Jeh Johnson's email, cyber export controls and faux phishing
News and notes from around the federal IT community.
Homeland Security Secretary Jeh Johnson said he will no longer check his personal email on his government computer.
DHS secretary swears off personal email at work
The Homeland Security secretary won't be checking his private email account on his work computer any more. After a report in Bloomberg called out Jeh Johnson and other senior executives for obtaining waivers from an agencywide policy prohibiting the use of personal email on federal systems, Johnson said he would end the practice.
"When I read the story, I said, 'You know, whoops, this is not a good practice so I should discontinue it,'" Johnson said at a July 21 event hosted by Politico. He added that he wanted others who had received waivers to stop using personal email accounts at the office.
The DHS policy seeks to protect the department's network against phishing attacks or malware infections launched via email messages on private accounts. DHS also bans the use of private email for government purposes from a records management point of view.
Johnson said he did not use his private Gmail account for government business, and in the future, he would use his personal smartphone to check his private email while at work.
Reps call for second look at export controls on cybersecurity software
A bipartisan group of lawmakers has expressed concern about the possible consequences of the addition of "intrusion software" to the list of controlled technologies governed by the international Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies.
In response to a rulemaking notice posted by the Commerce Department's Bureau of Industry and Security, Rep. Jim Langevin (D-R.I.) submitted public comments via a letter warning that the new controls could unintentionally stifle cybersecurity research.
"The change would draw a misguided line between offensive and defensive cyber tools, and I fear it would weaken our nation's cybersecurity and overall national security posture," Langevin wrote.
The letter was co-signed by Reps. Michael McCaul (R-Texas), chairman of the House Homeland Security Committee; David Schweikert (R-Ariz.); and Ted Lieu (D-Calif.).
"In particular, by presumptively preventing export of tools with zero-day and rootkit capabilities, the proposed rule would impair the comprehensive testing of risk management frameworks and the overall evaluation of cybersecurity," the letter states.
Some members of the business and activist community share those concerns. For example, Google officials called the rules "dangerously broad and vague" and said they would restrict the ability of software companies and network operators to patch their systems and solicit intrusion testing on the part of cyber researchers.
OPM says phishing alarm did not delay aid to military personnel
While the Office of Personnel Management's credit-monitoring contractor CSID was notifying feds of their exposure in the OPM data breach, the U.S. military became convinced that the notification email messages were a phishing scam and warned recipients not to open them, according to a July 21 story on The Intercept.
The article included the text of the initial warning and the subsequent acknowledgment from the Army Criminal Investigative Command and the Air Force's Office of Special Investigations that the messages were legitimate.
The story's author, Jana Winter, tweeted that the concerns had "delay[ed] aid to military hacking victims," and at least one version of the article's headline repeated that claim.
OPM spokesman Sam Schumach said that wasn't the case.
"It did stop the notifications for a couple days," he told FCW, but after changing the message so users could copy and paste the URL instead of just clicking on a link, OPM resumed sending the notifications.
Affected military members were notified in the same time frame as most other feds, Schumach said. Military notifications resumed June 17 and were finished by June 19.
"OPM understands things could have gone better, but ultimately I think we're satisfied with the end result and our partnership with CSID because we do have a 98 percent contact rate and 21 percent take-up rate, which is unprecedented in terms of a breach like this," Schumach said.
FCW first reported on the military's phishing concerns about CSID email messages on June 19.
Winter did not respond to a request for comment.