APT28/APT29 & Iowa Primary Caucus

[gredinger]

Why does it seem that every couple years, Democrats drop the ball on technology pretty heavily?

Cozy Bear was an effective APT. Even a secure organization could be impacted by a similar attack. I'd give them a pass on this hack if it weren't for APT28 (Fancy Bear).

The thing is, we never knew the external damage. In 2016, a lot of accounts were compromised, but how much data was actually compromised?

For example, most candidates use software called "NGP VAN". This software contains a lot of private information that campaigns have access to; a lot of voter information. If credentials were compromised on these systems (two-factor authentication wasn't required at the time...), then this data was compromised. The effectiveness of this attack leads me to believe members of the DNC used the same credentials across multiple services...

Just imagine giving the opposition party every single one of your records you gathered for the past 8 years. That's effectively what would have happened in 2016, and there's not a single report saying that occurred during the attack.

It is still amazing to me that the *entire* attack was started by spearphishing. If these people actually checked what they clicked on the email, it wouldn't have occurred. Security awareness training should be mandatory for all DNC members.

----

Iowa Primary Caucus was another recent IT failure. The application failed hard. In the IT world, we do something called "postmortems"; i.e. we figure out what went wrong, how to prevent it from going wrong in the future, and learn from the mistakes.

https://landing.google.com/sre/sre-book/chapters/postmortem-culture/

The lack of transparency bothers me. Why can a private corporation release ( https://status.cloud.google.com/incident/cloud-networking/19009 ) more details on a technical failure than a private company designing software for the public and democracy?

if I were chair of the DNC, I'd demand a full postmortem, along with open sourcing the application for public review. We need more transparency in democracy, not less. Let's learn from our mistakes and remain blameless, not ignore past mistakes and cover them up.