White House Conveniently Confirms 'Cyberattack' Story Just As Its Pushing Cybersecurity Exec Order

from the coincidence... dept

A “conservative” website apparently reported that Chinese hackers broke into a White House military office computer system with a “spear-phishing attack (like regular phishing, but directly targeted at a victim)”. The White House has confirmed the story while saying that nothing sensitive was accessed:

A White House official speaking on background late Sunday confirmed there was an attempted hack but said that it affected an unclassified network, was “isolated” and that there was no evidence that any data had been stolen.

I’m not a huge fan of any sort of conspiracy theories, but it does seem questionable that this comes out just as the White House is circulating an executive order dealing with “cybersecurity,” and so soon after the administration’s preferred Cybersecurity Act got rejected by the Senate. The Free Beacon website that first broke the story seems to use it to suggest that the administration is “soft” on security — though it was conservatives in the Senate who blocked the Cybersecurity Act from passing in the first place.

Either way, it seems likely that people are trying to hack into key networks all the time. This doesn’t sound like much of a big deal, but the fact that the White House is confirming the news just as it’s pushing this exec order (while still hoping to get legislation through in the lame duck session), at least makes you wonder if the whole thing isn’t being “leaked” on purpose to get cybersecurity stories back into the press to push for the exec order or for a revival of the bill.

Filed Under: , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “White House Conveniently Confirms 'Cyberattack' Story Just As Its Pushing Cybersecurity Exec Order”

Subscribe: RSS Leave a comment
42 Comments
Ninja (profile) says:

Fake?

That makes two of us. And possibly millions.

Also, if it’s true then first Govt personnel should be instructed into secure behaviors (ie: avoid opening those power point chains or unknown links) and second they should prevent connection to sensitive systems. Other than that the cybersecurity “exec orders” they want to implement are pretty much useless.

Trails (profile) says:

As suspicious as...

It’s as suspicious as a traffic accident occurring while the gov’t is pushing new traffic laws.

The US Gov’t has a huge amount of internet “real estate”. The attack surface is massive, and the attempts are constant. In the weeks this executive order has been wending its way through the pipes, it’s not surprising that this occurred. The fact that it’s been reported so widely is a little …smelly… but it’s a pretty common occurrance.

IMO, this:

there was an attempted hack but said that it affected an unclassified network, was ?isolated? and that there was no evidence that any data had been stolen

means the attack was not some super-sophisticated attempt to get at classified networks, probably more a “USA teh suk, Chinaz #1!!!” kinda thing.

TasMot (profile) says:

What about the Computer Hacking Law

We already have a computer hacking law (Just ask Lori Drew ) that can be used to go after computer criminals (Computer Fraud and Abuse Act). But, what the administration is saying that this Cyber Attack (well I guess that a Cyber Atack is not computer fraud or abuse, is that what I’m missing?) So now, a (maybe) cyber attack that was unsuccessful and nothing bad happened that is not computer fraud or abuse needs a new law (although what they probably want is a whole new huge expensive department to deal with this failed threat). OR, they could just take the sensitive information off the internet so it can’t be reached. Wow, why didn’t I think of that.

Michael says:

A few things:

–Highly convenient timing
–*Critical* information and infrastructure shouldn’t be accessible online in the first place; even ordinary people know better
–The thing about this cyber-security bill is that it would effectively compromise the security and privacy of millions of people, under the guise of “protection”

Paul L (profile) says:

@Mike;

I love TechDirt and really enjoy the articles that you write with ONE exception: Cybersecurity. This is what I do for a living, and I do happen to work for an unnamed government that you focus on quite a lot in regards to these things….

With that being said; Let me just say that the level of cyber attacks on national infrastructure is *NOT* being oversold. Most people simply couldn’t comprehend the amount of attacks that are happening on a CONSTANT basis nor do most people understand the mitigation process and how it works within certain government organizations. In addition to that; there seems to be some serious misunderstanding in how data classification is approached at this level and why some controls (such as restricting government workers from accessing sites that are leaking classified data) exist.

Let’s assume that YOU are responsible for a team of people that tries to protect a network. Those networks contain different classifications of data and you need to make sure that people are NOT accidentally moving classified data to unclassified systems. How would you deal with vetting every piece of classified data on an unclassified system and determining if it’s actually been leaked? That process would be a nightmare.

Within government systems, the rule is that classified data is not allowed on unclassified networks. Period. That allows us to leverage data classification tools to help ensure that this data stays where it belongs. Having to make ad-hoc exceptions when something is “believed” to be leaked simply isn’t practical.

These rules are not about CONTROLLING users from accessing this data on the net that’s been leaked, they are in place to prevent this data from ending up on unclassified systems no matter what it’s source.

There’s a lot more to know about this process than simply what shows up in a news article somewhere….

Anonymous Coward says:

not only convenient that it has supposedly happened at this time, but also convenient that they haven’t released where the ‘attack’ came from. all in all, a bit too convenient, i think. mind you, all those in favour in congress will be jumping up and down that the bill needs to move forward as quick as possible before the whole USA is obliterated!

Anonymous Coward says:

Re:

The problem is related to how the laws have made the correct limitations to its extend. People are far more concerned about this than 5 years ago when the process was more gedulgt. The defensive options unfortunately suffers when the offensive possibilities are far too unresticted. It is the name of the game in politics, politicians just have to understand this new reality and same goes for the people responsible for structuring the law-packages.

It is a known fact that the devil is in the detail.

Chuck Norris' Enemy (deceased) (profile) says:

Re:

We don’t question that there are attacks, we question the need for more broadly, poorly written legislation that adds no security to critical infrastructure, coughs up private information without question, and adds another inefficient bureaucratic nightmare of compliance and fines. Cybersecurity experts shouldn’t need a law to figure out how to stop attacks.

Paul L (profile) says:

Re:

I agree with you 100% with your comments.

Don’t get me wrong.. I am NOT in favor of the Cybersecurity Act for a variety of reasons, most of which you already mentioned. I don’t want to see the thing passed either.

My concern was more the approach to many of the cyber security articles that show up here. Many of them DO seem to question if these attacks are real, or just fabricated to justify poorly written laws. At least that’s how I’ve been reading many of them.

John Fenderson (profile) says:

Re:

I haven’t seen any that I interpret as questioning if the attacks are real. I have seen several that question whether or not specific reports are exaggerated — and they often are. This article highlights a pretty good example of that.

There does appear to be an effort to transfer the paranoia of terrorists into the area of computer security, presumably in an attempt to get draconian laws passed.

From a security perspective, this is just as counterproductive as pretending that there is no threat at all.

Suzanne Lainson (profile) says:

So what is being done about cybersecurity?

Let’s say government is totally removed from cybersecurity. Is private enterprise going to keep the Internet safe? Should we all be using cash transactions to avoid having any info transmitted or stored on servers? Seems like companies are being hacked all the time, and security isn’t as good as it could be in most places. So how will protections be implemented?

That Anonymous Coward (profile) says:

Oh! The Humanity?

I was going to say something similar.

Now the other thing to mention is someone with access to the Nuclear Football and all kinds of secrets we have to protect, is one of those people who will answer an email from a deposed prince seeking help to move money out of his country.

It was a spearfishing attack, makes it sound dangerous. Almost as dangerous as getting an email from a friend seeking money in a foriegn country because they were mugged and robbed.

If you can’t get your staff trained to avoid these attacks, what makes you think you can write a law and make it all better? Physician heal thy self.

Anonymous Coward Named Eric says:

And what about the attack on the banks?

With the recent breach on major banks throughout the world this is more reason for Obama to issue an executive order. I call bullshit. We condemn these acts, even though the whole world knows we are responsible for Stuxnet doing exactly this to Iran.

You’d have to be an idiot to not think this is positioning by our “most trusted”.

Suzanne Lainson (profile) says:

And what about the attack on the banks?

We condemn these acts, even though the whole world knows we are responsible for Stuxnet doing exactly this to Iran.

Isn’t that the point, though? Between governments and criminals, that which can be hacked will be hacked. What should we do? How do we, citizens of the world, protect ourselves? Or do we concede that we can’t?

Eric Blair says:

Re:

Let me just say that the level of cyber attacks on national infrastructure is *NOT* being oversold.

1) See the reporting that the DHS was pleased that the myth of the Russian attack on a water station was being propagated.
2) There is a simple solution to the ‘infrastructure attack’ problem. Don’t hook that stuff up to the internet.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »