Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

5/23/2019
04:15 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

FEC Gives Green Light for Free Cybersecurity Help in Federal Elections

Official opinion issued by the Federal Election Commission to nonprofit Defending Digital Campaigns is good news for free and reduced-cost security offerings to political candidates and committees.

The Federal Election Commission (FEC) has approved a request by nonprofit Defending Digital Campaigns (DDC) to offer federal candidates and national political party committees free and discounted cybersecurity services as a way to beef up US election security.

In an opinion letter issued on May 21 to DDC, the FEC said it reached its conclusion "under the unusual and exigent circumstances presented by your request and in light of the demonstrated, currently enhanced threat of foreign cyberattacks against party and candidate committees, the Commission approves DDC’s proposed activity."

DDC — a nonpartisan nonprofit founded by Matt Rhoades, former campaign manager for Mitt Romney, and Robby Mook, former Hillary Clinton Campaign manager — last year published the free "Cybersecurity Campaign Playbook" for campaigns to better secure their data and online accounts. The organization had officially requested FEC approval last fall to ensure its plans to offer free and discounted services to political committees and campaigns complied with federal campaign finance rules.

Meanwhile, several major cybersecurity vendors and service providers, such as Google, Microsoft, CloudFlare, Akamai, and McAfee, began offering free website and user-account protection services, among others, to election municipalities and candidates since the runup to the 2018 elections, and in the wake of the Russian hacking of the Democratic National Committee, Democratic Congressional Campaign Committee, and former Hillary Clinton campaign manager John Podesta's email account during the 2016 presidential election.

State and local election jurisdictions and campaigns are notoriously cash- and resource-strapped when it comes to technology, and especially security, so the freebie offerings were embraced by security experts as well as the election jurisdictions that opted for the services.

The FEC opinion issued this week specifically addresses the DDC's request, but it should also provide guidance for existing cybersecurity offerings for the elections that fit the criteria specified by the agency. One stipulation, for example, is that the services cannot "defray expenses that committees would have incurred regardless of cybersecurity efforts, such as expenses for computers; only the securing of such computers against digital intrusion is within the scope of this opinion," the FEC wrote in its opinion.

But if another vendor doesn't follow the same criteria, its services may not be considered FEC-approved. "Therefore, if another person's proposed activity were to differ in any materially distinguishable manner from the activity described in the opinion, they may wish to consider requesting their own advisory opinion from the Commission in order to receive formal legal guidance," an FEC spokesman told Dark Reading.

DDC as an Intermediary
The DDC specifically plans to offer free or reduced-cost cybersecurity-related software and hardware and services, as well as information-sharing systems; a cybersecurity hotline; cybersecurity bootcamps, training, and certification courses; on-site training; and incident response and monitoring services via partnerships with suppliers. DDC will act as an intermediary to negotiate software licenses and service contracts from security vendors and providers, and to ensure proper installation and use of tools.

All registered national political party committees and federal candidate committees are eligible — including the DNC — for cybersecurity help via DDC, as is a House candidate committee with a minimum of $50,000 in receipts for the current election cycle; a Senate candidate committee with a minimum of  $100,000 in receipts for the current election cycle; and a presidential candidate's committee if he or she is polling above 5% in national polls.

Related Content:

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Manchester United Suffers Cyberattack
Dark Reading Staff 11/23/2020
As 'Anywhere Work' Evolves, Security Will Be Key Challenge
Robert Lemos, Contributing Writer,  11/23/2020
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27660
PUBLISHED: 2020-11-30
SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL commands via the domain parameter.
CVE-2020-27659
PUBLISHED: 2020-11-30
Multiple cross-site scripting (XSS) vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2) profile parameter.
CVE-2020-29127
PUBLISHED: 2020-11-30
An issue was discovered on Fujitsu Eternus Storage DX200 S4 devices through 2020-11-25. After logging into the portal as a root user (using any web browser), the portal can be accessed with root privileges when the URI cgi-bin/csp?cspid=&csppage=cgi_PgOverview&csplang=en is visit...
CVE-2020-25624
PUBLISHED: 2020-11-30
hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.
CVE-2020-29378
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. It is possible to elevate the privilege of a CLI user (to full administrative access) by using the password [email protected]#y$z%x6x7q8c9z) for the e...