NSA Will Hunt Cyber Attackers Inside The US

The sophisticated hacks pulled off by Russia and China against a broad array of government and industrial targets in the United States has prompted a reconsideration of national cyber security strategy. There is problem with the failure of the intelligence agencies to detect the attacks and this is now driving the Biden administration and Congress to think hard about how the nation should protect itself from growing cyber threats.

Now, members of the US Senate Armed Services Committee have expressed support  for expanding the scope for for the National Security Agency (NSA) and US Cyber Command to conduct more intelligence gathering domestically.

A group of cross-party Senators has offered to help expand the NSA's authority which would allow the NSA spy agency to look for signal’s intelligence against foreign adversaries that US officials have said are behind a string of recent attacks, like the recent SolarWinds hack

Committee members praised General Paul Nakasone, who heads both the NSA spy agency and the US military Cyber Command for his efforts to secure the 2020 elections from foreign interference. The NSA and Cyber Command conducted some two dozen operations to protect US infrastructure and target adversaries prior to the November poll.

The disastrous Solar Winds cyber attack is thought to be from Russia and it affected parts of the government including the Department of Justice and the Department of Defense.

Nakasone told senators  that the US was unable to keep up with the threat in large part because laws prevent NSA and Cyber Command from adequately observing adversaries operating on US networks.“They’re no longer just launching their attacks from different parts of the world. They understand that they come into the United States, use our infrastructure, and there’s a blind spot for us not being able to see them.” 

Nakasone also said there are legal barriers for companies to share information with the US government. But to prevent such attacks the federal government must be able to respond more quickly to attacks on private networks inside the United States to understand what’s happening when they are under attack, which currently requires law enforcement and sometimes warrants or other permissions.

The General did not  ask Congress for additional authorities for the NSA to meet that threat, remarking that it wasn’t “necessarily” US Cyber Command that needed to lead that effor, but he he didn’t have to. The Senators  seemed more than ready to deliver them. “I would like to work with the committee on getting you those authorities” said Democrat Senator Kirsten Gillibrand. “This is a case of where we’ve made laws we think are correct and we don’t use our resources,” said Republican Senator Mike Rounds.

While the Fourth Amendment to the US Constution protects against unreasonable searches and is a key obstacle to potential expansion of the NSA’s domestic search powers, it is though that the Biden administration could create a package of procedures or safeguards to address these concerns. That would pave the way to expand the NSA’s capabilities to detect and  prevent hacks without necessarily invading the citizens' privacy.

However, there remain deep rooted concerns for giving expanded authorities to foreign-facing spy agencies, not least because of the widespread bulk surveillance of US citizens carried out by the NSA, as disclosed by the renegade spy agency operative, Edward Snowden

As pointed out by Democrat Senator Ron Wyden, a member of the US Senate Intelligence Committee  “The government already has the authority to watch every bit of data going in and out of federal networks. CISA  and NSA still missed the SolarWinds backdoor calling home for further instructions. The problem here isn’t our privacy laws, but that the government is failing cyber security 101.... Some in the government now want to ask for new, warrantless surveillance of Americans’ communications to distract Congress from asking unpleasant questions about why CISA’s $6 billion cyber shield failed to stop or detect the hacks,” he said in a statement.

US Senate:    CBS:       DefenseOne:     Wall Street Journal:      NYT:      BankInfoSecurity:     Image: Unsplash

You Might Also Read:

CISA, NSA And The Dual Hat

 

« FBI 2020 Online Crime Report
New Cyber Security Measures To Protect US Energy »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Ground Labs

Ground Labs

Ground Labs is a security software company dedicated to making sensitive data discovery products that help organisations prevent sensitive data loss.

Elavon

Elavon

Elavon is a leader in secure payment processing solutions for customers,from large worldwide enterprises to locally-owned small businesses.

Vitrociset

Vitrociset

Vitrociset design complex systems for defence, homeland security, space and transport. Activities include secure communications and cybersecurity.

Exabeam

Exabeam

Exabeam provides security intelligence and management solutions to help organizations of any size protect their most valuable information.

Network Integrity Systems

Network Integrity Systems

Network Integrity Systems is a leader in network infrastructure security and offers solutions specifically developed for Government and Private Enterprise.

PlainID

PlainID

PlainID provides IAM teams with a simple and intuitive means to control their organization’s entire authorization process.

Statice

Statice

Statice develops state-of-the-art data privacy technology that helps companies double-down on data-driven innovation while safeguarding the privacy of individuals.

Exire Technologies

Exire Technologies

Exire Technologies is comprised of a team of professionals who are specialised in cybersecurity and a value added reseller and integrator of ICT security systems.

Talon Cyber Security

Talon Cyber Security

Talon delivers the leading enterprise browser designed to bring security to managed and unmanaged devices, regardless of location, device type or operating system.

Deft

Deft

Deft (formerly ServerCentral Turing Group) is a trusted provider of colocation, cloud, and disaster recovery services.

DeepFactor

DeepFactor

DeepFactor is the industry’s first Continuous Observability platform enabling Engineering and AppSec teams to find and triage RUNTIME security, privacy, and compliance risks in your applications.

ConnectSecure

ConnectSecure

ConnectSecure (formerly CyberCNS) is a global cybersecurity company that delivers tools to identify and address vulnerabilities and manage compliance requirements.

Atomic Data

Atomic Data

Atomic Data is an on-demand, always-on, pay-as-you-go expert extension of your enterprise IT team and infrastructure.

Druva

Druva

Druva is the industry’s leading SaaS platform for data resiliency, and the only vendor to ensure data protection across the most common data risks backed by a $10m guarantee.

ThreatNix

ThreatNix

ThreatNix is a tight knit group of experienced security professionals who are committed to providing competent cybersecurity solutions that adhere to international standards.

Exacom

Exacom

Exacom is a leading provider of multimedia logging/recording solutions across public safety, government, DoD, energy, utilities, transportation, and security applications.