Further Reading, Other Developments, and Coming Events (26 August)

Here are today’s Further Reading, Other Developments, and Coming Events.

Coming Events

• On 10 September, the General Services Administration (GSA) will have a webinar to discuss implementation of Section 889 of the “John S. McCain National Defense Authorization Act (NDAA) for FY 2019” (P.L. 115-232) that bars the federal government and its contractors from buying the equipment and services from Huawei, ZTE, and other companies from the People’s Republic of China.
• The Federal Communications Commission (FCC) will hold a forum on 5G Open Radio Access Networks on 14 September. The FCC asserted
  • Chairman [Ajit] Pai will host experts at the forefront of the development and deployment of open, interoperable, standards-based, virtualized radio access networks to discuss this innovative new approach to 5G network architecture. Open Radio Access Networks offer an alternative to traditional cellular network architecture and could enable a diversity in suppliers, better network security, and lower costs.
• The Senate Judiciary Committee’s Antitrust, Competition Policy & Consumer Rights Subcommittee will hold a hearing on 15 September titled “Stacking the Tech: Has Google Harmed Competition in Online Advertising?.” In their press release, Chair Mike Lee (R-UT) and Ranking Member Amy Klobuchar (D-MN) asserted:
  • Google is the dominant player in online advertising, a business that accounts for around 85% of its revenues and which allows it to monetize the data it collects through the products it offers for free. Recent consumer complaints and investigations by law enforcement have raised questions about whether Google has acquired or maintained its market power in online advertising in violation of the antitrust laws. News reports indicate this may also be the centerpiece of a forthcoming antitrust lawsuit from the U.S. Department of Justice. This hearing will examine these allegations and provide a forum to assess the most important antitrust investigation of the 21st century.
• The United States’ Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) announced that its third annual National Cybersecurity Summit “will be held virtually as a series of webinars every Wednesday for four weeks beginning September 16 and ending October 7:”
  • September 16: Key Cyber Insights
  • September 23: Leading the Digital Transformation
  • September 30: Diversity in Cybersecurity
  • October 7: Defending our Democracy
  • One can register for the event here.
• On 22 September, the Federal Trade Commission (FTC) will hold a public workshop “to examine the potential benefits and challenges to consumers and competition raised by data portability.” By 21 August, the FTC “is seeking comment on a range of issues including:
  • How are companies currently implementing data portability? What are the different contexts in which data portability has been implemented?
  • What have been the benefits and costs of data portability? What are the benefits and costs of achieving data portability through regulation?
  • To what extent has data portability increased or decreased competition?
  • Are there research studies, surveys, or other information on the impact of data portability on consumer autonomy and trust?
  • Does data portability work better in some contexts than others (e.g., banking, health, social media)? Does it work better for particular types of information over others (e.g., information the consumer provides to the business vs. all information the business has about the consumer, information about the consumer alone vs. information that implicates others such as photos of multiple people, comment threads)?
  • Who should be responsible for the security of personal data in transit between businesses? Should there be data security standards for transmitting personal data between businesses? Who should develop these standards?
  • How do companies verify the identity of the requesting consumer before transmitting their information to another company?
  • How can interoperability among services best be achieved? What are the costs of interoperability? Who should be responsible for achieving interoperability?
  • What lessons and best practices can be learned from the implementation of the data portability requirements in the GDPR and CCPA? Has the implementation of these requirements affected competition and, if so, in what ways?”
• The Federal Communications Commission (FCC) will hold an open meeting on 30 September, but an agenda is not available at this time.

Other Developments

• The United States (U.S.) Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency’s (CISA) Assistant Director for Infrastructure Security Brian Harrell has resigned and left CISA. Harrell is returning to the private sector and will be replaced by CISA Deputy Assistant Director Steve Harris in an acting capacity.
• The Federal Communications Commission (FCC) announced “the successful conclusion of bidding in its auction of Priority Access Licenses in the 3550-3650 MHz band…which was designated as Auction 105, made available the greatest number of spectrum licenses ever in a single FCC auction.” The FCC stated “[t]his 70 megahertz of licensed spectrum will further the deployment of 5G, the next generation of wireless connectivity, as well as the Internet of Things and other advanced spectrum-based services.” The FCC added:
  • Bidding in the auction of 70 megahertz of Priority Access Licenses (PALs) in the 3550-3650 MHz band (Auction 105) concluded today following round 76. Gross proceeds reached $4,585,663,345, and bidders won 20,625 of 22,631, or more than 91.1%, of available licenses. The FCC will release a public notice in a few days providing detailed auction results, including the names of Auction 105 winning bidders, and announcing deadlines for payments and the filing of long-form applications, as well as other post-auction procedures needed for the prompt issuance of licenses. That information, as well as other information about Auction 105, will be available at: https://www.fcc.gov/auction/105.  
• The United States (U.S.) Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) issued a Joint Cybersecurity Advisory “in response to a voice phishing (vishing) campaign.” The agencies said “[v]ishing is a form of criminal phone fraud, using social engineering over the telephone system to gain access to private personal and financial information for the purpose of financial reward.” Vishing was reportedly key components in the recent Twitter hack and a breach of Israeli defense firms.
  • The FBI and CISA stated:
    • The COVID-19 pandemic has resulted in a mass shift to working from home, resulting in increased use of corporate virtual private networks (VPNs) and elimination of in-person verification. In mid-July 2020, cybercriminals started a vishing campaign—gaining access to employee tools at multiple companies with indiscriminate targeting—with the end goal of monetizing the access. Using vished credentials, cybercriminals mined the victim company databases for their customers’ personal information to leverage in other attacks. The monetizing method varied depending on the company but was highly aggressive with a tight timeline between the initial breach and the disruptive cash-out scheme.
• At a press conference at the Department of Defense (DOD), Undersecretary of Defense for Acquisition and Sustainment Ellen Lord provided more detail on the waiver the trump Administration granted for some purchases of services and equipment from the People’s Republic of China. Regarding the Section 889 waiver, Lord stated
  • The waiver was granted temporarily by ODNI. It’s only in effect until September 30th in order to provide time to review the full details of the rule implementation using additional information from DOD. 
  • The waiver covers items that are considered low-risk to national security such as food, clothing, maintenance services, construction materials that are not electronic, and numerous other items that ODNI has identified as commodities, low-risk commodities. 
  • The waiver received is not for our major weapons systems or any support activity related to them. The short-term waiver is important so that end-of-fiscal-year activity will not be impacted. We are balancing warfighter readiness and completing end-of-year purchases to avoid issues with expiring funds with rule implementation for the next 45 days. DOD is not seeking a broader waiver request at this time. 
  • As we eliminate Chinese telecommunications equipment form our supply chain, we know that there are challenges for our industry partners, but we are pleased to see the defense industrial base stepping up smartly. This is the right thing for our national security. 
  • We’re pleased to see the efforts of our major primes in being proactive to eliminate the prohibited equipment, and we continue to remain in constant dialogue. We will keep you updated as we move forward. 
• The United States (U.S.) Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has updated its “Essential Critical Infrastructure Workers Guidance” by issuing Version 4.0. CISA stated “[w]hile earlier versions were primarily intended to help officials and organizations identify essential work functions in order to allow them access to their workplaces during times of community restrictions, Version 4.0 identifies those essential workers that require specialized risk management strategies to ensure that they can work safely. It can also be used to begin planning and preparing for the allocation of scare resources used to protect essential workers against COVID-19.”
  • In the guidance, CISA explained
    • This list is intended to help State, local, tribal, territorial officials and organizations endeavor to protect their workers and communities as they continue to reopen in a phased approach, coupled with the need to ensure continuity of functions critical to public health and safety, as well as economic and national security. Decisions informed by this list should also take into consideration worker safety, workplace settings, as well as additional public health considerations based on the specific COVID-19-related concerns of particular jurisdictions. This list is advisory in nature.
  • CISA stressed:
    • It is not, nor should it be considered, a federal directive or standard. Additionally, this advisory list is not intended to be the exclusive list of critical infrastructure sectors, workers, and functions that should continue to work safely during the COVID-19 response across all jurisdictions. (emphasis in the original)
  • CISA asserted
    • The advisory list identifies workers who conduct a range of operations and services that are typically essential to continued critical infrastructure viability, including staffing operations centers, maintaining and repairing critical infrastructure, operating call centers, working construction, and performing operational functions, among others. It also includes workers who support crucial supply chains and enable functions for critical infrastructure. The industries they support represent, but are not limited to, medical and healthcare, telecommunications, information technology systems, defense, food and agriculture, transportation and logistics, energy, water and wastewater, and law enforcement
• The United States (U.S.) Department of Energy’s (DOE) Artificial Intelligence and Technology Office (AITO) “announced the creation of the First Five Consortium (First Five).” The DOE has adapted Pentagon developed artificial intelligence/machine learning to help U.S. first responders make better, faster decisions in the event of a disaster. However, this effort was co-led by Microsoft and involved a range of other stakeholders.
  • DOE explained
    • Co-Chaired with Microsoft Corporation, First Five was formed in response to the January 2020 White House Executive Forum focused on Humanitarian Assistance and Disaster Response. This cross-cut of industry, government, non-profit, and academia has pledged their in-kind support to develop solutions that will improve the impact mitigation of natural disasters in the United States.
    • DOE’s Pacific Northwest National Laboratory is currently scaling a prototype initially developed by the Department of Defense (DOD) Joint Artificial Intelligence Center (JAIC) that uses deep learning algorithms to provide near real-time data to improve the decision making of our nation’s First Responders. Since 2019, the JAIC has led the development of AI capability through its National Mission Initiatives.
    • To support this work, Microsoft recently established a critical infrastructure team to help advance the nation’s key systems, services, and functions essential to the operation of American society and its economy. Comprehensive data collection together with modeling hold huge promise for forecasting and detecting early signs of coming disasters. The development of life-saving AI algorithms can help responders better focus their aid and make for a faster and safer response. The team will explore avenues to use AI, confidential computing, modernized communications, distributed systems, and cybersecurity to improve disaster resilience, collaborating with DOE, DOD, and others.
• The Federal Aviation Administration (FAA), Department of Justice (DOJ), Federal Communications Commission (FCC), and Department of Homeland Security (DHS) published “an advisory guidance document to assist non-federal public and private entities interested in using technical tools, systems, and capabilities to detect and mitigate Unmanned Aircraft Systems (UAS).” This guidance document is not binding on entities operating UAS but instead runs through a survey of some federal laws that limit the use of UAS, especially with respect to privacy and surveillance.
• The agencies stated
  • The advisory is intended to provide an overview of potentially applicable federal laws and regulations, as well as some factors relevant to whether those laws may apply to particular actions or systems. Specifically, this advisory addresses two categories of federal laws that may apply to UAS detection and mitigation capabilities: (1) various provisions of the U.S. criminal code enforced by DOJ; and (2) federal laws and regulations administered by the FAA, DHS, and the FCC. The advisory does not address state and local laws, which UAS detection and mitigation capabilities may also implicate. Neither does it cover potential civil liability flowing from the use of UAS detection and mitigation technologies
  • This advisory is provided for informational purposes only. It is strongly recommended that, prior to the testing, acquisition, installation, or use of UAS detection and/or mitigation systems, entities seek the advice of counsel experienced with both federal and state criminal, surveillance, and communications laws. Entities should conduct their own legal and technical analysis of each UAS detection and/or mitigation system and should not rely solely on vendors’ representations of the systems’ legality or functionality. As part of that analysis, entities should closely evaluate and consider whether the use of UAS detection and mitigation capabilities might impact the public’s privacy, civil rights, and civil liberties. This is particularly important because potential legal prohibitions, as discussed below, are not based on broad classifications of systems (e.g., active versus passive, detection versus mitigation), but instead are based on the functionality of each system and the specific ways in which a system operates and is used. A thorough understanding of both applicable law and the systems’ functionality will ensure important technologies designed to protect public safety, by detecting and/or mitigating UAS threats, are used effectively, responsibly, and legally.
• A United States Department of Homeland Security (DHS) advisory body has reported to President Donald Trump on software defined networking in response to a request from the Executive Office of the President that it examine “the implications of software-defined networking (SDN) on the Nation’s national security and emergency preparedness (NS/EP) communications and information and communications technology (ICT) infrastructure.”
  • The National Security Telecommunications Advisory Committee (NSTAC) explained
    • In networking, SDN and network functions virtualization (NFV) represent an ongoing shift away from legacy technologies based upon hardware to software based networks that leverage standard, commercial off-the-shelf, or commodity-based hardware.
    • This shift is structurally transforming the ICT ecosystem and allowing networks to become more flexible and adaptive. SDN’s more flexible architecture has proven to be beneficial during the ongoing response to the coronavirus (COVID-19) pandemic.
    • The NSTAC examined best practices for SDN and related technologies; identified the associated challenges and opportunities; and assessed current utilization and corresponding risk mitigations. Building off the recommendations outlined in the 2017 NSTAC Report to the President on Emerging Technologies Strategic Vision, this examination sought to make specific recommendations to the EOP regarding SDN policy.
  • NSTAC made these and other recommendations:
    • The Administration should encourage and support the continued deployment of SDN technology in the U.S. and allied nation ICT environments. Policymakers should consider how to promote the use of open architectures with particular focus on 5G and beyond.
    • The Defense Community and the Intelligence Community (IC) should expand efforts to define their specific requirements and use cases for SDN and related technology specific to their unique needs, which can be shared with private sector SDN providers and relevant standards bodies. In collaboration with the private sector, the Defense Community and IC should also determine how the capabilities might be leveraged for adoption in the national security environment.
    • The Government establish policies to help educate U.S. departments, agencies, and critical infrastructure operators on the full range of SDN and related technology capabilities to enhance their mission performance, improve security, and lower costs.
    • Working with Congress, the Administration should: establish policies and incentives to encourage U.S.-based investment and innovation in research and development of SDN and related technology capabilities and standards; (2) encourage best practices for secure implementation; and (3) promote deployment of these capabilities within the U.S. Government and allied nation ICT environments. Policymakers should also consider updating acquisition strategies and mechanisms around SDN and related technology-based services.
• The Australian Strategic Policy Institute released a report titled “Hunting The Phoenix” that “focuses on overseas talent-recruitment operations—how the Chinese Communist Party (CCP) goes abroad to hunt or lure” technology talent from abroad as a means of leveling the playing field with the United States (U.S.) and other nations.
  • ASPI asserted
    • The CCP’s use of talent-recruitment activity as a conduit for non-transparent technology transfer presents a substantial challenge to governments and research institutions. Many of those activities fly under the radar of traditional counterintelligence work, yet they can develop into espionage, interference and illegal or unethical behaviour.
    • While this phenomenon may still be poorly understood by many governments and universities, it can often be addressed by better enforcement of existing regulations. Much of the misconduct associated with talent-recruitment programs breaches existing laws, contracts and institutional policies. The fact that it nonetheless occurs at high levels points to a failure of compliance and enforcement mechanisms across research institutions and relevant government agencies. Governments and research institutions should therefore emphasise the need to build an understanding of CCP talent-recruitment work. They must also ensure that they enforce existing policies, while updating them as necessary. This report recommends the introduction of new policies to promote transparency and accountability and help manage conflicts of interest.
  • The United States (U.S.) Department of State provided ASPI with $145,600, which may have resulted in a bias to the final product, so caveat lector.

Further Reading

• “California DMV Is Selling Drivers’ Data to Private Investigators” By Joseph Cox – Vice. In following up on previous articles about various state Departments of Motor Vehicles (DMV) around the United States (U.S.) selling people’s personal information, this reporter got his hands on a list of the entities the California DMV is sharing such information with and it includes private investigators, bails bondsmen, and employers for those employees who drive as part of their duties. Previously, it has been disclosed that the CA DMV made $50 million a year doing this even though the agency claims this amount merely recovers its costs. No word in this article on whether recipients of this information are barred from sharing or selling it. Earlier this month, eight House Democrats and two Members of the California Assembly wrote the DMV with their concern about these practices and the practice of sharing driver’s license photos with law enforcement agencies for facial recognition technology.  
• “Facebook Braces Itself for Trump to Cast Doubt on Election Results” By Mike Isaac and Sheera Frenkel – The New York Times. In an article that seems sourced right out of Facebook headquarters, the reader is treated to the dilemmas facing the social media giant and competitors if President Donald Trump or others use their platforms to try and delegitimize an adverse or uncertain election result. There are plenty of options being discussed, but few decisions being made.
• “America’s Terrible Internet Is Making Quarantine Worse” By Olga Khazan – The Atlantic. The digital divide telecommunications advocates have been decrying for years has been exacerbated during the pandemic. Because the United States (U.S.) opted to treat broadband internet like a consumer product instead of a public utility (as many nations in Western Europe did), there are wide disparities in availability, quality, and speed that are further feeding inequities in the educational system. Affluent students have no trouble with online learning, less wealthy students may not be able to afford service or their service may not allow for Zoom classes. The U.S. may need to use the same methods deployed during the New Deal to rectify differences in electricity availability to close the digital divide.  
• “Trump pressures head of consumer agency to bend on social media crackdown” By Leah Nylen, John Hendel and Betsy Woodruff Swan – Politico. It comes as no surprise that President Donald Trump is leaning on Federal Trade Commission Chair Joe Simons to act according to the former’s executive order purportedly regarding online censorship. The two have met twice and the issue has arisen, but the unnamed sources in the article did not relate the result of the conversation. Before a Senate committee earlier this month, Simons poured cold water on the notion the agency will wade into the fight over implementation of the executive order that could strip away more protection for technology companies under 47 U.S.C. 230.
• “With Hacks and Cameras, Beijing’s Electronic Dragnet Closes on Hong Kong” By Paul Mozur – The New York Times. After passage of the new security law that changed civil liberties in Hong Kong, the police and security services are threatening and arresting pro-democracy activists and politicians. They are also using technological means to press these advocates such as hacking into Facebook accounts and forcing people to provide access to their phones. Many technology companies are refusing to honor requests for information or access from officials and are now treating them the same way they would for requests from Beijing.

© Michael Kans, Michael Kans Blog and michaelkans.blog, 2019-2020. Unauthorized use and/or duplication of this material without express and written permission from this site’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Michael Kans, Michael Kans Blog, and michaelkans.blog with appropriate and specific direction to the original content.

Image by Sasin Tipchai from Pixabay