Election Day in the UK: Traffic Patterns and Political Party Attacks

The July 4, 2024 UK general election brought Labour to power after 14 years of Conservative leadership. While election days rarely cause dramatic shifts in Internet traffic, Cloudflare data shows notable dips during voting hours and a significant DDoS attack on a political party shortly after polls closed.

Polling stations were open from 07:00 to 22:00 local time, a typical Thursday election in Britain. Traffic initially rose slightly from the previous week before falling around noon by roughly 2%. More pronounced declines began after 16:00, with additional drops at 16:45 and again at 22:00 as voting concluded.

Country-level traffic variations

Looking at the devolved nations individually, the afternoon and evening dips varied considerably. Northern Ireland saw the steepest decline at 10%, followed by Scotland (-6%), Wales (-5%), and England (-3%). In Northern Ireland, traffic fell noticeably around 13:00 local time and again between 16:00 and 20:00. Scotland experienced about a 5% drop from 16:00 to 21:00. Wales saw decreases at 07:00 (4%), between 16:00 and 18:00 (around 5%), and at 21:00. England's decline was milder, with approximately 3% drops between 16:00-18:00 and 2% between 20:00-22:00.

All four nations saw traffic rebound after 23:00 as initial results were announced. Peak increases varied: Wales hit 3% at 01:00, Northern Ireland and England saw 12% and 11% increases respectively at 02:00, while Scotland peaked at 12% around 04:00.

DNS data from Cloudflare's 1.1.1.1 resolver shows more targeted effects. Traffic for political parties surged on election day, with peaks at 22:00 and midnight (up to 600% growth) and again at 04:00 (671%). Labour, led by Keir Starmer, saw DNS traffic spike by 866% at 22:00 compared to the previous week, outperforming the Conservative Party.

Government and election-related sites followed different patterns. Unlike some countries that update results continuously, the UK's official sites saw their largest DNS spike—a 172% increase—on election morning around 07:00. This likely reflects citizens searching for polling station locations and voting resources rather than live result tracking.

UK news outlets became the main destination for results. DNS traffic to news media sites surged 74% on election day, peaking at 104% at midnight and 04:00. Microblogging social media in Great Britain was already 25% above the previous week's level when polls closed at 22:00, peaking at 27% at midnight. Video streaming social platforms (YouTube, TikTok) saw DNS traffic roughly 10-15% higher than the previous week beginning at midnight, suggesting some users turned to these platforms for news coverage.

DDoS attacks target political parties

While DDoS attacks are constant background noise, major political events often attract additional activity. Cloudflare data shows two UK political parties were targeted in the days surrounding the election.

One party experienced a single attack on June 16 lasting over four hours and peaking at 60,000 requests per second (rps). A second party—shown in yellow in Cloudflare's charts—was hit four times: on June 13, 19, 26, and in the early hours of July 5 (UTC), just after the first projections gave Labour a majority.

That final attack was the most significant, peaking at 156,000 rps. It began at 01:47 local time (00:47 UTC) and lasted only four minutes. While these rates are small relative to Cloudflare's overall scale, they can be devastating for unprotected websites unaccustomed to such traffic volumes.

A high-intensity election year

The 2024 UK election demonstrated that while voting hours bring modest traffic dips, results night drives substantial engagement with news and social media platforms. The DDoS activity against political parties reinforces a broader trend in this "year of elections"—cyberattacks targeting politically related websites have become a recurring feature of democratic processes worldwide. Election coverage of these trends is continuously updated in the 2024 Elections Insights report on Cloudflare Radar.