How sophisticated was the “sophisticated” cyber attack against Labour?

On Tuesday, the Labour party claimed that it had been victim to a “sophisticated and large scale cyber attack”, and this was widely reported.

 In a press release seen by Full Fact, a Labour party spokesman said: “We have experienced a sophisticated and large scale cyber attack on Labour digital platforms. We took swift action and these attempts failed due to our robust security systems. The integrity of all our platforms was maintained and we are confident that no data breach occurred.”

It became clear shortly after the release that the attack was a DDoS attack. DDoS (distributed denial-of-service) attacks look to disrupt a website by overwhelming a server or network with an unexpected flood of traffic. When this happens normal web traffic cannot get through to the site. 

Orchestrating or participating in a DDoS attack is illegal in the UK, and any kind of attack on a political party during an election is worth taking seriously. But it’s also important to understand that these type of attacks are common, and are generally not seen as “sophisticated” by cybersecurity experts. 

DDoS attacks by themselves are not attempts to hack into computer systems or to steal data. (They can sometimes be used as a distraction technique while a more sophisticated attack occurs simultaneously, although currently there is no suggestion that this happened in this case.) 

Professor Alan Woodward of the Surrey Centre for Cyber Security and the Department of Computer Science at Surrey University told Full Fact that it’s unlikely the attack was serious.

“I was surprised to see Labour describe this attack as sophisticated. DDoS attacks are as old as the hills and you can buy them off the shelf: little knowledge required. Criminals providing crime as a service often have DDoS attacks as their entry level offering.

“Any high profile site should expect a DDoS attack and be prepared for it. There are many service providers who will help protect against such an attack.”

Professor Eerke Boiten, interim head of school of computer science and informatics at De Montfort University, told Full Fact: “There are different ways of sending DDoS traffic, and some of them could be described as more sophisticated than others, including by using timings and other behaviours to evade protection systems that aim to discover DDoS attacks early as possible. 

“If an attack was successfully fought off, that would of course be evidence against it being a sophisticated attack rather than in favour.” 

A Labour source seemed to confirm that the attack was successfully halted to Sky News’ technology correspondent Rowland Manthorpe.