to inform both organisations that they will be audited.”

Banks and associates connected to his unofficial leave campaign remain under investigation by the UK’s National Crime Agency. Last November the NCA announced an investigation into the source of £8M in funding Banks provided to the Leave.EU campaign — after an Electoral Commission investigation found there were reasonable grounds to suspect he was “not the true source” of the money.

The UK introduced legislation back in the year 2000 to outlaw foreign donations, with donors of even a few thousand pounds needing to be both British citizens and on the UK electoral roll for the donations to be legal.

However since then the rise of social media platforms has provided an unregulated workaround for election spending rules by offering a free-for-all conduit for political ads by the backdoor.

And it’s only since major scandals over election interference, such as Kremlin propaganda targeting the 2016 US presidential election, that tech giants have started to pay attention to the problem and introduce some checks on who can run political ads.

Facebook, for example, recently announced it will set up human-staffed operations centers to monitor political news.

In a few markets it’s also launched tools that offer a degree of transparency around who is buying certain types of political ads. But such measures clearly come far too late for Brexit.

A UK parliamentary committee which spend months investigating the issue of online political disinformation — and slammed Facebook for dodging its questions — came out with a laundry list of recommendations for changes to the law in a preliminary report last year, including calling for a levy on social media firms to defend democracy from disinformation.

Although the government rejected the levy, and most of the committee’s recommendations — preferring a ‘wait and see’ approach. (It has previously committed to legislate around social media and safety, though.)

Last year the UK’s election oversight body issued a series of fines for other leave-backed Brexit referendum campaigns — after finding the official Vote Leave campaign had breached election campaign spending limits by undeclared joint working with a youth-focused Brexit campaign, BeLeave.

Almost half a million pounds in illegal overspending was channeled via a Canadian data firm, AggregateIQ, to use for targeting political advertising pushing pro-Brexit ads on Facebook’s platform.

Facebook later released some of the ads that had been used by Brexit campaigns, which included fake claims and dogwhistle racism being used by leave campaigns to stir up fear among voters about foreigners coming to the UK.

The Facebook Cambridge Analytica data misuse scandal which snowballed into a major global scandal last year, also triggered a major ICO investigation into the use of personal data for political campaigning, parts of which remain ongoing.

Facebook must change and policymakers must act on data, warns UK watchdog

The watchdog issued a £500,000 fine on Facebook last year, as part of that probe — saying the company had “failed to sufficiently protect the privacy of its users before, during and after the unlawful processing” by Cambridge Analytica.

Though Facebook has filed an appeal, arguing the ICO did not find evidence that any UK users’ data was processed by CA.

Last year information commissioner Elizabeth Denham also called for an “ethical pause” around the use of microtargeting ad tools for political campaigning — saying there was “a risk of developing a system of voter surveillance by default”.

In the case of Facebook, the platform has generally preferred to continue accepting money for political ads, while it works on expanding self-styled “election security” measures.

Although it did temporarily suspend foreign-funded ads during a referendum in Ireland last year on whether to repeal or retain a constitutional ban on abortion — acting after concerns had been raised. It also fast tracked the launch of an ad transparency tool in the market ahead of the vote.