Gizmodo Under Fire for 'Stunt Hacking' of Trump Officials

Tech website Gizmodo is coming under fire for stunt phishing attacks on Trump administration officials and associates.

The site emailed a fake invitation to view a Google Docs spreadsheet from a Gizmodo email address, with the name of the sender mimicking someone the recipient would know.

If the recipient clicked the link, it would direct them to a document that appeared like a Google sign-in page, asking them to put in their Google credentials.

Gizmodo reported over half the officials connected to the Trump administration clicked on the link – though no personal information was collected.

The faux phishing attack was aimed at 15 people, including White House press secretary Sean Spicer, former FBI Director James Comey, senior adviser to the president Stephen Miller, deputy assistant to the president Sebastian Gorka, White House adviser Peter Thiel, White House cybersecurity adviser Rudy Giuliani and informal adviser to the president Newt Gingrich, The Hill reported.

A senior counsel for The Constitution Project was outraged.

At a minimum @Gizmodo should have anonymized who it was faux-phishing. The more I look at this the more clear it was grossly irresponsible

— 🤔Jake Laperruque😒 (@JakeLaperruque) May 9, 2017

"I'm less concerned about it encouraging copycats in the form of actual malicious hacks — hopefully illegality would discourage that — but am very worried that this will lead to efforts that list out public figures that seem vulnerable to hacking," Laperrugue told The Hill.

"That would create serious cybersecurity risks and expose individuals to malicious hacks. Hopefully this activity will be condemned as seriously irresponsible and not repeated in the future on any scale."

Though Gizmodo claimed it offered disclaimers throughout the test "for careful readers" to notice it was a stunt hacking, one critic called the test pointless.

"The fact that half of their targets fell for the ruse isn't shocking," Markus Jakobsson, the chief scientist for Agari, a internet company that aims to eliminate email cyber attacks, wrote in a blog post Wednesday. "It doesn't show that the Trump administration is negligent or clueless.

"The administration, simply, is made up of people, and this is what people do. For those who think we should hold the victims accountable for their actions, I have one piece of advice: give it a rest. That might have been possible five years ago, before the level of sophistication of email attacks rose to the current level."

• Google Users Sent Phishing Emails to Open Shared Document
• Macron Campaign Says It Fought off Cyberespionage Attempts