Lessons Learned from the EU Referendum Contents

4The Electoral Commission and the administration of the referendum

The role of the Electoral Commission during referendums

82.The Electoral Commission was established by Parliament as a body independent of government in 2001, as a result of the Political Parties, Elections and Referendums Act 2000 (PPERA).108 PPERA, as amended in 2009, provides for an Electoral Commission with nine or ten Commissioners (originally, the range was between five and nine Commissioners).109 The legislation provides that one of the Commissioners will be appointed as the Chair of the Electoral Commission. From 2009 until 31 December 2016, the Chair of the Commission was Jenny Watson. Her replacement, who took office in January 2017, is Sir John Holmes. The Commission’s Chief Executive, Claire Bassett was appointed in October 2015.

83.The Electoral Commission’s remit stretches from the management of elections and referendums to regulating fundraising and campaign spending by parties. During referendums, the Commission is charged with examining the way in which proposed referendum questions are worded to make sure that they are intelligible to voters.110 In addition, at UK-wide referendums, the Chair of the Electoral Commission acts as the Chief Counting Officer, responsible for certifying and announcing the result of the referendum. In this guise, they appoint local Counting Officers and instruct them on how to run specific aspects of the referendum poll.

84.For the EU Referendum, the European Union Referendum Act obliged the Government to consult the Electoral Commission before tabling regulations amending section 125 of PPERA 2000.111 More generally in the field of referendums and elections, the Commission runs public awareness campaigns to ensure voters know:

After each election and referendum, the Commission publishes reports which examine how well these elections were run and make recommendations for improvements for future elections or referendums.113

Administrative issues that arose during the referendum

85.During the campaign, a number of administrative issues arose and were recorded by the Electoral Commission in an incident log. These issues can be distilled into two main categories: software problems and regulatory/administrative problems.

Software problems

The crash of the online registration site

86.With regards to software problems, the most significant example of software failure was the collapse of the voter registration website, https://www.gov.uk/register-to-vote, only hours before the registration deadline on 7 June 2016.

87.The website was launched on 10 June 2014 by the then Coalition Government as part of the move to Individual Electoral Registration (IER) which replaced the previous model of household registration.114

88.On 7 June 2016, hours before the deadline for individuals to register to vote at the EU referendum, the voter registration website crashed. The collapse of the website, managed by the Cabinet Office and the Government Digital Service, was blamed on “unprecedented demand” for the service, with 515,256 online applications to register to vote recorded on 7 June (the previous record for the largest number of online applications received in a day was 469,047 on 20 April 2015).115

89.In light of this demand and the subsequent failure of the registration website, the Government explained that it felt that all individuals who are eligible to register to vote for the referendum should continue to do so and said it was “urgently looking at all options and talking to the Electoral Commission about how we can extend the deadline for applying to register to vote in the EU referendum”.116 On 10 June, the Government tabled a set of regulations, the European Union Referendum (Voter Registration) Regulations 2016, which would extend the registration period until midnight that day.117 The regulations were approved by Parliament.

90.The Electoral Commission suggested in its official report on the referendum, that the problems that led to the website’s crash were aggravated by a large number of duplicate applications to register to vote. According to the Commission’s report, 38% of applications made during the campaign were duplicates.118 Furthermore, they estimate that of the 436,347 applications to register to vote between midnight on 7 June (the original deadline) and the extended deadline of midnight on 9 June, “approximately 46% of these were duplicate registration applications submitted by people who were already correctly registered to vote”.119 The Electoral Commission noted that in 26 local authority areas more than half of the applications received in that period were duplicates.120 Jenny Watson indicated that the situation was not helped by the existence, at one point in the referendum, of a Facebook rumour that incorrectly said that voters had to re-register to make sure they could vote in the referendum.121

91.In order to reduce the number of duplicate applications, the Electoral Commission recommended that in future the Government “should develop an online service to allow people to check whether they are already correctly registered to vote before they complete a new application to register”.122 Jenny Watson suggested that such a platform would be difficult to implement, not least because, as Claire Bassett, the Commission’s Chief Executive, explained, there is a separate register for each part of the country where they are held independently and across five different IT systems.123 Nonetheless, despite these difficulties, Ms Watson said that the Commission believes “the Cabinet Office need to pursue this [the ability to check your registration status online]”.124

92.The Register to Vote website crashed on the evening of Tuesday 7 June. The Government has stated that this was due to an exceptional surge in demand. It is clear that the level of public interest in the referendum, allied to the sheer numbers of duplicate applications and confusion as to whether individuals needed to re-register to vote for the referendum, created a much higher demand for the Register to Vote website. Duplicate applications pose an unnecessary administrative burden on electoral registration officers and are an equally unnecessary drain on the time of electors themselves. PACAC therefore endorses the Electoral Commission’s recommendation that the Government should develop an online service to enable people to check whether they are already correctly registered to vote. While PACAC is aware of the technical issues that would need to be overcome to deliver such a service, it would be of invaluable assistance in preventing the Register to Vote website from collapsing due to high levels of demand again ahead of future elections and referendums.

93.After the crash of the website, the Government promised to undertake a “lessons learned exercise”.125 The results of this exercise, undertaken by Equal Experts UK for the Cabinet Office, were published on 14 November 2016.126 The review noted that the register to vote service has “been very successful in terms of uptake by citizens” and “successfully supported the general election in 2015 and the May elections in 2016 without incident”.127 Though the report’s general view is “that the Cabinet Office supports the Register to Vote service very well”, it nonetheless suggested that while the issue that led to the website’s crash was “technical in nature, gaps in technical ownership and risk management contributed to the problem, and prevented it from being mitigated in advance”.128

94.In addition, the report found that performance testing of the website was “limited, and the conclusions drawn from the results were not sufficiently detailed or tested”, with mistaken assumptions about the likely traffic on the website.129 Indeed, while load testing did result in system performance problems, “it was assumed that such a load would not occur”. Furthermore, the report found that performance tests “did not continue to the point of destruction - which would have flagged up the system’s breaking point in advance”.130

95.The report also identified a gap in the technical ownership of the website, “with roles and responsibilities unclear”. As the report noted, while the Cabinet Office was the owner of the service, “its technical responsibilities were delegated to multiple suppliers” with the consequence being that it was “harder for technical issues to be identified and solved (or mitigated)”.131 The report made the following recommendations:

96.The Government has consistently argued that the Register to Vote website’s collapse was the product of a significant, last minute spike in applications to register to vote, magnified by the large number of duplicate applications. However, the Government clearly failed to undertake the necessary level of testing and precautions required to mitigate against any such surge in applications. It is worrying that when testing identified issues in system performance, mistaken assumptions meant that these issues were not investigated further and corrected.

97.The Register to Vote website is a key component of the transition to Individual Electoral Registration. The nature of the electoral cycle is that public interest and engagement grows in close proximity to election and referendum polling days. It is, therefore, of the utmost importance that the website can withstand spikes in the number of applications, not least as such spikes are likely to emerge near, if not on, the registration deadline. PACAC supports the recommendations of the Equal Experts report, in particular in ensuring more frequent performance tests of the website are conducted, including those that test it destruction.

98.Both the Government and the Electoral Commission’s response to the website collapse was heavily criticised by the Association of Electoral Administrators (AEA).133 According to the AEA, there was “a clear lack of contingency planning and communications from the Cabinet Office and the EC [Electoral Commission] to EAs [Electoral Administrators], who had to deal with the phone calls etc. the next morning with no indication of what was going to happen”. The AEA had been informally consulted on a number of options that the Government and Commission were considering as responses to the collapse, resulting in the AEA management board “unanimously” agreeing:

… that any potential change to the registration deadline would introduce considerable risk to the administration of the EU referendum, not least because of the additional pressures it would place on EAs but also the precedent it could have on future elections and the potential for a challenge to the result of the referendum if it were close. This viewpoint was forcibly expressed to both the Cabinet Office and the EC.134

99.However, when the decision was taken to introduce emergency legislation, it happened “without any further consultation with the AEA or its members, i.e. those who would need to make fundamental changes to the administration of the referendum process”. The AEA claim that “EAs effectively had to read the BBC website for updates”. The consequence of the extension and emergency legislation was, according to the AEA, “to impact heavily on already exhausted staff, thereby placing the conduct of the entire EU referendum under significant risk”.135

100.Jenny Watson acknowledged that the website crash caused confusion not only for the Commission, “but also for EROs (Electoral Registration Officers), who were really up against a deadline”. 136 Her colleague, Ailsa Irvine, the Electoral Commission’s Head of Electoral Guidance, conceded that EROs “could have done with having a more effective strategy between us and government to give them more information earlier” and suggested that one of the lessons the Commission wants “to learn and work with government on is to make sure that we can communicate fully and effectively with electoral registration offers [ … ] in future”.137

101.It is disappointing that the local electoral administrators who play a key role in delivering the referendum on the ground, including the implementation of the extended registration deadline, had to rely on news sources for updates on the Government’s decision to introduce emergency legislation. PACAC therefore welcomes the Electoral Commission’s recognition of the need for a more effective communication strategy between themselves, the Government and electoral administrators. PACAC recommends that the Government and Electoral Commission develop new guidelines, in consultation with bodies such as the Association of Electoral Administrators, on the level and quality of information provided to electoral registration officers and other administrators both prior to, and during, referendum campaigns.

Cyber security of elections

102.Although the Committee has no direct evidence, it considers that it is important to be aware of the potential for foreign interference in elections or referendums. The report on lessons learned from the website crash described it as “technical in nature, gaps in technical ownership and risk management contributed to the problem, and prevented it from being mitigated in advance”.138 However the crash had indications of being a DDOS (distributed denial of service) ‘attack’.139 We understand that this is very common and easy to do with botnets.140 There can be many reasons why people initiate a DDOS: commercial (e.g. one company bringing down a competitor’s website to disrupt sales); legal (e.g. a law enforcement agency wanting to disturb criminal activity on Darknet); political; etc. The key indicants are timing and relative volume rate.

103.PACAC does not rule out the possibility that the crash may have been caused by a DDOS (distributed denial of service attack) using botnets. Lessons in respect of the protection and resilience against possible foreign interference in IT systems that are critical for the functioning of the democratic process must extend beyond the technical. The US and UK understanding of ‘cyber’ is predominantly technical and computer-network based. For example, Russia and China use a cognitive approach based on understanding of mass psychology and of how to exploit individuals. The implications of this different understanding of cyber-attack, as purely technical or as reaching beyond the digital to influence public opinion, for the interference in elections and referendums are clear. PACAC is deeply concerned about these allegations about foreign interference.

104.We commend the Government for promoting cyber security as a major issue for the UK. We recommend that Cabinet Office, the Electoral Commission, local government, GCHQ and the new government Cyber Security Centre establish permanent machinery for monitoring cyber activity in respect of elections and referendums, for promoting cyber security and resilience from potential attacks, and to put plans and machinery in place to respond to and to contain such attacks if they occur. We recommend that the Government presents regular annual reports to Parliament on these matters.

Registration of ineligible voters

105.During the referendum campaign, it emerged that a number of EU-nationals had mistakenly received poll cards and, in some instances, postal votes. The Electoral Commission’s incident log notes that 3,502 non-eligible EU citizens had mistakenly received either poll cards and/or postal votes.141 In response the Electoral Commission claimed that this was a result of a fault in the Xpress elections software used by 238 local authorities in England and Wales.

106.On 2 June 2016 the Electoral Commission issued a statement outlining the steps taken to remedy this problem. According to the Commission, the software provider had “resolved the issue which means that, if any postal votes have been issued to these electors, they will be cancelled and none of these electors will be shown as eligible on the electoral registers to be used at polling stations on 23 June”. Furthermore, the Commission stated that all of the affected electors would also be written to by their local Electoral Registration Officer “with an explanation of what happened and will be told that they will not be able to vote at the referendum”.142

Administrative and regulatory issues

Verification of an individual’s entitlement to register to vote

107.Issues with the system of checks in place to verify an individual’s entitlement to be a registered elector under the system of individual electoral registration (IER), were identified during the referendum, in connection to the incorrect registration of EU citizens.

108.Schedule 2 of The Electoral Registration and Administration Act 2013 provides for the sharing of data as a means of assisting registration officers in verifying an attempted registration.143 This Schedule is further developed by The Electoral Registration and Administration Act 2013 (Transitional Provisions) Order 2013.144 The Electoral Commission’s guidance for Electoral Administrators explains that this data sharing, in the first instance, takes the form of cross-checking the details provided by an individual when registering with Department for Work and Pensions (DWP) records:

Any person making a new application for registration must provide personal identifiers for the purpose of establishing whether they are the person named in the application, and the results of this process must be taken into account in determining the application. The information provided is used to verify their identity against DWP records, and may also be matched against local data sources if the applicant’s identity cannot be verified using DWP records.145

109.Furthermore, even when an individual’s records match those held by DWP the Commission’s guidance makes clear that an Electoral Registration Officer (ERO) will also need to establish that the applicant fulfils their other eligibility criteria (age, nationality, residence) and may have already done so before receiving the match results from DWP.146

110.However, while EROs have the power to request checks of a person’s immigration status against Home Office records, the Electoral Commission has noted that Parliament did not specify, in the 2013 Act, “that checks on nationality must be carried out on all registration applications, nor has it provided EROs with access to the data they would require to be able to do so”.147 This is despite the fact that the Commission had previously recommended, in their response to the 2011 White Paper on IER “that the Government should explore the feasibility of enabling EROs to seek confirmation from relevant agencies (such as the United Kingdom Border Agency) of an applicant’s nationality and immigration status”.148

Other errors with postal votes/polling cards

111.According to the Electoral Commission’s incident log, there were a small number of local authorities which reported other incidents relating to postal votes and polling cards. For example, in Harborough a number of poll cards were not delivered within the delivery window of 18–24 May, due to an issue with the local counting officer’s contracted print suppliers and delivery service. More substantially, in Basingstoke and Deane all 128,000 poll cards sent to electors contained an error regarding the deadline for postal vote applications or applications to amend their postal vote status, and in Bristol and Swale, two Counting Officers issued pictorial postal voting instructions with their first wave of postal votes that could have been interpreted as favouring one particular referendum outcome, this affected 61,000 voters.149

Assessments of the administration of the referendum

112.Evidence to our inquiry suggests that, while not without some faults and problems, the EU referendum was, on the whole, well run and that the Electoral Commission competently discharged its duties as an administrator and regulator. Indeed, Dr Alan Renwick stated that he wished “to specifically praise the Electoral Commission for doing a good job” in administering the referendum.150

113.Professor Stephen Tierney suggested that both the Scottish independence referendum in 2014 and the EU referendum in 2016 had been “free, fair and deliberative processes, comparable in terms of democratic legitimacy to recent elections”.151 He said that the “combination of PPERA, the work of the Electoral Commission and Parliament’s approach to purdah all helped to ensure that the referendum rules worked fairly”.152

114.In a similar vein, The UK in a Changing Europe drew attention to the experience of both the Scottish and the EU referendums, arguing that they had demonstrated that there is “a very high level of compliance with PPERA 2000 and with the decisions of the Electoral Commission”, continuing that the Commission had “effectively established itself as an arbitrator in such matters”.153 Indeed, their evidence noted that in “the only notable instance of possible gaming of the rules [ … ] when Grassroots Out created a number of sub-groups (that weren’t registered with the Electoral Commission) [thus potentially circumventing spending limits]”, the Electoral Commission acted swiftly to remedy the situation.154

115.The Association of Electoral Administrators (AEA) suggested that “the Electoral Commission (EC) and the Chief Counting Officer (CCO) generally discharged their statutory duties satisfactorily” and commended the coordination and communication at the early stages of referendum planning.155

116.Following the referendum, the Electoral Commission commissioned an independent assessment of the administration of the referendum.156 The “overall picture” from this report was that “given the high profile nature of the referendum, the Chief Counting Officer, the Electoral Commission and electoral officials across the UK managed the referendum very well”.157

117.However, the report did flag some problems that emerged during the referendum as a result of the underlying electoral machinery (and thus beyond the direct remit of the CCO and the Commission). For example, the crash of the Register to Vote website placed a major burden on many electoral officials, while many members of the public reported confusion about the electoral registration process and a large number of duplicate applications which absorbed resources. In addition, the report identified some “challenging business processes involved in postal voting and overseas voting which also place a strain on local authorities”. As a result, “some overseas citizens may not have not been able to cast their votes or have them counted because of the tight timescales involved with registration and posting ballot papers through the international mail system. There were also concerns that the proxy voting process was open to vulnerabilities”.158

118.To inform their findings, the authors of the independent assessment, Dr Alistair Clark and Dr Toby James, commissioned a survey sent to 380 local authorities administering the referendum in Great Britain and to the electoral authorities in Northern Ireland and Gibraltar. The survey had a response rate of 66%. The survey revealed that while there were “high levels of overall satisfaction among COs [Counting Officers] with the management structure [during the referendum][ … ] there were some reservations that a conflict of interest may exist because the Commission was both the regulator and manager of the referendum process”.159

Regulator and provider: the Electoral Commission’s dual role

119.On this point of the Commission’s role as administrator and regulator, the AEA suggested that “on balance, we believe that there should be separate bodies” running and regulating the referendum, rather than the current arrangement which “provides the Chief Counting Officer with the support of the EC’s [Electoral Commission’s] staff and infrastructure”.160

120.While Will Straw and Paul Comer from Britain Stronger in Europe stated that “the administration of the regulation in the main worked well” and that they had a good relationship with the Commission, they also raised questions about the dual role of the Electoral Commission during the campaign and the consequences this has for the Chair of the Commission (who recuses themselves from Chairing duties to act as CCO).161 As a result, Mr Comer noted, when BSE posed “regulatory questions of a possibly thorny nature to the Electoral Commission, clearly their chair was recusing them from any involvement in the determination of those because of their role as the Chief Counting Officer”. Therefore, “there is just a question as to whether in future referenda their role as chair of the regulator should take precedence and someone else acts as chief counting officer, so that they can apply their judgement to those sorts of questions”.162

121.Though Mr Comer did not provide an example of a situation when BSE asked for the Commission’s guidance, or action, and were refused because of this dual role, he nonetheless commented that during the course of the campaign a number of important questions were raised and the “feeling that the chair was not there to help guide the senior staff at the Electoral Commission just raised the question as to whether it is more appropriate that they recuse themselves from those sorts of decisions to be the Chief Counting Officer, or whether they should actually be applying their judgment to those issues instead and have someone else as Chief Counting Officer”.163

122.However, the Commission’s role as both a regulator and a provider was strongly supported by Dr Simon Usherwood, who argued that it neither made the Commission’s job more difficult nor caused a conflict for the Commission.164 The idea of separating the Commission’s regulatory and administrative functions was also rejected by Vote Leave’s William Norton, who said he could not see “any other practical way of doing it [the regulation, and delivery, of referendums]”.165

123.Mr Norton did, however, suggest that the Electoral Commission could have been more proactive a regulator, arguing that it has a tendency to operate more as “an auditor than a referee”:

It is more the case that it does not blow a whistle and say, “That is offside”. It is much happier coming back about five months later and saying, “Three of the goals were offside”, and so on and so forth.166

While Mr Norton indicated that the Commission “are getting better at intervening where there is a clear and present danger of a breach”, he said that he would rather the Commission “kept closer to campaigners and were more forthcoming”.167

The Designation Process

124.One area, identified by both designated campaigns, where the administration of the referendum could have been improved was the designation process. Witnesses from Britain Stronger in Europe and Vote Leave contended that greater clarity could be provided by the Electoral Commission on the criteria used for designating campaigns. Vote Leave’s William Norton suggested that, despite his experience of three referendum campaigns, he was still no nearer to “guessing what the criteria are as to how you get designated”.168 Britain Stronger in Europe’s Will Straw suggested that greater clarity as to those guidelines “may have helped those different campaigns [Vote Leave and Grassroots Out] be clearer in their applications”.169

125.Vote Leave highlighted a further issue with designation: a delay in designation of the leave campaign due to an “acrimonious split in the leave side”.170 Matthew Elliott, its Chief Executive, explained that Vote Leave were designated as the official campaign on 13 April and then the control period started on 15 April.171 As a result “until 13 April, we did not know whether we would be a campaign spending £7 million or one spending £700,000. That brought in several budgeting and cash flow issues”.172 Matthew Elliott suggested that “it was quite useful to the Government that it was so late in the day, because it did mean that during a long period, that run-up to the referendum, you had both the leave campaigns preparing for designation rather than working out how to debate the other side—the remain campaign”.173

126.Responding to the evidence listed above, the Electoral Commission’s Chief Executive, Claire Bassett, argued that the Commission had “actively sought to achieve” transparency of the designation process, with the criteria published well in advance.174 Indeed, Ms Bassett went as far as to suggest that the steps taken by the Commission, which included publishing the criteria in advance and talking to people about those criteria, was “probably the maximum transparency that we could achieve, short of changing the process in its entirety”.175

127.Jenny Watson did, however, suggest that the Electoral Commission could look at whether an explicit fit and proper person test should form part of the designation process for future campaigns.176 According to Ms Watson, the Commission already comes close to conducting such a test during the designation process and already possesses the ability to “call campaigners in for interview” should it have any issues or concerns.177

The Electoral Commission

128.With regards to the Electoral Commission’s dual role as a regulatory and administrator for referendums, Jenny Watson rejected any suggestion that any serious tensions arose during the campaign. For example, Ms Watson explained that the Commission had delegated the regulation of campaigners away from the Chair, which also acts as Chief Counting Officer during the referendum, and the board “through to the Chief Executive to staff members”, during the campaign.178

129.Ms Watson also said she was unconvinced by the suggestion, made by Britain Stronger in Europe in their written evidence, that “on some key compliance issues where we felt more junior staff weren’t giving due attention to the issues, we had no point of recourse” due to the Chair of the Commission recusing herself as a result of her CCO role.179 According to Ms Watson, her experience of her staff team was that “if something was raised with them that they thought needed action they would take that action” and stated that she was unaware of any issues that had not been “effectively and properly handled at the right level”.180

130.Overall, in terms of the efficacy of the Chair of the Electoral Commission being Chief Counting Officer, Ms Watson acknowledged that there could be other individuals within the Commission that could be appointed to the role in future. However, Ms Watson’s evidence emphasised the importance of the role being housed within the Commission. She explained that there “simply was nobody else with the time or capacity [to be CCO]”. Ailsa Irvine, the Electoral Commission’s Head of Electoral Guidance, explained that “trying to co-ordinate the delivery of the poll across 362 local areas” was a “significant co-ordinating role” that requires “significant resource and expertise to be able to manage that”.181

131.In Ms Watson’s opinion, when Parliament voted to establish the Electoral Commission, it considered “who else could take this on [the CCO function]” and decided that the Commission “was the right place to put it”. Though she suggested that had there been somebody else with that capacity to undertake the duties of CCO “we would have seriously considered that”, Ms Watson also re-emphasized that the capacity needed for the task currently only resides within the Commission.182


132.On the whole, the referendum was well run and competently administered by the Electoral Commission. We pay tribute to the work of the Electoral Commission’s staff and local electoral administrators across the United Kingdom in ensuring that the referendum could be delivered effectively, within a compounded time frame, even with the added pressures that arose as a result of the crash of the Register to Vote website.

133.The Electoral Commission’s dual role as a regulator and key delivery agent for referendums could pose potential difficulties. However, while we note suggestions that these roles should be divided between separate bodies, it is clear that the Electoral Commission is the only body, at present, which is capable of discharging both roles.

134.The Electoral Commission’s dual role has resulted in the Chair of the Commission acting as Chief Counting Officer during referendums. Our inquiry explored whether it would be more appropriate for these roles to be separated out. However, we are again persuaded that the Chair of the Commission was the only person with the capacity, resource and expertise to co-ordinate the delivery of the referendum.

135.The process of designating the two official campaigns could be improved to provide greater clarity and transparency by the Electoral Commission. In particular, it was unfair that designation was so late, so that the Leave side could not plan ahead and commit to spending while competing for designation, but the uncontested Remain side was not disadvantaged in this way. We recommend that the Electoral Commission undertake a review of the designation process to examine where greater transparency could be achieved. This review should include consultation with campaigners from each of the campaigns that sought designation during the EU referendum. It should address whether earlier designation would have been fairer, and whether there should be a more explicit fit and proper person test for those applying for designation.

111 European Union Referendum Act.

113 Electoral Commission, Election and referendum reports.

114 The move to IER was brought about by the Electoral Registration and Administration Act 2013.

115 GOV.UK, Voter registration: Applications breakdown; the website crashed on the same night as the ITV referendum programme ‘Cameron and Farage live’ which featured the then Prime Minister, followed separately by Nigel Farage, taking questions from a studio audience.

125 HC Deb 8 June 2016, col.1199.

133 Association of Electoral Administrators (EUR0016).

134 Association of Electoral Administrators (EUR0016).

135 Association of Electoral Administrators (EUR0016).

139 Distributed denial of service (DDoS) attacks consist of floods of internet traffic from distributed sources often caused by botnets, which result in network facilities becoming overloaded and inoperable.

140 Cyber attacks can be launched by hackers themselves or from computers that have been compromised to serve the hacker’s need without the users knowledge (bots). Networks of bots (botnets) can act together to achieve a collective aim.

141 The Electoral Commission, EU Referendum Incident Log.

143 Electoral Registration and Administration Act 2013, schedule 2.

145 The Electoral Commission and Cabinet Office, Guidance for Electoral Registration Officers: Part 4-Maintaining the register throughout the year, originally published September 2013 (last updated July 2016), p.37.

146 The Electoral Commission and Cabinet Office, Guidance for Electoral Registration Officers: Part 4-Maintaining the register throughout the year, originally published September 2013 (last updated July 2016), p.40.

149 The Electoral Commission, EU Referendum Incident Log.

151 Professor Stephen Tierney (EUR0072).

152 Professor Stephen Tierney (EUR0072).

153 The UK in a Changing Europe (EUR0064).

154 The UK in a Changing Europe (EUR0064).

155 However, as discussed in paras.98–101, the AEA was particularly critical of the handling of the registration website’s collapse Association of Electoral Administrators (EUR0016).

156 The assessment was conducted by Dr Alistair Clark from Newcastle University and Dr Toby James from the University of East Anglia (Clark, A. and T. James, An Evaluation of Electoral Administration at the EU Referendum: Report prepared for the Electoral Commission, 22 August 2016).

160 Association of Electoral Administrators (EUR0016).

179 Britain Stronger in Europe (EUR0091); Q327.

11 April 2017