News in Brief

Jeh Johnson's email, cyber export controls and faux phishing

Jeh Johnson

Homeland Security Secretary Jeh Johnson said he will no longer check his personal email on his government computer.

DHS secretary swears off personal email at work

The Homeland Security secretary won't be checking his private email account on his work computer any more. After a report in Bloomberg called out Jeh Johnson and other senior executives for obtaining waivers from an agencywide policy prohibiting the use of personal email on federal systems, Johnson said he would end the practice.

"When I read the story, I said, 'You know, whoops, this is not a good practice so I should discontinue it,'" Johnson said at a July 21 event hosted by Politico. He added that he wanted others who had received waivers to stop using personal email accounts at the office.

The DHS policy seeks to protect the department's network against phishing attacks or malware infections launched via email messages on private accounts. DHS also bans the use of private email for government purposes from a records management point of view.

Johnson said he did not use his private Gmail account for government business, and in the future, he would use his personal smartphone to check his private email while at work.

Reps call for second look at export controls on cybersecurity software

A bipartisan group of lawmakers has expressed concern about the possible consequences of the addition of "intrusion software" to the list of controlled technologies governed by the international Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies.

In response to a rulemaking notice posted by the Commerce Department's Bureau of Industry and Security, Rep. Jim Langevin (D-R.I.) submitted public comments via a letter warning that the new controls could unintentionally stifle cybersecurity research.

"The change would draw a misguided line between offensive and defensive cyber tools, and I fear it would weaken our nation's cybersecurity and overall national security posture," Langevin wrote.

The letter was co-signed by Reps. Michael McCaul (R-Texas), chairman of the House Homeland Security Committee; David Schweikert (R-Ariz.); and Ted Lieu (D-Calif.).

"In particular, by presumptively preventing export of tools with zero-day and rootkit capabilities, the proposed rule would impair the comprehensive testing of risk management frameworks and the overall evaluation of cybersecurity," the letter states.

Some members of the business and activist community share those concerns. For example, Google officials called the rules "dangerously broad and vague" and said they would restrict the ability of software companies and network operators to patch their systems and solicit intrusion testing on the part of cyber researchers.

OPM says phishing alarm did not delay aid to military personnel

While the Office of Personnel Management's credit-monitoring contractor CSID was notifying feds of their exposure in the OPM data breach, the U.S. military became convinced that the notification email messages were a phishing scam and warned recipients not to open them, according to a July 21 story on The Intercept.

The article included the text of the initial warning and the subsequent acknowledgment from the Army Criminal Investigative Command and the Air Force's Office of Special Investigations that the messages were legitimate.

The story's author, Jana Winter, tweeted that the concerns had "delay[ed] aid to military hacking victims," and at least one version of the article's headline repeated that claim.

OPM spokesman Sam Schumach said that wasn't the case.

"It did stop the notifications for a couple days," he told FCW, but after changing the message so users could copy and paste the URL instead of just clicking on a link, OPM resumed sending the notifications.

Affected military members were notified in the same time frame as most other feds, Schumach said. Military notifications resumed June 17 and were finished by June 19.

"OPM understands things could have gone better, but ultimately I think we're satisfied with the end result and our partnership with CSID because we do have a 98 percent contact rate and 21 percent take-up rate, which is unprecedented in terms of a breach like this," Schumach said.

FCW first reported on the military's phishing concerns about CSID email messages on June 19.

Winter did not respond to a request for comment.

About the Author

Connect with the FCW staff on Twitter @FCWnow.


  • Management
    shutterstock image By enzozo; photo ID: 319763930

    Where does the TMF Board go from here?

    With a $1 billion cash infusion, relaxed repayment guidelines and a surge in proposals from federal agencies, questions have been raised about whether the board overseeing the Technology Modernization Fund has been scaled to cope with its newfound popularity.

  • IT Modernization
    shutterstock image By enzozo; photo ID: 319763930

    OMB provides key guidance for TMF proposals amid surge in submissions

    Deputy Federal CIO Maria Roat details what makes for a winning Technology Modernization Fund proposal as agencies continue to submit major IT projects for potential funding.

Stay Connected