As the Democratic Party prepares for the 2018 midterm elections, it's moving to avoid the disastrous hacks it suffered in 2016. But it's not going to start encrypting its emails anytime soon.
That’s not to say that it’s not taking cybersecurity seriously. The party has hired Raffi Krikorian, who ran engineering at Uber’s lab for self-driving vehicles, as its new chief technology officer. Krikorian has quickly urged Democratic officials to start using Signal, widely regarded as the strongest app to replace traditional text messaging, and brags that DNC Chair Tom Perez installed the app on his own accord.
“I remember I kept on saying these things in enough meetings that one day Tom showed up in my office and was just like, 'Hey, I installed Signal on my phone!'” Krikorian told BuzzFeed News. “I thought, thank God.”
The DNC is also testing Wickr, an encrypted chat app that allows for an easy group chat, and the three primary Democratic election committees — the Democratic Congressional Campaign Committee, Democratic Senatorial Campaign Committee, and Democratic Governors Association, respectively devoted to electing Democrats to the House, Senate, and state governorships, have a subscription, Wickr says.
Emails, though, are a different story. Krikorian plans to make sure everyone in the organization knows about basic security measures, like implementing two-factor authentication, using only strong passwords, and testing staffers with fake phishing attacks. “I have a whole spreadsheet of stuff that we're looking at with regard to what to do around email in general,” Krikorian said. “If we can then encrypt emails, that's sort of icing on top of that. But we're still getting that water up a bit.”
It was unencrypted emails, of course, that were the most visible sign of the DNC hacks. According to a declassified joint report by the NSA, FBI, and CIA, the GRU, Russia’s military intelligence agency, began a campaign against Democrats in March 2016. That campaign “resulted in the compromise of the personal e-mail accounts of Democratic Party officials and political figures,” the report said. “By May, the GRU had exfiltrated large volumes of data from the DNC.”
On March 19 of that year, John Podesta, Hillary Clinton’s campaign manager, following an aide’s bad advice, fell for a spearphishing attack and gave a hacker his email password. Neither two-factor authentication nor password strength would have prevented that, and Podesta was aware at the time of what a phishing attack was. In October, WikiLeaks released the first of an eventual 58,700 of Podesta’s emails, which included significant correspondence with Clinton. The contents of those emails became fodder in a narrative that Clinton and her foundation were “corrupt,” echoed everywhere from conservative conspiracy sites to Russian state media to Donald Trump’s campaign.
Had Podesta’s emails been encrypted, the WikiLeaks trove would have looked like gibberish. But while easy to use encrypted chat apps have proliferated in recent years, encrypted email remains significantly more difficult.
The most widespread and trusted means of email encryption is called PGP, or Pretty Good Privacy, versions of which were first developed in 1991. But setting it up is difficult for the average user, and involves several steps, like using an email client that supports PGP and first exchanging cryptographic keys with the person you’re corresponding with.
“I don't think PGP is the most realistic option now or in the future. It even gives crypto geeks headaches,” Martin Shelton, a security researcher who teaches journalists digital security practices, told BuzzFeed News. “I think that the move to encrypted channels suggests they're already aware that the channel matters. But people don't like to put in extra effort.”
But even Wickr chat has its problems, said Erinn Atwater, a member of the University of Waterloo’s Cryptography, Security, and Privacy lab who’s authored papers on the difficulties of PGP adoption. Any group chat is only safe if you can trust all of its members, she said.
“If you have 20+ people in a group chat, who is responsible for monitoring the list of users in the chat?” Atwater asked. “Could a malicious hacker social engineer any one of the participants to get an invitation to the chat, and then just sit there, forgotten because nobody knows who they are?”
The discrepancy between difficult-to-use encrypted email and easy-to-use encrypted text messaging means the smart strategy means that an organization like the DNC may be best served by weaning itself from an overreliance on email for sensitive conversations, Shelton said.
“It's probably wise to assume an email breach will happen eventually, and keep more sensitive conversations elsewhere,” he said. “What's the saying? ‘Don't email anything you wouldn't want on the front page of the New York Times.’”
Additional reporting by Ruby Cramer
Correction: After this story was published, Wickr contacted BuzzFeed News to say that as of August 2017, all of its code is now open source. Previously, that was only true of its paid subscription service. This story has been updated to reflect that information.