The CEO of Keystrike said if he were an advisor to Euriovision management, he would make several changes to the telephone voting.
The Eurovision telephone voting was in the spotlight after Israel received a rare good result. Several countries, including Norway and Spain, requested information from the European Broadcasting Union about the public voting in Eurovision. There has been no conclusion on the matter yet and no evidence that the election was hacked. A meeting on cybersecurity issues, hosted by Icelandic cybersecurity company Keystrike, discussed this issue as well as others.
Jakob Antonsson, a cybersecurity expert at Keystrike, and Valdimar Óskarsson, the company’s CEO, discussed the issue at the meeting. Among other things, they were asked how difficult it would be to trace an attack of this type if, for example, Mossad or some other party had carried it out.
“It can be difficult to trace such cyberattacks to specific countries, but it is not impossible,” said Jakob. “Today, there are sophisticated threat attribution methods that look at IP spoofing, organization and workflow, code, time patterns, and past behavior of hacking groups. While organizations like Mossad are considered among the most capable in the world at disguising such operations, over time attacks have been traced to countries through a coordinated effort by security agencies, Western cybersecurity companies, and multinational cooperation.”
Valdimar said that in a larger context, certain ethical and democratic questions arose. “If states use cyberattacks and information management to shape debate in democracies, they undermine trust in information systems and the media, thereby weakening the public’s ability to make informed decisions,” Valdimar said. “This has implications far beyond individual attacks – it increases the risk of information chaos, conspiracy theories and political divisions that benefit the attackers but weaken the society that is affected.”
Transparency and trust
According to Valdimar, the public is largely dependent on technology and the processes of administrators in functional elections such as Eurovision.
“There is neither public access to voting data nor an independent way for the media or the public to verify whether the votes are real and correctly recorded,” says Valdimar. “This raises important questions about transparency and trust, especially when it comes to a popular competition that receives a lot of attention and has a real impact on the image and standing of participating nations.”
In this context, cybersecurity becomes not just a technical issue, but a fundamental element of democratic discourse and public trust in institutions. If people do not have access to independent means of verifying results – and if the systems are not guaranteed to be secure from attack or abuse – a security breach in such a process becomes not just a technical problem but something that concerns both society and democracy. That is why it is crucial that popular elections emphasize transparency and maintain reliable and independent oversight of the electoral process – both to ensure the validity of the results and to support democracy in the digital world.”
Unfair election
Valdimar said that if he were an advisor to the management of Eurovision, he would make various changes to the telephone voting.
“Allowing an individual to vote 20 times is not only unfair, but it also gives some people a voice that is 20 times louder than others. While you, even with a background in music, vote once, those who want to abuse the system can vote 20 times. Their vote counts twenty times as much as your vote. It’s just unfair. An election like this cannot reflect the will of the people.”
Jakob said he would take the following security measures.
“First, limit the number of votes – one vote per person, not twenty, because this is a music competition, not multiple influence,” said Jakob.
“Secondly, verification should be implemented using an electronic ID, which does not necessarily have to be government-issued, but is sufficiently reliable to confirm that the vote comes from a real person.”
Thirdly, a transparent post-competition report would be important – not just “this country gave this country 12 points”, but a simple and understandable summary of how and when votes were cast and where they came from.
The fourth suggestion is to establish independent monitoring and cybersecurity audits, where experts test whether the system is vulnerable to hacking before the competition begins. Finally, real-time patterns need to be monitored to detect unusual behavior, such as suspiciously many votes from the same network or phone number sequences, and respond before the error becomes irreversible.”
Presidential Election and Brexit
Jakob and Valdimar were asked whether they had seen any signs that computer attacks had been carried out on major international events with the intention of influencing public opinion or voting results.
“Yes, we have certainly seen signs that cyberattacks or digital operations have been used to influence outcomes or public opinion in major international events,” said Jakob.
“While direct evidence cannot always be provided, there are numerous examples that raise suspicions. For example, there have been confirmed attempts to influence democratic elections digitally, such as the 2016 US presidential election and the Brexit referendum, where disinformation campaigns and data leaks were used to influence the debate and the outcome.”
A threat that needs to be taken seriously
Valdimar said that when it came to cultural events like Eurovision, which was both emotional and political in a way, the same methods were technically feasible.
“We can already see how important betting banks, social media and telephone voting are, and it would be naive to think that no one is interested in changing a result that affects the national psyche and even profits,” said Valdimar. “It doesn’t have to be a major attack. It’s enough to just reverse the rankings, shift votes or turn off transparency, and then the impact is real. So we’re not talking about future possibilities – but about a current threat that needs to be taken seriously, whether it’s aimed at elections, culture or public opinion.
At the end of the day, Eurovision is more than just entertainment – it is a huge stage where nations come together, unite in music and celebrate diversity. But if the elections that determine the results are weak or easily manipulated, then credibility is lost and the harmony on which the competition is supposed to be built becomes false. That is why we need to make sure that security is in line with the importance of the competition – and that all voices are heard equally.”
The matter is discussed in more detail in Viðskiptablaðið. Subscribers can read the full story here.
