National security officials outline hopes for US data breach notification law

A national breach notification law needs to be simple and limited, officials said, but stopped short of endorsing a specific proposal.

Top U.S. national security officials on Tuesday explained some ideal elements to a potential national data breach reporting law, describing the idea as one pathway to stopping massive security incidents like the SolarWinds hack.

A national data breach reporting law would need to be clear and concise for companies to follow it, and generally not be a huge burden, said Tonya Ugoretz, deputy assistant director of the FBI. It also might function as an alternative to government surveillance of private sector networks, a controversial idea previously suggested as a means of detecting cyber-espionage.

Such a law should be focused on receiving reports about only especially sensitive breaches, such as those which jeopardize national security and critical infrastructure or that compromise U.S. government information, Ugoretz said during a prerecorded segment that aired at the virtual 2021 RSA Conference.

However, Ugoretz and Adam Hickey, the deputy assistant attorney general and the Justice Department’s National Security Division, stopped short of endorsing any particular proposals, given that the White House still hasn’t publicly signaled its wishes.

Debate over how to address victims reporting major cyberattacks to the federal government has become more urgent since last year’s breach at the federal contractor SolarWinds, which affected nine federal agencies and prominent tech companies via a supply chain attack that exploited SolarWinds software updates. U.S. officials have blamed the breach on Russian intelligence.

Already, the Biden administration via an executive order last week initiated plans for requiring government contractors to report cyber incidents. Going a step further to address the private sector more broadly would require congressional action, and ideas are circulating on Capitol Hill about what such a law would look like.

Some in Congress have suggested intelligence agencies need to have greater insight into what’s happening on private sector networks, since the SolarWinds attackers used private sector U.S. infrastructure as a partial means of carrying out the hack. 

“One alternative to that — if you don’t like the idea of more surveillance — is reporting that is voluntary, in the sense that you choose what you put on the form that you fill out,” Hickey said. “Now the regulation may require it, but the point is, you’re filling it out. Someone’s not watching your network.”

Ugoretz said the idea would be to keep the burden on private sector companies low.

“I don’t think we’re looking at a threshold where every single incident and intrusion would need to be reported,” she said. “What we’re most concerned about from the federal government perspective are incidents where there’s a national security or public safety concern, so things like U.S. government information that’s been threatened or U.S. critical infrastructure.”

Furthermore, any new law needs to be easy to follow, Ugoretz said. Already, companies must contend with a patchwork of state data breach notification laws.

The irony of the renewed demand for a national law stemming from the SolarWinds hack is that FireEye demonstrated the best-case scenario in voluntarily reporting that it was compromised, alerting the federal government to the broader threat, Hickey and Ugoretz said.

“That was model behavior and it was entirely voluntary, and it’s in the public good,” Hickey said. “Sometimes you want legislation that creates those incentives so that what is purely voluntary today is encouraged in the future or potentially required, and that’s a choice obviously for the administration and Congress to make.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure