Cyber Week in Review: November 20, 2020

Editor's note: There will be no Week in Review next week in observance of the U.S. Thanksgiving holiday. We will publish the next Week in Review on December 4.

Asia Forms RCEP Trade Bloc

On Sunday, fifteen Asia-Pacific countries signed the Regional Comprehensive Economic Partnership (RCEP) agreement, creating a trade bloc that includes a third of global GDP and population. In addition to removing tariffs and encouraging greater cross-border investment in critical industries such as telecommunications, the deal, which had been under negotiation since 2013, aims to promote e-commerce standards regarding data privacy and consumer protection. Stuart Tait, who leads commercial banking for HSBC’s Asia-Pacific operations, described RCEP as a commitment to “power global economic growth and pull the economic center of gravity towards Asia.” Notably excluded from the trade bloc is the United States. The Trump administration’s aversion to multilateral agreements was made clear in 2017 when the president withdrew the United States from negotiations over a similar Asia-Pacific trade partnership, then known as the Trans-Pacific Partnership (TPP).

U.S. Military Buys Location Data Originating From Apps

On Monday, Vice reported that U.S. Special Operations Command, which oversees counterterrorism efforts by the U.S. military, purchased data from a pair of data broker startups, X-Mode and Babel Street. The firms sell location information gathered from smartphone apps. Although both startups claim to anonymize or otherwise privatize the data, a former employee suggested that the data alone "could absolutely deanonymize a person." The Pentagon has previously used cell-phone tracking and location data to inform drone strikes, but the data purchased from the two firms has not been tied to any specific military operations. Customs and Border Protection and Immigration and Customs Enforcement are also customers of Babel Street. Mark Tallman, an assistant professor at the Massachusetts Maritime Academy, noted that X-Mode and Babel Street’s data has uses far beyond American military operations: “It is practically certain that foreign entities will try to leverage (and are almost certainly actively exploiting) similar sources of private platform user data. I think it would be naïve to assume otherwise.”

Huawei to Sell Honor Business

On Tuesday, citing “tremendous pressure” resulting from the “unavailability of technical elements needed for our mobile phone business,” Huawei announced plans to sell its budget smartphone brand, Honor, to a consortium of private and government-backed Chinese buyers. Given that Huawei was blocked from the U.S. market in connection with its telecoms-equipment business, and not its smartphone business, the newly independent Honor is expected to regain access to American suppliers. Huawei, meanwhile, will focus on its higher-end brand products. Nicole Peng, a technology analyst at Canalys, said “I think the immediate benefit is to give themselves more breathing room and keep the phone business afloat, especially in China.”

CISA Director Chris Krebs Fired

On Tuesday, President Trump fired Christopher Krebs, director of the Cybersecurity and Infrastructure Security Agency (CISA), citing an allegedly “highly inaccurate” statement that claimed “there is no evidence that any voting system deleted or lost votes, changed votes, or was in any way compromised.” Under Krebs’ leadership, CISA was widely credited for successfully addressing many of the vulnerabilities affecting U.S. election infrastructure. Krebs spearheaded efforts to deter foreign election interference, encouraged cooperation between states and the federal government, and created a “Rumor Control” page on CISA’s website that repeatedly refuted false claims of election fraud. News of his dismissal was met with praise for Krebs’ work in the information security community and disapproval from some on Capitol Hill. Senator Angus King (I-VT), for example, warned that firing Krebs would leave the United States vulnerable to foreign interference aiming to undermine faith in the democratic process, “CISA’s job is not done. We’re in a very dangerous period.”

Canada Calls Out China, Russia, Iran and North Korea 

On Wednesday, Canada’s Communications Security Establishment (CSE) reported that state-sponsored hacking programs in China, Russia, Iran, and North Korea posed threats to Canadian critical infrastructure. Citing the increase of manufacturing and industrial processes connected to the internet, Scott Jones, who leads cybersecurity at CSE, acknowledged that state-sponsored hackers are potentially capable of the “shutting off of transmission lines” or “opening circuit breakers, meaning electricity simply won't flow to our homes to our business.” The report noted that Russian hackers had already probed Canadian power grids in 2019. In addition to publicly naming the four nations as cybersecurity threats for the first time, CSE is currently considering whether to permit Huawei equipment in Canada’s 5G networks.