Cyber Week in Review: June 23, 2017

Here is a quick round-up of this week’s technology headlines and related stories you may have missed:

1. The challenge of drawing up a proportionate response. The Washington Post published a blockbuster story providing new details about the Obama administration's deliberations in responding to Russia's interference in the 2016 U.S. presidential election. President Obama was made aware in August 2016 that the CIA had obtained intelligence--through an ally--that Vladimir Putin had given his intelligence apparatus specific instructions to "defeat or at least damage" Hillary Clinton and help elect Donald Trump. That intelligence triggered a government-wide effort to corroborate the information and draw up potential responses, which included disclosing information that would be embarrassing to Putin, sanctions broader than what the administration eventually settled on (like sanctioning Russian cybersecurity company Kaspersky), moving a U.S. naval carrier group to the Baltic sea, and cyberattacks that would temporarily take down Russian networks. Despite warning the Kremlin four times to cease their activities, the Obama administration eventually opted against retaliation during the election, fearing that any action would be seen as partisan and play into Trump's claims that the vote would be "rigged."

2. Please sir, can I have some more cyber powers? Germany and Canada are looking to expand their legal ability to compromise computer networks and devices. First, Germany's parliament adopted legislation giving German law enforcement authorization to deploy malware to investigate thirty-eight different criminal offenses, ranging from money laundering to the distribution of child pornography. The new lawful hacking powers--which some find controversial--should help German law enforcement bypass the increasing ubiquity of encryption that hinders their ability to access a criminal suspects' data by capturing it before it is encrypted. Second, Canada is considering legislation that would give the Communications Security Establishment, the country's signals intelligence agency, authority to engage in "active" offensive cyber operations. These new powers would give CSE the ability to "degrade, disrupt, influence, respond to or interfere with the capabilities, intentions or activities" of a foreign individual, state, organization, or terrorist group through cyberspace. The move is part of a broader reform of Canada's national security apparatus and comes a week after CSE published an assessment of the threat of foreign interference into Canada's elections.

3. Mexico accused of spying on critics. The University of Toronto's Citizen Lab claims that an unknown actor is using cyberespionage tools to target Mexican journalists and human rights defenders involved in investigations of high-level official corruption or human rights abuses. The targets were compromised by Pegasus, a malware platform developed by the NSO Group, an Israeli cybersecurity firm. The Mexican government admits that it bought Pegasus but denies misusing it to target journalists and activists. This isn't the first time that NSO's toolbox has come under scrutiny. Last year, Pegasus malware was found on the devices of human rights activists in the United Arab Emirates. The company claims that it only sells its software to governments and can't be held responsible for what they chose to do with their tools. In recent years, a cottage industry of boutique firms have sprung up to provide bespoke cyber espionage services to governments that don't have an in-house capability to develop their own tools, like the CIA or NSA.

4. And you thought your backup solution was pretty good. Estonia and Luxembourg signed an agreement allowing the Estonian government to backup it's critical data in Luxembourg. The data will be stored in what the Estonians are calling a "data embassy," essentially a server farm that will have the same immunity and protection as traditional embassies, on Luxemburger soil.