Senate power shift reshapes cyber policy

Delivered every Monday by 10 a.m., Weekly Cybersecurity examines the latest news in cybersecurity policy and politics.
Nov 11, 2024 View in browser
 
POLITICO Weekly Cybersecurity Newsletter Header

By Joseph Gedeon

With help from Maggie Miller

Driving the day

— A seismic transition in Senate cybersecurity oversight looms as key committees fall under new Republican control.

HAPPY MONDAY, and welcome to MORNING CYBERSECURITY! The worst part of the end of election season? I lost dozens of bot followers on social media. So long, inflated ego.

Have any tips or secrets to share with MC? Or thoughts on what we should be covering? Find me on X at @JGedeon1 or email me at jgedeon@politico.com. You can also follow @POLITICOPro and @MorningCybersec on X. Full team contact info is below.

Want to receive this newsletter every weekday?  Subscribe to POLITICO Pro . You’ll also receive daily policy news and other intelligence you need to act on the day’s biggest stories.

On the Hill

I HAVE THE POWER — This election cycle has so far proved to be a tilt of epic proportions for the Senate’s right flank that now has a firm grasp over the upper chamber. Here’s what wielding some of that new power could look like.

— The big problem: CISA's now got a Sen. Rand Paul (R-Ky.) problem. The Kentucky Republican soon to be holding the Homeland Security and Government Affairs committee gavel isn't just skeptical of the agency — he's been its most vocal opponent.

— The receipts: Last year, he stood alone in the Senate in voting against the renewal of the Chemical Facility Anti-Terrorism Standards program and has consistently pushed back against CISA's expanding role, particularly in his crusade over allegations of censoring conservative speech. (The Supreme Court dismissed those claims earlier this year.)

This is a big switch-up from outgoing Chair Sen. Gary Peters (D-Mich.), who industry insiders have long commended for getting complex cyber legislation across the finish line.

Paul was also the lone dissenter on three major cyber bills coming out of HSGAC this year, including measures to boost health care sector threat sharing and streamlining federal cyber regulations (co-led by Peters). They all cleared committee, 10-1.

— No whiplash in Intel: The Mark Warner (D-Va.) to Marco Rubio (R-Fla.) switch at Senate Intel looks to be a lot smoother. The duo's track record of bipartisan cooperation suggests business as usual – just with reversed nameplates.

Committee spokesperson Rachel Cohen tells Maggie that Warner’s cyber priorities aren't slowing down into the transition: "The Chair has always made the cybersecurity of our nation one of his highest priorities and that will continue into the Fall."

Chinese cyber threats look to top the agenda. Warner's team is particularly concerned about cyberattacks on critical infrastructure including telecoms, energy and water systems by groups like Volt Typhoon and Salt Typhoon.

— The handoff plan: Warner's pushing for "solutions that can be carried over into the new Congress." And given his historically strong working relationship with incoming Chair Rubio — they've been a notably bipartisan duo — that continuity looks likely.

— Armed Services shuffle: Some potentially good news for cyber policy watchers: The changes at the Senate Armed Services Committee might actually strengthen cyber oversight.

Sen. Roger Wicker (R-Miss.) won his reelection bid and with it comes some tech know-how to the SASC chair. Besides generally backing the development of a Cyber Force, Wicker asked the Pentagon to “employ all available means” to prevent data brokers from collecting military member data, MC was first to report.

That included asking for stricter privacy protections on soldiers’ personal phones and enhanced information security training.

One other to watch is Sen. Mike Rounds (R-S.D.), who appears next up for the SASC cyber gavel. Rounds brings arguably the deepest technical expertise of any Senate Republican to the role.

At the White House

THE DISINFORMATION LOOP — A Trump campaign video from 2022 about cracking down on federal disinformation work is recirculating as current news — creating exactly the kind of misleading information flow it claims to want to stop.

— The big picture: Trump's proposed Day One executive order that Elon Musk shared on X over the weekend wouldn't just ban federal agencies from identifying domestic mis- and disinformation. It would also prohibit coordination with social media companies and authorize a purge of officials who've worked on these issues.

The catch? The video now at more than 92 million views, that Musk is presenting as fresh, is actually from Trump's 2022 playbook — though the threat of its implementation could be very real. And for CISA, the now-$3 billion agency Trump himself put together in 2018, it's an existential threat.

“This seems very targeted at the FBI especially, CISA secondarily,” one former CISA official tells MC. “It’s likely retribution for the FBI's involvement and investigation into Trump and associates over the last few years, also helps Elon with [X].”

— Reality check: Legal experts have yet to weigh in with MC on whether Trump can simply fire career civil servants by executive order. In general, industry insiders hold that there should be a continued aggressive effort to curb influence operations from Russia, China and Iran.

“I think there could be an EO that directs the USG to not be the ‘arbiter of truth’ and limits any domestic focused disinformation work undertaken by DHS and CISA,” CSC 2.0 Executive Director Mark Montgomery tells MC. “In reality these efforts are already limited by the Biden administration’s awful rollout, and subsequent dissolution of, the Disinformation Governance Board two years ago.”

But there’s some irony in Musk, who’s positioned himself as a warrior against disinformation, sharing a years-old video as if it were breaking news.

“What these guys say and what they actually implement tend to be very different,” former Principal Deputy National Cyber Director Jake Braun tells MC.

— Where it gets messy: Modern cyber defense relies heavily on tracking how information — both true and false — moves through networks. And more than disinfo, CISA's mandate covers everything from pipeline security to hospital networks.

The bigger problem: CISA's been trying to thread this needle since 2020, when Trump fired its leadership after the agency declared that year's election secure. The agency's grown notably more cautious, focusing almost exclusively on foreign disinformation about election procedures.

“Any EO would need to direct the intelligence community, Cyber Command and DHS to continue their efforts to work against foreign interference,” Montgomery said. “The successful protection of the election infrastructure this cycle was a direct reflection of these efforts.”

— One thing to watch: The private sector's reaction. As MC readers very well know, major tech companies and critical infrastructure operators rely heavily on CISA's threat intelligence.

And in this case, they're watching an old video create waves all over again.

The International Scene

SUPERMARKET SHUTDOWN — A “very significant” network traffic attack hit Israeli shoppers Sunday morning, causing widespread credit card reader malfunctions across gas stations and supermarket chains nationwide, Israeli cyber firm Check Point shared with Morning Cyber.

“This was a very significant attack aimed at a credit processing payment company, essentially impacting the ability to pay with credit cards in some of the country’s biggest consumer chains and gas stations for around 5-6 hours,” Check Point chief of staff Gil Messing tells MC.

— Eyes on Iran: According to Check Point, the attack is suspected to be from a Tehran-linked hacking group named “Anonymous for Justice.”

The incident follows a string of suspected Iranian-linked cyber operations against Israeli financial infrastructure. A similar attack in October targeted Sheba, the national credit payment system.

Israel’s embassy in Washington and the country’s Cyber Directorate did not respond to a request for comment.

— Ready for Round Two: Credit Guard says it's now coordinating with security agencies to fortify defenses. The company says it ruled out fears of a more sophisticated cyber infiltration, pinpointing communication suppliers as the likely target.

Tweet of the Day

Democracy is always best when it comes via an X poll that millions of people around the world can vote on. At least Harambe isn’t an option.

Source: https://x.com/elonmusk/status/1855647150144995639

X

Quick Bytes

ZIP IT UP — Hackers are using a ZIP file technique to bypass security solutions and deliver malicious payloads hidden within compressed archives, Bill Toulas writes for BleepingComputer.

DEMANDING SPYWARE SANCTIONS — WhatsApp and Meta are seeking sanctions against NSO Group for withholding evidence in a lawsuit related to NSO's controversial spyware program, Pegasus. (Courthouse News Service)

ICYMI — Pro-Russia hacking groups launched cyberattacks against South Korea after North Korea sent troops to support Russia in its war against Ukraine, leading to temporary outages on government and private websites. (Reuters)

Chat soon.

Stay in touch with the whole team: Joseph Gedeon (jgedeon@politico.com); John Sakellariadis ( jsakellariadis@politico.com); Maggie Miller (mmiller@politico.com); and Rosie Perper (rperper@politico.com). 

 

Follow us on Twitter

Heidi Vogt @HeidiVogt

Maggie Miller @magmill95

John Sakellariadis @johnnysaks130

Joseph Gedeon @JGedeon1

 

Follow us

Follow us on Facebook Follow us on Twitter Follow us on Instagram Listen on Apple Podcast
 

To change your alert settings, please log in at https://login.politico.com/?redirect=https%3A%2F%2Fwww.politico.com/settings

This email was sent to salenamartine360.news1@blogger.com by: POLITICO, LLC 1000 Wilson Blvd. Arlington, VA, 22209, USA

Unsubscribe | Privacy Policy | Terms of Service

Post a Comment

Previous Post Next Post