Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

5/23/2019
04:15 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

FEC Gives Green Light for Free Cybersecurity Help in Federal Elections

Official opinion issued by the Federal Election Commission to nonprofit Defending Digital Campaigns is good news for free and reduced-cost security offerings to political candidates and committees.

The Federal Election Commission (FEC) has approved a request by nonprofit Defending Digital Campaigns (DDC) to offer federal candidates and national political party committees free and discounted cybersecurity services as a way to beef up US election security.

In an opinion letter issued on May 21 to DDC, the FEC said it reached its conclusion "under the unusual and exigent circumstances presented by your request and in light of the demonstrated, currently enhanced threat of foreign cyberattacks against party and candidate committees, the Commission approves DDC’s proposed activity."

DDC — a nonpartisan nonprofit founded by Matt Rhoades, former campaign manager for Mitt Romney, and Robby Mook, former Hillary Clinton Campaign manager — last year published the free "Cybersecurity Campaign Playbook" for campaigns to better secure their data and online accounts. The organization had officially requested FEC approval last fall to ensure its plans to offer free and discounted services to political committees and campaigns complied with federal campaign finance rules.

Meanwhile, several major cybersecurity vendors and service providers, such as Google, Microsoft, CloudFlare, Akamai, and McAfee, began offering free website and user-account protection services, among others, to election municipalities and candidates since the runup to the 2018 elections, and in the wake of the Russian hacking of the Democratic National Committee, Democratic Congressional Campaign Committee, and former Hillary Clinton campaign manager John Podesta's email account during the 2016 presidential election.

State and local election jurisdictions and campaigns are notoriously cash- and resource-strapped when it comes to technology, and especially security, so the freebie offerings were embraced by security experts as well as the election jurisdictions that opted for the services.

The FEC opinion issued this week specifically addresses the DDC's request, but it should also provide guidance for existing cybersecurity offerings for the elections that fit the criteria specified by the agency. One stipulation, for example, is that the services cannot "defray expenses that committees would have incurred regardless of cybersecurity efforts, such as expenses for computers; only the securing of such computers against digital intrusion is within the scope of this opinion," the FEC wrote in its opinion.

But if another vendor doesn't follow the same criteria, its services may not be considered FEC-approved. "Therefore, if another person's proposed activity were to differ in any materially distinguishable manner from the activity described in the opinion, they may wish to consider requesting their own advisory opinion from the Commission in order to receive formal legal guidance," an FEC spokesman told Dark Reading.

DDC as an Intermediary
The DDC specifically plans to offer free or reduced-cost cybersecurity-related software and hardware and services, as well as information-sharing systems; a cybersecurity hotline; cybersecurity bootcamps, training, and certification courses; on-site training; and incident response and monitoring services via partnerships with suppliers. DDC will act as an intermediary to negotiate software licenses and service contracts from security vendors and providers, and to ensure proper installation and use of tools.

All registered national political party committees and federal candidate committees are eligible — including the DNC — for cybersecurity help via DDC, as is a House candidate committee with a minimum of $50,000 in receipts for the current election cycle; a Senate candidate committee with a minimum of  $100,000 in receipts for the current election cycle; and a presidential candidate's committee if he or she is polling above 5% in national polls.

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Can Your Patching Strategy Keep Up with the Demands of Open Source?
Tim Mackey, Principal Security Strategist, CyRC, at Synopsys,  6/18/2019
Florida Town Pays $600K to Ransomware Operators
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12928
PUBLISHED: 2019-06-24
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server.
CVE-2019-12929
PUBLISHED: 2019-06-24
The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server.
CVE-2019-12936
PUBLISHED: 2019-06-23
BlueStacks App Player 2, 3, and 4 before 4.90 allows DNS Rebinding for attacks on exposed IPC functions.
CVE-2019-12937
PUBLISHED: 2019-06-23
apps/gsudo.c in gsudo in ToaruOS through 1.10.9 has a buffer overflow allowing local privilege escalation to the root user via the DISPLAY environment variable.
CVE-2019-12935
PUBLISHED: 2019-06-23
Shopware before 5.5.8 has XSS via the Query String to the backend/Login or backend/Login/load/ URI.