The FBI recently disseminated a series of videos seeking to educate the public about ways to protect against online foreign influence operations and cybersecurity threats, within the context of elections. They refer to it as the “Protected Voices Initiative.”
After watching several of the videos I wanted to offer some comments, which I was unable to do on YouTube, where the videos reside natively.*
The video in the series entitled “Foreign Influence” was especially interesting. Viewers are reminded to vet people, to be sure they are who they say they are.
This advice is a reminder that a lot about cyber is truly about fundamental concepts and focusing on the fundamentals has long been my refrain in this domain.
One of the reasons this basic premise is too often ignored in the relevant presupposed context, IMO, is due to a lack of formalism in the operations of grass roots and volunteer political campaigns.
Anyone who has ever had to recruit or vet volunteers might agree with the sentiment that it is difficult enough to identify and retain volunteers, and this at times can serve as a disincentive to ask too much from them.
Years ago I organized a grass roots event attended by a number of volunteers and days later attended an event where some of the same people were in attendance. One of these attendees asked me to write him a recommendation.
The request made me pretty uncomfortable because I had just met him that one time, but I was reminded that he did take the time to attend my event. I asked him if he would be willing to give me a copy of his drivers license, or something along those lines, so that I could verify his identity.
He asked me if I was discriminating against him- which placed me in a difficult situation.
While working in pro bono I have often been the only person in the room who is what we now refer to as "diverse." I could empathize with his perspective.
But I could also see how he might not be who he said he was, and my credibility could be impacted by vouching for someone I met once. Further, now that the ball was rolling, what if he ended up suing me for discriminating against him because I didn't want to write the recommendation? Even if a #12B6 or analogous prevailed in such a scenario, that was still a *lot* of grief for having chatted with a volunteer.
In retrospect, the best way to address some of the risks engendered by the above scenario, I think, would be to formalize a process of vetting volunteers, and have a third party conduct the process, before meeting with any vols in person.
I would posit, however, that it is not a particularly apt climate for this.
Right now very esteemed people in law enforcement are forcefully debating the merits of the legal rights of people who are undocumented or have issues with immigration (I'm a bit of a hardliner on this issue, and remind that interfering with immigration is a RICO predicate).
So, in this climate, what would happen to an event organizer who requested proof of identity? This is legitimately something to consider with the next presidential election less than 100 days away.
Political parties often supply kits to their volunteers, downloadable forms that contain call scripts, pitches, asks, et cetera, so interested parties can take the initiative on a particular candidate, area, or issue.
It may be helpful to consider what a template for vetting volunteers could look like, for both US political parties, and for any other relevant actors in this area.
*Original date of publication: July 26th 2020 at 4:13PM EST. That version was deleted and the above identical except for this notice version was republished on July 27th, 2020 at 10AM EST after the July 26th publication was vandalized.
