Policy Briefing, 3.2.20

More Signal. Less Noise.

MVISION Cloud: Real-time protection for enterprise data across SaaS, PaaS, IaaS, and private cloud.

Time changes everything –so does the cloud. Yet, even as the cloud unlocks potential it opens the door to threats. McAfee designs security natively in the cloud, for the cloud. To protect the latest, like containers. To empower your change-makers, like developers. And to enable business accelerators, like your teams. Cloud security that accelerates business, it’s about time. Visit McAfee.com/time.

V2 | Issue 41 | 3.2.20

The CyberWire Pro Policy Briefing for 3.2.20

Summary

By the CyberWire staff

At a glance.

Cyberspace is not as lawless as it appears.
US skepticism about Huawei continues.
The US Senate Commerce Committee considers establishing cybersecurity grand challenges.

International law applies in cyberspace, too.

Just Security has a long essay that serves as a useful corrective to the widely held but arguably wrong-headed notion that cyberspace really is lawless, "the Wild West," as it's commonly called. While it's true that many of the details of international law in cyberspace remain unsettled, and while a few (actually, about four) governments habitually behave as if the information super highway is a lawless road straight out of Graham Greene, the reality is quite different. Two general bodies of international law are particularly relevant, and have particularly applicable analogies with norms of good conduct in cyberspace. First, cyberspace is in many respects similar to a global commons, like the oceans, and the law of the sea affords many precedents that guide how one ought to conduct oneself there. Second, cyberspace is a military operational domain, a place where states contend along the spectrum of conflict. And here the international law of armed conflict surely applies. Consider prohibited targets. A cyberattack that effectively took a hospital out of operation would be on the face of it an illegitimate operation, as would cyberattacks that caused disproportionate suffering, or worked indiscriminate damage against clearly civilian targets. "With all due respect to the norm-skeptics, international law is alive and well in cyberspace," the essay's conclusion begins.

The US postpones talks about Huawei until next week, but this shouldn't be read as a reprieve.

A cabinet-level meeting on the future of strictures against Chinese hardware manufacturer Huawei has been postponed until March 11th, Reuters reports, but it seems unlikely this foreshadows any sort of reprieve. Huawei itself seems to be preparing itself for a protracted round of difficulties. The company is preparing to move away from US-manufactured chips to semiconductors it produces itself, Bloomberg reports, and it's beginning to prepare a charm offensive, a kind of image makeover, and the Wall Street Journal says Huawei is talking to various US influencers and K-Street types as it sorts out its strategy.

Cyber Grand Challenges?

The US Senate Commerce Committee is considering how it might establish a set of cybersecurity grand challenges, how it might establish a set of clearly stated, difficult-to-solve but in-principle-soluble problems that researchers could tackle for appropriate rewards. Nextgov says there's draft legislation that would put money behind such challenges.

Selected Reading

The Cybersecurity 202: Officials fear coronavirus could be next front in election interference (Washington Post) U.S. officials fear adversaries might weaponize public fears about coronavirus ahead of Super Tuesday to spread disinformation, amplify rumors and tamp down voter turnout.

TA505 hacking crew spent much of 2019 trying to breach South Korea's financial sector (CyberScoop) TA505, a gang of hackers with a long history of financially motivated attacks, increased its targeting of businesses in South Korea last year.

Norm-Skepticism in Cyberspace? Counter-factual and Counterproductive (Just Security) Leading expert on international law and cyber responds to statement by Chief of US Naval Operations, Admiral Mike Gilday on international norms in cyberspace.

What’s next for nation-state collaboration in cyberspace? (Fifth Domain) Recent events have demonstrated the progress like-minded nations have made in establishing norms of responsible behavior in cyberspace, but there is more to address.

The Need for a 'Collective Defense' (BankInfo Security) Among the top issues being discussed at the RSA 2020 conference this week is the need for more cybersecurity collaboration between government agencies and the

Taiwan accuses China of waging cyber 'war' to disrupt virus fight (U.S.) Taiwan's foreign minister on Saturday accused giant neighbor China of wagin...

China’s 5G tech is a national security issue ... or is it a trade one? (C4ISRNET) How the Trump administration has approached banning Huawei’s technology for 5G networks has raised a question at the annual RSA Conference: Is the decision rooted in national security issues or trade issues?

US postpones meeting on potential measures to restrict Huawei from using American technology (Computing) The meeting is now expected to be postponed on 11th March

U.S. moves high-level U.S. meeting on China tech, possible new Huawei curbs to March: sources (Reuters) Trump administration officials have rescheduled for March 11 a critical meeting ...

Senate passes bill providing $1 billion for rural telecom networks to replace Huawei (ABC7 San Francisco) The Senate passed a bill that would provide $1 billion for rural telecom companies to replace equipment from Chinese tech giant Huawei.

A Democratic president could have a big impact on the tech industry — here's where the candidates stand on important tech issues (CNBC) The democratic presidential candidates have shared their views on issues like breaking up Big Tech, antitrust, online privacy and net neutrality.

Key House Democrat criticizes DHS for not submitting election security report on time (TheHill) House Homeland Security Committee Chairman Bennie Thompson (D-Miss.) on Friday raised concerns around the Department of Homeland Security’s (DHS) failure to submit a congressionally mandated election security report

Former NATO chief has 3 tips to secure 2020 election (Fifth Domain) Adm. James Stavridis has suggestions for the public and politicians.

West Virginia backtracks on using smartphone voting app in state primary (NBC News) Voters with disabilities will instead be able to use a system that prints out their completed ballot, which they can then mail in.

Senate Commerce Committee Is Cooking Up a Bill to Support Cyber Grand Challenges (Nextgov.com) Presidential advisers want their cybersecurity “moonshot” to become more than just another report gathering dust.

The future of defense contractor cybersecurity standards (Fifth Domain) Katie Arrington, CISO for the Office of the Under Secretary of Defense for Acquisition and czar for the new Cybersecurity Maturity Model Certification, told Fifth Domain her thoughts on CMMC's “constant state of evolution.”

For information operations, Air Force wants integration (C4ISRNET) The Air Force’s new information warfare command will open an operations center in March as part of a broader effort to better integrate the service’s information-related capabilities.

The Navy’s fleet-footed plan for hardening networks (C4ISRNET) NAVWAR Commander Rear Adm. Christian “Boris” Becker shares how a mindset change is speeding up how data feeds preparedness and how he envisions the information warfare enterprise moving forward.

Trump again nominates Rep. John Ratcliffe to be director of national intelligence (Washington Post) President Trump announced Friday that he would nominate Rep. John Ratcliffe as the next director of national intelligence, turning to a vocal political ally after dismissing his previous acting intelligence director amid new questions of election interference by Russia.

Switzerland Files Criminal Complaint Over Crypto Spying Scandal (New York Times) The Swiss government has filed a criminal complaint over the U.S. Central Intelligence Agency's alleged use of a cryptography company as a front to spy on various governments' secret communications, the Swiss attorney general's office said on Sunday.

La lettre d’Europe: la Suisse, le pays où les espions sont les bienvenus (Le Soir Plus) L’affaire Crypto AG éclate au grand jour dans un pays très réputé pour son industrie du chiffrement.

FCC seeks $200M in total fines against top wireless carriers (Axios) FCC investigated wireless companies' sharing of customers location data.

T-Mobile Vows to Fight FCC Fines for Location Sharing (Wall Street Journal) Federal telecom enforcers told the top U.S. cellphone carriers to pay more than $200 million in penalties for allegedly mishandling sensitive location data, a punishment at least one company vowed to contest.

With Online Revenge Porn, The Law Is Still Catching Up (Law360) The law is still lagging behind the rise of nonconensual pornography — explicit images distributed online without the subject’s consent — and it’s forcing attorneys to get creative so victims can have some peace.