Yes, The DNC's Debate Format Sucks, And There's An Easy Fix

from the DIY dept

Man, these presidential election years sure seem to last longer than a year, don't they? And, in our hyper-partisan world of never ending political stupidity, it's somewhat comforting that the one thing we can all agree on is that the debate formats recently have basically sucked out loud. The complaints about debate formats started with the 2016 RNC primaries, with its crowded field and strange varsity/JV debate night structure. Fast-forward to 2019 and the DNC's Democratic debates are being pilloried as well. In the latter case, the chief criticism appears to be that there is far too little substance discussed, with moderators for cable and OTA networks instead focusing on getting the candidates to clash in the most easy-to-soundbite fashion. Even from the major print media, you get takes such as:

Democrats woke up Thursday to find that the debate format they have agreed to is an unmitigated disaster designed to hype ratings (hence baiting the candidates to attack one another) but not to educate voters or really test candidates’ fitness for office.

Sure, getting rid of most of the field in September by raising the qualifications to 2 percent support in designated polls and 130,000 unique donors will help. If the threshold went up a percentage point each month, we might finally get to a manageable field in which candidates have more than one minute to spit out an answer and 30 seconds to rebut. However, this won’t solve all the problems with the current system

That's right, although it seems somewhat lost that the real problem here is identified in that opening paragraph. The system today is one in which the DNC and RNC partner with cable and OTA broadcasters to televise the debate. As part of that deal, those same broadcasters put their own news personalities in the chairs of moderators. This creates a pretty obvious conflict of interest. The debates is supposed to be a method through which small-D democratic process functions: voters are introduced to candidates they may not previously have been aware of, they learn those candidates' positions, and all of this is reflected in public polling to inform those candidates as to whether they should stay in the race or not. This process winnows the field down to a functional choice between select candidates.

But this isn't what happens. Instead, the moderators, many of which host their own news programs, push the preferred process of the founding fathers to the side and instead adopt the ideals of the founder of the Maury Pauvich Show. Candidates are incentivized both in the coverage and by the time-restrictions on responses to questions to spit out sound-bite-y quips rather than debate true policy. And there is a pretty simple way to change the misalignment of incentives in all of this: the DNC should stream and broadcast the debate itself and then license network and cable TV providers to rebroadcast it.

Thanks to the internet and the rise of quality equipment with which to stream stuff, the parties no longer need to dole out broadcast partnerships for their debates. Instead, the parties can handle all of this themselves and stream the debates either on their own sites, or via platforms like Facebook or YouTube. TV partners can then be allowed to re-transmit that, which they'll absolutely want to do. If they somehow do not, the stream will be available on the internet.

This move would do several things. First, it would end the insanity that is DMCA notices and platform bans that happen when people re-transmit the broadcast of a TV partner on streaming sites. The idea that a major party debate should be locked up behind copyright notices surely would make the founding fathers shit themselves. And, yet, that's what's happening today.

More importantly, it would leave moderator seats vacant for those with actual expertise on the topics to be discussed. Those moderators would also not be incentivized to generate soundbites or easy-to-repackage quips for cable news broadcasts. Literally everything would be better and there is no longer a technological or cost barrier to do all of this.

So, RNC and DNC: when the campaigns start for 2024, which will likely start roughly ten minutes after the 2020 election, consider this your DIY project.

Filed Under: debate, dnc, election, politics, primaries

Coordinated Trolling Efforts Are Serving Up Small-Scale Election Interference Across The Country

from the I'm-so-old-I-remember-this-being-nothing-more-than-knocking-down-yard-signs dept

A brave new world of voter suppression is upon us. It isn't shadowy government guys with guns patrolling polling centers in search of "voter fraud" unicorns. It isn't the surrealistic landscapes created by gerrymandering. It isn't even the messages being sent from the top man in the land: that people who aren't Caucasian are probably bussed-in illegals voting straight Democrat.

This new voter suppression flows through the internet, originating in closed chat sessions and manifesting as disinformation campaigns meant to steer certain voters away from the polls.

In a private “strategy chat” with more than 40 far-right trolls, one user who tried to create a new Twitter account to spread disinformation ahead of Tuesday’s midterms elections described how he had hit an immediate roadblock: Twitter banned him for deliberately giving out the wrong election date.

“Were they really banning people for saying [vote on] November 7? Lol, whoops,” the user, whose name was a racist joke about Native Americans, wrote. “Maybe that’s what got me shadowbanned.”

As the report points out, some of Twitter's anti-election interference efforts appear to be working. Tweets containing the wrong voting date were blocked before they were seen by other users. But there's only so much algorithms can catch. Faced with this blocking, the trolls viewed in this chat room adjusted their tactics.

Several were successful in creating unique identities that appeared to be middle-aged women who posted anti-Trump rhetoric as part of a long-term effort to build up followings that could later be used to seed disinformation to hundreds or thousands of followers.

If this seems counterproductive in terms of eliminating votes for non-Republican candidates, it actually isn't. As NBC's Ben Collins notes, this more clever effort has managed to elude moderators. Posting under hashtags like #nomenmidterm and #letwomendecide, these accounts are being used to deter male liberals from casting votes.

The interference is coming from inside the house. Homegrown efforts are joining foreign state-sponsored interference to make every election from 2016's to the rest of forever seem tainted. This is piled on top of ongoing problems with electronic voting devices, which are notoriously insecure and far from user friendly. The democratic process appears to be no more secure than a connected tea kettle.

But this cascade of bad news shouldn't deter anyone from voting. For the most part, the system works! (And by "system," I mean the actual act of voting, not necessarily the system run by those receiving votes…) Even if the individual act of voting can often feel pointless or useless, it's still better than the predetermined "elections" held by despotic governments where the outcome is made-up and the points don't matter.

This also shows efforts to quell online disinformation are working to a limited extent. Combining humans and algorithms makes more sense than relying solely on one method, but both have their limitations. Human biases can strip the neutrality out of moderation efforts and algorithms tend to do one thing pretty well, but suck at anything else that requires comprehension of context, nuance, or sarcasm.

This is the new normal for elections. Get used to it. But don't get discouraged.

Filed Under: content moderation, election, election day, social media, trolling

Georgia Scrambles To Patch Massive Vulnerabilities In Its Voter Registration System After Insisting It Was Totally Secure

from the so-about-that-voting-system... dept

Yesterday we had a rather incredible story about Georgia's Secretary of State, Brian Kemp, who, despite the conflict of interest, is both running for Governor and in charge of making sure Georgia's elections are fair. Over the weekend, Kemp had made a highly questionable claim that his opponents in the Democratic Party of Georgia had attempted to hack the voter registration system, and he was opening an investigation. As we noted, what appears to have actually happened was that an independent security researcher had discovered massive, stunning, gaping security flaws in Georgia's voter registration system, that would potentially allow anyone to access anyone else's information and even modify it. That's an especially big deal in Georgia, where the very same Secretary of State Brian Kemp had pushed for laws that meant that if any of your ID information was different from what was in the voter system, you didn't get to vote.

Incredibly, despite multiple security experts pointing out some fairly basic flaws, Kemp's office insisted the site was secure. According to press secretary Candice Broce:

“We can also confirm that no personal data was breached and our system remains secure.”

Elsewhere the Secretary of State's Office insisted there were no problems with the site. However, as ProPublica is now reporting, late Sunday night, after it had insisted there was nothing wrong, it appeared that someone behind the scenes was scrambling to patch the vulnerabilities:

ProPublica’s review of the state’s voter system followed a detailed recipe created by the tipster, who was described as having IT experience and alerted Democrats to the possible security problems. Using the name of a valid Georgia voter who gave ProPublica permission to access his voter file, reporters attempted to trace the security lapses that were identified.

ProPublica found the website was returning information in such a way that it revealed hidden locations on the file system. Computer security experts had said that revelation could give an intruder access to a range of information, including personal data about other voters and sensitive operating system details.

ProPublica’s attempt to take the next step — to poke around the concealed files and the innards of the operating system — was blocked by software fixes made that evening.

The same Candice Broce who had insisted that there was absolutely nothing wrong with the site then told ProPublica two obviously bullshit claims. First, that the setup that allowed users to see exactly where files were stored was standard practice, and so was making last minute changes to a voter registration website two days before an election:

Broce said the ability to see where files were stored was “common” across many websites, and she said it was not an inherent vulnerability. She did not deny that the website’s code was rewritten and would not say whether changes were made as a result of the possible security holes.

“We make changes to our website all the time,” Broce said. “We always move our My Voter Page to a static page before Election Day to manage volume and capacity. It is standard practice.” By Monday afternoon, the page did not appear to be static in the way Broce described, and she did not respond to a request to provide evidence of the change.

Of course, as anyone who has done any serious website building in, let's say, the last 10 to 15 years, knows well, that is not at all standard practice. But, let's see the quote from an expert anyway:

Joseph Lorenzo Hall, the chief technologist at the Center for Democracy and Technology in Washington, D.C., disputed that visibility into file storage was common. “It’s definitely not best practice,” he said. He said it appeared the state had made the change in response to being notified of the problem and could see no reason why officials would otherwise make such a change ahead of Election Day.

Security experts frown on making such seemingly ad hoc changes close to major events, such as an election, because they can create unforeseen problems when made so quickly.

Basically, it appears that Kemp and the Secretary of State's office are betting on voters in Georgia being totally ignorant. Meanwhile, this is the same office that just a couple months ago made the following bold statement:

“There has never been a breach in the Secretary of State’s office. We have never been hacked, and according to President Trump and the Department Of Homeland Security, we have never been targeted. Georgia has secure, accessible, and fair elections because Kemp has leveraged private sector solutions for robust cyber security, well before any of those options were offered by the federal government.”

I don't care what side of the partisan divide you fall on, but Kemp's actions in failing to protect the system, overseeing the voting in his own election, then attacking the messenger for pointing out his own vulnerability, denying the vulnerability, and then scrambling to fix the vulnerability at the last minute without telling anyone, should disqualify him from running a Burger King, let alone being Governor of the state of Georgia.

Filed Under: brian kemp, computer security, election, georgia, voter registration, vulnerability

We Brought Our Election Simulation Game To Chicago... And Learned The Chicago Way

from the russians-in-a-dimly-lit-shipping-container dept

You may recall that, back in June, I wrote about a bizarre situation in which an election simulation game, that I helped co-design, called "Machine Learning President," somehow had some of the rules sheets leaked to Rebekah Mercer, from which they were leaked once again to Jane Mayer at the New Yorker, who wrote up an article there, not knowing the provenance of the game. This caused many, many people to assume that the Mercers had somehow made up this game to "relive" the success of the 2016 election. This resulted in a ton of angry headlines and tweets -- including the host of NPR's comedic news-based "game show" Wait Wait Don't Tell Me, Peter Sagal, who alerted his friend, Cards Against Humanity designer, Max Temkin, who tweeted angrily about the game.

The next day, when I wrote up my post explaining what the game really was about -- we had a lot of people reach out to ask if they, too, could play the game. Unfortunately, it's a ton of work to put on, and the crew who designed the game -- lead by Berit Anderson and Brett Horvath from Scout.ai and Guardians.ai, who initially conceived of the game, along with Randy Lubin (who is our partner in our CIA game project), and science fiction writer, Eliot Peper -- are all super busy. However, by far the most aggressive in getting us to play the game were Max Temkin and Peter Sagal.

It finally happened two weeks ago in Chicago, and Charlie Hall at Polygon has a brilliant write-up about how the game went:

Inside a warehouse on Chicago’s North Side, within the thin strip of industrial property between Bucktown and Lincoln Park, Sen. Elizabeth Warren is pandering to a small group of powerful evangelicals. Just a few feet away, near a bowl brimming with 20-sided dice, Vice President Mike Pence is honing his next batch of TV and radio ads. Meanwhile, within a dimly lit shipping container, Russian oligarchs are desperately trying to funnel money to Sen. Kamala Harris through Black Lives Matter.

No, it’s not the fever dream of some political wonk stranded here along the nation’s third coast. It’s a 40-person live-action role-play of the 2020 presidential election. Formally, it’s called a “scenario planning game.” In motion, it’s a vehicle for some of the most engaging political theater that I’ve ever seen.

This was really only the second time we've run the full game (there have been a few playtests of part of the game). The first time was back in San Francisco in February and then this time in Chicago. The San Francisco game was incredible, but the crew that Max and Peter brought out to play in Chicago took it to the next level in terms of truly inhabiting their roles... and learning from the experience:

For Sagal, who every week tells jokes about political figures set against the backdrop of real NPR News stories, Machine Learning President was an educational experience.

“I make my living reading the news,” Sagal said. “All that shit is real, but it’s not important. The important shit we never find out about, and I honestly think this game illustrates that.

“Look at it this way: All of the candidates tonight got to make speeches, and these speeches were important. [...] But what was also interesting was that there was no attempt on anybody’s part to use those speeches to convince anybody of anything. That all happened during the 15-minute rounds. The speech was just about signaling. The speech was not making the deal or convincing anybody to do anything. It was just about delivering on something and positioning yourself to confirm a deal you’ve already made. There was no persuasive aspect to any of the things that any of us said, because the persuading had already been done. Or, as in our case with the Evangelicals, not done.

“What the game teaches you,” Sagal continued, “is that the shit that we get to see, as citizens who watch the speeches and get the emails [...] is nonsense and not important. The stuff that’s really important is happening behind the scenes.”

That may be the best endorsement we've seen of the game yet -- and the article only barely touches on some of the crazy alliances, use of technology, dealmaking, events, and backstabbing that played out over the course of a truly frantic evening. As the article notes, a big part of the point of the game is to get people to better understand how politics and tech and money intersect, and we heard from multiple people who played in Chicago saying they couldn't stop thinking about it after playing (we also had a few veterans of actual political campaigns note that it hit a little too close to home). Chicago has a reputation in politics, and I will say that the folks who showed up to play demonstrated that quite effectively.

Either way, we're still hoping to set up additional events for the game, even though it's quite a bit of work to run, and all of us are pretty swamped with other stuff. However, since people keep asking for it, we're trying to figure out ways to run it perhaps a bit more often.

Filed Under: chicago, election, election game, elections, games, machine learning president, max temkin, peter sagal, politics, scenario planning, simulation

Google Removed Catalonian Referendum App Following Spanish Court Order

from the this-seems-problematic dept

Last month, we wrote about the crazy situation in Spain, where the government was so totally freaked out about a Catalonian referendum on independence that it shut down the operators of the .cat domain, arrested the company's head of IT for "sedition" and basically shut down a ton of websites about the referendum. The Washington Post now has an article with even more details about the digital attacks in both directions around the Catalonian independence referendum, including hack attacks and DDoS attacks. But one thing caught my eye. Apparently, the supporters of the referendum had created an app called "On Votar 1-Oct." The app had a bunch of the expected functions:

The app, available on Google Play until just before 7 p.m. on Friday, helps people to find their polling station via their address and shows the closest polling stations on Google Maps via GPS, the name of the town or keywords.

It also allows users to share links to polling station locations.

But the Spanish government was so freaked out by the referendum and anything related to it, that it ran and got a court order demanding Google take the app out of Google's app store:

The court order told Google Inc—at 1600 Amphitheatre Parkway Mountain View CA 94043 (USA)—to take down the app located at that URL and also to block or eliminate any future apps submitted by the user with e-mail address "onvotar1oct@gmail.com" or identifying as "Catalonia Voting Software".

The judge says in her ruling that the tweet with the app link is "only a continuation of the actions of the [Catalan government] to block" Constitutional Court and High Court orders "repeatedly".

In the Washington Post article, the CTO of the Catalonian government explains why this is so disappointing:

“I’m a tech guy,” says Jordi Puigneró, chief technology officer of the Catalonian government. “So I’ve always been a great fan of Google and its principles of respect for digital rights. But now I’m really disappointed with the company.” (Puigneró’s office was also occupied by police during the referendum, he says.)

And you can understand why he's disappointed. But, the real problem here, seems to be going back to the same problem we keep identifying over and over again: deep centralization of the digital world. Part of the very promise of Android was that it was supposed to be open, and people weren't supposed to be locked into just Google's app store. And, indeed, there are competing app stores -- but the general argument around them (with the possible exception of Amazon's competing Android app store) is that if you want to keep your device secure, you'll only download via Google's app store.

And then we're back to a problem where there's a centralized choke point for censorship -- one which the Spanish government is able to exploit to make that app much more difficult to access. Google, for its part, said it took the app down because it had received a valid court order. And, that's true, but it's also opening up yet another path to widespread censorship. Google has stood up against similar situations in the past, but the decision of whether or not a movement should be stifled should never come down to whether or not a giant company like Google decides its worth taking a moral stand against a legal court order. The problem is much more systemic, and its built into this world where we've started to build back up gatekeepers.

For nearly two decades, I've argued that the real power of the internet was not -- as many people initally argued -- that it got rid of "middlemen," but rather that the middlemen turned into enablers rather than gatekeepers. In the old world, when only some content could get released/published/sold/etc., you had to rely on gatekeepers to choose which tiny percentage would get blessed. The power of internet platforms was that they became enablers, allowing anyone to use those platforms and to publish/release/sell/distribute things themselves, often to a much wider audience. But there'a always a risk that over time, former enablers become gatekeepers. And it's a fear we should be very conscious about -- even if it's not done on purpose.

To be clear, I don't think Google wants to be a gatekeeper around things like apps. It would prefer not to be. But because the marketplace has become so important, and because Google's role is so central, it almost has no choice. And when governments start issuing court orders to take down apps, suddenly Google is left with few good options. Either it censors or it picks fights with a government. And even if many of us would probably support and cheer on the latter as a choice, we should be concerned that this is even an issue at all. The solution has to be less reliance on centralized platforms and centralized choke points. Catalonians shouldn't have to rely on Google to get a simple voting app out to the public. The next big breakthroughs need to be towards getting past such bottlenecks.

Filed Under: bottlenecks, catalonia, democracy, election, independence, play store, points of failure, referendum, spain
Companies: google

Stories Claiming DNC Hack Was 'Inside Job' Rely Heavily On A Stupid Conversion Error No 'Forensic Expert' Would Make

from the don't-trust-anonymous-sources-unless-you-agree-with-them dept

While we wait for the Mueller investigation to clearly illustrate if and how Russia meddled in the last election, there's no shortage of opinions regarding how deep this particular rabbit hole goes. While it's pretty obvious that Putin used social media and media propaganda to pour some napalm on our existing bonfires of dysfunction, just how much of an impact these efforts had on the election won't be clear until a full postmortem is done. Similarly, while Russian hackers certainly had fun probing our voting systems and may have hacked both political parties, clearly proving state involvement is something else entirely.

Quite fairly, many folks have pushed for caution in terms of waiting for hard evidence to emerge, highlighting the danger in trusting leaks from an intelligence sector with a dismal track record of integrity and honesty. There's also the obvious concern of ramping up tension escalation between two nuclear powers. But last week, many of those same individuals were quick to highlight several new stories that claimed to "completely debunk" Russia's involvement in hacking the DNC ahead of last year's election. The problem? These reports were about as flimsy -- if not flimsier -- than the Russian hacking theories they supposedly supplanted.

In fact, these reports took things one step further by claiming that the hack of the DNC was something committed solely by someone within the DNC itself. This particularly overlong, meandering piece by The Nation, for example, claimed to cite numerous anonymous intelligence sources who have supposedly grown increasingly skeptical over the "Russian hacking narrative." Quite correctly, the report starts out by noting that while there's oodles and oodles of smoke regarding Putin's involvement in the election hacks, the fire (hard evidence) has been hard to come by so far:

"Lost in a year that often appeared to veer into our peculiarly American kind of hysteria is the absence of any credible evidence of what happened last year and who was responsible for it. It is tiresome to note, but none has been made available. Instead, we are urged to accept the word of institutions and senior officials with long records of deception. These officials profess “high confidence” in their “assessment” as to what happened in the spring and summer of last year—this standing as their authoritative judgment.

But it's then that's where things get a little weird. The report repeatedly proclaims that a laundry list of anonymous "forensic investigators, intelligence analysts, system designers, program architects, and computer scientists of long experience and strongly credentialed" have been hard at work "producing evidence disproving the official version of key events last year." But one of the key conclusions by these experts -- and a key cornerstone for of all of these stories -- makes absolutely no sense.

The reports lean heavily on anonymous cybersecurity experts calling themselves "Forensicator" and "Adam Carter," who purportedly took a closer look at the metadata attached to the stolen files. Said metadata, we're breathlessly informed, indisputably proves that the data had to have been transferred from inside of the DNC network and not over the internet, since the internet isn't supposedly capable of such transfer speeds:

"Forensicator’s first decisive findings, made public in the paper dated July 9, concerned the volume of the supposedly hacked material and what is called the transfer rate—the time a remote hack would require. The metadata established several facts in this regard with granular precision: On the evening of July 5, 2016, 1,976 megabytes of data were downloaded from the DNC’s server. The operation took 87 seconds. This yields a transfer rate of 22.7 megabytes per second.

These statistics are matters of record and essential to disproving the hack theory. No Internet service provider, such as a hacker would have had to use in mid-2016, was capable of downloading data at this speed. Compounding this contradiction, Guccifer claimed to have run his hack from Romania, which, for numerous reasons technically called delivery overheads, would slow down the speed of a hack even further from maximum achievable speeds."

That reads like a semi-cogent paragraph, but it's largely nonsense. 22.7 megabytes per second (MB/s) sounds impossibly fast if you don't know any better. But if you do the simple conversion from megabytes per second to megabits per second necessary to determine the actual speed of the connection used, you get a fairly reasonable 180 megabits per second (Mbps). While the report proclaims that "no internet service provider" can provide such speeds, ISPs around the world routinely offer speeds far, far faster -- from 500 Mbps to even 1 Gbps.

And despite the report oddly pooh pooh'ing Romanian broadband's "delivery overheads," many Romanian cities actually have faster internet connectivity than either Russia or in the States (check out Akamai's global broadband rankings). Bernie Sanders learned this last year when he unintentionally pissed off many Romanians when trying to highlight the dismal state of U.S. connectivity. Even then, the hacker in question could have used any number of tricks to hide his or her location and real identity from a high-bandwidth vantage point, so the claim that the hacker couldn't achieve 180 Mbps through a VPN is simply nonsense.

Obviously this raises some questions about what kind of cyber-sleuths we're talking about when they can't do basic conversions or look at some fairly obvious broadband speed availability charts. And it also raises some questions about why reporters thought flimsy anonymous experts were the perfect remedy to the other flimsy anonymous leaks they hoped to debunk. While The Nation couldn't even be bothered to do the simple calculation to determine the speed of the connection used by the hacker was relatively ordinary, in a story titled "Why Some U.S. Ex-Spies Don't Buy the Russia Story," Bloomberg actually did the conversion to get the 180 Mbps speed, and still somehow told readers that such speeds were impossible:

"The VIPS theory relies on forensic findings by independent researchers who go by the pseudonyms "Forensicator" and "Adam Carter." The former found that 1,976 MB of Guccifer's files were copied from a DNC server on July 5 in just 87 seconds, implying a transfer rate of 22.6 megabytes per second -- or, converted to a measure most people use, about 180 megabits per second, a speed not commonly available from U.S. internet providers. Downloading such files this quickly over the internet, especially over a VPN (most hackers would use one), would have been all but impossible because the network infrastructure through which the traffic would have to pass would further slow the traffic."

Yes, all but impossible! Provided you ignore that DOCSIS 3.1 cable upgrades and fiber connections deliver speeds consistently faster than that all around the world every day -- including Romania. False claims and sloppy math aside, after the Bloomberg column ran, several actual, identifiable intelligence experts also came forward doubting the legitimacy of the supposed intelligence sources for these stories altogether:

Surrounded by raised eyebrows, The Nation is now apparently reviewing its story for accuracy after numerous people highlighted that a major cornerstone of the report was little more than fluff and nonsense. Bloomberg has so far failed to follow suit.

So again, there's certainly every reason to not escalate hostility between the United States and Russia with many details still obfuscated and investigations incomplete. And there's also every reason to view reports leaning heavily on anonymous intelligence insiders skeptically after generations of distortions and falsehoods from those same agencies. That said, if you want to debunk the anonymous claims of a growing number of intelligence insiders who claim Russia played pinball with our electoral process, perhaps running into the arms of even more unreliable, anonymous intelligence sources -- without checking your math -- isn't your best path toward the truth.

Filed Under: bandwidth, dnc, election, hack, math, russia

What The US Intelligence 'Russia Hacked Our Election' Report Could Have Said... But Didn't

from the why-didn't-it? dept

By now it's quite clear that many in the US intelligence community believe strongly that Russia tried to influence the US election, and part of that included hacks into the DNC's computer systems, a spearphishing attack on Clinton campaign manager John Podesta's emails and some exploratory surveillance hacking into the computer systems of state election systems (but not into the voting machines themselves). The US intelligence services said it back in October. And they said it again last month. And, they said it again on Friday with the release of an unclassified "incident attribution" report.

Because the debate over this issue has gotten quite silly in some places -- and ridiculously political as well -- let's start with a few basic points: It is absolutely entirely possible that the Russians hacked into all these systems and that it was trying (and perhaps succeeding?) to influence the election. Nothing in what I'm saying here is suggesting that's not true. What I am concerned about is the evidence that's presented to support that claim -- mainly because I think we should all be terrified when we escalate situations based on secret info where the government just tells us to "trust us, we know." And, yes, governments (including the US) have done this going back throughout history. That doesn't make it right.

But here's the thing: there actually is some pretty good evidence that Russia was behind the hack. But here's the crazy thing: that evidence is not in this report, but presented elsewhere. If you keep reading below, I'll point out an example of some pretty compelling evidence that Russia was behind the hack -- and it's the kind of evidence that the US intelligence community could have easily provided, but did not.

And that's where the problems lie. Because very little in this new report provides any evidence at all of Russia doing anything. It certainly goes deep into the motivations for why Russia might want to influence our election. It's also not surprising that Russia might have the ability and expertise to do these things. But it would be nice to see actual evidence. As Lovenzo Franceschi-Bicchierai at Motherboard notes, there's really very little in the new report that we didn't know already:

But this report adds nothing we didn’t already know from public information. The only significant statement is that, yes, American spies are convinced Russian President Vladimir Putin himself directed the hacking and influence campaign—something they already stated in early October.

Marcy Wheeler similarly notes that there's plenty of work on motives, but little on evidence:

What we see of it is uneven. I think the report is strongest on Russia’s motive for tampering with the election, even if the report doesn’t provide evidence. I think there are many weaknesses in the report’s discussion of media. That raises concerns that the material on the actual hack — which we don’t get in any detail at all — is as weak as the media section.

The "media" section is actually pretty ridiculous. It basically notes that RT, the American-targeted TV station owned by the Russian government, has a history of pushing Russian-approved propaganda. Well, sure.

And just one more pointer on this. Former CIA analyst Patrick Eddington also has a really thorough analysis of the report and comes to basically the same conclusions:

While the report provides new and important details on the multifaceted Russian operation, its failure to include declassified primary source data for key claims ensures the controversy has not been put to rest.

So, what kind of evidence could the intel community have provided? Well, Matt Tait, who used to work at the UK's GCHQ, and who now tweets at @pwnallthethings gave a pretty damn good example of digging down into publicly available data to present quite compelling evidence that Russian interests were behind, at the very least, the hack of John Podesta's emails. This is not 100% conclusive, certainly, but it's a hell of a lot more compelling than anything released by the US government: See? That's pretty damn compelling. Perhaps it's not conclusive, but it's a very, very strong argument for why the hack came from Russia. And it's a hell of a lot more compelling that what the US government put out.

I've seen lots of people arguing that the intelligence community couldn't reveal more details because it would "burn sources and methods" that were used to determine the attribution of the hacks -- but Matt Tait did figure all that out with public information (ironically, some of it revealed via Wikileaks). Now, perhaps the intelligence community that hates Wikileaks doesn't want to use that as a "source" in its report. Or perhaps it's something else. And, yes, it makes sense that the intelligence community should not burn sources and methods to reveal stuff like this. But there are ways to present compelling details without compromising those things. But, of course, this is the US intelligence community we're talking about, and they're generally not fans of revealing anything at all. So I'm sure even the details in this report were like pulling teeth. And that's dumb.

Again, more and more of what happens in the world is going to happen via computer systems and networks. And we're not always going to know. But it's a serious problem when governments are escalating situations and making angry posturing moves against one another based on totally secret information where the best we're being told by the government is "trust us." Especially when that very same government has a long history of not being so trustworthy.

Filed Under: election, evidence, hacking, matt tait, russia, us intelligence

White House Kicks Russian Diplomats Out Of The Country, Releases Preliminary Report On Russian Hacking With More To Come

from the escalation-time dept

As was widely expected, the White House officially announced its response to claims of Russian interference in our election process, and the "response" is basically kicking 35 Russian diplomats out of the country. Russia admittedly suggested it will do the same. The announcement also includes adding some entities to the official list of "Specially Designated Nationals and Blocked Persons." Somewhat incredibly, now added to that list is the FSB, which is the modern incarnation of the KGB. What's incredible about this was that it took until now for this to happen. With this, the administration also issued an executive order expanding on a previous executive order from last year, enabling it to take these actions.

Somewhat ridiculously, the new executive order just shows the full new order, and doesn't call out what changes were made from the original. So I went through and did a diff on the two executive orders myself. The first major change is an additional first line of who can be sanctioned. While the original had a description of what types of people could be sanctioned for cybersecurity violations, that same sanction has been bumped down to the 2nd item, and the new first item is:

the persons listed in the Annex to this order

Hmmm. That feels unfortunately close to an "enemies list."

The second major change is the addition of this action which can get you sanctioned to a long list of reasons:

tampering with, altering, or causing a misappropriation of information with the purpose or effect of interfering with or undermining election processes or institutions;

Yup. Remember, we noted already that interfering with "election systems" was not previously listed as a sanctionable offense. Now it is. That was to be expected.

Along with this report, Homeland Security and the FBI also (finally) released something of a "Joint Analysis Report" about the alleged Russian interference. The only major revelation in there is that the US government is referring to this hacking program as "GRIZZLY STEPPE."

This Joint Analysis Report (JAR) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). This document provides technical details regarding the tools and infrastructure used by the Russian civilian and military intelligence Services (RIS) to compromise and exploit networks and endpoints associated with the U.S. election, as well as a range of U.S. Government, political, and private sector entities. The U.S. Government is referring to this malicious cyber activity by RIS as GRIZZLY STEPPE.

Previous JARs have not attributed malicious cyber activity to specific countries or threat actors. However, public attribution of these activities to RIS is supported by technical indicators from the U.S. Intelligence Community, DHS, FBI, the private sector, and other entities. This determination expands upon the Joint Statement released October 7, 2016, from the Department of Homeland Security and the Director of National Intelligence on Election Security.

This activity by RIS is part of an ongoing campaign of cyber-enabled operations directed at the U.S. government and its citizens. These cyber operations have included spearphishing campaigns targeting government organizations, critical infrastructure entities, think tanks, universities, political organizations, and corporations leading to the theft of information. In foreign countries, RIS actors conducted damaging and/or disruptive cyber-attacks, including attacks on critical infrastructure networks. In some cases, RIS actors masqueraded as third parties, hiding behind false online personas designed to cause the victim to misattribute the source of the attack. This JAR provides technical indicators related to many of these operations, recommended mitigations, suggested actions to take in response to the indicators provided, and information on how to report such incidents to the U.S. Government.

Other than that, the report really doesn't tell us much more than was already reported in the past by various cybersecurity outfits, about the supposed infiltration by two hacking groups -- called APT28 and APT29 (APT: Advanced Persistent Threat) that people say are connected to the Russian government. There is a nifty graphic, though: The report also posts the YARA signature of the malware that was used (and encourage security folks to check for matching YARA signatures on their systems), and highlights (as was already known) that most of the "hacking" involved spearphishing (directly targeting individuals and tricking them into giving up passwords, with fake password reset requests).

The report does not add much to prove that it was actually the Russians behind this, though everyone insists that's now the consensus view. The NY Times notes that "a more detailed report on the intelligence... will be published in the next three weeks," which certainly could reveal more details. But... of course... "much of the detail -- especially evidence collected from "implants" in Russian computer systems, tapped conversations and spies — is expected to remain classified." In other words, for those who are still skeptical that it was Russia, don't expect them to be convinced by any of this.

Meanwhile, Donald Trump, when asked about all of this managed to toss off his typical word salad of nothingness:

“I think we ought to get on with our lives. I think that computers have complicated lives very greatly. The whole age of computer has made it where nobody knows exactly what is going on. We have speed, we have a lot of other things, but I’m not sure we have the kind, the security we need.”

Yes, it's true that attribution in online security is difficult, but most of that statement is completely ridiculous.

And, of course, this is all kinds of a mess. You have claims of attacks that no one wants to back up with actual details, for fear that it will reveal too much about sources and methods. You have escalation of "diplomatic responses" to counter this attack that everyone tells us was done by the Russians. You have an incoming President who basically said "how do I even computer." None of this is good, and none of it should be okay from no matter where you sit. If we're going to get into a fight with Russia, it would be nice if we had more evidence that "hey, someone broke into the email systems of political parties -- because those organizations are bad at security." But that doesn't seem likely to happen.

Instead, we're left with this weird game where we're constantly being told "trust us" by one side and "computers confusing" by the other. That's not comforting.

Filed Under: cybersecurity, diplomats, election, russia, sanctions, white house