Massive hacker attack triggers US National Security Council emergency meeting

White HouseA large-scale cyberespionage attack targeting United States government computer systems, which some experts described as potentially being among “the most impactful espionage campaigns on record”, triggered an emergency meeting of the US National Security Council on Sunday, according to reports. Chaired by the US president, the National Security Council is the country’s most senior decision-making body.

Although it was only discovered last week, the cyberespionage campaign is believed to date to last spring, possibly as early as March. Sources called it a highly sophisticated operation that originated from a “top-tier” adversary –a term that refers to a handful of state actors that have access to the most elite cyber operatives and advanced technologies known to exist.

As of last night, US government officials had not publicly identified the state actor believed to be behind the cyberespionage campaign, which experts have coined the “2020 supply chain attack”. But several American and European news outlets pointed to Russia as the culprit, citing sources familiar with the investigation. The Washington Post said the Russian Foreign Intelligence Service, known as SVR, was behind the attack. The Russian government denied on Monday that its agencies had any role in the attacks.

The origins of the attack are believed to be in the private sector. It began when a sophisticated illicit cyber actor, known by the nickname Advanced Persistent Threat (APT) 29, or Cozy Bear, stole cyber tools used by two major government contractors, FireEye and SolarWinds. These cyber tools are used to detect and patch vulnerabilities in computer systems. These companies provide services to numerous US government customers, including the Departments of Defense, State, Treasury and Commerce. Other US government customers include the National Security Agency and the Office of the President, including the White House Situation Room. All of these entities have reportedly been affected by this cyber espionage operation.

By disguising their malicious software as software patches, the hackers were reportedly able to access and monitor, in real time, email traffic within and between government agencies. It is not known at this time whether US intelligence agencies, other than the National Security Agency, have been affected by this hack. All branches of the US military maintain intelligence components. Additionally, the Department of the Treasury operates the Office of Intelligence Analysis, while the Department of State is in charge of the Bureau of Intelligence and Research. The White House said yesterday that it had asked the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency to probe the attack and evaluate the extent of the damage caused to US government operations.

Author: Joseph Fitsanakis | Date: 15 December 2020 | Permalink

Senior Homeland Security officials resign, reportedly under White House pressure

Department of Homeland Security DHS

TWO SENIOR OFFICIALS AT the United States Department of Homeland Security have resigned, reportedly after coming under pressure to do by the White House. The resignations may point to the latest incidents in an ongoing string of firings and resignations in the US intelligence and national security communities, part of a concerted effort by President Donald Trump.

The more senior of the two DHS officials who have resigned as of today is Bryan Ware, DHS assistant director for cybersecurity. Ware served at the DHS’s cybersecurity wing, the Cybersecurity and Infrastructure Security Agency (CISA). CISA was created by the Trump administration two years ago, when the president signed into law the Cybersecurity and Infrastructure Security Agency Act. The mission of the young agency is to streamline cybersecurity efforts across government agencies and departments, in order to improve the government’s cybersecurity protections.

Ware’s resignation coincided with a rare announcement by top officials at CISA, which called the US presidential election of November 3 “the most secure in American history”. The officials, who are members of the Election Infrastructure Government Coordinating Council (GCC) Executive Committee, added that “[t]here is no evidence that any voting system deleted or lost votes, changed votes or was in any way compromised”. The announcement appeared to be a refutation of claims made by President Trump and his supporters that the election was marred by significant irregularities.

The DHS assistant secretary for international affairs, Valerie Boyd, also resigned as of today. In her resignation letter, Boyd states that her “belief that people of character should support the institution of the Presidency […] has been tested many times these past few years”. In his farewell letter to colleagues, Ware states that his departure from the DHS came “too soon”, indicating that the decision to resign was not his own. Several sources suggest that both Ware and Boyd were pressured to resign by White House aides close to President Trump.

Reporters said last night that officials at the White House, the DHS and the CISA did not respond to requests for comment about the two DHS officials’ resignations. There were also rumors last night that CISA director, Chris Krebs, would be fired by President Trump in a matter of days.

Author: Ian Allen | Date: 13 November 2020 | Permalink