Paris Call for Trust and Security in Cyberspace

Effective information sharing is critical to successfully countering election interference. Here are some of the best practices we heard from stakeholders across government, industry, and civil society.

Thoughtfully assess the information-sharing challenges:

• Consider all parts of the electoral cycle as vulnerable to interference.
• But identify your vulnerabilities and focus on potential weak points.
• Recognize that the effects of separate activities can cumulatively amount to interference.
• Use shared language to discuss threats and responses to ensure messages are clear.
• Acknowledge that threats and responses evolve.

Build and leverage multi-stakeholder relationships:

• Identify points of contact across government, civil society, and industry. Keep lines of communication simple.
• Clearly state information-sharing goals, including who should share what type of information.
• Hold joint scenario-planning and rapid-response exercises.
• Where possible, the public and private sectors should aim to coordinate on policy changes.
• Cooperate and share best practices with regions around the world.

Foster intra-government coordination:

• Build inter-agency coordination for the long term, including through support from senior officials.
• Engage political parties across the political spectrum.
• Create a non-partisan expert group to collect and assess reports of election interference and notify the public of interference.

Communicate effectively:

• Communicate in simple but specific language.
• Improve and publicize methods for identifying election interference.
• Communicate with citizens about the tools they should use to combat disinformation.
• Notify parties about not just breaches but also attempted.
• Centre conversations around interference victims.

There is little consensus on what “foreign interference” is and how it compares to related concepts such as “influence”. Clearer definitions can help protect core democratic values. Here are recommendations we heard from stakeholders across government, industry, and civil society, on core elements that should be included in defining foreign interference.

Incorporate the notion of coercion:

• Coercion undermines freedoms in democratic society. For example, foreign actors can create or exploit economic dependencies.

Incorporate the concept of deception:

• Deception – or the lack of transparency – is an important component of interference because perpetrators often cover their tracks.
• This can also be framed as inauthenticity or misrepresentation. 
• Democracy requires transparency, and the lack of transparency erodes institutional integrity – a key aim of authoritarian actors.

Attempt to consider the activity’s intent:

• Ask what a foreign actor is seeking to achieve. Do they intend to disrupt, manipulate, damage or erode confidence in democratic organizations, institutions and processes? If so, this is often “interference”.
• There may not be a partisan objective. The intent may be simply to sow confusion and incite chaos in the system. 
• Intent can be challenging to determine, and that determination may be possible only after damage has been caused.  

Consider scope and framing, then test definitions:

• Foreign efforts to undermine democracy take various forms.
• Definitions should apply to the full range of threat actors and to a wide array of threats vectors.
• Political definitions can apply to a broader range of threats than can definitions framed in terms of international law.
• Governments should test their definitions to make sure they do not affect acceptable activities such as public diplomacy.

A pandemic can worsen concerns about election interference due to increased potential for disinformation, fears about safety around voting, and the potential for understaffing for processes and teams essential to voting. Here are some best practices we heard from stakeholders across government, industry, the media, and civil society, on countering interference in a pandemic.

Balance competing priorities:

• Ensure that cybersecurity does not get sidelined because of other pandemic-related issues.

Inoculate the public:

• To counter pandemic-related uncertainties that could be exploited by bad actors, all stakeholders should work together to build awareness of voting processes and possible delays in result reporting.
• Stakeholders should also engage and train trusted local partners to support this awareness-building. This is especially important for vulnerable groups, which can grow in number during a pandemic.

Leverage voting technologies, but thoughtfully:

• Governments should invest in voting technologies that help protect voter participation and increase voter trust in crises like pandemics.
• These technologies should be widely accessible, secure, and supplemented by paper backups if not auditable.

Adopt tailored, hybrid voting approaches:

• Governments should adopt voting approaches tailored to their communities, potentially with combinations of in-person voting, voting by mail, and portable voting. It need not be a “one size fits all” approach.

Plan for contingencies:

• Election management bodies should have a comprehensive and quickly implementable communication plan for situations in which an element of the election system is compromised. Also they should have a ready-to-deploy “plan B”.

Assess impact:

• All stakeholders, particularly civil society, should support or conduct research to help measure the impact of efforts at countering interference in a pandemic environment.

Protecting democracies from foreign election interference is a shared responsibility—when you see something, say something. Government, news media, social media platforms, academia and civil society all have important roles to play. Here are some best practices we heard from stakeholders across government, industry, the media, and civil society on speaking up in the face of disinformation.

Civil society – media:

• Offer news and information that are useful – Tell the stories and issues that are identified by the community.
• Maintain the mantle of “journalistic arbiter of truth” – Identify biases and blind spots; however, do not create false dichotomies as not everything has two sides. Maintain impartiality and avoid an advocacy role.
• Ask the right questions – Am I being manipulated? Who benefits from this story? Is the newsworthiness worth amplifying disinformation?
• Consider sharing – Pool resources to quickly fact-check and avoid duplication.

Industry – social media platforms:

• Recognize the value of partnerships – Consider sharing data and other resources with experts; those with the raw data might need others to help mine it.
• Be transparent – Have your efforts to deal with disinformation checked or “peer-reviewed” by other stakeholders.

Government:

• Create a high threshold for intervention during election – Repeated government interventions could undermine people’s confidence in the legitimacy of the election.
• Have the right people respond to electoral interference – It is important to be non-partisan and to have a clear mandate when reacting to election interference.
• Ensure access to real-time information – Include both classified and non-classified information.
• Develop communication strategies – Consider the purpose of the communication, the type of information threat, whom it was directed at, when it occurred, and where it occurred; communicate threats in accessible and non-partisan way; and convey to citizens what is being done to protect the system.
• Don’t exchange business cards during a hurricane – establish ongoing relationships with other parts of the electoral ecosystem before any crisis hits; build a large tent for an all of government response which includes non-traditional groups.

Protecting election infrastructure is essential to countering election interference. Here are some best practices we heard from stakeholders across government, industry, the media, and civil society to achieve this before, during, and after elections.

Protect voter registration systems:

• Consider encrypted backups, including encrypted remote mirrored sites, and paper backups.
• Restrict access to voter registration systems. Follow the principle of least privilege—an individual should be given only the privileges within a technical system that are needed to complete a task.

Support electronic poll books and quick paper-based voting systems:

• There are advantages to electronic pollbooks and paper-based voting systems that quickly count ballots (i.e. scanners) and can be audited.
• Electronic pollbooks allow quicker voting and real-time synchronization to help reliably record that a voter has checked in, cast a ballot, and not voted more than once.
• But electronic pollbooks can fail, so stock back-up materials such as paper pollbooks and envelopes for voters to vote provisionally.

Keep voting technology up to date:

• Have plans to periodically replace voting technology to prevent the use of outdated or insecure voting systems.

Implement audits to boost confidence in election results:

• Risk-limiting audits offer advantages over traditional audits. They are more efficient, they are dynamic, and they confirm only the winner, not the margin by which the winner won since this type of audit checks a statistically significant sample, rather than a full count.

Allow cybersecurity firms to support election campaigns:

• Campaigns frequently do not have the expertise or capacity to handle cybersecurity issues on their own.

An informed citizen combats foreign interference during elections by thinking critically about what they see online and understanding the fundamentals of democracy. Here are some recommendations we heard from stakeholders across government, industry, and civil society, on building resilience to empower citizens.

Support and empower trusted speakers:

• Engage with trusted community organizations and recognized leaders to effectively communicate accurate information.
• Though it may be difficult to stem the tide of disinformation, trusted speakers can encourage voting.
• Share tools with trusted speakers for identifying and tackling threats.

Be proactive:

• Flood space with accurate information early on.
• Pre-bunk issues that are vulnerable to disinformation and manipulation.
• Educate people on how to vote and the mechanics of democracy.
• Build cohesion in society around shared sovereign values and democracy – provide positive messaging.

Build digital literacy:

• Digital literacy is not one-size-fits-all – a tailored approach is required to help people think critically about what they see online.
• Base digital literacy efforts on robust research regarding attitudes and behaviors.
• Know your audience and connect with them via the appropriate medium.

Use effective fact-checking:

• Explore and address systemic problems that create bad information.
• Keep up-to-date platforms hosting disinformation change rapidly.
• Be impartial—ensure that you are fact-checking all parties and viewpoints.