New House Speaker is a skeptic of U.S. cybersecurity agency

Welcome to The Cybersecurity 202! This trend is … annoying.

Was this forwarded to you? Sign up here.

Today, Post Live will speak with Senate Majority Leader Charles E. Schumer (D-N.Y.), Scale AI CEO Alexander Wang, White House Office of Science and Technology Policy director Arati Prabhakar and others about the future of artificial intelligence. Register here.

Below: A senator urges Cybercom to go on offense against Chinese hackers, and an NCAA probe began with evidence obtained on computers. First:

Rep. Mike Johnson, as House speaker, could play a key role in the fate of some cyber issues

The incoming speaker of the House has criticized the Cybersecurity and Infrastructure Security Agency (CISA), is skeptical of expiring surveillance powers the Biden administration wants renewed and has said voting software during the 2020 election was “rigged.”

After weeks of a vacancy in a position that’s second in line to the presidency, House Republicans on Wednesday selected Rep. Mike Johnson (R-La.) to lead their party in the chamber.

It puts him in a position to set the agenda on key cybersecurity issues.

CISA

Johnson signed on to a GOP Judiciary Committee letter in August questioning Department of Homeland Security Secretary Alejandro Mayorkas when told Johnson in a July hearing that CISA does not censor speech.

CISA has been embroiled in a lawsuit that has now reached the Supreme Court, with Republican attorneys general alleging that CISA and other federal agencies violated Americans’ First Amendment rights in the name of combating disinformation and misinformation.

CISA has repeatedly denied any censorship, and courts have offered varying rulings about whether CISA should be subject to restrictions from dealing with social media companies under the suit.

“Your sworn testimony before Congress is contradicted not only by the findings of the Missouri court, but by documents obtained through the Committee’s oversight,” the GOP letter reads. “The Department of Homeland Security, and especially CISA, are central to the Biden Administration’s censorship efforts and the censorship-industrial complex writ large.”

Last month, approximately half of House Republicans — including Johnson — voted to reduce CISA funding by 25 percent, inspired by GOP complaints about censorship. The vote failed with all Democrats voting against it. Sen. Rand Paul (R-Ky.) has led a campaign against CISA in that chamber.

Surveillance powers

National security officials have urged Congress to re-up spying authorities set to expire at the end of this year under Section 702 of the Foreign Intelligence Surveillance Act. Those authorities permit warrantless eavesdropping on the emails, texts and phone calls of foreign targets. But those targets sometimes communicate with U.S. citizens, and there are concerns about whether Americans have had their privacy violated.

Biden administration officials have warned that the expiration of Section 702 would be devastating.

Some Republicans have become more critical of the overarching FISA law after documented abuses in the investigation of a former Trump campaign official, and Johnson is among the GOP lawmakers who have cited how the FBI has improperly used FISA authority.

In a letter from January of last year, Johnson and Jim Jordan (R-Ohio) — then the top GOP member of the House Judiciary Committee, and currently its chairman — pointed to a 2021 Justice Department watchdog report, which found that in a set of 7,000 FISA applications, 183 had missing or incomplete documentation used to ensure their accuracy.

“This lack of documentation suggests, at best, the FBI maintains sloppy oversight of its use of warrantless spying authorities,” the letter reads. “At worst, it suggests the FBI holds a cavalier disregard for the fundamental protections enshrined in the Bill of Rights.”

Those overarching FISA concerns, and violations of 702 privacy rules specifically, led the duo to ask questions to FBI Director Christopher A. Wray. National security officials have acknowledged mistakes and say they’ve put in place additional safeguards in response.

Now, as House speaker, he can largely determine whether Section 702 legislation gets to the floor, and his legislative plan for the coming months makes no mention of it.

Election security

Johnson played an important role in trying to overturn the 2020 election results, my colleagues Amy Gardner and Michael Kranish reported. Along the way, he advanced false or unproven claims.

“The allegations of these voting machines, some of them being rigged, with this software by Dominion — there is a lot of merit in that,” he said in a radio interview shortly after the election.
“In Georgia, it really was rigged. It was set up for the Biden team to win,” he also said.
“When you have a software system that is used across the country that is suspect because it came from Hugo Chávez’s Venezuela, when you have testimonials of people like this, but in large numbers, it begs to be litigated and investigated,” he said in the same interview.

On Wednesday, Johnson declined to comment when asked if he believed the 2020 election was stolen. “We’re not talking about any issues today,” he said after emerging with the speaker’s gavel. “My position is very well-known.”

Johnson led a push to get lawmakers to sign on to a legal brief supporting a lawsuit challenging the 2020 results, a case that the Supreme Court quickly dismissed.

Dominion has sued media outlets and GOP figures over claims similar to those Johnson mentioned. It reached a $787.5 million settlement with Fox News this year.

The keys

Senator urges Cyber Command to go on offense against Chinese hackers

Sen. Eric Schmitt (R-Mo.) urged U.S. Cyber Command to take an offensive stance against Chinese hackers who breached the State Department, Commerce Department and House of Representatives this year.

A letter addressed to Lt. Gen. Timothy Haugh — Cybercom’s second-in-command who President Biden has nominated to take the reins of the Defense Department’s cyberspace combatant unit as well as the National Security Agency — argues that the United States has for far too long taken only a defense approach to protecting government networks.

“I believe the U.S. government should use all tools at its disposal to discourage and deter state-sponsored hacking groups from wreaking havoc on U.S. government information systems,” the Oct. 24 letter says.
“As opposed to simply patching vulnerabilities and going about regular business, it is time the United States takes the fight to the doorstep of malicious actors,” it adds.

The hackers leveraged a flaw in the company’s cloud services that allowed them to access email accounts of top U.S. officials, including Commerce Secretary Gina Raimondo, U.S. Ambassador to China Nicholas Burns and Assistant Secretary of State for East Asia Daniel Kritenbrink, as well as Rep. Don Bacon (R-Neb.). Some 60,000 State Department emails were exfiltrated in the breach, Senate staffers briefed on the incident previously said.

The hackers leveraged a stolen Microsoft signing key used by the company to authenticate customers, allowing them to masquerade as federal users of Microsoft’s email services and access officials’ inboxes.
That stolen key was leaked in an April 2021 “crash dump” in which the contents of a computer’s memory and systems are recorded upon crashing (the recorded data is often used to figure out what went wrong with a computer during failure).
Schmitt has led previous efforts to examine the United States’ dependence on Microsoft services.

Cybercom did not return a request for comment.

Proposed CISA budget cuts would be “catastrophic,” agency official says

CISA executive assistant director Eric Goldstein called potential budget cuts to his agency a “catastrophic” move that would open up security gaps exploitable to hackers, CyberScoop’s Christian Vasquez writes.

“During a House Homeland Security cybersecurity and infrastructure protection subcommittee hearing … Goldstein … said that a significant budget cut — such as the 25 percent reduction that House Republicans have proposed — would greatly reduce the agency’s ability to monitor threats on federal networks,” Vasquez writes.
“Right now, we are at the point where we have reasonable confidence and our visibility into risks facing federal agencies,” Goldstein said. “We would not be able to sustain that visibility with that significant of a budget cut, and our adversaries would unequivocally exploit those gaps.”

Subcommittee ranking member Eric Swalwell (D-Calif.) said any cuts would “devastate CISA’s ability to operate key programs” and open up the U.S. to cyberattacks from nation state adversaries. Swalwell also called out the committee’s chairman, Rep. Mark Green (R-Tenn.), for a recently unsuccessful attempt to cut the agency’s budget.

“Unfortunately, last month half of the Republican conference, including the chairman of our committee and the newly elected speaker, voted to cut CISA’s budget by 25 percent,” Swalwell said.
Rep. Andrew R. Garbarino (R-N.Y.), the top Republican on the cybersecurity panel, said that “we are going to make sure our colleagues continue to be educated on what a great agency CISA is.”

Garbarino, a supporter of CISA Director Jen Easterly, previously said he would like the Biden administration to “let her be a little more of a leader.” At a different panel, he said CISA needs to be “the center for cyber in the [Biden] administration.”

Correction: A previous version of this newsletter misspelled Rep. Andrew R. Garbarino’s name. This version has been updated.

NCAA sign-stealing probe began after firm obtained evidence from Michigan computers

A sign-stealing probe threatening to disrupt the University of Michigan’s football season began after an outside investigation firm approached the NCAA with documents and videos that the firm said it obtained from computer drives maintained and accessed by multiple Michigan coaches, our colleague Will Hobson reports, citing two people familiar with the matter.

The Big Ten conference confirmed reports last week that said the NCAA was investigating allegations that Michigan covertly sent people connected to its football program to videotape coaches on opposing teams as they signaled in plays at games, which violates college football rules. Football assistant Connor Stalions was suspended over leading the alleged operation. He did not reply to a message left at a phone number listed to him seeking comment.

“While NCAA rules do not explicitly prohibit sign-stealing — the practice of decoding signals that opposing coaches use to send in play calls to players on the field — the organization does ban video-recording opposing coaches as well as in-person scouting of upcoming opponents,” Will writes.
The outside firm concluded that Michigan had been running this sign-stealing operation since at least last season when it went 13-1 before losing in the College Football Playoff semifinals.

The firm had presented evidence including schedules of opponents’ games and travel plans in which scouts paid around $15,000 in tickets to attend games of major football rivals including Ohio State and Georgia.

Daybook

Sen. Charles E. Schumer (D-N.Y.), OSTP director Arati Prabhakar, Signal president Meredith Whittaker and others partake in a Post Live summit on the rise of AI at 9 a.m.
The Senate Banking Committee holds a hearing on illicit terrorism financing tomorrow at 10 a.m.
The National Center on Sexual Exploitation holds a congressional briefing on policy solutions to prevent online sexual exploitation at 10 a.m.
The Senate Banking Committee holds a hearing on illicit terrorism financing at 10 a.m.

Secure log off

Thanks for reading. See you tomorrow.

ncG1vNJzZmivp6x7uK3SoaCnn6Sku7G70q1lnKedZL2wuMitoJyrX2d9c3%2BOamdoamZku6bDjKGmrquVYsCxscCknKtlmah6tLfEqauim12qwG6v2Jucq6uVmMKztdOyZJqflaOwuns%3D

Rep. Mike Johnson, as House speaker, could play a key role in the fate of some cyber issues

CISA

Surveillance powers

Election security

The keys

Senator urges Cyber Command to go on offense against Chinese hackers

Proposed CISA budget cuts would be “catastrophic,” agency official says

NCAA sign-stealing probe began after firm obtained evidence from Michigan computers

Government scan

Industry report

Global cyberspace

Cyber insecurity

Encryption wars

Daybook

Secure log off