Sen. Wyden calls out Pentagon for not adopting email encryption technology

The senator from Oregon wants to know why DISA isn't using STARTTLS.

Sen. Ron Wyden, D-Ore., wants to know why the Defense Information Systems Agency has failed to implement a basic encryption technology that would otherwise protect employees’ emails from being intercepted by hackers and foreign intelligence agencies, according to a recent letter sent to DISA Director Lt. Gen. Alan Lynn.

Wyden is requesting information concerning why DISA has lagged behind the vast majority of U.S. intelligence agencies, including the CIA and NSA, in adopting a widely used encryption technology known as STARTTLS to protect unclassified email systems. STARTTLS adds a layer of web encryption over the email protocol SMTP.

[documentcloud url=”http://www.documentcloud.org/documents/3533789-Starttls-Letter-Signed-March-22.html” responsive=true sidebar=false text=false pdf=false]

DISA is responsible for providing email services to the Coast Guard, Army, Navy and Marines.

An agency spokesperson confirmed that DISA received Wyden’s letter.

While the technology is far from a cure-all against hackers that seek to spy on a target, the technology can help ensure the confidentiality of emails that are sent between different military branches.

“I am concerned that DISA is not taking advantage of a basic, widely used, easily-enabled cybersecurity technology,” the letter reads.

Vice’s Motherboard was the first to obtain Wyden’s letter.

Wyden’s staff has been following this issue because the Oregon senator has long been an advocate for strong encryption.

“Until DISA enables STARTTLS, unclassified email messages sent between the military and other organizations will be needlessly exposed so surveillance and potentially compromise by third parties,” Wyden wrote.

The focus on DISA’s poor email security practices represents just the latest in a series of recent policy initiatives by Wyden to shine a spotlight on insufficient digital security standards. He also has spoken extensively about insecurities present in SS7, the telephone network that internationally organizes the transfer of smartphone data.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure