But industry orgs and government agencies say they've mounted additional digital defenses to address new threats posed to Covid-19 research specifically, and they've made some progress — although everyone agrees there's still a lot to fix. — Playing catch-up: "The health care sector, broadly, has really been an underperformer from a cybersecurity perspective," Bryan Ware, assistant secretary for cybersecurity at CISA, told MC. Health care had the most breaches by industry in 2019, according to a Verizon report. Cyber firm RSA wrote last month that the sector relies on older IT systems and hasn't made cybersecurity a priority. While the picture isn't as dire for universities , they have "a bit of a different challenge," Ware said. "The university model is to be very open and transparent and to share and collaborate," he said, and adversaries can exploit that openness. In 2018, for example, prosecutors said Iranian hackers primarily seeking to steal research made off with at least 31 terabytes of data from 144 American universities, and broke into 176 foreign universities. Verizon's 2019 report said that despite some improvements in higher education, "the news still isn't great." Researchers defend their defenses. The health care sector has been improving on cybersecurity as it becomes aware of more threats, said John Riggi, senior adviser for cybersecurity and risk at the American Hospital Association. In education,"data has to be made public, but it's made public at a certain time on certain servers, but not in a way that should open you up to cyberattack," said Toby Smith, vice president for policy at the Association of American Universities. — The threat now: Some have questioned whether it would be so bad if China or Russia hacked U.S. Covid-19 research. Riggi answered: "If an adversarial nation steals U.S. Covid-19 vaccine research and develops it on their own, there's no guarantee that they would make it available to us." And it's not just hypothetical. Federal prosecutors in July charged two Chinese men with hacking hundreds of companies in the U.S. and elsewhere, as well as targeting three U.S. firms researching the coronavirus. Hackers are reportedly leaning on known, unpatched vulnerabilities to try to break into Covid-19 research companies and institutions. — What's been done, and what more is needed: In addition to public warnings and prosecutions, feds have offered classified and unclassified briefings to research institutions. Since March, CISA has increased network scanning of enlisted health care entities by 70 percent, Ware said, while noting that they're patching faster than other industry sectors. Riggi's association has also held briefings on the threat to hospitals during the pandemic. Smith's association updated its list of ideal actions to improve research cybersecurity as recently as May. Universities want the government to share more threat information they can act on, Smith said, but also said he'd like to see universities train faculty better on cybersecurity fundamentals. Riggi said Congress could help as well by passing legislation introduced this summer that's designed to crack down on foreign nations' theft of U.S. taxpayer-funded research. BIDEN, HARRIS SOUND RUSSIA ALARMS — Biden and his Democratic running mate Sen. Kamala Harris (Calif.) warned of Russian election interference over the weekend, even as top Trump administration officials — in contrast with U.S. intelligence statements — touted China as the greater election threat. Harris told CNN on Sunday that she believed Russian meddling could "theoretically" cost Democrats the election. Biden had emphasized Russia earlier. "There are a lot of countries around the world I think would be happy to see our elections destabilized," Biden said at a news conference on Friday. "But the one who's working the hardest most consistently and never has let up is Russia." He singled out Attorney General William Barr for contradicting the briefings Biden said he'd received. SCHIFF DRAWS A LINE — In what is likely a precursor to a subpoena, House Intelligence Chair Adam Schiff (D-Calif.) on Friday demanded that senior clandestine community officials participate in a classified briefing on election security next week. In a letter to Director of National Intelligence John Ratcliffe, Schiff requested that officials from the NSA, CIA, FBI and DHS participate in the session, adding that he "expects" National Counterintelligence and Security Center chief Bill Evanina and Shelby Pierson, the intelligence community's election security czar, to attend as well. An ODNI spokesperson declined to comment. Ratcliffe last month informed congressional committees that in-person briefings on election security would no longer take place in order to avoid leaks. Instead, lawmakers would receive written "intelligence products." However, Senate Intelligence Committee Chairman Marco Rubio (R-Fla.) last week said he expected to continue to receive in-person briefings. On Sunday, Schiff accused Attorney General William Barr of lying when he said China posed the greatest threat to the 2020 election. "That's just a plain false statement by the attorney general, a flat-out false statement," he said in an interview with CNN. "What Bill Barr just did in that statement was just flat-out mislead the American people." |