White House pushing for research carveout in GDPR

Some privacy provisions in GDPR could have a negative effect on security researchers' work.

The White House is hoping to convince European regulators to protect security researchers in their General Data Protection Regulation so they can continue to scrape data that’s relevant for data breach and botnet investigations, according to White House Cybersecurity Coordinator Rob Joyce.

GDPR, which mandates companies with European customers to have numerous data protections in place, goes into effect May 25, 2018. The law will have a significant impact on the billion-dollar cybersecurity industry, but some of its privacy provisions could have a negative effect on security researchers’ work.

One of the more concerning developments revolves around access to data published by the Internet Corporation for Assigned Names and Numbers (ICANN). Whenever a domain name is registered, ICANN requires information like, a name, IP address and physical address to be submitted. While these details are sometimes forged, that information can provide clues about a cyberattack.

ICANN stores all of this data in a record archive known as WHOIS. With the way GDPR is currently written, ICANN may scrub aspects of WHOIS, thereby making it less useful to security researchers.

Security professionals have criticized the impending change. In an interview with independent cybersecurity journalist Brian Krebs, Gregory Mounier, head of outreach at EUROPOL‘s European Cybercrime Center, said that “the new WHOIS plan could leave security researchers in the lurch.”

“Let’s say you’re monitoring a botnet and have 10,000 domains connected to that and you want to find information about them in the WHOIS records, you won’t be able to do that anymore,” Mounier told Krebs.

Joyce said Tuesday at a cybersecurity conference in Annapolis, Maryland that he was also concerned by the chilling effect that GDPR may have on some cybersecurity research projects and investigations.

“We share some of your concern that some of the internet metadata that lets us hunt threat actors and which enables businesses to understand where the threats originate may be affected by GDPR,” said Joyce. “We are actively attempting to push back and fix or create a carve out in the regulations for GDPR … we think there’s room and time to get the ICANN records exempted from it.”

The Department of State is the lead U.S. agency in contact with the European Commission’s working group regarding GDPR compliance negotiations.

“Multiple other international partners have raised this same concern,” Joyce added. “It resonates with us and as we engage with the EU we’re looking to make sure that that there’s an effort to secure cyberspace. And taking away one of the tools for detection doesn’t line up.”

The State Department did not respond to a request for comment.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure