Network Interference

The Central Asian republics control, monitor, and manipulate online information around elections and other politically charged events. As early as February 2005, the Citizen Lab (Deibert, Reference Deibert2005) reported that Kyrgyz websites belonging to political parties and independent media were subject to hacking during the parliamentary election. The pattern of recorded failures pointed to deliberate interference with access to online sources (OpenNet Initiative, 2005). Influenced by the Russian and Chinese models of information control (Weber, Reference Weber2019), governments in the region employ a plethora of restrictive measures to silence political dissent or discontent and censor the media and civil society voices. Several connected tactics are used to restrict access to online information, including blocking content and throttling or shutting down networks (Muhamedov & Buralkiyeva, Reference Muhamedov and Buralkiyeva2023).

Internet shutdowns are an extreme form of digital censorship. Authorities in Turkmenistan have been particularly prone to imposing large-scale blackouts. The country is a repeated offender using censorship when the electorate votes and keeping tight control over the online information space as a preventive measure. Recent incidents were reported by Access Now (2023b) around protests in December 2021 and during the March 2022 presidential elections when the citizens were plunged into digital darkness. Kazakhstan has also repeatedly switched off the internet amid elections and protests. The most severe internet shutdowns to this date were imposed as a reaction to the massive protests in January 2022 when Kazakhstani authorities initiated a country-wide blackout to curb the unrest. The government also disrupted internet access around extraordinary presidential elections in November 2022, accompanied by targeted blocking of social media and communications platforms (Access Now, 2023a). From a legal perspective, governments justify internet shutdowns with provisions on anti-terrorism and public security under their domestic law. On the technical level, close to complete shutdowns are enabled by centralized state control and influence over large segments of telecommunication infrastructure providing internet services (Pavlova, Reference Pavlova2022).

Selectively blocking access to online content is a widespread practice across Central Asia. According to Freedom House (2023a), Turkmenistan exerts the tightest control over the online information space, where the state-run internet service provider permanently blocks websites that carry independent news coverage or critical content. A key election in Kazakhstan in June 2019, when the country voted for a successor to then-president Nursultan Nazarbayev, was also accompanied by excessive network disruption on election day and restrictions on streaming services and several social media platforms (NetBlocks, 2019). The authorities justified the network interference with concerns over the spread of false information (Freedom House, 2020). During the January 2021 parliamentary election, media freedoms were curtailed with social media restrictions and distributed denial of service (DDoS) attacks designed to disrupt or block websites. According to the country’s officials, the targeted censorship intended to prevent the spread of false information and maintain public order (Freedom House, 2022). Kazakhstan repeated similar tactics in the extraordinary presidential elections in November 2022 (Access Now, 2023a; RSF, 2022) and again in the parliamentary election in March 2023 (RFE/RL, 2023). The region’s practice of suppressing free speech extends into censorship in online spaces. For illustration, Uzbekistan amended its criminal code to make insults against the president illegal and added penalties for online offences. These provisions, infringing on freedom of expression, entered into force ahead of the presidential elections in October 2021 (Freedom House, 2021).

DDoS attacks disrupt the traffic of a server, service, or network by overwhelming the target or its surrounding infrastructure. These disruptive attacks are simple to deploy and difficult to prevent, especially for small and under-resourced entities, which makes them a popular tool to censor media outlets and websites of civil society organizations and political candidates (Korosteleva, Reference Korosteleva2022). For example, Kazakhstani news site Vlast reported suffering a persistent targeted DDoS attack in January 2021 (Freedom House, 2022). DDoS attacks were also targeted against several news sites, including KazTAG and Orda.kz prior to the presidential elections in November 2022 (Justice for Journalists, 2024). Disruptive cyber operations have been playing an increasingly political role. In September 2022, Kazakhstan experienced a series of primarily DDoS attacks that interfered with internet connectivity across the country, allegedly linked to the upcoming presidential elections scheduled for November 2022. The intent behind these incidents was unknown, but President Kassym-Jomart Tokayev blamed foreign actors seeking to destabilize the country during a sensitive political period (Eurasianet, 2022; Khassenkhanova, Reference Khassenkhanova2022). Considering the regional context, the cyberattacks might have been connected to the war in Ukraine. According to the CyberPeace Institute’s database “Cyber Attacks in Times of Conflict Platform #Ukraine,” government websites in Kazakhstan were targeted by Russia-affiliated groups deploying DDoS attacks on three different occasions in October 2022.

It is noteworthy that Russia employed DDoS attacks as a coercive measure around politically charged events in the past, including state-orchestrated DDoS attacks on Estonia during the bilateral conflict throughout April and May 2007 and in the Russo-Georgian War in August 2008 (Kozłowski, Reference Kozłowski2020). Another early example was the use of DDoS attacks as part of Russian mounting pressure to persuade the Kyrgyz president to close the US base in Manas (Bradbury, Reference Bradbury2009). According to the Electoral Knowledge Project, in January 2009, DDoS attacks targeted the country’s internet infrastructure, lasting for approximately ten days and eliminating 80 percent of the country’s limited online capacity.

Cyberattacks Targeting Electoral Infrastructure

Malicious cyber activities against electoral infrastructure, including electronic voting systems and voter registration databases, with the intent to obstruct voting or erode trust in election results have been observed worldwide (ASPI, 2019). Central Asian countries have experimented with e-voting systems. Kazakhstan actively used e-voting technology between 2004 and 2011 but discontinued this practice and returned to paper ballots due to concerns over the integrity of e-voting procedures (Kassen, Reference Kassen2020). Uzbekistan piloted biometric identification during the referendum on constitutional amendments in April 2023 (Gazeta.uz, 2023). The Kyrgyz authorities view the digitalization of electoral infrastructure as a step toward enhancing transparency and increasing electoral participation through biometrics registration, biometric identification of voters, and ballot scanning and reporting technology. The e-system prevents common election fraud in the form of vote buying, carousel voting, and group or family voting (Sheranova, Reference Sheranova2020). This technology was piloted in the 2015 parliamentary election to increase the integrity of voting stations (Goyal, Reference Goyal2017; Putz, Reference Putz2015). In 2016, the Osh City Council introduced e-voting after repeated violent political uprisings in the region. Kyrgyzstan has conducted e-counts since 2017, where optical scanners are used to verify counts (International IDEA, 2023). The United Nations Development Programme (UNDP) (2021) reported a large-scale voters’ biometric data collection campaign prior to local council elections in March 2021 to increase the reliability of the vote count during elections and referendums. In April 2023, the Central Election Commission of Kyrgyzstan presented a pilot electronic voting project and an upgraded voter identification device for local elections (Kharizov, Reference Kharizov2023).

Public concerns about the integrity and reliability of electoral infrastructure, whether based on suspected external interference or internal manipulation, can have serious repercussions. Such disruption erodes public trust, impacts voter turnout, and challenges the legitimacy of election outcomes. The Kyrgyz parliamentary elections in November 2021 were accompanied by allegations of interference, and opposition leaders called for the results to be annulled after technical difficulties appeared to have affected the vote count (OSCE & ODIHR, 2022a; RFE/RL, 2021). The Central Election Commission’s tabulation monitor experienced a blackout, and when the system restarted, different results appeared on the monitor. The discrepancy resulted in several opposition parties falling below the 5 percent threshold required for entering the Parliament (Pannier, Reference Pannier2021). Technical failures can be destabilizing especially in countries with contested election outcomes. The 2021 Kyrgyz elections in question followed a failed parliamentary vote in October 2020. In that case, the Central Election Commission declared the results of voting in all polling stations invalid amid protests over alleged campaign violations and unfair voting practices. Concerning potential foreign interference in the 2021 repeated elections, the Kyrgyz Security Council registered cyber incidents targeting the Central Election Commission’s servers from twenty countries without affecting the elections (Kabar, 2021b; Orlova, Reference Orlova2021). The Commission reported on the attempted cyberattacks against national servers while stating that the current level of protection sufficiently defends the country’s electoral infrastructure (Kabar, 2021a).

Data Leaks and Cyber Espionage

Central Asia has witnessed a shift toward digitalizing government services driven by digital economy initiatives and international support. However, as pointed out in the Electoral Knowledge Project (n.d.), rapid digitalization can increase the attack surface for malicious activities if coupled with massive data collection and insufficient safeguards that would ensure privacy, transparency, and effective oversight to handle citizens’ personal information securely. Sensitive data can be hacked, leaked, or otherwise exploited for the purpose of fraud, jeopardizing people’s security, or undermining trust in democratic processes and institutions. For illustration, the Kazakhstani Central Election Commission experienced an extensive data breach in July 2019. Data from the election database, comprising information on 11 million Kazakhstanis, which constitutes approximately 60 percent of the total population, was published online, exposing names, identification numbers, passport numbers, and residence addresses (Vlast, 2019). The Ministry of Internal Affairs launched an investigation into the unlawful dissemination of confidential data in the same month. However, the investigation did not find anyone accountable for the incident. The official report cited insufficient evidence of a crime as the leaked personal data was neither further used nor caused harm. Still, the mere publication of personal data suggests malicious intent and poses risks to citizens, including the potential for identity theft, targeted scams, and social engineering to exploit the targets. The decision taken by the Kazakhstani Ministry of Internal Affairs to close the investigation highlights the lack of accountability for data breaches – even when national security and the democratic process are at stake (U.S. Bureau of Democracy, Human Rights, and Labour, 2020).

Data exfiltration and cyber espionage can also constitute election interference. Primary targets of such operations are government agencies, officials, and political candidates, but hacking extends to research and civil society organizations, journalists, and private companies (O’Connor et al., Reference O’Connor, Hanson, Currey and Beattie2020). Although the known cases of targeted hacking do not conclusively prove an objective to interfere in democratic processes, threat intelligence reports increasingly point to political motivation of state-affiliated groups operating in Central Asia. Microsoft’s reporting (2022) suggests that China utilizes cyber espionage as a tool for advancing the country’s political, economic and military influence, including in Kazakhstan. A Chinese cyber-security vendor further reported on Russian-speaking actors deploying malware to surveil a wide range of individuals and organizations in Kazakhstan, extending to government agencies, military personnel, researchers, journalists, private companies, educational organizations, and dissidents (Cimpanu, Reference Cimpanu2019). Securelist by Kaspersky (2018c) reported on a Chinese threat actor detected behind a targeted campaign linked to a high-level meeting in Central Asia pursuing a regional political agenda and another campaign targeting a national data center in the region that allowed access to a wide range of government sources (Securelist, 2018a). Another report by Securelist (2019) detailed Zebrocy malware, primarily associated with Russian state-sponsored hacking groups, spearphishing Central Asian government-related targets, both in-country and in remote locations. A Russia-affiliated group was also reported to use the potential Telegram ban in Kazakhstan to distribute malware in an alternative communication software for the political opposition (Securelist, 2018b). In yet another case, a hacking group deployed a novel backdoor against international governmental targets located in Kazakhstan, with low confidence indicators pointing to Moscow (Chakravarti, Reference Chakravarti2023). While not directly interfering with the elections, these incidents point to an active engagement of Russia- and China-affiliated actors in politically motivated hacking in the region, targeting critical components of democratic processes.

Disinformation Campaigns, Inauthentic Accounts, and Synthetic Content

Disinformation deployed to deliberately share false narratives and information with the aim of manipulating opinion and discrediting the opposition intensifies around elections. Online disinformation campaigns target a wide array of political candidates, media organizations, individual journalists, and civil society representatives. Malicious actors leverage social media and messaging platforms to sway voters, amplify the content via inauthentic accounts, and deploy trolls to harass individuals and distort online discourse (Lee Myers, Reference Lee Myers2022). In Central Asia, the coordinated online attacks provide the basis for a high incidence of online and offline abuse aimed at deterring candidates and independent reporting (Pavlova, Reference Pavlova2023). Networks of fake accounts promoting pro-government narratives have been observed in Kazakhstan around elections, including in the presidential election campaign in November 2022 (Du Boulay, Reference Du Boulay2023). These accounts are commonly referred to as “nurbots,” after the ruling Nur Otan Party (Kozhanova, Reference Kozhanova2019). Kyrgyz activists reported on fake accounts spreading disinformation, allegedly coordinated by national ministries and operated by a combination of government agencies and individuals (Bradshaw, Bailey, & Howard, Reference Bradshaw, Bailey and Howard2021). The Committee to Protect Journalists (2020) and Reporters Without Borders (2020) observed that law enforcement agencies in Kyrgyzstan instructed a troll farm to discredit critics. The practice of using fake accounts has also been observed in Uzbekistan, where online trolls derail discussions and undermine the reputation of journalists and news organizations (Bradshaw, Bailey, & Howard, Reference Bradshaw, Bailey and Howard2021).

As documented by the Australian Strategic Policy Institute (ASPI) (2019), Russia frequently deploys coordinated information operations abroad. The government and state-affiliated groups exploit the online information space to sway public narratives. These efforts persist beyond elections, forming part of a broader, long-term strategy to manipulate public opinion and erode trust in democratic institutions. Networks of accounts originating in Russia and targeting Central Asian states are regularly detected on popular social media platforms (Bradshaw, Bailey, & Howard, Reference Bradshaw, Bailey and Howard2021). Online disinformation campaigns have intensified in the aftermath of the international armed conflict in Ukraine (Cabar, 2023). Disinformation finds a fertile ground amid the expanding social media landscape and low trust in traditional media. The commercialization of advanced artificial intelligence tools is set to facilitate further abuse and empower malicious actors to spread fake and harmful content (Khashimov, Reference Khashimov2021; Neudert, Reference Neudert2018; Stanley-Becker & Nix, Reference Stanley-Becker and Nix2023; Tiku, Reference Tiku2022).

Online Surveillance and Intimidation

Politically motivated surveillance is pervasive throughout Central Asia, with governments employing sophisticated technologies to monitor citizens’ communications and online activities. Invasive data collection practices are facilitated by the adoption of Russian-style legislation and tools, increasing use of Chinese surveillance and censorship technologies, and adaptation of domestic legal frameworks to authorize state overreach (Weber, Reference Weber2019). The Kazakhstani authorities intercept internet traffic and internet users are required to install digital security certificates designed to generate detailed logs of their online activity (Kumenov, Reference Kumenov2020; Raman, Reference Raman, Evdokimov, Wurstrow, Halderman and Ensafi2019). Human Rights Watch (2021) reported that the “false information” bill in Kyrgyzstan, which came into power in August 2021, compels internet service providers to register their clients in a unified identification system and provides authorities with complete information related to users if a court or a state agency requests such data. Without adequate transparency and independent oversight, these intrusive practices are weaponized against the opposition, the media, and civil society, violating individuals’ rights to privacy and participation in civil society as well as freedom of expression, assembly, and association.

Both Kazakhstan and Uzbekistan have repeatedly engaged in the targeted surveillance of media, dissidents and activists (Kumenov, Reference Kumenov2018; Marczak et al., Reference Marczak, Scott-Railton, Perry, Al-Kizawi, Anstis and Panday2023; RFE/RL, 2016; Securelist, 2023). Already in 2015, WikiLeaks published an exchange of documents linking state agencies and a surveillance software company indicating that the government might have obtained software to monitor and interfere with online traffic, including encrypted communications, as well as to perform targeted attacks against certain users and devices (Freedom House, 2020, 2023b). In 2021, Amnesty International’s Security Lab conducted forensic analysis on the phones of Kazakhstani human rights activists – confirming four individuals had their devices infected with the Pegasus spyware (Amnesty International, 2021). A Justice for Journalists (2020) report highlights how online surveillance goes hand in hand with arbitrary arrests of opposition figures and journalists, creating a climate of self-censorship and preventing genuine political participation.

Reduce the Risk of Information Compromise

• • Central Asian governments must curb the mass collection of personal data to what can reasonably be justified, following the principles of legality, necessity, and proportionality, while increasing the cybersecurity, transparency, and oversight measures for how data is processed, transmitted, and stored to secure the systems that are custodians of sensitive and personal data. Excessive data collection creates weaknesses in the digital ecosystem that can be exploited for malicious purposes, such as unauthorized access to personal data, resulting in severe privacy violations with little accountability.

• • Broad surveillance powers violate international human rights standards, undermine data security, and induce self-censorship. States must refrain from intrusive practices such as mass surveillance, real-time collection of traffic data, and targeted interception of online communications without legal authorization and a legitimate purpose, adhering to the principles of necessity and proportionality in line with international human rights standards.

• • Internet service providers and online platforms must help secure digital ecosystems, especially in regard to transparency about their operations as well as trust and safety practices and potential threats to users’ privacy. Digital service providers must ensure privacy by design, including end-to-end encryption, data protection safeguards, and fact-checking mechanisms that include trusted and verified partners in the loop of accuracy verification and limit the virality of disinformation and other harmful content. Priority should be given to improving verification techniques to combat manipulated content and inauthentic coordinated behavior online, especially amid the commercialization and rapid proliferation of AI tools for language generation, image creation, and content amplification.

• • Procurement and deployment of dual-use technologies such as commercial cyber intrusion capabilities by states should be conditional and subject to a human rights and impact assessment that informs and guides such activities and their scope, aligns them with the international human rights law, and subjects them to independent and transparent oversight. Governments should commit to imposing international controls to prevent commercial cyber intrusion tools from being exported to countries with poor human rights records and prevent vendors from bypassing regulations.

Improve the Understanding of the Cyber Threat Landscape

• • Countering foreign cyber-enabled election interference requires effective technical and legal attribution to identify threat actors and address malicious behavior. States should invest in building their national capacities and extend international and bilateral cooperation aimed at information exchange and forensic and legal capacity building. Proactive measures such as conducting regular cybersecurity assessments and simulations can help identify vulnerabilities within electoral systems.

• • Central Asian governments should advance the implementation of confidence-building measures on structured and transparent exchange of information between states and private companies. International partnerships, such as the International Counter Ransomware Initiative, and operational collaboration between the public and private sectors facilitate gathering timely, comprehensive, and actional intelligence and allow states and affected entities to protect themselves against attacks. For example, the OSCE confidence-building measures include threat information sharing among participating states, public–private partnerships, critical infrastructure protection, and vulnerability disclosure (OSCE, 2016). Common baselines for sharing intelligence and recognizing the impacts of cyber incidents are key for effective mitigation and response, and OSCE delivers programs in Central Asia that support the development and implementation of the classification of cyber incidents in terms of scale and seriousness, emphasizing critical infrastructure protection (Cybil Portal, n.d. ).

• • Donor countries and organizations should prioritize funding for civil society initiatives, research and investigative organizations, and independent media providing transparent data collection, investigation, and analysis. Such efforts help build data-driven understandings of the threat landscape, including the knowledge of cyber threats affecting elections and democratic processes. Information about cyber-enabled election interference is currently reliant on the fragmented work of organizations operating with limited resources. To evidence cyber threats and their impacts on infrastructure, services, and populations, authorities and research organizations should conduct rigorous data collection and pilot data-driven methodologies to enhance cyber preparedness, improve accountability, and inform effective victim redress.

Strengthen Accountability and Legal Frameworks

• • Central Asian governments must increase transparency around elections by allowing independent election observation and reporting. Electoral observation missions should advance their reporting on cyber incidents, information campaigns, online intimidation, and other cyber-enabled tactics threatening free and fair elections. By incorporating detailed assessments of cyber threats into their reports, electoral observation missions can provide critical insights into how cyber-enabled tactics undermine electoral integrity.

• • States should advance normative and legal frameworks to strengthen international provisions safeguarding electoral infrastructure, namely under the United Nations framework of responsible state behavior in cyberspace. In the consensus report of the United Nations Open-Ended Working Group on information and communications technologies (ICTs) (United Nations General Assembly, 2021), states acknowledged that malicious cyber activities against critical infrastructure and critical information infrastructure that undermine trust and confidence in political and electoral processes, public institutions, or that impact the general availability or integrity of the internet, are a real and growing concern, and that public–private cooperation may be necessary to protect its integrity, functioning, and availability. However, progress on these commitments remains uneven and stakeholder engagement inadequate. States should advance cyber norm implementation and clarify the application of international law, including international human rights law, in cyberspace through targeted capacity building to strengthen accountability measures for state-sponsored interference in elections and democratic processes.

• • Governments should develop policy and legal frameworks through inclusive consultative processes. Multistakeholder platforms such as the Oxford Process on International Law in Cyberspace provide expert guidance and support for states. “The Oxford Statement on International Law Protections against Foreign Electoral Interference through Digital Means” (The Oxford Process, 2020) reaffirms that the body of existing international law applies to cyber operations by states, including those that have adverse consequences for the electoral processes of other states. Other multistakeholder initiatives, such as the Paris Call for Trust and Security in Cyberspace (2018), have called on stakeholders to strengthen their capacity to prevent malign interference by foreign actors aimed at undermining electoral processes through the malicious use of cyber capabilities.

• • State response to cyberattacks must be timely and transparent, extending to informing citizens, reporting on detected cyber threats, and following up with accountability measures to deter malicious behavior. Detailing which norms or laws have been violated by a cyber incident can enhance the transparency of attributions and build state capacity to recognize and penalize malicious behavior. For instance, the EU Cyber Diplomacy Toolbox includes a cyber sanctions regime that addresses persons and entities involved in cyberattacks or attempted cyberattacks with a significant effect (EEAS) (Cyber Diplomacy Toolbox, n.d.).

Increase Cyber Resilience of Electoral Infrastructure and Processes

• • Cybersecurity measures must be prioritized already at the inception phase of building or upgrading electronic election systems and digitizing election administration. State agencies relevant to election processes must act transparently and ensure election results are verifiable to be accepted by the electorate. Such measures hold particular significance for the Central Asian region, where several countries have experimented with e-voting systems. For instance, Kazakhstan initially embraced e-voting technology but later abandoned the system due to concerns about the reliability of e-voting procedures, or Kyrgyzstan, where technical difficulties appeared to have affected the vote count.

• • Central Asian authorities should increase and incentivize cyber capacity building, including sharing best practices and promoting dialogue with stakeholders. Many existing initiatives facilitated by states or intergovernmental organizations are open only to government representatives. Capacity building needs to be more inclusive to build trust and leverage the strengths of diverse groups of stakeholders. Similarly, international and regional platforms dealing with cybersecurity and cybercrime must enable and support multistakeholder cooperation.

• • Civil society is critical in fostering transparency and accountability during the election process. To support these efforts, funding from international organizations, donor countries, and private companies should be directed toward organizations with a track record of capacity-building initiatives that can raise cybersecurity awareness, provide training programs, and help combat disinformation, such as those promoting independent fact-checking or supporting investigative journalistic initiatives.

• • Securing free and fair elections, including by refraining from network interference and information campaigns that influence election results, must be an integral part of multilateral and bilateral agendas that democratic countries pursue in their engagement with Central Asian governments. Cybersecurity cooperation and capacity building presents a viable platform to enhance the region’s overall resilience against internal and foreign cyber threats to elections (European Commission, 2023).