Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

Show NLP summaries collection recirc on article pages

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Did Obamacare ‘massively’ increase the cost of health care?

Why Donald Trump ended up praising Hollywood’s most famous cannibal

Biden seeks to put focus on health care, infrastructure

In photos: The scene in Indonesia after flash floods and cold lava killed at least 44 people

Can you spot bad financial advice on TikTok? Take our quiz.

Trump insults N.Y. case prosecutor at Jersey Shore rally

No, Apple, people do not want tech to crush everything in its path 

The urgent air defense lessons of April 16 

Are smartphones destroying childhood? It’s complicated.

Miss Manners: Should I accept offered seat swaps when I’m flying for free?

Ask Amy: Dad hurt by daughter publicly reconnecting with her biological family

Carolyn Hax: What’s the real cost of going halfsies on a modest engagement ring?

5 myths about Social Security as the program faces a funding crisis

Social Security has to be fixed. But you still need your own savings.

Pentagon worried its primary satellite launcher can’t keep pace

U.S.-China talks on AI risks set to begin in Geneva

Web publishers brace for carnage as Google adds AI answers

Rare collection of ancient coins, locked away for 100 years, heads to auction

Why Spain will recognize a Palestinian state

Middle East conflict live updates: Israeli forces advance in Rafah; Health Ministry says Gaza hospital system will collapse in hours

Retired cop meets abandoned baby he helped 23 years ago: ‘What are the odds?’

I used to dismiss my mom’s advice. Then I found a note she wrote before she died.  

Photos of his mom at lunch are a balm people didn’t know they needed

RFK Jr.’s ‘history lesson’ on Russia’s invasion of Ukraine flunks the fact test

The Trump-Biden battle over the 2017 tax cut

Wizards just miss No. 1 pick again but land top consolation prize this time

Eighth-inning decision burns the Nats in a 4-2 loss to the Red Sox

The Wizards will pick second in the NBA draft. Here’s whom they could take.

Pete Buttigieg’s view from the middle seat

The case for eating at Italian gas stations

5 big travel lessons from an accomplished conservationist

US President Joe Biden Departure

See more coverage in your recommendations

Get the weekly Campaign Moment newsletter

Set alerts for major election developments

Election 2024

The Campaign Moment newsletter

Politics alerts

Welcome to The Cybersecurity 202! We’re taking a brief break here and returning on Wednesday. In the meantime, keep enjoying the temporary lifting of The Post’s paywall. You can even read stuff I wrote there, including <a href="https://www.washingtonpost.com/national-security/2023/01/05/biden-cyber-strategy-hacking/">early exclusive details about the Biden administration’s national cybersecurity strategy</a> that I provided alongside Ellen Nakashima and a story with Karen DeYoung about some of the documents in the Discord leaks regarding <a href="https://www.washingtonpost.com/national-security/2023/04/15/united-nations-leaked-documents/">spying on the United Nations’ secretary general</a>.

Reading this online? <a href="https://www.washingtonpost.com/newsletters/the-cybersecurity-202/">Sign up for The Cybersecurity 202 to get scoops and sharp analysis in your inbox each morning.</a>

Below: Kazakh authorities detain a Russian cyber expert, and a university health system claims its cyber insurance policy was not honored. First:

SEC action sends ripples over CISO accountability for data breaches

Andrew Harnik

SolarWinds recently disclosed that the Securities and Exchange Commission notified top executives of pending legal action over the company’s landmark data breach — a step that some have described as unprecedented.

That’s because the company’s chief information security officer is among those who received a notice, “likely the first time a CISO has ever received one of these,” Jamil Farshchi, CISO at Equifax, <a href="https://www.linkedin.com/posts/jamilfarshchi_technology-cybersecurity-riskmanagement-activity-7079075622831984640-5F7G/?utm_source=share&amp;utm_medium=member_desktop">said on LinkedIn</a>.

By sending the so-called Wells notices, which notify recipients of the commission’s possible intent to bring charges against them, the SEC has stirred up some anxiety in the cybersecurity field.

SolarWinds itself has said that “any potential action will make the entire industry less secure by having a chilling effect on cyber incident disclosure.”

“Though it doesn’t mean that the CISO has been charged, it is a new milestone,” Agnidipta Sarkar, a former CISO of pharmaceuticals company Biocon, told <a href="https://www.csoonline.com/article/643618/sec-notice-to-solarwinds-ciso-and-cfo-roils-cybersecurity-industry.html">Apurva Venkat at CSO Online</a>. “From today onwards, CISOs will increasingly be made accountable for the decisions they take or did not take.”

SolarWinds said in an <a href="https://www.sec.gov/ix?doc=/Archives/edgar/data/0001739942/000173994223000079/swi-20230623.htm">SEC filing</a> last week that its CISO and chief financial officer, Tim Brown and Barton Kalsu, received the notices, which the company said were sent to “current and former executive officers and employees.”

The notices — which come around two-and-a-half years after the discovery of the SolarWinds breach — are the latest action by regulators in the wake of the massive SolarWinds hack.

The SolarWinds breach, which was discovered in late 2020 but which the company has said might have begun as early as January 2019, affected at least nine federal agencies and more than 100 companies, <a href="https://www.theverge.com/2021/2/18/22288961/solarwinds-hack-100-companies-9-federal-agencies">according to the White House</a>.&nbsp;

“The cybersecurity breach of SolarWinds’ software is one of the most widespread and sophisticated hacking campaigns ever conducted against the federal government and private sector,” as <a href="https://www.gao.gov/blog/solarwinds-cyberattack-demands-significant-federal-and-private-sector-response-infographic">the Government Accountability Office described it</a>.

The hackers compromised an update to the company’s Orion IT management platform, giving them remote access to infected computers. The U.S. government has <a href="https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-agencies-and-a-top-cyber-firm/2020/12/13/d5a53b88-3d7d-11eb-9453-fc36ba051781_story.html">identified Russia’s SVR intelligence agency</a> as the responsible party.

<a href="https://www.darkreading.com/application-security/solarwinds-faces-potential-sec-enforcement-act-over-orion-breach">SolarWinds said</a> in <a href="https://www.sec.gov/ix?doc=/Archives/edgar/data/1739942/000173994222000091/swi-20221028.htm">an October SEC filing</a> that the commission had sent a Wells notice to the company. Then, last week, Sean Lyngaas of CNN <a href="https://www.cnn.com/2023/06/23/tech/solarwinds-chief-sec-wells-notice/index.html">wrote about an internal email</a> CEO Sudhakar Ramakrishna sent in which he said that “if the SEC does ultimately decide to initiate any legal action, we intend to vigorously defend ourselves.” Cybersecurity journalist Kim Zetter <a href="https://zetter.substack.com/p/sec-targets-solarwinds-ciso-for-possible">published the letter</a> on her Zero Day Substack.

A spokesperson for the SEC said the agency “does not comment on the existence or nonexistence of a possible investigation,” David Jones wrote for Cybersecurity Dive.

The SolarWinds disclosures follow closely behind <a href="https://www.washingtonpost.com/technology/2023/05/04/sullivan-sentencing-uber-executive/">last month’s sentencing</a> of Uber’s former chief security officer, Joseph Sullivan, for covering up a 2016 cyberattack on the company. That conviction, too, was unprecedented and <a href="https://www.washingtonpost.com/technology/2022/10/05/uber-obstruction-sullivan-hacking/">caused alarm in the cybersecurity world</a>.

The Wells notices have prompted a lot of speculation about what’s behind the move.

The notices are usually sent to executives over Ponzi schemes, accounting fraud and market manipulation, Equifax’s Farshchi wrote.

A violation that might fit in this case is a “[f]ailure to disclose material information,” he said. “Things like failing to disclose the gravity of an incident … or failing to do so in a timely manner, could conceivably fall into this category,” Farshchi wrote.

“But *if* this is about disclosure, it shows the SEC isn’t sitting around waiting for cyber regs to be issued,” he wrote (emphasis his). “They’re taking action today.” (The SEC has been expanding cybersecurity regulations within the financial services sector.)

It does look like an emerging trend, said Shawn Tuma, co-chair of the data privacy and cybersecurity practice at Spencer Fane.

“The law evolves in incremental steps and, in my opinion, what this shows is a very early in developing — yet consistent — trend toward trying to name and hold individuals responsible for cybersecurity failures in companies, and it seems the CISO will be at the top of the list,” Tuma <a href="https://www.secureworld.io/industry-news/wells-notice-solarwinds-ciso">said in a story</a> by Cam Sivesind at Secureworld.

SolarWinds has already suffered in the pocketbook as a result of the attack, estimating that the fallout would <a href="https://www.reuters.com/technology/solarwinds-says-dealing-with-hack-fallout-cost-least-18-million-2021-04-13/">cost it nearly $20 million</a>. It also is <a href="https://fedscoop.com/solarwinds-agrees-to-pay-26m-to-settle-shareholder-lawsuit-over-2020-cyberattack/">paying $26 million</a> in a settlement from a shareholder lawsuit.

Mark Rasch, a former Justice Department prosecutor who is now an attorney with Kohrman Jackson and Krantz, said the SEC moves reflect an understanding that massive breaches can affect a company’s value or stock price.

“The SolarWinds breach, like the Colonial Pipeline attack, are systemic and endemic attacks that don’t just impact those companies,” Rasch told Zetter. “They impact entire sectors. When you are a company where a breach can impact that much of the population, you have to do a better job.”

Correction: A previous version of this newsletter had an incorrect first name for Tim Brown. This version has been updated.

Kazakh authorities detain Russian cybersecurity expert wanted in U.S., Moscow

Samuel Corum

Kazakhstan has detained a Russian cybersecurity expert who is wanted in both the United States and Russia, <a href="https://www.reuters.com/world/kazakhstan-detains-russian-cyber-expert-wanted-by-both-washington-moscow-2023-06-28/">Reuters reports</a>, citing the detainee’s employer.

“Nikita Kislitsin, an employee of Russian cybersecurity firm F.A.C.C.T., was detained on June 22 and Kazakh authorities are considering Washington’s extradition request,” Reuters wrote, citing a statement from F.A.C.C.T. “It said the accusations against Kislitsin, which it did not spell out, stemmed from his time as a journalist and independent researcher. It gave no further details.”

Kislitsin is a former editor in chief of Russian magazine “Hacker.”

F.A.C.C.T. is a spinoff of cybersecurity firm Group-IB, which finalized its exit from Russia in an effort to focus on non-Russian markets, according to a <a href="https://www.group-ib.com/media-center/press-releases/group-ib-exits-russia/">company announcement</a> in April.

“Separately, Russia’s Vedomosti newspaper said Moscow court arrested Kislitsin in absentia on charges of unauthorised access to digital information, and that Russia would seek his extradition,” the report adds.

University of California sues insurance syndicates that allegedly refused to honor policy after cyber incident

Reed Saxon

The University of California sued various companies operating through the Lloyd’s of London’s insurance marketplace, alleging they refused to provide payouts on cyber insurance policies taken out following a data breach of its health system nearly 10 years ago, <a href="https://www.wsj.com/articles/university-of-california-sues-lloyds-syndicates-over-cyber-insurance-da4675f5?tpl=cs&amp;mod=hp_lead_pos1">James Rundle reports for the Wall Street Journal</a>.

“The university’s board of directors, known as the regents, filed suit in the Superior Court for the State of California … claiming the school should have been covered by policies purchased before the incident,” Rundle writes.

“The regents allege the syndicates have refused to engage in dispute resolution by asserting that the statute of limitations applying to the claims had expired,” the report adds.

Lloyd’s didn’t respond to the Wall Street Journal’s request for comment. The University of California declined to comment to the outlet.

Data on 4.5 million patients was exposed in the UCLA Health system breach, which was first detected in 2014 and later <a href="https://www.latimes.com/business/la-fi-ucla-medical-data-20150717-story.html">disclosed in 2015</a>. Multiple lawsuits ensued; they were settled by UCLA Health in 2019 for $7.5 million.

The university filed insurance claims to recoup expenses related to providing identity protection for victims, but the “insurers, which the regents said they couldn’t name in the complaint, have refused every claim, saying that UCLA Health failed to satisfy cybersecurity requirements under the contract terms,” Rundle writes.

It’s been a busy few months in cyberinsurance news. A New Jersey appellate court in May <a href="https://news.bloomberglaw.com/business-and-practice/merck-cyberattack-isnt-warlike-action-under-nj-insurance-law">rejected several insurance groups’ argument</a> that pharma giant Merck suffered a cyberattack under warlike conditions, allowing the company to receive insurance payouts in connection to the 2017 NotPetya malware attack.

2,700 swindled into cybercrime syndicates rescued in Philippines

Jam Sta Rosa

Police and commandos in the Philippines launched a massive raid this week to rescue some 2,700 workers who were allegedly duped into providing labor for fraudulent video game sites and related cybercrime groups, <a href="https://apnews.com/article/philippines-cybercrime-raids-china-indonesia-malaysia-vietnam-de16f11954700ffd432377267f571892">the Associated Press reports</a>.

“Brig. Gen. Sydney Hernia, who heads the national Philippine police’s anti-cybercrime unit, said police … rescued 1,534 Filipinos and 1,190 foreigners from at least 17 countries, including 604 Chinese, 183 Vietnamese, 137 Indonesians, 134 Malaysians and 81 Thais. There were also a few people from Myanmar, Pakistan, Yemen, Somalia, Sudan, Nigeria and Taiwan,” the report says, describing what is the largest rescue raid so far this year.

Cybercrime scam operations have become commonplace in strife-torn nations in Asia as workers are forced into carrying out scams across the internet.

“Some of the workers told investigators that when they tried to quit they were forced to pay a hefty amount for unclear reasons or they feared they would be sold to other syndicates, police said, adding that workers were also forced to pay fines for perceived infractions at work,” the report says.

The Association of Southeast Asian Nations in May agreed to <a href="https://apnews.com/article/asean-myanmar-human-trafficking-6d8d9b1c32cf4ed82edec79523db30e3">shore up efforts</a> against cross-border crime syndicates.

<a href="https://www.bloomberg.com/news/articles/2023-06-28/us-health-department-ensnared-by-moveit-hacking-campaign" target="_blank">U.S. Health Department ensnared by MOVEit hacking campaign (Bloomberg News)</a>

<a href="https://therecord.media/cyber-command-under-advisement-team-cyberthreat-collaboration" target="_blank">Cyber Command to expand 'canary in the coal mine' unit working with private sector (The Record)</a>

<a href="https://techcrunch.com/2023/06/28/uspto-trademark-data-api-leak/" target="_blank">U.S. Patent and Trademark Office notifies filers of years-long data leak (TechCrunch)</a>

<a href="https://www.reuters.com/business/top-manager-us-firm-privately-sold-high-tech-russia-2023-06-28/" target="_blank">Top manager at U.S. firm privately sold high tech in Russia (Reuters)</a>

<a href="https://www.wsj.com/articles/chinese-balloon-used-american-tech-to-spy-on-americans-2e3f5039" target="_blank">Chinese balloon used American tech to spy on Americans (Wall Street Journal)</a>

<a href="https://www.infosecurity-magazine.com/news/andariels-mistakes-uncover-new/" target="_blank">Andariel’s mistakes uncover new malware in Lazarus Group campaign (Infosecurity Magazine)</a>

<a href="https://www.al-monitor.com/originals/2023/06/uae-israel-launch-global-initiative-fight-cyberattacks" target="_blank">UAE, Israel launch global initiative to fight cyberattacks (Al-Monitor)</a>

<a href="https://www.lemagit.fr/actualites/366543032/Olsztyn-Pologne-premiere-Smart-City-touchee-par-une-cyberattaque" target="_blank">Olsztyn, Poland: When a cyberattack derails the smart city (LeMagIT)</a>

<a href="https://www.cbc.ca/news/business/indigo-earnings-cyberattack-1.6891154" target="_blank">Indigo lost $50M last year, in large part due to February cyberattack (CBC News)</a>

<a href="https://arstechnica.com/security/2023/06/casualties-keep-growing-in-this-months-mass-exploitation-of-moveit-0-day/" target="_blank">Casualties keep growing in this month’s mass exploitation of MOVEit zero-day (Ars Technica)</a>

<a href="https://thehill.com/policy/cybersecurity/4069890-hackers-say-texas-city-website-targeted-over-state-law-on-gender-affirming-care/" target="_blank">Hackers say Texas city website targeted over state law on gender-affirming care (The Hill)</a>

<a href="https://www.theverge.com/2023/6/28/23776263/1password-family-account-app-management-ios-android-macos-windows" target="_blank">You can now manage 1Password family accounts via its apps (The Verge)</a>

<a href="https://arstechnica.com/information-technology/2023/06/fears-grow-of-deepfake-id-scams-following-progress-hack/" target="_blank">Fears grow of deepfake ID scams following Progress hack (Ars Technica)</a>

<a href="https://www.nytimes.com/2023/06/28/technology/facial-recognition-shoplifters-britain.html" target="_blank">Barred from grocery stores by facial recognition (New York Times)</a>

Former congressman John Katko (R-N.Y.) has registered to lobby for information security company SecurityScorecard, <a href="https://www.legistorm.com/directLink/downloadLobbyFiling/id/1777674.html">Legistorm’s Keturah Hetrick reports.</a> Katko, the former chairman of the House Homeland Security Committee, works at lobbying firm HillEast Group.

Former undersecretary of defense for intelligence Michael Vickers <a href="https://www.insaonline.org/detail-pages/event/2023/06/29/default-calendar/coffee-and-conversation-with-the-hon.-michael-vickers">speaks at</a> the Intelligence and National Security Alliance at 9 a.m.

Air Force CTO Jason Bonci speaks at a MeriTalk event on <a href="https://www.meritalk.com/event/dod-icam-il5-mission-critical-cloud-security/">cloud security</a> at 1 p.m.

Thanks for reading. See you next week.

2022 American Society of Business Publication Editors, Bronze National Award, Government Coverage

2022 American Society of Business Publication Editors, Silver Regional Award, Government Coverage

2022 American Society of Business Publication Editors, Bronze Regional Award, Single Topic Coverage by a Team

2022 Society of Professional Journalists Washington, D.C., Chapter, Finalist, Staff

2021 Best in Business Awards, Honorable Mention, Technology, Small Division (for editing role)

2009 National Press Club Sandy Hume Memorial Ward for Excellence in Political Journalism

2001 Indiana Associated Press Managing Editors, 1st Place, Non-Deadline News Reporting (with another reporter)

2001 Hoosier State Press Association, 3rd Place, Business Writing (team project)

University of Southern Indiana, BA in Print Journalism

Tim Starks is the author of the Cybersecurity 202 newsletter at The Washington Post. He previously served as senior editor at CyberScoop and ran Politico's cybersecurity newsletter. The Evansville, Ind., native also has held reporting roles for CQ Roll Call, the New York Sun and the Evansville Courier & Press.

Tim Starks

George Washington University, BBA in business analytics

Georgetown University, MS in business analytics

David DiMolfetta researches The Cybersecurity 202 and The Technology 202, the morning newsletters at The Washington Post keeping readers up to date on cybersecurity and technology policy.

David DiMolfetta

washpost

The Washington Post

Virus Outbreak Hotel Companies SEC

name

prism://prism.query/site-and-tag,/politics/powerpost,cybersecurity202&limit=20

Your daily guide to cybersecurity news and policy, by reporter Joseph Marks.

The Cybersecurity 202

A newsletter briefing on cybersecurity news and policy.

https://newsletter-imgs.s3.amazonaws.com/prod/the-202s/primary/cybersecurity.svg

https://newsletter-imgs.s3.amazonaws.com/prod/the-202s/secondary/cybersecurity.svg

Your daily guide to cybersecurity news and policy, by reporter Tim Starks.

prism://prism.query/site,/us-policy/cybersecurity-policy&limit=20

Cybersecurity Policy

prism://prism.query/site,/politics/powerpost&limit=20

The 202s

The 202s - The Washington Post

PowerPost, by The Washington Post, delivers essential intelligence for D.C. decision-makers.

THE 202s

/politics/powerpost/the-cybersecurity-202

The Cybersecurity 202;Cybersecurity Policy;THE 202s