Wednesday, October 5, 2016

Honda’s past campaign suspected Khanna was phishing their emails

Rep. Mike Honda and Ro Khanna will face each
other in a rematch this November.
Rep. Mike Honda's previous congressional campaign believed Ro Khanna may have been trying to gain access to their emails, according to a 2013 campaign memo. The technique, called “spear phishing,” is often used to dupe users into handing over access to their email accounts.

Featuring the subject line, “Phishing E-Mails from Ro Khanna,” then-Honda political director Lamar Heystek suspected he and his staff were being spear phished by Khanna’s personal email. The mass email, sent Jan. 31, 2013, also suggested campaign staffers follow his lead and change their passwords. A screenshot of the suspected email list shows Khanna’s personal email and asks whether or not Khanna is their friend. The email then asks users to click yes or no.

Honda's campaign, at the very least, suspected Khanna was
phishing their emails, according to this January 2013 memo.
The query is a hallmark of spear phishing that often attempts to put targets at ease, for example, by using a name familiar to the person, in order to continue their interaction with the malware. If a user clicks either yes or no, the phishing site can then pursue their entire contacts list with similar bait.

The possibility or even the suspicion in 2013 that Khanna’s team was using unorthodox cyber techniques should receive renewed scrutiny following a lawsuit filed by Honda’s campaign Sept. 22 against Khanna and his campaign manager for, among other allegations, repeatedly accessing a Dropbox account that contained confidential donor information belonging to the Honda campaign. Honda campaign manager Michael Beckendorf called the alleged incident a "modern-day Watergate."

The timeline is consistent with the lawsuit that alleges Brian Parvizshahi, Khanna’s campaign manager began accessing information from the account starting in early 2013. Parvizshahi first gained access while serving as a summer intern in 2012 for the fundraising consultant used by the Honda campaign. However, according to the lawsuit, the firm never revoked Parvizshahi’s password and it is alleged log-in information shows he periodically gained access to the account from February 2013 to June 2015. Parvizshahi resigned Sept. 22.

Khanna, following a town hall in Fremont just hours the Honda lawsuit was announced, denied his campaign engaged in so-called “spear-phishing” techniques during the 2014 congressional election cycle. Khanna, himself, could have unknowingly put his own email contacts at risk by interacting with a separate spear-phishing attempt, provided someone on the Honda campaign was on his list of contacts.

However, there could be another strange twist in this increasingly sordid congressional race. Khanna’s campaign chair Steve Spinner, one of the most influential bundlers in all of Democratic Party politics, unveiled with great fanfare a software program called RevUp, which essentially acts in a similar way to the spear-phishing model, asking users to allow their email contacts to be mined as potential future donors.

The program described in Bloomberg Businessweek earlier this year, aims to revolutionize the painstaking, much-disliked process candidates must go through for tracking down potential campaign contributors and asking for their donations. The main difference is that RevUp obtains access to email contacts in a transparent manner.

RevUp’s algorithm, however, is highly invasive and drills down into the potential donor’s personal history—using a host of public and private records—to discern with purported high accuracy whether they are likely donors. RevUp's pitch is this: Less time is spent identifying contributors along with a higher success rate for extracting campaign donations. Khanna acknowledges his campaign currently uses RevUp.

Furthermore, the use of RevUp in tandem with Parvizshahi’s alleged access to confidential Honda fundraising data, if proven it indeed occurred, could shed new light on just how valuable those records may have become, allowing Khanna’s campaign a straight-line road map to possible donors.

Honda’s campaign, meanwhile, has been reticent in responding to questions about Heystek's phishing email to staffers in 2013, along with Spinner’s potential involvement. One reason may be that Honda, long a loyal Democratic Party stalwart, doesn’t want to be viewed as criticizing a significant cash cow like Spinner, who has strong personal ties to President Obama and Hillary Clinton. Spinner's influence is unrivaled after raising tens of millions of dollars for the national party over the years. For instance, a day before the Honda lawsuit was announced late last month, Spinner held a fundraiser at his Atherton home for Democratic vice presidential nominee Tim Kaine. costing participants up to $33,400 a person.


First off, we’re talking January 2013 ... isn’t that months before Khanna even had a campaign? There wasn’t even a “Khanna team” at that point! He started his campaign in April 2013. And this yet-to-be-formed team (and don’t blame it on Parvizshahi, he wasn’t even around until January 2014) was putting “spear phishing” at the top of the ‘’things to do” list? Wow, that’s pretty dubious.

More importantly, so this “suspicion” of phishing was raised by Honda staffer Lamar Heystek? Name sounds familiar. Oh yeah, he’s Honda’s former campaign manager/political director. Remember those February 2013 email exchanges between Heystek and Honda’s chief of staff, Jennifer Van der Heide, discussing potential donors who Honda’s office might invite to an official State Department roundtable discussion that he co-hosted on February 21, 2013? Emails that were written around the same time as the January 31 email cited in this article? Emails that targeted potential Khanna donors (that Honda recently swore under oath that he didn’t do)? Emails that contributed to a finding by the Office of Congressional Ethics that there was “substantial reason to believe that Representative Honda improperly tied official events to past or potential campaign or political support?” Yeah, those emails and that guy!

Yeah, let’s trust the “suspicions” of the guy who was involved in the genesis of Honda’s ethics scandal to form the basis for an article 3 ½ years later.

Sorry Steve, there’s no there there. “Pay to play” doesn’t pay.

Honda Ethics report:

A Senate campaign sent me the Bloomberg article a few months ago, and after I read it I was pretty excited by RevUp's potential. It sounded like it could be really helpful to organizations trying desperately to raise much needed funds.

I then had a chance recently to use RevUp to help fundraise for that same Dem candidate and found it super easy and helpful. So when I saw your blog, I was surprised by how you described it (as it's not phishing at all). RevUp is "data analytics". HUGE difference. It provided data to me (e.g., a volunteer fundraiser) of my contacts with my full permission for me to respectfully and efficiently reach out to my friends to make the right ask, at the right time (and NOT bother 99% of everyone else with spam!!!)

What I don't understand is why attack RevUp. We don't go after Google, Facebook or Salesforce cause Schmidt, Sandberg and Benioff are helping Dems. RevUp is helping nearly 100 candidates (majority Dem candidates and committees) with fundraising. In political circles, it is the hottest new technology. Why go after an innovative Silicon Valley start-up, especially one that's helping so many non-profits, universities and candidates? Personally, I can't wait to use it again for my next fundraiser....

So...this isn't about RevUp or about the Pavarishi person (who we should hope will not be railroaded by Honda after being thrown used the bus by Khanna) who is now no longer with the campaign.

It's also interesting to note that this was done before the 2014 Khanna team was put together.

The email address is rokhanna1@gmail.com. That's the one that is at issue in Honda's pending suit and what Khanna uses himself.

If he was involved in phishing, as this document suggests, this was something he was doing himself before his campaign staff was in place.

The question is whether that is actually spear fishing, it may not be but it seems suspicious.

Just saw my first Honda for Congress ad during the 5:00 pm news.
#1, For the 1,000th time he trots out the internment camp video... Does it ever end? Apparently not, because its the first thing in his video.

#2, The ad, plain and simple, just makes him look OLD...simply OLD. I'd say he may lose more votes than votes gained.

He'll have to do much better than the "theme" found in that ad.
Its just a old guy who says he's done some good things in the distant past. Nothing new or fresh.
Waste of money if you ask me.

By way of disclosure, I don't live in the district.

Post a Comment