NSA Will Hunt Cyber Attackers Inside The US

The sophisticated hacks pulled off by Russia and China against a broad array of government and industrial targets in the United States has prompted a reconsideration of national cyber security strategy. There is problem with the failure of the intelligence agencies to detect the attacks and this is now driving the Biden administration and Congress to think hard about how the nation should protect itself from growing cyber threats.

Now, members of the US Senate Armed Services Committee have expressed support  for expanding the scope for for the National Security Agency (NSA) and US Cyber Command to conduct more intelligence gathering domestically.

A group of cross-party Senators has offered to help expand the NSA's authority which would allow the NSA spy agency to look for signal’s intelligence against foreign adversaries that US officials have said are behind a string of recent attacks, like the recent SolarWinds hack

Committee members praised General Paul Nakasone, who heads both the NSA spy agency and the US military Cyber Command for his efforts to secure the 2020 elections from foreign interference. The NSA and Cyber Command conducted some two dozen operations to protect US infrastructure and target adversaries prior to the November poll.

The disastrous Solar Winds cyber attack is thought to be from Russia and it affected parts of the government including the Department of Justice and the Department of Defense.

Nakasone told senators  that the US was unable to keep up with the threat in large part because laws prevent NSA and Cyber Command from adequately observing adversaries operating on US networks.“They’re no longer just launching their attacks from different parts of the world. They understand that they come into the United States, use our infrastructure, and there’s a blind spot for us not being able to see them.” 

Nakasone also said there are legal barriers for companies to share information with the US government. But to prevent such attacks the federal government must be able to respond more quickly to attacks on private networks inside the United States to understand what’s happening when they are under attack, which currently requires law enforcement and sometimes warrants or other permissions.

The General did not  ask Congress for additional authorities for the NSA to meet that threat, remarking that it wasn’t “necessarily” US Cyber Command that needed to lead that effor, but he he didn’t have to. The Senators  seemed more than ready to deliver them. “I would like to work with the committee on getting you those authorities” said Democrat Senator Kirsten Gillibrand. “This is a case of where we’ve made laws we think are correct and we don’t use our resources,” said Republican Senator Mike Rounds.

While the Fourth Amendment to the US Constution protects against unreasonable searches and is a key obstacle to potential expansion of the NSA’s domestic search powers, it is though that the Biden administration could create a package of procedures or safeguards to address these concerns. That would pave the way to expand the NSA’s capabilities to detect and  prevent hacks without necessarily invading the citizens' privacy.

However, there remain deep rooted concerns for giving expanded authorities to foreign-facing spy agencies, not least because of the widespread bulk surveillance of US citizens carried out by the NSA, as disclosed by the renegade spy agency operative, Edward Snowden

As pointed out by Democrat Senator Ron Wyden, a member of the US Senate Intelligence Committee  “The government already has the authority to watch every bit of data going in and out of federal networks. CISA  and NSA still missed the SolarWinds backdoor calling home for further instructions. The problem here isn’t our privacy laws, but that the government is failing cyber security 101.... Some in the government now want to ask for new, warrantless surveillance of Americans’ communications to distract Congress from asking unpleasant questions about why CISA’s $6 billion cyber shield failed to stop or detect the hacks,” he said in a statement.

US Senate:    CBS:       DefenseOne:     Wall Street Journal:      NYT:      BankInfoSecurity:     Image: Unsplash

You Might Also Read:

CISA, NSA And The Dual Hat

 

« FBI 2020 Online Crime Report
New Cyber Security Measures To Protect US Energy »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Cyberlytic

Cyberlytic

Cyberlytic applies artificial intelligence to combat the most sophisticated of web application threats, addressing the growing problem of high volumes of threat data.

Innotec Security

Innotec Security

Innotec Security is a Spanish company specializing in cybersecurity-as-a-service, cyber resilience and cyber risk management.

Sentropi

Sentropi

Sentropi is an online protection solution against charge backs, account takeovers, identity thefts and online scams.

miniOrange

miniOrange

miniOrange is a cloud and on-premise based identity and access management (IAM) solution provider.

LightEdge Solutions

LightEdge Solutions

LightEdge’s highly-trained compliance and security experts take the guesswork out of keeping your business protected.

infySEC

infySEC

InfySEC is an information security services organization offering Security Technology services, Security Consulting, Security Training, Research & Development.

BEAM Teknoloji

BEAM Teknoloji

BEAM Technology is an independent Software Quality and Security Testing Center in Turkey.

SecureNation

SecureNation

SecureNation offers a wide variety of cutting-edge technologies and IT services to address almost any of your information security, network security and information assurance needs.

FirstWave Cloud Technology

FirstWave Cloud Technology

FirstWave Cloud Technology is a global cyber security company which has been delivering Cybersecurity-as-a-service solutions to the market since 2004.

Finnish Security & Intelligence Service (SUPO)

Finnish Security & Intelligence Service (SUPO)

The Finnish Security and Intelligence Service is a government agency tasked with combating serious threats to national security in Finland.

Cyber Coaching

Cyber Coaching

Cyber Coaching is a community for enhancing technical cyber skills, through unofficial certification training, cyber mentorship, and personalised occupational transition programs.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CornerStone

CornerStone

CornerStone is an award winning, independent risk, cyber and security consulting firm providing a range of Risk Management, Security Design and Implementation Management Services.

DataSolutions

DataSolutions

DataSolutions is a leading value-added distributor of transformational IT solutions in the UK and Ireland.

Cyber Security Council UAE

Cyber Security Council UAE

The Cyber Security Council's vision is to protect UAE cyberspace, maintain confidence in our digital infrastructure and institutions, and build a cyber-resilient society.

Emantra

Emantra

Emantra specialises in the enablement of Secure Cloud services through it’s comprehensive Sovereign Cloud Hosting, Secure Access Service Edge, and managed services.

Cybermindz

Cybermindz

Many cyber security professionals are under sustained and increasing stress. We set about providing direct support to restore and rebuild emotional and cognitive health.

RedLattice

RedLattice

RedLattice are at the cutting edge of tool development and AI-assisted vulnerability research in cybersecurity.