DHS Cyber Warriors Issue Warning About Massive Hacking Campaign, Disclose They've Been Hacked A Day Later

from the holy-shit-this-is-bad dept

Welp. Everything is compromised. Again.

Reuters was the first to report suspected Russian hackers had gained access to hundreds of SolarWinds customers, including US government agencies.

Hackers believed to be working for Russia have been monitoring internal email traffic at the U.S. Treasury and Commerce departments, according to people familiar with the matter, adding they feared the hacks uncovered so far may be the tip of the iceberg.

[...]

The cyber spies are believed to have gotten in by surreptitiously tampering with updates released by IT company SolarWinds, which serves government customers across the executive branch, the military, and the intelligence services, according to two people familiar with the matter. The trick - often referred to as a “supply chain attack” - works by hiding malicious code in the body of legitimate software updates provided to targets by third parties.

A full report by FireEye (which was also a victim of this hacking) details the process used to gain illicit access, which involved leveraging bogus signed components crafted by the hackers and distributed by an unaware SolarWinds. The widespread hacking campaign may have begun as early as March of this year. That it was only discovered now means the fallout from this will continue for months to come.

Here's how the backdoor works, according to FireEye:

SolarWinds.Orion.Core.BusinessLayer.dll is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. We are tracking the trojanized version of this SolarWinds Orion plug-in as SUNBURST.

After an initial dormant period of up to two weeks, it retrieves and executes commands, called “Jobs”, that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services. The malware masquerades its network traffic as the Orion Improvement Program (OIP) protocol and stores reconnaissance results within legitimate plugin configuration files allowing it to blend in with legitimate SolarWinds activity. The backdoor uses multiple obfuscated blocklists to identify forensic and anti-virus tools running as processes, services, and drivers.

SolarWinds boasts over 300,000 customers, including 425 Fortune 500 companies, all ten of the top ten telcos, the Pentagon, State Department, NSA, DOJ, and the White House. Its long list of customers (which now returns a 404 error) all but ensures every passing hour will add another victim to the list.

According to SolarWinds' post-attack-discovery SEC filing, it believes only a small percentage of its customers are affected. But even a fraction of its users is still a gobsmacking number of potential victims.

On December 13, 2020, SolarWinds delivered a communication to approximately 33,000 Orion product customers that were active maintenance customers during and after the Relevant Period. SolarWinds currently believes the actual number of customers that may have had an installation of the Orion products that contained this vulnerability to be fewer than 18,000.

The attack is serious and widespread enough that the DHS's cybersecurity arm has issued a warning -- one that says the only proven way to mitigate damage at this point is to disconnect affected hardware from the internet and pull the plug on Orion software. The CISA (Cybersecurity and Infrastructure Security Agency) Emergency Directive says this is a persistent threat -- one not easily patched away.

CISA has determined that this exploitation of SolarWinds products poses an unacceptable risk to Federal Civilian Executive Branch agencies and requires emergency action. This determination is based on:

• Current exploitation of affected products and their widespread use to monitor traffic on major federal network systems;

• High potential for a compromise of agency information systems;

• Grave impact of a successful compromise.

CISA understands that the vendor is working to provide updated software patches. However, agencies must wait until CISA provides further guidance before using any forthcoming patches to reinstall the SolarWinds Orion software in their enterprise.

The directive goes on to mandate reporting on infected systems and for affected agencies to assume the system remains compromised until CISA gives the all-clear. Unfortunately, this grave warning comes from an agency that is also compromised. CISA issued the directive on December 13. Here's what was reported in the early hours of December 14:

US officials suspect that Russian-linked hackers were behind the recent data breach of multiple federal agencies, including the Departments of Homeland Security, Agriculture and Commerce, but are continuing to investigate the incident, multiple sources told CNN Monday.

CNN learned Monday that DHS' cyber arm, which is tasked with helping safeguard the nation from attacks by malicious foreign actors, is among at least three US government agencies compromised in the hack.

In addition to CISA, government officials also suspect breaches at the US Postal Service and the Department of Agriculture. And the Defense Department is in the process of assessing its own exposure, if any. If any of its components have been breached, it has yet to be publicly reported.

The Russian government is denying involvement, but the evidence seems to point to "Cozy Bear," the offensive hacking wing of Russia's intelligence services. Unfortunately, SolarWinds' dominance in the network management field made it that much easier for the attack to scale. And with CISA compromised, the government's attempts to mitigate damage will be slowed as its own cybersecurity wing attempts to rid itself of a persistent threat.

Filed Under: cisa, commerce department, hacking, russia, treasury, vulnerability
Companies: fireeye, solarwinds

Trump Fires US Cybersecurity Director Chris Krebs After Krebs Debunks Trump's Claims Of Election Systems Fraud

from the mad-king-tantrum dept

As we noted last week, it was widely expected that sooner or later Donald Trump would turn his post-election temper tantrum towards Chris Krebs, the widely respected director of the Cybersecurity and Infrastructure Security Agency (CISA). Krebs had been standing firm in reporting that there was no evidence to support the widespread conspiracy theories about hacked voting machines. CISA had been proactively debunking these claims.

On Tuesday morning, Krebs tweeted about how election security experts all agreed that there was no evidence of manipulated elections -- directly contradicting the ongoing unsubstantiated claims of the President and his enablers:

In response, a few hours later, Trump tweeted that Krebs was fired:

If you can't read that, it's the President saying:

The recent statement by Chris Krebs on the security of the 2020 Election was highly inaccurate, in that there were massive improprieties and fraud - including dead people voting, Poll Watchers not allowed into polling locations, “glitches” in the voting machines which changed... votes from Trump to Biden, late voting, and many more. Therefore, effective immediately, Chris Krebs has been terminated as Director of the Cybersecurity and Infrastructure Security Agency.

There is no evidence that any of that actually happened. None. Zero. Zilch. Every single one of those stories has been debunked (and most of them have literally nothing to do with Krebs' job). The only thing truthful in those tweets is that Trump was firing Krebs. This is a disgusting abuse of power, supporting completely bullshit conspiracy theory nonsense, in order to remove a public servant who actually did his job well in protecting against such election manipulation.

Moments later, on his personal Twitter account, Krebs tweeted with class:

This is the kind of grace and class that Trump and his enablers will never understand.

As professor Steve Vladeck notes, "we're worse off as a country" because of "this temper tantrum" by the President.

Filed Under: chris krebs, cisa, dhs, donald trump, election security, fired, tempter tantrum

US Cybersecurity Director Expecting To Be Fired After Refusing To Edit Page Debunking Election Hacking Myths

from the ridiculousness-in-a-bag dept

One of the few parts of the federal government that hasn't dissolved into a complete partisan trash heap was the newly created Cybersecurity and Infrastructure Security Agency (CISA), a division of Homeland Security that was created as part of the problematic CISA bill five years ago. While we were disappointed in many aspects of the bill itself, as an organization CISA has done some pretty good work in coordinating and dealing with cybersecurity threats. Throughout the tech industry I've heard nothing but good things about CISA as a government organization, and its director Chris Krebs (as well as the staff of CISA). Indeed, I've heard from many companies preparing for this year's election how useful CISA has been in providing clear and useful information regarding potential cybersecurity threats.

Relatedly, CISA has an excellent Rumor Control page that debunks various myths about potential cybersecurity risks regarding the election. It's very good and very thorough. And, in fact, it debunks many of the myths that various Trumpists have been spreading around social media in pretty clear and concise language:

It appears that the White House has finally realized this exists and decided it's not a good look for its own organization to be debunking the very same myths that the White House itself is trying to boost and spread as real. The White House apparently asked Krebs to have the page changed, and Krebs rejected the request. He's now telling colleagues he expects to be fired for standing up for the truth and against nonsense about election hacks.

White House officials have asked for content to be edited or removed which pushed back against numerous false claims about the election, including that Democrats are behind a mass election fraud scheme. CISA officials have chosen not to delete accurate information.

In particular, one person said, the White House was angry about a CISA post rejecting a conspiracy theory that falsely claims an intelligence agency supercomputer and program, purportedly named Hammer and Scorecard, could have flipped votes nationally. No such system exists, according to Krebs, election security experts and former U.S. officials.

The article notes that an assistant director at CISA, Bryan Ware, has handed in his resignation and it is believed that this was demanded from the White House related to this particular issue.

Krebs deserves kudos for standing up for truth and a secure election, rather than to be fired for it, while Trump continues to lie, obstruct and pretend he didn't lose the election.

Oh, and thanks to the White House for driving a ton more traffic to CISA's super useful Rumor Control website.

Filed Under: chris krebs, cisa, cybersecurity, donald trump, elections, myths, white house

Unpublished Guidelines Show The DHS Is Steering States Away From Insecure Internet Voting Options

from the good-move dept

The DHS has come out against internet voting. Sort of.

If there's anything less secure than electronic voting, it's internet voting. The temptation is to provide voters with more options if the pandemic continues to keep voters home. But guidelines from the DHS's redundantly-named Cybersecurity and Infrastructure Security Agency (CISA) say this risks the integrity of those votes by opening them up to attackers.

The eight-page document, obtained by the Guardian, pulls no punches in calling the casting of ballots over the internet a “high-risk” endeavor that would allow attackers to alter votes and results “at scale” and compromise the integrity of elections. The guidelines advise states to avoid it altogether or restrict it to voters who have no other means of casting a ballot.

No state is currently offering online-only voting, but the option used to collect votes from US citizens overseas is still pretty risky. The DHS doesn't consider the electronic delivery of ballots to be inherently insecure, but CISA's report points out attackers could intercept ballots en route and alter them by removing candidates' names, for example. Returning them electronically obviously poses the same risks: interception and alteration.

The worst option is the one no state has been willing to deploy… yet: online voting. The report says this method poses the highest risk of attack. Putting the whole thing online could compromise the security of the vote and voters, remove the secrecy that surrounds the public voting process, and potentially lead to wide-scale alteration or destruction of votes.

The only thing surprising about the DHS's guidance is that it exists at all. While concerns continue to mount about election security, the DHS has remained mostly silent, allowing the private sector and local governments to address these issues in their own way. This silence has continued despite the host of issues raised during the 2016 presidential elections. This is making some election integrity experts happy.

“Clear, explicit guidance from DHS that internet voting is not secure or trustworthy is long, long overdue,” says Susan Greenhalgh, the senior adviser on election security for the watchdog group Free Speech For People. “It has failed for four years to codify and publish that guidance in an effort to avoid antagonizing some state officials.”

But, as the Guardian points out, the DHS has not officially broken its silence about election security issues. The document obtained by the Guardian was not publicly released by the DHS. The document can't be found on CISA's site and no DHS official has commented on the document itself. So, while it's good guidance that brings common sense to internet-based voting, it doesn't appear to reflect the public face of the DHS's election security efforts.

Hopefully, this guidance has at least made its way to state governments even if the general public hasn't been entrusted with it. The guidelines will make electronic collection of voter information and votes slightly more secure and dissuade those unprepared to follow these steps from opting for riskier voting methods while dealing with the unforeseeable complications of a global pandemic.

Filed Under: cisa, cybersecurity, dhs, election voting, internet voting

DHS Inspector General Says Office Has No Idea How New Cybersecurity Act Is Supposed To Be Implemented

from the OIG-to-Congress:-you-made-this-mess,-now-fix-it dept

The reanimated CISA, redubbed The Cybersecurity Act (a.k.a., OmniCISA) and hurried through the legislative process by stapling its 2000 pages to the back of a "must-pass" budget bill, is still in the processes of implementation. Not much is known about what the law is intended to do on the granular level, other than open up private companies to government surveillance so the USA can beat back "the cyber."

Surveillance aficionados were quick to lean on private companies to start sharing information, but the government needs to be taught new tricks as well. There's plenty of info siloing at the federal level, which keeps the DHS, FBI, and others involved in the cyberwar from effectively communicating, much less sharing anything interesting they might have had forwarded to them by the private sector.

The federal government has been less than successful in securing its own information -- something CISA was also supposed to fix. The DHS's Inspector General has performed a follow-up investigation on the department's implementation of CISA's requirements. For the most part, things seem to be moving forward, albeit in a vague, undefined direction.

The OIG notes that the DHS has put together policies and procedures and, amazingly, actually implemented some of them. Better still, it has moved many critical account holders to multi-factor authorization. Unfortunately, the DHS still has a number of standalone systems that can't handle multi-factor authorization, which will make them more vulnerable to being breached.

That's pretty much the end of the good news. There are still holes in the DHS's data systems at a very critical juncture. From the report [PDF]:

Although the Department has established software inventory policies, not all DHS components used data exfiltration protection capabilities to support data loss prevention, forensics and visibility, and digital rights management. Further, the Department had not developed policies and procedures to ensure that contractors implement data protection solutions.

Then there's this part of the report, which shows that no one truly understands the 2000-page law -- not even the DHS's first level of oversight, which can't even tell what the agency is supposed to be doing to comply with the new law. (h/t Eric Geller)

DHS and its Components can benefit from additional data protection capabilities and policy to help ensure sensitive PII and classified information are secure from unauthorized access, use, and disclosure. We are submitting this report for informational purposes to the appropriate Congressional oversight committees, as required by the Act. Due to a lack of specific criteria, this report contains no recommendations.

This explains why the report is so short: the OIG doesn't have anything to work with. Two thousand pages and yet the Cybersecurity Act's demands and goals remain so vague that all the Inspector General can do is take a cursory look at the DHS's security protocols and see if they've improved. Beyond that, the DHS and its Inspector General have no specifics to guide them and no firm goals to reach. So, the Inspector General's office is doing the only thing it can do: kick the problem over to the legislators who created it.

This is already quite the problem considering the DHS is flying blind with achieving its internal directives. What makes matters worse is the DHS is a clearinghouse for the information and data obtained from private companies -- like ISP monitoring of user activity for "cybersecurity purposes" -- and is in charge of determining whether or not any personally-identifiable information needs to "scrubbed" before it is passed on to other government agencies.

If it doesn't have enough guidance to determine what direction it should be going in securing its own systems, it presumably has far less when it comes to the handling of private sector information. Those privacy protections were stripped during CISA's swift push through Congress and replaced with a DOJ judgment call on whether or not the DHS has performed an adequate scrub before handing over data to the FBI, NSA, et al. "Lack of specific criteria" pretty much defines the government's approach to domestic surveillance -- which is enabled by this law: grab it all now; figure it out later.

Filed Under: cisa, cispa, cybersecurity, cybersecurity act, dhs

Want To Know How Ridiculous The Omnibus Bill Is? It Has A Meaningless Porn Filter Clause Four Times

from the say-what? dept

Following Congress passing the Omnibus spending bill, it of course did not take long for President Obama to sign the bill, meaning that the fake cybersecurity bill/actual surveillance bill, is now law. Particularly ridiculous is that in his little speech about it, Obama talked about how he "wasn't wild about everything in it" but that he was happy that it was a bill "without ideological provisions." Except, you know, for the many ones that did get in there.

But, what do you expect with a 2000+ page bill that Congress was only given a couple of days to look at before voting on. Zach Carter, over at Huffington Post has examples of a couple of ridiculous provisions in the omnibus, starting with a ban on giving any funding to ACORN, the organization that was the target of scorn from Republicans a few years back. So what's so ridiculous about that? Following the pile on against ACORN years ago the organization shut down. It hasn't existed in years. Preventing funding for it seems, you know, kinda pointless, as it doesn't exist.

But it's the other wacky provision that caught my attention. Apparently this provision is in the omnibus no less than four times in different places:

"None of the funds made available in this Act may be used to maintain or establish a computer network unless such network blocks the viewing, downloading, and exchanging of pornography."

Apparently, this little clause has become so standard, you can find it in earlier funding bills as well. It's the 2013 funding bill the the 2012 funding bill and many more, I assume.

And, as Carter notes, this language is "completely meaningless," but it's still in there four times. Just because.

So Congress can't seem to get much of anything done, but it does pass an omnibus bill that includes a weird meaningless porn filter requirement four times... and a damaging surveillance bill. And you wonder why people dislike and distrust Congress.

Filed Under: cisa, cybersecurity, omnibus, president obama

As Expected, Congress Approves CISA (As Part Of Omnibus)

from the selling-out-your-privacy dept

This is hardly a surprise since Speaker Paul Ryan put his (weak, privacy destroying) version of CISA into the "must pass" omnibus funding bill, retitled as the Cybersecurity Act of 2015, but the bill was easily passed by Congress this morning, 316 to 113. Frankly, 113 votes against was much higher than I expected. Below are the votes:

---- YEAS    316 ---

Adams Aderholt Aguilar Allen Ashford Barr Barton Bass Beatty Benishek Bera Beyer Bilirakis Bishop (GA) Bishop (MI) Bishop (UT) Blumenauer Bonamici Bost Boustany Boyle, Brendan F. Brady (PA) Brady (TX) Brooks (IN) Brown (FL) Brownley (CA) Buchanan Bucshon Burgess Bustos Butterfield Calvert Capps Capuano Cárdenas Carson (IN) Carter (GA) Carter (TX) Cartwright Castor (FL) Castro (TX) Chabot Chaffetz Chu, Judy Cicilline Clark (MA) Clarke (NY) Clay Cleaver Clyburn Coffman Cohen Cole Collins (GA) Collins (NY) Comstock Conaway Connolly Conyers Cook Cooper Costa Costello (PA) Courtney Cramer Crenshaw Crowley Culberson Cummings Curbelo (FL) Davis (CA) Davis, Danny Davis, Rodney DeFazio DeGette Delaney DeLauro DelBene Denham Dent DeSaulnier Deutch Diaz-Balart Dingell Dold Donovan Doyle, Michael F. Duckworth Duffy Edwards Ellmers (NC) Engel Eshoo Esty Farr Fattah Fitzpatrick Fleischmann Flores Foster Foxx Frankel (FL) Frelinghuysen Fudge Gabbard Garamendi

Gibson Graham Granger Graves (GA) Graves (MO) Grayson Green, Al Green, Gene Grothman Guthrie Hahn Hanna Harper Hartzler Hastings Heck (WA) Hensarling Herrera Beutler Higgins Hill Himes Hinojosa Honda Hoyer Huffman Huizenga (MI) Hurd (TX) Israel Issa Jackson Lee Jeffries Jenkins (WV) Johnson (OH) Jolly Joyce Kaptur Katko Keating Kelly (IL) Kelly (MS) Kilmer Kind King (NY) Kinzinger (IL) Kirkpatrick Kline Knight Kuster Langevin Larsen (WA) Larson (CT) Lawrence Lee Levin Lewis Lipinski LoBiondo Loebsack Loudermilk Love Lowenthal Lowey Lucas Luetkemeyer Lujan Grisham (NM) Luján, Ben Ray (NM) Lynch MacArthur Maloney, Carolyn Maloney, Sean Marchant Matsui McCarthy McCaul McCollum McGovern McHenry McMorris Rodgers McNerney McSally Meeks Meng Messer Mica Miller (MI) Moolenaar Moore Moulton Mullin Murphy (FL) Murphy (PA) Nadler Napolitano Neal Neugebauer Newhouse Noem Nolan Norcross Nugent Nunes O'Rourke Olson Palazzo Pallone Pascrell

Paulsen Payne Pearce Pelosi Perlmutter Peters Peterson Pingree Pittenger Pitts Poe (TX) Poliquin Price (NC) Price, Tom Quigley Rangel Reed Reichert Renacci Ribble Rice (NY) Rice (SC) Richmond Rigell Rogers (KY) Rokita Rooney (FL) Ros-Lehtinen Roskam Ross Rouzer Roybal-Allard Royce Ruiz Ruppersberger Rush Russell Ryan (OH) Ryan (WI) Sánchez, Linda T. Sanchez, Loretta Sarbanes Scalise Schakowsky Schiff Scott (VA) Scott, Austin Scott, David Sensenbrenner Serrano Sessions Sewell (AL) Sherman Shimkus Simpson Sinema Sires Slaughter Smith (NJ) Smith (WA) Speier Stefanik Stewart Stivers Swalwell (CA) Takai Thompson (CA) Thompson (PA) Thornberry Tiberi Titus Tonko Torres Trott Tsongas Turner Upton Valadao Van Hollen Vargas Veasey Vela Velázquez Visclosky Wagner Walberg Walden Walorski Walters, Mimi Walz Wasserman Schultz Watson Coleman Weber (TX) Wenstrup Westmoreland Wilson (FL) Wilson (SC) Womack Woodall Yarmuth Yoder Young (AK) Zeldin Zinke

---- NAYS    113 ---

Abraham Amash Amodei Babin Barletta Becerra Black Blackburn Blum Brat Bridenstine Brooks (AL) Buck Byrne Carney Clawson (FL) Crawford DeSantis DesJarlais Doggett Duncan (SC) Duncan (TN) Ellison Emmer (MN) Farenthold Fleming Forbes Fortenberry Franks (AZ) Gallego Garrett Gibbs Gohmert Goodlatte Gosar Gowdy Graves (LA) Griffith

Grijalva Guinta Gutiérrez Hardy Harris Heck (NV) Hice, Jody B. Holding Hudson Huelskamp Hultgren Hunter Hurt (VA) Jenkins (KS) Johnson (GA) Johnson, Sam Jones Jordan Kelly (PA) King (IA) Labrador LaHood LaMalfa Lamborn Lance Latta Lieu, Ted Lofgren Long Lummis Marino Massie McClintock McDermott McKinley Meadows Meehan Miller (FL)

Mooney (WV) Mulvaney Palmer Perry Pocan Polis Pompeo Posey Ratcliffe Roby Roe (TN) Rogers (AL) Rohrabacher Rothfus Salmon Sanford Schrader Schweikert Shuster Smith (MO) Smith (NE) Smith (TX) Stutzman Takano Thompson (MS) Tipton Walker Waters, Maxine Webster (FL) Welch Westerman Whitfield Williams Wittman Yoho Young (IA) Young (IN)

---- NOT VOTING    5 ---

Cuellar Fincher

Johnson, E. B. Kennedy

Kildee

Filed Under: cisa, cybersecurity, omnibus, omnicisa

White House Supports Privacy Destroying CISA, Despite Past Promises It Would Not

from the this-is-a-problem dept

In the past, President Obama has threatened to veto any cybersecurity bill that undermines privacy and civil liberties. Of course, people didn't quite believe that was true, and now that we see the final cybersecurity bill, the bastardized CISA has been attached to the "must pass" omnibus spending bill, and clearly is a disaster on privacy issues, what do you think the White House is saying?

Well, they love it, of course:

"We are pleased that the Omnibus includes cybersecurity information sharing legislation," a senior administration official said in an emailed statement. "The President has long called on Congress to pass cybersecurity information sharing legislation that will help the private sector and government share more cyber threat information by providing for targeted liability protections while carefully safeguarding privacy, confidentiality, and civil liberties."

Except, you know, it doesn't actually do that last part.

Filed Under: administration, cisa, cybersecurity, omnibus, omnibus bill, president obama, privacy, white house

Congressman Who Supports Undermining Encryption Says We Need CISA (Which Undermines Privacy) To 'Protect Privacy'

from the up-is-down,-black-is-white,-day-is-night dept

Representative Adam Schiff, the ranking member of the House Intelligence Committee (the Committee that has most strongly been pushing versions of cybersecurity bills that undermine privacy and provide more surveillance powers) apparently believes that as long as he says day is night and up is down, the world will believe him. In response to Speaker Paul Ryan's decision to shove CISA into the omnibus funding bill, Schiff insisted that this was necessary to protect our privacy:

“This is the most protective of privacy of any cyber bill that we have advanced and we need to keep in mind the overriding interest all Americans have in protecting their privacy from these innumerable hacks,” Intelligence Committee ranking member Adam Schiff (D-Calif.), a cosponsor of his panel’s cyber bill, told The Hill. “Our privacy is being violated every day. And the longer we delay on measures like this, the more we subject ourselves to those kind of intrusions into our privacy.”

Nearly everything Schiff says here is complete hogwash. This bill is far from "the most protective of privacy of any cyber bill" that has advanced. Other versions clearly had more privacy protections (mainly the one advanced by the House Judiciary Committee). And, this latest one clearly strips out privacy provisions and makes it that much more difficult to protect our privacy.

And the fearmongering about "these innumerable hacks" and how "our privacy is being violated every day" is totally meaningless, because CISA does nothing to stop these hacks. We've asked many times before how would CISA have stopped a single hack and no one ever answers. We've looked hard and cannot find a single online security expert who thinks that CISA would be useful in preventing online hacks and attacks. Because it wouldn't. There is nothing in there geared towards stopping attacks.

You know what would help in protecting our privacy and limiting the damage from hacks? Stronger encryption. I wonder what Rep. Adam Schiff thinks about that?

Take a wild... wild guess. Oh, you're right: He doesn't like encryption.

"While it remains too early to tell the role encrypted communications may have played in the devastating terrorist attacks in Paris, we do know that ISIS regularly instructs its operatives to use encrypted platforms precisely to help evade detection. These platforms are made overseas as well as in the U.S., and there are significant security, technological, economic and privacy issues involved in addressing the challenge posed to the intelligence community and law enforcement by encryption.

"That is why Chairman Nunes and I – months before these horrific attacks – requested that the National Academy of Sciences, an organization that two decades ago studied this very issue, produce an updated report that can help us to identify and design effective, technologically feasible and economically viable solutions to the increasingly dangerous problem known as 'going dark.' I am pleased that the Academy is proceeding with such a study, which will help inform policymakers and the public alike.

Yup.

If Rep. Schiff was truly worried about hacks and keeping Americans' data secure, he'd be supporting strong encryption. Instead, he's looking to undermine it, while at the same time supporting a separate bill which, under the false pretense of protecting us from cybersecurity attacks, actually undermines our privacy even further.

So here's a challenge to Rep. Adam Schiff: Can you find a single recognized cybersecurity expert who thinks that the way to protect against hacks is (1) found in this Cybersecurity Act and (2) involves figuring out ways to stop encryption from letting people "go dark"? If not, perhaps you should stop saying these things and stop legislating about it.

Filed Under: adam schiff, cisa, cybersecurity, encryption, privacy

Why The New CISA Is So Bad For Privacy

from the it's-a-mess dept

We warned earlier this week that Congress was going to make the cybersecurity bill CISA much worse on privacy, and then shove it into the "must pass" omnibus spending bill, and that's exactly what happened. The 2000+ page bill was only released early yesterday morning and the vote on it is tomorrow, meaning people have been scrambling to figure out what exactly is actually in there. The intelligence community has been using that confusion to push the bill, highlighting a couple of the predictions that didn't make it into the bill to argue that people against CISA are overstating the problems of the bill. That's pretty low, even for the intelligence community.

Stanford's Jennifer Granick has gone through this new zombie CISA, which has technically been renamed "the Cybersecurity Act of 2015," but which she's calling OmniCISA and discovered that it's a complete disaster on the privacy front, basically wiping out any ability by the FCC or the FTC to make service providers respect user privacy, and instead, is designed to encourage more monitoring of user behavior, weakening their privacy. As she notes, after the FCC's net neutrality rules, there was some concern about a turf war between the FCC and the FTC on who protects consumer privacy rights with regards to internet access providers. To stop people from freaking out over this, the two agencies told people to calm down, because they're happy to work together to protect privacy, with the FCC handling issues related to privacy as a common carrier, and the FTC handling everything else.

But, as Granick points out, under CISA, so long as ISPs claim that they're spying on your internet activity for "cybersecurity" purposes (which is defined ridiculously broadly in the bill), then the FCC and FTC are completely blocked from doing anything:

This language means that, regardless of what rules the FCC or FTC have now or will have in the future, private companies including ISPs can monitor their systems and access information that flows over those systems for “cybersecurity purposes.”

[....]

It appears that OmniCISA is trying to stake out a category of ISP monitoring that the FCC and FTC can’t touch, regardless of its privacy impact on Americans.

This section of OmniCISA would not only interfere with future privacy regulations, it limits the few privacy rules we currently have.

The Wiretap Act is a provision of law that conditions the ability of telephone companies and Internet Service Providers to monitor the private messages that flow over their networks. The Wiretap Act says that these wire and electronic communications service providers can “intercept, disclose, or use that communication in the normal course of … employment while engaged in any activity which is a necessary incident to the rendition of his service or to the protection of the rights or property of the provider of that service” (emphasis added). Similarly, ECPA allows providers to access stored information, and then to voluntarily share it for the same reasons. This language allows providers to conduct some monitoring of their systems for security purposes — to keep the system up and running and to protect the provider.

But it appears OmniCISA would waive these provisions of the Wiretap Act and ECPA. Why do that except to expand that ability to monitor for broader “cybersecurity purposes” beyond the legal ability providers already have to intercept communications in order to protect service, rights, or property?

So this bill isn’t just about threat information sharing, it’s about enabling ISP monitoring in ways beyond current law that have not been clearly defined or explained.

And, of course, if you don't think this will be abused both by the internet access providers and the law enforcement/intelligence communities, you haven't been paying attention for the past decade or more.

Filed Under: cisa, cybersecurity, fcc, ftc, jennifer granick, privacy, surveillance