Overnight Cybersecurity: House Intel chair says surveillance collected on Trump transition team

Welcome to OVERNIGHT CYBERSECURITY, your daily rundown of the biggest news in the world of hacking and data privacy. We’re here to connect the dots as leaders in government, policy and industry try to counter the rise in cyber threats. What lies ahead for Congress, the administration and the latest company under siege? Whether you’re a consumer, a techie or a D.C. lifer, we’re here to give you …

 

THE BIG STORY:

–TRUMP TRANSITION STAFF MAY HAVE BEEN CAUGHT TALKING TO WIRETAPPED PEOPLE: The U.S. intelligence community incidentally collected information on members of President Trump’s transition team and the information was “widely disseminated” in intelligence reports, House Intelligence Committee Chairman Devin Nunes (R-Calif.) said Wednesday. “I recently confirmed that on numerous occasions, the intelligence community collected information on U.S. individuals involved in the Trump transition,” Nunes told reporters. “Details about U.S. persons involved in the incoming administration with little or no apparent foreign intelligence value were widely disseminated in intelligence community reports.”

To read the rest of our piece, click here.

–…MEANING IT DID NOT INVOLVE OBAMA: Nunes clearly differentiated what he found from what Trump tweeted. “This is a normal, incidental collection, based on what I could collect,” Nunes said. “This appears to be all legally collected foreign intelligence.” Legally collected foreign intelligence cannot be ordered by the president, as Trump repeatedly claimed had happened. Rather, it can only come from an intelligence or law enforcement agency following strict protocols. Incidentally collected foreign intelligence is when someone legally surveilled communicates with a third party. If Trump or his transition team spoke to someone under investigation, that data is considered perfectly kosher surveillance.

–…TRUMP SAYS HE’S ‘SOMEWHAT’ VINDICATED: After President Trump said he felt “somewhat” vindicated after the head of the House Intelligence Committee revealed that members of his transition team had their communications swept up in legal surveillance activities. “I somewhat do. I must tell you I somewhat do,” Trump said Wednesday afternoon at the White House. “I very much appreciated the fact that they found what they found.” Trump was also personally briefed by Nunes…

To read the rest of our piece, click here.

–…DEM SAYS BRIEFING TRUMP MIGHT HAVE BEEN INAPPROPRIATE: Rep. Eric Swalwell (D-Calif.) – a member of the House Intelligence Committee Nunes chairs – expressed concern about Nunes telling the press before the rest of the committee about those findings. “I was disappointed to see that Chairman Devin Nunes did not share with his House Intelligence colleagues classified information he allegedly received involving President Donald Trump and his campaign. More troubling is that Chairman Nunes chose instead to brief the President and his team, days after it was learned that the President’s campaign is under criminal investigation.”

–…ADAM SCHIFF LABELS STATEMENT A “PROFOUND IRREGULARITY”: Rep. Adam Schiff (D-Calif), the top Dem on the Intel committee, expressed his disappointment, saying  “If accurate, this information should have been shared with members of the committee, but it has not been,” in a statement that criticized Nunes for a “profound irregularity” in how he had handled the situation.

To read the rest of our piece, click here.

Later, he commented on MSNBC’s Meet the Press about evidence he has seen of collusion between Russia and the Trump administration, “There is more than circumstantial evidence now.”

–…JOE SCARBOROUGH CALLS FOR NUNES’S OUSTER: The Republican Party should remove Rep. Devin Nunes (R-Calif.) as chairman of the House Intelligence Committee, the host of MSNBC’s “Morning Joe” said in a tweet on Thursday. “If the Republican Party wants to do what is best for this country and its national security, they will remove Devin Nunes as Intel Chairman.” To read more, click here.

–…NANCY PELOSI SAYS NUNES IS ‘DEEPLY COMPROMISED’: Rep. Nancy Pelosi (D-Calif.) said in a statement “Chairman Nunes is deeply compromised, and he cannot possibly lead an honest investigation. Congress must create a comprehensive, independent, bipartisan commission to expose the full truth of the Trump-Russia connection.”

To read the rest of our piece, click here.

–…MANAFORT MAY GET CALLED BEFORE SENATE INTEL PANEL: Sen. Mark Warner (D-Va.) said the Senate Intelligence Committee needs to speak with President Trump’s former campaign chairman, Paul Manafort, to get answers related to the probe into Russian meddling in the 2016 presidential election. During an interview on CNN, Warner, the ranking member on the Senate Intelligence Committee, was asked whether he believes Manafort’s statement denying allegations of collusion with the Russians. “This is why we have to have this investigation, why we have to talk to Mr. Manafort and a series of other individuals who have been affiliated with the Trump campaign,” Warner said. “In the case of Paul Manafort, he was the actual campaign manager. We’re going to need to bring him in and have that kind of conversation.”

To read the rest of our piece, click here.

 

A POLICY UPDATE:

BY AIR OR BY ROAD: Democratic Sens. Ed Markey (Mass.) and Richard Blumenthal (D-Conn.) are reintroducing two bills aimed at improving cybersecurity in automobiles and airplanes.

The two bills, one for each form of transportation, were first introduced last session of Congress.

The Security and Privacy in Your Car (SPY Car) Act would require the National Highway Traffic Safety Administration and Federal Trade Commission to develop automotive cybersecurity and privacy standards. It also calls for a “cyber dashboard” rating system that would inform consumers if cars went above and beyond those standards.

The Cybersecurity Standards for Aircraft to Improve Resilience (Cyber AIR) Act would introduce a bevy of new baseline standards for air carriers. Companies would have to take “reasonable measures” to prevent cyber attacks, including testing and maintenance, and securing wifi access on airplanes. Carriers and manufacturers would also need to disclose attacks on airplane systems.

To read the rest of our piece, click here.

 

 

A LIGHTER CLICK: BREAK A LEG, Nancy Kerrigan. Break a leg?

 

A REPORT IN FOCUS:

HERE BE DRAGOS: Dragos, a security firm specializing in the industrial control systems (ICS) used by factories and other large plants, found malware disguised as Siemens control software had infected at least 10 systems.

The malware mimics the programmable logic controller for Siemens systems. Antivirus firms had either flagged the program as a false positive — something that looks like malware but isn’t — or malware not targeting anything specific.

The Dragos discovery comes as a part of a much broader report looking at the prevalence of malware in ICS that also calculated that around 3000 such systems are hit with untargeted malware every year.

 

WHAT’S IN THE SPOTLIGHT:

–THE EPA: The Cause of Action Institute is suing the EPA for documents relating to its employees’ use of the encrypted messaging app Signal.

According to the filing, Cause of Action sent a Freedom of Information Act request early February to receive any official records giving employees permission to use Signal or archived records generated on Signal.

A small number of EPA employees were reported to be using Signal to coordinate their response to the then-incoming Trump administration. By law, if any of the messages using Signal contained agency business, they would need to be archived on an EPA searchable account for open records requests.

The Freedom of Information Act gives limited deadlines to fulfill requests, notify about the need for extensions or ask for clarifications. Per the filing, the EPA allegedly sent a letter saying “[t]he EPA office assigned to [CoA Institute’s] request will be in contact … soon to seek any clarification necessary to process [the] request,” but never contacted the COA institute.

Though the White House isn’t covered by FOIA, aides may have violated a similar law – the Presidential Records Act – when they allegedly used a similar app known as Confide to conduct official business, hoping to avoid a Democratic National Committee type breach. The PRA does not give the public the ability to request records.

The EPA declined to comment on the suit.

–WIKILEAKS:  WikiLeaks has not yet fulfilled its vow to contact all of the companies whose products were targeted by the CIA and help them repair security problems unveiled by the anti-secrecy website’s “Vault 7” leaks.

WikiLeaks earlier this month published a large cache of documents, which appear to have been taken from highly secure CIA networks, describing hacking techniques used by the agency. The site redacted critical information needed to actually conduct those attacks.

While WikiLeaks has since contacted major tech sites such as Apple and Google to help them patch their weaknesses, they have not yet done so for a number of smaller firms, including Trend Micro, Avast, and Comodo, multinational companies whose products appear in the leaks.

The firms tell The Hill they have not been contacted by the Wikileaks, concerns first raised by the news site Cyberscoop.

“We have not been notified directly by WikiLeaks but we would welcome the chance to review any new or additional undisclosed data. Our goal is to provide the best security we can to the more than 400 million people and businesses that depend on us, and would welcome any information that helps us do so,” said Avast Vice President Sinan Eren, in a statement.

To read the rest of our piece, click here.

Meanwhile, Motherboard reports the Department of Justice might have accidentally confirmed the CIA leaks were authentic in court.

 

IN CASE YOU MISSED IT:

Links from our blog, The Hill, and around the Web

House Homeland Chair Michael McCaul (R-Texas) again calls for stronger actions against Russia. (The Hill)

A wayward DOT employee used Transportation Secretary Elaine Chao’s twitter account to tell a Democratic legislator to  “SUE [TRUMP’S] VERY SOUL.” (The Hill)

Rep. Jason Chaffetz (R-Utah) and Rep. Stephen Lynch (D-Mass.) grilled law enforcement about facial recognition technology. (The Hill)

The Senate inches from killing the FCC’s privacy rules. (The Hill)

Today’s best headline: “We think technology can solve the world’s problems, but it can’t even stop robocalling.” (Recode)

The many, many ways law enforcement can dodge encryption. (Schneier on Security)

We might be giving the alt-right’s meme makers too much credit. (Motherboard)

 

If you’d like to receive our newsletter in your inbox, please sign up here.