Cybersecurity and Cyberwarfare

The Homeland Security Department plans to issue a binding directive Oct 16 requiring agencies to implement a slew of new e-mail security protections. The directive will give agencies three months to implement a tool called DMARC that helps prevent hackers from spoofing an e-mail’s sender, Assistant Secretary Jeanette Manfra said during a Global Cyber Alliance event in New York. Agencies must also implement a separate e-mail protection tool called STARTTLS, Manfra said.

Facebook is looking to hire people who have national security clearances, a move the company thinks is necessary to prevent foreign powers from manipulating future elections through its social network, apparently. Workers with such clearance can access information classified by the US government. Facebook plans to use these people -- and their ability to receive government information about potential threats -- to search more proactively for questionable social media campaigns ahead of elections, apparently. Job candidates like this are often former government and intelligence officials or contractors. The status can carry over to private-sector jobs, as long as the position still requires access to sensitive information. Previously granted clearances become inactive when intelligence workers leave government employment, but they can be reactivated on Facebook’s behalf, the person said.

The government's top watchdog has agreed to investigate the reported cyberattack that targeted the Federal Communications Commission earlier in 2017 while the agency was preparing to roll back net neutrality regulations. A spokesman for the Government Accountability Office (GAO) confirmed it has accepted a request from two Democratic lawmakers to probe the distributed denial of service (DDoS) attack that the FCC said disrupted its electronic comment filing system in May. The spokesman said that the probe, which was first reported by Politico, is “now in the queue, but the work won’t get underway for several months.” The investigation will also examine the FCC’s broader cybersecurity efforts.

On Oct 10, the Supreme Court sidestepped a growing controversy over who can give permission to access a computer, a debate that goes to the core of what constitutes hacking in this era of widespread use of the internet and social media. The justices turned away two cases over whether it is a violation of federal anti-hacking law for account holders to give a third party access to a computer system they do not own themselves. In doing so, they left in place a lower court ruling that went against a Cayman Islands company in a dispute with Facebook, and another against a California-based executive recruiter. The San Francisco-based 9th US Circuit Court of Appeals ruled in both cases that only computer system owners may grant authorization, and not account holders or employees with legitimate access credentials.

The Russian government used a popular antivirus software to secretly scan computers around the world for classified US government documents and top-secret information, modifying the program to turn it into an espionage tool, apparently.

The software, made by the Moscow-based company Kaspersky Lab, routinely scans files of computers on which it is installed looking for viruses and other malicious software. But in an adjustment to its normal operations that the officials say could only have been made with the company’s knowledge, the program searched for terms as broad as “top secret,” which may be written on classified government documents, as well as the classified code names of US government programs, apparently.

A division of the Library of Congress could play a key role in ensuring future US elections are protected against cyberattacks that alter vote tallies or other digital meddling, the authors of a major report on election hacking said. That division, the US Copyright Office, approved a slate of exemptions to a 1996 copyright law that give ethical hackers more leeway to search for digital vulnerabilities in products without facing legal threats from companies that don’t want their security gaps exposed. The exemption, which came out shortly after the 2016 election, included a specific provision freeing ethical hackers to poke and prod at voting machines. That provision paved the way for a “voting machine hacking village” at the 2017 DEF CON security conference in Las Vegas in July that turned up cyber vulnerabilities in numerous voting systems. If the exemption is allowed to expire in 2018, however, it could leave future elections more vulnerable to nation-state and criminal hackers.

It was a case of spies watching spies watching spies: Israeli intelligence officers looked on in real time as Russian government hackers searched computers around the world for the code names of American intelligence programs. What gave the Russian hacking, detected more than two years ago, such global reach was its improvised search tool — antivirus software made by a Russian company, Kaspersky Lab, that is used by 400 million people worldwide, including by officials at some two dozen American government agencies.

The Israeli officials who had hacked into Kaspersky’s own network alerted the United States to the broad Russian intrusion, which has not been previously reported, leading to a decision in Sept to order Kaspersky software removed from government computers. The Russian operation, described by multiple people who have been briefed on the matter, is known to have stolen classified documents from a National Security Agency employee who had improperly stored them on his home computer, on which Kaspersky’s antivirus software was installed. What additional American secrets the Russian hackers may have gleaned from multiple agencies, by turning the Kaspersky software into a sort of Google search for sensitive information, is not yet publicly known.

The hack into the accountancy giant Deloitte compromised a server that contained the e-mails of an estimated 350 clients, including four US government departments, the United Nations and some of the world’s biggest multinationals, apparently. The incident was potentially more widespread than Deloitte has been prepared to acknowledge and that the company cannot be 100% sure what was taken. Deloitte said it believed the hack had only “impacted” six clients, and that it was confident it knew where the hackers had been. It said it believed the attack on its systems, which began a year ago, was now over. However, apparently, the company red-flagged, and has been reviewing, a cache of e-mails and attachments that may have been compromised from a host of other entities.

White House officials believe that chief of staff John Kelly’s personal cellphone was compromised, potentially as long ago as December, according to three U.S. government officials. The discovery raises concerns that hackers or foreign governments may have had access to data on Kelly’s phone while he was secretary of Homeland Security and after he joined the West Wing.

Tech support staff discovered the suspected breach after Kelly turned his phone in to White House tech support this summer complaining that it wasn’t working or updating software properly. Kelly told the staffers the phone hadn’t been working properly for months, according to the officials. White House aides prepared a one-page September memo summarizing the incident, which was circulated throughout the administration. A White House spokesman said Kelly hadn’t used the personal phone often since joining the administration. This person said Kelly relied on his government-issued phone for most communications. The official, who did not dispute any of Politico’s reporting on the timeline of events or the existence of the memo, said Kelly no longer had possession of the device but declined to say where the phone is now.

Senate Armed Services Committee Chairman John McCain (R-AZ) said the panel will work to combat Russia's disinformation campaign that aims to undermine democratic governments and sow division and dissent throughout the United States. “We know that Putin’s Russia has not slowed its efforts to interfere in our elections and domestic affairs. The Senate Armed Services Committee will continue working to address this challenge, which is a threat to our national security,” Sen McCain said. Sen McCain said he is a victim of one of Russia's targeted ads, which planted a false narrative that he met with a leader from the Islamic State of Iraq and Syria (ISIS).