An inspector general's office full of hackers? Two lawmakers say it's a good idea

Sen. Sheldon Whitehouse, D-RI., is proposing the creation of an independent inspector generals office that would actively test the cybersecurity of federal, civilian agencies.

Democratic Sen. Sheldon Whitehouse is proposing the creation of an independent inspector generals office that would actively test the cybersecurity of federal, civilian agencies.

The office would be staffed with “red team” operators that could penetrate or “pen test” agency computer networks, thereby providing information about existing vulnerabilities to federal executives.

“Cyber responsibilities are currently spread across 73 different inspector generals and it is not reasonable to expect all 73 of those offices to have adequate expertise and capacity. Indeed, many do no more than to check compliance with minimum standards,” Whitehouse, D-R.I., explained. “A single specialized independent office could both attract world class talent to the government and spur federal agencies in the direction off more effective cybersecurity measures.”

Whitehouse proposed the idea as part of a larger policy recommendation package that he co-authored with Rep. Michael McCaul, R-Texas, and Washington-based think tank the Center for Strategic and International Studies. The recommendations will be offered to the incoming Trump administration, and both lawmakers plan to pursue legislative acton laid out in the report.

The proposed 74th inspector general would be likely housed in either the Office of Management and Budget or Government Accountability Office, Whitehouse said.

“Understanding our vulnerabilities is an important first step in improving our defenses. But we also need to clearly communicate to the American people the seriousness and breadth of existing threats,” said Whitehouse, “an educated public is a democracy’s first line of defense.”

To improve public awareness around cybersecurity, Whitehouse is also encouraging President-elect Trump to designate a “cybersecurity discloser in the executive branch.” The position would be “empower[ed] with broad declassification authority and charged with clearly, constantly and concisely reporting” data about major cyberattacks.

“Information about cyberattacks is reflexively classified making it difficult to report to the public,” said Whitehouse. By making declassification the default approach, Whitehouse hopes that the public will gain a better basic understanding of the challenges faced by federal agencies.

It remains unclear exactly when or if Whitehouse will introduce legislation related to the proposed inspector generals office in fiscal 2017.

“I have not done a survey to see what could be accomplished by executive order versus what can be accomplished by legislation,” Whitehouse said when questioned about next steps. “Chairman McCaul, myself, intelligence committee folks, folks in the house are going to have to look at I think a wide variety of options. I think this report provides a very good framework for it.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems