The CyberWire Pro Policy Briefing for 12.12.19

Summary

By the CyberWire staff

The US Senate appears to be leaning towards the Justice Department's position on encryption, the Washington Post reports. During a Senate Judiciary Committee hearing on Wednesday, committee chairman Lindsey Graham told representatives from tech companies including Apple and Facebook that "You’re going to find a way to do this or we’re going to do it for you," referring to lawful access to encrypted data. Fortune notes that senators' arguments against end-to-end encryption tended to focus on fighting child exploitation and sex trafficking, as opposed to the FBI's earlier warnings that the technology would enable terrorists to operate undetected. The Washington Post points out that Senator Graham's position has shifted since the Justice Department was trying to gain access to an encrypted iPhone in the wake of the 2015 San Bernardino shootings.

Facebook refused Attorney General William Barr's request that the company delay its plans to implement end-to-end encryption across all of its services, Computing says.

Senator Ron Wyden (Democrat of Oregon) is seeking information on how Avast uses its customers' data, according to Motherboard. Wladimir Palant, creator of Adblock Plus, revealed in October that the Avast was storing browsing information on users of the security company's browser extensions. Avast's CEO Ondrej Vlcek told Forbes that the data is anonymized and can't be used for targeted advertising, but it is used by companies to determine metrics about web traffic.

The Wassenaar Arrangement held its annual meeting of member states and determined that "software designed or modified for the conduct of military offensive cyber operations" will now be treated as a military technology, Jane's 360 reports.

Selected Reading

Wassenaar targets cyber-warfare systems, communications surveillance with new rules (Jane's 360) Military-grade offensive cyber-warfare technologies given increased controls through addition to military list. Addition of offensive cyber-warfare technologies comes after significant concerns raised by private sector over impact on vulnerability assessments.

China Wants Your Personal Information, Trump's National Security Adviser Warns (WAMU) If some U.S. allies allow Chinese company Huawei into their 5G telecommunications networks, Robert O'Brien says China's communist government would have access to sensitive personal data.

The Pegasus fiasco: Privacy in peril (Frontline) The targeted snooping of WhatsApp accounts in India by malicious software raises concerns about privacy, data protection and citizens’ rights.

Britain’s antiquated election system can’t cope with social media’s many challenges (The Telegraph) Deep fakes, doctored videos and a string of other emerging technologies are taking the art of political misinformation in new and dangerous directions – the need for remedial action has never been greater.

Trump meets Russia’s top diplomat amid scrap over election interference (Washington Post) Secretary of State Mike Pompeo and Russian Foreign Minister Sergei Lavrov clashed during a news conference at the State Department before a White House meeting.

GOP senator blocks bill aimed at preventing Russia election meddling (TheHill) Sen. Mike Crapo (R-Idaho) on Tuesday blocked an attempt by Democrats to pass legislation meant to prevent Russia and other countries from interfering in elections.

Advisory group looks to redesign federal cyber response (FCW) The National Infrastructure Advisory Council wants new agencies to tackle 'existential' cyber threats.

Infrastructure Council Warns Trump That Chance to Thwart a Cyber 9/11 ‘Is Closing Quickly’Department of Defense Contracts for Dec. 10, 2019Report: Email Remains a Weak Link in U.S. Election Infrastructure (HS Today) The president’s National Infrastructure Advisory Council warned Donald Trump in a draft report this week that cyber threats need to be confronted with dire urgency, considering the grave risks posed to society’s most critical sectors from bad actors including Russia, China and Iran and the inability of private industry to fend off sophisticated attacks on their own

{Draft NAIC report on cyber risk] (NAIC) On September 5, 2019, the National Security Council tasked the President’s National Infrastructure Advisory Council (NIAC) to examine how the federal government and private industry can collaborate seamlessly to confront urgent cyber risks in the most critical and highly targeted private infrastructure.

Senators Don't Get Encryption (Fortune) U.S. lawmakers threatened tech companies like Facebook and Apple with anti-encryption regulation at a Senate Judiciary Committee hearing, ignoring the complexity of the issue.

Open Rights Group criticises government for demanding weaker encryption (Computing) The ORG believes such back-doors would endanger the security of internet users around the world,

Facebook turns down Attorney General's request for access to its messaging products (Computing) That would be a gift to hackers, criminals and repressive regimes, Facebook believes.

Senator Wyden Asks Avast Antivirus Why it Sells Users' Browsing Data (Vice) Wyden’s questions come after Mozilla removed Avast's and AVG’s extensions for harvesting user data.

CISA subpoena bill set to land (FCW) The legislation will make a number of changes from a proposal submitted by DHS, narrowing the scope of the authorities to critical infrastructure IT and only for cybersecurity purposes.

How Congress wants to help sync military cyber (Fifth Domain) New positions detailed in the annual National Defense Authorization Act will exist both with the Pentagon staff and at the services.

What the Defense Department’s Cyber Certification Will Mean for Small Businesses (Nextgov.com) The Pentagon lead for the Cybersecurity Maturity Model Certification program argued the move will be good for small contractors. And for those that don’t want to comply: Good riddance.

Republicans Condemn FBI’s Use of Surveillance Powers They Long Supported (Wall Street Journal) Republican senators expressed outrage Wednesday that the Federal Bureau of Investigation had committed errors in how it sought and obtained surveillance on a former Trump campaign adviser, a sharp pivot for several lawmakers.

House advances transportation security bill - Homeland Preparedness News (Homeland Preparedness News) The U.S. House of Representatives advanced Monday the Emerging Transportation Security Threats Act of 2019 (H.R. 3318). The bill, introduced by U.S. Rep. John Joyce (R-PA), creates a task force to analyze emerging threats to transportation security. It also requires …