The CyberWire Pro Policy Briefing for 3.18.20

Summary

By the CyberWire staff

At a glance.

China expels US journalists.
Some HIPAA requirements relaxed to aid remote healthcare during the COVID-19 pandemic.
HHS incident shows difficulties of attribution.
FISA reform remains on hold in the US Congress.
Tension between public health and civil liberties?

China expels US journalists.

Amid tensions over trade, espionage, and, most recently, the origin and spread of coronavirus, China's government has expelled a number of US journalists and banned their publications from working in the country. The Wall Street Journal lists the affected news outlets as itself, the New York Times, and the Washington Post, with Time and the Voice of America placed on notice that they could be next, if they don't straighten up and fly right.

US will overlook certain HIPAA violations.

The US Department of Health and Human Services has announced it will waive potential fines for healthcare providers who use Facetime and Facebook Messenger to consult and diagnose patients, CNET reports. Ordinarily doing so would violate the Health Insurance Portability and Accountability Act (HIPAA), but HHS is relaxing enforcement as a sensible accommodation to the pandemic.

Downtime, incidents, and attribution.

The consensus about the incident the US Department of Health and Human Services experienced Sunday and Monday is now relatively firm: it probably wasn't an attack at all, and clearly the Department's operations didn't suffer. Some think that it might not even have amounted to a probe or a preliminary distributed denial-of-service attack. It might have been an unusually large number of visitors looking for reliable information on COVID-19, or even an artifact of the Department's Drupal instance.

The episode should indicate, as we’ve seen so often in the past, the difficulties of attribution. It’s often difficult to tell whether an incident is an attack at all, or simply a malfunction, or even just routine functioning that’s a little bit out of the ordinary. Given the centrality of deterrence to the US national strategy recommended by the Cyberspace Solarium, what the commission's final report called "enhanced attribution" will be a must.

Whither FISA reform?

The US Senate extended domestic surveillance authorities temporarily this week, but Foreign Intelligence Surveillance Act (FISA) reform will have to wait. As Lawfare describes, there are many in Congress and the Administration who want more extensive FISA reform than that contained in the House bill the Senate has yet to consider.

Governments consider extraordinary methods in fighting COVID-19.

The Telegraph summarizes ways in which several countries are considering technologies ranging from surveillance to social control as potential responses to the COVID-19 pandemic.

Selected Reading

Could dystopian technology be what saves mankind? (The Telegraph) In India the authorities want to know where you are.

Britain developing coronavirus 'close contact detector' app (The Telegraph) A new mobile app that can instantly alert people if they have been in close contact with someone carrying the coronavirus is under development.

U.S. government, tech industry discussing ways to use smartphone location data to combat coronavirus (Washington Post) The U.S. government is in active talks with Facebook, Google and a wide array of tech companies and health experts about how they can use data gleaned from Americans’ phones to combat the novel coronavirus, including tracking whether people are keeping one another at safe distances to stem the outbreak.

Israeli Spyware Firm Wants to Track Data to Stop Coronavirus Spreading (Bloomberg) Product sifts through mobile phone data to pinpoint contagion. Israel security agency uses own software to critics’ dismay.

Internet's largest social networks issue joint statement on COVID-19 misinformation (ZDNet) Facebook, Google, LinkedIn, Microsoft, Reddit, Twitter, and YouTube put out joint statement promising to fight COVID-19 fraud and curb misinformation.

Google, Facebook, Twitter join other tech giants in bid to curb fake COVID-19 posts (Silicon Valley Business Journal) The rare joint statement issued by Facebook, Twitter, Google, YouTube, LinkedIn, Reddit and Microsoft called on others to join them to fight false information that has spread in response to the COVID-19 outbreak.

Facebook is wrongly blocking news articles about the coronavirus pandemic (Business Insider) Facebook's automated moderation systems appear to be "going haywire."

Viewpoint: Geneva Conventions for Cyber Warriors Long Overdue (National Defense) Cyber warfare is a fact of the modern world. However, there is no clear international law that distinguishes between warfare, terrorism, crime or vandalism.

Higher Education Ministry suspends all teaching, e-learning (The Star Online) The Higher Education Ministry has suspended all teaching and learning activities, including e-learning, in all public and private higher-learning institutions in the country.

China Banishes U.S. Journalists from Wall Street Journal, New York Times and Washington Post (Wall Street Journal) China said it was revoking the press credentials of American journalists working for three major U.S. newspapers in the largest expulsion of media since the Mao era, amid an escalating battle with the Trump administration over media operating in the two countries.

Op-Ed: Spying for profit: The dangers of economic intelligence (Daily Maverick) For all intents and purposes, protecting economic well-being has become about protecting the economic wellbeing of the rich. Economic intelligence in pursuance of a country’s national interests facilitates crony capitalism and legitimises spying for profit.

U.S. Blacklists New Islamic State Leader (Wall Street Journal) The designation of Amir Muhammad Sa’id Abdal-Rahman al-Mawla as a global terrorist comes as the U.S. continues to add pressure on ISIS.

US waives potential health privacy penalties during coronavirus crisis (CNET) Doctors in the states can start using Facebook Messenger and FaceTime to diagnose patients, without worrying about violating privacy laws.

What Happened to FISA Reform? (Lawfare) On March 16, the Senate punted on the issue of reforming the Foreign Intelligence Surveillance Act—a sign of just how dysfunctional Congress and the executive branch have become.

FTC Increasingly Looks to Public Companies’ SEC Disclosures for Privacy and Cybersecurity Enforcement Opportunities (Cooley) While the FTC does not make its initial privacy and cybersecurity investigations public, there have been reports that the FTC has initiated an increasing number of privacy and cybersecurity-related…

Attorney General Barr urges DOJ to prioritize prosecuting coronavirus scammers (CyberScoop) Scammers who have been taking advantage of the coronavirus pandemic by spreading spearphishing emails have the attention of the Department of Justice.

Report urges alternative to tampering with tech's liability shield (Axios) Digital free speech group says lawmakers should force more transparency instead.

Needed: A Cybersecurity Good Samaritan Law (Dark Reading) Legislation should protect the good hackers who are helping to keep us safe, not just go after the bad.

Cabaniss resigns as OPM director (Federal News Network) Dale Cabaniss, who briefly led the Office of Personnel Management for six months, has resigned Tuesday afternoon, Federal News Network has learned.

Election commission hires cyber-savvy adviser to support 2020 efforts (CyberScoop) Maurice Turner is set to join the federal commission at the end of the month as a senior adviser to the EAC's executive director.

DOD's red team hackers struggle sharing vulnerabilities with military (FedScoop) The DOD's own hackers need to share the vulnerabilities they uncover with the military and be better trained, among other issues a new DOD IG report found.

Followup Audit on Corrective Actions Taken by DoD Components in Respon (Department of Defense Office of Inspector General) Publicly Released: March 17, 2020The objective of this followup audit was to determine whether DoD Cyber Red Teams and DoD Components took actions to correct problems identified in Report No.

Government Is Broadening Investigations of Spoofing-Like Practices (Wall Street Journal) Authorities are investigating whether traders at JPMorgan Chase & Co. manipulated the market for Treasury securities and futures contracts, according to regulatory disclosures and people familiar with the matter.