Monday, September 9, 2024

Congress’ September cyber to-do list

Delivered every Monday by 10 a.m., Weekly Cybersecurity examines the latest news in cybersecurity policy and politics.
Sep 09, 2024 View in browser
 
POLITICO's Weekly Cybersecurity newsletter logo

By Maggie Miller

Driving the Day

— Congress is back from summer break this week, and issues including election security, combating Chinese threats and a recent major outage are on the agenda.

HAPPY MONDAY, and welcome to MORNING CYBERSECURITY! I’m your host, Maggie Miller, and as an Austin native, my heart is very happy after my hometown University of Texas football team had a fantastic weekend. Sorry, not sorry Michigan fans, Hook ‘Em Horns!

Have any tips or secrets to share with MC? Or thoughts on what we should be covering? Find Joseph on X at @JGedeon1 or email him at jgedeon@politico.com. You can also follow @POLITICOPro and @MorningCybersec on X. Full team contact info is below.

Want to receive this newsletter every weekday? Subscribe to POLITICO Pro. You’ll also receive daily policy news and other intelligence you need to act on the day’s biggest stories.

Today's Agenda

New America hosts its 2024 Future Security Forum, featuring remarks from former White House National Security Adviser Lt. Gen. H.R. McMaster. 8:30 a.m.

The Center for Strategic and International Studies holds a virtual discussion on "The Cyber Safety Review Board: Reflecting on the Past and Charting the Future.” 9:15 a.m.

The Brookings Institution and Spelman College hold a discussion on "The Promise and Perils of Artificial Intelligence: Issues at Stake in the 2024 Election.” 7 p.m.

On the Hill

SUMMER’S OVER — Both the House and Senate come back into session this week after more than a month of recess, and multiple cyber and tech-related issues are high on the to-do list for the returning members.

— China, China, China: This includes House votes this week on around two dozen bills aimed at countering Beijing, with votes taking place as early as tonight, and continuing on through Wednesday.

Among the measures up for consideration are the Securing Global Telecommunications Act, which would require the State Department to create a strategy to promote the use of secure telecoms globally. Another bill on the list is the Foreign Adversary Communications Transparency Act, which would require the Federal Communications Commission to publish a list of groups owned by adversary nations that have been given authorizations or licenses by the FCC.

The ROUTERS Act is also up for a vote and would require the Commerce Department to conduct a study of national security risks by consumer routers and modems. Voting will also take place on legislation that would require foreign cranes constructed by adversarial nations to be inspected by U.S. authorities for cyber risks prior to use at U.S. ports. And another bill on the agenda would authorize $325 million per year through fiscal year 2027 to counter Chinese malign foreign influence efforts.

— Secure the vote: With less than two months until the U.S. elections, ensuring that the process stays secure and disinformation campaigns are prevented is also a topic for both sides of the Capitol.

The Senate Intelligence Committee plans to hold a hearing sometime later this month on election security concerns, which will feature representatives from social media and tech companies. A spokesperson for Committee Chair Mark Warner (D-Va.) did not respond to a request for comment on an exact date for the hearing. But given the ramp-up in concerns around efforts by foreign nations such as Iran and Russia to interfere in portions of the elections, such as spreading disinformation and targeting presidential campaigns, it’s a key topic.

The Office of the Director of National Intelligence on Friday put out an update on the foreign threat space around the upcoming elections, noting that while the intelligence community has “not observed any foreign actor seeking to interfere in the conduct of the 2024 elections,” threats from Iran, China and Russia are high. Warner applauded the public update from the ODNI on Friday and called for a “whole-of-society effort” to protect the elections.

“Today’s update underscores the extent to which a range of foreign actors — but most notably Russia, Iran, and the People’s Republic of China — remain intent on undermining confidence in the election, stoking divisions among Americans, and even seeking to shape outcomes of election races,” Warner said.

— In the House: In addition, the House Administration Committee plans to hold a hearing Wednesday on “American confidence in elections,” featuring testimony from the secretaries of state of Florida, Ohio, Michigan and Arizona, who are the lead election officials for those states.

— CrowdStrike in the frying pan: The House Homeland Security Committee is set to hold a hearing Sept. 24 on the massive global outage in July linked to a faulty update from cybersecurity group CrowdStrike to Windows computers. This led to major disruptions for flights around the world, interruption of operations at companies and federal agencies and many other problems.

While the committee had invited CrowdStrike CEO George Kurtz to testify, Adam Meyers, the senior vice president of counter-adversary operations at CrowdStrike, will instead appear before the committee. The company could face further congressional interest, as both the House Oversight and Reform Committee and the Senate Homeland Security and Governmental Affairs Committee were looking into the incident in the weeks after it occurred.

“Recognizing that Americans will undoubtedly feel the lasting, real-world consequences of this incident for some time, they deserve to know in detail how this incident happened and the mitigation steps CrowdStrike is taking to avoid the cascading impacts of outages like this across sectors,” House Homeland Security Committee Chair Mark Green (R-Tenn.) said in a statement when Meyers was announced as a witness.

— Shut it down: Looming over the entire month is the threat of a government shutdown on Oct. 1 if the House and Senate can’t agree to compromise language on the 2025 appropriations package, and if no continuing budget resolution can be pushed through.

House Republicans last week unveiled a stopgap appropriations package that would keep the government funded through the end of March, but it includes a provision banning non-citizen voting in U.S. elections, something Democrats are strongly opposed to. So, stay tuned for wrangling this month.

People on the Move

FIRST IN MC: NEW DAWN, NEW DAY — Brandon Wales, who stepped down as the executive director of the Cybersecurity and Infrastructure Security Agency last month, starts today as vice president of cyber strategy at cybersecurity group SentinelOne in the Washington, D.C. region.

Wales told your MC host ahead of the announcement that taking on the position at SentinelOne was “an offer that’s hard to say no to.” He cited the ability to work at a “technology company that could be a real, key part of the solution” around strengthening the partnership between the government and private sector on combating cyber threats.

— Elections in the spotlight: It doesn’t hurt that he is joining a former federal colleague. Wales will be working under former CISA Director Chris Krebs, who currently serves as chief public policy officer at SentinelOne, and is someone Wales described as a “fantastic leader.” They both were leading at CISA during the runup to the 2020 presidential election, and this year, Wales has “high confidence” in the security of the forthcoming elections process, even as he acknowledged that threats are high.

“Today, there are far more physical security threats to elections than cybersecurity ones, it doesn’t mean we’ve taken our eye as a country off cybersecurity risks, but it’s a matter of continuing to make sure that the government meets election officials where they are,” Wales said.

He also warned of disinformation risks from foreign adversaries, citing moves taken by the Justice Department last week to crack down on Russian-linked disinformation efforts, and recent findings around Chinese operations aimed at U.S. voters.

“We’re going to continue to see our adversaries continue to attempt to exploit political differences in this country, and the government needs to be playing a role in addressing that,” Wales said.

— Eyes on Beijing: The former CISA executive director is also laser-focused on threats from China, such as compromises of U.S. and allied critical infrastructure networks by the government-backed hacking group Volt Typhoon. He describes China as “the defining geopolitical threat that we face.”

“The scale of their offensive program, the sophistication that they’ve demonstrated, the intent to be prepared to disrupt or destroy US critical infrastructure and the infrastructure of our allies overseas is by far the one that I am most concerned about,” Wales said.

Industry corner

CRACKDOWN — Ransomware attacks against organizations such as hospitals aren’t going anywhere without the government being willing to ban payments, a top industry CEO is arguing.

Michael Fey, CEO and co-founder of Island, the enterprise browser system, sat down on the sidelines of the Billington Cyber Summit last week with your MC host that “the fact that it is legal to pay ransomware is why it exists at scale.”

— The debate: Banning ransom payments is something the Biden administration has come close to. At last year’s Counter Ransomware Summit, the U.S. and around 50 other members of the alliance (which has since grown) committed to developing a policy statement that member governments should not pay ransomware demands. However, the statement does not explicitly ban governments from doing so and includes carve-outs for emergencies.

It’s a controversial issue, given that often companies will pay a ransom to get their networks back up as soon as possible, vital for organizations like hospitals where patient data and well-being are on the line. Often, the alternative is having to replace entire systems, and significant organizational downtime, having serious consequences for the group’s bottom line.

Despite this, Fey argued against exemptions and made the point that an outright ban would fully discourage cybercriminals.

“If it’s known that the board of directors goes to jail, the CEO goes to jail if they pay, put it equivalent to money laundering, then you’re a hacker going ‘okay, I’m going to torture this hospital, I risk my life, my limb on somebody who’s not allowed to pay,” Fey said.

Tweet of the Day

A U.S. cyber trip down under.

Tweet of the Day for Sept. 9, 2024 version of Morning Cybersecurity.

X

Source: https://x.com/statecdp/status/1832122733108363703?s=46&t=7qgObawVR3sD59eITHivyA

Quick Bytes

PENTAGON PRIORITIES — The new assistant secretary of defense for cyber policy is focusing on getting a return on investment for cyber operations as one of his first priorities in the role, Mark Pomerlau reported for DefenseScoop.

AN IRAN ICYMI — Experts at the Foundation for Defense of Democracies exposed a network of at least 19 websites posing as U.S. news or analysis groups targeting specific groups of potential U.S. voters with pro-Iranian content, your MC host reported Friday.

THREATS ABOUND — Russia, China and Iran are “ramping up” their efforts to interfere in U.S. elections this fall, intelligence officials told reporters Friday, as John reported (for Pros!). Those types of threats are the new normal during the election cycle, POLITICO’s Hailey Fuchs and Josh Gerstein reported.

Chat soon. 

Stay in touch with the whole team: Joseph Gedeon (jgedeon@politico.com); John Sakellariadis (jsakellariadis@politico.com); Maggie Miller (mmiller@politico.com); and Heidi Vogt (hvogt@politico.com).

 

Follow us on Twitter

Heidi Vogt @HeidiVogt

Maggie Miller @magmill95

John Sakellariadis @johnnysaks130

Joseph Gedeon @JGedeon1

 

Follow us

Follow us on Facebook Follow us on Twitter Follow us on Instagram Listen on Apple Podcast
 

To change your alert settings, please log in at https://login.politico.com/?redirect=https%3A%2F%2Fwww.politico.com/settings

This email was sent to edwardlorilla1986.paxforex@blogger.com by: POLITICO, LLC 1000 Wilson Blvd. Arlington, VA, 22209, USA

Unsubscribe | Privacy Policy | Terms of Service

No comments:

Post a Comment