Cybersecurity

Earlier this week, the Federal Election Commission (FEC) issued two draft advisory opinions in response to a request from Area 1 Security, a cybersecurity company proposing to offer free or reduced-cost phishing solutions to federal candidates and political committees.

Both opinions deemed that Area 1's proposal would be a violation of the Federal Election Campaign Act, which prohibits corporations from making contributions to federal candidates, political parties or political committees. In other words, new cyber threats don't necessarily trump old laws.

Charles Spies, the leader of the political law practice at Clark Hill, said that while FEC commissioners have made cybersecurity a priority and are more likely to show leeway to products that can offer some relief, they are still bound by the parameters of the Federal Election Campaign Act.

“The FEC has to balance the plain language of its statute and regulations, which prohibit corporations from making contributions to campaigns, versus the unique circumstances of preventing cybersecurity breaches and potentially widespread distribution of a product,” Spies said.

Complicating matters further is the unique pricing structure that Area 1 deploys. According to Kate Belinski, a partner practicing political and election law at Ballard Spahr, corporations have to offer their services to campaigns at the normal charge—otherwise, whatever the price differential amounts to might be deemed a contribution.

But Area 1's prices can vary from case to case. As laid out by Draft B of the FEC's advisory opinion, the company either utilizes a “pay-per-phish” model or incorporates a four-factor pricing model that looks at, among other things, a client's financial resources and the potential longevity of the client relationship to determine pricing.

“That does present a problem because if there is no usual normal charge then it's difficult for the FEC to evaluate whether candidates are essentially getting an in-kind contribution from this company,” Belinski said.

Another prong identified among Area 1's four-factor pricing model—the “special feeling of pride” the company would feel in servicing client—also adds a potential wrinkle of its own to the proceedings. Per Draft B, the company is asserting that it would benefit internally from the pride of tackling a “high-visibility problem,” which would increase Area 1 employees' motivation and make them “happier and more productive.”

Area 1 also argues that it would learn from the experience since federal candidates and political committees are “aggressively targeted” by actors using methods that are potentially “highly developed.” But for the FEC, those arguments may stray too far from the Area 1's core business.

Last August, the Commission issues an advisory opinion approving a request from Microsoft to provide an “enhanced online security services” bundle termed “AccountGuard” to existing “election sensitive” customers— including federal candidates and national party committees — at no extra charge. The proposed services ran the gamut from security webinars to Microsoft investigating in the event that individual Office 365, Outlook.com or Hotmail.com accounts were targeted or breached by a nation-state actor.

Microsoft's success with the FEC may have ultimately boiled down to its ability to frame the request based on “commercial and not political considerations,” according to the advisory opinion. The FEC's saw “AccountGuard” as something that was integral to the company's core business. Basically, if any of Microsoft's users are hacked, it reflects poorly on the company as a whole.

“That was important to the FEC. Microsoft articulated commercial and business issues related to its brand and the integrity of its product. Those and other factors, in the FEC's estimation, were a sufficient commercial justification,” said Caleb Burns, a partner who specializes in campaign finance law at Wiley Rein.

Still, determining what will sway the tide of electoral votes isn't an exact science. Burns argues there are many factors that can influence an election. He pointed to a long line of FEC advisory opinions interpreting the phrase 'influence an election' in the absolute sense, rather than when influence is exerted for one side over the other— which is potentially too broad a reading.

“At the end of the day, I think this advisory decision demonstrates that the FEC's historic interpretation of whether activity will 'influence an election' is faulty and probably not what the statute intended,” Burns said.