messing up a Paypal scam

37 ways to mess up a PayPal scam

Night at Hellsö marinaI have a boat for sale. The sea is still one of my big passions, but I simply have too little time to use it. So I decided to let it go. I will buy a bigger one later, when and if I have more time. It’s still winter in Finland and all the small boats are on dry land covered by snow. But spring is approaching and the boating fever is spreading. It’s the right time to publish an ad on the net.

Soon I get a mail from a nice young lady. Let’s call her Mrs. Witney De Villiers, as that is what he or she called herself. (Probably a randomly picked false identity, any similarity to real existing persons is purely coincidental.) She was very keen on buying my boat and we had a nice conversation over a couple of days. I did unfortunately not sell the boat, but I got a nice story to tell instead. I will not bother you with all the details, so here’s a shortened version with all the important parts included.

– Hi, I’m in Mexico and I want to buy your boat. How long have you had it? What’s the final price? (Well, I’m in Finland and this is the point where I became more or less convinced that it is a scam.)
– I have had it for five years.
– OK, the price is fine. I want to buy it. Please take down the ad. What’s your PayPal account info so that I can make a payment? I’ll cover the PayPal charges. (Needless to say, the ad remained up.)
– Good news. I can accept wire-transfer which would be a lot cheaper for you than PayPal. (She can’t accept if this is a traditional PayPal scam.)
– Sorry, but I can’t do wire-transfers now. I only have access to PayPal because bla bla blaa …. (Yes, another scam-indicator.)
– OK, I created a PayPal account. Here’s the account info. But there’s some paperwork we need to handle before we proceed. Please fill in the buyer’s part of this attached contract and mail a scanned copy to me. I also need a picture of your photo ID. (The provided PayPal account info was false.)
– Great! I have made the payment. “Check your mail as there should be a confirmation mail from PayPal. I made an extra payment of 3650 € and I’am sure you noticed that, you’ll have to send the extra amount to the Shipping Company through Western Union right away, so that they can come ahead for the pick up and also you should send your address where they have to come for the pick up and also the necessary Western Union Payment Information.” (All the key elements in this very traditional scam becomes visible at this point. This is where you should realize what’s the name of the game, if you haven’t figured it out already. A faked mail from “PayPal” appears in my spam folder.)
– Hold your horses. We need to do the paperwork first. See my previous mail.
– “I want you to know that I have made an arrangement for you to receive the copy of my ID and my other necessary data for the boat. I want you to know that the courier representative coming over for the pick up has all he said documents in an enclosed confidential envelope with him which he will deliver to you in person.”
– Well, we really need to close the deal and have a legally binding agreement before we can arrange for transportation.
– “I understand your concern and certify that all sales is final. Your show of concern has given me a very good fact that you are indeed an honest seller hence, the reason why I am using this medium to confirm to you that all sales is final and I am satisfied with the present condition of the Boat.. so you can now proceed with the western union and get back to the paypal with the western union scan receipt so they can release all the fund into your account immediately..More so, send me a copy of the western union receipt… i look forward to read from you…” (Contract and passport files attached. Oh gosh what a poorly faked British passport!!!)
– Thanks, but you forgot to sign the contract.
– “Oh sorry, I write my name as the signature.. i hope to receive a copy of western union receipt from you today…” (That “signature” was typed, not handwritten.)
– Just want to let you know that I need the SIGNED contract before 3 PM. Otherwise I will not have time to go to the bank. And I’m traveling tomorrow so I will be unable to handle transactions. (To create urgency is a common scammer tactic.😉 )
– “Have signed on the contract.. i wait to read from you with the western union receipt..” (Printed, handwritten and scanned this time. It’s 4 AM in Mexico when this part of the conversation takes place.)
– WTF!!! The bank refused the transaction. The recipient is on some kind of international blacklist, apparently suspected for criminal activities. (Well, I wasn’t completely honest here.)
– “How about you go there and split up the money in to 2 and send on two transaction.”
– I’m certainly NOT going to send any money to a blacklisted company!
– “here is another shipping company info [another private person in US] I wait your story again” (We enter the threatening phase. A while later a mail appears in my spam folder. “PayPal” will take “LEGALACTION” and hand me over to FBI if I don’t pay in 24 h.)
– What are those clowns at PayPal up to now? They talk about some legal action against me even if I haven’t entered into any legally binding agreement to transfer money. Do you have any clue, or maybe I should contact PayPal directly and ask what they think they are doing? (Let’s see how/if they react. Contacting PayPal would reveal the scam instantly.)

Next I got a long mail pointing out how honest this lady is and how keen she is to do business with nice and honest sellers like me. But she can’t unfortunately do anything about the PayPal actions as the purpose of all that is to protect both the seller and buyer. She points out that even a smaller sum would be enough to release the payment into my PayPal account (ok, we are in the bargaining phase). At this point I decided that this blog post is becoming far too long and chose to not respond at all. She didn’t get back to me either. They probably realized that they are not going to get 3650 € from me and gave up.

As you have noticed, I became wary at a pretty early stage. There were several details in this conversation that made me suspicious. 37 to be more precise:

  1. The boat is of a local brand made for the Finnish market and totally unknown pretty much everywhere else. Why did she want this particular brand and model? Boats are also different in Mexico and Finland. My boat would be a real oddity over there.
  2. The boat is far too cheap to make it feasible to ship across the Atlantic.
  3. Smaller boats are inexpensive and widely available in the US. Buying one from Europe would be madness even if shipping was free.
  4. Buyer showed very little interest in the object. A 10 years old boat is not a bulk item. Every such boat has a soul of its own. One would be mad to buy without seeing it.
  5. Only one question was asked about the price. And it was no problem to proceed even if I ignored that question. Well, price doesn’t matter if you have no intention to pay.
  6. The buyer paid a lot more interest in the payment process than in the object of the deal.
  7. The buyer was extremely keen to pay and close the deal, but not to make any official papers that would prove her ownership. It should really be the buyer who cares about the papers and the seller who cares about payment, and not the other way around.
  8. Messages in the beginning of the conversation were very generic boilerplates. They were designed to work for any kind of goods. It doesn’t sound very convincing when selling a boat and the other part insists on talking about “the merchandise”.
  9. No other method of payment worked except PayPal. Naturally, as their scamming technique is based on PayPal.
  10. I’m supposed to make a payment to a courier company, which indeed do exist. The address to receive the payment has however nothing to do with that company. Both courier companies seem to use private persons in US as their billing contacts. Strange.
  11. A common tactic throughout the conversation was to ignore questions and requests that were not part of the script. They were addressed only if they stalled the process.
  12. The buyer had no problem “sending the money” even if the provided PayPal account was false. “PayPal” also had no problem sending mails to this non-existing account holder.
  13. The scam includes sending a fake message from PayPal stating that the money is on hold until the shipping agent has been paid. This fake is obvious if you know how PayPal works or know how to check the sender’s true mail address.
  14. The whole scenario match the very common scam where the victim is lured to pay money to someone and is promised more money later. The Nigerian scams belong to the same group and use a logic that is quite similar.
  15. At one point they claim to be satisfied with the present condition of the boat. They have made no attempt to find out in what condition the boat is.
  16. This Mrs. Witney De Villiers seems to be a true cosmopolitan. She is using an address and phone number in Mexico for this deal but her passport is British. At one point she also mentioned a phone number located in the British Virgin Islands. A Google search revealed that young ladies with an identical picture are living in at least two different places in US, but are using different names.
  17. If the husband of Mrs. De Villiers is still around, then he should do some Googling too. Seems like at least two dating sites have profiles with the photo of his wife.
  18. If you look European and hold a British passport, one could assume that you know English. But I guess that means nothing, people are so sloppy with grammars nowadays …
  19. And the passport. Oh gosh! Where should I start? The name has apparently been replaced, very bluntly, I might add. The first thing that strikes the eye is that the new name is in a different font than the rest of the passport. The font isn’t even close. But they did at least get the color right. All text is black. That’s an achievement considering their overall Photoshop skills!
  20. The background behind the replaced name does not have surface structure that is coherent with the rest of the passport.
  21. They didn’t apparently know how to scale pictures in Photoshop as the passport’s photo is smaller than the place reserved for it. (The photo of “Mrs. De Villiers” can be found on the net with more than sufficient resolution to fill the whole space.)
  22. The empty space around the passport’s too small photo is very badly cloned.
  23. If replacing part of a text line, make sure the new text is vertically aligned with the old text. It looks funny otherwise. Using the same text size also helps. And yes, I mentioned the font already.
  24. The passport’s signature is readable. But wait a minute! It reads Gabriella B and not Witney De Villiers!
  25. The embedded metadata in the passport’s picture file reveals that it isn’t saved by a camera’s firmware. The file comes from Adobe Photoshop CS4 for Windows.
  26. The content of the optically readable bottom lines do not match the standard for passports.
  27. Got a contract with a typed signature instead of handwriting. The habit to handwrite signatures should be fairly well known globally.
  28. When I finally got a signed contract, the signature bears no similarity to the signature in the passport, even if both are supposed to be signed by the same person. They didn’t even try to mimic he signature in the passport.
  29. The signed contract seemed to be scanned with a Konica Minolta multifunction device. “Mrs. De Villiers” mentioned however earlier that one of the reasons why she couldn’t do wire transfers was that she was out boating. Well, she could of course be cruising with a well-equipped boat, but buying mine would be a big step down in that case.
  30.  “Mrs. De Villiers” is very keen to get the receipt of the transport agency payment herself. The faked mails from “PayPal” do however clearly state that it is PayPal who need the receipt to clear the transaction, and not the buyer.
  31. This young lady in Mexico seems to have unusual working hours or staff that works shifts to answer her mail. Replies are received promptly throughout the European working hours.
  32. When the payment is delayed they start to threaten the victim. “PayPal” claims that legal actions will be taken if the payment isn’t made, and the seller hasn’t fulfilled that part of the “agreement”. Interesting in a situation where the seller hasn’t made any legally binding commitments to relay money.
  33. When they enter the threatening phase, they try to use FBI to scare the victim. Finland is not part of the US, which the scammer may or may not know. Looking up the name of the local police, or even using Europol, could have increased the scare-factor. They do mention the “World Law Enforcement Agency”, but selecting an existing agency might have been more effective.
  34. The first threat mail arrive less than 48 h after the initial notification that “PayPal” has a pending transaction. No previous mails do however contain any information about a deadline for the payment or anything about legal consequences if no payment is made.
  35. At one point she started bargaining and suggested that I should send at least some money ASAP and the rest when I have got the money on my account. 20 minutes later I receive a mail form “PayPal” that clearly states that the full 3650 € must be paid before the funds are released. There were many more discrepancies between the messages from “Mrs. De Villiers” and “PayPal” even if both came from the same source.
  36. When the bargaining starts, she mentions that I can pay a smaller part first if I’m short on cash and need to borrow money. Well, a couple of days ago I claimed that I had tried to transfer the whole sum, so it should be clear that I have the money.
  37. Some of their boilerplates seem to have been in use for many years. Googling key phrases will reveal the scam immediately and point to discussions and warnings that are several years old.
Fake passport. Some parts blurred to protect victims of identity theft.

Fake passport. Some parts blurred to protect victims of identity theft.

Sounds hilarious, doesn’t it! The scam is so obvious when presented in this way. And forcing the scammer out of the ready-made script makes the act crack up even more. But the sad fact is that people are lured by these guys daily. A lot of this seems to be done in volume so they must be dealing with a significant number of victims every day. Their way to do business very quickly and easily may seem feasible for smaller bulk items, and may not ring the alarm bells in the same way as when dealing with bigger items. Big or small item, it’s always a good idea to take a critical look at the whole case and look for discrepancies like this. Many of the points listed above are on their own enough to spot the scam. Also make sure that they can’t orchestrate the show on their own. Think about what you need to be able to trust the other part, and be persistent about getting what you want. Reluctance to comply is a pretty strong sign that something is fishy.

The core point for anyone who runs into cases like this is however to understand how the scam works. That’s the key to recognizing it in practice. You are promised money but something must be paid before the transaction can be completed. Sounds familiar? Yes, this is basically the same scenario as in the Nigerian scams. The core of the scam is that the money you are to receive is just a promise, but the money you transfer to someone else is real. The PayPal-based scams may be somewhat more effective as many people trust PayPal. It’s not an official bank, but many people think of it as a bank. You may believe that this trusted party is holding the money and securing the transaction. In reality, all you have got is a faked mail. There is no PayPal transaction and the promised money is just numbers written in the mail.

If you fall for the scam and pay, the scammers will vanish like smoke in thin air. PayPal can’t help you as this has nothing with them to do. The scammers have just misused PayPal’s name. And the payment method used to collect your money is always irreversible and provides no security for the sender.

So to summarize. If you ever consider engaging in a transaction with strangers and where money is relayed through you, you should:

  • Validate the reasons for the transaction. Most proposals of this kind are scams.
  • Make sure that you really know who you are dealing with. Demand proof of identity.
  • Make sure that the money is under your own control before making any payments to others. Cash or a deposit in your own account is pretty safe. (Added: See the comments below for an issue with this.)
  • Make sure that you are not engaging in money laundering.

What really strikes me is how poorly this false buyer’s role is created. Some simple Google searches is all it takes to reveal the scam. And many discrepancies would have been so easy to fix. Are these guys really “America’s dumbest criminals”?

Maybe, maybe not. The point is probably that you need to be suspicious before you turn to Google. And once there you will find descriptions of this type of scam no matter how well the scammers have tried to eliminate discrepancies in their story. So once you get suspicious, it’s game over for the scammers anyway. The most profitable tactic for them is maybe to run the scam en masse without caring about the details, and just harvest those who won’t get suspicious until it’s too late. Or maybe they’re just stupid and can’t do any better? (Believing that anyone would fall for that fake passport would indicate the latter.)

Well, the boat is still for sale. Anyone interested?

Safe surfing,

Message from "PayPal". Note the sender's address and the scam warning. The warning is actually authentic and copied from real PayPal messages. This may be good advice against phishers, who just know the mail address but not the victims real name. All "PayPal" mails in this case had the correct name in the beginning.

Message from “PayPal”. Note the sender’s address and the scam warning. The warning is actually authentic and copied from real PayPal messages. This may be good advice against phishers, who just know the mail address but not the victims real name. All “PayPal” mails in this case had the correct name in the beginning.

More posts from this topic


Tricks Not Treats: The 5 Scariest Online Threats

The first known use of the term "trick or treat" was found in a November 1927 edition of Blackie, Alberta's Canada Herald: Hallowe’en provided an opportunity for real strenuous fun. No real damage was done except to the temper of some who had to hunt for wagon wheels, gates, wagons, barrels, etc., much of which decorated the front street. The youthful tormentors were at back door and front demanding edible plunder by the word “trick or treat” to which the inmates gladly responded and sent the robbers away rejoicing. "No real damage" from "youthful tormentors?" Sounds a lot like the early days of hacking. Unfortunately those days are long over. “It’s a business,” F-Secure's Chief Research Officer Mikko Hyppönen told Wired UK. “There’s a whole structure there that’s needed,” F-Secure's "Cyber Gandalf" Andy Patel told ITPRO. “An individual can’t just go in and do this now; it’s not a one man job… these are companies.” The cyber crime "industry" has raked in hundreds of millions and possibly even billions of dollars. And it does it, in general, by counting on people to make mistakes. “People do stupid stuff,” Mikko explained. “You cannot patch people.” The first step to avoiding a threat is knowing it exists. So this Halloween as you search for treats online, look out for these tricks. Ransomware F-Secure Labs has warned about malware that holds your digital files hostage to demand a ransom for most of the last decade. But it's in the last year that the threat has burst into the mainstream and become something you can't go a few weeks without hearing about it on the news. How do you avoid this trick? Keep your system software updated and run security software at all times. Make regular backups of every file that matters on your computer and never click on attachments and links in emails that you weren't expecting. Find My iPhone Scam This scam answers the question, "How can losing your iPhone get any worse?" People who use the "Find My iPhone" app have been targeted by criminals who've gotten ahold of their phones with a scam that allows the crooks to gain access to the device and -- possibly -- the owner's most intimate financial details. How do you avoid this? Check the URL before entering any confidential data. Or as Apple says, "You should never enter your Apple account information on any non-Apple website." Phishing Scams As cyber criminals have gone pro, they've gotten better at using old tactics that we thought had faded away -- like email attachments and phishing scams. Like the trick that gives crooks access to stolen iPhones, a phishing scam just tricks you into entering your private credentials into the wrong site. And it then uses those credentials to hack your email, financial accounts, etc. Checking URLs before entering data is crucial because with the explosion of photo editing software and skills, it's now easier than ever to make a fake site look real. Experts believe that one wrong click to a fake site led the chair of a major presidential campaign to expose his entire inbox to the world. Having someone else leak your password Millions and millions of passwords have been leaked in 2016, some from breaches of data that took place years ago. It might not sound scary that your Yahoo! password from 2005 is now public, except if you are still using that password today on a critical account. This is why you need to use strong, unique password for each important account. Yes, remembering all that is almost impossible. So consider using a tool like F-Secure's KEY to manage your passwords. KEY is free to use on one device. Haunted IoT devices As our homes are getting smarter by connecting almost everything to the internet, they're also getting haunted -- by cyber criminals. A botnet is a network of computers that have been hacked and "enslaved." Security expert Brian Krebs was recently hit by a monster attack on his site that he believes was powered by a botnet powered by "'Internet of Things,” (IoT) devices — routers, IP cameras and digital video recorders (DVRs) that are exposed to the Internet and protected with weak or hard-coded passwords." What can you do? So much of this problem requires manufacturers to improve their security. But you can help by keeping every device updated with the latest software from the manufacturer and always changing your default passwords.  [Image by Daniel Lewis | Flickr]

October 21, 2016
dead end

Should We Stop Thinking of Email As Private?

When he was still working in cyber security for the Finnish government, Erka Koivunen met a NATO diplomat that there was "nothing new" about the era we now live in. Foreign envoys have always lived with the constant awareness that their private communications could be "leaked" for their enemies to exploit. "Anything that was written down could eventually be discovered," Erka, who is now an F-Secure Cyber Security Advisor, told me. "So the most sensitive conversations never took place in writing." Given the massive email leaks that have now hit the worlds of business, with the Sony hacks, and politics, with the leaks of U.S. political figures, is this how we should all start thinking? Does everyone alive in the twenty-first century have to operate like a NATO diplomat? Or a C-level executive who knows any word she types could be subpoenaed? Or the campaign chair of a presidential campaign? The answer, unfortunately, seems to be increasingly clear. "Whatever you write, you may need to defend your position in public," Erka said. Relying on an insecure medium The problems with email begin with the general insecurity of it as a means of communication. It's more like sending a postcard than sending a sealed letter, Erka explains. "As soon as the message goes out of your or your company’s systems, you lose control of it," Erka explained. "This is by far the biggest problem of the good-ole-email. Messages can be eavesdropped, altered, delayed, replayed or dropped altogether without you ever knowing." To actually spy on email as it's being transmitted generally requires legal access to telecommunications infrastructure or extraordinary technical knowhow and resources. Think law enforcement or intelligence agencies. Since these groups have a vested interest in cloaking their activities, they had little incentive to engage in the massive sort of leaking of gigabytes of private data we've seen from Wikileaks. However, we appear to be at the end of the era of "the gentleman's agreement" between countries, as cyber policy expert Mara Tam explained on a recent episode of the Risky.Biz podcast. This agreement went something like: "Gentlemen read each other's email, but they don't leak it to the public." The leaks from former CIA contractor Edward Snowden helped make the public aware of how much information the government potentially could access. But the exposure of a private individual's digital communication to the world presents a stark new reality for anyone who conducts business online. "Personal mailboxes store gigabytes’ worth of conversation history that will be a treasure trove for attackers for multiple reasons," Erka said. "There are sensitive discussions about business strategy, customers, competitors, products. There is also internal gossip, badmouthing and other damaging stuff." Activist Naomi Klein told The Intercept that "this sort of indiscriminate dump is precisely what Snowden was trying to protect us from." And we don't yet have a full sense of the potential ways this mass of data can be used against us. A competitor could use private information to tarnish someone’s reputation and hackers can mine the data to prepare for future cyber intrusions or to gain access to your other accounts through password resets. Letting the public decide what's private Leaks have already cost some executives their jobs and could swing the U.S. presidential election. But in a sense, we're all victims of this new risk to all of our privacy. "Whatever you write in an email you have to consider, are you ready for your boss, your spouse, your business partners to read it?" Erka asked. This new reality leads inevitably to the tragedy of self-censorship. Zeynep Tufekci -- a "techno-sociologist" -- ‏has been doing a running commentary on the Wikileaks revelations and is very disturbed by what she's seeing. "People gossiping in internal conversation is not a scandal—but destroying public/private boundaries will paralyze dissent, not the powerful," she tweeted. Wikileaks is releasing more documents than it could ever sift through in the hopes that the newsworthy information will be discerned by interested researchers around the world. But along with potentially relevant items, intensely private information has been revealed. "For example, a suicide attempt was publicized through Podesta indiscriminate dump (Wikileaks tweeted it out)," she noted. "Who will want to be political?" This makes the loss of email seem dire, but perhaps it speaks to a not just a flaw in the medium's security but the medium itself. "The deeper problem with email is that it has never quite settled on a social mode," The New York Times Farhad Manjoo wrote. "An email can be as formal as a legal letter or as tossed off as drive-by insult. This invites confusion." What can you do? So, should you be like that NATO diplomat content to keep all of your deepest secrets out of writing? Can you expect yourself to remove all snark and potentially offensive thoughts from your emails? Should you assume that your email box is like a box of letters in your attic, vulnerable to anyone who can get access to it? These answers are ultimately up to you and how you use -- or don't use -- email. F-Secure security advisor Sean Sullivan has found that young people he's interviewed are increasingly abandoning email as communication tool. "They only have an account -- typically Gmail -- in order to sign up for stuff," he said. If this continues, email is on its way out, whether it's private or not. For now, lawyers, doctors and other professionals with explicit legal responsibilities, email has a much more defined role that cannot be easily abandoned or circumvented. As far as your work email goes, consult your IT staff for guidance as you may be under legal obligation to preserve your data. But for your personal email, Erka suggests you have to at least be aware of how likely you are to be a target and what you can do to contain any potential damage -- besides using a strong unique password for every email account you have and only entering your account information on the secure webpage of your email provider. If you are involved in international politics, for instance, there's no question. You are a target. Hackers are either after your emails or are trying to get access to powerful people in your contacts. If you're someone with no power, no tumultuous relationships and no interest in politics, you're likely not to be on anyone's radar... yet. The problem is no one knows where you'll be in a few years and our inboxes are big enough to last a lifetime. "When everyone is using cloud-based emails like Gmail, there's no need to save space," Erka said. "That's the whole selling point of those services: Never delete anything." If you see the potential for enough damage, you many want these recent leaks as an inspiration to launch a serious spring cleaning of your personal online inboxes, including email and social media. "You may want to delete the messages you don't need and sort the stuff you do want into folders that you take off the web and can store on a secure backup," Erka suggested. Yes, you will lose the convenience of being able to search your Gmail box through a simple interface, but so will potential hackers. He also recommends sharing documents through sharing platforms and cloud services such as Sharepoint, Salesforce or Dropbox. "These links can require separate authentication upon opening and the sender can control how long it will be valid," Erka said. "If the email gets stolen and leaked years later the chances are the link will be invalid by that time." For quick conversations, Sean suggests Wickr, which offers self-destructing messages through a mobile app or a desktop client with easy encryption, something that just doesn't exist for most email. "For professionals, Wickr has a paid service which will retain messages for a legal requirement, and will then securely delete them post-requirement," he said. Regardless of policy, employers have a vested interest in moving their staff away from an over-reliance on email for more than privacy reasons. "Actual phone calls and face-to-face discussions that get out of your chair are probably more useful than email or chat threats," Sean said. "So rather than swap from one to the other – just learn to better utilize what you work with best." These leaks offer a sobering reminder that email is not secure. But, perhaps, the more important message is that it as a means of communication, it was never very smart. [Image by Alan Levine |Flickr]

October 20, 2016

5 Things You Need to Know About the Threat of Election Hacking

Cyber security is playing an starring role in the drama surrounding the question of who will be the next president of the United States. "The security aspect of cyber is very, very tough," Republican nominee for president Donald Trump said, when asked about securing American secrets from cyber attacks during the first debate. "And maybe it’s hardly do-able." Even the integrity of the election has been put into doubt by the threat of hacking -- which may be exactly the point. The questions about cyber intrusions into the electoral system and the wild speculations those intrusions provoke can be hard to put in perspective. So here are five basic premises to help you assess the situation as this historic election transpires. It would be almost impossible to hack the entire U.S. election. The biggest reason this U.S. presidential election is unhackable is that most of it doesn't depend on computers. More than three out of four Americans will vote on a paper ballot this November 8, Techcrunch's Ben Dickson reports. And the fact that all Americans don't vote in the same manner points to the biggest reason you probably couldn't hack the election. Each state has its own system, with some federal guidance. Nearly every state lacks sufficient funding to fully upgrade their systems, hence the reliance on outdated technology. So while voting machines are definitely vulnerable to hacking, hitting just the right ones in a systematic way that just happens to sway the electoral college vote in favor of one candidate would involve both a massive investment of time and money and an even larger serving of luck. But that doesn't mean an election can't be "hacked." “To ‘hack’ a US presidential election, all you need to do is to obviously tamper with one county’s system, then leak that the tampering occurred,” our security advisor Sean Sullivan told Dickson. “Many people will rush to assume that all of the other typical issues that occur may also be the result of hacking — and thus, you’ll end up delegitimizing all of the results.” A delegitimized election equals a  delegitimized winner. You don't even have to hack an election to hack an election. The hacks of the Democratic National Committee and Hillary Clinton's campaign chair John Podesta could end up being far more consequential in swaying the election than hacking either voting processes or actual vote counts -- especially if the resulting leaks end up revealing something extraordinarily damaging to the candidate in the documents being dripped out by Wikileaks. “Owning an election is gold; being able to influence it is silver; knowing the outcome in advance is bronze,” F-Secure cyber security advisor Erka a Koivunen explained. It's pretty clear that someone is at least after the silver in this election. Someone has definitely poking around in the U.S. election system. The United States has been clear that it believes that Russia is trying to hack this election. This month U.S. officials have explicitly stated that the Russians are behind the hack of a contractor that works on the electoral system of the key swing state of Florida. Similar hacks were reported by the states of Arizona and Illinois. U.S. intelligence also believes Russia is behind the hack of Podesta's emails and a security firm believes it found evidence that the nation led by President Vladmir Putin was behind the hack of the DNC. Russian Foreign Minister Sergei Lavrov told CNN that the accusation that it was behind the Podesta hack "flattering." When pressed to confirm or deny his nation's involvement, Lavrov said, “No, we did not deny this, they did not prove it." Trump himself questioned whether the hack actually happened in the second debate and if he's concerned about Russian hacking, he doesn't seem to be showing it. At one point he even -- jokingly, he said later -- asked Russia to hack his opponent's missing emails. Election technology needs to improve quickly. It's safe to say that no matter who is hacking the U.S. elections, the U.S. is probably hacking them, too. The richest nation on Earth is just not engaging, as far as most people can tell, in the leaks that have followed the recent U.S. hacks. In this new era of cyber attacks backed by nation-states or "privateers" employed by nation-states the rules of cyber espionage are unclear and the fog is thick. No matter what happens in 2016, digital technology will play ever-increasing role in both campaigns and election, and the U.S. needs to take steps to ensure the integrity of its elections. Sullivan believes that the Department of Homeland Security should go through with its proposal to declare voting system critical infrastructure and then adapt its defenses to catch up with the threats. “Network monitoring is rapidly becoming a requirement,” he told Techcrunch's Dickson. And voting must be made to feel at least as secure as using your credit card to buy a coffee. “Smartcard technologies are available in several European countries for online identity authentication,” Sullivan said. “They aren’t widely used. If a country such as the United States were to get serious about rolling out such tech, it would be a game changer.” All of this focus on the security of election systems means that there are “more people checking stuff.” The question now is who is putting in more resources -- the attackers or the people doing the checking. [Image by Maryland GovPics | Flickr]

October 13, 2016