Trump administration wants private sector to do more to counter foreign intelligence efforts

It's the first counterintelligence strategy of the Trump administration.

The Trump administration’s counterintelligence strategy, released Monday, aims for stronger collaboration between the intelligence community and the private sector on detecting and stopping foreign intelligence threats to U.S. entities.

The plan, which President Donald Trump approved in early January, emphasizes a longstanding government argument that the private sector must do more to prevent foreign espionage. As state-sponsored hackers target more U.S. companies, corporate America should prioritize preparations to stifle similar attacks in the future, the director of the National Counterintelligence and Security Center, Bill Evanina, told reporters at a briefing Monday.

“A hostile nation state attack on a private U.S. company … is a counterintelligence attack on our nation,” he said. The NCSC is part of the Office of the Director of National Intelligence.

Earlier on Monday the Department of Justice announced charges against four members of the Chinese People’s Liberation Army for allegedly hacking into Equifax to steal information about roughly 147 million Americans. Prosecutors also alleged the four PLA members also had stolen trade secrets from the credit reporting agency.

The plan broadly addresses how the NCSC and private sector can better protect against disinformation, hacking against critical infrastructure and key U.S. supply chains, as well as operations that may impact the U.S. economy.

How companies fit into the plan

While recommendations in the sweeping NCSC strategy include a broad range of ideas, including enhanced information sharing and developing capabilities to track foreign cyber-operations, Evanina told reporters he has one broad measure of success: that Americans and CEOs interpret the Equifax hack and similar attacks to be examples of counterintelligence operations carried out by hackers working on Beijing’s behalf.

Evanina said his top two concerns with Chinese hacking efforts is that they result in either the collection of troves of data to enhance or drive the country’s artificial intelligence capabilities, or the collection of information on Americans to better hone future espionage operations.

In response, Evanina said he would like to see corporations gather their general counsel, chief security officer, chief technology officer, and head of human resources with law enforcement on a quarterly basis to discuss potential threats. Companies also should prepare crisis strategies and conduct tabletop exercises to test for insider threats and supply chain attacks once a year, he said.

Countering cyber-operations

The new strategy stems, in part, from an understanding that threats against the U.S. and the private sector are rapidly changing. They’re expanding in part because nation-states and criminals alike have gained access to some of the most sophisticated computer exploits in the world following classified leaks from the U.S. intelligence community in recent years, according to the strategy document.

“The global availability of technologies with intelligence applications … and the unauthorized disclosures of U.S. cyber tools have enabled a wider range of actors to obtain sophisticated intelligence capabilities previously possessed only by well-financed intelligence services,” the strategy says.

The language is an implicit recognition of problems caused by the disclosure of secret U.S. hacking tools made public by groups like the Shadow Brokers and, according to the Justice Department, a former CIA developer.

To counteract foreign intelligence operations, the strategy suggests adopting better hiring of “cyber counterintelligence and technical security experts,” developing new capabilities to counter foreign cyber-operations in the U.S., and “new analytic tools to improve threat warning” on threats to critical infrastructure.

ODNI also wants to gain more insight into adversaries’ propaganda campaigns that could “undermine confidence in our democratic institutions and processes,” such as the disinformation operations Russia leveraged in the buildup to the 2016 presidential election. The stakes are high right now, as Russia is currently engaged in “information warfare” related to the 2020 presidential elections, FBI Director Chris Wray told the House Judiciary Committee last week.

The government also must improve its counterintelligence efforts in terms of  understanding how possible Chinese and Russian adversaries are operating out of Cuba, Evanina added. The U.S. intelligence community has a plethora of analysts who understand Chinese and Russian intents and capabilities, for example, but the U.S. needs to “merge” that expertise and “put it into context” in Cuba, Evanina said.

This new counterintelligence plan also aligns with some initiatives the U.S. intelligence community has undertaken in the last year, such as the National Security Agency’s creation of a cybersecurity directorate to better share tips on nation-state threats with the private sector so they can gain a better awareness of the threats against them.

The push to designate AI as the next critical infrastructure sector

The designation would unlock a range of federal services, tools and resources for an industry that policymakers view as increasingly tied to national and economic security.

Trump turns to private sector in offensive hacking operations memo

Where’s the Trump administration line on AI regulation?

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure