Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

5/23/2019
04:15 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

FEC Gives Green Light for Free Cybersecurity Help in Federal Elections

Official opinion issued by the Federal Election Commission to nonprofit Defending Digital Campaigns is good news for free and reduced-cost security offerings to political candidates and committees.

The Federal Election Commission (FEC) has approved a request by nonprofit Defending Digital Campaigns (DDC) to offer federal candidates and national political party committees free and discounted cybersecurity services as a way to beef up US election security.

In an opinion letter issued on May 21 to DDC, the FEC said it reached its conclusion "under the unusual and exigent circumstances presented by your request and in light of the demonstrated, currently enhanced threat of foreign cyberattacks against party and candidate committees, the Commission approves DDC’s proposed activity."

DDC — a nonpartisan nonprofit founded by Matt Rhoades, former campaign manager for Mitt Romney, and Robby Mook, former Hillary Clinton Campaign manager — last year published the free "Cybersecurity Campaign Playbook" for campaigns to better secure their data and online accounts. The organization had officially requested FEC approval last fall to ensure its plans to offer free and discounted services to political committees and campaigns complied with federal campaign finance rules.

Meanwhile, several major cybersecurity vendors and service providers, such as Google, Microsoft, CloudFlare, Akamai, and McAfee, began offering free website and user-account protection services, among others, to election municipalities and candidates since the runup to the 2018 elections, and in the wake of the Russian hacking of the Democratic National Committee, Democratic Congressional Campaign Committee, and former Hillary Clinton campaign manager John Podesta's email account during the 2016 presidential election.

State and local election jurisdictions and campaigns are notoriously cash- and resource-strapped when it comes to technology, and especially security, so the freebie offerings were embraced by security experts as well as the election jurisdictions that opted for the services.

The FEC opinion issued this week specifically addresses the DDC's request, but it should also provide guidance for existing cybersecurity offerings for the elections that fit the criteria specified by the agency. One stipulation, for example, is that the services cannot "defray expenses that committees would have incurred regardless of cybersecurity efforts, such as expenses for computers; only the securing of such computers against digital intrusion is within the scope of this opinion," the FEC wrote in its opinion.

But if another vendor doesn't follow the same criteria, its services may not be considered FEC-approved. "Therefore, if another person's proposed activity were to differ in any materially distinguishable manner from the activity described in the opinion, they may wish to consider requesting their own advisory opinion from the Commission in order to receive formal legal guidance," an FEC spokesman told Dark Reading.

DDC as an Intermediary
The DDC specifically plans to offer free or reduced-cost cybersecurity-related software and hardware and services, as well as information-sharing systems; a cybersecurity hotline; cybersecurity bootcamps, training, and certification courses; on-site training; and incident response and monitoring services via partnerships with suppliers. DDC will act as an intermediary to negotiate software licenses and service contracts from security vendors and providers, and to ensure proper installation and use of tools.

All registered national political party committees and federal candidate committees are eligible — including the DNC — for cybersecurity help via DDC, as is a House candidate committee with a minimum of $50,000 in receipts for the current election cycle; a Senate candidate committee with a minimum of  $100,000 in receipts for the current election cycle; and a presidential candidate's committee if he or she is polling above 5% in national polls.

Related Content:

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18954
PUBLISHED: 2019-11-14
Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious at...
CVE-2019-3640
PUBLISHED: 2019-11-14
Unprotected Transport of Credentials in ePO extension in McAfee Data Loss Prevention 11.x prior to 11.4.0 allows remote attackers with access to the network to collect login details to the LDAP server via the ePO extension not using a secure connection when testing LDAP connectivity.
CVE-2019-3661
PUBLISHED: 2019-11-14
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attacker to execute database commands via carefully constructed time based payloads.
CVE-2019-3662
PUBLISHED: 2019-11-14
Path Traversal: '/absolute/pathname/here' vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attacker to gain unintended access to files on the system via carefully constructed HTTP requests.
CVE-2019-3663
PUBLISHED: 2019-11-14
Unprotected Storage of Credentials vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows local attacker to gain access to the root password via accessing sensitive files on the system.