Gizmodo went phishing with the Trump team—will they catch a charge?

Earlier this week, the team at Gizmodo's Special Projects Desk published a report on how they "phished" members of the administration and campaign teams of President Donald Trump. Gizmodo identified 15 prominent figures on Trump's team and sent e-mails to each posing as friends, family members, or associates containing a faked Google Docs link.

"This was a test of how public officials in an administration whose president has been highly critical of the security failures of the DNC stand up to the sort of techniques that hackers use to penetrate networks," said John Cook, executive editor of Gizmodo's Special Projects Desk, in an e-mail conversation with Ars. Gizmodo targeted some marquee names connected to the Trump administration, including Newt Gingrich, Peter Thiel, (now-ex) FBI director James Comey, FCC chairman Ajit Pai, White House press secretary Sean Spicer, presidential advisor Sebastian Gorka, and the administration's chief policymakers for cybersecurity.

The test didn't appear to prove much. Gingrich and Comey responded to the e-mail questioning its provenance. And while about half of the targeted officials may have clicked the link—eight devices' IP addresses were recorded accessing the linked test page—none entered their login credentials. The test could not determine whose devices clicked on the link.

What the test did manage to do is raise the eyebrows of security experts and some legal experts. That's because despite their efforts to make it "reasonably" apparent that this was a test, Gizmodo's phishing campaign may have violated several laws, ignoring many of the restrictions usually placed on similar tests by penetration-testing and security firms. At a minimum, Gizmodo danced along the edges of the Computer Fraud and Abuse Act (CFAA).

Hold my beer

To violate the CFAA, Gizmodo would have to have intentionally accessed a computer without authorization or exceeded "authorized access" to obtain information from a "protected computer." The definition of "access" (and even "computer") is much broader than how most people would typically think of them under the law, so conceivably anything that returned information from a computer—a webpage with scripts that run in the computer's Web browser, for example—could be considered "access" under some circumstances.

Gizmodo took some steps to stay within the law. "The system we devised for this project disclosed to the subjects that it was a Gizmodo Media Group test at every stage," said Cook. "The initial e-mail and the log-in page that the e-mail linked to both contained disclosures. We designed the log-in page so that, if a subject entered any credentials, no passwords could be viewed, accessed, intercepted, or retained in any way. We would know if they entered any characters in the password field, but not which characters. In the [test], no subjects entered any credentials."

The test itself consisted of the targeted e-mail—using the name of someone each target knew, but with a return e-mail address of security.test@gizmodomedia.com. "At no point did we access any servers or data without authorization," Cook asserted.

But those measures may not have been enough to protect Gizmodo from a law enforcement investigation or potential prosecution.

Joshua Rosenblatt, a Baltimore-based attorney with a law-enforcement background recently spoke on the legal risks of penetration testing in a session at BSides Charm City in Baltimore (in a session entitled "I Went Phishing and I Caught a Charge"). He explained to Ars that even though Gizmodo may have not violated the letter of the law in the CFAA, "it's reasonable for the government to believe that the CFAA was violated under these circumstances."

That "reasonableness" is an invitation for the government to investigate Gizmodo, Rosenblatt explained, "which is hardly to Gizmodo's benefit—[though] the government's probably not thrilled at the prospect of investigating a media outlet either."

The Gizmodo test was constructed "in hopes that a top-level government official would try to hand over their Google account credentials," Rosenblatt explained. "If Gizmodo had succeeded in this, the situation would be much different. Because at that point, it looks to the government like Gizmodo was given the keys to some very sensitive information—even unclassified information can still impact security."

And while Gizmodo's test was set up only to "register" individuals who had tried to log in to the test's spoofed Google login, "it would be unreasonable for the government to rely on the word of someone who just phished top-level government officials," Rosenblatt said, "especially when Gizmodo could be well-meaning but wrong—it turns out that information security is actually more complicated than tends to be expected. Who knew?"

Phishing for trouble

Rosenblatt explained that there were a number of key questions that would need to be asked to determine if the test had truly stayed outside of the scope of the CFAA:

On the "access" and "obtaining information" side:

• How did they track click-throughs?
• Individualized websites/hyperlinks?
• Planting cookies?
• PHP/other scripts?

On the "exceeding access":

• How was the e-mail sent?
• Website directed? Browser used?
• Did they violate any terms of service to do so? That can be a killer in certain jurisdictions.

Mark Jaffe, who represented Andrew "weev" Auernheimer in his CFAA prosecution, agreed that the government could use the test as an excuse for investigation and potential prosecution. "All it took to motivate the government to bring a prosecution [against Auernheimer] was a list of e-mails published by Gizmodo's predecessor," Jaffe said. "Usually, the government prosecutes CFAA cases "because of a bad result, a bad actor, or an aggressive (usually) corporate victim," but he added, "If the government wants to get creative, it will. Unfortunately, I think the government would go after the media if it wanted to."

Jaffe said that some of the elements of the Gizmodo phishing project were "consistent with the broadest interpretations of the CFAA we've seen." The use of false names in e-mail headers may have violated the terms of use of the e-mail provider, he explained. (Gizmodo hosts its e-mail with Google.) "We've seen prosecutions based on violations on terms of service, alleging [that] it's access to protected computer without access. And the circumstances of obtaining the personal information from others, using a false name, could reach the most broad interpretations under the CFAA."

Jaffe said that he didn't believe that there should be criminal prosecution "as a result of this kind of experiment"—particularly since no passwords appear to have been acquired. "But I think that when prosecutors are motivated and creative, any kind of deceptive or 'bad' behavior on a computer can lead to investigations under the vague and overbroad CFAA."

Rosenblatt said he believed CFAA charges were unlikely—largely because Gizmodo's phishing experiment didn't go very far. "Based on their article," he said, "it's not clear that Gizmodo could be criminally charged for a CFAA violation. But that's mostly because their phish appears to have been far less effective than they seem to have anticipated or hoped. According to them, nobody tried to sign in to the fake Google sign-in page that they set up. And so there's less of a claim that 'information' was obtained."

But wait! There's more

But avoiding the CFAA's statutes doesn't mean Gizmodo's test is in the clear. The second issue raised by both Jaffe and Rosenblatt is that the CFAA is only one of a host of laws at the federal, state, and local levels that could be brought to bear.

Jaffe noted that while he couldn't recall any CFAA cases based solely on phishing, "there have been some federal civil actions, and states have specific anti-phishing laws."

"The CFAA isn't the only computer crime out there, and the federal government isn't the only one with a vested interest in preventing phishing attacks," Rosenblatt explained. "There are a multitude of crimes at both the state and federal levels, including identity fraud, falsified e-mail headers, attempting to obtain personal information by deception, etc. And given the variety of state laws and the number of targets involved here, there's a strong probability that this unsolicited phish violated a criminal law somewhere in the country." For example, Maryland's identity fraud laws have some significant implications when it comes to phishing.

The Gizmodo team acknowledged that they used deceptive means (using the names of targets' acquaintances in the "from" field of the e-mails) to obtain at least some information.

One of the justifications Gizmodo gave for the legality of the test was that a "careful reader" could have known that it was a phish. "'Disclaimers for careful readers' is not how consent works," Rosenblatt said. "Walking up to someone and saying, 'phishingtargetsayswhat' is not a valid way to gain consent."

For example, Rosenblatt explained, if an airline's ticket had fine print at the bottom that said the ticket was good for only half the flight—at which point passengers would be ejected from the aircraft— "an airline would have a difficult time trying to justify in court its mass-ejection policy on the basis that a 'careful reader' would have known to bring a parachute."

Gizmodo also defended the test in the article by equating it to the sorts of tests done by security professionals. "The existence of boxing doesn't make it legal to punch anyone you see," Rosenblatt said. "Red-teaming without consent is like walking down the street punching people in the chest to warn them to keep their guard up. Maybe you're making a good point that will help people, but you've still 100% broken the law and can't be upset when the cops come looking for you."