The NDAA is around the corner

Delivered every Monday by 10 a.m., Weekly Cybersecurity examines the latest news in cybersecurity policy and politics.

Nov 27, 2023 View in browser   By Joseph Gedeon — With help from Maggie Miller and Mallory Culhane  Driving the day — As lawmakers start their scramble to pass the annual defense spending bill before the end of the year, some major changes to America’s cyber policy could be coming. HAPPY MONDAY, and welcome to MORNING CYBERSECURITY! It’s great to be back in your inboxes for Cyber Monday — an exciting but misleading day of deals that has nothing to do with our line of work. Is it time we start a petition to rename America’s glorious savings holiday? Have any tips or secrets to share with MC? Or thoughts on what we should be covering? Find me on X at @JGedeon1 or email me at jgedeon@politico.com. You can also follow @POLITICOPro and @MorningCybersec on X. Full team contact info is below. Let’s dive in.   GET A BACKSTAGE PASS TO COP28 WITH GLOBAL PLAYBOOK: Get insider access to the conference that sets the tone of the global climate agenda with POLITICO's Global Playbook newsletter. Authored by Suzanne Lynch, Global Playbook delivers exclusive, daily insights and comprehensive coverage that will keep you informed about the most crucial climate summit of the year. Dive deep into the critical discussions and developments at COP28 from Nov. 30 to Dec. 12. SUBSCRIBE NOW.     Want to receive this newsletter every weekday? Subscribe to POLITICO Pro. You’ll also receive daily policy news and other intelligence you need to act on the day’s biggest stories. On the Hill EVERYBODY’S FAVORITE BILL — Now that everyone’s leftover Thanksgiving turkey is (probably) gone, lawmakers have room to add something a bit more meaty to their plate: this year’s National Defense Authorization Act. America’s legislators are migrating back to the Hill this week as they get set to reconcile the soon-to-be-ready House and Senate versions of the NDAA, a priority item for military spending that has to be passed before leaving for Christmas break. Here are some of the key cyber provisions we are watching. — United front: A clutch inclusion into the NDAA by way of the Senate would be the State Department Authorization Act, which aims to shore up international cooperation against cyber threats globally. At the heart of the bill lies the creation of a dedicated cyberspace and digital tech fund at State, which would serve as a lifeline for foreign governments to strengthen their networks against cyberattacks. It’s a strategy that resonates as well with the other chamber, which also wants to tie in a U.S.-Taiwan cooperation provision as Taipei faces a crucial presidential election in January. The House move aims to identify and expand areas of collaboration between the U.S. and Taiwan, but specifically focuses on defending military networks, countering malicious cyber activity, and leveraging U.S. cybersecurity technology and services. — It’s gonna be an election year: Which means election-related bills are going to get more scrutiny than usual. And that includes the debate over the Senate Intelligence Committee’s provision to require mandatory cyber penetration testing for all voting systems and hardware. The proposal stems from concerns about the vulnerabilities of electronic voting systems to hacking and manipulation, which is carrying more weight now that we are less than 365 days away from the vote. The fate of this measure is still unclear, but we’re watching for it to get stripped out of the final package considering the deep divides and contentions over election security between the GOP and Democrats. — A Cyber Force (?): A curious piece of the Senate’s NDAA includes language that would open the door to the establishment of a Cyber Force at the Department of Defense — a move that could mark a turning point in the military’s cybersecurity posture. The provision in question directs an independent assessment of the feasibility of establishing a Cyber Force as a separate branch of the military — similar to the Navy, Army or Space Force. The move would elevate cybersecurity to a major priority within the Pentagon, providing a dedicated branch with the resources and authority to address increasingly sophisticated national security concerns from cyber powerhouses like China and Russia. The ongoing conflict in Ukraine and the possibility of a widening war in the Middle East has further heightened its urgency. However, the proposal was not included in the House version of the bill. — Cyber piggyback: All this to say that considering the sheer size and importance of the NDAA, it once again could become a last-minute dumping ground for a slew of cyber bills coming out of the woodwork. Historically, the must-pass bill has served as a convenient vehicle for attaching various cybersecurity measures that get crammed through in the waning days. At the White House FIRST IN MC — More than 130 K-12 schools in the United States are now implementing new, free private sector tools to secure their systems against cyberattacks following a multi-pronged cyber initiative at an August White House summit on keeping hackers away from the education sector, but enrollment has turned sluggish since the flagship program rolled out, MC has learned. — By the numbers: Right now, 137 schools and districts are signed up to Project CyberSafe Schools, a Cloudfare-focused service that offers Zero Trust cybersecurity tools to boost email security and safer internet browsing to K-12 public schools under 2,500 students. That represents services for 35,500 students and staff in 32 states and Guam who asked for the service, deputy national security adviser for cyber and emerging technology Anne Neuberger tells MC. That’s a slight bump from 104 schools in 31 states, representing 18,300 students and staff back in mid-September. “There’s been good momentum and we want to see that grow,” Neuberger said on the need to accelerate enrollment. “Our goal is every one of the 9,100 eligible schools.” — CISA training sessions: In a parallel effort, America’s premier cyber agency has held three exercises since the program's launch in August, in line with its pledge to provide tailored assessments, conduct exercises and offer cybersecurity training to 300 new K-12 schools. The pace is on par with its promise of 12 exercises a year aimed at helping schools identify their own cyber risks. — Amazon Web Services grant: Among the summit offerings was a $20 million cyber grant commitment from AWS available to school districts and state departments of education as well as no-cost cyber incident response assistance. So far, 130 applications have been received from schools across 28 states, with more than 5 million students, Neuberger shared. — Easy targets: K-12 schools have become increasingly attractive targets for cybercriminals, particularly with ransomware attacks, due to their often poorly protected networks and the trove of sensitive data they hold. In September, Neuberger told MC that the White House is getting “weekly” updates around attacks on K-12 schools and that initial data for the school year shows that the high rate of attempted attacks is continuing. As a result, more action from the White House may be in the works in the near future. “Ransomware attacks are up 45 percent overall,” Neuberger said, referring to the worldwide rise in ransomware over the past year. “And we still see schools get hacked and children’s sensitive school information leaked online.” Election Security DIVING INTO MISCONCEPTIONS — Researchers at the University of North Carolina at Chapel Hill are on today’s POLITICO Tech Podcast to explain why growing calls for sweeping measures like banning or labeling AI-generated political ads ahead of the 2024 presidential election are overhyped. Scott Babwah Brennen and Matt Perault recently co-authored a report analyzing concerns around AI-generated political ads and the potential policy solutions. — Brass tacks: Their report pushes back on assumptions that AI-generated political ads will primarily fuel misinformation around the 2024 presidential election, and argues that more profound impacts are likely to be seen in smaller, local elections. “There’s much less attention on those local races, much less volume of content, [so] we think it’s more likely that you could potentially use generative AI to influence those elections in some way,” Perault said, adding that those smaller races often take “a backseat to the focus that’s on federal races like the presidential election.” — Taking chances on new tactics: Lawmakers and tech companies alike have been spitballing ideas to address concerns around AI-generated political ads, and the most popular remedy appears to be mandating disclosures on such content. But Perault and Brennen argue that one single action is unlikely to be a silver bullet. And a lack of existing research on the effectiveness of watermarks and disclosures puts the impact of those policies into question. “This election will be a laboratory where we will hopefully be able to learn … our hope would be that researchers [will] be working with the companies and sharing data so that researchers would have the data that they need to make these assessments would be able to evaluate the efficacy of this technology,” Perault said. Tweet of the Day An idea to always keep in the back of your mind when thinking about Gen AI or other emerging cyber tech. Quick Bytes A GLITCH IN THE MATRIX — In the swing county of Northampton, Pa., voters were left concerned after their new touchscreen voting machines glitched during a down-ballot judge's race in 2019. The incident, along with a similar glitch that occurred earlier this month, has raised concerns about voter confidence ahead of the 2024 presidential election, according to reporting from John. RECON DRONES — Skydio, a Silicon Valley drone company, has sent more than 100 surveillance drones to the Israeli Defense Forces in the weeks since the Hamas attack. The company is one of many American tech companies seeing a surge in demand for their products as Israel seeks to eliminate Hamas from the Gaza Strip, POLITICO’s Mohar Chatterjee reports. AMBULANCES DIVERTED — A network of hospitals in East Texas has been unable to accept ambulances since Thanksgiving due to a potential cybersecurity incident, CNN’s Sean Lyngaas reports. ICYMI — A group of cybersecurity researchers has discovered that the MadCat ransomware gang has been stealing from other criminals, writes Damien Black for CyberNews. Chat soon.  Stay in touch with the whole team: Joseph Gedeon (jgedeon@politico.com); John Sakellariadis (jsakellariadis@politico.com); Maggie Miller (mmiller@politico.com); and Heidi Vogt (hvogt@politico.com).   JOIN WOMEN RULE ON 12/12: For centuries, women were left out of the rooms that shaped policy, built companies and led countries. Now, society needs the creativity and entrepreneurship of women more than ever. How can we make sure that women are given the space and opportunity to shape the world’s future for the better? Join POLITICO's Women Rule on Dec. 12 for Leading with Purpose: How Women Are Reinventing the World to explore this and more. REGISTER HERE.       Follow us on Twitter Heidi Vogt @HeidiVogt Maggie Miller @magmill95 John Sakellariadis @johnnysaks130 Joseph Gedeon @JGedeon1   Follow us

To change your alert settings, please log in at https://www.politico.com/_login?base=https%3A%2F%2Fwww.politico.com/settings This email was sent to rouf@idiot.cloudns.cc by: POLITICO, LLC 1000 Wilson Blvd. Arlington, VA, 22209, USA Unsubscribe | Privacy Policy | Terms of Service