By Joseph Marks
The FBI headquarters in Washington on Nov. 1, 2017.(J. David Ake/AP)
With the shutdown now in its second month, the vast majority of FBI agents are still on the job and working without pay. But many of the resources they need for cyber investigations are missing in action, the agents said — including money to pay for wiretaps, subpoenas and other tools that form the bedrock of most digital investigations.
In one case, an FBI cyber agent didn’t have money to pay two confidential informants who provide intelligence about cyber assaults by U.S. adversaries, according to a report released yesterday by the FBI Agents Association. In another case, a cyber investigation was stymied because the agent in charge couldn’t coordinate with furloughed workers at another agency.
"These delays slow down our work to combat criminal activity on the [internet] and protect the American people," that agent said, as quoted in the report. It featured testimonials from some of the 14,000 current and former agents the FBIAA represents about how the shutdown is affecting their operations and personal lives.
Many investigations into cybercriminal gangs, hacktivist groups and even nation state-backed hacking operations are probably on hold during the shutdown, edged out by investigations where lives might be more imminently at stake, Austin Berglas, a former top cyber official in the bureau’s New York office, told me.
“If the head of an office understands he’s got dwindling funds to support investigations, he’s going to devote resources to the top priorities of the bureau: terrorism and significant counterintelligence investigations,” Berglas told me. “A massive botnet attack or a massive breach of credit card data is going to take a back seat to that.”
The FBIAA report details hard times across the bureau, ranging from counterterrorism sources who have gone mum because there’s no money to pay them to agents who had to back out of assisting local police investigating violent street gangs.
The funding impasse probably is hitting cyber investigations harder, however, because they tend to be more expensive than other operations, Berglas told me.
That’s because they often rely on troves of court-ordered digital evidence held by multiple Internet service providers and other tech companies, and the FBI has to compensate the companies for retrieving all those records. That can be a lot costlier than an agent tailing a drug dealer, he said.
The cyber divisions problems won't end when the shutdown does.
The bureau will also face significant difficulty resuming cyber operations after weeks in limbo, says Anthony Ferrante, former chief of staff for the FBI’s cyber division. After the October 2014 shutdown, Ferrante told me in an email, it took months before the bureau was processing cases at normal speed again.
“A longer shutdown could result in an even lengthier recovery time — and therefore greater exposure to threats at all levels of government,” Ferrante, who now leads the cybersecurity practice at FTI Consulting, told me.
That slowdown could be particularly damaging because the FBI is trying to meet an ambitious goal of “deterring, detecting, disrupting, and dismantling,” 8,400 computer crimes during the 2019 fiscal year. That’s about 1,000 more crimes than the bureau dealt with in 2018 — a year that didn’t include a weeks-long slowdown in operations.
The FBI declined to comment on whether the shutdown might affect that goal.
In the longer term, the shutdown could be a devastating blow to workforce morale and permanently impair the bureau’s ability to recruit top cyber talent. The Agents Association painted a bleak picture during a news conference of young agents unable to afford to feed their families and longer-serving agents delaying things including braces for children.
Berglas, an executive at the cybersecurity firm BlueVoyant, has fielded several recent calls from FBI cyber agents looking for private-sector jobs, he told me.
“Agents who are technically savvy and able to investigate very technical crimes are already wanted by the private sector at salaries that dwarf what they’re making at the bureau,” Berglas said. “Now, it’s been a month since the shutdown and they’ve already missed a paycheck and they’re often living paycheck to paycheck. That’s not just cruel, it’s a massive morale hit.”
|You are reading The Cybersecurity 202, our must-read newsletter on cybersecurity policy news.|
|Not a regular subscriber?|
The Department of Homeland Security logo in Washington on May 11, 2017. (Salwan Georges/The Washington Post)
It’s not clear how many agencies were infected, a senior official told Ellen, but no Defense Department or classified networks were affected.
The hacking campaign targets the “Domain Name System” (DNS), which translates Web or domain names into IP addresses. It was first spotted last fall by private-sector firms including Cisco and FireEye and was aimed then at government and industry targets in the Middle East.
The U.S. government response to the hacking campaign will be affected by furoughs of information technology staff due to the ongoing government shutdown. Here’s a take from Alex Stamos, former chief information security officer at Facebook, who’s now teaching at Stanford:
In all seriousness, everybody is going to come back to work, look at their logs and we are going to find out how our adversaries took advantage. The long-term impact of driving away qualified workers from the USG will be harder to measure.— Alex Stamos (@alexstamos) January 22, 2019
Director of National Intelligence Daniel Coats at the White House in Washington on Aug. 2, 2018. (Jabin Botsford/The Washington Post)
The document also said that the U.S. intelligence community plans to improve its understanding of adversaries' cyber operations, increase the production of cyberthreat intelligence and seek to prevent and counter malicious cyber activities via diplomatic, military, economic tools and other means. The intelligence community “must continue to grow its intelligence capabilities to meet these evolving cyber threats as a part of a comprehensive cyber posture positioning the Nation for strategic and tactical response,” according to the document.
“The intelligence strategy is not a direct rebuke of the president’s policies,” according to The Washington Post's Shane Harris. “But it is the latest expression of intelligence leaders’ intention to pivot away from a focus on combating terrorism, which has been their central concern since 2001, toward countries that threaten the United States on a geopolitical scale, chief among them Russia, China, North Korea and Iran.”
PWNED: A former top DHS cybersecurity official says it is “likely” as the shutdown drags on that the federal government is not working with state and local officials to boost the security of upcoming elections. Suzanne Spaulding, a former undersecretary at DHS in the Obama administration, wrote in a post published by the Center for Strategic and International Studies that the government is not as equipped to collaborate with operators of critical infrastructure to patch vulnerabilities or perform other important cybersecurity tasks. “With a cyber workforce that is understaffed in the best of times, we are losing ground against our adversaries every day that we operate at less than full strength,” said Spaulding, now a senior adviser for homeland security at CSIS.
Acting attorney general Matthew G. Whitaker in Kansas City, Mo., on Dec. 6, 2018. (Orlin Wagner/AP)
“The committee sent a list of questions in advance to Whitaker on Tuesday,” Ellen wrote. “Its chairman, Rep. Jerrold Nadler (D-N.Y.), noted in his letter that the questions ‘relate to whether there has been interference with the special counsel’s work. They do not relate to the underlying substance’ of Mueller’s investigation, he wrote.”
— More cybersecurity news from the public sector:
A Surface Laptop computer at Microsoft's main campus in Redmond, Wash., on April 20, 2017. (Mike Kane/Bloomberg News)
— Tech giants such as IBM, Intel and Microsoft as well start-ups are researching a way to encrypt data while it is in use, according to CyberScoop's Jeff Stone. “This kind of security, known as homomorphic encryption, would mark a significant upgrade over current forms of encryption, which secure data while it’s stored or while it’s moving through a connection,” Stone reported. “Homomorphic encryption would better protect users who are using internet searches and accessing stored credit numbers as well as businesses that are sharing proprietary data as part of information sharing programs.”
— More cybersecurity news from the private sector:
Heavy traffic in Nashville on June 26, 2015. (Mark Humphrey/AP)
THE NEW WILD WEST
— Cybersecurity news from abroad:
- Data Connectors’ Houston Cybersecurity Conference in Houston tomorrow.
- The Atlantic Council hosts an event titled “Cyber Risk Wednesday: Operationalizing Cyber Strategies” on Jan. 30.
FBI says ongoing shutdown hinders drug and gang crime operations:
President Trump spins asylum restrictions as humanitarian relief | Fact Checker:
Ice disk forms in Maine river: