Russians Hacked Voter Systems in 2 Florida Counties. But Which Ones?

MIAMI — The mystery surrounding a Russian intrusion into Florida’s voter registration systems during the 2016 election deepened on Tuesday when Gov. Ron DeSantis said that the F.B.I. had revealed to him which counties in the state had been targeted — then required the governor to keep the information secret.

At a news conference in Tallahassee, Mr. DeSantis, a Republican, said that officials from the F.B.I. and the Department of Homeland Security had asked him to sign a nondisclosure agreement pledging not to identify the two counties that fell victim to a “spearphishing” attempt by Russian hackers.

That the Russians breached security protocols in not one but two counties was previously unknown. Last month, the Mueller reportconfirmed that the F.B.I. believed that the Russian military intelligence unit known as the G.R.U. breached “at least one Florida county government.” Elections officials said that if the intrusion came through a spearphishing email, as it apparently did, it would put hackers in a position to potentially alter registration data, though not the tabulation of ballots.

.. Mr. DeSantis, who took office in January, had insisted on being briefed on the hacking after the release last month of the report by Robert S. Mueller III, the special counsel. Upon reading the report, the governor expressed frustration at the F.B.I. for not informing the state of its findings earlier, and vowed to make the details public if they were not classified.

.. “This is not acceptable, to keep secret attacks on the most public of our political processes: our elections,” said Ion Sancho, a Democrat and the former elections supervisor of Leon County, which includes the state capital, Tallahassee.

The Russia Investigation Will Continue

there is still much to uncover—and America’s intelligence services will work to uncover it. For example, how did the Kremlin know where to aim its disinformation effort? How did it know which communities to target, in which counties and states? One can argue that the Russians had a better sense of where to deploy their resources than did the Clinton campaign. Why did Trump and those around him consistently parrot Russian talking points? Why was the campaign so intent on disregarding expert advice on Russian issues? The Mueller report notes that while investigators couldn’t prove a conspiracy, some people nonetheless displayed conspiratorial behavior (destroying communications, engaging in a cover-up, and obstructing the work of investigators). The FBI, which has the benefit of secret intelligence, is certainly aware that it has only scratched the surface of Russian activities in 2016. Cyberhacks, troll farms, and the use of WikiLeaks are hardly cutting-edge espionage tradecraft. The Russian efforts that have been revealed to date were poorly hidden and displayed little professional elegance. Counterintelligence agencies must find it hard to believe the cupboard is already bare.

In the CIA, where I worked for 28 years, we used the analogy of a traffic light. A field officer pursuing a potential source would press forward slowly, assessing the target’s reaction to increasingly provocative and conspiratorial requests. As long as we received a “green light” in response, we would push the relationship further in the direction of our goal. If we hit a “yellow light,” we would reassess and try a different tack. We would stop only when we hit a firm “red light.” From the Mueller report, we now know that those around Trump were consistently flashing green
.. A number of commentators have focused on the bumbling nature of those in and around the Trump campaign, concluding that their ignorance and naïveté militate against their ability to engage in a conspiracy. This is a misunderstanding of how the espionage game works. Intelligence services recruit plenty of gullible people. The responsibility for recruiting, training, exploiting, and protecting a clandestine operation lies on the side of the professional intelligence service: The spy service must translate the target’s potential willingness into a productive and secure relationship; the professional intelligence officer must slowly manipulate the relationship in an increasingly conspiratorial and secret direction, then help rationalize it for the target. The Cold War was littered with Kremlin spies the West failed to uncover in a timely manner because Western agents assumed they were too obvious, absurd, drunk, dim-witted, or low-level. Naive and ignorant people can get in too deep when manipulated by professionals.

.. Likewise, counterintelligence professionals know that criminal prosecution is rarely the best tool for neutralizing the enemy. Even when investigators and intelligence officers are confident they’ve uncovered a spy, it is not a given that the person will be prosecuted. Hundreds of Americans spied for the Soviet Union during World War II and the Cold War, and only a small handful were ever brought to trial. The government’s methods of uncovering spies and its need to protect its sources limit its ability to produce convictions.

To some, it may seem unfair that investigators would not drop their efforts even after Mueller concluded that he could not “establish that the Trump campaign coordinated with the Russian government in its election interference.” Trump clearly thinks he’s been vindicated; he spoke to Russian President Vladimir Putin on Friday and said on Twitter that they discussed the “Russia Hoax” in their “long and very good conversation.”

Nevertheless, counterintelligence professionals realize they don’t have the whole story and will continue to work behind the scenes, slowly uncovering the activity of hostile intelligence services. From experience, they understand that failure to prove Russian espionage does not mean it didn’t happen. While the notion of “innocent until proven guilty” is something Americans take as solemn truth, to the Russian intelligence services it is just another vulnerability worth exploiting.

Zuckerberg’s new privacy essay shows why Facebook needs to be broken up

Mark Zuckerberg doesn’t understand what privacy means — he can’t be trusted to define it for the rest of us

Zuckerberg’s new privacy essay shows why Facebook needs to be broken up
Mark Zuckerberg doesn’t understand what privacy means—he can’t be trusted to define it for the rest of us.
by Konstantin Kakaes March 7, 2019

In a letter published when his company went public in 2012, Mark Zuckerberg championed Facebook’s mission of making the world “more open and connected.” Businesses would become more authentic, human relationships stronger, and government more accountable. “A more open world is a better world,” he wrote.

Facebook’s CEO now claims to have had a major change of heart.

In “A Privacy-Focused Vision for Social Networking,” a 3,200-word essay that Zuckerberg posted to Facebook on March 6, he says he wants to “build a simpler platform that’s focused on privacy first.” In apparent surprise, he writes: “People increasingly also want to connect privately in the digital equivalent of the living room.”

Zuckerberg’s essay is a power grab disguised as an act of contrition. Read it carefully, and it’s impossible to escape the conclusion that if privacy is to be protected in any meaningful way, Facebook must be broken up.

Facebook grew so big, so quickly that it defies categorization. It is a newspaper. It is a post office and a telephone exchange. It is a forum for political debate, and it is a sports broadcaster. It’s a birthday-reminder service and a collective photo album. It is all of these things—and many others—combined, and so it is none of them.

Zuckerberg describes Facebook as a town square. It isn’t. Facebook is a company that brought in more than $55 billion in advertising revenue last year, with a 45% profit margin. This makes it one of the most profitable business ventures in human history. It must be understood as such.

Facebook has minted money because it has figured out how to commoditize privacy on a scale never before seen. A diminishment of privacy is its core product. Zuckerberg has made his money by performing a sort of arbitrage between how much privacy Facebook’s 2 billion users think they are giving up and how much he has been able to sell to advertisers. He says nothing of substance in his long essay about how he intends to keep his firm profitable in this supposed new era. That’s one reason to treat his Damascene moment with healthy skepticism.

“Frankly we don’t currently have a strong reputation for building privacy protective services,” Zuckerberg writes. But Facebook’s reputation is not the salient question: its business model is. If Facebook were to implement strong privacy protections across the board, it would have little left to sell to advertisers aside from the sheer size of its audience. Facebook might still make a lot of money, but they’d make a lot less of it.

Zuckerberg’s proposal is a bait-and-switch. What he’s proposing is essentially a beefed-up version of WhatsApp. Some of the improvements might be worthwhile. Stronger encryption can indeed be useful, and a commitment to not building data centers in repressive countries is laudable, as far as it goes. Other principles that Zuckerberg puts forth would concentrate his monopoly power in worrisome ways. The new “platforms for private sharing” are not instead of Facebook’s current offering: they’re in addition to it. “Public social networks will continue to be very important in people’s lives,” he writes, an assertion he never squares with the vague claim that “interacting with your friends and family across the Facebook network will become a fundamentally more private experience.”

By narrowly construing privacy to be almost exclusively about end-to-end encryption that would prevent a would-be eavesdropper from intercepting communications, he manages to avoid having to think about Facebook’s weaknesses and missteps. Privacy is not just about keeping secrets. It’s also about how flows of information shape us as individuals and as a society. What we say to whom and why is a function of context. Social networks change that context, and in so doing they change the nature of privacy, in ways that are both good and bad.

Russian propagandists used Facebook to sway the 2016 American election, perhaps decisively. Myanmarese military leaders used Facebook to incite an anti-Rohingya genocide. These are consequences of the ways in which Facebook has diminished privacy. They are not the result of failures of encryption.

“Privacy,” Zuckerberg writes, “gives people the freedom to be themselves.” This is true, but it is also incomplete. The self evolves over time. Privacy is important not simply because it allows us to be, but because it gives us space to become. As Georgetown University law professor Julie Cohen has written: “Conditions of diminished privacy also impair the capacity to innovate … Innovation requires room to tinker, and therefore thrives most fully in an environment that values and preserves spaces for tinkering.” If Facebook is constantly sending you push notifications, it diminishes the mental space you have available for tinkering and coming up with your own ideas. If Facebook bombards the gullible with misinformation, this too is an invasion of privacy. What has happened to privacy in the last couple of decades, and how to value it properly, are questions that are apparently beyond Zuckerberg’s ken.

He says Facebook is “committed to consulting with experts and discussing the best way forward,” and that it will make decisions “as openly and collaboratively as we can” because “many of these issues affect different parts of society.” But the flaw here is the centralized decision-making process. Even if Zuckerberg gets all the best advice that his billions can buy, the result is still deeply troubling. If his plan succeeds, it would mean that private communication between two individuals will be possible when Mark Zuckerberg decides that it ought to be, and impossible when he decides it ought not to be.

If that sounds alarmist, consider the principles that Zuckerberg laid out for Facebook’s new privacy focus. The most problematic of them is the way he discusses “interoperability.” Zuckerberg allows that people should have a choice between messaging services: some want to use Facebook Messenger, some prefer WhatsApp, and others like Instagram. It’s a hassle to use all of these, he says, so you should be able to send messages from one to the other.

But allowing communications that are outside Facebook’s control, he says, would be dangerous if users were allowed to send messages not subject to surveillance by Facebook’s “safety and security systems.” Which is to say we should be allowed to use any messaging service we like, so long as it’s controlled by Facebook for our protection. Zuckerberg is arguing for tighter and tighter integration of Facebook’s various properties.

Monopoly power is problematic even for companies that just make a lot of money selling widgets: it allows them to exert undue influence on regulators and to rip off consumers. But it’s particularly worrisome for a company like Facebook, whose product is information.

This is why it should be broken up. This wouldn’t answer every difficult question that Facebook’s existence raises. It isn’t easy to figure out how to protect free speech while limiting hate speech and deliberate misinformation campaigns, for example. But breaking up Facebook would provide space to come up with solutions that make sense to society as a whole, rather than to Zuckerberg and Facebook’s other shareholders.

At a minimum, splitting WhatsApp and Instagram from Facebook is a necessary first step. This makes the company smaller, and therefore less powerful when it comes to negotiating with other businesses and with regulators. Monopolies, as Louis Brandeis pointed out a century ago, and as Columbia University law professor Tim Wu, journalist Franklin Foer, and others have underscored more recently, simply accrue too much political and economic power to allow for the democratic process to find a balance in how to tackle issues like privacy.

Tellingly, Zuckerberg’s power has grown so great that he feels no need to hide his ambitions. “We can,” he writes, “create platforms for private sharing that could be even more important to people than the platforms we’ve already built to help people share and connect more openly.”

Only if we let him.