Timesdelhi.com

September 24, 2018
Category archive

Department of Homeland Security

DHS launches a new cyber hub to coordinate against threats to US infrastructure

in critical infrastructure/cyber/cybersecurity/Delhi/Department of Homeland Security/DHS/Government/India/Policy/Politics/Russia/Russian election interference/Security/TC by

Among the many things the current administration has been criticized for is its lack of a unified strategy to combat cyber threats, especially in light of ongoing election interference and psy ops perpetrated by Russia. The Department of Homeland Security is advancing the ball with the creation of the National Risk Management Center, intended on protecting critical infrastructure from attacks and subversion by online adversaries.

The NRMC was announced today at a cyber summit in New York held by the agency, where DHS Secretary Kirstjen Nielsen explained the purpose and justification for this new entity. Remarkably, she directly contradicted the ongoing soft-pedaling by the Executive of Russian operations targeting the country.

“Let me be clear: Our intelligence community had it right. It was the Russians. It was directed from the highest levels. And we cannot and will not allow it to happen again,” she said.

DHS Secretary Nielsen in 2017.

Thus the creation of the NRMC, which will work directly with various entities and federal agencies to protect infrastructure like banking systems and the power grid (not to mention election systems). These are such obvious targets for foreign intelligence to attack, either for destructive or informative purposes, that they merit special attention from our side as well, and DHS is in fact the one to provide it.

The new center will be online and staffed tomorrow, though it will take some time to spin up completely as DHS allocates space, personnel and resources. Its exact duties, jurisdictions and connections with other units will no doubt be made clear as well.

Vice President Pence spoke at the event too, but naturally chose to lash out at the Obama administration, which he said “often chose silence and paralysis over strength and action.”

This is a strange thing to say when several prominent cybersecurity-related posts and offices have been abandoned and a report by the Office of Management and Budget found agencies around the country are utterly unprepared for even elementary cyberattacks.

Government investigation finds federal agencies failing at cybersecurity basics

One of the major moves to improve cybersecurity, elevating CyberCom to Unified Combatant Command level, was an Obama-era plan, and the president’s overall cyber strategy, announced last year, also cribbed liberally from the previous administration.

That said, the vice president was realistic on other points.

“The fact is Russia meddled in our 2016 elections,” he concurred. “This administration will not tolerate threats from Russia, China, Iran, North Korea or anyone else.”

The other countries on the list, it bears mentioning, have not been found to have interfered with American elections, though admittedly they might if they had the chance.

Pence also acknowledged states’ prerogative in running their elections how they like, but also said the federal government would be providing additional funding and technology for election security. He mentioned the “Albert sensors” being deployed to help monitor online systems, and a “virtual situation room” many states are already using that connects DHS with state authorities.

“I want to urge, with great respect, every state to take renewed action. Take advantage of the assistance offered by our administration,” Pence said.

That seems like a good idea, as Russian operations have already begun ahead of the 2018 midterms. Perhaps that joint Russo-American cybersecurity group proposed by Putin will help.

News Source = techcrunch.com

Russian indictments show that the U.S. needs federal oversight of election security

in America/Column/Congress/cybercrime/defcon/Delhi/democratic party/Department of Homeland Security/Election Assistance Commission/election security/elections/federal election/Federal government/Florida/Government/helsinki/India/national security/operating systems/Politics/president/presidential election/Ron Wyden/Russia/Trump/United States by

President Trump’s Helsinki summit with Vladimir Putin, on the heels of twelve Russian intelligence officials indicted for hacking the 2016 election, made it clear that this administration has zero commitment to protect our elections from future Russian attacks.

These events should remind us of an alarming fact we can no longer afford to ignore: our elections are not secure.

As a nation, we underfund and neglect election security. So, much like our aging infrastructure, our election infrastructure is severely outdated and crumbling before our eyes.

Unfortunately, in today’s hyper-partisan environment, even concerns over election security are divided along party lines. Case in point: after his trip to Russia last week, Republican Senator Ron Johnson declared “It’s very difficult to really meddle in our elections. It just is.”

To effectively safeguard our elections, we need to consider yet another conservative taboo: the federal government should have more power in setting election security standards. Our current decentralized, disjointed state-based system is no longer adequate for protecting our elections against foreign interference in the 21st century.

TechCrunch/Bryce Durbin

Right now, the federal government plays a very limited role in the oversight of election security. The Election Assistance Commission and Department of Homeland Security offer optional resources and issue non-binding guidelines for best practices, and states are free to come up with their own standards as they please. The results, unsurprisingly, are abysmal.

In 2016, for example, over two-thirds of all counties in the U.S. used voting machines that were over a decade old. Many machine used outdated softwares and ran in absurdly old operating systems such as Windows 2000. Thirteen states still use machines that are completely electronic, which makes themprone to glitches, and with no paper trails, the results cannot be audited.

Many experts have pointed out that our current machines could be hacked in a matter of minutes. Recently, a 14 year-old participant at DefCon breached a voting machine in 90 minutes, and was able to change the vote tally in the machine remotely, from anywhere.

Besides the machines, there are other major vulnerabilities in many states’ election security standards that would make hacking our elections a breeze for the Russians. Our voter registration databases are outdated and prone to infiltration. Many states have no post-election auditing requirements at all, and those that do are often insufficient, severely undermining our ability to identify and correct an attack.

While federalizing election security has long been castigated as an infringement of state rights, politicians are beginning to acknowledge its necessity. Senator Ron Wyden, for instance, recently introduced The Protecting American Votes and Elections Act of 2018, whichwould require every state to use election machines with paper ballots and mandate risk-limiting post-election audits (the “gold standard” of election auditing).

As Wyden argues: “Americans don’t expect states, much less county officials, to fight America’s wars. The Russians have attacked our election infrastructure and leaving our defenses to states and local entities, in my view, is not an adequate response. Our country needs baseline, mandatory, federal election security standards.”

TechCrunch/Bryce Durbin

Rather than providing concrete solutions, this Republican Congress continues to pretend that all of our election security problems can be solved by tiny, poorly designed federal grant programs alone. In this year’s omnibus spending bill, a bipartisan compromise provided a meager, but much needed $380 million federal grant to states for strengthening election security ahead of the 2018 election. However, the effectiveness of this grant is questionable, given it was earmarked for broad purposes and allocated by a formula that is not competitive or need-based.

Worse still, since states are not required to spend the federal grant allocated to them, some stateshave not even applied to collect their shares. Several state governments are impeding the use of this grant through a combination of delayed action and inaction. For example, Florida’s Republican-led state legislature has refused to authorize their election officials to use the grant before the 2018 election, even when the state is in desperate need for more election security funding.

While inadequate funding is a serious concern that needs to be addressed — House Democrats estimated that we will need $1.4 billion over the next decade to bring our entire election system in line with best practices — increasing federal grants alone would not be enough to secure elections in every state. The Secure Elections Act, a bill currently with the most broad-based, bipartisan support, will provide much needed federal funding to make up for the current shortfall, but as with this year’s federal grant, there is no guarantee states would use the funding in a timely and effective fashion — or at all — given state participation will remain voluntary under this bill.

Our representative democracy cannot survive if we fail to preserve the fairness and integrity of our elections. While it’s too late to implement binding federal guidelines to secure the 2018 midterm, we should accept nothing less for the 2020 presidential election, as we can be certain the Russians will hack that election in order to help their preferred candidate, yet again.

Too many states have proven they are unwilling to take election security seriously. It’s time for the federal government to step in.

News Source = techcrunch.com

A huge spreadsheet naming ICE employees gets yanked from GitHub and Medium

in activism/Delhi/Department of Homeland Security/Government/immigration/India/Policy/Politics/TC/Trump administration by

A massive database of current U.S. Immigration and Customs Enforcement (ICE) employees scraped from public LinkedIn profiles has been removed from the tech platforms hosting the data. The project was undertaken by Sam Lavigne, self-described artist, programmer and researcher in response to recent revelations around ICE’s detention practices at the southern U.S. border.

Lavigne posted the database to GitHub on Tuesday and by Wednesday the repository had been removed. The database included the name, profile photo, title and city area of every ICE employee who listed the agency as their employer on the professional networking site. A more in-depth version of the data pulled all public LinkedIn data from the pool of users, including previous employment, education history and any other information those users opted to make public. The total database lists this information for 1,595 ICE employees, from the company’s CTO on down to low-level workers.

The project accompanied a Medium post about the project’s aims that has since been removed by the platform:

While I don’t have a precise idea of what should be done with this data set, I leave it here with the hope that researchers, journalists and activists will find it useful…

I find it helpful to remember that as much as internet companies use data to spy on and exploit their users, we can at times reverse the story, and leverage those very same online platforms as a means to investigate or even undermine entrenched power structures. It’s a strange side effect of our reliance on private companies and semi-public platforms to mediate nearly all aspects of our lives.

The data set appears to have violated GitHub and Medium guidelines against doxing. Medium’s anti-harassment policy specifically forbids doxing and defines it broadly, preventing “the aggregation of publicly available information to target, shame, blackmail, harass, intimidate, threaten, or endanger.”

Because it doesn’t include personal identifying information like home addresses, phone numbers or other non-public details, Lavigne’s project isn’t really doxing in the normal sense of the word, though that hasn’t made it less controversial.

GitHub’s own policy leading to the data’s removal is less clear, though the company told The Verge the repository was removed due to “doxxing and harassment.” The platform’s terms of service forbid uses of GitHub that “violate the privacy of any third party, such as by posting another person’s personal information without consent.” This leaves some room for interpretation, and it is not clear that data from a public-facing social media profile is “personal” under this definition. GitHub allows researchers to scrape data from external sites in order to aggregate it “only if any publications resulting from that research are open access.”

While Lavigne’s aggregation efforts were deemed off-limits by some tech platforms, they do raise compelling questions. What kinds of public data, in aggregate, run afoul of anti-harassment rules? Why can this kind of data be scraped for the purposes of targeted advertising or surveillance by law enforcement but not be collected in a user-facing way? The ICE database raised these questions and plenty more, but for some tech companies the question of hosting the data proved too provocative from the start.

News Source = techcrunch.com

The United States needs a Department of Cybersecurity

in China/Column/computer security/Congress/cyberattack/cybercrime/Cyberwarfare/Delhi/department of defense/Department of Homeland Security/department of justice/executive/Federal Bureau of Investigation/Government/hacking/India/national security/Politics/Russia/San Francisco/Security/spy/United States/Washington by

This week over 40,000 security professionals will attend RSA in San Francisco to see the latest cyber technologies on display and discuss key issues. No topic will be higher on the agenda than the Russian sponsored hack of the American 2016 election with debate about why the country has done so little to respond and what measures should be taken to deter future attempts at subverting our democracy.

For good reason. There is now clear evidence of Russian interference in the election with Special Counsel Mueller’s 37-page indictment of 13 Russians yet the attack on US sovereignty and stability has gone largely unanswered.  The $120 million set aside by Congress to address the Russian attacks remains unspent. We expelled Russian diplomats but only under international pressure after the poisoning of a former Russian spy and his daughter.

Recent sanctions are unlikely to change the behavior of the Putin administration. To put it bluntly, we have done nothing of substance to address our vulnerability to foreign cyberattacks. Meanwhile, our enemies gain in technological capability, sophistication and impact.

Along with the Russians, the Chinese, North Koreans, Iranians and newly derived nation states use cyber techniques on a daily basis to further their efforts to gain advantage on the geopolitical stage. It is a conscious decision by these governments that a proactive cyber program advances their goals while limiting the United States.

Krisztian Bocsi/Bloomberg via Getty Images

We were once dominant in this realm both technically and with our knowledge and skillsets. That playing field has been leveled and we sit idly by without the will or focus to try and regain the advantage. This is unacceptable, untenable and will ultimately lead to potentially dire consequences.

In March of this year, the US CyberCommand released  a vision paper called “Achieve and Maintain Cyberspace Superiority.” It is a call to action to unleash the country’s cyber warriors to fight  for our national security in concert with all other diplomatic and economic powers available to the United States.

It’s a start but a vision statement is not enough.  Without a proper organizational structure, the United States will never achieve operational excellence in its cyber endeavors.  Today we are organized to fail.  Our capabilities are distributed across so many different parts of the government that they are overwhelmed with bureaucracy, inefficiency and dilution of talent.

The Department of Homeland Security is responsible for national protection including prevention, mitigation and recovery from cyber attacks. The FBI, under the umbrella of the Department of Justice,  has lead responsibility for investigation and enforcement. The Department of Defense, including US CyberCommand, is in charge of national defense.  In addition, each of the various military branches  have their own cyber units. No one who wanted to win would organize a critical  capability in such a distributed and disbursed manner.

How could our law makers know what policy to pass? How do we recruit and train the best of the best in an organization, when it might just be a rotation through a military branch? How can we instantly share knowledge that benefits all when these groups don’t even talk to one another? Our current approach does not and cannot work.

Image courtesy of Colin Anderson

What is needed is a sixteenth branch of the Executive — a Department of Cybersecurity — that  would assemble the country’s best talent and resources to operate under a single umbrella and a single coherent policy.  By uniting our cyber efforts we would make the best use of limited resources and ensure seamless communications across all elements dealing in cyberspace. The department would  act on behalf of the government and the private sector to protect against cyberthreats and, when needed, go on offense.

As with physical defense, sometimes that means diplomacy or sanctions, and sometimes it means executing missions to cripple an enemy’s cyber-operations. We  have the technological capabilities, we have the talent, we know what to do but unless all of this firepower is unified and aimed at the enemy we might as well have nothing.

When a Department of Cybersecurity is discussed in Washington, it is usually rejected because of the number of agencies and departments affected. This is code for loss of budget and personnel. We must rise above turf battles if we are to have a shot at waging an effective cyber war. There are some who have raised concerns about coordination on offensive actions but they can be addressed by a clear chain of command with the Defense Department to avoid the potential of a larger conflict.

We must also not be thrown by comparisons to the Department of Homeland Security and conclude a Cybersecurity department would face the same challenges. DHS was 22 different agencies thrust into one. A Department of Cybersecurity would be built around a common set of skills, people and know-how all working on a common issue and goal. Very different.

Strengthening our cyberdefense is as vital as having a powerful standing army to defend ourselves and our allies. Russia, China and others have invested in their cyberwar capabilities to exploit our systems almost at will.

Counterpunching those efforts requires our own national mandate executed with Cabinet level authority. If we don’t bestow this level of importance to the fight and set ourselves up to win, interference in US elections will not only be repeated …  such acts will seem trivial in comparison to what could and is likely to happen.

News Source = techcrunch.com

Russia targeted election systems in 21 states, successfully hacking some

in 2016 election/Congress/Delhi/Department of Homeland Security/election hacking/electronic voting/Government/Hack/India/Politics/Russia/TC by

On Friday, the Department of Homeland Security notified nearly half of the U.S. states that their election systems were targeted by Russia-affiliated hackers in an attempt to influence the 2016 election. In most of the states targeted, the hackers were engaged in preliminary activities like scanning. In other states hackers attempted to infiltrate systems and failed, but in a small selection of states, with only Illinois confirmed so far, the election systems were compromised successfully. According to Homeland Security, none of these attempts were aimed at the systems that actually tabulate the votes themselves.

At least 21 states were the focus on these hacking attempts, including Alabama, Alaska, Arizona, California, Colorado, Connecticut, Delaware, Florida, Illinois, Iowa, Maryland, Minnesota, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Texas, Virginia, Wisconsin and Washington, as confirmed by the Associated Press and the states themselves. States like Florida, Ohio, Pennsylvania, Virginia and Wisconsin are among the swing states considered critical to an electoral college victory last year. So far, other battleground states including Michigan, Nevada, New Hampshire and North Carolina are not among those confirmed in the hacking attempt.

In a message to election officials in the state of Wisconsin, Homeland Security specified that the hack was conducted by “Russian government cyber actors.” The agency first confirmed the state-level hacking attempts toward the 21 states in June, informing the Senate Intelligence Committee. At that time, the states targeted by the operation were not made public.

Some members of Congress have spoken out against Homeland Security’s decision to delay notifying states and providing details, including Rep. Adam Schiff and Sen. Mark Warner, the ranking Democrats on the House and Senate’s respective intelligence committees.

“It’s unacceptable that it took almost a year after the election to notify states that their elections systems were targeted, but I’m relieved that DHS has acted upon our numerous requests and is finally informing the top elections officials in all 21 affected states that Russian hackers tried to breach their systems in the run up to the 2016 election,” Warner said.

In a statement to TechCrunch, Homeland Security spokesperson Scott McConnell elaborated on the decision to inform states:

“DHS does not publicly disclose cybersecurity information shared between the department and its partners. When we become aware of a potential victim, DHS notifies the owner or operator of the system, who in this case may not necessarily be the Secretary of State’s office. However, recognizing that state and local officials should be kept informed about cybersecurity risks to election infrastructure, we are working with them to refine our processes for sharing this information while protecting the integrity of investigations and the confidentiality of system owners.

This includes the development of an election subsector coordinating council and making security clearances available to those who may need access to classified information in the oversight of their election systems. As part of our ongoing information sharing efforts, today DHS notified the Secretary of State or other chief election officer in each state of any potential targeting we were aware of in their state leading up to the 2016 election. We will continue to keep this information confidential and defer to each state whether it wishes to make it public or not.”

We will be following this story as more states disclose details around election-related hacking activity.

Featured Image: franckreporter/Getty Images

News Source = techcrunch.com

Go to Top