President Donald Trump, right, shakes hands with Russian President Vladimir Putin. (AP Photo/Susan Walsh)
The historic House vote to impeach President Trump last night also marked the most recent turn in a cybersecurity saga that’s gripped the nation since 2016 and consumed much of the past year.
Russia’s hacking and disinformation operation in 2016 has occupied lawmakers, election officials and cybersecurity pros for three years now as they try to hold the Kremlin accountable and to prevent a repeat in 2020.
It was also Trump’s obsession with poking holes in the official narrative about that operation – by urging Ukraine’s president to investigate a baseless conspiracy theory about Russia’s Democratic National Committee hack and the cybersecurity firm CrowdStrike — that helped spark an impeachment trial that promises to grip the nation for weeks to come.
“This impeachment is, to a great degree, a cyber story,” Jon Bateman, a Cyber Policy Initiative fellow at the Carnegie Endowment for International Peace and a former Pentagon cybersecurity official, told me. “It’s the president’s inability to grasp what really happened in a series of cyber incidents that’s led to our current political crisis.”
Election hacking was a key battleground for lawmakers this year as Democrats demanded Congress provide $600 million for states and localities to secure their voting machines and impose strict mandates to ensure elections are as secure as possible.
They also pummeled Republicans who blocked those efforts, accusing them of being complicit with Russia, and even branding Senate Majority Leader Mitch McConnell (R-Ky.) as “Moscow Mitch” before he relented this week and endorsed sending $425 million to states.
Homeland Security Department officials, meanwhile, crisscrossed the country vetting election equipment and running cybersecurity training for local officials. But they were regularly undermined by the president’s wavering on whether Russia was actually responsible for the 2016 interference, helping spark concern the Kremlin will do it again.
“We really haven’t done enough to deter Russia from doing this again and the message from the White House has been inconsistent at best. At worst, it’s undermining everything else the government is doing,” Chris Painter, the former top cybersecurity official at the State Department, told me.
There’s no question election interference will continue to be a front burner concern throughout 2020 as the campaign heats up and election officials prepare to mount their best defense.
“For people working in cybersecurity before 2016, we never could have imagined how central these issues would become to the functioning of our democracy,” Betsy Cooper, director of the Aspen Institute’s Tech Policy Hub and a former Homeland Security Department cybersecurity official, told me. “You can’t possibly think about 2019 without thinking about the continuing significance of Russian election interference.”
Here are two other big cybersecurity stories that defined 2019.
China’s long-term threat
Government officials and experts have warned for years Chinese hackers are stealing billions of dollars in intellectual property from U.S. companies, but things got far more serious in 2019 when Huawei became a frontrunner to build global 5G wireless Internet networks.
If Beijing inserts backdoors into Huawei systems, it could steal unprecedented levels of business and government data from those next-generation networks, officials at the Commerce and State departments said. And they crisscrossed the globe making that case to allies throughout the year.
Super-fast 5G networks will also power a new generation of Internet-connected devices such as autonomous vehicles and smart factories, raising the danger Beijing could sabotage those systems if there was a military conflict between the United States and China.
Yet, despite a series of U.S. efforts to restrict Huawei’s global footprint — including a not-yet-fully-imposed ban on sales to it from many U.S. companies — the Chinese firm continues to rack up global contracts. Trump also made things worse by repeatedly wavering on pulling back some Huawei penalties in exchange for Chinese trade concessions — though there’s no indication of a Huawei component in a phase-one deal announced last week.
Huawei has steadfastly denied any involvement in Chinese spying.
The situation is even more precarious because the United States doesn’t have a domestic 5G supplier and is urging allies to contract with companies in friendly nations such as Finland’s Nokia and South Korea’s Samsung instead.
And the Huawei fight could be a harbinger of even more serious problems. 5G is just one of many vital technology fields in which the United States is falling behind China, including artificial intelligence and quantum computing. That could be disastrous for cybersecurity if the nation doesn’t change course and start investing heavily in research and development.
“It’s an ASAP thing,” Robert Silvers, a former top DHS cybersecurity official who’s now an attorney at the law firm Paul Hastings, told me. “China is racing ahead and we need to have done this yesterday.”
Hacking hits home
Some of the biggest cybersecurity stories of 2019 were about ransomware attacks against local governments in which hackers locked up computer systems and refused to release them until they got a payout, threatening vital city services.
Baltimore, New Orleans, Pensacola, Fla., and Albany, N.Y., were just a handful of the cities hit with ransomware this year. The Baltimore attack was among the most damaging in history, knocking out some services for more than a month and costing the city at least $18 million.
“More and more cyber incidents are coming home to affect Americans’ daily lives,” Bateman told me. “When you’re part of a data breach, that might spill your personal information and you’ll get free credit monitoring, but that’s very abstract. When the local government is closed for business, that hits home.”
The Cybersecurity 202 is taking a couple weeks off. We’ll be back Jan. 6. Have a great holiday and we’ll see you in 2019.
2020 Election: PINGED, PATCHED, PWNED
A DJI Drone. (Menlo Park Fire Protection District via AP)
PINGED: A pair of Republican senators wants government flight agencies to stop using Chinese drones that could be passing sensitive information about U.S. airports to Beijing spies.
“We…urge you to immediately restrict the use of this equipment and technology that has the potential to jeopardize the security of critical information and infrastructure,” senators including Tom Cotton (R-Ark.) and Marsha Blackburn (R-Tenn.) wrote to Secretary of Transportation Elaine Chao and Federal Aviation Administrator Stephen Dickson yesterday.
The letter follows the FAA’s announcement earlier this month that it would tap Chinese drone maker DJI to help support aircraft inspections, delivery of aircraft parts and airport security.
The letter cites memos from the Army and DHS flagging that the drones could compromise national security. A provision in a recent defense policy bill also banned the military from buying DJI drones.
Sens. Marco Rubio (R-Fla.), Rick Scott (R-Fla.), and John Cornyn (R-Texas) also signed the letter.
DJI responded in a statement that the senators’ letter was “riddled with false allegations that paint a misleading picture of DJI and our commitment to advancing the drone industry as well as data and cybersecurity.” The company said it is not beholden to the Chinese government and called the senators “misinformed” about U.S. government drone programs.
This item has been updated to add comment from DJI.
U.S. Department of Homeland Security logo. (Photo by Salwan Georges/The Washington Post)
PATCHED: President Trump formally appointed Bryan Ware to take over as DHS’s new second in command for cybersecurity yesterday. Ware will replace Jeanette Manfra, who announced her resignation last month and is heading to Google.
The job includes helping states and localities secure the 2020 election against hacking and combating digital threats facing government agencies.
Ware currently serves as DHS’s assistant secretary for cyber, infrastructure and resilience policy. He joined the department in 2018 as a senior adviser to then-Secretary Kirstjen Nielsen and, before joining DHS, worked on artificial intelligence and mobile technology in the private sector.
A man checks his phone (AP Photo/G-Jun Yam, File)
PWNED: Smart watches worn by tens of millions of children could be leaving their location information and voice messages vulnerable to hackers, Zack Whittaker at TechCrunch reports.
The watches are made by Chinese firm Thinkrace, which manufactures watches for several different companies. The company is storing children’s data in computer clouds without adequate security protections to access it, researchers at Pen Test Partners told Zack. As a result, researchers were able to track the location of children just by guessing basic information about their accounts.
The flaws aren’t just putting children at risk. In one case, Thinkrace provided 10,000 smartwatches that were also vulnerable to athletes participating in the Special Olympics, Zack reports.
Thinkrace did not respond to a request for comment from TechCrunch.
2020 Election: PUBLIC KEY
— New York University’s Brennan Center has a new security guide for election official out this morning.
— More cybersecurity news from the public sector:
2020 Election: PRIVATE KEY
— Cybersecurity news from the private sector:
2020 Election: THE NEW WILD WEST
— Cybersecurity news from abroad:
2020 Election: CHAT ROOM
Here’s some sage advice on the cyber lexicon from John Hopkins professor Thomas Rid:
Pro-tip: if you’re tempted to write “cyberwar something something” — just edit out the “cyber” in your draft, and try “war something something.” If it reads like nonsense, it probably was nonsense.
Same for “cyberweapon.”
Also, it’s almost 2020.
— Thomas Rid (@RidT) December 18, 2019
And before we leave you for the year, one last meme to sum up the ongoing election security debate, courtesy of Sen. Ron Wyden (D-Ore.):