Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

5/23/2019
04:15 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

FEC Gives Green Light for Free Cybersecurity Help in Federal Elections

Official opinion issued by the Federal Election Commission to nonprofit Defending Digital Campaigns is good news for free and reduced-cost security offerings to political candidates and committees.

The Federal Election Commission (FEC) has approved a request by nonprofit Defending Digital Campaigns (DDC) to offer federal candidates and national political party committees free and discounted cybersecurity services as a way to beef up US election security.

In an opinion letter issued on May 21 to DDC, the FEC said it reached its conclusion "under the unusual and exigent circumstances presented by your request and in light of the demonstrated, currently enhanced threat of foreign cyberattacks against party and candidate committees, the Commission approves DDC’s proposed activity."

DDC — a nonpartisan nonprofit founded by Matt Rhoades, former campaign manager for Mitt Romney, and Robby Mook, former Hillary Clinton Campaign manager — last year published the free "Cybersecurity Campaign Playbook" for campaigns to better secure their data and online accounts. The organization had officially requested FEC approval last fall to ensure its plans to offer free and discounted services to political committees and campaigns complied with federal campaign finance rules.

Meanwhile, several major cybersecurity vendors and service providers, such as Google, Microsoft, CloudFlare, Akamai, and McAfee, began offering free website and user-account protection services, among others, to election municipalities and candidates since the runup to the 2018 elections, and in the wake of the Russian hacking of the Democratic National Committee, Democratic Congressional Campaign Committee, and former Hillary Clinton campaign manager John Podesta's email account during the 2016 presidential election.

State and local election jurisdictions and campaigns are notoriously cash- and resource-strapped when it comes to technology, and especially security, so the freebie offerings were embraced by security experts as well as the election jurisdictions that opted for the services.

The FEC opinion issued this week specifically addresses the DDC's request, but it should also provide guidance for existing cybersecurity offerings for the elections that fit the criteria specified by the agency. One stipulation, for example, is that the services cannot "defray expenses that committees would have incurred regardless of cybersecurity efforts, such as expenses for computers; only the securing of such computers against digital intrusion is within the scope of this opinion," the FEC wrote in its opinion.

But if another vendor doesn't follow the same criteria, its services may not be considered FEC-approved. "Therefore, if another person's proposed activity were to differ in any materially distinguishable manner from the activity described in the opinion, they may wish to consider requesting their own advisory opinion from the Commission in order to receive formal legal guidance," an FEC spokesman told Dark Reading.

DDC as an Intermediary
The DDC specifically plans to offer free or reduced-cost cybersecurity-related software and hardware and services, as well as information-sharing systems; a cybersecurity hotline; cybersecurity bootcamps, training, and certification courses; on-site training; and incident response and monitoring services via partnerships with suppliers. DDC will act as an intermediary to negotiate software licenses and service contracts from security vendors and providers, and to ensure proper installation and use of tools.

All registered national political party committees and federal candidate committees are eligible — including the DNC — for cybersecurity help via DDC, as is a House candidate committee with a minimum of $50,000 in receipts for the current election cycle; a Senate candidate committee with a minimum of  $100,000 in receipts for the current election cycle; and a presidential candidate's committee if he or she is polling above 5% in national polls.

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
Can Your Patching Strategy Keep Up with the Demands of Open Source?
Tim Mackey, Principal Security Strategist, CyRC, at Synopsys,  6/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12881
PUBLISHED: 2019-06-18
i915_gem_userptr_get_pages in drivers/gpu/drm/i915/i915_gem_userptr.c in the Linux kernel 4.15.0 on Ubuntu 18.04.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) or possibly have unspecified other impact via crafted ioctl calls to /dev/dri/card0.
CVE-2019-3953
PUBLISHED: 2019-06-18
Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 10012 RPC call.
CVE-2019-12133
PUBLISHED: 2019-06-18
Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services associated with said products try to execute binaries such as sc.exe from the current directory upon system ...
CVE-2019-12592
PUBLISHED: 2019-06-18
A universal Cross-site scripting (UXSS) vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers to run arbitrary web script or HTML in the context of any loaded 3rd-party IFrame.
CVE-2017-8328
PUBLISHED: 2019-06-18
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of changing the administrative password for the web management interface. It seems that the device does not implement any cross site request forgery prot...