recommended reading

Odds of hacker 'shenanigans' during the presidential primaries are high

Expect hackers to try to disgrace presidential candidates with electronic extortion and other forms of digital deception during the upcoming primaries, say some former hackers and computer security specialists.

The surge in social networking has coincided with the rise of social engineering, or tricking a computer user into revealing personal data -- perhaps the answer to a password recovery question -- by posing as a trusted acquaintance. Hacker collectives Anonymous and LulzSec, and presumably China, have exploited this tactic, and other online gambits, to filch law enforcement authorities' personal data, and to gain access to the Gmail accounts of senior federal officials and military email addresses.

Now, perpetrators with a variety of motives are likely to apply the technique for infiltrating campaign email accounts, publishing falsehoods that go viral or knocking out candidate websites with denial-of-service attacks that inundate them with useless traffic, say cybersecurity experts.

"There's a pretty high probability of shenanigans," said Jennifer Emick, a security consultant who shed her affiliation with Anonymous after growing concerned about stunts she said verge on criminal. "With all the social networking -- they call it open source intelligence -- you can impersonate people the targets know on Facebook and have access to photos or personal information."

Some individuals apparently have attempted to pay hackers to shutdown sites that cast shadows over their favored candidate.

According to a 2011 chat room log obtained by Nextgov, one Internet user nicknamed "M" entered the room - a meeting place for hackers -- and asked if a member named "Jester" was "helping out with Rick Santorum's problem." The Jester is a prominent hacker known for attacking pro-jihad sites. M, an apparent supporter of former Pennsylvania senator and current GOP presidential candidate Santorum, then explained that "Jester is generally targeting liberal sites so I thought he might be in on this."

A chat room member clarified for M that The Jester typically attacks extremist sites. M replied that "this is an extremist gay site" -- likely a reference to, a satirical, widely-visited site created by a gay columnist in retaliation against the conservative politician's arguably anti-homosexual views. After several in the room reiterated that M was looking in the wrong forum, the individual signed off.

Santorum's campaign staff did not respond to a request for comment.

Emick priced a job like taking out that site at $1,000 to $2,000, due to the risk and hour or two of work involved - enough for a hacker to pay rent for a couple of months, she said.

Other hackers have their own political leanings, as evidenced by a college student who in 2008 commandeered then vice presidential candidate Sarah Palin's personal Yahoo! mailbox reportedly to find content that could undermine her campaign. According to federal prosecutors, David C. Kernell reset Palin's account password by accurately guessing the answers to her security questions, read her messages and then posted screenshots of the emails online.

"We had Watergate 40 years ago, but maybe today the therapists' email would simply be hacked, or the computer where they stored all of their clients' records would be hacked into," said Jack Lerner, a technology law professor at the University of Southern California.

This election season, "I don't think it is beyond the realm of possibility that hackers could execute denial-of-service attacks to disrupt a campaign's online operations, or, say, break into campaign email accounts to spread disinformation or damaging information about the candidate or the candidate's opponent -- if that kind of thing hasn't happened already," he added.

A glance through the biographical information in publicly available social network profiles can provide clues to a person's password recovery answers, experts point out. "And yet people still do dumb things: they give honest answers to security questions," Emick said. Chris K. Ridder, a San Francisco-based attorney and former resident fellow at Stanford Law School's Center for Internet and Society, said, "People might want to think more about their password reset questions. You don't put the real name of your cat in there, if you're going to find that on Facebook."

Elsewhere in the world, oppressive governments might be manipulating the Web to influence voting outcomes, as was probably the case in Russia where alleged Kremlin-sponsored denial of service attacks interfered with independent news and election monitoring websites.

Unlike government agencies, some campaign groups do not have the resources or know-how to prepare for data breaches. "Training your people to resist social engineering is a really good investment," Ridder said. "All you need is one person who is convinced by whoever is requesting the personal information."

Once information is compromised, it can be difficult to identify intruders, let alone prosecute them. Only a handful of hacktivists have been arrested and some culprits are not afraid of going to jail, said a former federal official who asked to remain anonymous. For every one or two criminals the government is catching, there are probably dozens slipping through the cracks, he said.

"In any cat and mouse game you're going to be playing a little bit of catch-up," former Justice Department computer crime investigator Mark Rasch said. "You can't just throw technology at the problem. You can't just say we need more people . . . you have to think like a hacker."

Nathan J. Hochman, a former assistant attorney general for Justice's tax division, said, "the fact that someone can get punished six months later might not be a deterrent when they can disrupt an election." Hochman, now partner at law firm Bingham McCutchen LLP, suggested campaign organizers devise a plan for how they will notify supporters and volunteers if there is a data breach or a viral spread of disinformation.

Campaign officials for Republican presidential front-runners Mitt Romney, Newt Gingrich and Michele Bachmann, as well as President Obama, did not respond to inquiries. The deputy press secretary for Texas governor and presidential hopeful Rick Perry said, "We don't discuss our internal security procedures."

"If I was running for president, I would delete my Gmail account," Ridder said.

Threatwatch Alert

Thousands of cyber attacks occur each day

See the latest threats


Close [ x ] More from Nextgov

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.


When you download a report, your information may be shared with the underwriters of that document.