AT&T paid a hacker group about $400,000 to delete customer data that was stolen in a widespread leak earlier this year, according to Bloomberg.

The Dallas telecom reportedly negotiated a roughly $380,000 payment through an intermediary called Reddington, which acted on behalf of the ShinyHunters hacking group.

AT&T disclosed Friday that hackers had leaked private information from “nearly all” of its customers through a third-party cloud service called Snowflake, which AT&T uses to store data.

The breach is one of several compromises associated with the software provider Snowflake, as the company confirmed Friday that the AT&T hack was connected to other incidents with Live Nation Inc.’s Ticketmaster and online loan marketplace LendingTree.

Bloomberg called it one of the worst security breaches of a U.S. telecom company in history.

According to Wired, AT&T has received a video to prove that the hackers have deleted all customer data.

AT&T has yet to confirm whether it received the video, but said that it “does not believe that the data is publicly available.”

The reported payout is relatively low compared to recent ransom payments made by other high-profile companies including UnitedHealthcare, which made a $22 million ransom payment in February, according to Bloomberg.

“For a big company like AT&T, $380,000 is a drop in the ocean,” Jon DiMaggio, chief security strategist at Analyst1, told Bloomberg.

ShinyHunters reportedly demanded an initial ransom of $1 million, but AT&T was able to talk the group down to a lower price, which it paid on May 17th in Bitcoin, Wired said.

The stolen data included telephone numbers and cell site IDs, information that could potentially be used to locate and identify customers.

However, AT&T says other sensitive data such as the content of texts, social security numbers and private personal information were not leaked.

AT&T didn't immediately respond to our requests for comment. 

The Federal Communications Commission has officially proposed a voluntary cybersecurity labeling program for the “things” in the Internet of Things (IoT).

FCC chair Jessica Rosenworcel on Thursday (August 10) released a notice of proposed rulmemaking (NPRM) seeking comment on how to institute such a program for smart devices that meet certain privacy and security standards, similar to the Energy Star program for devices, including cable equipment, that meet efficient energy-use standards.

Rosenworcel said the mark, billed as a “trusted, government-backed symbol,” would help consumers make more informed choices about their devices.

“The proliferation of consumer IoT devices has opened the door to cyberattacks on consumer products that can have serious privacy and national security consequences, ranging from theft of personal information to disruption of critical infrastructure,” the NRPM said.

The FCC IoT stamp of approval would come in the form of a U.S. Cyber Trust Mark, the goal being to distinguish trustworthy products from nontrustworthy devices and “create incentives for manufacturers to meet higher cybersecurity standards.”

The FCC cited the estimated 1 billion to 5 billion attacks on smart devices in the first half of 2021 alone in arguing for the need for a new seal of cybersecurity approval.

The mark would be based on criteria from the National Institute of Standards.

The FCC is seeking lots of comments on just how to set up the program, including which devices should be eligible, who should oversee it, how to demonstrate compliance and prevent unauthorized use, and how to let consumers know about it.

In the wake of the Department of Homeland Security’s warning about cyber-threats related to Russia's invasion of Ukraine, the Federal Communications Commission has launched a proceeding to examine potential threats to the global internet routing system, including any equity issues that might implicate.

The FCC commissioners uninamously adopted a notice of inquiry into the security of the Border Gateway Protocol (BGP), the internet's global routing system for data including email, e-commerce, banking, interconnected voice-over-IP service and 911.

The agency is looking to prevent bad actors from hijacking the protocol, which it said could expose web users to data theft, extortion, espionage and insecure transactions.

Also: CTA Pledges to Back Russia Tech Sanctions

The FCC has already warned communications providers to review their cybersecurity protections and practices, given that their communications networks are critical to transportation, gas, electricity, water and financial markets.

The FCC said Russian networks have been suspected of hijacking BGP to rout traffic through their networks under "unexplained" circumstances.

Among the issues on which the FCC wants comments:

1.) “Steps the Commission, in coordination with other federal agencies, could take to prevent BGP hijacking or otherwise promote secure Internet routing.”

2.) “Whether the Commission has a role in helping U.S. network operators deploy BGP security measures.”

3.) “[Its] authority to promote the security of Internet routing through regulation, including as it may apply to wireless and wireline Internet Service Providers, Internet Exchange Providers, interconnected VoIP providers, operators of content delivery networks, cloud service providers, and other enterprise and organizational stakeholders.”

4.) “Whether regulatory clarity could help network operators prioritize investments in the security of their networks.”

5.) “How our proposals may promote or inhibit advances in diversity, equity, inclusion and accessibility.” ■

The House on Thursday (Dec. 2) passed three communications-related bills, including one requiring the Federal Communications Commission to start kicking the tires on 6G wireless.

The bills are the FUTURE Networks Act (HR 4045), the Understanding Cybersecurity of Mobile Networks Act (HR 2685) and the American Cybersecurity Literacy Act (HR 4055).

The Future Uses of Technology Upholding Reliable and Enhanced Networks [FUTURE] Act directs the FCC to create a 6G task force comprising public interest groups, communications network businesses (though not ones considered to be “not trusted,” the law makes clear), and government stakeholders.

The bill defines “not trusted" as technology “owned by, controlled by, or subject to the influence of a foreign adversary” or that otherwise “poses a threat to the national security of the United States.”

Within a year, the FCC must report back to Congress on, among other things, the status of industry-led standards, supply chain security limitations, and how to coordinate siting, deployment and adoption of 6G.

The task force will have to produce a draft of that report within six months and put it out for public comment.

The bills together are meant to ensure the country leads in next-generation communications technology, said the Republican leadership of the House Energy & Commerce Committee, adding that they “will strengthen our cybersecurity awareness, bolster our leadership in 6G technology and reinforce the security of our mobile communications network.”

The bills passed out of the committee back in July.

The “Understanding Cybersecurity of Mobile Networks Act,” which requires the National Telecommunications and Information Administration (NTIA), the Biden administration's chief telecom policy advisory arm, to study and report on the cybersecurity of mobile broadband nets and their susceptibility to attacks and surveillance by “adversaries.”

HR 4055, the “American Cybersecurity Literacy Act,” would require the NTIA to educate the public about cybersecurity risks and best practices.

“The Understanding Cybersecurity of Mobile Networks Act gives policymakers a better understanding of the state of the cybersecurity in our wireless networks, which is a matter of national security,” Rep. Anna Eshoo (D-Calif.), who was the driving force behind that and the American Cybersecurity Literacy Act, said.

House Energy & Commerce Committee Republican leadership said Thursday (Aug. 19) that they had big issues with the theft of data from T-Mobile, saying Congress has to pass privacy legislation ASAP.

“The T-Mobile data breach is of serious concern. While we have more to learn to determine how this breach happened and its potential wide-ranging consequences, we urge all companies to do everything they can to safeguard and protect American’s personal information," they said in a statement.

"They" were E&C ranking member Cathy McMorris Rodgers (R-Wash.), Communications and Technology Subcommittee ranking member Bob Latta (R-Ohio), and Consumer Protection ranking member Gus Bilirakis (R-Fla.).

They pointed out that last month the committee approved bipartisan legislation to promote cybersecurity information sharing.

That appeared to be a reference to H.R. 4046, the “NTIA Policy and Cybersecurity Coordination Act,” which would authorize the NTIA's Office of Policy Analysis and Development and re-christen it the Office of Policy Development and Cybersecurity.

The office administers the network security information sharing program established by Congress in the Secure and Trusted Communications Act. It passed along with a raft of tech/cybersecurity bills last month.

But they said more needs to be done. "We need to build on that work to protect Americans’ privacy. This breach is yet another example of why Congress must pass a national privacy and data security law. We need strong national standards that ensure industries can innovate, strengthen cybersecurity and data privacy, and keep up with the evolving ways bad actors steal personal information.”

Both Republicans and Democrats have argued for national legislation, but have yet to agree on just what should be in that law.

A day after live streams for its radio and television stations were attacked by hackers in an apparent ransomware incident, Cox Media Group properties across the country were still largely unavailable.

Cox Media owns 65 radio stations in 11 markets, 33 television stations in 20 markets, and several multi-platform streaming video and digital platforms. The TV stations, in markets like Boston; Pittsburgh; Dayton, Ohio; Seattle; and Tulsa, Oklahoma are a mixture of major network affiliates like ABC, Fox, CBS, NBC and My Network TV and independents. 

According to a report in Inside Radio, the attack began on the morning of June 3, and was apparently centered on internal networks and live streaming capabilities such as web streams and mobile apps at the Cox Media properties. Websites for the stations and most programming remained unharmed, but according to Inside Radio some live stream programming and newscasts had to be canceled. 

The attack apparently didn’t affect traditional pay TV feeds for the channels. Dish Network, which reached a carriage deal with Cox Media for about 14 channels in December, said it experienced no issues with the broadcaster. 

Cox Media representatives did not return requests for comment, but according to reports, several stations informed employees to shut down their work computers and phones on June 3.

NBC News reported that at least two stations — ABC affiliate WFTV in Orlando, Florida, and NBC affiliate WPXI in Pittsburgh — were affected, with WFTV telling workers to stay home Thursday.  Other reports claimed that Cox stations in Charlotte, North Carolina ABC affiliate WSOC-TV and Tulsa Fox affiliate KOKI-TV were affected as well. As of Friday afternoon some reports said a few of the stations were beginning to resume their online streams, but streams for Cox Media radio stations were still unavailable.

As of 6 p.m. ET Friday, online streaming for Cox Media’s Alexandria, Louisiana ABC affiliate KLAX-TV, Atlanta ABC affiliate WSB-TV, Boston Fox affiliate WFXT, Dayton, Ohio CBS affiliate WHIO-TV, Charlotte ABC affiliate WSOC-TV, Orlando ABC affiliate WFTV and Tulsa Fox affiliate KOKI-TV was either unavailable or showing partial replays of old newscasts. 

Streaming services like Hulu Live, which carry local broadcast streams, also were impacted. Hulu Live temporarily replaced WSB-TV’s broadcast feed with ABC News Live until the local feed was restored. 

According to a report in cybersecurity publication The Record, Cox Media employees were saying earlier this morning that they had shut down their systems in time and that they “should be back up and running soon.” 

The attack comes shortly after some high-profile ransomware incidents, including the May hack of the Colonial Pipeline which choked off gasoline supplies up and down the East Coast for days. Colonial  reportedly paid $4.4 million to hackers to get fuel flowing again. Earlier this month, meat producer JBS shut down nine beef plants in the U.S. after a similar ransomware attack.  

On Thursday, deputy national security adviser Anne Neuberger issued an open letter urging companies to take security precautions to protect against ransomware attacks.

A new USTelecom study of the cybersecurity-readiness of small and medium-sized businesses operating critical infrastructure and found them generally wanting at a risk to national security.

USTelecom’s 2021 Cybersecurity Survey: Critical Infrastructure Small and Medium-Sized Businesses (SMBs) looked at communications networks as well as energy, financial and water, and found small businesses involved in all those were particularly vulnerable to breaches and can take longer to identify and recover from them (on average seven-and-a-half-months to fully recover).

Also Read: COVID-19 Related Pirate Streaming Is Big Malware Threat

Fully three quarters of those businesses surveyed said they had experienced a cyber breach while a majority (59%) said that their breach(es) had "stopped" productivity.

"Don’t be fooled – these companies may be small or have fewer employees than their counterparts – but they play a big role in operating and safeguarding our country’s critical infrastructure, including energy, financial, water and communications assets," said USTelecom SVP Robert Mayer in announcing the study.

The survey found that the cost, on average, to resolve a breach was $170,000, while 46% said they also lost customers because of breaches.

Also Read: IoT Cybersecurity into Law

USTelecom offered up some recommendations for mitigating cybersecurity risks: 1) conduct regular training; 2) revisit and update policies and procedures; 3) update system configurations; 4) conduct annual risk assessments; 5) conduct post-breach assessments; 6) evaluate in-house capabilities annually; 7) have cybersecurity insurance; 8) share information formally and informally; 9) conduct regular briefings; 10) dedicate at least 10%-25% of IT budgets to cybersecurity.

USTelecom conducted 14 in-depth online surveys with SMB CEOs and C-level executives. Usable responses were obtained from 323 respondents.

The year ahead will bring momentous challenges to digital ecosystems, according to dozens of policymakers and industry analysts who offered their visions at the annual “State of the Net” conference. They focused on the digital divide, cybersecurity, privacy, Section 230 oversight and the encouragement (but control) of fast-emerging technologies such as artificial intelligence during the two-day virtual event last week. 

Many of the public officials, in their remarks, also shot down the concept of “unity” as enunciated a week earlier in President Biden’s inaugural address. Their presentations offered a contentious glimpse of what’s ahead, frequently laced with interpretations of how the COVID-19 recovery process will affect telecommunications and media policy. The 2021 edition of SOTN presented an especially volatile annual amalgam of achievements and complaints; the event is produced by the Internet Education Foundation.

Among the three Members of the House of Representatives who spoke, Rep. Cathy McMorris Rodgers (R-Wash.) was the most critical of President Biden – challenging his first-day-in-office action to reverse a Trump Administration order to protect the electrical grid. Rodgers, the ranking member of the House Energy & Commerce Committee, also praised former FCC Chairman Ajit Pai’s spectrum policy actions.  

Reflecting her interest in infrastructure – especially power grid issues, Rodgers chastised President Biden’s moves “to weaken the grid.”

“On his first day, President Biden issued an order freezing the … executive order from last year,” Rodgers said, citing the SolarWinds cybersecurity hack. “It’s incredibly disappointing that President Biden has taken this action to weaken our grid. I hope that the Biden administration will reconsider that decision as quickly as possible; our grid is too critical to leave it vulnerable to hostile efforts of China and other foreign adversaries.”

In broader statements, Rodgers pressed her support for emerging technologies, citing her sponsorship of the  “American Competitiveness of a More Productive Emerging Tech Economy (the American COMPETE) Act” last year, which encourage U.S. leadership in Internet of Things, artificial intelligence, blockchain and other advanced projects.

Also Read: House Passes American COMPETE Act

“We must ensure emerging technologies such as artificial intelligence are developed with western values to counter and isolate China,” Rodgers said. She heaped considerable praise on the FCC’s Pai for his “significant progress in bringing the next generation of wireless communications to Americans” and making “unprecedented amounts of spectrum available to the private sector for commercial deployment.”

Also Read: Sen. Amy Klobuchar Pushes ‘Competition Policy’ to Enhance Antitrust Crackdown 

Rep. John Katko (R-N.Y.) focused on cybersecurity and the digital divide, reflecting his role as ranking member of the House Homeland Security Committee and on the House Transportation and Infrastructure Committee. He insisted that America needs “to better understand the nature and extent of third-party cyber-risks.”

“We need to rethink our fragmented approach to government security by centralizing authority,” Katko said. Although he cited the Cybersecurity and Infrastructure Security Agency (CISA) at the Department of Homeland Security as a natural focal point, he argued that CISA shouldn’t take authority away from the other agencies, but rather be “a good clearing house…[and] advisor” for the entire dot.gov cyber-realm. 

“We need to whack the hell out of the bad guys when they commit these acts like SolarWinds,” he added, referring to the massive December hack that assaulted government and corporate networks. 

Rep. Kelly Armstrong (R-N.D.), who sits on the House Judiciary Committee’s Antitrust Subcommittee, focused on the need for “coordination between the Judiciary and Commerce committees” as Congress plunges into the intertwined relationships between monopoly, privacy and use of consumer proprietary information.

“We cannot avoid the fact that user data is the coin of the realm,” Armstrong said. He described as vital the need for use of data during upcoming tech antitrust investigations, characterizing use of personal data as a major factor in dominant firms’ “anti-competitive conduct.”

“We must ask whether privacy measures are being used as a sword against competitors,” he said. “We must ask the same question when a company cites privacy as justification for consolidating its ad tech stack by requiring all ad purchases on its platforms to be routed through its demand side tools. … We cannot consider these issues in a silo. Tech antitrust and data privacy are intrinsically linked; our responses must acknowledge this fact.”

Also Read: Sec. 230 gets Academic Once-Over at State of Net Conference

Citing COVID-19 Era Successes; Reducing Digital Divide

During a session on “Resiliency and Network Performance,” Matt Toomey, VP of broadband technology at NCTA: The Internet & Television Association, lauded cross-industry collaboration within the broadband sector during the past year; he characterized it as a way to “to keep America connected” by focusing on adaptive video technology.

“It's a testament to the adaptiveness of how … the video streaming guys work; it's just phenomenal,” Toomey said. “There's lots of evidence of collaboration across the board between operators and content providers.” He cited experiences in which engineers exchanged reports between their “war rooms … to make sure that content from content providers was able to get to ISP networks and … to make any adjustments in real time.”  

Also Read: FCC's Geoffrey Starks: Digital Disparities Must Not Stand

Maurita Coley, president and CEO, Multicultural Media, Telecom and Internet Council (MMTC) cited the broadband achievements of the past year as a model for what should be addressed in other pending policy issues, notably in bridging the digital divide.

“Maybe you could call it ‘trickle up,’” she said, describing the need for an “emergency broadband benefit.” Supporting the Biden $3.2 billion plan for very low-income family subsidies that would include broadband benefits, Cole cited endorsements from top executives. She said it is “absolutely essential that everyone have access to broadband, not just during the pandemic.” Coley included senior citizens and tribal communities as needing support for permanent access to broadband services.

Evan Marwell, founder/CEO of Education Super Highway, pointed out how policy commitments can change the access equation. He noted that in 2013 only 10% of students had good internet access in their classrooms; by last year, that factor had risen to 99.7%. He cited the value of the impetus from the Obama administration.

Addressing the digital divide, Marwell said, “Somebody needs to step up and that somebody probably needs to be President Biden.” He urged that the President “set a national goal of connecting all of our households and our students.” Citing the need for better broadband mapping, Marwell urged more work on collecting “data about who isn't connected.”

“It's really hard to solve a problem like this if you don't know where the problem is,” he said. “The broadband benefit is a great opportunity to make progress in… tackling the digital divide.” And he criticized the FCC for not reserving “a portion of the fund for the unconnected.” He supported Coley’s recommendation “to make this benefit permanent.”

 “The Biden administration needs a clear measurable goal that all of the different departments and agencies … [are]  working towards that is measurable, and they need to track progress against it,” Marwell said. He added the need for a unified “implementation strategy.”

At a SOTN session on internet geopolitics, several top former federal officials plowed more deeply into these access issues.

Bruce Mehlman, former Assistant Secretary of Commerce for Technology Policy at the  Department of Commerce (G.W. Bush administration), pointed out the differing viewpoints of Democrats and Republicans on domestic broadband rollouts.

“There will be a lot of discussion … about digital inclusion questions such as, algorithmic bias or just the diversity within the workforce of tech companies,” said Mehlman, now a principal at Mehlman Castagnetti Rosen & Thomas, a government relations firm. “Republicans have investments in rural access, and Democrats have investment in less-rural affordability.”  He called that an opportunity for dealing and because “there is an imperative to get it done.” Mehlman also cited “the opportunity for platforms to empower civil rights groups” but warned that the challenge of operating in “a post truth world where everybody starts with their own facts.”

“Smart infrastructure makes all the difference. It can make a country far more productive, but it also enables the surveillance state. So how do you get the balance right on things like crypto?” he asked rhetorically. Praising the U.S. tech sector, Mehlman also warned that, “We need to do a better job at retraining.”  

Daniel Sepulveda, a former deputy assistant secretary ambassador, U.S. Department of State (Obama administration) speculated on a proposal by former FCC Chair Tom Wheeler to create a digital platform agency.  

“At some point of an agency specialized on digital platforms depending on size and scope and reach is, it's certainly possible, he said. Sepulveda, now senior VP for policy and advocacy for MediaMath, a global advertising and marketing technology company, observed that such plans may be affected by similar concepts being bruited about in Europe. He said he is “not personally convinced it's necessary.” Sepulveda said he expects that existing agencies – such as the FCC and FTC, which “have infrastructure” in place, could be “bulked up … to deal with the challenges that are posed by new digital platforms.”

With an appropriate emphasis on broadband – especially 5G wireless technology – along with a timely focus on cybersecurity, streaming media and an expanded examination of content, the first-ever all-virtual CES 2021 is ready to roll next month. 

The Consumer Technology Association, producer of the electronic extravaganza, which is usually held in Las Vegas in early January, is still cobbling together details for the Jan. 11-14 online convention. It has not yet revealed details, for example, of its public policy program, which usually features top FCC, FTC, Transportation Department and Congressional officials and staff members.

However, in keeping with the current developments in cybersecurity – such as the alleged foreign hacking of U.S. government and corporate networks – CTA just announced a keynote presentation by Microsoft President Brad Smith, who has been a highly visible spokesman during recent weeks discussing the digital intrusion; Smith has also been Microsoft’s face for its push to convince the FCC to allocate broadcast white spaces for a “Rural Broadband Initiative.” 

Other cybersecurity speakers will include Damien Kieran, Twitter’s chief privacy officer, Keith Enright, Google’s chief privacy officer and Anne Toth, director-Alexa Trust at Amazon.

Verizon Chairman and CEO Hans Vestberg will deliver the CES 2021 kickoff keynote address, discussing 5G as the framework of the 21st century. Other sessions include “Broadband for All,” “Connected Cities” (examining smart cities, a favorite CTA objective) plus detailed sessions about 5G and mobile communications.

 Karen Chupka, CTA’s Executive VP, CES, calls “CES the hub for 5G” and characterizes 5G as “driving innovation.”

On the content front, Ann Sarnoff, chair/CEO of WarnerMedia Studios and Networks Group has just joined the CES line-up. On a separate program, iHeartMedia will run a conference session on how technology is enabling talent to continue to create and introduce music and immersive experiences during the pandemic. Ryan Seacrest (producer and on-air host) will run the session, which will include a “fireside chat” with singer/songwriter Dua Lipa and a special performance by Billie Eilish.

The “C Space” track of conference sessions will examine content development from both the advertiser/marketer viewpoint as well as “next-gen” consumers.

Also Read: CES 2021, a Work in Progress, Explores How Tech Is Reshaping Post-Pandemic World

Chupka along with CTA President/CEO Gary Shapiro and Jean Foster, senior VP of marketing and communications, explained the design of CES 2021, at an online news conference in mid-December. Microsoft has created the platform which will enable virtual booth visits, private meetings and a simulation of random corridor encounters. The “live” on-demand conference sessions and booth visits will be available from 7 a.m. to 9 p.m. ET daily. Recorded versions will remain available through Feb. 15.  Both time frames give global visitors more time to check out the array of CES “digital activations,” according to Foster.

Instead of bumping into friends in the convention center or hotel corridors and aisles, CTA and Microsoft said they have set up an attendee directory which will enable random encounters in hallways that are comparable to the live environment. In addition, the entire platform will be searchable by keywords.

The CES program will be produced as a combination of live and pre-recorded presentations, many of them to be produced during the coming week to make them as timely as possible before “show dates.” Using automated and real-time translation systems, the presentations will be available in 16 languages, including American Sign Language.

The CTA leadership team continually encouraged “early registration” (until Jan. 3).  The flat fee to attend all CES 2021 programs (including about 100 conference sessions plus access to exhibits and private meeting rooms) is $149, which will go up to $499.

No Sore Feet, But Scaled-Back Event

Reflecting the online environment, most CES sessions will be much shorter than at in-person events – often about 20 to 30 minutes long, even for panel discussions. 

CTA seems to be adjusting the expected turnout for the scaled-down virtual event.  Shortly after announcing initial plans, the association indicated that the online programs would attract about 150,000 attendees and 1,500 exhibitors (both numbers significantly smaller than the 180,000 and 4,500 comparables last January).

Recent announcements suggest about 100,000 virtual visitors and “more than 1,000” exhibitors.

The agenda calls for Monday Jan. 11 as a Media Day for reporters to receive new product briefings from about two dozen exhibitors. Virtual exhibits and conference sessions will be spread out over Tuesday through Thursday (Jan. 12-14) and most videos will remain available on-demand through Feb. 15.

The CES package will feature a live anchor desk with four tech journalists operating a “central command” to help attendees navigate the digital experience, hear the latest news and watch interviews.  The featured anchors are Justine Ezarik (iJustine), host and tech content creator; Rich DeMuro, tech reporter for KTLA-TV/Los Angeles; Naomi Kyle, actress, producer and host of Star Trek’s The Ready Room on CBS; and Brian Tong, tech host and content creator.

CTA said it made a “seven-figure investment” to develop the platform, which includes artificial/mixed reality components.   

“We wanted to invest in the value of the connections,” Chupka explained.  “You will see artificial intelligence enabling the platform, including streaming videos. We really wanted this to be an easy user experience, so we didn’t go into the technology that would be interesting to see” but may have been confusing.

Looking toward 2022, Shapiro predicted that “We’ll go back to Las Vegas,” but he also expects CES will continue as a hybrid digital event.

“The pandemic has demonstrated value of tech, especially broadband – not just for home office but for everything in your home that has to do with technology,” Shapiro said. During the video briefing session, he made several references to the need to develop public policies to support broadband, citing the nature of smart cities.

Shapiro acknowledged that this first effort “won’t be the best possible [but] we’ll learn from it. 

Exhibitors for CES 2021 include tech giants such as Canon, Hisense, Intel, Lenovo, LG Electronics, Panasonic, Philips, Sony, Samsung Electronics, TCL and Voxx, as well as non-traditional tech companies including Bridgestone, Caterpillar, Indy Autonomous Challenge, John Deere, L’Oréal and Procter & Gamble.

Disclosure:  I have been a paid consultant, managing CES programs for several years; I have no involvement in the CES 2021 agenda.

NCTA-the Internet & Television Association is celebrating the President's signature on the Internet of Things Cybersecurity Improvement Act.

The bill, introduced in March 2019, "requires that devices purchased by the U.S. government meet certain minimum security requirements." 

Related: IoT BIll Heads to Senate

“We applaud the President for signing into law the Internet of Things Cybersecurity Improvement Act," NCTA said in a statement. "With potential security threats to networks always looming, maintaining stringent cybersecurity standards is a must to protect many business and government operations. Since the government is such a large purchaser and user of IoT devices, this new law will have an impact on IoT purchases by businesses and beyond. Many thanks to Senators Gardner and Warner, and Representatives Kelly and Hurd, for introducing this important legislation and navigating it through Congress.”

Specifically, the law:

"Requires contractors and vendors providing information systems to the U.S. government to adopt coordinated vulnerability disclosure policies, so that if a vulnerability is uncovered, that can be effectively shared with a vendor for remediation." 

"Requires the National Institute of Standards and Technology (NIST) to issue recommendations addressing, at a minimum, secure development, identity management, patching, and configuration management for IoT devices. 

"Directs the Office of Management and Budget (OMB) to issue guidelines for each agency that are consistent with the NIST recommendations, and charge OMB with reviewing these policies at least every five years. 

"Requires any Internet-connected devices purchased by the federal government to comply with those recommendations. 

"Directs NIST to work with cybersecurity researchers, industry experts, and the Department of Homeland Security (DHS) to publish guidance on coordinated vulnerability disclosure to ensure that vulnerabilities related to agency devices are addressed."

The bill was introduced in the Senate by Sens. Mark Warner (D-Va.) and Cory Gardner (R-Colo.), co-chairs of the Senate Cybersecurity Caucus, as well as Sens. Maggie Hassan (D-N.H.) and Steve Daines (R-Mont.). Reps. Robin Kelly (D-Ill.) and Will Hurd (R-Texas) took the lead on the bill in the House.

The Senate has approved a bipartisan bill, the Internet of Things (IoT) Cybersecurity Improvement Act, which requires that any IoT devices purchased with government money meet minimum security standards.

The latest incarnation of the bill was introduced in March 2019 by Sen. Cory Gardner (R-Colo.), co-chair of the Senate Cybersecurity Caucus with Mark Warner (D-Va.), and in the House by Reps. Robin Kelly (D-Ill.) and Will Hurd (R-Texas).

It passed the House in September and heads to the President's desk for his signature.

The bill:

1. "Requires the National Institute of Standards and Technology (NIST) to issue recommendations addressing, at a minimum, secure development, identity management, patching, and configuration management for IoT devices.

2. "Directs the Office of Management and Budget (OMB) to issue guidelines for each agency that are consistent with the NIST recommendations, and charge OMB with reviewing these policies at least every five years.

3. "Requires any Internet-connected devices purchased by the federal government to comply with those recommendations.

4. "Directs NIST to work with cybersecurity researchers, industry experts, and the Department of Homeland Security (DHS) to publish guidance on coordinated vulnerability disclosure to ensure that vulnerabilities related to agency devices are addressed.

5. "Requires contractors and vendors providing information systems to the U.S. government to adopt coordinated vulnerability disclosure policies, so that if a vulnerability is uncovered, that can be effectively shared with a vendor for remediation."

“While more and more products and even household appliances today have software functionality and internet connectivity, too few incorporate even basic safeguards and protections, posing a real risk to individual and national security,” said Warner. “I’m proud that Congress was able to come together today to pass this legislation, which will harness the purchasing power of the federal government and incentivize companies to finally secure the devices they create and sell. I urge the President to sign this bill into law without delay.”

“I applaud the Senate for passing our bipartisan and bicameral legislation to ensure the federal government leads by example and purchases devices that meet basic requirements to prevent hackers from accessing government systems,” said Gardner. “Most experts expect tens of billions of devices operating on our networks within the next several years as the Internet of Things (IoT) landscape continues to expand. We need to make sure these devices are secure from malicious cyber-attacks as they continue to transform our society and add countless new entry points into our networks, particularly when they are integrated into the federal government’s networks.”

Sen. Mark Warner (D-Va.) is praising House passage of his Internet of Things (IoT) Cybersecurity Improvement Act, which requires minimum security requirements for IoT devices bought by the U.S. government, saying that there are not enough market incentives to secure devices.

Related: Sen. Warner Urges Internet Device Makers to Protect Products

The latest incarnation of the bill was introduced in March 2019 by Warner joined by Sen. Cory Gardner (R-Colo.), co-chair of the Senate Cybersecurity Caucus with Warner, and in the House by Reps. Robin Kelly (D-Ill.) and Will Hurd (R-Texas).

The bill has yet to pass the Senate, but did pass the Senate Homeland Security and Governmental Affairs Committee in June 2019.

It would:

1. "Require the National Institute of Standards and Technology (NIST) to issue recommendations addressing, at a minimum, secure development, identity management, patching, and configuration management for IoT devices.

2. "Direct the Office of Management and Budget (OMB) to issue guidelines for each agency that are consistent with the NIST recommendations, and charge OMB with reviewing these policies at least every five years.

3. "Require any Internet-connected devices purchased by the federal government to comply with those recommendations.

4. "Direct NIST to work with cybersecurity researchers, industry experts, and the Department of Homeland Security (DHS) to publish guidance on coordinated vulnerability disclosure to ensure that vulnerabilities related to agency devices are addressed.

5. "Require contractors and vendors providing information systems to the U.S. government to adopt coordinated vulnerability disclosure policies, so that if a vulnerability is uncovered, that can be effectively shared with a vendor for remediation."

“The House passage of this legislation is a major accomplishment in combating the threats that insecure IoT devices pose to our individual and national security," said Sen. Warner. "Frankly, manufacturers today just don’t have the appropriate market incentives to properly secure the devices they make and sell – that’s why this legislation is so important."

The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) has released its proposal for securing 5G networks and industry will have a big part.

"CISA relies on its partnership with the private sector to understand and manage risks posed to 5G technology," the proposal said. "With the promise of connectivity between billions of Internet of Things (IoT) devices, it is critical that CISA and industry collaborate to identify vulnerabilities and ensure that cybersecurity is prioritized within the design and development of 5G technology."

The proposal is grouped into five strategic objectives (see graphic).

The bottom line of the proposal is that it will take collaboration. "[T]he nature of the risk environment precludes any single entity from managing risk entirely on its own," it said, while "the stakes for safeguarding the network against these vulnerabilities could not be higher "given the potential for various applications and reliance of the network for future infrastructure."

“5G technology represents a pivotal shift in the United States' and world’s digital infrastructure, and with that shift come critical security and policymaking considerations,” said John Miller, senior counsel and senior VP for policy at tech association ITI. “The tech industry appreciates CISA’s leadership in recognizing where it can play a unique role in 5G implementation while simultaneously acknowledging the need for government-wide coordination to ensure a trusted and resilient 5G ecosystem.”

The Trump Administration and Congress have already taken some steps to secure 5G networks and the supply chain, most notably by excluding tech from Chinese telecom suppliers ZTE and Huawei from government-subsidized broadband buildouts and government contracts.

Tech groups want to make sure Congress prioritizes money for government-related cybersecurity in any future COVID-19 aid package.

That came in a letter to congressional leadership from the Information Technology Industry Council (ITI), Alliance for Digital Innovation (ADI), BSA | The Software Alliance, the Computing Technology Industry Association (CompTIA), the Center for Procurement Advocacy, Internet Association (IA), and the Cybersecurity Coalition.

Related: All the Latest Industry News on Covid-19

They said CTO have been doing "admirably" with what they have, but also say more cybersecurity money is needed at all levels of government.

They argue that "the prevalence of outdated legacy IT continues to hamper the effectiveness of [pandemic] recovery efforts. Citizens are being denied positive digital government experiences as they seek access to much needed programs, such as securing business loan programs, receiving economic security payments, or applying for unemployment benefits.”

Back in April, the groups said that to combat the COVID-19 pandemic the government needs to invest in IT upgrades across the board and at a level commensurate with the challenge of socially distanced living.

This week's letter outlines some cybersecurity upgrade main points:

1. "Support the Technology Modernization Fund at a level that would allow for meaningful investment in cross-agency IT modernization initiatives. To expedite the resourcefulness of such funds, existing requirements directing agencies to payback TMF funds should be relaxed when such funds are tied to pandemic or disaster recovery efforts;"

2. "Provide direct funding to federal agencies to modernize and secure IT systems beneficial to COVID-19 and future emergency responses. Such funding should be made available for expenditure over multiple years, but does not necessarily need to flow through agency working capital funds;

3. "Establish and fund a mechanism that provides federal financial support to state and local government agencies in need of IT modernization and upgrades to foster better recovery efforts. Such investments should focus on interoperability between programs that rely on federal, state, and local IT systems, where applicable. Language providing additional resources to the Coronavirus Relief Fund for IT improvements is an avenue Congress should explore;

4. "Provide necessary legislative authority for agencies to establish IT working capital funds with strong governance and reporting requirements to enable both Congress and the Executive Branch to more effectively budget for and finance significant IT modernization initiatives;

5. "Provide increased funding to the CDM program so that DHS can promptly and completely fulfill all requests for service and ensure robust threat detection and mitigation against increased adversarial attacks at all Federal agencies;

6. "Support funding to improve the Federal Risk Authorization and Management Program (FedRAMP) cloud technology security program by automating the security authorization process to increase government access to secure commercial cloud service and technology providers; and

7. "Establish a dedicated cybersecurity grant program for SLTT governments to enable greater resiliency and enhanced security of critical technology systems and networks; and

8. "Ensure that IT modernization efforts include focused attention and investment in commercial technologies that strengthen cybersecurity, empower effective workforce training, and ensure robust digital transformation."  

President Donald Trump has extended the executive order declaring the country to be in a state of national emergency due to cyber threats. 

The order was first issued April 1, 2015, by President Barack Obama, to deal with the "unusual and extraordinary threat to the national security, foreign policy, and economy of the United States constituted by the increasing prevalence and severity of malicious cyber‑enabled activities originating from, or directed by persons located, in whole or in substantial part, outside the United States." It was expanded in December 2016 and President Trump added to it in 2017.

Related: Trump Extends Cybersecurity National Emergency

Those turned out to include foreign election meddling that continues to this day, according to government officials and news reports, though that meddling has been downplayed by the current President. 

The White House said Monday (March 30) that "cyber-enabled activities" continue to pose an extraordinary threat to national security, foreign policy and the economy, which currently needs no more downward pressure. 

The renewal of the order is for a year. 

The vice chairman of the Senate Intelligence Committee is citing the recent disclosure of malware exploring a Department of Defense server to push for passage of his Internet of Things Cybersecurity Improvement Act. 

Related: Senate Intelligence Report Recommends Overarching Cyber Doctrine

Sen. Mark Warner (D-Va.) pointed out in a statement that it was a vulnerability exposure regime at DOD that allowed a researcher to report the malware and said his bill would help advance similar programs that could be coordinated with the DOD procedures in place. Warner's bill was reported out of the Senate Homeland Security and Governmental Affairs Committee last June, but has yet to be voted in the Senate. 

Znet reported that the researcher had first discovered that a DOD server running on Amazon Web Services' cloud platform was publicly accessible without credentials, then that it had been hacked and was being used by a botnet to mine cryptocurrency. 

The bill was introduced last March and reported favorably out of the Senate Homeland Security and Governmental Affairs Committee last June. 

It would make sure government IoT devices are as secure as they can be, including by requiring transparency and disclosure from contractors. The bill now heads to the full Senate for a vote. It would also require government-purchased devices to meet a minimum level of security. 

“This incident demonstrates the inherent value of vulnerability disclosure programs for information technology products operated by federal agencies,” Warner wrote in a letter to DOD CIO Dana Deasy. “These programs are a crucial force multiplier for federal cybersecurity efforts. Clear guidelines and a process for security researchers to find and share vulnerabilities enabled this malware discovery, and ultimately prompt remedial action by DOD," he said. "Continuing to encourage the responsible discovery and disclosure of bugs or vulnerabilities on federal information technology systems with both internal and outside security researchers can only strengthen the cybersecurity posture of federal and DOD systems.” 

The Harvesting American Cybersecurity Knowledge through Education (HACKED) Act passed the Senate Commerce Committee Wednesday (Nov. 13) with an amendment that would create a cybersecurity exchange program between government and industry.

The bill, which is co-sponsored by the bipartisan leadership of the committee and Communications Subcommittee, is meant to boost cybersecurity education and workforce.

The bill includes an amendment from Sen. Amy Klobuchar (D-Minn.) that would establish "a public-private cyber security professionals exchange program" that would recruit experts in the private sector and academia to join the federal government for up to a two-year hitch. On the other side, government computer experts would do "tours of duty in the private sector," in both cases to learn from each other and apply that knowledge to "help further secure government computer systems and critical infrastructure."

“With more than 300,000 cybersecurity job vacancies in the United States, ensuring that workers now and in the future have access to cyber education is a priority,” said ITI President Jason Oxman in a statement. “The bipartisan HACKED Act takes important steps to help fill this critical skills gap and bolster the U.S. cybersecurity workforce through long-term planning and investment."

Sen. Josh Hawley (R-Mo.) read TikTok and Apple the riot act in absentia Tuesday (Nov. 5) after the Chinese-backed social media platform and the social media giant declined to send representatives to his hearing on Big Tech's data handling, or mishandling, and risks from their connections to China. 

Sen. Hawley began the hearing asking about all the data TikTok is collecting from American users. Hawley warned that the short-form mobile video platform and its massive data collection could be leveraged by the Chinese government against the U.S. 

He then lit into Apple for providing cloud services to China.

Hawley said he wanted to get it on the record that TikTok is collecting "a lot of data," including content, location, contacts, behavioral data on use of the platform, and information from messages and users' phone books. 

He said that was comparable to the "massive data harvesting" machines Google and Facebook. 

And while TikTok said that data is stored in the U.S. and Singapore, Hawley pointed out that TikTok's parent is ByteDance, which is based in China and subject to a 2017 Chinese national intelligence law that requires Chinese companies to cooperate with state intelligence work. 

He said that means TikTok's doors could be opened at any time to the Chinese Communist Party and Beijing could tell parent ByteDance to scoop up data on Americans and give it to Beijing. 

Hearing witness Klon Kitchen, senior research fellow at the Heritage Foundation, said that was "without a doubt true." 

Related: Sen. Whitehouse Hammers Social Media

Hawley ticked off some of the ways TikTok or another Chinese platform could abuse all that data, particularly using data to help artificial intelligence train autonomous weapons systems to identify targets--China is reportedly investing heavily in AI tech. 

Asked how the U.S. could ensure that TikTok or other Chinese tech companies weren't Trojan Horses gathering data on Americans and sending it back to the Chinese government. "I'm not sure we can," said Kitchen. He said that anyone who thinks a Chinese company, even if a portion of the company is in the U.S., can say no to the Chinese government, "that is a fundamental misunderstanding of the way the government in Beijing works." 

Apple, which was another hearing no-show, took it on the chin from both Hawley and Kitchen. 

Hawley said he was concerned about American companies--specifically Apple, which provides cloud services to China--storing both data and the tools to decrypt it in China.  

Kitchen said that while Apple was providing decryption keys for Chinese data stored there, doing so would give China a better understanding of the inner workings of Apple's iCloud accounts and could allow them to collect data "outside of that border." 

Hawley asked Kitchen whether he thought Apple and others were compromising U.S. data security by storing both data and encryption keys. He said, yes, any company complying with China cybersecurity laws was risking not only data security but national security.  

Related: Sen. Hawley Says Big Tech Is Exploiting Digital Tread Mill

Kitchen followed that with his most sobering observation/allegation, one that particularly struck Hawley, who said it summed up the problem: "China imprisons and tortures and kills religious minorities and political dissidents, and it is using compliant companies to do this at scale." 

Neither Tik Tok nor Facebook had responded to a request for comment at press time on the tenor of the hearing or the company's decision not to participate. 

But Vanessa Pappas, GM of TikTok U.S. has posted on the issue, saying: "[W]e store all U.S user data in the United States, with backup redundancy in Singapore. TikTok’s data centers are located entirely outside of China. Further, we have a dedicated technical team focused on adhering to robust cybersecurity policies, and data privacy and security practices."

Sen. Josh Hawley (R-Mo.) read TikTok and Apple the riot act in absentia Tuesday (Nov. 5) after the Chinese-backed social media platform and the social media giant declined to send representatives to his hearing on Big Tech's data handling, or mishandling, and risks from their connections to China. 

Sen. Hawley began the hearing asking about all the data TikTok is collecting from American users. Hawley warned that the short-form mobile video platform and its massive data collection could be leveraged by the Chinese government against the U.S. 

He then lit into Apple for providing cloud services to China.

Hawley said he wanted to get it on the record that TikTok is collecting "a lot of data," including content, location, contacts, behavioral data on use of the platform, and information from messages and users' phone books. 

He said that was comparable to the "massive data harvesting" machines Google and Facebook. 

And while TikTok said that data is stored in the U.S. and Singapore, Hawley pointed out that TikTok's parent is ByteDance, which is based in China and subject to a 2017 Chinese national intelligence law that requires Chinese companies to cooperate with state intelligence work. 

He said that means TikTok's doors could be opened at any time to the Chinese Communist Party and Beijing could tell parent ByteDance to scoop up data on Americans and give it to Beijing. 

Hearing witness Klon Kitchen, senior research fellow at the Heritage Foundation, said that was "without a doubt true." 

Related: Sen. Whitehouse Hammers Social Media

Hawley ticked off some of the ways TikTok or another Chinese platform could abuse all that data, particularly using data to help artificial intelligence train autonomous weapons systems to identify targets--China is reportedly investing heavily in AI tech. 

Asked how the U.S. could ensure that TikTok or other Chinese tech companies weren't Trojan Horses gathering data on Americans and sending it back to the Chinese government. "I'm not sure we can," said Kitchen. He said that anyone who thinks a Chinese company, even if a portion of the company is in the U.S., can say no to the Chinese government, "that is a fundamental misunderstanding of the way the government in Beijing works." 

Apple, which was another hearing no-show, took it on the chin from both Hawley and Kitchen. 

Hawley said he was concerned about American companies--specifically Apple, which provides cloud services to China--storing both data and the tools to decrypt it in China.  

Kitchen said that while Apple was providing decryption keys for Chinese data stored there, doing so would give China a better understanding of the inner workings of Apple's iCloud accounts and could allow them to collect data "outside of that border." 

Hawley asked Kitchen whether he thought Apple and others were compromising U.S. data security by storing both data and encryption keys. He said, yes, any company complying with China cybersecurity laws was risking not only data security but national security.  

Related: Sen. Hawley Says Big Tech Is Exploiting Digital Tread Mill

Kitchen followed that with his most sobering observation/allegation, one that particularly struck Hawley, who said it summed up the problem: "China imprisons and tortures and kills religious minorities and political dissidents, and it is using compliant companies to do this at scale." 

Neither Tik Tok nor Facebook had responded to a request for comment at press time on the tenor of the hearing or the company's decision not to participate. 

But Vanessa Pappas, GM of TikTok U.S. has posted on the issue, saying: "[W]e store all U.S user data in the United States, with backup redundancy in Singapore. TikTok’s data centers are located entirely outside of China. Further, we have a dedicated technical team focused on adhering to robust cybersecurity policies, and data privacy and security practices." 

WASHINGTON — Advertisers are pushing for a national privacy bill, but with little chance of comprehensive legislation in the near term, they are pushing back on efforts by states to push for privacy legislation. State-level laws, they argue, are a Balkanized approach that could boost the power of the Big Tech players that both states and the federal government are looking to rein in.

Dan Jaffe, group executive vice president of government relations for the Association of National Advertisers, has been a point man in this pushback, notably against the California Consumer Privacy Act (CCPA). The CCPA becomes law on Jan. 1 and compliance will cost businesses billions — that is, when they can figure out what to comply with, which Jaffe said remains a moving target.

Jaffe spoke with Multichannel News about the implications of privacy by design, if that design is a patchwork of state approaches. Here’s an edited transcript of that conversation.

MCN: What are ANA’s main problems with the California Consumer Privacy Act?
Dan Jaffe: At the most fundamental level, it is that it is a single state law. We don’t think that privacy rules work on a state-by-state basis. The business has already gone through a substantial amount of fragmentation and that is only going to increase in 2020 unless there is a federal law passed that pre-empts state laws.

MCN: You say “laws,” so clearly the problem isn’t just California.
DJ: Let me give you the quick list of what I know, and I may not be covering everything. There is CCPA, as well as a [California] data-broker registration bill that is not the same as a Vermont databroker bill. Nevada’s new law goes into effect today [Sept. 30]. Maine has an ISP law and New Jersey has a major piece of privacy legislation with private-rights-of-action provisions in it. The attorney general of Ohio is talking about holding privacy hearings. … You get the general gist.

Overlaying all of this is the [European Union’s] General Data Protection Rules [which apply to any business over a certain size doing business in the EU, just as the CCPA applies to any business over a certain size doing business in the state].

I know a number of companies who have spent multi, multimillions of dollars to become GDPR compliant and are now spending millions on becoming CCPA compliant because of the differences in definitions.

MCN: Speaking of big money, the California attorney general’s office has put out a regulatory impact statement. What trouble signs are in that report?
DJ: I have said since the outset that this was going to be a major tax on California consumers because I could see there were going to be major regulatory compliance requirements. Now the attorney general’s report is talking about as much as $55 billion dollars in costs from the CCPA, and a further $16.9 billion in costs for compliance with the attorney general’s [rules].

I don’t want to be hyperventilating here, but the report says this is going to fall particularly hard on small business. Because of the way the act is designed, a relatively large number of relatively small businesses will be covered.

Big companies are going to be able to do well in this situation because they have compliance lawyers and IT experts and advertising experts. Companies midsize and below are going to have a very much harder time — and that is if everything goes smoothly.

Now, people may say that the privacy protections people have gotten outweigh all of these costs. I don’t necessarily think that that’s true.

MCN: Obviously, you don’t want this Balkanized model, but if it develops, is the free web content model sustainable?
DJ: For some, yes. The Tyrannosaurus Rexes survive, at least in the short run. But I don’t know how Google and Amazon and all these other companies that started out in garages and dorm rooms would have done if they had faced all these restrictions.

MCN: But an already divided Congress fighting over impeachment is unlikely to come together on privacy legislation anytime soon.
DJ: To pass any major legislation when they don’t like each other and they don’t work well together is very hard. I don’t know what’s possible. I just know what’s needed. We are going to make every effort to move [federal legislation] as far and as fast as we can. There is nothing more important that we are working on than privacy and data security issues.

A very large proportion of companies will say the same thing. And the situation is only going to get more difficult because there are 22 more states that seriously considered privacy legislation in 2019.

Unlike data security, where disparate laws still deal with a limited set of issues and, if you are complying with those requirements, you are likely complying with most data-security laws, this isn’t the case with privacy. It has a large range of issues over billions and billions of transactions and an enormous number of parties from first parties to third parties to data suppliers to data trackers to publishers.

MCN: So the answer is national legislation.
DJ: Yes, and for the first time the industry is not split on that. I don’t hear anybody say, “Oh, we don’t need national legislation.”

One more thing, and this I think is a grenade that has been thrown into the process. Before the law takes effect and even before the attorney general has finished his rulemaking, Alastair Mactaggart [the California resident who pushed for the initial ballot initiative] is putting forward a new ballot initiative that will completely alter and add to the existing [CCPA]. We are in a never-ending compliance race. To use a legal term: It’s a mess, and it’s likely to get messier.

WASHINGTON — Internet service providers and child advocates have gone to Congress to try and block what they say is an effort by Google to centralize the domain naming system (DNS) to the potential detriment of cybersecurity and more.

NCTA-The Internet & Television Association, CTIA and USTelecom said the potential fallout could include Google acquiring “greater control over user data across networks and devices around the world. This could inhibit competitors and possibly foreclose competition in advertising and other industries.”

NCTA outlined to the heads of the relevant committees just what it thought was at stake if Google took more control of the domain-naming system, which has been used to:

(1) Provide parental controls and Internet of Things management;
(2) Connect users to CDS so they could get content in the “fastest, cheapest and most reliable” way; and
(3) Assist law enforcement in combating online piracy.

Google has countered that it isn’t trying to centralize control and that the effort is only a test, with limited applicability.

With Big Tech under pressure to protect privacy, Google said it is just trying to bring the privacy benefits of the secure HHTPS regime (DNS-over-HTTPS, or DoH) to the domain naming system (DNS), which it said would help prevent others from seeing which sites a web user is visiting and help prevent spoofing.

Sounds good so far. But ISPs and others say there are unintended consequences, which is what prompted them to seek Hill help. The ISPs and child advocates, in their letters to top legislators, also said they were concerned that the DNS change would make it harder to track and stop child predators.

Not true, Google said. “There is no change to how DNS providers work with law enforcement in accordance with court orders,” it said in a statement.” Google said the test is among only a handful of DNS providers that already support DoH, and will not be instituted by default in those cases, as Mozilla has signaled it will.

As to the centralizing charge, Google said characterizing the company as a “centralized encrypted DNS provider” is not accurate.

Google was expected to reach out to the ISPs to try and clear up what they suggested was a misunderstanding. An NCTA spokesperson said they knew of no such outreach.

A report released by the bipartisan leadership of the Senate Intelligence Committee Thursday (July 25), one of the more bipartisan committees in Congress, says the government should come up with an "overarching cyber doctrine." 

That was one of the recommendations in a voluminous report on Russian election meddling focused on infrastructure.

The report concluded that the U.S. should make it clear to its adversaries, in a sort of "this could mean war" declaration, that it will treat an attack on election infrastructure as a hostile act, whose response may not be limited to cyber activity. 

Further, it said, "[i]deally, this principle of deterrence should be included in an overarching cyber doctrine for the U.S. Government. That doctrine should clearly delineate cyberespionage, cybercrime, and cyber attacks.  

"Further, a classified portion of the doctrine should establish what the U.S. Government believes to be its escalation ladder in the cyber realm—what tools does it have, what tools should it pursue, and what should the limits of cyber war be. "[P]olicymakers should consider what steps the U.S. will need to take to outstrip the capabilities of Russia, China, Iran, North Korea, and other emerging hostile actors in the cyber domain," it said.  

It also suggests the world community needs to get together to talk about cyber norms, "[j]ust as the international community has established norms and treaties about the use of technologies and weapons systems." 

It said the U.S. should lead the conversation about both the norms and the limits of cyber activities (say, declaring tampering with nuclear reactors off limits, as the world did with chemical warfare after the First World War).  

The report was released by Senate Select Committee on Intelligence Chairman Richard Burr (R-N.C.) and Vice Chairman Mark Warner (D-Va.). 

Devices consumers use to pirate digital copies and live streams of TV shows and movies appear also to be allowing for the theft of their owners' data in that Faustian bargain.

That is according to a nine-month probe by the Digital Citizens Alliance, which said that jailbroken Fire TV sticks and Kodi Boxes are being used by hackers to steal user names and passwords and breach networks.

The group has been hammering on the pirate-hacking connection for some time, producing a slick video last year to try and educate the public.

A study by bandwidth tracker Sandvine last year suggested that as much as 6% of all homes in North America had a Kodi open source media player in some form of content piracy mode.

Related: Fully Loaded Kodi Boxes Becoming Bigger Piracy Threat

The alliance has published its findings in a new report, Fishing in the Piracy Stream: Howthe Dark Web of Entertainment is Exposing Consumers to Harm. One harm is that users of piracy devices and apps are six times more likely to report issues with Malware, the alliance said.

“What the investigation shows is that as piracy shifts from websites and downloads to devices and apps, hackers are adapting and finding new ways to exploit consumers,” said Tom Galvin, executive director of Digital Citizens. “Consumers think these devices are like an Apple TV or Roku device, but they have a distinct difference: they have little to no incentive to protect their users. In other words, they are perfect for hackers.”

Related: Digital Citizens Alliance Warns of Pirate Facilitators

The group says its investigation, conducted in conjunction with cybersecurity firm Dark Wolfe Consulting, also uncovered a scheme to monetize stolen Netflix accounts.

Among the findings of the investigation were:

• Researchers found malware pre-loaded on apps used to illegally watch movies, sports, and other content

• Malware in the illicit ad-supported streaming app 'Mobdro' "forwarded the researcher’s WiFi network name and password to a server that appeared to be in Indonesia."

• That Malware "uploaded, without permission, 1.5 terabytes of data from the researcher’s device."

• Users of the illicit devices are abetting hackers by enabling them to bypass network security when the devices are connected directly to a home network.

• A scheme enabled "criminals" to pose as streaming sites, like Netflix, to gain illegal access to a legitimate subscription.

Among the alliance's proposed action items in the face of that hacking threat is for 1) consumer protection agencies--like the Federal Trade Commission, which has vowed to crack down on privacy violations--to warn consumers about the risks of illicit devices; 2) law enforcement to investigate and prosecute; and 3) digital marketplaces--eBay, Craigslist, Facebook--to ban the devices.

The alliance claims among its supporters, "health, pharmaceutical, and creative industries," the last which are obviously most affected by the aforementioned content piracy.

For broadcasters and programmers, there is nothing more important than the quality, reliability and unique nature of their content. A cyberattack can disrupt streaming services, slow video performance and enable hackers to steal unique content. The availability of connected devices on a broadband network is changing the way people consume content – and posing new security challenges.

These current trends – as well as the trends toward cloud-based streaming and linear programming – require that media companies rethink their approach to cybersecurity. While there are no simple solutions, the following five steps can help media organizations identify potential risks and significantly improve their security posture.

1. Harden Your Network at Every End-Point

The same new opportunities that enable programmers to contribute content, and enable customers to obtain content, have opened new inroads for malicious actors to steal or disrupt content. Every end-point across the distribution cycle needs to be assessed, tested and secured. Companies need to consider how their content data stores are protected, whether their transit is secure, and if everything is protected by encryption.

For satellite operators, it is critical to use multi-platform, layered controls to establish proactive security that limits opportunities for content and other data to be compromised on the ground or in orbit.

2. Use Layered Security

Multiple layers of security make it harder to breach your system and give your team valuable time to detect and respond before any data is compromised.

In the satellite industry, the most progressive operators utilize a pervasive security framework that includes layered controls, a mature compliance program, extensive audit and assessment initiatives, and a coordinated incident-response process.

3. Insist Your Partners Follow Best Practices

Even if you secure all the end-points you manage and employ layered-security measures, your content remains at risk if your partners do not follow best practices and are not transparent in their security posture. Media companies need to ensure that each ecosystem partner has the right security requirements in place and has regular communication to keep up with the threat environment and maintain security in orbit and on the ground.

The most progressive satellite operators maintain secure flight operations for all wide-beam and spot-beam satellites via a segmented control network that ensures key assets are being managed in a proactive way. Those operators also have multiple levels of cybersecurity in place for their partners, segmented by need of network access.

It is critical for satellite operators to proactively work with media customers to ensure their connected ecosystem is protected against active threats at all stages of uplink, downlink and terrestrial transport.

4. Practice Rapid Incident Response

Rapid incident response is what distinguishes an advanced cybersecurity program from others – and prevents an incident from becoming a significant breach. Breaches will occur, but the ability to rapidly detect, thwart and recover is what can make all the difference in the world.

Advanced digital payloads, such as those on Intelsat EpicNG satellites, can rapidly identify, communicate, move and mitigate interference issues – thus limiting the scope and severity of the breach.

5. Conduct Independent Security Audits

Cybersecurity is too complex and disruptive to rely solely on internal security reviews. Many companies have engaged outside cybersecurity firms and sought accreditations to ensure their current program and security posture is current and effective. If an outside firm identifies security issues, they can provide recommendations to further harden internal controls.

When evaluating satellite operators, media organizations should select only those that have been audited by a major, independent auditing firm. Also, insist that your satellite operator has completed a Service Organization Control 3 (SOC 3) review of security controls.

Conclusion

Cybersecurity will become a greater challenge as more content is distributed over multiple platforms. As media organizations become increasingly connected, the demand for cybersecurity solutions will increase significantly.

There are no simple solutions to ensure broadcast security. However, the five steps outlined above can substantially improve the security of your media content.

About the Author: Vinit Duggal is Vice President of Network Engineering and CISO at Intelsat, the world’s largest satellite operator.

CTIA, the wireless association, has launched a new cybersecurity certification program for Internet of Things (IoT) devices developed in collaboration with nationwide carriers including AT&T, Verizon and T-Mobile.

Devices can be submitted for testing starting in October.

Related: IoT Poses New Security Threats for Cable

CTIA says it will provide a more secure network for smart cities, connected cars, telehealth and other applications connected by wireless nets.

It could also help head off government regulations, particularly since it is based in recommendations from the Commerce Department's National Telecommunications & Information Administration and the National Institute of Standards & Technology.

“America’s wireless industry has long been a leader in cybersecurity best practices and establishing an industry-led cybersecurity certification program for IoT devices is a major step in building a trusted, secure wireless ecosystem for the Internet of Things,” said Tom Sawanobori, CTIA SVP and CTO, in a statement.

As cybercrimes and incidents of institutional hacking increase, cybersecurity is a critical concern for big TV distributors that give consumers access to the internet.

It’s also a strange topic for cable operators, though, because it’s rarely discussed in public, beyond the chorus of concern from consumer data watchdogs.

The Federal Communications Commission, whose leaders have made lofty speeches about the importance of cybersecurity, offers a perfunctory summary of its cybersecurity objectives, with few details about its cable or telco initiatives, in describing the FCC Cybersecurity and Communications Reliability (CCR) Division.

Need to Know:Cybersecurity

NCTA–The Internet & Television Association and the American Cable Association emphasize that “the entire cable industry takes cybersecurity very seriously” and back security and risk management practices. But details about those efforts — or the failures in the system — are scant.

Still, the scale of cyber-threats to the cable industry is significant and growing. In Akamai’s Summer 2018 State of the Internet/Security: Web Attack report, the firm measured a 16% increase in the number of distributed denial of service (DDoS) attacks recorded since last year globally, with new and more devious attack methods noted.

There are also constant reminders of new threats. This past May, researchers found that U.S. customers’ WiFi connections could be harvested from a cable operator's bill or email. Comcast said it quickly disabled the vulnerability in its activation portal, established an additional layer of authentication and that no personal user info was ever accessed.

Steve Goeringer, principal security architect at CableLabs, said cable has been “at the forefront of cybersecurity of broadband” thanks to the DOCSIS cable-modem specification, which has employed strong encryption and authentication since its version 1.1. Subsequent updates have created further barriers to DoS and DDoS, he added.

“Delivering services the way they were intended, including protecting customer privacy, is always critical,” Goeringer said. He cited pirated over-the-top content, which aside from being illegal, also exposes consumers to malicious software and theft of personal information, and the growing presence of Internet of Things devices, which are often insufficiently protected and can bring malicious software into the system.

Kyrio, a CableLabs subsidiary that provides technology services, has been focusing on Internet of Things security. “Companies that can provide strong security at scale will be able to use that as a key differentiator for their products, protect their brand and future-proof their products,” Ron Ih, the company’s director of business development, said in a June 4 blog post. Putting an emphasis on cable’s growing involvement with wireless services, he observed that, “expanded wired and wireless connectivity accelerates the need for a more scalable security solution for these networked devices” in the IoT value chain.

CableLabs vice president of technology policy Rob Alderfer recently acknowledged the need for government/industry cooperation, especially in the fast-emerging IoT category.

“With the constant barrage of new cyber incidents, often driven by IoT devices vulnerable to exploitation, governments at all levels are taking notice and grappling with the rapidly evolving threat,” according to a CableLabs summary of his remarks at a IoT workshop. “Cybersecurity is no longer the domain of the IT department, but rather a key area of governance for all enterprises.” 

Need to Know:Cybersecurity

Need to Know More?

Have a burning question about cybersecurity — or maybe request for a different topic you’d like to see us tackle? Email us at needtoknow@nbmedia.com and we’ll put our top minds on it!

More from Future on cybersecurity:

• Cybersecurity and Television [TV Technology]
• Cybersecurity and Retail [TWICE]
• Cybersecurity and Radio [Radio World]
• Cybersecurity and ProAV [AV Network]
• Cybersecurity and Residential Integration [Residential Systems]
• Cybersecurity and Pro Audio [Pro Sound News]
• Cybersecurity and Education [Tech & Learning]

Comcast said it moved quickly to disable a vulnerability in its activation portal for broadband gateways that could enable someone to obtain a customer’s WiFi network name and password using a customer's account number and address, rather than going through an additional layer of authentication, such as also having to provide a cell phone number.

As ZDNet first reported, two security researchers discovered the vulnerability, noting that a customer’s WiFi credentials could be uncovered if someone, for example, obtained a discarded bill or email from the cable operator. The researchers said the method could also be used to change WiFi network names and passwords and lock out the customer temporarily.

Using that method, a person could obtain machine data, but not customer data.

Comcast said it removed the option that caused the vulnerability soon after it was alerted to it, and has also launched an investigation.

“There’s nothing more important than our customers’ security,” a Comcast spokesperson said in a statement. “Within hours of learning of this issue, we shut it down. At no time did this site enable anyone to access customers’ personal usernames and passwords and we have no reason to believe that any account information was accessed. We are conducting a thorough investigation and will take all necessary steps to ensure that this doesn’t happen again.”

Cyber-attacks on "critical infrastructure" and theft or espionage involving commercial intellectual property remain the top concerns of the global cybersecurity community, Robert L. Strayer, Deputy Assistant Secretary for Cyber and International Communications and Information Policy at the U.S. Department of State said Thursday (April 19).

In remarks at the Media Institute's monthly luncheon in Washington, Strayer emphasized, "No business is unaffected by cybertheft" and warned that "we will continue to see threats to the digital ecosystem."   

Strayer declined, when asked by MCN, to specify media or telecom operators, including cable TV, as part of the "critical infrastructure." But he acknowledged that the U.S. Department of Homeland Security and other federal agencies are constantly examining ways to foil "bad actors" who could disrupt or hack into the operations of American companies.

He said U.S. and global partners "have to think of all the misuses" of cyber systems. He emphasized the growing role of the digital economy and noted that international groups such as the G7 and G20 nations "are increasingly looking at technology issues" such as blockchain, that are affecting traditional global systems.

"As we look around the world, we want to assure an open flow of data," Strayer said, but at the same time "it is absolutely critical to preserve a decentralized model." He emphasized that many countries want to regulate the internet, but that U.S. policy will continue to "push back against that." 

Strayer acknowledged that in the U .S. and most democracies, the digital infrastructure is in the hands of the private sector.

"We should not expect companies to operate in cyberspace any differently" than they do in conventional environments, Strayer said, but he warned that the task - including public/private collaboration - may be very challenging.

New cybersecurity standards will be "voluntary," he said, adding that "industry is driving the solution." He cited the need "to achieve maximum economic value" as companies battle cyberattacks.

Strayer cited Europe's "General Data Protection Regulation (GDPR)" that goes into effect on May 25, restricting many ecommerce and digital media practices in an effort to assure consumer privacy. He did not offer an opinion about whether such restraints may eventually emerge in the U.S., especially amid the current furor over activities at Facebook, Google and other companies that collect personal data.

He focused, instead, on ways that federal enforcement agencies are developing systems "to improve our defenses" and create a "cyber-posture" to fight cybercrimes. He said that systems are now "so interconnected that these threats can race around the world" almost instantly.

To battle such scourges, Strayer explained that the State Department and other U.S. agencies have about 150 "digital economy officers" at embassies and other locations worldwide to identify potential cybercrimes and to development enforcement tactics, often in collaboration with host countries.

Strayer also cited forecasts that estimate about 200,000 people will be needed to handle America's cybersecurity requirements in the coming years - a significant job creation stimulant.

Applying a layer of security and customer support for connected smart home devices, Verizon has launched TechSure, a service for its Fios and other high speed internet customers.

Verizon is selling three tiers of service:

-TechSure ($10 a month): Includes 24/7 phone support for most devices connected to the home network, and includes help with software installation, device setup support, and troubleshooting.

-TechSure Plus ($15 a month): The above plus identity theft protection, virus protection, and parental controls from partners that include LifeLock and McAfee.

-TechSure Premium ($30 a month): Everything in TechSure Plus, as well as added protection for many connected devices in the home (excludes mobile phones, which can be covered under a Total Mobile Protection plan). Under this tier, if a TV, tablet, smart thermostat, or any other eligible gadget breaks down, Verizon will repair or replace it.

Kyrio, the for-profit unit of CableLabs, has teamed with Microchip to develop embedded device security for the Internet of Things (IoT) sector.

Kyrio said it is the first certificate authority and Microchip Security Design Partner as part of an effort aimed at driving scale into IoT device security.

RELATED: CableLabs Unit Tackles IoT Testing

“The mission of this partnership is to embed IoT devices with digital certificates in secure hardware in a way that integrates well with hardware manufacturing process flows,” Ron Ih, director of business development at Kyrio, explained in this blog post. “This strategy will make it easy for IoT device manufacturers to enable enterprise-grade security without needing to be security experts.”

He noted that providing high security for networked devices historically requires complex back-end security software, security specialists, and processes “that did not fit well with hardware manufacturing flows,” and represents a situation that’s not sustainable with an IoT world that is seeing the number of connected devices explode.

RELATED: Kyrio Takes Over CableLabs Certification Testing Program

“IoT devices – from lightbulbs to cars – need security at the core, not as an afterthought,” Ih added. “By providing a strong managed Public Key Infrastructure (PKI) that fits within the existing design flow and supply chain familiar to device manufacturers, we are moving closer to the standardization the IoT industry requires to grow securely,” Ih explained.

RELATED: CableLabs Rebrands Security Spin-Off

Microchip, he said, already works with customers in several markets, including consumer, automotive, communications and industrial control.

Though Kyrio is the first certificate authority for Microchip’s Design Partner Program, other companies involved with it include cloud providers such as Google, Afero and Amazon Web Services, CycloneCrypto (a stack provider), and Cerberus, a design house based in the U.K.

Speaking alongside other panelists at a Capitol Hill luncheon briefing earlier this month, Sen. Ed Markey (D-Mass.) reiterated his concern that IoT stands for "Internet of Threats."

Rep. Ted Lieu (D-Calif.) insisted that consumers should know a so-called smart device can be hacked after they install it at home, but that government protections should have a "very light touch."

Chris Calabrese, VP-policy at the Center for Democracy and Technology, emphasized that the approval seal proposed in the Markey-Lieu Cyber Shield legislation is merely a way "to figure out if we can trust these devices."

And they all acknowledged that any such law will have to be dynamic because of the rapidly changing factors in the Internet of Things.

Shane Tewes, a visiting fellow at the American Enterprise Institute, organized and moderated the "Securing the Internet of Things" seminar Feb. 14. She characterized it as a good way "to get people's attention" even though some parties "are not going to be happy about it." In particular, she told Multichannel News after the event, manufacturers "don't want to put this in a box and get sued."

"You have to find the middle ground," Tewes said, adding quickly that AEI is not endorsing the legislation, but rather acknowledging that "something is going to happen" and the group doesn't want to "shy away" from the process.

Although it was unusual for a right-leaning think-tank such as AEI to showcase legislation by two liberal Democrats, the event hit a topic of interest to cable operators and other carriers as well as equipment makers -- all of whom are concerned about the assigned liability if home IoT devices are hacked. Markey is a member of the Senate Commerce Committee and its subcommittees handling communications and consumer protection. Lieu sits on the House Judiciary Committee. They introduced the Cyber Shield Act of 2017 (S.2020 and H.R.4163) in October.

Their proposal calls for a voluntary cybersecurity program for the Internet of Things, with input from a public/industry/academic advisory committee; one objective is to create product labels (physical or digital) that identify IoT devices that meet strong cybersecurity standards. The seal would show consumers that devices -- ranging from baby monitors to phones, laptops and other networked items -- are safe from intrusions. The voluntary self-certification program in the legislation would put the program into the Department of Commerce, also home of the National Institute of Standards and Technology and the National Telecommunications and Information Administration.

Dangers and Dynamic Solutions
Markey, in his opening remarks at the AEI session, warned, "We're here to talk about the sinister side of cyberspace: the harm that can be inflicted."

He emphasized that every IoT device is "something that can be compromised ... in ways that people don't think about but they should." He said the Cyber Shield "seal" would "enable consumers to make informed decisions" when they buy and install devices on a home network and "reward businesses that offer best practices." In the process, the legislation would "create a roadmap of improvements for manufacturers and their devices," Markey added.

Lieu concentrated on the "living, breathing process which would change over time as tech continues to change."

"The reason we're not very specific in this statute is [because] when it comes to technology, government should have a very light touch," Lieu added, emphasizing his expectation that that industry will "self-regulate." He explained that the voluntary program established by the proposed legislation would rely on a commission of diverse experts to set standards.

Industry-wide self-regulating standards, however, became the first matter addressed during a follow-on panel.

"We haven't seen a lot of coordination behind the standard," said CDT's Calabrese. "A lot of private entities have tried to put out standards, and the result has been a jumble."

Nonetheless, he agreed that certification of some sort is valuable "to figure out if we can trust these devices." He cited the recent BITAG report on technical aspects of IoT security and privacy as a model for such cross-industry collaboration. (The Broadband Internet Technical Advisory Group's members include Comcast, Charter, AT&T, Dish Network, Cisco, CableLabs, NCTA and Level 3.)

Rena Mears, head of consulting at DLA Piper law firm, pointed to the role of communications companies as devices are added to home networks.

"The level of data sharing is immense and going to get bigger," she said. "The risk with IoT is that each individual product is so small ... but taken together, it is immense." That will lead to "supply chain issues" which will put the burden "back to industry," Mears added.

"Even in an organized system, it's hard to find where the vulnerability or breach is," she said, stressing that liability "sits thick and heavy" in complex networks, such as IoT relationships.

"When I look at a home that has become a platform, and I look at the immense possibilities for IoT," Mears said, she envisions both values and dangers.

She called the ecosystem for IoT liabilities "just mind-boggling."

"There will have to be some set of rules that apply at some broader level rather than the traditional way of [managing] every little piece," Mears said.

Robert Stein, VP-government and regulatory affairs at InterDigital, a research and development company that provides wireless technologies for mobile devices, networks and services, acknowledged that, "We haven't thought that far ahead about who oversees" the integration of IoT connections.

The panel agreed that the Cyber Shield legislation is forcing the industry to examine specifics about digital security. Beyond the integrated role for carriers and hardware providers, there are "complicated realities" such as locked passwords. If a manufacturer installs a digital lock that a consumer cannot update, they wondered how it would affect the future interoperability with other home devices -- especially if a device is compromised or discarded.

The discussion echoed an early remark by Calabrese, who characterized the proposed legislation as an interim measure.

"No one should mistake it for a solution," he said.

Pictured (from left): Chris Calabrese, Rena Mears and Robert Stein, panelists at AEI's IoT security briefing Feb. 14.

Cox Business, the commercial services unit of Cox Communications, said it will offer its security product across all regions as it prepares to make it available soon in additional markets that include Cleveland, Roanoke, Santa Barbara, Palos Verdes and Sun Valley.

That offering, calledCox Business Security Solutions (CBSS), is underpinned by a 24/7 professionally-monitored UL Listed, 5-Diamond facility, Cox Business said.

CBSS uses a broadband connection with a wireless backup to help customers continually monitor the system and verify ongoing security. It also ties in a mobile alert system with cameras, enables customers to access and control the system with any connected smartphone, tablet or PC/laptop.

“We’re thrilled to expand Cox Business Security Solutions nationwide,” Steve Rowley, executive vice president, Cox Business, said in a statement. “Simply put, business owners must monitor their environments and create a ‘smart business’. With Cox Business Security Solutions, our video surveillance and detection systems help drive confidence in asset protection and provide peace of mind.”

Cox Business provides said it provides voice, data, video and security services for more than 350,000 small and regional businesses.

Congressional action to update the Telecommunications Act will be incremental, according to Rep. Greg Walden (R-Ore.), chair of the House Energy & Commerce Committee.

"We're looking at it piece by piece," Walden said at the 2018 State of the Net conference on Monday, Jan. 29. He added that Congress also "needs to look at the FCC operation" overall, acknowledging that "we live in a different era" than when the 1996 Telecom law was enacted. Walden said he expects a "program-by-program" evaluation, but did not suggest any timetable or urgency for the review.

More From SOTN: Rosenworcel Seeks Wider Investigation of Fake Comments

Walden's outlook on piecemeal telecom reform legislation echoes the view of his Senate counterpart Sen. John Thune, chairman of the Senate Committee on Commerce, Science, and Transportation Committee. At the SOTN conference last year, Thune also avoided any expectation that an omnibus revision of the Telecommunications Act is likely.

Walden also addressed net neutrality and broadcast spectrum issues in his remarks. He blamed the FCC's 2015 Open Internet ruling for creating an unnecessary barrier, but stopped short of promising any Congressional lawmaking on the topic either, as others have suggested.

"We ought to be able to find common ground to prevent bad behavior," such as paid prioritization, Walden said. But he contended that the issues are "not fully understood," saying, "We need to get certainty on what will drive more investment."

Related: Walden Says House E&C Will Hold Hearing on Paid Prioritization

Walden said he believes that lawsuits about the issue "will force America further back" in Internet development. He did promise that his committee will hold hearings on the topic, but did not specify a schedule.

In addition to his vow to find more money for the broadcast channel repack, required after last year's incentive spectrum auction, Walden vowed "a continuing effort to find more spectrum" and indicated that he expects that the FCC will "proceed with more spectrum auctions."

Related | broadcastingcable.com: Walden Says $3B Needed for Auction Repack

Asked about white space uses in the broadcast spectrum, Walden said he'd like to "maximize spectrum use but not interfere" with current operations.

"I'm not opposed so long as there is no interference," he explained.

A subsequent SOTN session on "The Fragmentation of Communications Policy" focused on privacy. Former Federal Trade Commission chair Jon Leibowitz, now in private practice at Davis Polk and Wardell law firm, said that the FTC is a "muscular agency" in this category and warned that state oversight of the issue is unacceptable.

"A federal solution - not a patchwork of state rules" is needed, Leibowitz said.

Another panelist, former National Telecommunications and Information Administration Director Larry Irving, now a telecom consultant, responded that the "FTC is not the right agency to regulate privacy over the Internet." At that, Chris Lewis, VP at Public Knowledge, insisted, "There is no reason why you can't have multiple cops on the beat," saying such an arrangement would provide "robust power" for enforcement.

Irving characterized the "likelihood of legislation in the near term is de minimis."

DOJ's Views of Security
Deputy Assistant Attorney General Rod Rosenstein focused on security in his remarks at the final SOTN session. Attendees were cautioned that he would not talk about or respond to questions about that day's revelations relating to the Russia allegations involving White House and Congressional activities.

Nonetheless, Rosenstein plunged into the fray, warning that, "We'll probably have more [cyber attacks] in the future with people protecting themselves" against such incursions.

He also said the DOJ is seeking "responsible encryption."

"We favor encryption but not to the exclusion of legitimate law enforcement concerns," he said. "We need to continue to improve our cyber defenses so we can help private sector protect themselves.”

He urged that "federal agencies work with industry to combat threats."

"We need to improve our cyber defenses to help protect the sector," he said.

In response to a question about intellectual property protection, Rosenstein said it was a "top priority for us," citing global coordination of efforts to fight piracy.

Public Dismay/Confusion
Earlier in the day, Sally Shipman Wentworth, vice president of Global Policy Development at the Internet Society, described an ISOC study which found that the user-centric vision of the Internet "has been lost." Commercial providers and government involvement now is dominant in Internet operations, factors that users don't understand, she said.

Wentworth also noted the "enormous explosion of threat vectors," singling out the massive role that government agencies will play in the Internet of Things, such as sensors for traffic, local security and other public services. She said that such activities will involves organizations that "have not necessarily been part of the Internet discussion so far," suggesting potential problems as new ventures and services emerge.

Her concerns were reinforced by findings from another new research report, unveiled at the SOTN conference.

Eighty-five percent of Americans said that the Internet has had a positive impact on their lives, but 56 percent said they believe it has weakened American democracy, according to the study by the Internet Education Foundation www.neted.org , which produces the SOTN conference. The "Society Under Strain" report found that Americans are "skeptical about the ability to secure the Internet" and about financial innovations that many don’t understand.

“Americans have high hopes for what the Internet can mean to their lives, but as technology advances it creates new concerns that ultimately end up before Congress and regulators,” said Tim Lordan, executive director of the Internet Education Foundation.

"Americans look to policymakers for answers," he added. "A majority (53%) believe that the laws and regulations that we have today aren’t working to deal with the issues that arise due to the Internet."

The study, conducted by Vrge Strategies, found that Americans are mixed on whether artificial intelligence and virtual assistants enabled by it will be beneficial or harmful. Thirty-seven percent said it will benefit them by making their life and work easier; nearly the same amount (36%) said it will be harmful by creating security and privacy issues.

According to the report's analysis, Americans overwhelmingly expect Internet companies to protect customers from cyberattacks: 52% cited Internet companies, 19% said the government and 18% expect consumers themselves to be responsible for protecting their Internet uses.

Nearly half of respondents (48%) said that while some incidents can be prevented, the “Internet cannot be protected from most cyber attacks.”

Pictured: Rep. Greg Walden speaking at the 2018 State of the Net conference.

Comcast Ventures participated in a $14 million “A” round of funding in BigID, a startup focused on enterprise data protection and privacy for personal data.

Other new investors in the round included ClearSky Security and SAP.iO. Previous investor BOLDstart Ventures also participated in the round, with takes BigID’s funding total to about $16.1 million.

BigID said it will use the funds to shore up its engineering team in Israel and expand its global sales and marketing efforts for its “data-driven personal information (PI) protection, privacy and governance platform.”

The company said its platform combines machine learning with identity intelligence to find, track and “de-risk” identity data at petabyte scale.

Founded in 2016, BigID is headquartered in New York, and launched its initial product in mid-2017.  

Tied to the A round, announced in conjunction with CyberTech Israel, BigID said ClearSky Security Managing Director and former Blackstone CISO Jay Leek has joined its board of directors.

“Customers are the lifeblood of any business and unless an organization can properly safeguard the security and privacy of their customer data they will not survive in the digital economy,” Dimitri Sirota, CEO at BigID, said in statement. “Regulations like GDPR [General Data Protection Regulation] crystallize the need for companies to understand their data. BigID gives companies a first-of-its-kind way to find, secure and govern their identity data across the data center and cloud. After all, you can’t know your customer unless you first know their data.”

DENVER — Just over the past year, connected devices including light bulbs, refrigerators, televisions, automobiles, insulin pumps and the electricity grid in the Ukraine were successfully hacked. All are evidence that the security threat for IoT and connected devices is real, but not insurmountable, according to panelists at a Cable-Tec Expo session, “IoT Security: Is It Really a Risk?”

Answer: Yes. “Security is a process, not a one-time thing,” said Petr Peterka, CTO of Verimatrix. “We need to be thinking about these devices over their entire lifetime.”

Read More: Complete Coverage of Cable-Tec Expo 2017

“We have got to stop this,” said Brian Scriber, principal security architect at CableLabs. “We have the tools.”

Scriber pointed out that manufacturers have little to no economic incentive to provide post-sale updates or security measures, let alone for their anticipated lifetime, Scriber said.

Plus, patches to remedy hacks and not always designed for the everyday person. Light bulbs don’t usually come with USB ports, for instance; depending on the type of IoT device hacked, the remedies can range from requiring special adaptors, custom cables, and even soldering irons.

Hackers hack for different reasons, Peterka said: Academics do it to expose flaws “because they want to protect us.” So-called “hactivists” usually have a political leaning they want known; thieves hack to steal; terrorists hack to cause large-scale damage.

Peterka characterized four levels of threats, associated with IoT hacks: Threats to brand and reputation, threats to lives (e.g. medical aides we have in or on ourselves), threats to national security, and threats to critical infrastructure.

Because set-tops and gateways are, in essence, the very first “connected IP devices” in a home or business, some security elements have already been solved, and can be applied to the IoT scene, he said. In particular, his list of the four corners of IoT device security includes device integrity, secure boot-ups, authentication, and the security of collected data.

He referenced work happening within CableLabs and some of its members with the Open Connectivity Forum, or OCF, as a solid flanking mechanism. “We have leadership there — which matters, because IoT security will absolutely impact our networks … and the fact is that we’ve solved these problems before,” Scriber said.

The ransom note appeared online on aug. 7, in the form of a chilling video addressed to HBO CEO Richard Plepler.

“HBO was one of our difficult targets to deal with, but we succeeded,” a voice says over sinster-souding music from Game of Thrones, before making a threat: “Our demand is clear and non-negotiable: we want [redacted] dollars to stop leaking your data.”

The demands followed the hackers’ claim to have stolen 1.5 Terabytes of the network’s most closely-guarded secrets from internal servers deep in the HBO fortress — seven times as much data as was stolen from Sony Pictures Entertainment in 2014.

The theft, which became public in late July, reverberated throughout the media industry, though the full extent of what the hackers actually stole remains sketchy. So far, a script for an upcoming episode of Game of Thrones was released, as were unreleased episodes of Curb Your Enthusiasm, Ballers and Insecure, personal data on GoT stars and email messages from a senior executive, with the hackers promising to release more content from the hack each week.

Plepler, in his initial memo revealing the breach to staff at the channel, was candid but confident.

“The problem before us is unfortunately all too familiar in the world we now find ourselves a part of,” he wrote. “As has been the case with any challenge we have ever faced, I have absolutely no doubt that we will navigate our way through this successfully.”

Cyber-threats affecting governments, companies and individuals are at a record high, by many estimates, and online extortion has become a major issue with the unprecedented growth in the number of new ransomware mutations.

The Cybersecurity Issue: Cybercrime Losses Continue to Mount

HBO’s hack was just the latest example of an industry threat — including ransomware, malware and distributed denial-of-service (DDoS) attacks designed to shut down entire networks — that executives could not have imagined only a few years ago. And for the companies that make and distribute content in a competitive world of consumer-savvy conglomerates, the stakes have never been higher.

That’s particularly true for networks, which often have huge revenue expectations for expensive first-run originals. The premature drop of an episode of a hot show, or the release of, say, unsavory emails about a show’s stars, can have lasting and costly consequences.

High Costs of Hacking
Sony Pictures is estimated to have spent more than $100 million in costs related to its hack, according to Reuters, while Yahoo’s 2013-2014 email hack ended up reducing its sale price to Verizon Communications by $350 million.

For now, it is unclear how hackers accessed HBO’s internal systems, though in the case of Sony Pictures and other recent attacks, access was gained through “phishing” emails sent to company executives or other employees. Once the user clicks on an infected link, hackers may be able to gain access to their email accounts, computers or servers.

“The scary thing about HBO is that of their internal network, they happened to get to the crown jewels, because they got to Game of Thrones,’ ” a cybersecurity analyst who works with companies in this field and asked not to be named said. “If they can get to that, they can get to anything.”

Immediately after the attack, Plepler sent an email to staff at the premium cable channel, urging calm through what he called “this difficult period,” reassuring employees that HBO’s email system as a whole was not compromised in the same way Sony’s was, a compromise which led to online leaks of sensitive data on talent, projects and personnel.

“At this time, we do not believe that our email system as a whole has been compromised, but the forensic review is ongoing,” Plepler wrote in the memo.

Distributors are struggling to stay current with the problem as well. As the backbone of the U.S. communications infrastructure, cable and telecom companies are in the crosshairs of hackers on a daily basis. Attacks that take down their services can cripple businesses, annoy consumers and wreak severe economic damage.

Sophisticated hackers can find a way to gain entry into company servers, stealing internal or customer data. In July, for example, Verizon Communications revealed that personal data for millions of its customers was exposed due to a misconfigured cloud server.

“Twenty years ago, I had an ISP look me straight in the eye and say, ‘We build the highway, how you choose to drive on it is up to you,’ ” Dave Lewis, global security advocate for content delivery network and cloud services provider Akamai, said. “Unfortunately, that sort of mentality just doesn’t hold water anymore, and they really need to take these sorts of things seriously.”

Given the investments internet-service providers make in security, most offer premium tiers of service to clients, particularly in enterprise, that offer added security features. According to Cisco Systems’s 2017 Midyear Cybersecurity Report, 71% of service providers surveyed offer such products.

Of course, for ISPs, the biggest threat isn’t necessarily stolen internal or customer data, but a blunt-force attack on their networks.

“In 2014, I was in the White House and someone said we have some report of a 500-Gigabyte-per-second [DDoS] attack, and at the time the experts said, ‘That is just not possible, it’s not gonna happen,’ ” said Ari Schwartz, managing director of cybersecurity services for Venable LLP, who served as director of cybersecurity at the National Security Council during the Obama administration until 2015. “At the time, it was literally not possible. The biggest attacks were in the 100-Gigabyte range. Now we are seeing 10 times that amount three years later.”

Those attacks can slow the internet to a trickle, as with the U.S. attack last October, or knock it offline altogether, as attacks in Europe demonstrated.

According to Cisco’s 2017 midyear cybersecurity report, 34% of service providers surveyed said they lost customers as a result of attacks to their networks. “As an active security challenge, it is quite a bit to take on, the bigger the pipelines, the bigger the threats,” Michal Brenner, marketing manager for Cisco’s service provider business group, said. “Service providers, as they move to more advanced technologies, really need to look at their complete end to end infrastructure and see how to protect that in a holistic way.”

As internet-connected devices, from speakers to baby monitors, continue to grow in popularity, the risks to U.S. ISPs grows exponentially greater. Last October, hackers hijacked an army of thousands of internet-connected security cameras, smart TVs and other “Internet of Things” devices, and marshaled them against Domain Name System (DNS) provider Dyn. The “botnet” the hackers created launched a distributed denial of service attack (DDoS) that slowed internet traffic to a crawl across most of the eastern U.S. Similar attacks have occurred in Europe and the U.S.

Ensuring that IoT devices are secure will be a top priority going forward. For ISPs, that means making sure that they can isolate future botnet attacks, protecting the rest of their customers and the larger network.

Device makers are expanding their products to include more devices with built-in security. Arris, which produces modems, routers and gateways for use in homes and offices, recently launched a home gateway with built-in McAfee Secure Home Internet support. These devices can be particularly useful in securing Internet of Things devices, which may otherwise be vulnerable.

“For a lot of devices [like a WiFi-enabled camera] there is no way to put security software on top of it, but as long as they are connected through this gateway, then they will be under this umbrella of security protection,” Bill Zhou, vice president of product management for Arris, said. “That is really the beauty of it.”

Staying a Step Ahead
The biggest challenge for distributors, indeed for all companies, is taking the threats serious enough to create basic end-to-end protections. Most large ISPs and cable operators successfully fend off hundreds of attacks on a daily basis. More often than not, they’re able to stay one step ahead of malicious attackers, or at least keep up with them fast enough to prevent disaster.

Still, each new hack into a big media company brings the problem back into the spotlight.

“There are still a lot of companies out there in the space that don’t do true risk management, that see security as a compliance exercise, and even the small and medium- size guys have to move to start thinking of this as risk management,” Venable’s Schwartz said.

Perhaps more alarming is the rising trend of hackers looking not to ransom, release or sell stolen data, but to destroy networks altogether, to wreak havoc.

“The fantastic fantasies of Hollywood, of what a hacker could do, early in the days of making hacker movies, we are starting to get to the point where many of those things are becoming a reality,” Francisco Artes, an architect for Cisco’s security business group, said.

The Trump administration may also force the hand of internet providers, depending on the outcome of an executive order signed by the president in May.

That order asks federal agencies to examine whether service providers, particularly publicly-traded providers like cable companies and telcos, are as transparent as they can be with regard to the risks they face and the security precautions they take. The order also tackles botnets, and asks U.S. security officials to determine what role ISPs should have in preventing those types of attacks in the future, and whether the government should force them to keep “clean pipes.”

“People have been under-investing in basic hygiene, and that has to change,” Schwartz said.

SIDEBAR: Tips on How to Stay Secure
Security consultants suggest several tips for information-technology teams to avoid breaches. Senior executives and employees that work in IT are among the most frequent targets of hackers, because of the level of access they have to proprietary and confidential data. In general, though, the same basic rules of security can and should be used by all company employees.

1. Authenticate: Enable multifactor authentication on email accounts. Even if a hacker gets email credentials, multi-factor authentication, which can include authentication through codes sent to mobile devices, for example, they will have a much harder time actually accessing employee accounts.

2. Monitor: Networks and systems should be regularly monitored, and any unusual activity should be immediately escalated and, if the need arises, isolated.

3. Educate: Executives and employees should be kept abreast of the latest phishing emails, and reminded not to click on links they are not expecting. “These things happen every day,” Dave Lewis, global security advocate for Akamai, said. “Every single company is targeted by these sort of things.”

4. Communicate: Executives and IT professionals should regularly communicate with staff, and promptly alert them if there is a breach (as HBO did following its hack). Employees should be encouraged to speak up if they think something is wrong, even if it ends up being a false alarm.

5. Update: All software and applications used by everyone in the company should be kept as up to date as possible. “Everybody should be doing this by now, but quite frankly it is like working with an NFL football team and telling them that tackle and blocking is important, it always will be,” Francisco Artes, an architect for Cisco’s security business group, said. — AW

High-profile snatching of content from Netflix and HBO may have grabbed the headlines in recent weeks and months, but the overall cybercrime trend itself has become increasingly harrowing.

“From a cybersecurity standpoint, the second quarter of 2017 has been one of the scariest in years,” Panda Security, a maker of cybersecurity systems and monitoring tools, proclaimed in its analysis for the second quarter.

The firm noted that the WannaCry attack in May and the GoldenEye/Peyta attack in June were the “standouts,” as they had an impact on multiple countries, which are still recovering. Some estimates put the overall cost of those attacks at between $1 billion and $4 billion, meaning the average loss per victim ranged from $4,300 to more than $17,000.

The Cybersecurity Issue: Primetime Targets

The frequency and financial impact of internet crimes are showing no signs of slowing.

In its 2016 Internet Crime Report, the Internet Crime Complaint Center (IC3), a branch of the FBI, said it has received an average of more than 280,000 complaints per year over the past five years. Formed in May 2000 to monitor scams such as ransomware, tech-support fraud and online extortion, the IC3 said more than 3.7 million cybercrime-related complaints have been reported since its inception.

Last year alone, IC3 received almost 300,000 complaints with reported losses in excess of $1.3 billion. With 2016 factored in, the reported losses since 2012 total $4.63 billion, the division said.

Ransomware, whereby the victim is urged to pay a ransom (usually in the form of a virtual digital currency like Bitcoin) to regain access to their data, continues to be a growing contributor. Last year, IC3 received 2,673 ransomware-related complaints, with associated losses of more than $2.4 million.

“Ransomware is still on the rise, and will continue to be as long as there are victims willing to pay,” Panda Security noted.

Panda Security’s latest report amplifies a growing trend, noting that of all the machines protected by its platform, 3.44% were attacked by unknown threats in Q2, up almost 40% from the previous quarter.

And hackers will have more targets to pursue amid the rise of the Internet of Things and as more connected “smart cities” emerge.

“Hyper-connected cities that are made up of networks of millions of devices will increase the overall reach of attacks, and the consequences will be more costly and more severe,” Panda Security predicted.

Video piracy is a global epidemic. From recording device-toting movie theater audiences to the behind-the-scenes torrent network manager (and ad salesperson), there isn’t a limit to the number of identities content thieves can assume. But to varying degrees, they’re united in their desire to swindle content producers — and consumers in many cases — and capitalize.

The advent of higher-quality resolution content like High Dynamic Range (HDR) is one of the latest opportunities for video pirates around the globe to target and exploit to their advantage, as the pirate source is most attractive to users (and their eyeballs).

Strategy Analytics predicts that annual worldwide sales of HDR-enabled TVs will reach 58 million units in 2020, with U.S. penetration of HDR TVs forecasted to reach nearly 25% of homes. The need to protect HDR content will intensify as more consumers obtain access to these devices — and subsequently this higher quality and valued content. Effective and efficient measures, however, are already in place so content owners and players can equip and protect themselves in the wake of this growing technology.

The content industry started adopting new systems to better secure its revenue when 4K-quality content was unveiled to the market — initially, on UHD Blu-ray Discs, and more recently on a wide variety of pay TV and over-the-top platforms. MovieLabs — a joint venture among the six Motion Picture Association of America (MPAA) studios — published the first version of its Specification for Enhanced Content Protection in 2013, which outlined a set of security recommendations for improving the security of the highest value audiovisual content regardless of delivery mechanism. Since then, the specifications have been tightened further. Content distribution partners should always use the most recent ones as their lodestar.

In discussing the challenges associated with HDR content, my co-author, Ron Wheeler, senior vice president of content protection and technology strategy at 20th Century Fox, told me that for companies whose business is to entertain viewers, innovation is key — including the latest picture quality evolution made possible with HDR.

However, better quality is just as attractive to pirates as to paying consumers. “Fox’s experience is that the moment a high-quality pirate source becomes available, it immediately becomes much more popular than lower-quality sources such as theater camcorders or ‘ordinary’ HD sources, and is, therefore, a bigger threat to our legitimate business. That makes it imperative that we do everything we can to protect that high-quality source from piracy as long as possible,” he said.

This is where forensic watermarking becomes a critical tool. The presence of a unique identifier for each piece of content makes retrieval a lot easier and enables content owners to easily identify the weak link in their distribution system. The ability to trace illicit redistribution to the original source makes it a very strong piracy deterrent, as content owners can strongly warn pirates, and even consumers watching an illegal stream, against the legal implications of accessing or sharing copyrighted content.

Equally if not more importantly, they can refer uploaders of the content to law enforcement authorities for investigation and prosecution, with attendant publicity that will make future would-be uploaders think twice. This deterrent effect has resulted in significant delays in piracy of high-quality sources in places where watermarking has been deployed, such as South Korea.
Studios are planning to offer HDR as a mass-market proposition by 2018, so content distributors need to implement or upgrade their protection arsenal now. By preparing for this growing pixel revolution, they can avoid the pitfalls of tech-savvy pirates using the latest specifications for content protection.

Mark Nakano is senior director of product marketing and partnerships at NexGuard; Ron Wheeler is senior vice president of content protection and technology strategy at 20th Century Fox.

House Energy & Commerce Committee chairman Greg Walden (R-Ore.) outlined a broad agenda for the committee and its Communications Subcommittee on Tuesday (Feb. 14), with items ranging from legislative action on Title II to a comprehensive examination of FCC and NTIA "reauthorization" to accelerated rural broadband deployment to increased oversight of federal cybersecurity initiatives.

At the monthly luncheon of the Media Institute, Walden (pictured) endorsed the "process reforms" that FCC chairman Ajit Pai (who was in the audience) has already introduced. Walden complimented Pai for successfully doing administratively "what Congress has been trying to do legislatively." He singled out Pai's decisions to revoke recent regulations over broadcast joint-sales and shared-service agreements and to rescind certain requirements for noncommercial TV ownership reports.

"We want this business to be vibrant and competitive," Walden said, noting that he expects to "see additional deregulation."

"We don't need antiquated rules like cross-ownership," Walden said.

As for the Open Internet rules, the Commerce chairman said, "Republicans are open to legislative solutions" and that net-neutrality decisions "should be done legislatively." But he acknowledged "it will take time" to develop new procedures, saying, "We have draft legislation" in the works.  

Walden did not respond to queries about a timetable for the congressional review. He chastised the previous FCC leadership's "over-reach" in the Open Internet process.

Although he glazed over his agenda for what he called a long-overdue comprehensive reauthorization of both the Federal Communications Commission and the National Telecommunications and Information Administration, Walden said he believes the FCC should be restored to its five-member level (currently the agency has only three Commissioners).

"The Commission should be filled out, the sooner the better," Walden insisted.

On the broader issue of a comprehensive update to the 1996 Telecommunications Act, Walden said he "resists the notion that it will be one bill," preferring to "look at this in modules" affecting various industries, he said, emphasizing that Communications Subcommittee chair Marsha Blackburn (R-Tenn.) will lead the group's decisions on a rewrite.

"If the marketplace can handle [conditions], it should," Walden said. 

Walden called deployment of rural broadband a top priority on the Committee's communications agenda, pulling in examples of the need for wireless broadband. In particular, he emphasized the need to "lower the cost of broadband development."

He told a homespun tale of the need for such capabilities coming up this summer, on Aug. 27: the date of a total solar eclipse where a prime viewing area will be in small towns within his central Oregon district. Walden said there is almost no wireless capability for a stretch of nearly 30 miles around the eclipse epicenter. Then he wondered aloud, looking directly at Pai,  if he "only knew someone who had administrative authority to require coverage in that region." (At that point, Pai jokingly stood up and started to walk away from his table, to the gleeful laughter of the audience.)

Regarding cybersecurity, Walden indicated that the Commerce Committee will examine the ways in which various agencies monitor activities within their sectors to avoid duplication. Citing the threats to power utilities as well as commercial and communications facilities, Walden vowed to work with industry and to "incentivize" the entire ecosystem to prepare for possible digital assaults.

"We don't need every agency to grab a piece of cybersecurity," he added.  "The goals should be how to share information and avoid cyberattacks."

To help high-speed subs ward off hackers and cyber-sleuths, Verizon Communications has launched Digital Security Pro, a service that costs $10 per month that combines services from LifeLock and McAfee.

The service, offered to Fios Internet other Verizon high-speed customers, aims to protect a customer’s online identify, shield them from malware and viruses along with access to a set of parental control tools.  Among that group, Verizon said McAfee’s security component lets customers manage and monitor devices from a centralized location.

Verizon is also offering additional adult and child subscriptions to LifeLock.

"We created Digital Security Pro so customers can spend less time worrying, and more time enjoying, what technology and the Internet have to offer," Susan Retta, vice president of consumer marketing at Verizon, said in a statement. "Digital Security Pro unifies virus protection, ID monitoring, and device management in one product giving customers the management tools needed to face online threats."

About half of Americans polled (49%) said they felt their personal information was less secure than it was five years ago, and a majority (64%) say they have have been exposed to some kind of data breach.

That is according to a new Pew Research Center cybersecurity survey.

The respondents did not have high expectations that the situation would be changing anytime soon.

Only 21% said they have a high level of confidence that either the federal government or social media sites can protect their personal information.

That comes as the government--White House, FCC, FTC--are trying to figure out how best to protect personal information and critical infrastructure in an Internet of Things world.

The respondents were about evenly split on the issue of encryption and whether the government should be able to get around it for law enforcement purposes.

According to the survey, 46% believe the government should be able to access encrypted data when pursuing criminals, while 44% said encryption should be unbreakable, even to law enforcement. Democrats and younger people skewed toward strong encryption while Republicans tend to favor law enforcement access.

One reason respondents may not have confidence in the security of their data is they neglect to follow cybersecurity best practices.

Sen. Brian Schatz (D-Hawaii), in early comments at Monday's annual State of the Net conference in Washington, presaged a discussion later in the day about whether and how federal support to build broadband facilities should be part of the Trump administration's proposals for upgrading the nation's infrastructure of roads and bridges.

That dialog sparked an examination, suitable to the venue and referred to throughout the day as part of the "kinetic versus cyber" ecosystem, of telecommunications' importance vis-à-vis tangible products.

"The more we can do in the broadband space, the  better," Schatz said in his remarks at the conference. "We can get bipartisan support," but he proposed that "we should do little things" rather than go for sweeping telecom reform.

Schatz also addressed the continuing controversy about net neutrality, insisting that, "reversing the Open Internet order is not so easy." He said that "right now it is just too polarized" to legislate on that issue, although he thinks Congress should do so.

"I'm open to legislating but only if it's not a Trojan horse for undermining the authority that is already in place," said Schatz, who sits on the Senate Committee on Commerce, Science and Transportation.

He also said he "believes Jessica should be back on the FCC," a reference to former Democratic FCC commissioner Jessica Rosenworcel, whose term ended after an ill-fated, politically laced attempt to reappoint her in late December.

Schatz's remarks included his views on privacy and the Internet of Things, which were major topics throughout the SOTN annual conference.

"IoT is one of the spaces where we need rules of the road; also artificial intelligence as it relates to law enforcement," Schatz said. "I don't think this is apocryphal sci-fi stuff. We have to have this conversation, ideally private-sector driven." 

He did not offer any suggestions on how Congress would become involved in these rapidly developing tech/telecom sectors.

At a subsequent session on IoT, Dr. Ron Ross, a fellow at the National Institute of Standards and Technology, characterized cybersecurity intrusions as "the greatest national security problem," emphasizing that communications and utility operators are not adequately prepared for attacks, such as "exfiltration" of customer information. He said building the infrastructure to defend against cyberattacks "is incredibly complex."

The panel also addressed looming issues such as liability and how IoT systems can be built that enable consumers to keep control over their own data.

Reassigning Spectrum, Funding Broadband Deployment
A session on "Rethinking the Future of Communications Policy" spanned a terrain from spectrum allocation to FCC staffing.

After declaring the current broadcast incentive auction a success (despite its lower-than-expected revenue results), the panel said it expects further efforts to retrieve airwaves for new digital applications. In particular, the panel focused on government agency controlled airwaves, which it called "the low hanging fruit for more spectrum."

Larry Downes, project director of the Georgetown University Center for Business and Public Policy, cited the opportunity for the new administration "to incentivize federal agencies with underused spectrum to give it up or share it for commercial use.   

Although the Defense Department is unlikely to relinquish its massive spectrum holdings, according to panelists, airwaves controlled by aviation and other agencies may be diverted to commercial use.  No one offered specifics regarding timetable or how the transfer would be accomplished.

Broadband will be part of the Trump administration's national infrastructure construction plan, said Markham Erickson, a partner at Steptoe & Johnson law firm, who represents telecom and internet clients. He expects the primary federal actions will be created by providing tax incentives and subsidies for private investment, "some mechanism to get broadband out to rural places."

Erickson also said he expects that the FCC will retain "extensive regulations" over some telecom sectors, although he did not cite specific topics.

With FCC transition team member Mark Jamison (pictured above) on the panel, discussion also touched on the extent of the FCC reorganization agenda. Jamison, who is director of the Public Utility Research Center at the University of Florida, was a member of the Trump transition team working on the FCC.

Jamison said that the "basic goal" was to "elevate the role of technical analysis."

"It's easier to hire lawyers than economists or engineers," he said. "I think the commissioners and public will be better served" with more technical expertise.

Gigi Sohn, a former advisor to former FCC chairman Tom Wheeler, concurred, noting that it was "very frustrating to bring engineers and economists" from telecom and media companies and count on their information. "As a result, we're reliant on industry input," Sohn said, lapsing, as she frequently did on the panel, to using "we" when discussing a job she left three weeks ago, a very common gaffe among recently quondam public servants. She joked about the ex post facto “we” that crept into her comments.

The panel agreed that FCC reorganization should reflect greater overlap of activities that affect multiple bureaus.

"The FCC should recognize the convergence of all kinds of Internet Protocol technologies," said Downes. "There is no need to separate bureaus based on [legacy] structures."

Sohn also used the platform to predict that Trump appointees will adopt the mantra "Consolidation, consolidation, consolidation," in counterpoint to Wheeler's "Competition" mantra. She predicted that the FCC will have no role in upcoming merger considerations, with those functions going to the Federal Trade Commission and Justice Department.

Erickson pointed out that there are similar rules at various bureaus and agencies, noting as an example that the Justice Department may be better equipped to take "a bigger view of intermodal and intramodal competition."  

In his closing keynote,  Sen. John Thune (R-S.D.) avoided any indication that an omnibus Telecommunications Act reform is in the works.

Comcast was the only "Platinum Sponsor" of the annual event;  AT&T, Verizon and Google were among the "Gold Sponsors."

Former New York Mayor Rudy Giuliani will advise the Trump  administration on cybersecurity, but in an unofficial capacity.

The Trump transition team said Thursday that Giuliani, who is a private consultant and chairman of the global cybersecurity practice at Greenberg Traurig, will "be sharing his expertise and insight as a trusted friend."

In addition, the president-elect plans to hold a series of meetings with senior execs "from companies which have faced or are facing challenges similar to those facing the government and public entities today, such as hacking, intrusions, disruptions, manipulations, theft of data and identities, and securing information technology infrastructure," which does not narrow the field much given the scope of cyber attacks.

The meetings appear to be more about information-gathering than policymaking.

"No consensus advice or recommendations resulting from group deliberations or interaction is expected or will be solicited," the transition team said.

"As the use of modern communications and technology has moved forward at unparalleled speed the necessary defenses have lagged behind," the team said in announcing Giuliani's ex officio role. "The President-elect recognizes that this needs immediate attention and input from private sector leaders to help the government plan to make us more secure."

Trump has said cybersecurity and preventing hacking is a priority, and made that point again in his press conference Wednesday (Jan. 11). He has said he wants a plan on combating cybercrime ASAP once he takes over Jan. 20.

Casting another dark cloud on its proposed sale to Verizon, Yahoo Inc. confirmed Wednesday that it believes an unauthorized third party, in August 2013, stole data associated with more than 1 billion user accounts.

The latest admission follows an earlier one in which Yahoo said data from more than 500 million accounts, including customer e-mail addresses, birth dates, phone number and encrypted passwords, were stolen.

Yahoo noted that the latest data breach was discovered after it law enforcement provided the company with data files that a third party claimed was Yahoo user data.

RELATED: Breached: What happened when hackers shut down Liberty Global’s broadband in the Netherlands

“Yahoo believes this incident is likely distinct from the incident the company disclosed on September 22, 2016,” the company said.

The latest data breach admission plants another seed of doubt around Verizon’s $4.8 billion deal to acquire Yahoo for $4.8 billion. Speculation following the earlier hacking revelation was that Verizon might try to cut the purchase price by as much as $1 billion. Verizon has held that the data breach could be a material event

RELATED: Verizon Agrees to Buy Yahoo for $4.83B

Verizon said its position on the pending deal remains unchanged following this week’s revelation.  

"As we've said all along, we will evaluate the situation as Yahoo continues its investigation. We Will review the impact of this new development before reaching any final conclusions,” Verizon said in a statement.

UPDATE:Bloomberg reported Thursday morning that Verizon is exploring a price cut or a possible exit from the proposed deal. 

Regarding the latest breach discovery, Yahoo said stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, possibly, encrypted or unencrypted security questions and answers. Yahoo noted that the investigation showed that the purloined data did not include passwords in clear text, payment card data, or bank account information.

“Payment card data and bank account information are not stored in the system the company believes was affected,” Yahoo said.

Based on its ongoing investigation in the hacking matter, Yahoo said it believes an unauthorized third party accessed the company’s proprietary code to learn how to forge cookies.

Yahoo said it is encouraging its users to review their online accounts for suspicious activity and to change their passwords and security questions. Further, it’s recommending the use of a Yahoo Account Key, an authentication tool that, it says, eliminates the need to use a password on Yahoo altogether.

The House took a serious, and mostly bipartisan, look Wednesday (Nov. 16) at the cybersecurity threat posed by the Internet of Things.

A joint hearing, "Understanding the Role of Connected Devices in Recent Cyber Attacks," was held in the Communications Subcommittee, chaired by Rep. Greg Walden (R-Ore.), and the Subcommittee on Commerce, Manufacturing and Trade, chaired by Rep. Michael C. Burgess (R-Texas).

The hearing was held in the wake of the distributed denial of service attack on Oct. 21 that restricted access to some major websites.

Apparently, the attack only employed 150,000 of about 1.5 million IoT devices still infected with the botnet that allows them to be commandeered to deliver similar or larger attacks in the future.

The seriousness of the issue was highlighted by the fact that the witnesses agreed that that the DDOS attack, which affected Netflix, Twitter and others -- was relatively benign compared to, say, an attack on critical systems that could cost lives.

Rep. Pete Olson (R-Tex.), a former Navy aviator, said the biggest threat to security is not bombs and missiles but ones and zeros and that, in the current environment, the government has to be proactive.

In fact, Republicans and Democrats were both using the R word (regulation) to talk about addressing the threat, as were all of the witnesses to some degree, though Dale Drew, SVP and chief security officer at Level 3 Communications, focused on standards and existing regs rather than new ones.

Rep. Anna Eshoo (D-Calif.), ranking member of the Communications Subcommittee, also suggested that approach. When one witness said a new government agency might be needed to deal with IoT cybersecutiry, she said that would not happen in the new administration. Walden joked that for every new agency created, they could eliminate two, a reference to President-elect Donald Trump's proposed requirement that two regulations be scrapped for every one added.

But Walden got serious, saying that the IoT cybersecurity issue was bipartisan and the Republican leadership would continue to address it.

Walden told the witnesses he was concerned about the government stepping into the marketplace, but primarily because he had heard cybersecurity witnesses before warn government to "first do not harm" and to be careful not to lock things into statute.

Rep. Frank Pallone (D-N.J.), ranking member of the Communications Subcommittee, pointed out that some have argued that regulating devices will constrain innovation.

Witness Bruce Schneier, adjunct Lecturer, Kennedy School of Government, Harvard University, conceded the point, but said the government would definitely need to step in because the risk was too great. He said there's "a fundamental difference between your spreadsheet crashing and losing your data, and a connected car crashing and losing your life."

He emphasized that it was a catastrophic risk, crashing all connected cars, for example.

"It is an arms race, and the current edge is to the attacker," Schneier said, adding that given the scale of the Web and the ability to affect physical objects via IoT, "it might be that the Internet of fun and games is over."

Dyn Inc., a major Domain Name Server and Web hosting service, said Friday that it has recovered from a DDoS (distributed denial of service) attack that caused an Internet service disruption this morning on the east coast.

Per multiple media reports, sites supporting services such as Twitter, Reddit, Airbnb, Spotify, and Reddit were among those that were impacted.

As detailed in this week’s Multichannel News cover story (subscription required), DDoS attacks led by hacking groups have wreaked havoc on cable operators and have caused them to bolster their online defences. 

“Starting at 11:10 UTC on October 21th-Friday 2016 we began monitoring and mitigating a DDoS attack against our Dyn Managed DNS infrastructure. Some customers may experience increased DNS query latency and delayed zone propagation during this time. Updates will be posted as information becomes available,” Dyn initially reported on its status page, noting that the attack was primarily centered on in the eastern U.S. and impacting managed DNS customers in that region.

“Services have been restored to normal as of 13:20 UTC [9:20 a.m. ET],” Dyn posted on that site, as well as on Twitter:

Services have been restored to normal as of 13:20 UTC.

— Dyn (@Dyn) October 21, 2016

Comcast said it's also being watchful:

Known DNS issues seem to be resolving. Our engineers are closely monitoring this external issue. Updates here: https://t.co/eLN09p8UBc

— ComcastCares (@comcastcares) October 21, 2016

Updates: Issues resurfaced into the afternoon amid more hacker attacks. The latest from Dyn: "Dyn Managed DNS advanced service monitoring is currently experiencing issues. Customers may notice incorrect probe alerts on their advanced DNS services. Our engineers continue to monitor and investigate the issue. Customers with questions or concerns are encouraged to reach out to our Technical Support Team."

Dyn issued this update at 2:52 p.m. ET: "At this time, the advanced service monitoring issue has been resolved. Our engineers are still investigating and mitigating the attacks on our infrastructure."

Dyn issued this update at 6:17 p.m. ET: "This incident has been resolved."

“This … is … bad.”

The chief information officer at Liberty Global, Veenod Kurup, mouthed those words, mostly to himself, as he saw the Guy Fawkes mask of Anonymous appear in the YouTube video.

It was bad enough that there was an outage in the system, and a big one. Hundreds of thousands of homes and counting — eventually 2.2 million, or nearly two of every three of Liberty’s Netherlands broadband subscribers — were now essentially unplugged.

Worse, the cause wasn’t a late summer storm or a lightning strike, but something far more devious: a breach in the company’s cyber defenses through an overwhelming distributed denial-of-service (DDoS) attack on company servers.

Transfixed by the video, Kurup and other executives realized the unfolding tech nightmare was getting worse. It appeared to be the sinister work of Anonymous, the infamous global Internet vigilante group known for ferocious attacks.

The Liberty executives listened in disbelief in their offices near Amsterdam as the eerie synthesizer-distorted voice on the screen explained how the next attacks would be even harsher. The target: Liberty Global’s newly acquired Ziggo operations in the Netherlands.

The audio ended with a version of the group’s signature coda: “We are Anonymous. We are legion. We do not forget. We do not forgive. F---k your bad services. Expect us.”

When it ended, the room fell silent for a second.

Over the ensuing 72 hours of August 2015, a bizarre chain of events would leave Liberty executives flummoxed, and forever wary. The crisis would embroil an eclectic set of characters, including frazzled cable engineers, detectives with the Dutch Police’s High-Tech Crime Unit, cyber gumshoes at the National Cyber Security Centre, the digital vigilante group known as Anonymous, copycat hackers looking for Internet glory and the true perpetrators, who briefly evaded authorities despite their crude methods.

In bringing down Liberty Global’s Ziggo network, the criminals and the manhunt to capture them yielded some crucial lessons for the many media companies — indeed, any major industrial concern — that will inevitably confront this insidious peril of the Internet Age: that they will be victimized by a hacker or attacker hell-bent on stealing data, demanding money or bringing the system down.

Hacking is big business, and it’s getting bigger. Cybercrime inflicts annual costs to the global economy exceeding $400 billion, according to a study by the Center for Strategic and International Studies, sponsored by cybersecurity firm McAfee. Costs could reach up to $2.1 trillion globally by 2019, according to Juniper Research. Other estimates put the figure at a mind-boggling $6 trillion within five years, including lost productivity, fraud and post-attack disruption.

Cable operators and other ISPs rarely speak about cybercrime for fear of inadvertently revealing network vulnerabilities, but given the widespread, mostly unauthorized revelations about the Netherlands cyberattack, Liberty executives agreed to share limited details to clarify the episode.

Sometimes a breach occurs for all the wrong reasons. A company can do all the right things, create the best safeguards and vigorously review security, but may overlook a tiny flaw in the system.

Liberty’s network, like that of many ISPs, is attacked constantly in a variety of ways (see chart), but the attempts are kept at bay with increasingly sophisticated safeguards. Though outages at big ISPs from hackers are rare, the odds continue to grow in the hackers’ favor as digital commerce and cloud computing thrive. Wireless operations are, in many ways, even more vulnerable.

Evolving prevention and detection strategies are as elaborate as they are endless: “honeypots,” for example, are computer systems set up to act as a decoy to lure cyber-attackers and study their methods. Liberty had long ago implemented a holistic approach to security beyond just firewalls, with a 24-hour monitoring team in a global security operations center. Highly trained executives followed a thoughtful crisis-management process. Recent upgrades had already reduced malware infection rates by 25% since January 2015. With a comprehensive plan backed by best practices, the network security team was comfortable the company could withstand most cyber attacks.

THE ATTACK BEGINS

But last summer, a rupture suddenly and quietly appeared in the front lines. And like all successful attacks, the intruders caught the fortress completely by surprise. It was as if the cable giant had built reinforced steel walls with spotlights and guard dogs in front of the house and then left a window open in the new annex out back.

Around 9:30 pm on Tuesday, Aug. 18, Liberty technicians got word that Ziggo, an incumbent cable operator acquired by Liberty months earlier, was reporting outages.

Ziggo had only just begun the process of integrating its system into Liberty’s, but no matter: Liberty owned them now and complaints were lighting up call centers by the thousands. In just hours, hundreds of thousands of customers would be without broadband services.

Ziggo and Liberty engineers quickly huddled on a conference call to determine the cause of the outage. More often than not, the problem can be traced to an equipment failure. Not this time. Within an hour, the engineers, because of the mushrooming volume of outages, quickly realized Ziggo was under a distributed denial of service (DDOS) attack. This was a Priority 1 incident.

Liberty Global’s chief technology officer, Balan Nair, knew reaction time was critical. “The key to solving all this is a function of how quickly you react initially and how good your team is,” he said. “Up and down the ladder, everyone was taking this very seriously. They were burning the midnight oil on this.”

A distributed denial-of-service attack typically floods a company’s network by inundating it with connection requests, leaving the targeted server overwhelmed, a lot like Lucy at the chocolate factory, frozen by its inability to keep pace with commands. Often the culprit is using an army of hijacked Web browsers or malware-infected computers, or botnets. According to a report by TrendMicro Research, $150 can buy a week-long DDoS attack on the black market.

Indeed, DDOS attacks are common — Liberty, like many cable operators, fends off up to 10 Gigabits of DDOS attacks — per day. This particular attack targeted DNS servers, which redirect domain names to correct IP addresses. Social media chatter about the outage began building — for those that could still get online.

Social media, in fact, supplied the first clues to identifying the perpetrator. Several groups began to claim credit via Twitter. Then came the YouTube video. As it played against a still photo of a Guy Fawkes mask, the synthesized voice began its threat:

“We, Anonymous, have a message to company Ziggo … now we’re going to hold Ziggo offline for a few days because Ziggo offers bad service. This is the last warning. We are Anonymous. We not forgive. We do not forget. F---k your bad services. We are Legion. Expect us.”

Recalls Kurup: “That shook us to the bone.”

The nature of a DDOS attack is that it ebbs and flows, and by 5 a.m. on Aug. 19, several hours after the first thrust, the attack seemed to ebb with the countermeasures of Ziggo and Liberty engineers. Liberty executives breathed a moment of relief: Customers could be back online when they awoke.

The DDOS attack had not been so unique or complex, so why had the network become so suddenly vulnerable?

While the tech teams were puzzled at first, they soon realized the cause. Despite defenses that Liberty Global had in place, the firewalls in front of newly acquired Ziggo’s DNS servers had not been set up according to Liberty Global standards, and had collapsed. Firewalls prevent routine unauthorized access, but not the kind of voluminous attacks of the sort that targeted Ziggo.

Moreover, the attackers had caught Liberty at its weakest moment — in the middle of migrating an entire network. As the DDoS attack ebbed, Liberty and Ziggo engineers were left chewing on a tough question: how to instantly migrate Ziggo’s network into Liberty’s — usually a months-long task with tests, changes and documentation required — in one day.

The engineers hatched an audacious scheme. Senior managers, confident the team could execute, approved the plan instantly.

“They said, ‘You know what you need to do — do it,’ ” said Kick Fronenbroek, a senior security specialist for Liberty Global.

At some point on the second day, another threatening YouTube video surfaced. This one was more specific, and raised questions about the attacker’s true identity. Posted by someone ominously dubbed “AnonNazi,” it featured a crudely drawn, green, animated, hooded character with a synthesized voice, emblazoned with a banner with swastika icons.

The voice claimed full credit for the earlier attack, dismissing Anonymous. “Some other people are claiming it was Anonymous, but it was not. We attacked the DNS service because of the bad service that Ziggo provides …” AnonNazi boasted.

His next utterances were pointed.

“Because of bad service we want you to pay all of the customers all of their money back for about one week. If you don’t accept this, we will continue with more powerful attacks,” the voice threatened. “You have been warned.”

The question burning on everyone’s mind: if this wasn’t the real Anonymous, who in the hell had just brought down service to nearly 2 million homes? Executives at Ziggo and Liberty were baffled.

Around 4 p.m. on that second day, Aug. 19 — after the first attack, and before the migration of the network — there was another, more ferocious assault using a different entry method.

Again, consumers and businesses across the country were digitally stranded with no broadband service. In just 24 hours, the national network had absorbed two unprecedented cyberattacks. “We had outages before, but this is the first big one we had,” Kurup said. “Nothing like it before.”

That roughly 2 million customers were without broadband (TV service worked fine) was enough. But the self-proclaimed attackers, AnonNazi, took to social media to pour salt in the wound: Liberty stood helpless — for the moment — as a second wave of digital torpedoes directed by the same hackers penetrated the bulkheads.

“We now understand the weakness, but we also see that the system is allowing it to happen,” Kurup said. “We knew we could fix this problem.”

The crisis was escalating. On YouTube, Ziggo was threatened with new attacks. At the same time, the attackers announced a new target, KPN, a Dutch telecommunications company.

The Dutch Ministry of Security and Justice called the attack “serious,” and Liberty executives called in the High-Tech Crime Unit of the Dutch Police Services Agency.

A growing team of technicians were tackling the DDOS attack, and by the evening on the second day, had counteracted the menace of the incoming traffic. The traffic issue was becoming more manageable.

By about 3 a.m. on Aug. 20 — about 50 hours into the attacks — engineers had redirected the flow of traffic, essentially by offloading it to island data centers.

Working around the clock, the teams had finally migrated the network and successfully updated defenses. All mitigation steps in Liberty’s elaborate security protocol were in place. Engineers at Ziggo and Liberty were content for the moment. The back window was shut.

Although the attackers had managed to inflict inconvenience, the company had reason to be proud of how it battled back. Its fast reaction preserved customers’ data and privacy, and minimized downtime for countless business and residential subscribers. An endto- end security plan made the attack manageable. And the incident left Liberty’s security team with invaluable battlefield experience.

As Liberty stated in its annual report, “the overload impacted 2.2 million customers, yet within 24 hours, our teams were moving 130,000 customers per hour to more resilient infrastructure. Two days later, full service was restored.”

Liberty now was intent on winning the war. Fearing further attacks as a result of the threats hurled over YouTube, Liberty didn’t just drop the matter, as many corporate hacking victims do. The company pressed a criminal investigation, beginning a cat and mouse game to track down the culprits, while bracing for more attacks.

But a strange thing happened — nothing.

Much to the bewilderment (and relief) of executives, no large-scale DDoS hacking attempts were detected in the system. The threatened deadline came and went. Ironically, the hacker’s inaction provided a major clue.

Serious hackers, not to mention ransomware, vow a certain time for an attack — and stick to it. That this code was not honored virtually confirmed suspicions that Anonymous wasn’t behind the attack.

A subsequent Twitter post by AnonOps, which claims to have ties to the actual group, echoed many social-media commenters: “DDoS on #Ziggo is not an #Anonymous operation.”

HACKER VS. HACKER

Then the manhunt took a bizarre turn for investigators: the groups claiming credit for the attack began to insult and threaten one another on social media.

Some dismissed the poster AnonNazi as a pretender. Another self-proclaimed hacker, AnonymousScruggs, claimed credit for the attacks on Ziggo.

“They were having turf wars,” said John Fokker, who, with Ton Maas led the digital team for the High Tech Crime Unit of the Dutch National Police. “Most [professional hackers] are discreet about how they approach the company. They don’t have a beef on Twitter.”

Days later, on Aug. 26, a video narrated by the synthesized voice of a faint image, hooded and tinted purple, and posted by “Code Red,” drew Liberty’s attention:

The hackers began to “dox” one another, an attack wherein all of a target’s personal documents (email addresses, phone numbers and bank accounts) are released on the Internet. On the Twitter account of AnonNazi, a post read simply, “This account has been compromised by @BOEFII.”

Said another post by @BOEFII under a story about the attack on a media website in the Netherlands:

“I would like to thank everyone who participated in helping me to dox every single person from Anon_Nazi. They are destroyed and they will never cause any harm to Ziggo again.”

Had a bunch of glory-hungry hackers claiming credit for the same crime just turned on one another — outing each other in the process?

Top engineers at Liberty were left scratching their heads.

In addition to the police, Liberty called in digital detectives from the National Cyber Security Centre, which collects data and advises organizations on security, and a rapid response team from Deloitte, which focused more on forensics.

Over the next several days, Liberty engineers began turning over discs of data to investigators. Digital detectives scoured social media for clues, conducted interviews and studied logs of interactions between the Liberty/Ziggo servers and outside computers. Investigators searched for patterns and addresses that matched the information they were gathering about the attackers.

As the digital dust settled, Liberty executives reviewed detection and prevention measures all across the Liberty Global footprint. “We had already sanitized the entire system,” said Kurup.

Chasing the digital breadcrumbs, the public claims of credit, and the battle between the hackers, Fokker and Maas moved quickly and made two arrests early on.

Six weeks after the initial attack, on Oct. 7, 2015, Dutch police arrested four minors between 14 and 17 years old and one 21-year-old. The boys come from Berkelland, Lochem, Den Helder, Schoorl and Vinkeveen.

Police seized computers, mobile phones, external hard drives and USB sticks. The young suspects “wanted to show they were capable of having a major effect such as taking down an Internet provider,” the National Prosecutor’s Office said in a statement to Dutch media.

Under Dutch penal code, the suspected hackers face up to two years for the DDoS attack. Because of the extortion threats, they face a maximum of an additional 12 years behind bars. A trial date has not been set, but because of the suspects’ age, leniency will be sought.

Today, the Liberty and Ziggo engineers are sensitive about the incident. “If the same cast of characters had done this anywhere else in our global footprint — Germany, France, Belgium — it wouldn’t have even caused an outage,” said Kurup. “We would have intercepted it. It would have been logged as a routine attack.”

Kurup hopes the apprehension of the hackers, which made big headlines in the Netherlands, deters others. But no matter — the incident has made the entire company more vigilant, and that’s a good thing.

“It’s a constant battle,” Kurup said.

STATE of CYBERSECURITY

500M

Number of accounts that Yahoo said hackers had accessed containing passwords and personal details in 2016.

SOURCE : Yahoo

129%

Increase in DDoS attacks in Q2 2016 vs. Q2 2015

SOURCE : Akamai State of the Internet Security Report, Q2 2016.

45%

Increase in 2015 of detected security incidents over the year before for telecommunications companies.

SOURCE : PWC, The Global State of Information Security Survey 2016. Based on responses of more than 10,000 CEOs, CFOs, CIOs, CISOs, CSOs, VPs, and directors of IT and security practices from 127 countries.

100M

Number of fake tech-support scams blocked by Symantec in 2015, whereby pop-up error alerts steer victims to an 800 number where “tech- support reps” sell services.

SOURCE : Symantec

39%

Percentage of companies that cited “budget” as the biggest barrier to adopting advanced security processes and technology.

SOURCE : Cisco 2015 Security Capabilities Benchmark Study

54%

Percentage of companies that cited malicious software downloads as the leading cause of internal breaches.

SOURCE : Cisco Systems, Security Risk and Trustworthiness Study

93%

Percentage of cases in which it took attackers “minutes or less” to compromise systems. Organizations, meanwhile, took weeks or more to discover that a breach had even occurred — and it was typically customers or law enforcement that sounded the alarm, not their own security measures.

SOURCE : Verizon 2016 Data Breach Investigations Report

65%

Percentage of respondents who collaborate to improve cybersecurity and reduce cyber-risks, up from 50% in 2013.

SOURCE : PWC The Global State of Information Security Survey 2016, based on responses of more than 10,000 CEOs, CFOs, CIOs, CISOs, CSOs, VPs and directors of IT and security practices from 127 countries

HACKING 101: HOW TO GET IN

Cybercrime is any criminal act involving a computer and/or a network. Hacking is the unauthorized access into a computer system. Crimes can take any form, from outright theft of data or funds, damage to a network or harm to a reputation. Increasingly, one of the weakest links in security is the employee. Most attacks on companies involve some sort of malware, a broad term for malicious code, including Trojans, worms and viruses that steal or destroy data, often introduced through emails, downloads or other network weak spots. Some common terms below:

• “Phishing” attempts involve official-looking emails tempting employees to click on a link that can trigger countless malware possibilities. (Spear phishers focus narrowly on a single company or individual.)

• Distributed Denial of Service (DDoS) attackers use multiple hijacked computers to push through a huge volume of traffic through the network until it becomes overwhelmed and no longer functions.

• Botnets, also known as “zombie armies,” are groups of infected computers controlled by third parties for DDoS attacks or for distributing other malware.

• Trojan attacks allow attackers to remotely steal data and manipulate the computer.

• Ransomware demands a ransom after blocking access to the computer by encrypting files on the hard drive.

• Spyware allows attackers to go undetected on infected computers to track users movements on the Internet, even keystrokes for theft of accounts, etc.

• Adware redirects users to unwanted advertising.

• SQL injection inserts a nefarious code in a website/’s entry field that allow attackers to manipulate or steal or destroy data.

Charter Communications said it has hired Jane Rhodes-Wolfe as group vice president, head of corporate security, where she will will oversee physical security matters for the company and manage Charter’s overall relationship with law enforcement.

Rhodes-Wolfe, who reports to Charter senior executive VP David Ellen, will be based out of the company’s Stamford, Conn., headquarters and also provide support for to executive management on cybersecurity matters, the company said.

Rhodes-Wolfe joins Charter following 20 years with the Federal Bureau of Investigation, where she most recently served as section chief, counterterrorism division.  During her time at the FBI, Rhodes-Wolfe also served in other leadership positions, including national programs dedicated to national security, criminal investigations, and technology systems.

“In this increasingly dangerous world, Jane’s proven leadership and experience make her the ideal candidate to lead the physical security strategies and programs at Charter and to maintain the critical law enforcement relationships that help keep our 90,000 employees safe,” said Ellen, in a statement.

Since retiring from the FBI earlier this year, Rhodes-Wolfe has worked as a consultant, lending her expertise in security, enterprise risk management and media relations to private and government clients, Charter said.

Rhodes-Wolfe holds a Bachelor's Degree in Accounting from Western Michigan University.

Comcast said it has opened the search for researchers and projects for the MSO’s Innovation Fund for 2016.

The fund, Comcast VP of Internet services Jason Livingood, noted in this blog post, applies a focus on broadband, security and open-source development.

During its history, Comcast’s Innovation  Fund (formerly called the Comcast Technology Research & Development Fund) has supported  62 projects from 10 countries, he noted. According to the 2015 annual report on the initiative, 19 grants were made last year for U.S.-based projects, and one each in France, Switzerland and Australia.

Livingood highlighted three 2015 projects in the post: The United States Telecommunications Training Institute’s (USTTI), which provides free information and communications technology (ICT) training to technology leaders in the developing world; TheFrench Institute for Research in Computer Science and Automation’s (INRIA), which researches advanced trouble-shooting tools for home networks; and Georgia Tech, which is working to develop better firewall tools to help users spot and avoid malicious Domain Name System (DNS) activity.

“We specifically designed the fund to be a resource for researchers working on smaller projects that may not qualify for larger grant programs,” Livingood wrote.

The fund as backed by a $1 million commitment from several groups within Comcast in 2014 and 2015, and that level has been renewed for 2016, according to the annual report. Grants range from $3,000 to $100,000 or more, depending on the size and scope of the project.

Looking ahead, Livingood said the Innovation Fund is particularly interested in supporting projects that create or advance important open-source projects; address critical cybersecurity threats and issues; advance the deployment and adoption of IPv6, DNSSEC, and DANE; identify performance bottlenecks and other issues in home networks; explore the performance and security-related issues in home networks; and advance understanding of the Internet of Things.

“We’ve begun funding projects for 2016, but still have a lot of opportunity to support good projects. And if we see a worthy project that we can’t fit in this year, we will put it up for consideration in 2017,” Livingood wrote. 

As an unsavory group, phishing, hacking and malware together comprised the number one cause of data security "incidents."

They caused 31% of all breaches, according to the second annual Data Security Incident Response Report from BakerHostetler, which analyzed more than 300 such incidents the law firm helped manage.

Rounding out the top five causes, in order, were employee actions/mistakes (24%), external theft (17%), vendor-related incidents (14%) and internal theft (8%). Just outside the top five, at 6%, was improper records disposal.

The study found that the average time between a breach and detection was in excess of two months (69 days), and in at least one case well more than a year. Almost a quarter (24%) of the breaches resulted in a regulatory inquiry, and litigation was begun in 6% of the cases.

More than half of the breaches (52%) were self-detected.