Ex-NSA hacker wants to give 2020 candidates free cybersecurity tool. The FEC may stop him
A small software company wants to give political campaigns a free tool designed to block hackers from gaining access to their files, but the Federal Election Commission may prevent that from happening.
In a draft notice posted Monday, FEC lawyers recommend that the commission vote against a request by Silicon Valley startup Area 1 Security to allow it to offer cybersecurity software for free to political campaigns.
Unless the FEC grants an exemption, a company that provides a free product to a political campaign can run afoul of a law prohibiting corporate campaign contributions.
Oren Falkowitz, a former NSA hacker who founded Area 1, touts his software as a leading solution to block so-called spearphishing attacks, which often take the form of fake emails asking the user to click on a link that then allows hackers access to the organization.
Russian military hackers used a spearphishing attack to gain illegal access to the email accounts of the Democratic National Committee and Hillary Clinton's campaign chairman in 2016, according to the special counsel's report.
"This is exactly the thing we are supposed to be trying to solve against," Falkowitz told NBC News. "The reality is that campaigns can't afford to spend their valuable contribution money on expensive cyber security products."
In a formal request for an FEC advisory opinion allowing it to move forward, Area 1 cites as precedent an FEC opinion last year allowing Microsoft Corp. to "offer a package of enhanced online account security services to its election-sensitive customers at no additional cost."
The FEC ruled that it would make an exception because Microsoft would be acting on a non-partisan basis out of business interests and not trying to curry favor with political campaigns—exactly the argument Area1 is making.
"Microsoft plans to offer this service for a variety of commercial reasons beyond mere promotion or goodwill, most notably to protect its brand reputation, which would be at risk of severe and long-term damage if the accounts of its election sensitive customers were hacked," the commission ruled in October 2018.
But in its draft opinion, the FEC found that Area 1 did not meet the same test that Microsoft did, mainly because the company did not show that it would gain something valuable, or "adequate consideration in return for its services," in the FEC's language. Without doing that, Area1's provision of free services looks too much like a political contribution, the draft opinion says.
Area 1 said it would benefit through research opportunities and by instilling pride in its employees by allowing them to solve a cyber security problem that harms all Americans, but the FEC draft opinion says that isn't enough.
"Area 1 would not be receiving any benefit in preserving an existing client relationship or otherwise receiving any other compensation beyond nominal payment," the draft opinion says. "Because Area 1 does not propose sufficient business considerations justifying charging federal candidates or political committees little or nothing in return for its services, the commission concludes that Area 1's proposal would result in impermissible in-kind contributions and is thus impermissible."
In a second draft opinion, FEC staff recommended against Area 1's proposal for slightly different reasons: because "Area 1 proposes to deviate substantially from its ordinary business practices by not applying either of its established pricing strategies to federal candidates and political committees."
It’s common for the staff to offer more than one draft opinion for the commission to consider because the exact language can set a precedent for future cases.
The FBI says political campaigns remain a top target for foreign influence campaigns, including through hacking.
"We recognize that our adversaries are going to keep adapting and upping their game," FBI Director Christopher Wray said in April. "So we are very much viewing 2018 as just kind of a dress rehearsal for the big show in 2020."
The FEC is slated to officially decide on Area1's request during a public meeting Thursday.