Good faith bug-hunting. US considers banning more Chinese apps. House Intelligence Committee to investigate DHS decision on intelligence report. Google antitrust action nears?

Summary

By the CyberWire staff

At a glance.

CISA BOD 20-21 and "good faith" bug hunting.
US considers banning more Chinese apps.
House to investigate DHS decision on Russian influence campaign report.
US Department of Justice may file antitrust complaint against Google as early as this month.

Observers fasten on "good faith" white hat hacking aspects of CISA Binding Operational Directive.

The Wall Street Journal exemplifies a common reaction to the US Cybersecurity and Infrastructure Security Agency's (CISA) Binding Operational Directive 20-21, issued yesterday: it enunciates protection for white hat hackers inspecting Government systems in good faith. Bugcrowd's Founder, Chairman, and CTO, Casey Ellis, offered applause from the bug-hunting industry, as well as a set of suggestions CISA might follow as it oversees implementation of the Binding Operational Directive. They're grounded in the experience of administering bug bounty programs:

"Prioritize the enablement of per-agency roadmap development."
"Set a clear expectation that restrictive scope is unlikely to be followed by Finders, and that scope control isn’t the purpose of an organizational Vulnerability Disclosure Program."
"Extend the timeline to a fully public vulnerability disclosure program."
"Treat CERT/CC or other centralized points of intake as the exception process, not the primary process."
"Double down on the encouragement of 'good-faith authorization' (aka Safe Harbor)."
"Continue to clearly disambiguate 'vulnerability disclosure' from 'bug bounty' and 'private crowdsourced security'."
"Disambiguate researcher, contractor, etc to 'Finder' where possible."

Report: more Chinese apps on the US chopping block.

CNBC reports that, as recently enacted Chinese export controls stall the sale of TikTok operations to a US company, the US Administration is considering banning more Chinese apps on national security grounds. Which ones are candidates for banning was not immediately specified.

US House to open an investigation of DHS's hold on disclosing a Russian disinformation effort.

The House Intelligence Committee intends to investigate the Department of Homeland Security's decision not to release a report from the Department's Office of Intelligence and Analysis, ABC News reports. Committee Chair Adam Schiff (Democrat, California 28th District) said the inquiry will determine whether the decision not to give the draft report, a description of a Russian plan to call Democratic Presidential nominee Joe Biden's mental health into question, wide circulation within the Government was politically motivated. DHS has said the draft report "lacked the necessary context and evidence for broader dissemination."

The US Department of Justice moves closer to bringing an antitrust case against Google.

According to the New York Times, the US Justice Department intends to bring an antitrust case against Google as early as this month. The move has long been considered probable, and Attorney General Barr has directed that the investigation has enough to proceed, and that Departmental lawyers who wish for more time to put the case together need to be given a deadline.

Selected Reading

Why both Huawei and BTS share the cyber stage with powerful nations (ZDNet) Cyber conflict isn't about cyberwar, says The Grugq. It's about a global cyber power struggle that never ends, where even K-pop bands can influence nation states.

Cyberspace Breeding Ground For Radicalisation – PMB (Leadership Newspaper) PMB President Muhammadu Buhari has said the migration to cyber space was a breeding ground for radicalism in the world. According to the president, the

Iran Joins Discussions of Sovereignty and Non-Intervention in Cyberspace (Just Security) Przemysław Roguski explains the importance and substance of Iran's recent statement on international law in cyberspace

()

National Security Advisor says US must ‘confront the Chinese across all spectrums’ (Atlantic Council) Robert C. O’Brien said the United States must be prepared to push back against Chinese aggression militarily, diplomatically, and economically.

Op-ed: America and its allies must reject China's Huawei and lead on 5G development (CNBC) Less than six months ago, it appeared Chinese telecom giant Huawei was winning over America's European allies. Now, countries that decided to allow Huawei to build their 5G networks are waking up to the dangers posed by allowing Chinese state-directed companies into their infrastructure.

Chinese Tech Companies Shrouded in Veil of Mystery (Industry Global News24) In late June 2020, the US Federal Communication Commission (FCC) ascertained in the interests of the nation, two mobile players Huawei and ZTE as ‘national security threat’.

Democrats to investigate DHS decision to withhold election interference bulletin (ABC News) House Dem leaders criticized DHS for withholding a draft intelligence bulletin warning law enforcement agencies of a Russian effort to spread disinformation about Biden.

()

US Cyber Command welcomes new deputy commander (U.S. Cyber Command) Air Force Maj. Gen. Charles “Tuna” Moore assumed responsibility as the deputy commander of U.S. Cyber Command, replacing Navy Vice Adm. Ross A. Myers, and was promoted to

Online-voting company pushes to make it harder for researchers to find security flaws (CNET) Voatz, an e-voting company, tells the Supreme Court that security research should be done only with permission.

Justice Dept. Plans to File Antitrust Charges Against Google in Coming Weeks (New York Times) The attorney general is said to have set a deadline over the objections of career lawyers who say they need more time to build the case.

Sen. Rubio asks for DHS briefing after alleged cyber-attack on Florida school district (WPEC) Sen. Marco Rubio is asking the Department of Homeland Security for its intelligence briefing after an alleged cyberattack against the Miami-Dade County School District. Miami-Dade County Public Schools announced that its virtual learning platform was the target of 12 cyberattacks. According to the Superintendent, the fifth attack prevented more than 170,000 students and teachers from logging into the system and kicked off users who were already in the system.

Pentagon, Defense Contractors Are Out Of Step On Tech Innovation, GAO Finds (Defense One) The Pentagon wanted to fund ambitious research into future tech breakthroughs but contractors spend most of their money on safer bets, GAO has found.

AI’s Data Hunger Will Drive Intelligence Collection (Breaking Defense) The Pentagon’s new Chief Data Officer says real-world surveillance missions must be redesigned to capture high-quality data to train machine-learning algorithms.

Creepy ‘Geofence’ Finds Anyone Who Went Near a Crime Scene (Wired) Police increasingly ask Google and other tech firms for data about who was where, when. Two judges ruled the investigative tool invalid in a Chicago case.