Usenix Security 2021 ✱
“Why wouldn’t someone think of � democracy as a target?”
Security practices & challenges of people involved with U.S. political campaigns
Sunny Consolvo
Patrick Gage Kelley
Tara Matthews
August 2021
Kurt Thomas
Lee Dunn
Elie Bursztein
Security, Privacy, and Anti-Abuse Research
How John Podesta’s email got hacked, and how to not let it happen to you
How the Russians hacked the DNC and passed its emails to WikiLeaks
Macron Leaks: �The anatomy of a hack
Oct. 2016
July 2018
May 2017
Security, Privacy, and Anti-Abuse Research
3
- A study participant [emphasis added]
Security and politics should be separate... �If you’re a candidate, you should win or lose on your best day, based on who you are. Not because your email got popped and posted online by a [nation-state cybersecurity team].”
Security, Privacy, and Anti-Abuse Research
4
Research
Security, Privacy, and Anti-Abuse Research
5
28 people involved with political campaigns in the U.S.
Organizations
Roles
Qualitative research
Security, Privacy, and Anti-Abuse Research
2 main security factors
Work
culture
Tech practices and vulnerabilities
Security, Privacy, and Anti-Abuse Research
7
[Campaigns are] totally transient, �and almost everybody gets hired in �the 3 months prior to the election…
There’s really very few incentives for �any kind of [security] rigor.
Because you’re up against the clock, and �faced with the ticking clock, everything pales.”
— A study participant [emphasis added]
Security, Privacy, and Anti-Abuse Research
8
Different culture
They are� resourced constrained
They are� short-lived
They have�amorphous boundaries
They are� chaotically busy
Security, Privacy, and Anti-Abuse Research
9
Account use
MANY accounts are used for campaign work
Some accounts are hyper-shared or hyper-owned
Security, Privacy, and Anti-Abuse Research
10
Accounts not used for campaign-related �work are also targeted
Anything that can derail, embarrass, �or otherwise disrupt could be a target
Not just campaign accounts
Security, Privacy, and Anti-Abuse Research
11
Some important aspects
It’s unusual for campaigns to have IT staff
Only the individual can access all accounts
This means they need to...
Security, Privacy, and Anti-Abuse Research
12
[What are nation-states after?] �“Emails, communications, anything that could compromise the campaign, make it look bad... Anything that makes the campaign or the staff look bad...”
— A study participant [emphasis added]
Security, Privacy, and Anti-Abuse Research
13
2FA practices
Heard of and probably have used 2FA
2FA is under-utilized on targeted accounts
Weaker 2nd factors are often used
Security, Privacy, and Anti-Abuse Research
14
Common 2FA concerns
Too much time & effort
Fear of account lockout
Hyper-shared & hyper-owned accounts
Security, Privacy, and Anti-Abuse Research
15
Different factors
Different factors = different levels of security
don’t know or �can’t explain why
aren’t aware that they should use it to protect most of their accounts
They know 2FA is important, BUT�. . .
Security, Privacy, and Anti-Abuse Research
16
Risk & outcomes
Campaigns face an outsized risk of being attacked
The outcomes can be outsized too
Security, Privacy, and Anti-Abuse Research
17
Conclusion
Security, Privacy, and Anti-Abuse Research
18
44 experts
Expert roundtable
from 28 organizations
Security, Privacy, and Anti-Abuse Research
19
Expert roundtable’s focus
Improve security practices on political campaigns
Single, consistent piece of top advice for 2020
Feedback on our research findings
Security, Privacy, and Anti-Abuse Research
20
Tailored advice & education
Security advice & education that is tailored to their �needs and context
Consistent �message
Exactly �what to do & why
Prioritize! �Not everything can be critical
Security, Privacy, and Anti-Abuse Research
21
More research
From deep, foundational research �to tactical usability studies
Around the world
Across various types of campaigns
& campaign workers
Security, Privacy, and Anti-Abuse Research
22
Improved protections
Very robust, very usable security protections
Default settings
Standardization of offerings & experience
(Perceived) �time & effort
Security, Privacy, and Anti-Abuse Research
23
— A study participant [emphasis added]
“What is 100% true... is that foreign adversaries want information… The faster we all realize that, the better off we’re going to be…
to see politics and campaigns at all levels as a fundamental piece of democracy that needs to be protected . . .
For sure foreign adversaries are trying to attack our systems… Why wouldn’t someone think of democracy as a target?”
Security, Privacy, and Anti-Abuse Research
24
A big thank you
Our research participants
Our roundtable attendees
The many people at Google who helped make the research & roundtable happen
Security, Privacy, and Anti-Abuse Research
ARCHIVED
Everything beyond this point to be removed.
25
Security, Privacy, and Anti-Abuse Research
In today’s talk . . .
26
Understanding Campaigns
Security Challenges
Conclusion
Research
Security, Privacy, and Anti-Abuse Research
27
Imagine . . .
Security, Privacy, and Anti-Abuse Research
28
But not all hacks are �going to lead to an �outsized outcome like that, are they?
Security, Privacy, and Anti-Abuse Research
29
Recognized threats
Targeted attacks
Nation-states
Phishing
Security, Privacy, and Anti-Abuse Research
30
““It was like I was standing out there naked” �said [a Congressional candidate] who lost [their] primary race after secret campaign documents �were made public.
“I just can’t describe it any other way. �Our entire internal strategy plan was made public, and suddenly all this material was �out there and could be used against me.”
- The NY Times [emphasis added]
E. Lipton & S. Shane, Democratic House Candidates Were Also �Targets of Russian Hacking, The NY Times, Dec 13, 2016.
Security, Privacy, and Anti-Abuse Research
31
Providers & purposes
Accounts span multiple providers
Mix of accounts that were created . . .
by the campaign �for the individual
by the individual �for the campaign
by the individual �for other purposes
Security, Privacy, and Anti-Abuse Research
32
Additional considerations
Account security is a somewhat recent concern
Main goal: �WIN the election!!!
Lack of standardization
Security, Privacy, and Anti-Abuse Research
33
No . . .
Security, Privacy, and Anti-Abuse Research
34
2020 �seemed okay . . .
- Elections Infrastructure Govt Coordinating Council & Election Infrastructure Sector Coordinating Exec Committees
Nov 12, 2020 [Emphasis added]
The November 3rd election was the most secure in American history.”
Security, Privacy, and Anti-Abuse Research
35
Questions?
Sunny Consolvo
Patrick Gage Kelley
Tara Matthews
Elie Bursztein
Kurt Thomas
Lee Dunn
Security, Privacy, and Anti-Abuse Research