What is Old, and New, and Scary in Russia’s Probable DNC Hack

David Sanger and Nicole Perlroth of the NYT summarize the evidence of a Russia-based hack of the DNC emails:

Proving the source of a cyberattack is notoriously difficult. But researchers have concluded that the national committee was breached by two Russian intelligence agencies, which were the same attackers behind previous Russian cyberoperations at the White House, the State Department and the Joint Chiefs of Staff last year. And metadata from the released emails suggests that the documents passed through Russian computers. Though a hacker claimed responsibility for giving the emails to WikiLeaks, the same agencies are the prime suspects. Whether the thefts were ordered by Mr. Putin, or just carried out by apparatchiks who thought they might please him, is anyone’s guess.

(For more such analysis, see also here and here.)

There is nothing new in one nation’s intelligence services using stealthy techniques to influence an election in another. According to William Daugherty’s Executive Secrets: Covert Action and the Presidency, the United States by covert action:

• Attempted to “forestall a Communist government” in Indonesia in 1957
• Intervened “in Italian political processes to prevent the Italian Communist Party (PCI) from winning elections between 1948 and the late 1960s.”
• Used “extensive propaganda and political action programs in election campaigns” in Chile during the Kennedy, Johnson, and Nixon administrations.
• Provided “funds, desktop publishing materials, and other means of support to the banned trade union Solidarity following the imposition of martial law in Poland after 1981”

In addition, David Ignatius reported that in the Fall of 2004 President Bush signed (but later withdrew) a covert action finding designed to spend $20 million to counter Iranian influences in Iraqi elections. There are surely many, many other examples, in the United States and abroad.

While there is nothing new in one nation using its intelligence services to try to influence an election in another, doing so by hacking into a political party’s computers and releasing their emails does seem somewhat new. The combination of pilfering sensitive information and then “weaponiz[ing] Wikileaks” or some similar organization will surely recur. The possibilities do not end there. Foreign governments could “hack a voting machine,” “shut down the voting system or election agencies,” “delete or change election records,” “hijack a candidate’s website,” “dox[] a candidate,” “and target campaign donors.” (See also here.) As Cory Bennet wrote in The Hill earlier this year:

Since December, hundreds of millions of voters in the U.S., the Philippines, Turkey and Mexico have had their data discovered on the web in unprotected form. In some instances, legitimate security researchers found the information, but in others, malicious hackers are suspected of pilfering the data for criminal purposes.

The data breaches are raising questions as the U.S. considers whether to move toward electronic balloting. More people than ever are using the internet to register to vote and to request mail-in ballots. Some states have even become vote-by-mail only in recent years.

“If you can’t keep the voter registration records safe, what makes you think you can keep the votes safe?” asked Pamela Smith, president of election watchdog Verified Voting.

For a politically inclined hacker, insecure voter data could “very easily” create a pathway to “massive” voter fraud, said Joseph Kiniry, CEO of Free & Fair, which advocates for secure digital election systems.

“If you can go in there and delete rows based on someone’s name or political affiliation, we will have a massively screwed up election process on the day,” he said.

The Russian hack of the DNC was small beans compared to the destruction of the integrity of a national election result. This scary thought raises an OPM-hack-inspired question: Who in the U.S. government is responsible for this problem? Election fraud is typically the responsibility of election officials working with law enforcement officials. But when election fraud with national consequences is potentially threatened by foreign adversaries, it should become the responsibility of (at a minimum) national intelligence officials. But are they on this problem? Does the United States government have a well-worked out plan to ensure that our highly computerized and highly decentralized system for electing the President is protected from foreign disruption via cyber-exploitation or cyber-attack? I have no idea—but I seriously doubt it.