A Cyber Look at the 2017 National Defense Authorization Act

On December 23, 2016, President Obama signed into law the National Defense Authorization Act for Fiscal Year 2017, authorizing $611 (or $619) Billion dollars primarily for the Department of Defense. While the left leaners are focusing on the inclusion of the anti-propaganda (we'll talk about this in its proper place - if you are in a hurry, you can jump there by clicking Section 1287, the Global Engagement Center), we're going to take a holistic view of the Cyber Stuff found in the 969 page appropriations bill. As an academic who runs a research center focused on cyber security and cyber crime, please forgive me if I also include some of the R & D and Education stuff that may be more workforce development focused rather than "pure cyber."

The Act is divided into five Divisions. We'll focus on a few sub-titles within those divisions, which I'll place for you here. I'll certainly get lazy and abbreviate, so feel free to refer to the full text of National Defense Authorization Act as signed for "official wording":

• Division A - Department of Defense Authorizations
  
  • Title V - Military Personnel Policy
    
    • Subtitle A - Officer Personnel Policy
      
      • Sec. 509 - Pilot programs on direct commissions to cyber positions
    • Subtitle F -  National Commission on Military, National, and Public Service
    • Sections 551-557
  • Title IX - DOD Organization and Management
    • Subtitle C -  Joint Chiefs of Staff and Combatant Command Manners
      • Sec 923 - Establishment of unified combatant command for cyber operations
  • Title XI - Civilian Personnel Matters
    • Subtitle A - DOD Matters Generally
      • Sec 1103 - Training for employment personnel of DoD on matters relating to authorities for recruitment and retention at U.S. Cyber Command
      • Sec 1104 - Public-private talent exchange
  • Title XVI - Strategic Programs, Cyber, and Intelligence Matters
    
    • Subtitle C - Cyberspace-related Matters
      
      • Sec1641 - special emergency procurement authority to facility defense against or recovery from cyber attack
        
      • Sec 1643 - Cyber mission forces matters
        
      • Sec 1644 - requirement to enter into agreements relating to use of cyber opposition forces
        
      • Sec 1645 - cyber protection support for DoD personnel in positions highly vulnerable to cyber attack
        
      • Sec 1647 - advisory committee on industrial security and industrial base policy
        
      • Sec 1649 - Evaluation of cyber vulnerabilities on F-35 aircraft and support systems
        
      • Sec 1650 - Evaluation of cyber vulnerabilities of DoD critical infrastructure
        
      • Sec 1651 - strategy to incorporate Army reserve component cyber protection teams into DoD cyber mission force
        
      • Sec 1652 - Strategic Plan for DISA
        
      • Sec 1653 - plan for infosec continuous monitoring capability and comply-to-connect policy
        
      • Sec 1654 - reports on deterrence of adversaries in cyberspace
        
      • Sec 1655 - Sense of Congress on cyber resiliency of the networks and communication systems of the National Guard
  • Title XVIII
  • Subtitle E - Improving Cyber Preparedness for Small Business
  • Sec 1841 - Small Business Development Center Cyber Strategy and outreach
  • Sec 1842 - Role of small business development centers in cybersecurity and preparedness
  • Sec 1843 - Additional cybersecurity assistance for small business development centers 
  • TITLE XIX - Department of Homeland Security Coordination
  • Sec 1912 - Cybersecurity strategy for DHS
  • Sec 1913 - EMP and GMD planning, R&D, and protection and preparedness
  
  
  
  
  
• Division B - Military Construction Authorizations
• Division C - Department of Energy National security Authorizations
  
• Division D - Funding Tables
  
• Division E - Uniform Code of Military Justice Reform

Digging in more deeply, we'll give you page numbers to allow you to jump right to the meat of what interests you most . . .



p.70, Sec 240 - Strategy for Improving Electronic and Electromagnetic Spectrum Warfare Capabilities

By April 1, 2017, the Under Secretary for Acquisition, Technology, and Logistics needs to define a strategy in this area, which includes determining how to protect "programs that support or enable cyber operations" from electronic warfare, and describes how to conduct field testing in large-scale simulated exercises, with a budget submitted for 2018 on how to do that.  There already exists an Electronic Warfare Executive Committee thta will oversee this activity.



 p.110, Sec 509 - Pilot Programs on Direct Commissions to Cyber Positions

Each secretary of a military department may carry out a pilot program to recruit cyber professionals who have appropriate educational levels and physical qualifications to serve in the military directly into the ranks at an officer level in a cyber specialty area.  Pilots are authorized to run from Jan 1, 2017 through Dec 31, 2022, with status reports submitted in 2020.



p.131, Subtitle F - National Commission on Military, National, and Public Service

A full review of the military selective service process ("the draft") should be considered, with part of the scope (see 551(b)(3)) being "the feasibility and advisability of modifying the military selective service process in order to obtain for  military, national, and public service individuals with skills for which the Nation has a critical need, without regard to age or sex" -- the skills listed here are "medical, dental, and nursing skills, language skills, and science, technology, engineering, and mathematics (STEM) skills." 

Could this mean in the future that we could be drafting hackers?  And not just for traditional military service!   551(a)(2) says "consider methods to increase participation in military, national, and public service in order to address national security and other public service needs of the Nation."

Those terms are defined in 551(c) as:
"military service" - active service in one of the uniformed services
"national service" - civilian employment in Federal or State government in a field in which the Nation and the public have critical needs.
"public service" - "civilian employment in any non-governmental capacity, including with private for-profit organizations and non-profit organizations (including with appropriate faith-based organizations), that pursues and enhances the common good and meets the needs of communities, the States, or the Nation in sectors related to security, health, care for the elderly, and other areas considered appropriate by the Commission for purposes of this subtitle."

Does that mean I could be drafted to go help a State government secure their network?  or perhaps even helping a small business Defense Industrial Base supplier to get secure?  It's too soon to know, but it is very interesting that such a review is being ordered. Given the budget realities in both categories of employers (states and small DIBs) many companies have "unsecurable" networks unless some outside resource is somehow provided!

The Commission is ordered to produce a report to the President, within 7 months of its commencement, that includes such elements as:
(C)(2)
(A) do we need a draft registration system at this time?
(B) what is the best way of getting our critical skills and abilities personnel needs met for all three target areas -- Military, National, and Private
(C) How do we "foster among [our] youth an increased sense of service and civic responsibility in order to enhance the aquisition by the Nation of critically needed skills through education and training?"
(D) How do we increase willingness of our youth to consider military, national, or public service
(E)  How do we increase interest, education, and employment in our critical fields (including STEM, national security, cyber, linguistics and foreign language, health care and medical professions)
(F) What incentives could be offered to help hire them?




p.272 -  Sec 813 Use of Lowest Price Technically Acceptable Source Selection Process

(C)(1) calls attention to the fact that we are idiots if we send our needs for cyber security to the lowest bidder every time.  (it actually says "information technology services, cybersecurity services, systems engineering and technical assistance services, advanced electronic testing, audit or audit readiness services, or other knowledge-based professional services;"



p. 344 - Sec 902 Responsibilities of the Chief Information Officer of the DoD

(I) makes it clear that the CIO "has the responsibilities for policy, oversight, and guidance for the architecture and programs related to the networking and cyber defense architecture of the Department."  THANK YOU!



p.358 - Sec 923 Establishment of  Unified Combatant Command for Cyber Operations

You are probably thinking "Wait!  We already have a Cyber Command!"  See below Sec. 1642, but basically our currenct Cyber Command is at a lower level than a "Unified Combatant Command" and that is quite significant.  This establishes a general/admiral level Unified Command version of Cyber Command and gives them "The principal function of the command is to prepare cyber operations forces to carry out assigned missions."

Under "(b) Assignment of Forces" it says "Unless otherwise directed by the Secretary of Defense, all active and reserve cyber operation forces of the armed forces stationed in the United States shall be assigned to the cyber command."  BUT . . . any Cyber Operation carried out in any geography will be conducted "under the command of the commander of the unified combatant command in whose geographic area the activity or mission is to be conducted" (unless otherwise directed by the Presidet or the Secretary of Defense.)

Which sounds like, if we are going the cyber equivalent of "guns hot" anywhere in the world, see your standard org chart.  Am I right?  Need the help of mil-speak experts to get this part sorted.

(2)(A) makes the commander of this unit "subject to the authority, direction, and control of the Principal Cyber Advisor" and specifies their scope of operation as:
 (i) Developing strategy, doctrine, and tactics
(ii) Preparing and submitting budget for cyber ops and cyber command
(iii) exercising authority, direction, and control of funds for --
        (I) cyber command
        (II) cyber ops assigned to other unified combatant commands
 (iv) training and certification
(v) conducting specialized courses of instruction for commissioned and noncommissioned officers
(vi) validating requirements
(vii) establishing priorities
(viii) ensuring interoperability of equipment and forces
(ix) formulating and submitting requirements for intelligence support
(x) monitoring promotion of cyber operations forces ...

The "Principal Cyber Advisor" (PCA) is not defined in this bill, but comes from the National Defense Authorization Act of 2014, which established that we should have a Principal Cyber Advisor and that they work in the Office of the Under Secretary of Defense for Policy.  Currently the PCA is Eric Rosenbach, who is also Chief of Staff for the Office of the Secretary of Defense.  His Deputy PCA is Major General Burke E. "Ed" Wilson.  (You may know Mr. Rosenbach as the author of "Find, Fix, Finish: Inside the Counterterrorism Campaigns that Killed bin Laden and Devastated Al Qaeda").


p. 445 -  Sec 1103 - Training for employment personnel of DoD on matters related to authorities for recruitment and retention at U.S. Cyber Command

This section says:
If you're an HR person or a supervisor in the Cyber Command, you really ought to know enough about what Cyber people do so that you don't mess up the new Command by hiring bumbling idiots who happen to be able to check all the right cyber-sounding boxes."  (That is not an exact quote.)  Have to say, I'm a big fan of this section!



p. 446 - Sec. 1104 - Public-Private Talent Exchange

"The Secretary of Defense may, with the agreement of a private-sector organization and the consent of the employee, arrange for the temporary assignment of an employee to such private-sector organization, or from such private-sector organization to a DoD organization."

I can see HUGE benefits both ways here ... I can imagine that Cyber Command may want to put someone in a Silicon Valley or well-run Financial Services company to learn how they deal with risk at scale.  At the same time, there may be a private-sector company who faces a risk they can't possibly understand without being brought "in house" and shown some things from a DoD perspective that could really cause a near-miraculous advance in the sponsoring company's ability to defend their company or sector from nation-state actors.

It looks like they have the right hooks in ... including that after a DoD person does a stint in a private sector company, they have to serve at least twice that length of time back in DoD.  The DoD person also counts the time served as government service for purposes of benefits and promotion. The personnel swap can be for periods of three months to two years, renewable for a total of up to four years.



p.448 - Sec. 1105 - Temporary and Term Appointments in the Competitive Service in the DoD & Sec 1106 - Direct-Hire Authority for the DoD for Post-Secondary Students and Recent Graduates

Section 1105 establishes that if the only way to fill a critical skill is to offer someone non-standard government pay, the SecDef has the ability to do that.

Section 1106 says the SecDef can direct hire up to 15% of their total hires for professional and administrative occupations at GS-11 or below, including people who are currently enrolled as full-time students who have completed at least one year towards a degree.



p. 457 - Sec 1124 - Pilot program on Enhanced Pay Authority for Certain Research and Technology positions in the Science and Technology Reinvention Laboratories of the DoD

This section authorizes up to 150% of base salary to be offered to recruit and retain talented researchers to the DoD labs.



p. 488 - Sec 1225 - Modification of Annual report on Military Power of Iran 

Future reports on Iran's Cyber capabilities, should specifically address their propensity and ability to use proxies and other actors to mask their cyber operations, as well as including their ability to attack non-government entities within the US, and how they cooperate and use assistance from other state and non-state actors.



p. 560 - Sec 1292 - Enhancing Defense and Security Cooperation with India

(E) we agree to "collaborate with the Government of India to develop mutually agreeable mechanisms to verify security of defense articles, defense services, and related technology, such as appropriate cyber security and end use monitoring arrangements."



Title XVI - Strategic Programs, Cyber, and Intelligence Matters

p.601 - Sec 1641 - Special Emergency Procurement Authority to Facilitate the Defense Against or Recovery from a Cyber Attack

 The same government code (Title 41 US Code § 1903) that allows us to help companies and citizens in case of a nuclear, biological, chemical, or radiological attack can also be used for cyber attacks.  (See: https://www.law.cornell.edu/uscode/text/41/1903 ).



p.602 - Sec 1642 - Limitation on Termination of Dual-Hat Arrangement for Commander of the United States Cyber Command

Interested parties should go read the original, but this addresses the question of whether the head of U.S. Cyber Command should also be the Director of the NSA, and basically says that the two missions should be linked until such time as U.S. Cyber Command is sufficiently established to be able to fly solo without a sudden and dramatic loss of capability as they try to stand up a non-NSA linked version of Cyber Command.


p.603 - Sec 1643 - Cyber Mission Forces Matters; Sec 1644 - Requirement to Enter into Agreements Relating to Use of Cyber Opposition Forces;

1643 says that To help get the new mission stood up, several waivers of the normal hiring rules are implemented, including Direct Hire Authority for positions up to the GG or GS-15 level.  They also are going to implement an accelerated training program to get the necessary skills implemented for military, civilian, and contractor personnel, as soon as they all agree on what those necessary skills should be.

1644 gives the new unit until September 2017 to establish rules of engagement with each of the other Unified Combatant Commands including how to train and make ready for service any personnel who will be conducting cyber opposition operations.



p.605 - Sec 1645 and Following

1645 says that "At Risk" personnel should be identified and trained in how to use and operate personal electronic devices and accounts in a secure manner.   This could also be known as the "Hey!  Don't use your AOL Account for Government Business!" training.



p.605 - Sec 1646 - Limitation on Full Deployment of Joint Regional Security Stacks

This section refers to a technology being developed by DISA, the Defense Information Systems Agency, that deploys a suite of equipment that handles Firewall, Intrusion Detection and Prevention, Enterprise Management, and Virtual Routing and Forwarding, as well as many network security capabilities.  Each stack also provides the ability to do big data analytics.  There are currently eleven CONUS and five OCONUS sites being developed.  For more details on the program, see the DISA website on the JRSS initiative.  What this section says is that we won't go live with JRSS until all of the proper tests and acceptance checks have been conducted and properly trained personnel are ready to operate the stacks.



p.606 - Sec 1647 - Advisory Committee on Industrial Security and Industrial Base Policy

This committee will meet "at least annually" until 2022 to review the security standards for cleared facilities, especially with regards to information and networking security, including physical security and equipment installation and infosec and cyber defense policies, practices and reporting of incidents.  The committee will have five non-government and five government members.



p.607 - Sec 1649 - Evaluation of Cyber vulnerabilities of F-35 Aircraft and Support Systems

Perhaps the most important part of this section is the call to "Establish Department-wide information repositories to share findings relating to the evaluation and mitigation of cyber vulnerabilities" not just on the F-35 and related support systems, but on all major weapons systems of the DoD.  This section also authorizes the creation of specialty tools and systems to assist in the identification of such vulnerabilities.



p.608 - Sec 1650 - Evaluation of Cyber Vulnerabilities of DoD Critical Infrastructure

This section calls for every base and every military installation to have a thorough review of the identification and mitigation of all cyber vulnerabilities of major weapon systems and critical infrastructure.  The program will work through one of the covered research laboratories to establish a pilot aimed at improving the defense of control systems, increasing the resilience of military installations, and preventing or mitigating high-consequence cyber attacks.  The pilot will also help to inform future requirements for the development of new control systems.   As with Sec 1649, the development of any new required tools is authorized, as is the establishment of information repositories to share DoD-wide findings from these assessments.



p.610 - Sec 1651 - Strategy to Incorporate Army Reserve Component Cyber Protection Teams into DoD Cyber Mission Force

This plan calls for a report to Congress within 180 days on how Army National Guard units can be used to support State and civil operations in National Guard status under USC Title 32.  In many cases the Army National Guard employs people who have cyber security responsibilities, skills and talents as a result of their civilian-time jobs.  This plan received a great deal of attention in the past couple years with headlines such as "Pentagon to Recruit Thousands for Cybersecurity Reserve Force" but this call for a report points to the fact that it is still very unclear what the actual mission would be and how these forces would or could be deployed.  That same article points out that as of late 2015, Cyber Command was still more than 3,000 positions short of their full requested staff.  For more on the 133 "Cyber Teams" that the DoD hopes to fill, see the DoD Special Report on the Three Primary Cyber Missions from defense.gov.  In the DoD Special Report, 68 of the Teams are referred to as Cyber Protection Teams, which, according to the 2015 DoD Cyber Strategy, "will augment traditional defensive measures and defend priority DoD networks and systems against priority threats."


(Skipping here the development of a DISA Strategic Plan)



p.611 - Sec 1653 - Plan for Information Security Continuous Monitoring Capability and Comply-to-Connect Policy: Limitation on Software Licensing

The Comply to Connect policy is a new DoD wide statement that if you are connecting a device to a DoD network, that device and its operator are aware of and agree to comply with all DoD security and licensing policies.  Teeth are added to make sure that .mil stays in compliance with all software licenses through monitoring of the number of stations where software is installed.



p.613 - Sec 1654 - Reports on Deterrence of Adversaries in Cyberspace

Both the President and the Joint Chiefs will have to report to Congress any and all cyber threats by our adversaries and a description of the various military and non-military ways to address those threats, along with the relevant authorities and legal standards that allow such actions.



p. 663 - Sec 1841 - Improving Cyber Preparedness for Small Businesses; Sec 1842 - Role of Small Business Development Centers in Cybersecurity and Preparedness; Sec 1843 - Additional Cybersecurity Assistance for Small Business Development Centers

In a rather unusual directive in the DoD appropriation, Congress calls for the Small Business Administration and the Department of Homeland Security to work collaboratively to develop a cyber strategy for small business development centers "to be known as the Small Business Development Center Cyber Strategy."   In case you are wondering what a Small Business Development Center is, they are defined in 15 USC § 648 - the Small Business Development Center Program.
The program calls for SBDCs to partner with ISACs and similar organizations and unlocks certain DHS funds to help develop training programs to ensure that small businesses are aware of cyber threat indicators and cyber training programs.  (For my Alabama readers, the Alabama Small Business Development Center network has offices at Innovation Depot in Birmingham and many universities across the state.)    In 2016, SBA estimated that $115M in funds would be available for all fifty states.  While the current bill doesn't add more funding directly, it does request that a strategy be created that includes how existing cyber programs at DHS and other Federal agencies could channel existing funds through the SBDCs to maximize impact.  The SBA and DHS have one year to submit their strategy to Congress.  Let's make sure they include the InfraGard program as a resource in that plan!



p.684 - Sec 1912 - Cybersecurity Strategy for the Department of Homeland Security

Congress requires DHS to provide a Cybersecurity strategy that includes consideration of their 2011 cybersecurity strategy, their 2014-2018 DHS Strategic Plan, and the most recent Quadrennial Homeland Security Review (currently that would be the 2014 Quadrennial Homeland Security Review).  The strategy should include how they fulfill section 227 requirements of the Homeland Security Act, their cybersecurity investigations capabilities, their plans for cybersecurity R&D, and their plans for engaging with international cybersecurity partners.  90 days after the strategy, they are to produce for Congress an implementation plan with strategic objectives, projected timelines, and metrics.



p.684 - Sec 1913 - EMP and GMD Planning Research and Development and Protection and Preparedness

There are several natural and man-made risks to our electrical infrastructure.  The new trend is to designate electromagnetic pulses from man-made sources, such as nuclear devices, as EMPs, but to refer to solar storms or other naturally occurring equivalent risks as geomagnetic disturbances (GMD).  The Department of Energy has worked with several electrical groups on plans in these areas, such as the Joint EMP Resilience Strategy published in July 2016 or the September 2016 FERC Reliability Standard for Transmission Systems during GMDs.  In 2010, FERC released a major 197 page study on the cybersecurity impacts a GMD could have called Geomagnetic Storms and their Impacts on the U.S. Power Grid.  The current bill calls for continued R&D in these areas, with regular reporting to Congress as well as the inclusion of such threats in future training and outreach as well as resiliency planning tests and events.



p. 547 - Sec 1287 - Global Engagement Center (Under Title XII - Matters Relating to Foreign Nations, Subtitle H -- Other Matters)

This section orders the Department of State to stand up a "Global Engagement Center" the purpose of which is "to lead, synchronize, and coordinate efforts of the Federal Government to recognize, understand, expose, and counter foreign state and non-state propaganda and disinformation efforts aimed at undermining United States national security interests.

The Center shall carry out the following functions (which I list here in full, due to the high interest):

(1) Integrate interagency and international efforts to track and evaluate counterfactual narratives abroad that threaten the national security interests of the United States and United States allies and partner nations.

(2) Analyze relevant information, data, analysis, and analytics from United States Government agencies, United States allies and partner nations, think tanks, academic institutions, civil society groups, and other nongovernmental organizations.

(3) As needed, support the development and dissemination of fact-based narratives and analysis to counter propaganda and disinformation directed at the United States and United States allies and partner nations.

(4) Identify current and emerging trends in foreign propaganda and disinformation in order to coordinate and shape the development of tactics, techniques, and procedures to expose and refute foreign misinformation and disinformation and proactively promote fact-based narratives and policies to audiences outside the United States.

(5) Facilitate the use of a wide range of technologies and techniques by sharing expertise among Federal departments and agencies, seeking expertise from external sources, and implementing best practices.

(6) Identify gaps in United States capabilities in areas relevant to the purpose of the Center and recommend necessary enhancements or changes.

(7) Identify the countries and populations most susceptible to propaganda and disinformation based on information provided by appropriate interagency entities.

(8) Administer the information access fund established pursuant to subsection (f).

(9) Coordinate with United States allies and partner nations in order to amplify the Center's efforts and avoid duplicatoin.

(10) Maintain, collect, use, and disseminate records (as such term is defined in section 552a(a)(4) of title 5, United States Code) for research and data analysis of foreign state and non-state propaganda and disinformatoin efforts and communications related to public diplomacy efforts intended for foreign audiences. Such research and data analysis shall be reasonably tailored to meet the purposes of this paragraph and shall be carried out with due regard for privacy and civil liberties guidance and oversight.

The bill then goes on to authorize $60,000,000 to be transferred from DoD to State to fund such a Center.

Hillary's Email Server and the New York City malware

Wednesday night (September 30th) I had a strange Tweet in my notifications from a journalist at ForeignPolicy:

Elias explained that he was wanting some quotes in response to a "hyperbolic AP story" by Bradley Klapper, Jack Gillum and Stephen Braun that had posted on the AP wire. (The same story has been posted in the Washington Post, US News & World Report and other top news sources.
The story begins with the opening paragraph:

Russia-linked hackers tried at least five times in August 2011 to trick Hillary Rodham Clinton into infecting her computer systems while she was secretary of state, according to newly released emails from the State Department.

The New York Times version of the story is far more sensational (and far more incorrect) in their telling of the story. Given the victim of all this attention, you would have thought these stories were from Fox News! Here's NYT making up scary security-sounding stuff:

Still, the evidence that Mrs. Clinton's personal account had been on the receiving end of a "spear phishing" attempt, revealed in a batch of her emails released by the State Department on Wednesday, raises the same question the F.B.I. is trying to answer as it combs through the forensic evidence from the server that was once in Mrs. Clinton's basement.

In fact, a disclaimer on the bottom of the NYT news story now reads:

A headline on Friday with an article about Hillary Rodham Clinton's email server overstated what is known about an investigation into the server's security. As the article correctly noted, Mrs. Clinton received spam email that was intended to place malware on her computer network; the investigation has not yet determined that the malware effort was successful.

What Elias did that apparently the AP reporters and the NYT reporters did NOT do was a simple Google search. If they had, they would have seen the story on this blog, dated August 17, 2011, with the headline New York City "Uniform Traffic Ticket" tops spammed malware. The image that accompanied that story, shown below, reveals why the email was turned over to the government:



 As Politico suggests in their story Most Clinton spam messages likely deleted, the workers tasked with finding "work-related" emails to turn over probably started with a few simple rules like "turn over all the emails that are from .gov addresses" -- which would include this spam, which claimed to be from @nyc.gov.

The point of that CyberCrime & Doing Time blog post was to share that this was one of the highest volume spam campaigns we had seen that summer!  Just in the UAB Spam Data Mine, we had received 11,000 copies of this email!  Spear-Phishing, which the New York Times wrongly suggests happened here, is when an email message is personalized to target a particular high-wealth or high value target.  If Hillary Clinton was targeted, so were about 11,000 mostly entirely fictitious people whose spam goes into the UAB Spam Data Mine, as well as a few hundred people who chose to share their emails with us!

What is ChepVil?

It isn't a mystery at all.  In fact, we have that documented in the blog post as well.  The malware is not mysterious at all.  It was part of a "pay-per-install" malware ring that was very popular at that time.  When my lab at UAB reported the malware to VirusTotal, it was detected by 18 of 43 anti-virus programs, with both Microsoft and Sophos detecting the malware and calling it "Chepvil" (Microsoft called it "TrojanDownloader: Win32/Chepvil.N" while Sophos called it "Mal/ChepVil-A" - we were using the name "FraudLoad" for this malware at that time).  You can see that August 17, 2011 VirusTotal report as it looked the day we reported it.  (And you can see in the comment there, also from that day, that we explained the source of the malware and gave a link back to our blog post.)

ChepVil is a type of malware that was heavily based on the BredoLab malware, although by August 2011, the BredoLab original author was already in jail.  Armenian programmer, Georgy Avanesov,  was arrested in October of 2010 when the Dutch High Tech Crime Team police seized 143 servers located at LeaseWeb in the Netherlands that he used to control his world-wide spamming operations.  At the time of his arrest, BredoLab was infecting 3 million computer per month and being used to send approximately 3.6 billion spam messages per day.  Despite this massive seizure, because his source code was already known by other malware criminals, the attacks quickly resumed following his arrest.

The August 17, 2011 version of this malware made a connection back to the Russian domain name sfkdhjnsfjg.ru, (associated with BredoLab, according to Sophos, see for example this Sophos report from August 4, 2011.)

We reported malware communicating to that server to the Microsoft Malware Protection Center on August 11, 2011 -- pointing out that it was hosted on the IP address 195.189.226.103, one of several IP addresses on that same netblock that took turns hosting sfkdhjnsfjg.ru during August 2011, all  hosted in Mykolayiv, Ukraine.   The first time we saw this family of malware communicating with that server was in a big campaign imitating the FBI on May 5, 2011.  The same malware family pretended to be the United Parcel Service on June 9, 2011, sending my lab at UAB more than 54,000 copies of the malware.  We produced a map of the computers that sent us both the May 5 FBI spam and the June 9 UPS spam and shared it with law enforcement at that time:

The point is - it wasn't "targeted" and it wasn't "spear-phishing" and it isn't a "mystery" about how it  came to be sent to Mrs. Clinton.   This wasn't a clever Russian master mind sitting in his evil lair dreaming of taking over the State Department.  One of the millions of spam bots that were part of this network (or actually probably FIVE of them) asked the Command & Control server "Who shall I spam next?" and happened to draw Mrs. Clinton's email address.

But What COULD the Malware Do? 

In August of 2011, the primary thing that Chepvil did was deliver "Fake Anti-Virus" software.  That's it.  The malware would connect to the server and ask "What additional malware would you like to infect me with?"  The server would then see who was currently paying the highest commission to have their malware installed, and whether the daily quota for installing that additional malware had already been fulfilled, and install whatever it was told to install.

In August of 2011 - the only thing we saw Chepvil install was Fake Anti-Virus, and a near cousin "Fake System Alert".  So, *IF* Mrs. Clinton had actually been infected by this malware, it would have caused a pop-up animation to play, claiming she was infected with dozens of nasty viruses, and that she needed to pay the criminals $59 to get rid of the malware.  None of that is true -- the malware is actually just "ScareWare" -- intended to irritate you with pop-up warnings about being infected until you finally give up and pay the "license fee" or have the malware professionally removed from your PC.

The Daily Malware Report

Olivia Foust Vining (now at PhishLabs, Hi Olivia!) was the student malware analyst in my lab who brought this malware to my attention that day in her "Daily Malware Report" (a research project sponsored by UPS!)  By the end of her shift, we had actually seen 45,377 copies of the malware!  Her report gave every 15 minute breakdowns of how many copies we received during the morning hours.

count |        mbox         
-------+---------------------
   326 | 2011-08-17 03:30:00
   264 | 2011-08-17 03:45:00
  1880 | 2011-08-17 04:00:00
   756 | 2011-08-17 04:15:00
  1930 | 2011-08-17 04:30:00
  2608 | 2011-08-17 04:45:00
  5982 | 2011-08-17 05:00:00
  4364 | 2011-08-17 05:15:00
  3544 | 2011-08-17 05:30:00
  2418 | 2011-08-17 05:45:00
  2262 | 2011-08-17 06:00:00
   999 | 2011-08-17 06:15:00
   870 | 2011-08-17 06:30:00
   972 | 2011-08-17 06:45:00
   643 | 2011-08-17 07:00:00
   277 | 2011-08-17 07:15:00
   354 | 2011-08-17 07:30:00
   200 | 2011-08-17 07:45:00
  4571 | 2011-08-17 08:00:00
  3974 | 2011-08-17 08:15:00
  3109 | 2011-08-17 08:30:00
  2047 | 2011-08-17 08:45:00
  1617 | 2011-08-17 09:00:00
(23 rows)

For comparison, here is the count of the other high malware volumes for that day:

count |             md5_hex              
-------+----------------------------------
 45377 | 1c2b06a9fbbea641ae09529e52f29b96 <= the "Uniform traffic ticket" malware
  3484 | e7b48c4421a68740dfd321dade6fd5e6 <= "End of July Statement" malware
  2627 | c1f67a7542359397544bd0af0b546166 <= "Your credit card has been blocked" malware
  1021 | d22eadfda41fcbeb692c600c97d10ff5 <= "Money Transfer Information" malware

But how did Spammers learn Mrs. Clinton's email address?

There are four primary ways that spammers gather email addresses.

The first is specialized software programs that scour the web looking for email addresses on websites.  One of the richest sources of these is actually "archives" of large email lists.  When email lists provide web access to their history, many do so publicly, allowing these scraping tools to learn the email addresses of every person mentioned on the mailing list.  Spammers also JOIN tons of mailing lists to be able to gather the email addresses posted there.

Data dumps are another rich source of email addresses.  Do you recall, for example, the Adobe breach in 2013 when 38 million people who had ever used an email address to register for the free download of Adobe reader or any other Adobe product had their email addresses publicly revealed?  Such events are great days for the spammer community!

Next, we have malware on other people's computers. Many malware programs have as one "module" code that will scan a computer for email addresses.  If even ONE of Hillary's regular correspondents became infected with malware, her email address would have been discovered that way.

Lastly, we have SMTP harvesters.  These programs scan for mail servers, enumerate the domains served by that server, and then begin asking "do you deliver email for al@yourdomain.com? amos@? ann@? ... zach@?" The more intense of these servers will ask for every single letter and number combination, until it has a complete list of the "known" email addresses for the given domain.

So . . . it isn't surprising at all that even "secret" email addresses receive spam.

Thanks, Foreign Policy, for getting it right! 

I was pleasantly surprised by how well Elias Groll handled the details on this story.  He quickly identified the scare-mongering going on over at the AP, and reached out for the facts.  Obviously what I shared above is far too much technical detail for the readers of FP, but I do want to commend the level-headed reporting in their story:

Clinton's Private Emails Show Aides Worried About the Security of Her Correspondence