Gizmodo Went Phishing With the Trump Team -- Will They Catch a Charge? (arstechnica.com)

Earlier this month, technology publication Gizmodo published a report on how it "phished" members of the administration and campaign teams of President Donald Trump. The blog said it identified 15 prominent figures on Trump's team and sent e-mails to each posing as friends, family members, or associates containing a faked Google Docs link. But did the publication inadvertently break the law? ArsTechnica reports: "This was a test of how public officials in an administration whose president has been highly critical of the security failures of the DNC stand up to the sort of techniques that hackers use to penetrate networks," said John Cook, executive editor of Gizmodo's Special Projects Desk, in an e-mail conversation with Ars. Gizmodo targeted some marquee names connected to the Trump administration, including Newt Gingrich, Peter Thiel, (now-ex) FBI director James Comey, FCC chairman Ajit Pai, White House press secretary Sean Spicer, presidential advisor Sebastian Gorka, and the administration's chief policymakers for cybersecurity. The test didn't appear to prove much. Gingrich and Comey responded to the e-mail questioning its provenance. And while about half of the targeted officials may have clicked the link -- eight devices' IP addresses were recorded accessing the linked test page -- none entered their login credentials. The test could not determine whose devices clicked on the link. What the test did manage to do is raise the eyebrows of security experts and some legal experts. That's because despite their efforts to make it "reasonably" apparent that this was a test, Gizmodo's phishing campaign may have violated several laws, ignoring many of the restrictions usually placed on similar tests by penetration-testing and security firms. At a minimum, Gizmodo danced along the edges of the Computer Fraud and Abuse Act (CFAA).

Comments

Inadvertently?

[aardvarkjoe]

But did the publication inadvertently break the law?

Maybe they didn't think the consequences through, but I find it hard to believe that nobody involved realized that this sort of thing is illegal.

Re:HERE COMES MSMASH

[Anonymous Coward]

A story on how Gizmodo failed to phish the current administration with legally questionable methods == anti-Trump post???

If anything, this story highlighted the fact that nobody in the Trump administration fully fell for the phishing and that they really may have learned from the failures of the Clinton campaign debacle. Methinks the bias may be yours...

First Hulk Hogan's genitals, now Phishing Trump?

[Glock9mm]

First they go after Hulk Hogan's genitals, now they're phishing Trump? Do they realize how stupid and illegal that is? The entire Gizmag/Gizmodo/Jezebel syndicate is a load of politically sponsored crap.

Quit fooling yourself

[onyxruby]

They didn't dance along the edge of legality. They danced over and never looked back. Legitimate pen test services are painfully aware of this and have the paperwork to prove it.

Ars should have enough sense to check things out for the sake of their own credibility. If Ars Technica bothered to ask anybody who's ever worked in the security industry they would have quickly learned the indemnification is taken very seriously.

http://www.isaca.org/chapters3...
https://pen-testing.sans.org/b...

Hell, even metasploit has been talked about this for years!
https://dev.metasploit.com/pip...

The only people fooled by Gizmodo's phishing logic were the editors who signed off on this to begin with. Next time ask a pro before you publish, it will help you avoid looking the fool.

Re:This is the EXACT same thing that "hacked" Pode

[Tulsa_Time]

Sure... call them names... pretend you are smarter than your opponents...

Strong argument.

False Positives??

[xanthos]

Just because the email was opened, doesn't mean it was done intentionally by an actual human being.

It can be difficult to distinguish between a human being opening an email and a malware scanning engine opening a email. Modern systems will actually follow links and run executables in sandboxes before releasing the actual email to the end user. What looks like someone opening the email, usually a callback via a pixel image or js include, doesn't involve a human actually opening the email. In fact, just using a preview pane can make it seem like the email has been opened.

Sorry to be a kill joy, but this phishing test proved absolutely nothing.

Re:First Hulk Hogan's genitals, now Phishing Trump

[Hentes]

Gizmag is a respectable tech blog, it wasn't owned by Gawker.