4 ms·

actually, they do all have gsuite! at least when i worked for them in 2016.

TheCoelacanth 8y ago
Probably not the using the Advanced Protection Program, though. It would have made the accounts much harder to break into since you need a physical key to log in to the account.
idlewords 8y ago
What we're trying to protect here is people's personal accounts. So even campaigns that use GSuite have people's personal stuff just on random Gmail (or Yahoo, or AOL...)
- daveFNbuck 8y ago
  They're trying to protect work-related communications. These can be separated from personal accounts.
  - tptacek 8y ago
    I've been working on sensitive projects with trained professionals for 2 decades and have watched how hard it is for people to keep personal computing resources and professional ones separate. The idea that campaign staffers would be required to maintain a level of OPSEC that IT security people can't reliably maintain seems unrealistic and unproductive. I think people have a broken idea of what a congressional campaign actually is. It's not an enterprise with a security team. It's a bunch of random people working together for a year or so, and only for a few months full time, at that. That's what makes them targets. Whatever our industry does to protect campaigns needs to engage with the reality of what a campaign is, rather than pretending they're all credit scoring firms that should have known better than to not spend all of their $13,000,000 security budget this year.
    - daveFNbuck 8y ago
      Shouldn't the fact that they're a bunch of random people make it easier to separate work from personal communications?
      - kiallmacinnes 8y ago
        Not at all, a bunch of random people really means "ad hoc - just use what works". That means no IT support to get that 2FA protected (if you even have it) email account onto your phone. Guess what email they will start using?
      - camgunz 8y ago
        That would be one way to do it, but it's a lot more effort than "everyone just uses their own email, we never set anything up", which is the default and also free -- and default/zero effort/free is extremely popular. Even if there is an IT setup on a campaign it's not guaranteed everyone will be onboarded onto it. People come and go, balls get dropped, etc. There are other bonuses to this too. The first that comes to mind are that campaigns are transient; using your own email can help you with document retention requests in the event of lawsuits. But I think mostly that political professionals use their email for a lot of different things, and keeping everything in a single account is a lot more convenient than dealing with multiple campaign accounts.
    - mushufasa 8y ago
      this is exactly it. work related emails already are on gsuite. yeah they could require 2FA and other stuff, but the more friction, the more people will fall back on personal emails. Campaign workers have like 2 days of training total. it is what it is. Even at high levels of staff, many are on sabbatical from their main careers. Though, if there was a moment for behavior change, this would be it. Really, it might be easiest to get campaign staff on some secure messaging app instead of email, cause trying to explain different levels of email security will simply go over laypersons heads. My region of staffers all used GroupMe -- I wouldn't be surprised if the DNC doubles down on Slack or something similar.
  - idlewords 8y ago
    No, it's the stuff in the personal accounts that's a more interesting target. You're trying to dredge up stuff on J. Random Candidate (or their manager, or staffer) that will distract and derail the campaign. Pictures of someone doing a bong rip in college, details of interpersonal drama, that kind of thing. The Podesta emails show how much more mileage attackers got out of drama than substance.
  - jessaustin 8y ago
    Where have we heard this before?

Probably not the using the Advanced Protection Program, though. It would have made the accounts much harder to break into since you need a physical key to log in to the account.

idlewords 8y ago

What we're trying to protect here is people's personal accounts. So even campaigns that use GSuite have people's personal stuff just on random Gmail (or Yahoo, or AOL...)

daveFNbuck 8y ago
They're trying to protect work-related communications. These can be separated from personal accounts.
- tptacek 8y ago
  I've been working on sensitive projects with trained professionals for 2 decades and have watched how hard it is for people to keep personal computing resources and professional ones separate. The idea that campaign staffers would be required to maintain a level of OPSEC that IT security people can't reliably maintain seems unrealistic and unproductive. I think people have a broken idea of what a congressional campaign actually is. It's not an enterprise with a security team. It's a bunch of random people working together for a year or so, and only for a few months full time, at that. That's what makes them targets. Whatever our industry does to protect campaigns needs to engage with the reality of what a campaign is, rather than pretending they're all credit scoring firms that should have known better than to not spend all of their $13,000,000 security budget this year.
  - daveFNbuck 8y ago
    Shouldn't the fact that they're a bunch of random people make it easier to separate work from personal communications?
    - kiallmacinnes 8y ago
      Not at all, a bunch of random people really means "ad hoc - just use what works". That means no IT support to get that 2FA protected (if you even have it) email account onto your phone. Guess what email they will start using?
    - camgunz 8y ago
      That would be one way to do it, but it's a lot more effort than "everyone just uses their own email, we never set anything up", which is the default and also free -- and default/zero effort/free is extremely popular. Even if there is an IT setup on a campaign it's not guaranteed everyone will be onboarded onto it. People come and go, balls get dropped, etc. There are other bonuses to this too. The first that comes to mind are that campaigns are transient; using your own email can help you with document retention requests in the event of lawsuits. But I think mostly that political professionals use their email for a lot of different things, and keeping everything in a single account is a lot more convenient than dealing with multiple campaign accounts.
  - mushufasa 8y ago
    this is exactly it. work related emails already are on gsuite. yeah they could require 2FA and other stuff, but the more friction, the more people will fall back on personal emails. Campaign workers have like 2 days of training total. it is what it is. Even at high levels of staff, many are on sabbatical from their main careers. Though, if there was a moment for behavior change, this would be it. Really, it might be easiest to get campaign staff on some secure messaging app instead of email, cause trying to explain different levels of email security will simply go over laypersons heads. My region of staffers all used GroupMe -- I wouldn't be surprised if the DNC doubles down on Slack or something similar.
- idlewords 8y ago
  No, it's the stuff in the personal accounts that's a more interesting target. You're trying to dredge up stuff on J. Random Candidate (or their manager, or staffer) that will distract and derail the campaign. Pictures of someone doing a bong rip in college, details of interpersonal drama, that kind of thing. The Podesta emails show how much more mileage attackers got out of drama than substance.
- jessaustin 8y ago
  Where have we heard this before?