Associations are Powerful – and therefore Targets for Hackers

Associations are very powerful, particularly in America.

Think about it. Your Doctor is approved by the American Medical Association. Your Attorney is approved by the American BAR association. Your Accountant is approved by the American Association of CPAs (certified public accountants).  A person’s license /certifications may be “recognized” by the government, but ultimately it is a group of peers that form the association.

Americans of all ages, all stations of life, and all types of disposition are forever forming associations… In democratic countries knowledge of how to combine is the mother of all other forms of knowledge; on its progress depends that of all the others.

– Alexis de Tocqueville – Book Two, Chapter V. (source)

This may sound philosophical, and we’ve blogged about this before, but it’s important for associations to remember just how much power they have.  And with power comes great responsibility.


Why? Because it’s logical.

If you were a dictator in a country that had sanctions against it, I dunno, maybe they didn’t allow US Companies to help you drill for your oil reserves and you lacked the technology to do it yourself, wouldn’t it make sense to go after an association of accomplished professionals in that area?

St. Petersburg IP Address Alerts
Security Alerts with  IP addresses (listed as) St. Petersburg Targeting Associations. NOTE: IP Addresses are easy to fake so it could be a false positive.

It sounds horrible, but it is logical in a Machiavellian kind of way.

A story for y’all. I was talking to a client who had a Tendenci Open Source AMS site for a group of students at universities in the liberal arts. He said

nobody is going after English majors“.

“Oh really?” I asked.

Then I asked If any of his students attended X University (really I could have picked any University). He said “yes.” I pointed out that exact University also has extensive Chemistry, Energy and Engineering programs that do cutting edge work.

My point was if you can do spear phishing on a student to get closer to an Engineering Professor with expertise in Directional Drilling, wouldn’t Russia be interested in that? Would North Korea be interested in obtaining information on the latest tech in chemistry? Of course they would.

Those countries might not even be directly doing the hack attempt. But a entrepreneurial hacker knows there is a market for that data. Would Russia buy it? Yes. Would the US buy it? Yes.

My point was simply that if you can infect the computer or phone of one student, any student, then you can get into the network. And then move laterally. You are in.

Again – to the POWER of ASSOCIATIONS:

Americans combine to give fêtes, found seminaries, build churches, distribute books, and send missionaries to the antipodes. Hospitals, prisons, and schools take shape in that way. Finally, if they want to proclaim a truth or propagate some feeling by the encouragement of a great example, they form an association. In every case, at the head of any new undertaking, where in France you would find the government or in England some territorial magnate, in the United States you are sure to find an association. I have come across several types of association in America of which, I confess, I had not previously the slightest conception, and I have often admired the extreme skill they show in proposing a common object for the exertions of very many and in inducing them voluntarily to pursue it.

– Alexis de Tocqueville – Book Two, Chapter V. (source)

This is not to scare users of any association management software. It is pointing out facts and hopefully increasing awareness among NGO technology professionals, association executives, association leadership and in fact (hopefully) the whole country, that there is a serious vulnerability if not addressed seriously.