Election system tests find and fix vulnerabilities

Several vulnerabilities, including one classified as critical, were identified and addressed during security testing of Latvia’s election systems ahead of the Saeima elections, LSM reported.

Polling station staff are testing the systems in practical training sessions this week. The Central Election Commission, or CVK, provided further details on election preparations on Thursday.

Several vulnerabilities were identified in cooperation with the company Tet. The information was passed to the institutions responsible and to the system developers, who made the necessary improvements. Repeated tests are now under way to confirm that the problems have been resolved, CVK chair Māris Zviedris said.

Latvia’s cybersecurity incident prevention institution Cert.lv is supporting the CVK with election system security. The checks included penetration tests and an assessment of the software code.

After a cyberattack on Latvijas Valsts meži, all components of the systems developed by the company were also checked, Cert.lv cybersecurity expert Kārlis Svilans said. No signs of malicious activity or unauthorised access were found, he said, adding that the system was safe to use.

Svilans said the security tests conducted by Tet and Cert.lv had identified several security weaknesses, but only one was classified as critical. The exact nature of that vulnerability has not been disclosed because the information is restricted.

Cert.lv is carrying out repeated tests, which are expected to be completed by the end of this week. Its sensors have been placed across all components connected to the election systems to detect attempted unauthorised access in real time and respond accordingly.