What does it mean to hack the DNC?

The unauthorized access and subsequent exfiltration and release of thousands of emails from the Democratic National Committee and John Podesta, chairman of the Hillary Clinton Presidential Campaign, was one of the biggest stories of 2016. The coverage is all but guaranteed to persist well into 2017 now that President Obama has publicly retaliated against Russia, justified by US Intelligence Community consensus that the origins of the attack can be traced to the highest levels of the Kremlin.

The story has been so ubiquitous that the shorthand reference to “the DNC hack” has fallen into a dangerously generic space of wide rhetorical use without necessary specificity. The editorial decision, made by almost every news outlet covering the story, to frame the story generally as “Russia Hacking D.N.C.” and focusing on the intelligence community consensus that Russia tampered with the election has proven to be problematic.

Internal D.N.C. networks were hacked, but the important part of this story is the release of the content. This is information warfare.

Most people have no concept of what “hacking” (gaining surreptitious and unauthorized access to a network) actually entails; it has largely become a buzzword. A layperson reads that “Russia hacked the Democrats” and understands it to be a nefarious attack, without really understanding what it means. Framing the D.N.C. attack in those general terms rapidly erased the specificity of exactly what happened, ultimately to the detriment of the U.S. government and the American people. It greatly accelerated the narrative, and rhetorical leap, from “Russia hacked the D.N.C.” to “Russia hacked the election” to “Russia hacked our democracy.”

One New York Times headline even contained the phrase “Russia Hacked Election,” while another claimed that “Russian Cyberpower Invaded the U.S.” This sensationalizing is dangerous.

A similar mistake was made on December 31 2016 when the Washington Post ran a story with the headline: “Russian hackers penetrated U.S. electricity grid through a utility in Vermont, U.S. officials say.” As it turned out, the electricity grid was not hacked. One computer at a electricity facility was compromised and that computer wasn’t even attached to the grid. Many in the cybersecurity industry were further skeptical of the claim because the stated link to Russia was the use of a piece of malware used in other suspected Russian attacks. However, this specific piece of malware is commercially available online for any hacker to purchase and deploy. That is not sufficient evidence for attribution.

Claiming that “a piece of malware (tangentially related to suspected Russian cyber attacks) was found on a non-critical laptop at an electricity provider” is a very different narrative than “Russia hacked the U.S. electricity grid,” in much the same way that “private emails and attachments were exfiltrated and leaked from D.N.C. email servers and John Podesta’s Gmail account” is a very different narrative than “Russia hacked the election.”

A recent poll showed that 50% of Clinton voters believe “Russia tampered with vote tallies to help Donald Trump.” This is a claim no one in government has ever made, but it’s easy to see how voters would be under the impression that Russia did in fact literally alter vote totals. That belief undermines the legitimacy of the voting process in America, the outcome of the election, and thus our democracy. Worse still, a cynical read of the situation leads to the conclusion that such an outcome is considered advantageous by more than one faction, both internal and external, albeit for different reasons.

Donald Trump was elected President of the United States due to a number of factors. The release of the D.N.C./Podesta emails surely played a role. It is even possible it was the reason Trump won, and for many there is comfort in that thought. However, there are many more important and dangerous reasons Trump won the election, namely economic inequality, fear, a terrible Democratic campaign, and the fact that rural America has yet to recover from the 2007 recession (compounded by the refusal of politicians to even acknowledge that fact, as they make their broad speeches about successful U.S. economic recovery.) Those reasons are more deserving of widespread coverage, particularly because those are things we have control over and on which we can actually make progress. But Russia dominates the headlines.

Is Russia’s attempt to influence the U.S. election dangerous? Absolutely. Is it all that surprising? Not really. Propaganda and information warfare is not new. Nor is direct covert action with the aim of influencing an election. The United States itself is guilty of as much in many countries in the world. Everyone is vying for the best of all possible global outcomes to further their own goals. Every government has preferred candidates as it pertains to both their allies and enemies. Leaking private emails to damage an organization by their own words also isn’t entirely new. And while doing so on this stage and at this scale is unprecedented, it should not come as a complete shock. It is an effective tactic with a wide latitude for denial. This is the online world in which we now live.

Email has been a weak security link since it’s invention and implementation. Without its widespread use, there would be an exponential reduction in much of the world’s hacking and far fewer leaks. Email is unquestionably an attacker’s easiest, cheapest, and most reliable vector. According to Adam Shostack and Andrew Stewart, in a test of people’s ability to distinguish real email from phishing attempts, only 6% got all the answers right.

The difficulty of hacking emails compared to hacking an election, or a democracy, is of a different order of magnitude. Which is why it’s important to remember that Russia didn’t “hack the election,” but exfiltrated some emails and used them to carry out a propaganda campaign (with the aid of the global news media). It was one unprecedented element of a uniquely unprecedented presidential race.

An organized information campaign with the goal of disrupting and/or altering the outcome of a democratic election is an aggressive act that cannot go unanswered, but punishing Russia or pinning Donald Trump’s victory on the Kremlin isn’t going to fix America. Allowing the story to continue to dominate the news cycle in such sensationalist terms gets us nowhere.