News in Brief

Jeh Johnson's email, cyber export controls and faux phishing

Jeh Johnson

Homeland Security Secretary Jeh Johnson said he will no longer check his personal email on his government computer.

DHS secretary swears off personal email at work

The Homeland Security secretary won't be checking his private email account on his work computer any more. After a report in Bloomberg called out Jeh Johnson and other senior executives for obtaining waivers from an agencywide policy prohibiting the use of personal email on federal systems, Johnson said he would end the practice.

"When I read the story, I said, 'You know, whoops, this is not a good practice so I should discontinue it,'" Johnson said at a July 21 event hosted by Politico. He added that he wanted others who had received waivers to stop using personal email accounts at the office.

The DHS policy seeks to protect the department's network against phishing attacks or malware infections launched via email messages on private accounts. DHS also bans the use of private email for government purposes from a records management point of view.

Johnson said he did not use his private Gmail account for government business, and in the future, he would use his personal smartphone to check his private email while at work.

Reps call for second look at export controls on cybersecurity software

A bipartisan group of lawmakers has expressed concern about the possible consequences of the addition of "intrusion software" to the list of controlled technologies governed by the international Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies.

In response to a rulemaking notice posted by the Commerce Department's Bureau of Industry and Security, Rep. Jim Langevin (D-R.I.) submitted public comments via a letter warning that the new controls could unintentionally stifle cybersecurity research.

"The change would draw a misguided line between offensive and defensive cyber tools, and I fear it would weaken our nation's cybersecurity and overall national security posture," Langevin wrote.

The letter was co-signed by Reps. Michael McCaul (R-Texas), chairman of the House Homeland Security Committee; David Schweikert (R-Ariz.); and Ted Lieu (D-Calif.).

"In particular, by presumptively preventing export of tools with zero-day and rootkit capabilities, the proposed rule would impair the comprehensive testing of risk management frameworks and the overall evaluation of cybersecurity," the letter states.

Some members of the business and activist community share those concerns. For example, Google officials called the rules "dangerously broad and vague" and said they would restrict the ability of software companies and network operators to patch their systems and solicit intrusion testing on the part of cyber researchers.

OPM says phishing alarm did not delay aid to military personnel

While the Office of Personnel Management's credit-monitoring contractor CSID was notifying feds of their exposure in the OPM data breach, the U.S. military became convinced that the notification email messages were a phishing scam and warned recipients not to open them, according to a July 21 story on The Intercept.

The article included the text of the initial warning and the subsequent acknowledgment from the Army Criminal Investigative Command and the Air Force's Office of Special Investigations that the messages were legitimate.

The story's author, Jana Winter, tweeted that the concerns had "delay[ed] aid to military hacking victims," and at least one version of the article's headline repeated that claim.

OPM spokesman Sam Schumach said that wasn't the case.

"It did stop the notifications for a couple days," he told FCW, but after changing the message so users could copy and paste the URL instead of just clicking on a link, OPM resumed sending the notifications.

Affected military members were notified in the same time frame as most other feds, Schumach said. Military notifications resumed June 17 and were finished by June 19.

"OPM understands things could have gone better, but ultimately I think we're satisfied with the end result and our partnership with CSID because we do have a 98 percent contact rate and 21 percent take-up rate, which is unprecedented in terms of a breach like this," Schumach said.

FCW first reported on the military's phishing concerns about CSID email messages on June 19.

Winter did not respond to a request for comment.

About the Author

Connect with the FCW staff on Twitter @FCWnow.

Featured

  • Contracting
    8 prototypes of the border walls as tweeted by CBP San Diego

    DHS contractors face protests – on the streets

    Tech companies are facing protests internally from workers and externally from activists about doing for government amid controversial policies like "zero tolerance" for illegal immigration.

  • Workforce
    By Mark Van Scyoc Royalty-free stock photo ID: 285175268

    At OPM, Weichert pushes direct hire, pay agent changes

    Margaret Weichert, now acting director of the Office of Personnel Management, is clearing agencies to make direct hires in IT, cyber and other tech fields and is changing pay for specialized occupations.

  • Cloud
    Shutterstock ID ID: 222190471 By wk1003mike

    IBM protests JEDI cloud deal

    As the deadline to submit bids on the Pentagon's $10 billion, 10-year warfighter cloud deal draws near, IBM announced a legal protest.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.