| Welcome to The Cybersecurity 202! It's gonna be a busy day. Still, please send tips to tim.starks@washpost.com. Below: Prosecutors announce a major cryptocurrency seizure, and a firm that has a powerful role in global internet infrastructure has links to U.S. agencies. First: | Election Day has arrived – and here is what's on the cyber agenda |  A sign in Lewiston, Maine. (AP Photo/Robert F. Bukaty) | | | Election Day is finally here. It brings a "very complex threat environment," in the words of Cybersecurity and Infrastructure Security Agency Director Jen Easterly. Those threats will run up against cyber defenses that have gotten significantly stronger since 2016, with improved election infrastructure around the country. But experts are still concerned about foreign governments trying to influence voters, false claims the last election was stolen are still rampant and the U.S. may be more vulnerable to those kind of threats than before. Today could also have ramifications for cybersecurity policy, with control of the House and Senate and leadership of cyber policymaking in Congress in the air. Here's what we're watching today: | | That "very complex threat environment" that Easterly speaks of includes hacking threats; the threat posed by disinformation and influence campaigns; physical threats to election workers and voters; and insider threats. Federal officials have said they've seen no specific or credible hacking threats to undermine election infrastructure. That doesn't mean there aren't hacking threats of other kinds: The FBI did warn political party organizations last month about Chinese government-affiliated hackers scanning their systems, looking for targets in a potential precursor to hacking operations. | - One prominent long-accused election meddler said to run Russia's online troll factory, Yevgeniy Prigozhin, said Monday that he was interfering in the midterms and would continue to do so, though it's not clear if his statement was true or disinformation.
| | The FBI has warned of growing physical threats to election workers in key battleground states. There also have been attempts to intimidate voters at drop boxes, prompting court action in Arizona that doesn't appear yet to have stemmed the tide there of a nationwide trend. Some right-wing figures apparently believing that election systems will vindicate their fraud claims face accusations or even prosecution over allegedly copying election systems, which cyber experts say poses a host of negative consequences. | - "Individuals entrusted with access to election infrastructure can, at times, represent potential risks to the confidentiality, integrity, and availability of election systems and information," CISA warned in May.
| How the system is holding up | | Election security has come a long way since 2016. But states believe they need far more money for election administration. Still, it's difficult to affect election infrastructure on a significant scale, which is something to keep in mind if election deniers stir up claims of widespread tampering. There might be temporary voting hiccups that could appear to indicate that something malicious is afoot. We'll be on watch to let you know if it turns out to be something more — usually, it's not malicious after all. | - "As with any election, it is important to note that operational challenges may arise. For example, individual polling places may experience delays at opening or lines could form at certain points in the day," the National Association of Secretaries of State and the National Association of State Election Directors said in a joint statement Monday. "Election administrators continue to learn and improve. … We become more resilient and implement additional safeguards for each election. We are prepared for tomorrow, as well as the post-election period."
| | Because of efforts to intimidate election workers, there has been turnover. New workers could accidentally cause more bumps in the road. | - "As a former election official, I can tell you that when you have new workers and new election officials, the number of mistakes goes up," David Levine, elections integrity fellow at the German Marshall Fund's Alliance for Securing Democracy and a former election administrator in Idaho, told me. "How those folks respond once those mistakes are made, and how others portray those mistakes and respond to them — voters, media and others — will go a long way toward ensuring a smooth midterm election."
| The actual election results | - And there are guaranteed changes ahead for the top Republican role on the House and Senate homeland security panels, regardless of who controls each chamber, because the current leading Republicans on those committees — Rep. John Katko (N.Y.) and Sen. Rob Portman (Ohio) — are retiring.
| - "We have a number of candidates for secretary of state in Arizona and in Nevada, Michigan, and even the governor in Pennsylvania that selects the secretary of state," Chris Krebs, the former CISA director who's now a partner in the Krebs Stamos Group, told my colleague David Ignatius on Monday at a Washington Post Live event. "Those candidates have the ability to determine the certification of the 2024 election. So we're actually seeing election denialists on the ballot across the country, and that's the real tactical risk to democracy."
| | |  | The keys | | Prosecutors announce billion-dollar cryptocurrency haul |  A pedestrian walks past the Justice Department in D.C. (Tom Brenner for The Washington Post) | | | The 52,000 bitcoin recovered by federal agents — which was once worth $3.4 billion but is now valued at around $1 billion — amounts to the second-largest cryptocurrency seizure in the Justice Department's history, Tory Newmyer reports. Prosecutors said James Zhong, 32, stole the money from the Silk Road dark web marketplace a decade ago. Zhong has pleaded guilty to a count of wire fraud. "Prosecutors said Zhong defrauded Silk Road by rapidly executing transactions that fooled the online marketplace's payment system into depositing bitcoin into his account," Tory writes. "Silk Road launched in 2011 as a hub for people to transact in bitcoin for drugs and other illegal goods and services until federal authorities pulled the plug on it in 2013. Silk Road founder Ross Ulbricht was convicted in 2015 of seven felony charges related to running the marketplace and sentenced to life in prison." Zhong's attorney, Michael Bachner, said in a statement that Zhong is "extremely remorseful for his conduct that occurred over 10 years ago when he was just 22 years old," and that Zhong has returned "virtually all of the bitcoin" he stole. "Given the increase in bitcoin value over the past decade, the value of the bitcoin he returned exponentially exceeded the value of the bitcoin he took," Bachner said. | Offshore firm with links to U.S. agencies wields powerful internet role |  TrustCor Systems has significant power in global internet infrastructure. (Charles Krupa/AP) | | | Major tech companies and internet browsers have given TrustCor Systems root certificate authority, a powerful place in global internet infrastructure that guarantees that websites are safe, Joseph Menn reports. But the company has connections to contractors of U.S. intelligence agencies and law enforcement, he reports. "The company's Panamanian registration records show it has the identical slate of officers, agents and partners as a spyware maker identified earlier this year as an affiliate of Arizona-based Packet Forensics LLC, which public contracting records and company documents show has sold communication interception services to U.S. government agencies for more than a decade," Menn writes. The company also offers an email service that claims to be end-to-end encrypted, though some experts say they found evidence that undermines that claim. And a person familiar with Packet Forensics's work said it used TrustCor's certificate process and email service, MsgSafe, to help the U.S. government catch suspected terrorists and intercept communications. Packet Forensics counsel Kathryn Temel said the firm doesn't have a business relationship with TrustCor, though Temel declined to say if it previously had one. TrustCor didn't respond to a request for comment. | Report: Widespread spyware use in EU member states, little oversight | | The purchase of commercial spyware is widespread in European Union nations, and the EU should issue a moratorium on using it until it can develop common regulations and better enforce existing laws, according to a draft report submitted to a European Parliament investigative committee today. "The spyware scandal is not a series of isolated national cases of abuse, but a full-blown European affair," reads the report, submitted by its rapporteur Sophie in 't Veld, a Dutch member of the European Parliament. "EU Member State governments have been using spyware on their citizens for political purposes and to cover up corruption and criminal activity. Some went even further and embedded spyware in a system deliberately designed for authoritarian rule." There has been "illegitimate use of spyware" in four countries – Greece, Hungary, Poland and Spain – and "suspicion of its use" in Cyprus, the report concludes. Other EU members have served as export or banking hubs for spyware companies, the report says. The report to the Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware is expected to come up for adoption next spring or summer. "No meaningful European oversight is in place," In 't Veld said, "not to curb the illegal use of powerful spyware against individuals, nor to monitor the trade in these digital goods." | | |  | Global cyberspace | | | |  | Securing the ballot | | | |  | Daybook | | - Cybersecurity leaders from the government and private sector speak at Cyversity's annual conference in Orlando today.
- The American Enterprise Institute hosts an event on security standards for connected devices today at 2 p.m.
- Doreen Bogdan-Martin, the newly elected secretary general of the International Telecommunication Union, and National Archives and Records Administration innovation chief Pamela Wright speak at an American University event on Friday at 8:30 a.m.
| | |  | Secure log off | | | Thanks for reading. See you tomorrow. | | |
No comments:
Post a Comment