CYBERSECURITY THREAT
Toomey’s campaign is latest target of political email hacking.
CQ-Roll Call
WASHINGTON — Sen. Pat Toomey, R-Pa., is the latest U.S. politician to announce his campaign was the target of an attempt to hack into its emails.
Google notified Mr. Toomey’s office that “hackers from a nation state may have attempted to infiltrate specific email accounts associated with his campaign apparatus” through a phishing scam, Steve Kelly, a spokesman for the Pennsylvania Republican, said in a statement.
“This underscores the cybersecurity threats our government, campaigns, and elections are currently facing,” Mr. Kelly said. “It is essential that Congress impose tough penalties on any entity that undermines our institutions.” The attacks were not successful. Mr. Toomey’s Senate office has not been the target of similar hacking attempts.
Google has not elaborated on the basis of its claim that the hackers may have had ties to a nation-state.
Mr. Toomey’s campaign is an odd target for an email phishing attack since he isn’t up for re-election until 2022. He folded up his campaign shortly after winning a second term in 2016.
The email accounts that were targeted are “dormant,” Mr. Kelly said, and “haven’t been active in over a year.”
Mr. Toomey’s staff was only made aware of the phishing attempt after the campaign’s email administrator received a message from Google about the attack and relayed it to Mr. Toomey’s chief of staff.
Mr. Toomey isn’t the only senator targeted by attempts to infiltrate his email network. Russia-based GRU, the Kremlin-linked intelligence agency responsible for hacking Democratic National Committee emails in 2016, unsuccessfully attempted a phishing scam on Sen. Claire McCaskill, DMo., in February.
Sen. Jeanne Shaheen, DN.H., has also been targeted by phishers.
The FBI and Senate sergeant at arms are still working to determine the perpetrators of the attacks on Ms. Shaheen.
The episodes have forced senators to reckon with their security measures in place.
While House staffers are required to take a training course on cybersecurity, their colleagues in the Senate are not.
The sergeant at arms is in charge of many of the technical support services and offers regular cyber awareness trainings to staff in lawmakers’ offices, on committees and back home in the states. Sergeant-at-Arms Michael Stenger said in May the SAA had hosted 52 such seminars since the start of 2017.
But there are thousands of users with access to the Senate networks, and policies vary among offices. Turnover, including thousands of interns cycling through each year, makes enforcement of a blanket security policy a challenge.
Both Republicans and Democrats indicated last month they have work to do to ensure attacks are not successful in the future.
“The cybersecurity threat is very real, and frankly we haven’t stepped up and done what I think we should do to deal with it — which should be an all government response,” Senate Majority Whip John Cornyn, RTexas, said in July.