WASHINGTON -- Cyberattacks are still posing a threat to the 2020 presidential contest. The Department of Homeland Security's cyber agency is looking to provide some help, and there are early signs that at least some of the Democratic campaigns are willing to work with it.
"If you are the Pentagon or the NSA, you have the most skilled adversaries in the world trying to get in. But you also have some of the most skilled people working defense," said Robby Mook, who ran Hillary Clinton's campaign in 2016. "Campaigns are facing similar adversaries, and they don't have similar resources and virtually no expertise."
Traditionally, cybersecurity has been a lower priority for candidates, especially at the early stages of a campaign. They need to raise money, hire staff, pay office rents, lobby for endorsements and travel repeatedly to early voting states.
Particularly during primary season, campaign managers face difficult spending decisions: Air a TV ad targeting a key voting demographic or invest in a more robust security system for computer networks?
"You shouldn't have to choose between getting your message out to voters and keeping the Chinese from reading your emails," said Mook, now a senior fellow with the Defending Digital Democracy Project at the Harvard Kennedy School's Belfer Center.
Mook has been helping develop a plan for a nonprofit to provide cybersecurity support and resources directly to campaigns.
Homeland Security has had about a dozen initial discussions with campaigns so far, officials said.
Its focus has been on establishing trust so the department can share intelligence about possible threats and receive information from the campaigns in return, said Matt Masterson, a senior department cybersecurity adviser. The department will also test a campaign's or party's networks for vulnerabilities to cyberattack.
"The challenge for a campaign is they really are a pop-up," Masterson said. "They have people coming in and coming out, and they have to manage access."
It's unclear how much campaigns are spending on cybersecurity. From January to March, 12 Democratic campaigns and Trump spent at least $960,000 total on technology-related items. But that also includes technology not related to security, such as database or website services.
Former congressman John Delaney, the first Democrat to declare his candidacy for president, said he viewed cybersecurity as a fixed expense.
"It's not supercomputers cracking through your firewalls," he said. "It's really tempting emails that people respond to and give away information."
The 2016 attacks were low-tech, with Russian agents sending hundreds of spearfishing emails to the personal and work emails of Clinton campaign staff members and volunteers, along with people working for the Democratic Congressional Campaign Committee and the Democratic National Committee.
After an employee clicked and gave up password information, the Russians gained access to the Democratic Congressional Campaign Committee's networks and eventually exploited that to gain entry to the Democratic National Committee.
Clinton's campaign chairman, John Podesta, fell for the same trick on his personal email account, which allowed Russians to steal thousands of messages about the inner workings of the campaign.
But it wasn't as if the Clinton campaign ignored cybersecurity. Mook said training was extensive on cyber threats, two-factor authentication was mandatory and multiple fake emails were sent to test staff members' ability to detect phishing attempts.
The relative ease with which Russian agents penetrated computers underscores the perilous situation facing campaigns. Clinton has been talking about this with Democratic presidential candidates.
"Unless we know how to protect our election from what happened before and what could happen again ... you could lose," Clinton said in an MSNBC interview. "I don't mean it to scare everybody. But I do want every candidate to understand this remains a threat."
California Sen. Kamala Harris' campaign said it also was preaching the basics of cybersecurity with staff, such as requiring two-factor authentication and using encrypted messaging.
"All staff is being trained on threats and ways to avoid being a target," Harris spokesman Ian Sams said.
Trump administration officials insist election security is a priority.
"We're all-in in protecting 2020," Chris Krebs, head of Homeland Security's cyber efforts, told lawmakers Tuesday at a House committee hearing. "I'd ask each of you: Do you know if your campaign is working with us?"
Information for this article was contributed by Chad Day, Zeke Miller, Juana Summers, Will Weissert, Meg Kinnard and Sara Burnett of The Associated Press.
A Section on 05/04/2019
Gloss