| | | | |  | | By Sam Sabin | | | | — Groundhog Day, the sequel: Anti-surveillance advocates and Silicon Valley will spend the week lobbying against the Senate's EARN IT Act, once again, before Thursday's markup. — As Congress eyes expanding FinCEN's regulatory authorities, a former acting director says the financial crimes unit actually has all the power it needs to stop ransomware. — It's not just about data privacy: State lawmakers are also taking up several cybersecurity bills this year, including ones targeting data breach notification and election security. HAPPY MONDAY, and welcome back to Morning Cybersecurity! I'm your host, Sam Sabin, and based on the calendar of events for this week, I hope everyone's coffee machines (or tea kettles) are ready to go! Have tips and secrets to share with MC? Or thoughts on what we should track down next? Send what you've got to ssabin@politico.com . Follow along at @POLITICOPro and @MorningCybersec. (Full team contact info below.) Let's get to it:
| | | ENCRYPTION'S GROUNDHOG DAY — The Senate Judiciary Committee is expected to take up Sens. Richard Blumenthal (D-Conn.) and Lindsey Graham's (R-S.C.) EARN IT Act on Thursday. But ever since lawmakers reintroduced the bill last week, encryption advocates and the tech industry have been beating a familiar drum: the legislation could kill the tech industries' encryption offerings. "It will create a really significant disincentive for the offering of end-to-end encrypted services," said Samir Jain, director of policy at the Center for Democracy and Technology. The legislation has united encryption advocates and Silicon Valley who made a similar argument in early 2020, the last time Congress considered the legislation. Back then, the coronavirus pandemic cut the bill's lifespan short. Now, the measure could have more momentum as Congress seeks ways to tackle children's online safety following Facebook whistleblower Frances Haugen's testimony. — What EARN IT does: Blumenthal and Graham's legislation would remove Section 230 liability protections over users' posts if an online service fails to prove it's doing enough to curtail online child abuse materials. If signed into law, it would be the first Section 230 amendment since the passage of FOSTA-SESTA in 2018. — What's all the fuss about? Both advocates and the tech industry worry that the EARN IT Act would discourage platforms from offering end-to-end encryption since even using those services can be used to "further support the finding of liability," Jain said. For example, a plaintiff who decides to sue under the legislation could argue a messaging service is liable for the materials because it was "willfully blind" to the encrypted child abuse materials sent on its platform, Jain also said. — Revving the engines: Evan Greer, deputy director of the digital rights group Fight for the Future, told MC that their organization is planning to relaunch its NoEARNITAct.org campaign "ASAP this week" and it plans to drive "calls and email to Senate Judiciary members and senate leadership ahead of the expected markup." — Not just the Senate: Rep. Sylvia Garcia (D-Texas) also introduced a companion bill (H.R. 6544) in the House last week, although so far it isn't scheduled for a markup.
| | | | HAPPENING THURSDAY – A LONG GAME CONVERSATION ON THE CLIMATE CRISIS : Join POLITICO for back-to-back conversations on climate and sustainability action, starting with a panel led by Global Insider author Ryan Heath focused on insights gleaned from our POLITICO/Morning Consult Global Sustainability Poll of citizens from 13 countries on five continents about how their governments should respond to climate change. Following the panel, join a discussion with POLITICO White House Correspondent Laura Barrón-López and Gina McCarthy, White House national climate advisor, about the Biden administration's climate and sustainability agenda. REGISTER HERE. | | | | | Want to receive this newsletter every weekday? Subscribe to POLITICO Pro. You'll also receive daily policy news and other intelligence you need to act on the day's biggest stories.
| | | WHAT WE REALLY, REALLY WANT — Michael Mosier, the former chief of Treasury's Financial Crimes Enforcement Network, tells MC that Treasury has the power it needs to take on ransomware, despite legislative efforts suggesting otherwise. Instead, FinCEN's problem lies with non-financial organizations involved in ransomware incidents that don't realize they can report suspicious financial transactions, including ransomware extortion payments, to the organization in the first place. "That's not a regulatory gap, it's a conversation," said Mosier, who led FinCEN from April to August last year. FinCEN plays a key role in warning financial institutions about banking accounts and crypto wallet addresses that cybercriminals use to launder their profits, Mosier said. And those advisories are the best way to help financial institutions detect suspicious ransomware payments that might cross their path. But Mosier said, as ransomware explodes, collecting more information from cyber insurance companies that cover ransom payments or incident response firms that work with victims would help expedite information sharing with financial institutions. — Congress working on a solution: The Anti-Money Laundering Act, which was included in the 2020 National Defense Authorization Act, attempts to beef up reporting of criminal money laundering and terrorist financing (and it has taken some steps, such as codifying a public-private partnership program, called FinCEN Exchange , where government officials, financial organizations and other private sector companies tied to ransomware response exchange information about where they're seeing suspicious criminal activity). But other parts of the AML aimed at strengthening FinCEN's preventative tools are stuck in limbo as Congress continues to punt discussions on a bipartisan spending deal. "They still haven't received any of the funding for the 131 people that they were supposed to get," Mosier said, "and none of the deadlines [for implementing the law] have been extended." — Not helping matters: Lawmakers are still eyeing ways to expand FinCEN's regulatory powers. Rep. Jim Himes (D-Conn.) included a provision in the House-passed China competition package that requires FinCEN to collect public comments on whether it should be able to halt financial transactions without notice if it suspects criminal activity. But those legislative efforts play into a common misconception about the agency's role: "From a FinCEN perspective, we always saw our role as sounding the alarm preventively, with trends and risk indicators, to help people identify and ideally stop or at least report these attacks," Mosier said.
| | | STATE CYBER BILLS TO WATCH — Capitol Hill isn't the only one targeting cybersecurity legislation in 2022. Your MC host breaks down the state issues we're tracking as statehouses get moving: — Studying up : A handful of states have introduced legislation that sets up teams to study and share recommendations for cybersecurity best practices. A Utah House committee is holding a hearing about a bill later today that would create a cybersecurity commission to study best practices. Maryland state lawmakers are also considering legislation that would set up a cybersecurity awareness and training program for state employees. — Securing elections: Ten states have legislation pending in their statehouses focused on securing election machines and other cyber-related election security matters, according to a National Conference of State Legislatures database. The issues include a Rhode Island bill establishing a cyber review board to oversee election systems' security and an Arizona bill requiring election workers to create their own unique passwordsthat update every two weeks to access voting systems. The states taking up election security are Alaska, Arizona, Illinois, Indiana, Missouri, New Hampshire, New Mexico, Rhode Island, South Carolina and Virginia. — Data breach notification: While at least seven states enacted bills updating their data breach notification laws last year, another 12 are considering similar bills before their legislative sessions end this year, according to the National Conference of State Legislatures . New York state is weighing a bill that sets a five-day time span for organizations to disclose a security breach. A New Jersey lawmaker wants to update the state's data breach law so it applies to breaches of geolocation data. And Massachusetts' pending data privacy bill , which moved to the Senate floor last week, would give residents the ability to sue companies for data breaches.
| | | | STEP INSIDE THE WEST WING: What's really happening in West Wing offices? Find out who's up, who's down, and who really has the president's ear in our West Wing Playbook newsletter, the insider's guide to the Biden White House and Cabinet. For buzzy nuggets and details that you won't find anywhere else, subscribe today. | | | | | | | | DELVING DEEPER — Following a similar report from Palo Alto Networks late last week, Microsoft researchers issued their own report Friday delving deeper into a new cyberespionage campaign targeting Ukrainian government offices and tied to a Russia-linked hacking group. — Same acts, different names: Palo Alto Networks has been calling the group Gamaredon, while Microsoft is referring to it as Actinium. But both companies detailed the group's phishing techniques. Microsoft also noted that the new espionage campaign isn't linked to the malware wipers that hackers loaded onto Ukrainian computers last month, although Palo Alto Networks said it identified "potential malware testing activity" from the hackers. — More specific targets : Microsoft's report goes into more detail about the Ukrainian organizations that the state-sponsored hackers are currently targeting, noting that groups across the government, military, judiciary, law enforcement, nonprofits and non-government organizations are in the crosshairs. The group's goals include "exfiltrating sensitive information, maintaining access and using acquired access to move laterally into related organizations." — Longer timeline : Palo Alto's report focused on an incident that started on Jan. 19, whereas Microsoft reports that the new Russian campaign has been going on since October.
| | | — Matthew Masterson, a former Election Assistance Commission and CISA official, is joining Microsoft's Democracy Forward team. He'll lead the tech company's information integrity work and election tech and security efforts. — Kathryn Mitchell Thomas, most recently the chief for research and engineering with the assistant secretary of defense for legislative affairs, is now chief of staff for Rep. Jim Langevin (D-R.I.), per National Security Daily.
| | | CISA Director Jen Easterly has weighed in on the question we've all wanted answered: "How can you NOT like Pineapple on Slice of pizza is the real question. #WarForPineapple."
| | | — CISA is requiring all federal agencies to patch a critical vulnerability in Microsoft's Win32k by Feb. 18, according to a notice issued Friday. — Chinese hackers are believed to be behind a cyberattack that compromised News Corp. journalists' emails and story drafts and started in February 2020. (The Wall Street Journal) — Cyberattacks on cryptocurrency exchanges have been an "important revenue source" for North Korea's buildout of its nuclear and ballistic missile programs, according to a confidential UN report. (Reuters) — A representative for the new BlackCat ransomware group confirms its members are connected to REvil, BlackMatter and other larger ransomware gangs. (The Record) — Following Russia's arrest of REvil hackers, larger ransomware-as-a-service gangs are refining their tactics to narrow their targets and maximize the efficiency of their operations. (Bleeping Computer) — "Thousands of Pentagon contractors could buckle under cybersecurity push." (README) Chat soon. Stay in touch with the whole team: Eric Geller (egeller@politico.com); Konstantin Kakaes ( kkakaes@politico.com) ; Maggie Miller ( mmiller@politico.com); Sam Sabin ( ssabin@politico.com); and Heidi Vogt ( hvogt@politico.com). | | | | Follow us on Twitter | | | | Follow us | | | | |
Comments
Post a Comment