Political campaigns, outside of the States, are very much bootstrapped. And IT folks very much not minded to volunteer their time.
Citation: I'm a member of a European Parliament on his third term in politics. Of my 200+ volunteers, not one is in infosec. Within my party, maybe 60 staff total are paid for a campaign.
You're conflating parliamentary budget and staff with a campaign budget and staff. These documents came from his campaign, not a parliamentary office (be it EU or French). For obvious reasons the two don't mix. Campaigns generally operate on extremely restricted budgets, and are naturally transient in nature.
I think you just confused "a European Parliament" (that is, a national parliament in Europe) with "the European Parliament", which is a different thing altogether.
And then also confused an MP (or, in your interpretation, MEP) not having any infosec staff with the whole government (or EU) not having infosec staff.
But then, even with all that, your conclusion isn't all that wrong for the topic at hand; if a major power like Russia targets a particular politician in the West (perhaps aside from the official, rather than campaign, personality of the sitting head of state), there is likely to be a substantial resource asymmetry that favors the attacker.
No, he is saying that he is a member of a parliament. The lower house of the Irish parliament to be exact [0].
Might just be because the EU is a trade block, it doesn't have secretive military and intelligence institutions because it doesn't have any military and intelligence institutions at all.
Better let INTCEN, SIAC, SitCen, EUFOR and EUNAVFOR know that.
The EU is absolutely far, far more than a trade block.
In fact in France there is a general contempt from the political class and the medias for any candidate who is not a literary person.
At the level of Hillary and Macron, the money is there. If infosec people don't volunteer, they will need to be paid for, even if it means running less television ads or what not. Even in Europe campaigns have paid staff. It might mean cuts to something else, but is it worth skimping on security?
As an aside, I'm from the US and have never heard of a campaign looking for infosec volunteers. Are we sure no one would volunteer?
Wonders never cease.
Get real.
edit: Considering the response perhaps I should qualify. The major parties in most developed countries have permanent election teams with multi-million pound budgets. I cannot see why my response is in any way controversial.
edit: Regarding this...
> The major parties in all developed countries have permanent election teams with many multi-million pound budgets.
That's very likely. However, the bursty nature of elections means they're probably also onboarding thousands of volunteers and temporary staff in a very short period of time.
This is an ignorant statement. The many millions of hours of work freely given to producing, maintaining and supporting users of software licensed under Free Software [1] licenses shows it's not true.
I suspect it's just that ‘IT folks’ tend to be cynical about most political parties. So they would want to be paid for any work done for such outfits rather than doing it pro bono.
I'd suggest that politicians who expect they can get such work done for free are the ones who need to “get real”.
Um, yeah, they've thought of that (and have been told that 10,000 times) already.
Just that it turns out these organizations -- and the threat models they face -- are a bit more complicated than you would seem to think. And the task of finding qualified and, crucially, trustworthy people who can also interface with the sprawling, chaotic, and (inherently) politicized juggernauts that underlie these campaigns, even more so.
won't be able to do anything
That's some pretty crude hyperbole (as I'm sure you're already aware).
Accounts are checked after each elections by the National Commission on Campaign Accounts and Political Financing; it is an active check, as some of the previous campaigns refunds were blocked because of some wrong doing.
More details available on Wikipedia (translated from FR): https://translate.google.fr/translate?sl=fr&tl=en&js=y&prev=...
Source (in French): http://www.zdnet.fr/actualites/lection-presidentielle-l-anss...
The weird thing I've noticed is that some people in my country will express your sentiment, but then turn around and tell you they live in the best country in the world and would be offended were anyone to say otherwise.
I guess they don't see the connection between the government workers and that quality of life.
They are often just dealing with out of date processes that are mandated by law and which limit their ability to be innovative.
https://www.vox.com/policy-and-politics/2016/10/28/13456368/...
"Seemingly skeptical (and rightfully so), Podesta forwarded the email to his chief of staff, who then passed along the email to the campaign’s IT team. This is where things go so painfully wrong: The campaign’s IT team incorrectly identified the email phishing for Podesta’s password as legitimate, instructing him to change his password."
The phishing email claims to be from from Google support, and tells the user:
> CHANGE PASSWORD: <https://bit.ly/[deleted]>
That should be enough red flags. Also, the bitly address expands to one in the domain, myaccount.google.com-securitysettingpage.tk
If you visit the stats page for that bitly link by adding a + to the end, you'll find that it was visited exactly twice, both visits at the right time for the hack, and you'll find that the Wikileaks data cuts off soon after the hack, probably when they set up 2FA as suggested. While that doesn't technically prove that they're related, it's better evidence than we have for any other theories.
Sources:
Bitly stats page: https://bitly.com/1PibSU0+
Phishing email: https://wikileaks.org/podesta-emails/emailid/34899
This is my source: https://motherboard.vice.com/en_us/article/how-hackers-broke...
Also, I learned recently that Clinton didn't know how to use a personal computer. Nobody on her staff could take the time to teach her the basics.
People basically treat their laptops as glorified thin clients nowadays.
Obama campaign had a contract firm that implemented and enforced infosec. They even tossed USB keys in the parking lot to catch campaign workers that we're dumb enough to try them.
The problem is beyond rote security at this point. We're in the realm of talented, well financed threat actors with databases of 0days.
State actors
You would think they would want to hire a few professional, highly qualified NetSec sysadmins and give them authority to enforce network, server and endpoint security policies over an organization as a whole. But nope.
DNC is a fine example of failing to prioritize network security.
edit: I mean it's not exactly rocket science in terms of recruiting. Find a person who would be qualified by their years of experience and proven track record to be the chief security officer at an organization the size of cloudflare, limelight or netflix (or similar) and offer them a job at an equally high salary. Pay relocation and COLA expenses.