Chamber of Secrets: How the U.S. Business Group May Have Plotted Dirty Tricks

One thing I'd like to know about the shadowy plot that appears to link the U.S. Chamber of Commerce to a covert "dirty tricks" campaign against its critics: When will the FBI get involved?

Certainly there appears to be cause. The Chamber denies involvement with three IT firms -- Berico Technologies, HBGary Federal and Palantir Technologies -- accused of developing the plan, while it's not yet clear if any laws were broken. Yet details emerging in the case indicate a plot to spy on, intimidate and discredit targets including the Service Employees International Union, liberal think-tank the Center for American Progress, political advocacy group MoveOn.org and Salon blogger Glenn Greenwald.

ThinkProgress, the CAP blog that broke the story and an alleged target of the plot, has produced email evidence suggesting that the Chamber was in contact with the security firms regarding their plan to undermine opponents of the trade group. The Chamber reportedly enlisted law firm Hunton & Williams last fall to explore ways to strike out at the progressive groups. Hunton & Williams, a major corporate lobbyist in Washington that has previously represented the trade group in other matters, solicited the tech firms, codenamed "Team Themis," for help developing specific ideas to further the plan.

According to ThinkProgress:

The core proposals called for snooping on the families of progressive activists, creating phony identities to penetrate progressive organizations, creating bots to "scrape" social media for information, and submitting fake documents to Chamber opponents as a false flag trick to discredit progressive organizations.

In addition to the Team Themis plans that ThinkProgress and other outlets have reported on, a closer look at the proposals show that the firms had planned to use exploits to steal information from the Chamber's opponents, or worse.

Themis also proposed using "malware" to hack into U.S. Chamber Watch in order to extract information and generally keep tabs on the site. One leaked email from HBGary Federal, one of the firms allegedly recruited to execute the attacks, details how Themis was considering using social media to infiltrate the computers of CoC foes:

Even the most restrictive and security conscious of persons can be exploited. Through the targeting and information reconnaissance phase, a person's hometown and high school will be revealed. An adversary can Create a classmates.com account at the same high school and year and find out people you went to high school with that do not have Facebook accounts, then create the account and send a friend request. Under the mutual friend decision, which is where most people can be exploited, an Adversary can look at a targets friend list if it is exposed and find a targets most socially promiscuous friends, the ones that have over 300-500 friends, friend them to develop mutual friends before sending a friend request to the target.

To that end friend's accounts can be compromised and used to post malicious material to a targets wall. When choosing to participate in social media an individual is only as Protected as his/her weakest friend. Once an adversary has gotten inside a targets social circle he/she can post links, videos, other media content that will be posted to the targets wall that contain Malicious links to exploit whatever system the target is on. If the target is accessing Facebook from work then the work system is compromised.

Hunton & Williams seems to have been collecting information about the SEIU, according to data I received from the labor group, a persistent critic of the Chamber. Law firm staff spent 20 hours on SEIU Web sites on Nov. 10, the same time that Hunton & Williams was collaborating with Themis on the plan targeting Chamber opponents. In January and February, staff from the firm spent an additional 76 hours on SEIU sites.

Seemingly among Hunton & Williams's areas of interest was Cleanupsodexo.org, an SEIU-sponsored site focusing on food and facilities company Sodexo, a client of the law firm and a Chamber member. The union has accused Sodexo of abusing its workers, mishandling government contracts and other problems. Site data shows that Hunton & Williams "systematically reviewed" Cleanupsodexo and searched for information related to the group's staff, according to the SEIU. The labor group is now investigating whether its computer systems may have been breached, a process I was told would take several days.

SEIU: Follow the money
Did such intensive scrutiny constitute standard "opposition research," or something darker? After all, lobbying firms routinely keep dossiers on lots of organizations. It's hard to say at this stage. But the timing and Hunton & Williams' work with the security firms is suspicious, and certainly cause for an independent investigation. Said SEIU communications director Inga Skippings in a statement:

Two obvious questions are why did Hunton & Williams employees spend 20 hours on our site, and who was paying them to do it? It is difficult to believe that the Chamber would pay Hunton & Williams for research that it did not know about. The most obvious explanation is that the "black ops" work was already underway when the documents were leaked.

Time to bring in the feds to figure out what's going on and whether others may have been targeted.

Thumbnail from Flickr user Hello Turkey Toe
Related:

• Why Business Should be Embarrassed by the U.S. Chamber of Commerce
• Corporate Interests Rev Up Campaign Against Financial Reform
• Koch Industries: Behind the Fight to Gut the EPA