NCSC ramps up cyber support for political candidates ahead of General Election

Ahead of the General Election on 4 July, the National Cyber Security Centre – itself a part of GCHQ – has announced a new cyber defence service, which will help prevent individuals from falling foul of spear-phishing, malware attacks and other cyber threats.

The new Personal Internet Protection service provides an extra layer of security on personal devices by warning users if they try to visit a domain, which the NCSC knows to be malicious, and also by blocking outgoing traffic to these domains.

The opt-in service forms part of a wider package of cyber support on offer to individuals and organisations who play an important role in our democracy. It emerges in the wake of the Government’s announcements in recent months of attempts by the Russian Intelligence Services and China state-affiliated actors to carry out malicious activity targeting UK institutions and individuals (among them parliamentarians).

Advice for civil society groups

The NCSC and its international partners from five other countries have also jointly produced new advice for civil society groups whose work focused on advancing democratic values puts them under threat of transnational repression by state-sponsored actors.

Jonathon Ellison, the NCSC’s director for national resilience and future technology, said: “Individuals who play important roles in our democracy are an attractive target for cyber actors seeking to disrupt or otherwise undermine our open and free society. That’s why the NCSC has ramped up its support for those individuals at higher risk of being targeted online to ensure they can better protect their accounts and devices from attacks.”

Ellison added: “In this significant political year around the world, I would urge individuals eligible for our services to sign up and to follow our guidance now in order to bolster their defences.”

Attractive targets

The NCSC assesses that the personal accounts of candidates and election officials, as well as their official work accounts, are almost certainly attractive targets for cyber actors looking to carry out espionage operations.

The Personal Internet Protection offer for high-risk individuals builds on the NCSC’s Protective DNS service, which was developed principally for use by organisations. Since 2017, the latter has provided protection at scale for millions of public sector users, handling more than 2.5 trillion site requests and preventing access to 1.5 million malicious domains.

Individuals at higher risk are also encouraged to sign up for the Account Registration service: another opt-in service which allows the NCSC to alert individuals if malicious activity is detected on their personal accounts.

The new guidance aimed at supporting civil society groups is designed for a community which faces a heightened threat of targeting by malicious cyber actors and is more likely to have limited resources to combat the threat. This community includes elected officials, journalists, activists, academics, lawyers and dissidents.

The new document, entitled ‘Mitigating Cyber Threats with Limited Resources: Guidance for Civil Society’, can be accessed on the CISA website.