.png)
Again addressing a major issue that is kick-starting this decade, the U.S. Government continues its efforts to effectively combat cyber-crime.
Cyber 9-Line
On June 9, 2020, US Cyber Command (USCYBERCOM) Public Affairs Office announced a 911-like portal for malware attacks: the Cyber 9-Line. Collaborating with the National Guard, USCYBERCOM created the Cyber 9-Line with the intent to share information, in real time, related to cyber threats and attacks by foreign adversaries.
Using a template of questions designed to effectively communicate cyber incidents, the resulting data “enables USCYBERCOM's Cyber National Mission Force to further diagnose a foreign attack and provide timely, unclassified feedback back to the unit, who shares with state and county governments to address the cyber incident. This process is a key aspect of how USCYBERCOM helps strengthen America’s cybersecurity, and enable election integrity.”
USCYBERCOM reports that 12 states completed the Cyber 9-Line registration process, enabling them to use DOD resources against foreign adversaries and strengthen both the state and U.S. network.
By creating open lines of communication, USCYBERCOM can add to its existing unclassified cyber intel cache, referred to as its Big Data Platform (BDP), with information gathered from state cyber incidents through the National Guard. BDP content, especially that regarding malicious cyber activities, is critically important for defending the country’s elections, critical infrastructure, and developing cyber incident response capabilities.
Access to Cyber 9-line can be requested at cyber9line@cybercom.mil.
S. 4051 A Bill to End the Use of Warrant-Proof Encryption that Shields Criminal Activity
On June 23, 2020, Senators Lindsey Graham of South Carolina, Tom Cotton from Arkansas, and Marsha Blackburn of Tennessee introduced S. 4051 seeking to end “warrant proof encryption” that impedes law enforcement investigations. According to the Senate Judiciary website, the purpose of the bill is rooted in national security interests by removing a tech shield often used by terrorists.
The bill, entitled “Lawful Access to Encrypted Data Act," is summarized by the Senate Judiciary as “a balanced solution that keeps in mind the constitutional rights afforded to all Americans, while providing law enforcement the tools needed to protect the public from everyday violent crime and threats to our national security. The bill would require service providers and device manufacturers to provide assistance to law enforcement when access to encrypted devices or data is necessary – but only after a court issues a warrant, based on probable cause that a crime has occurred, authorizing law enforcement to search and seize the data.”
Some of the historical anecdotes providing support for the bill are as follows:
In December 2019, a member of the Royal Saudi Air Force carried out a terrorist attack at the Pensacola Naval Air Station in Pensacola, Florida, killing three service members and wounding eight. Attorney General Barr and FBI Director Wray recently announced that new evidence shows the terrorist was radicalized by al Qaeda. The FBI uncovered this evidence only after hacking into the phone to recover encrypted data. The terrorist had shot the phone in an attempt to destroy it. The FBI said they “effectively received no help from Apple” and the effort took over four months, costing “large sums of taxpayer dollars.”
In May 2015, there was a terrorist attack Garland, Texas. ISIS later claimed responsibility. Investigators discovered that one of the terrorists in Texas exchanged more than 100 messages with a terrorist overseas using an end-to-end encrypted app. To date, the FBI is still unable to determine the content of these messages.
While text of the bill is not yet available on congress.gov, the Senate Judiciary lists highlights of the bill as follows:
1. Enables law enforcement to obtain lawful access to encrypted data.
If a warrant is obtained, the bill requires the device manufacturers and service providers to assist law enforcement with accessing encrypted data if assistance would aid in the execution of the warrant.
Allows the Attorney General to issue directives to service providers and device manufacturers to report on their ability to comply with court orders, including timelines for implementation. Although, the Attorney General is prohibited from issuing a directive with specific technical steps for implementing the required capabilities.
2. Incentivizes technical innovation.
Directs the Attorney General to create a prize competition to award participants who create a lawful access solution in an encrypted environment, while maximizing privacy and security.
3. Promotes technical and lawful access training and provides real-time assistance.
Funds a grant program within the Justice Department’s National Domestic Communications Assistance Center (NDCAC) to increase digital evidence training for law enforcement and creates a call center for advice and assistance during investigations.
Such legislation is expected as the governments of the Five Eyes (USA, the United Kingdom, Canada, Australia, and New Zealand) have been analyzing economic and legislative mechanisms to encourage tech companies to provide encryption keys to law enforcement agencies for several years.