5 ms·

This is seriously uninformed article with bad assumptions and assertions. The first assertion author makes is that attacker is resource limited which is a poin

This is seriously uninformed article with bad assumptions and assertions. The first assertion author makes is that attacker is resource limited which is a pointless assertion for stack sponsored entities unless cost of attack is astronomical. The second point author makes is that US elections are highly decentralize for attacks such as hacking electronic systems, making effective attacks very expensive. Again this is completely wrong assumption for two reasons: (1) attacker doesn't need to hack all of US precincts. Thanks to thin win margins in elections, you just need to flip only few precincts that have been predicted as "middle". Typically these are just 1-5% of total so cost of attack is actually very low and could be targeted with precision for a desired result. (2) There are only few brands and systems of voting machines and other electronic systems are actually in use. Again, you don't have to hack all of them. Just hack one or two and they might be good enough to slip 1-5% margin you desire. The connection to Internet is irrelevant. There are well known methods to hide malware in firmware drivers that could have been planted by a state sponsored hacker who obtained job at one of these companies making these machines. These kind of malware would be impossible to detect without very extensive reverse engineering. Think about this for a minute: For a cost of less than a million dollar (i.e. compensation for single hacker) you can flip election of entire country. It makes a huge economic sense to any adversarial government. Overall, hacking political system has shown to have ROI of 10,000% or more and it should make a perfect economic sense to businesses and external governments. You can literally donate just $100K to political candidate and he would pass a law for you that makes your company 10s of millions for many many years. It never ends to surprise me that political donations by commercial entities and ultra-rich is not considered a crime in US. In most other countries they are known as "bribe". Even better, just flipping few of the precincts you can flip entire election in to your favor and you can do it all even legally by precision targeted social media. It's just amazing power to behold on one of the largest and most powerful country.

deft 8y ago
Good points. Your last paragraph really shows how easy it would be / is which makes me wonder why is the Russia story such a big deal? There very well could have been similar attacks pulled off in the past with no one noticing (or it being legal all together) Sidenote: politics only seems to have morality as a focus when it is in their favour.
- freeflight 8y ago
  > which makes me wonder why is the Russia story such a big deal? Because it allows the responsible people to shift all the blame to an external actor: "Sure, we might have used crappy and insecure voting machines, everybody with a clue warned us about for years, but that wouldn't have mattered if the Russians didn't hack them!"
- ameister14 8y ago
  >Your last paragraph really shows how easy it would be / is His last paragraph is the equivalent of 'I'll create a GUI interface using visual basic; see if I can track the killer's IP' it displays a complete lack of understanding or knowledge of campaign finance, how the electoral system works, and how it's manipulated.
dredmorbius 8y ago
Your counterargument misses the point made explicitly within the article: "They may have vast resources, and in particular they may have more resources than the defenders—but they're still limited. Why? They'll throw enough resources at the problem to solve it, i.e., to hack the election, and use anything left over for the next problem, e.g., hacking the Brexit II referendum… There's always another target." Too: there may be multiple parties attempting hacks. Getting your opponent to overextend (a war of attrition) is a time-honoured strategy.
- sytelus 8y ago
  Those are weak arguments. Author basically says hacker doesn't want to hack country A because then he will run out resources to hack country B. Seriously? As mentioned in comment, hacking election is very cheap. On back of the envelop, I think $1 million should buy you enough ads to precisely target handful of swing precincts that will give you just 1-2% of the boost needed to put you over the thin win margin. If US elections were won by say, 25% win margins then it would become more expensive because it would be hard to scale. But most elections have less than 5% win margins these days and there are very good predictions available on swing districts. If you have access to voter registration database, you can literally target your ad at individual household level. As shown by last 4 major elections, just even flipping less than ten thousand household can achieve victories.
  - textor 8y ago
    Equivocation of ad placement and hacking is a disingenious tactic, especially here.
    - deleted 8y ago
      [deleted]
  - ryanwaggoner 8y ago
    This makes it sound like the only people running targeted advertising would be the state-sponsored "hackers", but that isn't the case. Campaigns spend hundreds of millions of dollars on advertising, including digital, and one side still loses, and not always the side who spends less on advertising. If you think it's so easy to swing elections with a few hundred thousand dollars of ads, you should definitely go into political strategy and prove it. They'll rain money down on you.
rayiner 8y ago
> Overall, hacking political system has shown to have ROI of 10,000% or more and it should make a perfect economic sense to businesses and external governments. This trope amazes me. If this were true, you’d see a lot more campaign donations. Instead, you see a few billion out of an economy of trillions. There isn’t an investment opportunity like that just sitting around without investors jumping on board and bidding up the price. It’s not logically possible for this to be true, without making a bunch of other hand waving and dubious assumptions.
- odyssey7 8y ago
  I don't think hacking and donating should be conflated this way. What is the ROI for a dictator who decides to count their own votes?
- dalbasal 8y ago
  I agree that this is a trope. It a factoid defined/estimated/invented by athink tank or somesuch, published somewhere and then republished lots of times citing earlier publications. It's inevitaly made up, because no one (sane) publicly acknowledges that contracts won as a result of lobbying. But, I disagree with this: "An investment opportunity like that just sitting around without investors jumping on board and bidding up the price" Economists theorize using "perfect" markets like a stock or bond markets. Real life includes clunkier scenarios. An investment might be worth X to you and Y to me. It may be available to me and not to you, or worthless to you. I might be able to evaluate the value, while you can't. That doesn't mean that the roi of "investments" that aren't traded investment products will usually be in that 3%-30% range. If Apple decide to develop a new product, that is an "investment." The cost of that investment is not subject to those kinds of market forces, which ensure that high ROI investments don't exist. The ROI could be negative or it could be orders of magnitude above average. With something like "buying influence," there is no economic theory reason to expect any ROI in particular. It would be unexpected if the value of lobying was less than the cost, but otherwise it's a pretty open field.
psergeant 8y ago
I think as well this misses the point that an election target can be life or death. If the US elects a Putin-unfriendly government in the near future, one would expect some serious fire-and-brimstones reprisals from the Americans (and European allies) for previous election interference. I’d be amazed if those don’t focus on bringing about regime change in Russia, and it seems unlikely that can happen with the current leadership getting away unscathed. Whether or not this is a good thing is left as an exercise for the reader.
dantheman 8y ago
This is incorrect: You can literally donate just $100K to political candidate and he would pass a law for you that makes your company 10s of millions for many many years. It never ends to surprise me that political donations by commercial entities and ultra-rich is not considered a crime in US. In most other countries they are known as "bribe". Companies cannot give money directly to politicians and individuals are limited. https://www.opensecrets.org/overview/limits.php https://www.opensecrets.org/overview/limits.php Political Action Committees can accept money, but must be independent from a candidate.
- Retric 8y ago
  > must be (nominally) independent from a candidate. It sounds a lot more effective than it is. In practice it’s a non issue.
- michaelt 8y ago
  Companies cannot give money directly to politicians According to [1] Paul Ryan accepted $121,700 from Blackrock Inc, and [2] says Charles Schumer accepted $102,950 from Lockheed Martin. Sounds like companies giving money to politicians to me? [1] https://www.opensecrets.org/members-of-congress/summary/paul-ryan?cid=N00004357 https://www.opensecrets.org/members-of-congress/summary/paul... [2] https://www.opensecrets.org/members-of-congress/summary/charles-schumer?cid=N00001093 https://www.opensecrets.org/members-of-congress/summary/char...
  - maxerickson 8y ago
    They are aggregating the contributions of people associated with the company. Look at https://www.opensecrets.org/members-of-congress/contributors?cid=N00004357&cycle=2018 https://www.opensecrets.org/members-of-congress/contributors... These tables list the top donors to candidates in the 2017 - 2018 election cycle. The organizations themselves did not donate, rather the money came from the organizations' PACs, their individual members or employees or owners, and those individuals' immediate families. Organization totals include subsidiaries and affiliates.
- creaghpatr 8y ago

deft 8y ago

Good points. Your last paragraph really shows how easy it would be / is which makes me wonder why is the Russia story such a big deal? There very well could have been similar attacks pulled off in the past with no one noticing (or it being legal all together) Sidenote: politics only seems to have morality as a focus when it is in their favour.

freeflight 8y ago
> which makes me wonder why is the Russia story such a big deal? Because it allows the responsible people to shift all the blame to an external actor: "Sure, we might have used crappy and insecure voting machines, everybody with a clue warned us about for years, but that wouldn't have mattered if the Russians didn't hack them!"
ameister14 8y ago
>Your last paragraph really shows how easy it would be / is His last paragraph is the equivalent of 'I'll create a GUI interface using visual basic; see if I can track the killer's IP' it displays a complete lack of understanding or knowledge of campaign finance, how the electoral system works, and how it's manipulated.

dredmorbius 8y ago

Your counterargument misses the point made explicitly within the article: "They may have vast resources, and in particular they may have more resources than the defenders—but they're still limited. Why? They'll throw enough resources at the problem to solve it, i.e., to hack the election, and use anything left over for the next problem, e.g., hacking the Brexit II referendum… There's always another target." Too: there may be multiple parties attempting hacks. Getting your opponent to overextend (a war of attrition) is a time-honoured strategy.

sytelus 8y ago
Those are weak arguments. Author basically says hacker doesn't want to hack country A because then he will run out resources to hack country B. Seriously? As mentioned in comment, hacking election is very cheap. On back of the envelop, I think $1 million should buy you enough ads to precisely target handful of swing precincts that will give you just 1-2% of the boost needed to put you over the thin win margin. If US elections were won by say, 25% win margins then it would become more expensive because it would be hard to scale. But most elections have less than 5% win margins these days and there are very good predictions available on swing districts. If you have access to voter registration database, you can literally target your ad at individual household level. As shown by last 4 major elections, just even flipping less than ten thousand household can achieve victories.
- textor 8y ago
  Equivocation of ad placement and hacking is a disingenious tactic, especially here.
  - deleted 8y ago
    [deleted]
- ryanwaggoner 8y ago
  This makes it sound like the only people running targeted advertising would be the state-sponsored "hackers", but that isn't the case. Campaigns spend hundreds of millions of dollars on advertising, including digital, and one side still loses, and not always the side who spends less on advertising. If you think it's so easy to swing elections with a few hundred thousand dollars of ads, you should definitely go into political strategy and prove it. They'll rain money down on you.

rayiner 8y ago

> Overall, hacking political system has shown to have ROI of 10,000% or more and it should make a perfect economic sense to businesses and external governments. This trope amazes me. If this were true, you’d see a lot more campaign donations. Instead, you see a few billion out of an economy of trillions. There isn’t an investment opportunity like that just sitting around without investors jumping on board and bidding up the price. It’s not logically possible for this to be true, without making a bunch of other hand waving and dubious assumptions.

odyssey7 8y ago
I don't think hacking and donating should be conflated this way. What is the ROI for a dictator who decides to count their own votes?
dalbasal 8y ago
I agree that this is a trope. It a factoid defined/estimated/invented by athink tank or somesuch, published somewhere and then republished lots of times citing earlier publications. It's inevitaly made up, because no one (sane) publicly acknowledges that contracts won as a result of lobbying. But, I disagree with this: "An investment opportunity like that just sitting around without investors jumping on board and bidding up the price" Economists theorize using "perfect" markets like a stock or bond markets. Real life includes clunkier scenarios. An investment might be worth X to you and Y to me. It may be available to me and not to you, or worthless to you. I might be able to evaluate the value, while you can't. That doesn't mean that the roi of "investments" that aren't traded investment products will usually be in that 3%-30% range. If Apple decide to develop a new product, that is an "investment." The cost of that investment is not subject to those kinds of market forces, which ensure that high ROI investments don't exist. The ROI could be negative or it could be orders of magnitude above average. With something like "buying influence," there is no economic theory reason to expect any ROI in particular. It would be unexpected if the value of lobying was less than the cost, but otherwise it's a pretty open field.

psergeant 8y ago

I think as well this misses the point that an election target can be life or death. If the US elects a Putin-unfriendly government in the near future, one would expect some serious fire-and-brimstones reprisals from the Americans (and European allies) for previous election interference. I’d be amazed if those don’t focus on bringing about regime change in Russia, and it seems unlikely that can happen with the current leadership getting away unscathed. Whether or not this is a good thing is left as an exercise for the reader.

dantheman 8y ago

This is incorrect: You can literally donate just $100K to political candidate and he would pass a law for you that makes your company 10s of millions for many many years. It never ends to surprise me that political donations by commercial entities and ultra-rich is not considered a crime in US. In most other countries they are known as "bribe". Companies cannot give money directly to politicians and individuals are limited. https://www.opensecrets.org/overview/limits.php https://www.opensecrets.org/overview/limits.php Political Action Committees can accept money, but must be independent from a candidate.

Retric 8y ago
> must be (nominally) independent from a candidate. It sounds a lot more effective than it is. In practice it’s a non issue.
michaelt 8y ago
Companies cannot give money directly to politicians According to [1] Paul Ryan accepted $121,700 from Blackrock Inc, and [2] says Charles Schumer accepted $102,950 from Lockheed Martin. Sounds like companies giving money to politicians to me? [1] https://www.opensecrets.org/members-of-congress/summary/paul-ryan?cid=N00004357 https://www.opensecrets.org/members-of-congress/summary/paul... [2] https://www.opensecrets.org/members-of-congress/summary/charles-schumer?cid=N00001093 https://www.opensecrets.org/members-of-congress/summary/char...
- maxerickson 8y ago
  They are aggregating the contributions of people associated with the company. Look at https://www.opensecrets.org/members-of-congress/contributors?cid=N00004357&cycle=2018 https://www.opensecrets.org/members-of-congress/contributors... These tables list the top donors to candidates in the 2017 - 2018 election cycle. The organizations themselves did not donate, rather the money came from the organizations' PACs, their individual members or employees or owners, and those individuals' immediate families. Organization totals include subsidiaries and affiliates.
creaghpatr 8y ago