The CyberWire Pro Policy Briefing for 2.2.21

Summary

By the CyberWire staff

At a glance.

Authorities interrupt Internet service in Myanmar, India.
EU works on data-transfer agreements with UK, US.
Distinguishing acts of espionage from acts of war.

Governments switching off the Internet.

CNN reports that Internet access has been cut off in a number of areas around New Delhi as protests over new agricultural laws intensify. The Ministry of Home Affairs justified the decision as “in the interest of maintaining public safety and averting public emergency." Others are decrying the action as “undemocratic.”

CyberScoop says Myanmar appears to have restricted Internet access as well in the wake of yesterday’s coup, with the “disruption pattern” indicating “a centrally issued blackout order.” Telephone communications and government media outlets were reportedly also suspended. The Biden Administration denounced the moves and threatened sanctions.

EU workshops data transfer agreements with US, UK.

Following Brexit and an EU court decision overturning an existing US data flow accord, the EU, UK, and US are hammering out new GDPR-compliant arrangements, the Wall Street Journal reports. International businesses are hanging in the balance, with US intelligence collection customs tipping the scales.

Opinions: Cyber violence is not the answer to Solorigate.

SC Media advises firms impacted by Solorigate to focus on swapping intel with the Government and bolstering defenses through virtual checks and balances (for example, using one provider for a service and another to monitor that service for aberrations)—not on confronting Huggy Bear mano a mano. Retaliation may seem tempting, but as one expert put it, “It is the equivalent of…deciding to go punch a bear in the face that just stole your picnic basket.” Another proposed fix SC Media rejects as an empty handshake is a cyber Geneva Convention.

While offensive actions are the province of the Government, they may be unwise in this case. GCN says US President Biden is under pressure to “respond forcefully,” and is weighing retaliative measures, but sanctions and counter-attacks haven’t worked to deter hackers in the past, and can escalate the conflict and harm the initiating country. Instead, GCN recommends building for resilience.

A C4ISRNET editorial reminds readers of the difference between espionage and cyberattacks, which disrupt, degrade, or destroy systems. US presidents have never considered incidents of espionage acts of war. That said, Russia may now have “enormous advantage in negotiations, defense planning, policy formation, foreign affairs and intelligence,” and it’s concerning that cyberspace has given authoritarian regimes a leg up on the global stage.

Selected Reading

Amid military coup, Myanmar's internet is partially blacked out (CyberScoop) Internet connectivity dropped precipitously in Myanmar on Monday as the military seized power, likely the result of the government shutting down access in a move that drew condemnation from President Joe Biden and digital freedom activists.

Myanmar coup: Joe Biden threatens to resume sanctions (the Guardian) US president calls for international solidarity in confronting generals who have seized power in country

Secretary Antony J. Blinken With Andrea Mitchell of MSNBC Andrea Mitchell Reports (United States Department of State) QUESTION: We see the Russian people are out and protesting against Vladimir Putin. There have been many arrests, thousands braving these sub-freezing temperatures. Alexei Navalny’s wife was detained protesting against his arrest and, of course, previously his poisoning by Russian authorities. You have condemned this, and the Russians have responded saying that this is gross […]

State’s New Cyber Office Brings Up Old Congressional Turf Issues (Nextgov.com) The House Homeland Security Chair and new Cybersecurity subcommittee leader say any cyber diplomacy should also tap CISA’s expertise.

Cyber espionage is not cyber attack (C4ISRNET) A expert explains how a recent giant hack is a classic case of espionage that differs from a true cyberspace attack.

SolarWinds Breach Shows Why Cybersecurity Whistleblowers Need Protection (Bloomberg Law) The 117th Congress should prioritize enacting a cybersecurity and data privacy whistleblower protection law. Zuckerman Law attorneys say the SolarWinds breach serves as a stinging reminder that we continue to ignore these whistleblowers to the detriment and peril of our national security and economy, as well as the security of our personal, sensitive data.

Trusting the Vote: Establishing a Presidential Commission on Election Resilience and Trust (Alliance For Securing Democracy) ASD’s Elections Integrity Fellow David Levine and the Center for Democracy and Technologies' Senior Technologist in Elections and Democracy William T. Adler urge President Biden to establish a bipartisan presidential commission to recommend ways to restore public trust in democracy. Introduction The deadly events of January 6, 2021 have made it abundantly clear that

Disruptive by Design: Transcending Cyber (SIGNAL Magazine) The Defense Department has an information warfare (IW) problem. There's no organization within the department that directs, synchronizes and coordinates IW planning and operations.

Letitia Long, Larry Hanauer: New Administration Poses Intell Community Revitalization Opportunities (GovCon Wire) Intelligence and National Security Alliance executives Letitia ‘Tish’ Long and Larry Hanauer noted s

How the NSC can better tackle emerging technology threats (Brookings) Surveillance cameras are seen in front of a Huawei logo in Belgrade, Serbia, August 11, 2020. REUTERS/Marko Djurica Technology is fundamentally altering the security landscape. Rapid and profound a…

Bipartisan bill would help domestic abuse survivors bypass mobile surveillance (CyberScoop) There's a new bill on Capitol Hill aimed at helping domestic violence victims bypass partner surveillance and safely leave shared phone plans.

European Data Protection Board Issues Guidelines On Examples Regarding Data Breach Notification (Mondaq) On 14 January 2021 the European Data Protection Board (EDPB) adopted Guidelines 01/2021 on Examples Regarding Data Breach Notification, ("Guidelines").

Paul M. Abbate Named FBI Deputy Director (US Federal Bureau of Investigation) Director Christopher Wray has named Paul M. Abbate as the deputy director of the FBI.

DARPA Announces Results of First Hardware Bug Bounty (Homeland Security Today) After three months of reviewing more than 13,000 hours of hacking exploits conducted by more than 580 cybersecurity researchers, DARPA has announced that its Finding Exploits to Thwart Tampering (FETT) Bug Bounty successfully proved the value of the secure hardware architectures developed under its System Security Integration Through Hardware and Firmware (SSITH) program while pinpointing critical areas to further harden defenses.

DARPA’s First Bug Bounty Program Highlights Security Successes, Weaknesses (Meritalk) The Defense Advanced Research Projects Agency (DARPA) announced that its first bug bounty program has “proved the value of the secure hardware architectures developed under [DARPA’s] System Security Integration Through Hardware and Firmware (SSITH) program while pinpointing critical areas to further harden defenses.”

Can Third-Party Security Programs Prevent the Next SolarWinds? (Security Boulevard) While the U.S. government was focused on election security last year, unbeknownst to senior American officials a secret cyber espionage campaign by a major nation-state adversary of unprecedented magnitude was already underway – lethal, stealthy and undetected.

Does Einstein need a post-SolarWinds makeover? (FCW) A marquee program designed to protect the government against cybersecurity threats is facing new scrutiny in the wake of Solar Winds Orion breach, but analysts say the program was unlikely to have ever stopped the hacking campaign.

The U.S. Spent $2.2 Million on a Cybersecurity System That Wasn’t Implemented — and Might Have Stopped a Major Hack (ProPublica) The software company SolarWinds unwittingly allowed hackers’ code into thousands of federal computers. A cybersecurity system called in-toto, which the government paid to develop but never required, might have protected against this.