DNC Leak: Russian Hackers or Inside Job?

…and does it change the result?

Who is responsible for the recent Democratic National Committee (“DNC”) hack and resulting emails published on WikiLeaks? Russian hackers are suspected and the FBI is investigating, but Russia adamantly denies involvement. The hackers could be from the same group who stole DNC’s oppositional research about Republican Presidential nominee Donald Trump in mid-June. Perhaps, the perpetrator is simply a DNC employee or subcontractor disenchanted with circumstances that many are now describing as a DNC conspiracy to favor and support its predetermined nominee in the presidential primary – Hillary Clinton – while impeding other candidates such as Bernie Sanders. Whether an angry Bernie Sanders supporter or a foreign government preferring Trump is to blame, the lesson here is once again that if your emails (sent in plain text) contain something of value, they will eventually be exposed.

Regardless of the leak’s source, the emails are now public and the damage has been done. If litigation were brought against the DNC, these emails might not be admissible in court, but by then, the election would be over. The court of public opinion is what matters in situations like this.

Whoever leaked the emails had a clear agenda: to upset Bernie Sanders supporters at the Democratic National Convention and deter the pace of “party unity.” And it appears to have worked.

Criminals usually have less complicated and less political motives for hacking into email correspondence. Hackers are more likely to target small business owners including attorneys with sensitive client information, real estate professionals with access to loan documents and bank wiring instructions or registered investment advisors, who work with high net worth individuals. Hackers commonly use stolen emails to initiate a Business Email Compromise (BEC) attack, posing as a client or senior executive and requesting funds via a wire transfer. Some hackers steal a users’ sensitive personal or business information, and then hold that information for “ransom”, demanding a payment to keep sensitive information private. Consider the consequences if your most sensitive client emails or personal email messages were intercepted and you received a ransom note demanding payment, threatening to post this information online for the world to scrutinize. How much would you be willing to pay to keep this information private?

As we have seen with the DNC example, plain text email correspondence can be easily exposed, either en route to the recipient or with access to a corporate mail server or archive. This and other recent leaks such as the “Panama Papers” have underscored the need to have a secure messaging/email system in place, whether in a political or corporate setting. But, what are the pillars of a successful secure messaging system?

For starters, assume the data can be compromised at any point. Use “Outbox-to-Inbox” email encryption rather than “network-level” or “policy-based gateway” encryption, if your information is sensitive to the highest degree.

RMail’s Executive Mode Encryption is an example of use “Outbox-to-Inbox” email encryption as it encrypts email messages locally in the sender’s Microsoft Outlook program at the sender’s desktop or device, and ensures encrypted delivery straight through to the recipient’s desktop (with options to have it remain encrypted in the sender’s sent folder). This process mitigates data breaches both within the sender’s in-house or outsourced email system, and externally while en route across the Internet and within the recipient’s email system. Executive Mode Encryption also allows the recipient to encrypt their replies without having RMail at their end.

With RMail® Executive Mode encryption, the message and any attachments remain encrypted within the recipient’s email inbox, and are encapsulated and AES 256 bit encrypted inside a PDF file, which can only be accessed using a secure password. And, it is simple to use. Remember, if it is secure yet too cumbersome, people will circumvent the system and it will not be used, making the investment in the tool useless (or used less).

Would RMail® Executive Mode encryption have protected DNC messages from this type of leak? It may have. It certainly should have at least been an option for the DNC leadership team to protect information in this new era of high profile leaks.

You might also like