Reason Roundup

The U.S. Government Spent Billions Failing To Defend Its Own Agencies From Cyberattacks

Plus: Google gets hit with another antitrust lawsuit, the U.S. falls in a new ranking of human freedom, and more...

|


reason-hackers | Peerapong Boriboon/Dreamstime.com
(Peerapong Boriboon/Dreamstime.com)

As if this year wasn't apocalyptic enough already, over a dozen federal agencies—including the one that manages all our nukes—had their internal networks compromised in what's being described as the "worst ever" hack of the U.S. government.

On Thursday, Politico reported that the U.S. Department of Energy and the National Nuclear Security Administration (NNSA), which it oversees, both discovered evidence that hackers had accessed their networks. They're only the latest agencies to fall prey to hackers, who've also managed to infiltrate the State Department, Department of Homeland Security, and parts of the Pentagon.

The revelation of this massive cyberattack came last week when cybersecurity firm FireEye announced that its own systems had been breached.

The company's internal investigation pinpointed a vulnerability in the software they'd purchased from Texas-based technology company SolarWinds. Hackers had reportedly inserted a backdoor into SolarWinds' Orion network management software. That corrupted software was then pushed out via an update to some 18,000 of the company's clients, including numerous corporations and government entities.

FireEye's discovery set off a government investigation that has produced a growing list of agencies and departments that have also been infiltrated by the hack. The initial hack of SolarWinds reportedly happened between March and June, meaning that cyberattackers have likely had access to government networks for months now.

Thomas P. Bossert, a national security adviser to President Donald Trump, said in The New York Times that this kind of "supply chain attack" is typically the work of state actors, and suggested that the Russian government was responsible.

The Washington Post, relying on "people familiar with the matter," reported on Monday that the Russian hackers associated with the country's foreign intelligence service were behind the attack.

Democratic politicians have been quick to echo this line.

"This is virtually a declaration of war by Russia on the United States and we should take that seriously," said Sen. Dick Durbin (D–Ill.) on Wednesday. Sen. Richard Blumenthal (D–Conn.) said on Twitter that "today's classified briefing on Russia's cyberattack left me deeply alarmed, in fact downright scared. Americans deserve to know what's going on. Declassify what's known & unknown."

Patrick G. Eddington, a research fellow in homeland security and civil liberties at the Cato Institute, noted that Blumenthal and his fellow senators have the power to make all of this public if they wanted to.

https://twitter.com/PGEddington/status/1339181230449954817

The State Department has yet to publicly pin the blame on the Kremlin. Journalist Glenn Greenwald also noted that no proof of Russia's involvement has been made public as of yet.

Regardless of who's responsible, this hack has exposed some embarrassing security vulnerabilities for both SolarWinds, and particularly the U.S. government.

In the former's case, one security researcher told Reuters that he'd discovered last year that the company's update server was secured with the password "solarwinds123." The company did not have a chief information security officer either, reports The New York Times.

The Times also noted in a Wednesday article that despite the billions the federal government has spent upgrading and reorganizing its cybersecurity capabilities, it was unable to prevent or even initially detect this massive hack of government computer systems. It had to be alerted by the private sector.

One option policy makers should consider is just abolishing the Departments of Energy, Commerce, Homeland Security, and other compromised agencies we can make do without. An agency can't be hacked if it doesn't exist.

FREE MARKETS

On Thursday, 38 state attorneys general filed an antitrust lawsuit against Google, arguing that it had used uncompetitive practices to maintain a monopoly on internet searches. The Wall Street Journal has the details:

The states alleged that Google leverages its position as the dominant search engine—and the personal data such a perch allows the company to gather—to limit consumers from using competing search engines, force businesses to use its proprietary advertising tools and foreclose competition from specialized search engines for travel or local businesses.

This lawsuit comes a couple of months after the U.S. Department of Justice filed a similar antitrust suit against the search engine giant. How successful these efforts will be remains to be seen. Past federal investigations of Google's supposed monopoly power have come to nothing.

FREE MINDS

The Cato and Fraser Institutes have released the latest version of their Human Freedom Index, which ranks countries around the world based on how free their populations are, as measured by a range of indicators that "encompasses personal, civil, and economic freedom."

The report, which relies on data from 2018, once again gave top marks to New Zealand, Hong Kong, and Switzerland as the freest countries in the world. The U.S. was ranked 17th, down from 15th last year.

QUICK HITS

  • Perhaps the real victims of COVID-19 are the government officials not getting enough credit for the vaccines developed by private companies.
  • Southern California ICU capacity is officially at 0 percent.
  • The Boston Landmarks Commission would like the public's input on whether property owners should be allowed to demolish this potentially historic garage.

  • Los Angeles County is appealing a ruling from earlier this month that has stopped it from imposing a ban on outdoor dining.
  • Vaccinating the elderly first, rather than essential workers, will save more lives according to a model from the Centers for Disease Control and Prevention (CDC).

https://twitter.com/mattyglesias/status/1339754173491982337

 

Christian Britschgi is a reporter at Reason.