Weapons of distraction. Evolving US breach notification requirements. Corruption under discussion at the Summit of Democracies.

Summary

By the CyberWire staff

At a glance.

Weapons of distraction.
Evolving US breach notification requirements.
Corruption under discussion at the Summit of Democracies.

Cyberattacks as a weapon of distraction.

Axios explores how state-backed threat actors could use a cyberattack as a distraction to interfere with the US government’s decision-making process. Using China as an example, Former Cybersecurity and Infrastructure Security Agency Director Christopher Krebs, referenced a report conducted by the US Cybersecurity and Infrastructure Security Agency (CISA) that revealed that in 2013 Chinese sponsored threat actors had their sights set on natural gas pipelines. Krebs explained, "If things get hot in Taiwan, there's a possibility that the Chinese government could use some sort of cyber capability to make us focus here rather than over there."

US continues to tighten data breach notification regulations.

Cooley reports that in November the US Office of the Comptroller of the Currency (OCC), the Federal Reserve Board (FRB), and the Federal Deposit Insurance Corporation (FDIC) issued a new breach notification rule for banking organizations and their service providers. Set to come into effect in April 2022, the rule treats banking organizations in much the same way as data owners or controllers under current breach notification laws, and also covers “bank service providers,” defined as any entity who performs services subject to the Bank Service Company Act. The rule requires that organizations notify their primary regulator (the OCC, FDIC or FRB) of a data breach as soon as possible and no more than thirty-six hours after the incident has been identified. That said, the clock doesn’t start ticking until the bank determines that the breach is in fact a “notification incident,” meaning the organization can take time to confirm “actual harm” before notification.

The National Law Review notes that the new regulation is just the latest in a series of evolving reporting requirements in the US. New breach notification rules for critical pipeline owners and operators came into effect in May, stating that cybersecurity incidents must be reported to the Cybersecurity and Infrastructure Security Agency within twelve hours. Similar regulations for health apps and health-related devices were implemented in September, and regulations for covered freight railroads, passenger rail, and rail transit systems will come into effect on New Year’s Eve.

Global democracy summit will focus on corruption.

At this week’s Summit for Democracy, the Biden administration will be discussing The United States Strategy on Countering Corruption, considered by anti-corruption experts to be President Biden’s most impressive strategy so far. Called “exactly what we’ve been waiting for” by the Helsinki Committee’s senior policy advisor Paul Massaro, the document focuses on multilateralism, with the United States Treasury vowing to fight tax evasion and foreign government corruption at US financial institutions by cooperating with existing multilateral organizations. The Atlantic Council explains that the goal is to get buy-in from the EU and UK, which should collaborate with USAID’s new Global Accountability Program and the US State Department’s Democracies Against Safe Havens initiative. Ideally, the EU and UK will also develop their own strategies to coincide with US efforts and implement tighter regulations for the historically unregulated real estate, private investment, and legal services sectors.

Selected Reading

U.S. Wins Appeal in Julian Assange Case, Bringing His Extradition Closer (Wall Street Journal) The government won an appeal in its bid to extradite the WikiLeaks founder, clearing an important hurdle in Washington’s yearslong battle to put him on trial on spying charges.

Who's watching? How governments used the pandemic to normalize surveillance (Los Angeles Times) Today's young are born into a digitally interconnected reality where big data and artificial intelligence will shape everyday existence long before the children are old enough to protect their privacy or give consent.

Chris Krebs: Future cyber attacks could be used to "disrupt" U.S. decision-making (Axios) Krebs said a cyberattack would be part of "a larger, more complex approach by an adversary."

Russia military chief warns Ukraine against attacking rebels (Military Times) The statement comes amid soaring tensions over a Russian troop buildup near the border with Ukraine that stoked Ukrainian and Western fears of a possible invasion.

What Russia might do in Ukraine: 5 scenarios (Breaking Defense) While it is impossible to predict what Russian President Vladimir Putin has planned, any decision may not be as black-and-white as “to invade or not to invade.”

Russian military movements near Ukraine: What satellite images show (Washington Post) Satellite images show how Russian forces and materiel have moved toward Ukraine from as far away as Siberia.

Biden, Ukraine leader discuss ways to resolve Russia crisis (Military Times) U.S. intelligence reports last week said Russia had moved 70,000 troops to Ukraine’s borders as it builds toward a possible invasion early next year.

Ukraine Ready to Fight to ‘Last Drop’ (Foreign Policy) But Biden’s talk of accommodating Russia has Congress worried.

Don’t Sell Out Ukraine (Foreign Affairs) The west must respond to Russia with strength, not appeasement.

Biden pledges more military support for Central Europe, Lithuanian official says (Reuters) U.S. President Joe Biden on Thursday promised Central European NATO members more military support as concern grows over a Russian troop build-up on the border with Ukraine, Lithuania's presidential advisor said.

No plans to send more troops to Ukraine, Biden says (Military Times) But the U.S. president still insists Russia will face severe consequences if it invades Ukraine.

Polish defense minister: Here’s how NATO must adapt (Defense News) Addressing the high dynamics of the global and regional situation will not be effective unless we continuously adapt. Our laws, institutions and mindsets must adapt. Our military must adapt. NATO must adapt.

US to deliver small arms and ammunition to Ukraine amid Russian tensions, Pentagon says (Stars and Stripes) The weapons are the last portion of a $60 million security-assistance package announced Sept. 1 meant to help Ukraine “more effectively defend itself against Russian aggression,” the White House said at the time.

How the US Military Could Mobilize If Russia Invades Ukraine (Military.com) U.S. paratroopers landing in the Baltics, Army cavalry and artillerymen convoying in from Germany and an armored brigade massing its forces.

Iran nuclear talks resume as U.S. and Israel intensify rhetoric (Reuters) Talks on reviving the 2015 Iran nuclear deal resumed on Thursday with the United States and Israel ramping up rhetorical pressure on Tehran about the possible economic or military consequences if diplomacy fails.

The U.S. Faces Hard Choices on Strategic Ambiguity in Europe and Asia (World Politics Review) trategic ambiguity worked in a world in which Washington could often, at little risk, deter rival powers from coercing smaller U.S. partners. Today, however, Russia and China’s increasing military assertiveness may mean that the period in which the U.S. could ensure partners’ security on the cheap is coming to an end.

U.S. to Bar Investment in Chinese AI Giant, Considers Banning Key Exports to Top Chip Maker (Wall Street Journal) The focus on SenseTime and Semiconductor Manufacturing International Corp. is part of a broader Biden administration effort against China’s tech firms.

China's state-backed cyberattacks are part of a larger plan (Marketplace) Experts estimate that intellectual property theft is costly for countries — and that China is frequently the main culprit.

‘An urgent matter’: Biden warns democracy is under threat at summit (the Guardian) President opens two-day summit with 80 world leaders as experts warn democratic rights are under assault in the US

Biden’s democracy summit should produce a transatlantic anti-corruption strategy (Atlantic Council) The Biden administration's impressive new corruption strategy should inspire the UK and EU to join in.

US to tighten restrictions on exports of malicious cyber tools (TheHill) The Biden administration is expected to announce on Friday an initiative to tighten rules surrounding the exports of certain technologies that have been used by authoritarian governments and bad actors for repression.

IronNet : Breaking down silos to enable Collective Defense against nation-state adversaries (MarketScreener) Last month I wrote about "the problem with a legacy mindset"within the cybersecurity community.

A quick look at cyber in the 2022 defense bill (Defense Systems) As has been the case for the past few years, cyber governance provisions were featured in this year's must-pass defense policy bill moving through Congress, but a bipartisan breach notification measure was dropped from the bill -- to the chagrin of its supporters.

36-Hour Breach Notification Rule to Go into Effect for Banking Organizations (cyber/data/privacy insights) On November 18, 2021, three US agencies – the Office of the Comptroller of the Currency (OCC), the Federal Reserve Board (FRB) and the Federal Deposit Insurance Corporation (FDIC) – issued a joint rule concerning computer-security incident notifications, which will go into effect on April 1, 2022, w

Federal Data Breach Reporting Requirements Continue to Evolve (The National Law Review) Complementing the patchwork of state data breach notification laws, a number of federal agencies recently have promulgated sector-specific reporting rules affecting a variety of companies...

More US moves to tighten up transport security in war against cyber attacks (Loadstar) Washington is moving to ramp up security against cybercrime in the US transport arena. The US Department of Homeland Security’s latest initiatives are pushing railroads to beef up their security, following a similar drive targeting airports and airlines. From the start of next year, major railways must also conduct a vulnerability assessment and develop formal plans on how to respond to cybersecurity incidents. In addition, they have to designate a cybersecurity co-ordinator ...

DoD reshuffles tech oversight, creates new office to manage 'SWAT team of nerds' (The Record) The Defense Department on Wednesday announced it would create a new office to oversee its data and artificial intelligence efforts, a restructuring that could have a lasting impact as the Pentagon races to keep pace with China’s technological advances.