Hi, so my name is Robby Mook. I ran Hillary Clinton's campaign in the last election cycle up through last year, but actually before that was working on campaigns basically straight for about 15 years, ran a governor's race, a Senate race, local legislative race, and then worked at the Democratic Congressional Campaign Committee, which oversees all the House races for four years.
So I'm a campaign guy. I've recently made a slight pivot, and I'm at the Harvard Kennedy School at the Belfer Center doing a senior fellowship there with a Republican colleague of mine, actually Mitt Romney's former campaign manager, and we're working on cybersecurity on a bipartisan basis to help get our campaigns and elections more secure. That's what we're doing.
All right, so that's Robby's intro. I'm going to get a sense for everybody here now, too.
Raise your hand if you are, again, enterprise security, chief security officer, security engineer, someone who builds strong things. Okay.
What about if you're like a policy person, someone who does legal stuff, policy? And what if you just break stuff? You just break stuff.
Is it working now? Okay.
Ah, there we go.
There we go. Yeah, yeah.
Okay, yeah, so my background is for the last 20-ish years. I've worked with people.
I see...
In the audience, building companies that break stuff, essentially, and helping people understand how to build things that can't be broken.
And then I came over to Wicker because I thought it'd be fun to try and build a product that was impervious to that breaking.
So I kind of come from the audience standpoint a little bit more, and when I took the job at Wicker, I got pulled into sort of post-election, how do we fix this stuff?
How do we deal with these comms? How do we make them stronger?
Yeah.
And one of the first people I was introduced to was Robbie.
And one of the first things I figured out is that we didn't speak a common language a lot of times.
I didn't know what a committee was.
He did.
Or I thought I knew what a committee was, but I didn't.
And so we spent a lot of time trying to figure out how to go out and help people.
But the first thing we did is we tried to find common language around these issues.
So that's probably the best embodiment of the goal for this talk.
So one of the first things that I didn't understand...
One of the first things that I looked to Robbie to understand is how was it that there were these persistent security issues in 2016 that people knew about, but they just weren't mitigated?
Why did it take so long to really understand them and deal with them?
Yeah, well, the interesting thing about this is the first presidential campaign I worked on was John Kerry's campaign in 2004.
And that campaign was actually suffered a breach that got pushed out by the, I think it was the Chinese.
And then I know that both in the 2008 and 2012 campaigns, there were also incidences.
When we were beginning our campaign, and it's important to make a distinction, the campaign is different from the DNC.
But when we were beginning our campaign, what we were mostly anticipating was espionage.
So that people were going to try to break in to get information that would probably be very helpful.
If you're trying to plan for another administration coming in, it's nice to know.
Everything.
You know, the campaign was talking about and different policies that were being discussed and so on.
And probably some of the rationale behind some of, you know, what the candidate was thinking.
So that's what we were anticipating.
And the important thing to understand about that from a mindset perspective is if somebody goes in and gets something, but you're not imagining how they could sort of release it, then it's like, well, at the end of the day, you know, we can do so much.
We can spend so much money.
We can put so many resources into this.
But, you know, I guess.
The Chinese will be that much more intelligent about what could happen.
So, look, from our campaign standpoint, as far as we know, and that's like people here understand that caveat much better than me, we were never breached.
But my biggest lesson coming out of this, and I think a lesson everybody needs to take away and people in this room understand this perfectly well, is it's not just the data that you control.
It's the data about you or that other people control.
That can be weaponized against you.
So I think the so having said all that, I think the entire ecosystem of our elections, of our democracy, frankly, we're not I think, first of all, didn't really believe that what happened could actually happen.
You know, there was a lot of resistance early on when we were educated on what probably took place.
There was a lot of resistance, this idea that it was actually the Russians, that it was actually done.
And so I think it's really important to think about that as a retaliatory measure against things that Hillary had done and said, as Secretary of State.
So that was one issue.
But then again, I think because it had never happened before, look, I think law enforcement could have done a lot more to be a lot more proactive with the DNC.
I mean, the fact that they were only calling a help desk for like a year and that they were only doing that intermittently, I think that's a problem.
I think the DNC obviously internally could have done a lot more to shoot this up to the top and do something about it.
And then I think there's a series of questions that are really tough around the news media and social media and what ethical obligations they have.
And we can talk more about like France and other places where I think we saw some different strategies work.
You know, what role they have in mitigating the ability of another country to influence our election.
The last piece that I'd touch on, which is really complicated, I don't think we're going to figure this out for a long time, is in France.
Again, as a good example of this, what is the government, does the government have a role?
And then what is that role to work proactively with campaign organizations to make them more resilient to these sorts of attacks?
That just didn't exist.
So that was going to be my other question is law enforcement seemed not speedy to come to the rescue.
And yet we had these past elections.
I mean, I think probably a lot of people in this room had some knowledge of what was happening with in the geopolitical sphere, if you will, in previous elections.
So was there something around the political climate that constituted that a call to the help desk was an appropriate reaction?
Or what do you think really led to that?
I don't know.
I don't know if it was politically motivated.
You know, James Comey said in retrospect, he would have walked over to the DNC.
That would have been nice.
But again, I don't like to get into too much finger pointing on all this because I think we are where we are.
And every time.
Everybody, everybody in this entire situation could have done a lot of things differently.
So my focus right now is on, OK, what should they do differently?
And, you know, this is a perfect example.
I think there is no absolutely no reason.
This is one of the things we're working on that law enforcement and the and the party and campaign infrastructures can't have systems in place to have those conversations.
And they should.
Yeah.
So in Robbie and I first met in February, something like that after the elections.
And again, it was it was precipitated by people trying to get me.
I was involved in helping.
And then we submitted a paper to talk at this conference.
And one of the things we said is information security is now the number one priority of all elections domestically and internationally.
Pen test that statement.
Yeah.
Stress test that statement.
Do you still think that's that's a valid statement?
Yeah, I think.
And again, this is what we're trying to work on.
I think if you pulled aside any campaign manager now and said.
Obviously, do you want to get hacked?
They'd say no.
Do you think it's a big problem if you get hacked?
I think most of them would say yes.
And then I think if you ask them, have you done everything you can, they'd sort of say no, but I don't really know.
And so there are two issues here.
I think one is campaigns often underestimate the value of the information they have.
I'm still hearing this today where a campaign will say, well, we don't have anything that's that great.
And you say, well, how would you feel if that poll you did got out?
How would you feel if the research about your campaign?
Candidate was pushed out publicly and then they say, well, yeah, but that's really hard to find.
So I think we need to do more culturally to get people to understand if that information exists anywhere, it's vulnerable.
And then secondly, we need to do a much better job getting all the resources that exist, like in this room, for example, but certainly in this building today.
Plugged into the campaign space on both sides of the aisle because we we know everything we need to do.
I would argue to to protect certainly these midterm campaigns because they're pretty they're in the scheme of the world.
They're pretty simple organizations.
You know, they're anywhere from like 10 to 200 people by and large.
Presidential campaigns are bigger and the more complex and the committees, you know, the the campaign committees or the the DNC or the RNC.
Those are more complex. But I would even argue there we have all the tools and resources.
We're just not we're not getting connected.
So we've got to deal with the cultural piece and then we've got to figure out how to apply the brainpower that exists and the strategic know how and get people up to speed.
So firsthand, I'm seeing committees and and different campaigns come to us and say, hey, we want to use a different kind of tool for communication.
And so that's a I don't know if that's a United States thing, but it's apply a product to a problem.
Yeah. Talk about France a little bit, because I think there was a little bit of a different approach there.
Yeah. Well, and I'd say during and we talked about this during the campaign, our problem was we didn't know if the Russians.
So, again, we were the campaign. We knew the DNC had been breached as a campaign.
We we had to assume we were breached, too, until we could get a team in there to to to test that.
And so the question came up, how do we communicate?
How do we share documents? How do we do phone calls and how do we message each other?
And that's where, you know, the encryption piece became key.
So I think between Wicker and a lot of there's other solutions out there, I think that's going to be a lot better next time.
You know, that people won't face. It's almost like a comedy.
Sometimes we were trying to figure out, like, do we print this? Do we you know, what do we do?
But in France, I think a few things went much better there.
First of all, you had a non-military, non-law enforcement government agency work very proactively with all political parties together to provide them with.
Strategies to better secure themselves. So first of all, just providing that base level security that they need.
But also, we know that the government worked very proactively with Macron in particular when they knew that information had been stolen to set up a bunch of honeypots, basically.
So that when it was pushed out, there'd be confusion about what was real and what wasn't.
We, in theory, have that with DHS and they're working very hard to get into that space.
But I think we have a long way to go in terms of having that kind of working relationship.
Look, the other piece in France was the media was blacked out for days when that came out.
And that's never going to happen here. That shouldn't happen in the United States.
I would never argue for that. But I think, like I said, I think there's an important ethical discussion to be had about, let's say that information is put out.
Every reporter I've ever worked with, and I understand where they're coming from, is going to say, well, if I don't report this, someone else will.
So if I'm running a news organization that's supposed to keep people informed, I need to report that.
So I also don't think the answer is the news media saying, well, don't, you know, we shouldn't mimic a blackout.
But I do think there's important contextual information.
And I think I think I'm certain most reporters now would say, well, if we had all the context around what was going on when these emails were put out, we, of course, would have provided that context.
So I think there's a real question about how do we take intelligence and and get that out there faster?
In in real time is too much to ask.
But how can we leverage resources outside the IC community to give reporters more confidence to give that context?
So that's just one of many things. But yeah, I mean, don't get me wrong.
I'm interested in products being used, but I love the misdirection piece.
I love the fact that law enforcement came together and said, here's it.
You know, we're going to learn from what happened in the US and we're going to figure out ways to make that information less disruptible.
Yeah, right. Because that that's a lesson that they learned.
Here's the funny thing, too. We actually discussed doing that when we we learned very shortly before it was announced that the DNC had been breached.
And I remember brainstorming this idea of like putting a honeypot in there so we could prove like if we saw where that popped up and we didn't do it because we were afraid nobody would believe us.
Now, I think everything would be different. But that's where if you had a government agency partnering with you with credibility, you can do those sorts of things.
OK, so some of my naivete around the political scene was I don't think I fully appreciated the difference between.
The DNC and the campaign itself. And so as Robbie talked about, you know, he ran the campaign.
And so I'm pivoting here. I'm making an assumption a lot of people in this room just from having come here for years.
You're working on security problems for larger organizations.
Something I didn't appreciate was that you were actually a CEO of a 5000 person startup that had to kind of grow overnight.
And so, I mean, I've been working with companies like that for a long time.
And I absolutely understand that it's difficult to build an organization that is growing that fast and changing that fast.
And then to put the appropriate, you know, priority on securing your systems.
That's kind of a heavy lift and not something I appreciated.
So in that context, you know, if Podesta's email is the, you know, the huge thing, the tremendous thing that changed everything.
You know, you told me that of the 5000 people you were overseeing.
You know, 4900 were only using their phones and messaging.
And yet it's this Gmail that had all the impact.
How, in retrospect, would you attack those two different populations?
The front line, I'm only going to use messaging.
Versus, you know, kind of what is the equivalent of like a board of directors or a C-suite that's using older antiquated technology.
Yeah. Well, I think the, I mean, look, this gets to this whole cultural issue.
And I didn't know.
I didn't know very much about cybersecurity at all.
And I certainly didn't have any training in how to lead an organization when, again, it wasn't, when there was a breach that affected us so deeply.
Right?
And, in fact, as an example of that, the DNC had some PII taken and put out.
Those were our donors that we, like, directed there basically.
So we had to kind of deal with this thing across the board.
And I don't know the answer to this.
The cultural piece is so key.
The staff are sensitive to understanding how their behavior could potentially lead to something that's catastrophic for the organization.
They'll do the right thing, by and large, as much as they can.
It's really hard to make that real until it happens.
So I noticed, we talked about this at the beginning of the campaign.
You know, we had, we required two-factor for the work accounts.
You know, we had endpoint protection on the devices and everything.
And we talked about it.
And we talked about not clicking on the links.
Because we were all getting phished pretty constantly.
But, you know, I can tell you the way people behaved and the way people heard and checked into those conversations after the DNC breach was totally different.
I think the other thing that really helped was, like, phishing our staff, you know, internally to prove to them that everybody had more work to do to be vigilant.
That, I found, was a really helpful conversation starter.
But, look, I think they were both, I guess they were similar in that people needed to understand, we have to start being sensitive that anything we write down could be out there.
And we have to be sensitive about what we save.
So another example is we auto-deleted emails after every three weeks.
Some people were archiving.
They changed their behavior after that happened.
And so, you know, hopefully, I think the sad reality of more briefings.
Is we'll have more reference points that hopefully make it more real.
So this gets to be a wickery thing.
So apologies in advance.
But one of the other things I learned around ephemeral communications.
And so, look, when I was out there, I was always thinking about attack surfaces and crown jewels and what's the thing that matters most to the company and how do you access it and how do you protect it.
And in political context, you say things like polling data or opposition research and people are like, oh, God, yeah, that has to go.
Right away.
And so, you know, it's interesting how the political campaign has these pieces of information that are very different than other things.
I mean, communications are one thing, but there are certain pieces that are not needing to be kept around.
Can you expand on other things or why that is?
Well, definitely.
I mean, I think for every organization nowadays, there's the liability of maintaining something and the liability of deleting something.
Obviously, some organizations have a legal obligation to preserve communications.
So there's a high liability for deleting that.
That's pretty simple.
I think for a campaign where we have very few retention requirements, the liability of keeping anything is enormous.
And in particular because campaigns exist to communicate a message to people.
That's all we do.
We communicate.
At the end of the day, tactically, we do a ton of things.
And a lot of times we sort of think about, well, they produce TV ads or they organize volunteers to knock on doors.
That's all about delivering a message.
And the killer about an information operation like what was perpetrated and the danger in any communication whatsoever getting stolen is that blocks your ability to communicate.
Even if it's just the media talking about the fact that you had a breach instead of your own candidate's ability to get out there and just drive what you want people to understand about them.
So that's why on it, like I've been arguing to campaigns now, just defaulting.
This is ephemeral.
Obviously there's exceptions when you have legal requirements.
But there's just very little reason to keep things.
And I even experienced situations, you know, where we had people breach retention policies who had to, you know, when I was doing congressional races, who had to spend time in depositions for hours and hours.
In fact, we talk about redistricting nowadays.
Republicans would try to take our e-mails and spin them into, you know, getting, defending people.
And they would end up getting their really terrible gerrymandered maps.
So I just think there's every incentive in the world not to keep that information.
Okay.
So.
If you don't have to.
There was some, about a decade ago, I thought some really thoughtful security people, when they were talking about red teaming exercises.
That was about, I think, when it became more and more popular to do red teaming.
And they would say what I really want to understand is how to deal with the PR aspect of this.
Because that's what matters.
You're going to try and fix the problems.
But it's how you control the message.
How would you have controlled the message differently in retrospect?
That's a great question.
I would have been more forceful about what was going on in terms of the Russians were deliberately doing this to hurt our candidate and help the other candidate.
I think it even seemed crazy to us.
You know what I mean?
And it certainly seemed crazy to a lot of other people.
And if you go back and read the early coverage, you know, it was dismissed as sort of spin.
And I wish we had done, I think we could have done more to formally bring reporters in with numerous experts to reinforce that this wasn't just something we were concocting.
This was a real, we were saying what we were being told by genuine experts.
And in fairness to our communications people, they did.
They brought, you know, experts around.
But I think we potentially could.
We really could have somehow raised the bar on that even more and brought in, you know, brought that into, in a more focused way.
Not to get off track, but like Donald Trump, this is actually, I think this is the thing that Democrats are kind of like sometimes least conscious about moving forward.
It is incredibly difficult to drive a message when Donald Trump is your opponent.
Period.
For starters.
It's really hard when you got all this other stuff churning around.
So.
You know, I think there's a lot of different tactical things we could have done to draw more attention to our message.
But I think back then and certainly moving forward, we've got to provide the context so that voters aren't just hearing the intriguing pieces.
They're understanding that it's part of a broader effort that will, that changes the way they hear the information.
Yeah.
I mean, I'm a political expert.
I have not become at all.
I'm not advocating that.
But I would imagine that people are thinking some strategic thoughts about how to deal with the information.
And the next election cycle and how you can use that to your advantage while also trying to protect communications.
So I think there's a lot of strategy there.
Yeah.
No.
Look, I mean, we have to completely.
Yeah.
Not to get off on a tinder, but we have to completely start from scratch and rethink about the way people receive information about what's going on and figure out ways to help drive and control to the extent we can the narrative of campaign.
I can't even.
This is like my big thing that I haven't had enough time to talk about.
I mean, look at the last few days.
It's so hard to drive anything when Donald Trump is around.
I mean, it's like it's like that reality show.
It's like you've got like the the PBS, like you've got like the Lawrence Welk show and he's got like Survivor.
You know what I mean?
And like you're trying to like it's really hard.
I'm going to switch gears here real quick, too.
I I'm going to assume for this room a relatively provocative question.
That's around policy.
And the law around encryption.
And there's an awful lot of discussion right now around.
I mean, our back doors mandatory.
And you have an opinion on that.
I think what's more important is do you see any distinction on the left or the right in terms of someone falling into a certain camp on that issue?
Yeah.
Well, I think I think the good news is people in the two parties are in different places.
You have Democrats who are definitely pro back door.
You have Republicans are pro back door.
And then you have people on both sides.
You're not.
I my answer to this would be I don't know enough to feel passionately.
And number one and number two, when I talk to experts, the idea of building a back door opens up vulnerabilities, potentially as many as it's trying to solve.
And there's also a legitimate argument that like that's just not possible.
You you you create what you created back door in this technology.
But this one doesn't have one.
So why aren't people just going to go there?
And so that leads me to think that it's it's it's hard to imagine how that scenario is realistic.
All that said, the reason I start by saying I don't know enough to feel especially passionate is that I think the political space, I think this world needs to help get elected officials.
And actually, practitioners like myself were interacting with some of those officials as candidates better educated on these issues so that there we have.
We can look at it from multiple angles.
I think people who want to protect lives and stop terrorists are entirely legitimate.
And I think Alex is Alex Stamos speech earlier this week really encapsulated this.
Well, I think everybody has really good intentions.
But I think sometimes the policy debate isn't as productive as it could be because you have a lot of people.
You have elected officials, many of whom just don't understand the basic technological, the basic technologies or mathematics that we're talking about here.
So I don't know if that's OK.
So I'm going to try and summarize a little bit.
No, it doesn't fall on party lines, which I think is no.
And that shouldn't. I mean, I was just going to weigh in.
I think that would be one of the worst things that can happen here.
I don't see that actually. I mean, we're getting drawn in that conversation quite a bit.
And I don't see that happening.
It would be very damaging if it did.
I would lump cybersecurity in there in general, too.
I think that I think this this argument we're conflating whether what Russia did is bad with whether Donald Trump did well in the election or anything else is that is horribly counterproductive and stupid.
Democrats and Republicans should be angry about what happened.
We know that in past elections, both campaigns were hacked and we we have to work on this together.
And actually, so the last thing I'll say on this, this is something I'm passionate about.
I think the political space can learn from the security space because you talk with these.
I was at the CISO summit at Black Hat.
They're competitors out front with their customers.
But behind the scenes, they're working together on security.
We've got to build that culture in the political space.
My goal and my hope is that within a year or two, you see Republican and Democratic folks working together on this issue.
Pretty seamlessly.
So my I'm going to layer on there.
It's not just political.
It's the whole goddamn country.
Everything is so stupid.
It's not just political.
It's not just military.
It's not just the my military, but it's the people.
And I deal with this sort of thing.
My job is to really and truly is to protect all of you.
All the people.
Not just a segment.
Right.
And you see what you're talking about is a little bit of this, a little bit of that.
No, no.
It's a whole damn picture.
Yeah, I would agree.
What I was going to say is this is typically a bit of an activist community.
Thank you.
And people who want to go out and pitch in and help.
And I'm going to tell you, it is, we're halfway there, I'm told.
And we're about to go to Q&A.
So if you guys want anything, I'm going to open it up.
I'm sorry.
No, it's not a problem.
It's not a problem.
What I was going to say is it's hard to understand D.C.
Let me rephrase.
It was hard for me to understand D.C.
When I got pulled in and I was given an opportunity to step in and try and help people untangle some of this stuff,
it's a different language.
It's a different structure.
It's a different decision-making model.
It's not fast, for sure.
It's education.
Yeah.
So you have to be patient.
But you have to, if you really care and you want to get involved in this issue, you can definitely lean in
and get it done.
I don't know.
Did you have any other questions that you wanted to ask?
No.
Oh, you want me to do this.
I got you.
Well, I'm going to do this just to say, now I see a hand back there.
I'm going to open it up for a question.
I think what they want you to do is walk up to the mic, even though there's not a mic.
I'm not fully understanding why that would be the case.
I think we give up.
Put your hand up there.
Yeah.
I think you and I can share this one.
I think this guy now.
I'll get you.
Yeah.
Mr. Wink, I served in a senior role for a political party.
I thought I could just reject.
Sorry.
Everybody does.
I saw the stand.
I figured I'd stand there.
All right.
I have two questions, if you don't mind.
Yeah.
Yeah.
My first question is, you just claimed that both political parties were compromised this election cycle.
No.
No.
I already submitted in the past.
In 2012, they were both compromised.
Okay.
That answers one question.
Okay.
There you go.
Thank you for the clarification.
I mean, I don't.
The honest answer, on 2016, I just don't know.
We've been told that at least the Russians were trying to do the same thing to the RNC,
whether they got in or not.
I just don't know.
Okay.
My second question is that as someone who has served for a party that was not the DNC,
to the point that was just made earlier, there are some of us who would love to engage in
political technology across the aisle.
And in this current commercial and political climate, it's very difficult to do so as a
vendor.
Is the, obviously, I'm not asking you to speak for the Democratic Party, but in your opinion,
are we entering a world where that fungibility of allegiance is viable?
Is viable?
Yes.
And I don't understand your question.
Are you saying can people work, can like a Republican help Democrats, you mean?
Or can...
Can someone...
So, traditionally, you'll find that you have to pick a side if you want to be a vendor
in American politics.
Yeah.
I got it.
How far are we away from eliminating that concept?
Okay.
No, it's a great question.
So, what's that?
It's the same thing.
Yeah.
It's the same thing.
It's two.
Yeah.
No, it's a great question.
So, the work I'm doing at Harvard, actually, Alex Stamos announced this in a speech on
Tuesday, I think it was.
So, I've partnered up with Romney's manager from 2012, and we are...
Alex announced that we're putting together an ISO, a bipartisan ISO for campaigns and
parties.
So, it will serve on a bipartisan basis to provide that node that you're talking about.
What we want to have is, first of all, a culture change where the parties are working together
on this behind the scenes.
We can say whatever we want about each other out front, but behind the scenes we're working
together.
And then, secondly, that the good news on this is I have not met a single person who
doesn't want to help.
So, we want to provide a place where people can bring that help and know that they are
helping the system and our democracy and not having to pick sides.
So, I don't know if that answers your question, but I think that's where we need to go.
To some extent.
I think that helping independent entities is certainly viable, but there are companies
that have contracted for either of the two major coalition parties and for smaller parties
that find it impossible to get business with other parties because you're painted once
you've contracted.
Oh, I see what you're saying.
Yeah, I think that's just going to be a...
We may get to a point where that's not a problem anymore.
I think the more the parties are working behind the scenes on information sharing and threat
awareness, we could potentially get to where you're talking about.
But I don't...
I don't know in the short term.
It's interesting.
I mean, look, I'll give you an example.
We picked a different firm to come in and take a look at our stuff than the DNC because we didn't
even want to have the same firm as the DNC necessarily, right?
So, some of that, you know, you deal with this in the corporate world, too, I imagine.
Yeah.
Hi.
So, I work for a large security vendor.
I was the speaker in the session before yours and I'm very passionate about this topic.
I actually gave a talk about doing fact checking on the indicators of compromise.
That have been publicly released by the various companies who investigated the different
breaches that happened in 2016 related to the different bears.
And a comment and then a question for you.
The comment is, as good as the security community is at sharing information internally, I still
think we have a ways to go.
One of the things that I learned in doing my analysis of those IOCs is that there was limited
utility in that information.
That there were some file hashes for example.
That reference files that I just simply had no access to.
And that there was no way for me to get.
So, there was no way for me to validate that the files were what the company, you know,
who said that they were related to such and such attack and did this certain behavior.
You know, I wasn't able to confirm that that was the case.
The question, though, is, you know, what we're seeing around us is a very rapid erosion of civil society.
And we're getting to a point where it definitely feels like there's a lot of
there's a portion of this country that will do anything and will stop at nothing to win.
Including and, you know, obviously on top of everything that has already happened that was dirty tricks
in the last election.
How do we reverse that course and convince people who are very interested in winning that they
need to do it in a way that shows that there's some legitimacy to their win.
Otherwise, people will be upset.
Yeah, it's a really hard question.
I mean, I don't have a great answer.
I'll give you some thoughts.
I mean, I think the first thing is I think there are way more people in this country
who want to do things the right way and have good intent than there are people who do not.
And so I think creating a space for people who want to have a democracy that is robust
and where we're arguing with each other but isn't sort of where ultimately, you know,
we are greater than the sum of our parts.
And I think the problem right now is, to your point, we're just gnawing at each other.
So I think there's long-term value in lifting that piece up.
I also think in campaigns we need, I think something over the last ten years that happened was
people like me, the campaign operatives, we kind of became enamored with what we do a little too much.
And I think the media sometimes reported, like,
campaigns are not the voters listening to two arguments and then making the best informed decision
and it's on them to pick the right person.
And more about campaigns are about which team can manipulate the situation better to their advantage.
And so I actually think part of what I've been, you know, I talk about this with some reporters sometimes,
is, like, we've got to get, we've got to always go back to what are you,
what's the case you're making to the voters and not what fancy, you know,
psychographic tool do you have to manipulate people's thinking.
Because when we celebrate that, we encourage people to go to, to do those things.
Does that make sense? So, you know.
The success of the current campaign, you know, shows that there is some, you know,
effectiveness to that and that they might want to continue to do that.
That's the narrative. I mean, that's the question I want to push on a little bit,
is I think we're too quick sometimes to point out tactics as the reason that somebody was successful.
And not look at bigger things.
If there's anything I've learned in all my time in politics,
like, a big part of why President Trump's behavior is not a problem right now
for a lot of the electorate is the economy is doing very well.
The stock market is doing great.
If the stock market was losing 200 points a day, I don't think this behavior would be tolerated.
There's those meta things, but that's never what gets written.
It's like, oh, it's this little tactical thing.
And so I think we need to, like, step up.
Step back and get out of some of that.
Because I think it encourages some of that nefarious behavior.
I'm not saying any of this is a panacea.
And the point you made is right.
But, yeah.
Thank you.
So when you were talking about encryption and backdoors being a nonpartisan issue,
you kind of phrased it as saying you knew people who were pro-backdoor and people who were not.
And then you kind of went on to say you and others are not very passionate about the topics
sometimes.
Do you know anyone who is anti-encryption backdoor?
Or is it largely just people who are pro or kind of undecided or don't really care, don't know which way to go?
I'm not the best person to ask.
But, you know, look, there's a libertarian wing of the Republican Party.
And I think a lot of those people are very much on the record against the government doing anything,
having any backdoor to go read people's materials.
I think there are liberal Democrats who are in the same place.
So I think there's lots of, you know, elected officials on record,
both ways.
And I think the...
I think...
Yeah, right.
I think, isn't Rand Paul, I think, you know, pretty out there against it.
Do you see those pulling a little bit more along some lines?
You said there's a liberal and a...
Or, sorry, a libertarian sect of the party?
Or, you know...
Do you see more of a line there than you see...
No, I don't think so.
Honestly, I don't.
Okay, that's good.
I think Senator Orrin Hatch is a really big defender of encryption.
And, you know, to me, it doesn't fall on a map in a specific way.
Geographically, party lines, it's just kind of a belief system.
That's it.
It's probably more, you know, but it's probably more like law enforcement versus, you know, some other...
Like, there's a lot of...
Honestly, I just think it's people who've had time to think about it.
Because I think there's almost an inevitable end state of this thought process.
And it's people who've been involved in the debate.
It's the back door.
Yeah, exactly.
They're listening.
That's been my experience.
I mean, people who have been tasked with looking at this issue.
And it doesn't always fall down, you know...
Some people will take a long time looking at it.
And they're like, yeah, we need to have an easier way to get access to these communications.
But ultimately, it's the people who've been around the issue for a while.
I think who end up with that inevitable...
We've got to find a way to not mandate back doors.
One is only having two mics.
Okay, a quick comment to follow up on his.
Which is to the people who are in favor of back doors for the government.
If we can convince them that back doors can be used by bad guys as well.
We haven't figured out a way to fix that.
Then the question I would ask to the people who are...
In favor of it is, how would they feel if their campaigns were hacked?
And it was published.
So, my question is, just to assess the risk.
What is the data that has to be kept for governmental reasons?
Assuming the communications are all going through Wicker.
Yeah.
Very little.
There's some compliance information that you basically have to store.
And in fact, this is why a campaign breach is...
Sometimes the flip of a corporate breach is you don't need...
The only reason the DNC had PII is because you need that for when President Obama was doing events, basically.
People need to get waived by the Secret Service.
But otherwise, all of your donor information is public anyway.
So, for us, it's actually the information itself.
It's not so much a financial loss as an opportunity loss.
Does that make sense?
Yeah.
One of the things you mentioned was that we had a situation where we had basically a company growing up 5,000 people all at once in a very short time.
I don't know if that's on.
Can you guys hear this in the back?
No.
It's not supposed to be switched on.
Test, test, test.
One, two.
One, two.
There you go.
Totally flushed.
Hello.
It's not very hygienic, but yeah.
One of the things he mentioned was that we had a company grow up to 5,000 people.
An organization grew up to 5,000 people all at once.
You're going to have cultural problems with enforcing best practices with respect to compliance and making sure that people don't get phished so easily.
Obviously, this is not an easy thing to deal with, but I would ask the question, what sort of policy recommendations might you make to make the transition to making campaigns, Republican or Democrat?
Making them more secure as the organizations instantly grow?
Yeah, no, it's a great question.
I think it's a few things.
One is just making the right tools readily available.
So, like, a small campaign should be using a cloud-based email service with all the right settings, right?
Like right off including two factor.
Right off the bat, you've gotten like 90% of the way there, right?
Those sorts of things need to be rooted in the right tools.
And then, you know, I think it's important to be more scrutinized in the culture of campaign management.
So when I'm setting up a campaign, I know to, like, if I go with certain cloud-based services and I use two factor, I'm in good shape.
And then I think the third piece is getting managers in a, I mean, maybe it's because of my experience, I just think it has to start at the top.
So just this, I mean, for example, this is ironic given the current news of the last few days.
One of the things you're very sensitive to on a campaign is that your staff don't just wander out and talk to the press all day long, right?
Right.
So that is just something that you make very clear on day one.
There are consequences.
It should be the same thing about phishing, about what you're putting in email, about what documents are saved, what are not.
All of that just needs to become part of the culture.
I know that sounds sort of ethereal, but I actually think we can do that pretty quickly and it will make a huge difference.
One thing that you mentioned is that you're working on a new ISO with a partner at a new organization you're with.
Would this cover or would this be part of your organization?
Yeah, our hope is that it can be, again, a clearinghouse and a place that can provide that sort of training and resource.
We have some legal challenges we need to work through to get to that place, but yes.
I'm sure the answer is yes, yeah.
Kind of to build off of what he was asking.
Where do you see state and local parties, those smaller organizations, fitting into this?
Because I know we're talking about federal breaches and Russian hacks and stuff like that.
But if you think about it, I mean, just last night the vote came down to 49 to 51.
So one state election could determine policy for an entire United States.
And I know for a fact that an remain unnamed state party has had an evil twin attack against their building.
So they're definitely happening at that state level.
No, absolutely.
And, in fact, I think the most egregious and painful hacks of last time were actually against the DCCC when those self-research books about the opponents were taken and given out locally.
So the good news, though, is if you put presidential campaigns aside, state parties and these state campaigns, congressional campaigns, state-led campaigns, they're small.
So if we can just get them on these cloud-based, you know, email systems.
And document sharing systems, document storage systems with the right settings, we're in, like, such a better place than we are today.
But that's where the vulnerability is.
Look, the other vulnerability, just quickly, is the families of people running for office.
Right?
I think that's the next place you're going to start to see.
And one of my observations there would be I talked about how I'm trying to learn politics.
The state and local level is a whole new Rubik's cube.
And so it's heavy lifting to understand how you can help at all those levels.
The other thing, one of the guys earlier was talking about trying to sell software into politics.
You talk to offices and they're trying to scrape up change from the couch for laptops.
So we're not talking about organizations, you know, that are going to buy you an island in the Caribbean.
Right?
You have to really want to help in this arena.
And that's even, you know, at the higher levels.
Getting into state and local government is going to be a difficult thing.
So is there, I guess you kind of touched on this, but are you working on some way of getting a platform that then is affordable?
You're talking about these cloud platforms and stuff like that.
And you're saying, you know, we don't have the money, which is 1,000% true.
And I know that the cost of Internet security is going way higher than people can afford that need it.
So is there some sort of plan in the place to try to get this?
Is that one of the questions?
Should the, you know, government step in and be like, here is, you know, something that all campaigns can use?
Do you want to take that first?
I'm just going to use my voice.
I'd say my experience has been that to go do something at the highest levels in a procurement cycle is going to take a really, really long time.
We're just going in and trying to be as inexpensive as possible and help.
It's not how we're kind of approaching corporate clients, but definitely in the political arena.
If there's going to be fast change, it's not going to be done, you know, in a rat race.
It's just not.
Thank you.
I have a microphone for you.
How much time?
I think you have a question.
So my question focuses more on the back end aspect of doxing, where the documents were released on the Internet and the challenge that caused for the campaign.
So you talked about kind of the data retention issue, kind of trying to get rid of your data so that it's not available.
Let's just assume that.
Let's assume that all the best security measures don't match up and data is released.
How did this experience change your view on campaign strategies for protecting once your data possibly gets out there?
How does this experience kind of affect how a campaign responds to doxing, the release of information?
Like, I guess as a voter, one of my concerns was I saw this data, but I wasn't sure if it was accurate.
I was wondering if it was accurate, if it was modified, the integrity of it.
Just how do you view that and how does the situation change?
Yeah, well, I think, again, this is where France is a great example where they prepared in advance for this to happen, right?
So it was ‑‑ and I think this is where this will be better in the future.
It will never happen quite like this again.
It won't be as easy ‑‑ the media won't be weaponized so totally.
The information won't be so purely broadcast out to people.
So, yes, look, I think every campaign now needs to ‑‑ you know, the same way it was routine for us to sit down and say,
what are we doing to secure our office and our emails at the beginning?
Now you're going to sit down and say, let's imagine there's a breach.
First of all, do a basic tabletop exercise the way that any other corporate entity does nowadays.
But then second, let's say there's an information operation.
What are we putting in place to disrupt that so that if stuff is stolen, there's a disruption factor within what they take?
But then also, how are we managing that?
You know, and we could talk about that for hours.
But, yes, I think all that just needs to become part of the routine.
Thanks.
You kind of mentioned this ‑‑ hello?
You kind of mentioned this already.
But you said that if you knew or if you understood, like, the full extent of the Russian hacks,
you would have, like, attempted to make a honeypot
or you would have brought in more ‑‑
You know, like, journalism, right?
What do you think, like, tool-wise and also culture‑wise,
how do you see, like, campaigns changing in the future to respond, not just to prevent,
but also respond to hacks like this?
Yeah, so I think the first piece that I mentioned earlier is I think there needs to be a discussion between the media,
the news media, social media, and the political space about what ‑‑ knowing that none of us want any foreign actor
to be able to get in and influence us.
How are we going to handle this differently moving forward?
And I don't want to sort of prejudge what that looks like.
And, again, a blackout, you know, is not an option.
And the other thing, just to be specific about it, part of why we didn't do more is because we weren't certain.
We were told things by the experts, but a lot of people were, you know, saying that's not true.
And we didn't ‑‑ the intelligence community didn't say until October, you know, they didn't speak out on this.
So we didn't know if we were ‑‑ how firm the ground we were standing on was.
You know, we had good reason to believe.
We were talking to smart people who were very experienced.
So I think also next time people will be a lot more firm when they say this is an information operation
and the media will understand what they mean.
So my observation is that we've seen this in the corporate world where it pivoted from, you know, not if but when.
And so I'm just seeing people understand that they're going to get owned the next election cycle.
And they're trying to understand how to deal with that.
Not just how they protect their information, but how they're actually going to work this tabletop exercise
such that it's not how do we protect our assets, it's when our assets get owned, what are we going to do with it.
Someone was asking about policy, and it's a little bit radical, but Last Company really tried to push for ‑‑
I mean, I can't imagine growing an organization like Robbie did and training people not to click on links.
I think their policy is click on them all.
And then build a team that can handle it.
Right?
That's the type of change I'm seeing in this mindset and these campaigns that's coming.
Because, look, you can't grow something that fast and have a bunch of young, just entering the workforce people,
even though they're probably more passionate employees.
I imagine yours are the most passionate employees that exist.
They're going to do the wrong thing.
And so you have to be ready for what happens when the wrong thing is coming.
Previous election cycles, they knew the Chinese were in there looking at their information.
And it was just gathering.
Nothing bad happened.
So now they have this, you know, like white hot nasty taste of this in the back of their mouth on both sides.
They know that this is going to be an impactful thing.
So I think it's just more people are really, really battening down the hatches and saying, all right, this is inevitable.
What are we going to do?
What do we have to really protect?
I mean, it sounds a lot like the corporate world, right?
We've all gone through this.
What is the most important thing to protect?
Let's go all out, and then let's be really prepared for when it goes bad.
And would you say that ‑‑
To that extent, to, like, do that, you see campaigns like yours in the future beefing up their in‑house security, like, analysis or just outsourcing it to third parties?
Totally.
I think it would be, like, the corporate sector both, right?
So, you know, we had security, you know, full‑time security, people this time.
I think you'll see that dramatically expand in the future.
But then we'll also have ‑‑
Yeah.
We'll have partners that we're working with, you know, from day one.
Yep.
So, my question was kind of based off the previous two gentlemen.
As far as, like, when information is found and how it's delivered in situations like this, it sounds like information integrity was the biggest issue because it led hesitation to putting up honeypots and who would believe.
I guess ‑‑
And, I mean, I don't know.
Going forward, it sounds like it's being worked on.
But how can we get that information more streamlined?
And get the intelligence community more involved to ‑‑ I mean, in a two‑party system, it's difficult because the other side is going to believe whatever they want anyway.
Yeah.
But, I mean, it seems like there needs to be an official policy and procedure.
We found this.
This is how we deliver it.
It's factual.
And ‑‑
I totally agree.
I think if we could have that, that would be awesome.
No, and I don't mean that in, like, a dismissive way.
I really mean that.
That's where we need to get to.
I don't know how we get there today in the political environment that we're in.
And with, you know, just ‑‑ I'll leave it at that.
But I think we've got to get where you're talking about.
So just to be a little bit of a skeptic, now that we know that's Robbie's strategy, if we're trying to run a campaign against him, I mean, it's going to be hard.
This is going to be the squishing of the balloon, right?
As soon as we have a standard for how that information is distributed, you're going to figure out how you can impact the campaign based upon that standard.
So I don't think it's a bad thing to do.
But just that's my nefariousness.
That's my nefarious way of looking at it.
Okay.
Great.
I think we'll take one last question if you can make it quick, sir.
Nice T‑shirt, sir.
I love this.
Yeah.
So I had a question.
So it seems like if you had a campaign that seemed like it was run legitimately and you're using all ephemeral messaging and not keeping anything unless you have to, but then at the end there was something that came out where they had colluded with a government agency or a foreign power, it seems like that it could be a really tricky scenario where there is no records.
Right.
There is no something to look back on what happened.
And so it seems like we have this need for encryption.
We have this need for ephemeral communication.
But at the same time, we really need some ability to have accountability for who said what and who bought what, you know.
So it seems like a really tricky, you know, problem to solve.
I'll pass it over to Robby.
But, yeah, I think what I'm seeing happen now is that I reference polling data and opposition books.
And there's just stuff that comes on a really rapid scale.
It's just, it's data.
It's just kind of like a new data set.
This guy used this replica and we're testing it.
This guy used it, and it's like, oh, it's just data.
And we don't know even if they're just trying to say, oh, here's a sample.
And they're saying, well, this is a version of it that I've copied.
And, you know, it's not or it's not something we're going to be able to do.
And we don't know if it's something we can do.
Because if you have some of these things, like we don't have any explicitly that
people have these things, then they're just going to be able to say, you know, I've
got to use this.
around. Well, I'm not going to do better than the moldy bread. No, I just agree with all
that. All this stuff is a tradeoff, right? Just the same way in our own inboxes, if we're
erasing, the pushback I always used to get when we erased e-mails was, well, I need to go
back and get those. And to me, the pain of losing those e-mails is always outweighed by the
assurance that nobody can go in and mess with you. So, yeah, I just think it's a tradeoff.
And I think in the current environment that we're in, it's better just not to have stuff
around. But everybody's got to make that choice for themselves. I think that's it, right?
I'm seeing a orange shirt saying no, more. Thank you. Thank you, Joel.