State privacy laws in the US. Cyberwar and a force designed to wage it. Legislation to protect water utilities.

Announcement

Last day to take our survey (and a chance for a gift card).

Today is the last day to send us your feedback in exchange for a chance to win a $100 Amazon gift card. We'd love to hear how we can provide the best content for you, and help make your life easier (and more cybersecure).

Summary

By the CyberWire staff

At a glance.

An overview of US state privacy legislation.
Britain seeks military advantage in agility and innovation.
US Senators consider legislation to protect water utilities.

The state of US state privacy regulation.

JD Supra reviews proposed, passed, and failed state data privacy legislation. Alabama, Arizona, Colorado, Connecticut, Florida, Illinois, Kentucky, Minnesota, Maryland, Massachusetts, New York, New Jersey, Oklahoma, Rhode Island, South Carolina, Texas, Vermont, Washington, and West Virginia have bills up for consideration. California and Virginia have passed legislation, while Mississippi, North Dakota, and Utah’s bills failed. You can monitor the progress of state privacy laws here.

The Jeune École comes to the fifth domain.

As we’ve seen, the UK is laying the groundwork for a streamlined, cyber-optimized military. SecurityWeek quotes Defense Secretary Ben Wallace as saying the swing to prioritizing technology “marks a shift from mass mobilization to information age speed, readiness and relevance for confronting the threats of the future.”

The UK’s new strategy includes the following commitments, according to the Daily Swig:

A “greater emphasis on cybersecurity and cyber defense”
A new National Cyber Force
Weaponry equipped with state-of-the-art sensors and data-sharing abilities
Increased attention to emerging technologies like robotics, drones, and AI
A tactical focus on “information maneuver”
A collaborative effort to develop and enforce cyber norms

Two Government documents, Global Britain in a Competitive Age: The Integrated Review of Security, Defence, Development and Foreign Policy (described as “the most comprehensive review since the end of the Cold War”) and Defence in a Competitive Age detail the forthcoming changes.

The Integrated Review underscores the fundamental values of security, sovereignty, prosperity, universal human rights, democracy, the rule of law, freedom of speech, freedom of faith, and equality, and outlines four primary objectives:

“Sustaining strategic advantage through science and technology…to firmly establish the UK as a global S&T and responsible cyber power”
“Shaping the open international order of the future…not least in the future frontiers of cyberspace and space”
“Strengthening security and defence at home and overseas… in the physical world and online”
“Building resilience at home and overseas, improving our ability to anticipate, prevent, prepare for and respond to…cyber-attacks”

Thus do capable militaries seek the asymmetric advantages of speed and innovation over mere weight of metal.

Putting the fear of Oldsmar into them.

Yesterday a bipartisan coalition of Senators proposed regulation that would allocate $35 billion to issues impacting state water utilities, The Hill reports. The money would go towards building cyber resilience in addition to addressing lead contamination, antiquated systems, and environmental threats. “It’s clear that the lack of investments in our water infrastructure has led to a public health crisis,” commented Senator Duckworth (Democrat of Illinois).

Selected Reading

Covert Action, Espionage, and the Intelligence Contest in Cyberspace (War on the Rocks) In recent months, the world learned that China carried out an indiscriminate hack against Microsoft Exchange, while Russia hacked U.S. information

Huawei ban timeline: China reportedly tries Canadians in possible retaliation for exec's arrest (CNET) Here's a breakdown of the controversy surrounding the Chinese phone maker and telecommunications supplier.

Sierra Leone’s proposed cyber-crime legislation is a threat to free speech and civil liberty (Sierra Leone Telegraph) Sierra Leone Telegraph: 23 March 2021: In the past, politicians in Sierra Leone would invoke sections of the notorious Public Order Act that criminalized libel to suppress free speech and the press…

UK Unveils Plan for Smaller, More High-Tech Armed Forces (SecurityWeek) Britain plans to cut the size of its army and boost spending on drones, robots and a new “cyber force” under defense plans announced by the government.

Explainer: What does the UK’s Integrated Review mean for cybersecurity? (The Daily Swig) Stephen Pritchard sheds light on the government’s new defense strategy

SolarWinds compromise leaves Senate questioning agency cyber defenses (Utility Dive) Existing cyber defense programs fell short in detecting and defending U.S. agencies, a shortcoming that exacerbated SolarWinds fallout.

DHS Cyber Chief Says Hacks Slowed Progress on Public-Private Collaboration (Wall Street Journal) Hacks of U.S. agencies and companies in recent months have set back efforts to improve the public-private collaboration seen as key to defending against future attacks, the Department of Homeland Security’s top cyber official said.

Recent Cyber Attacks Show Increased Nation State Activity, Says Former NSA Director (BusinessWire) Cyber attacks launched by nation states are becoming more proficient and aggressive, Admiral (ret.) Michael S. Rogers tells NetDiligence webinar.

DHS Seeks Permission to Collect More Cyber Vulnerability Data (Meritalk) The Department of Homeland Security (DHS) is seeking comments on an Information Collection Request (ICR) to the Office of Management and Budget (OMB) to allow DHS to assist executive branch agencies in collecting cybersecurity vulnerability information and post the information on their own agency websites.

New bill could require Big Tech to pay news publishers for content (ABC News) U.S. lawmakers are going after Big Tech again, as Congress re-introduces a bill that could require companies like Facebook and Twitter to pay publishers for content. This battle already played out in Australia, where last month legislation passed requiring Facebook and Google to pay for news.

Bipartisan lawmakers introduce $35 billion water infrastructure bill (TheHill) A bipartisan group of lawmakers on Tuesday introduced a bill that seeks to give states more money to address aging water infrastructure, putting funds toward reducing lead levels and projects to address the impacts

Status Of Proposed CCPA-Like State Privacy Legislation As Of March 22, 2021 (JD Supra) Keypoint: It was another busy week with bills introduced in Colorado, New York and West Virginia, a committee hearing in New Jersey on three bills, a...

Montenegrin Secret Service Chief Under Fire After Allegedly Disclosing NATO Ally's Data (RadioFreeEurope/RadioLiberty) Prosecutors in Montenegro say they have opened a preliminary investigation into the alleged disclosure of classified information by the head of the National Security Agency (ANB), Dejan Vuksic.

CISA and NSA: The Times, They Are A-Changin.’ Identity is Everything Now (CISA and NSA: The Times, They Are A-Changin.’ Identity is Everything Now) The recent SolarWinds Senate hearing and a flurry of subsequent briefings have unearthed new questions around the attack, which acting director of the U.S. Cybersecurity and Infrastructure Agency...

First North Korean National Brought to the United States to Stand Trial for Money Laundering Offenses (US Justice Department) After nearly two years of legal proceedings, Mun Chol Myong (“Mun”), 55, a national of the Democratic People’s Republic of Korea (DPRK), has been extradited to the United States. This case represents the first ever extradition to the United States of a DPRK national.

New York Regulator Issues Second Enforcement Action Under Cyber Rules (Insurance Journal) The New York Department of Financial Services' (DFS) second enforcement action to date under its cybersecurity regulation underscores the importance of