The latest edition of University or Maryland Baltimore’s Catalyst Magazine has a feature story on CHHS’ work on artificial intelligence (AI). The piece highlights our work with clients on adopting AI tools in building resiliency, as well as our academic and policy work.

By CHHS Extern Dominique Mendez

Americans rely on critical infrastructure entities such as telecommunications, transportation, energy, water, and wastewater systems. However, these sectors face the constant threat of undetectable cyberattacks capable of causing power outages and communications failures. In May 2023, the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Federal Bureau of Investigations (FBI) disclosed that “Volt Typhoon,” a People’s Republic of China (PRC) state-sponsored cyber actor, infiltrated the telecommunications, transportation, energy, water, and wastewater sectors using “KV Botnet malware” and remained undetectable in some networks for at least five years. Volt Typhoon targeted Cisco and NetGear routers that are no longer supported by their manufacturer’s security patches or software updates to fix vulnerabilities. The hackers gained access to Operational Technology (OT) and Informational Technology (IT) networks to exfiltrate credentials, ensure access to accounts, and maintain persistence on the network.

One technique Volt Typhoon relied on to infiltrate U.S. critical infrastructure is known as “Living Off The Land” (LOTL). LOTL utilizes built-in network administration tools to infiltrate victim organizations and hide malicious cyber activities from detection by blending Volt Typhoon’s commands with normal Windows systems and network activities. In one instance, the KV Botnet malware that Volt Typhoon transmitted encrypted traffic between infected routers to fabricate the hacker’s location and make it appear as if the hackers were operating directly from the infected router in the U.S. Furthermore, the malware downloaded a virtual private network (VPN) to some infected routers, creating a direct communication channel between the hackers and the victim’s network. The VPN served as an obfuscation technique, enabling hackers to connect to any router as an intermediate computer. This facilitated the hackers’ operational goals of gathering information about the target entity’s network architecture and operational protocols. For example, the hackers obtained initial access to an entity in the Water and Wastewater Systems sector by connecting to the network via a VPN with administrator credentials and preformed discovery, collection, and exfiltration of data. In this case, Volt Typhoon had access to water treatment plans, water wells, electrical substations, OT Systems, and network security systems. Once Volt Typhoon gains access to OT systems, the hackers can disrupt energy and water controls, access camera surveillance systems, cause failures in telecommunication and transportation systems, and manipulate heating, ventilation, and air cooling (HVAC) systems in server rooms. With full access to critical infrastructure OT networks, Volt Typhoon had the opportunity to disrupt critical infrastructure functions in the event of geopolitical tensions and/or military conflict in the Asia-Pacific region.

Fortunately, the FBI dismantled KV Botnet malware from infected routers nationwide. The FBI conducted a criminal investigation into Volt Typhoon’s violation of the Computer Frauds and Abuse Act, 18 U.S.C. § 1030(a)(5), where the hackers knowingly accessed a protected computer without authorization and caused the transmission of a program, information, code, or command, intentionally damaging the protected computer. On December 20, 2023, a U.S. magistrate judge granted a search warrant permitting the FBI to remotely access and search U.S.-based compromised routers and seize KV Botnet malware from each router. The FBI utilized the Botnet’s own communication protocols and simultaneously issued commands to each infected router, interfering with the hackers’ controls, halting the Botnet’s VPN process, and effectively deleting the malware on infected devices. The U.S. government has not made any arrests or issued indictments. However, FBI Director, Christopher Wray, emphasized concerns regarding the PRC’s hacking abilities at the Munich Cyber Security Conference last month:

“the Chinese government [] has continued to attack the economic security, national security, and sovereignty of rule-of-law nations worldwide. The cyber threat posed by the Chinese government is massive [and] is made even more harmful by the way the Chinese government combines cyber means with traditional espionage and economic espionage, foreign malign influence, election interference, and transnational repression. In other words, [China] is throwing its whole government at undermining the security of the rule-of-law world. It’s hitting us indiscriminately. Today, China’s increasing buildout of offensive weapons within our critical infrastructure, is poised to attack whenever Beijing decides the time is right.”

Although the FBI successfully discontinued Volt Typhoon’s operations, critical infrastructure sectors must continue taking steps to mitigate impending cyberattacks. CISA and the NSA released detailed recommendations to detect hackers on IT networks. CISA suggests critical infrastructure sectors should implement the following baseline protections:

• Hardening Volt Typhoon’s Attack Surfaces:
  • Apply patches for internet-facing systems and prioritize patching critical vulnerabilities in appliances known to be frequently exploited by Volt Typhoon (i.e. routers reaching end-of-life status).
  • Use third-party assessments to validate current system network security compliance.
  • Limit internet exposure of systems when necessary.
  • Maintain and regularly update inventory of all organizational IT assets.
• Reinforcing Security Measures for Credentials and Accounts:
  • Implement phishing-resistant multifactor authentication (MFA) and roll NTLM hashes of accounts that support token-based authentication.
  • Separate user and privileged accounts, consider using privileged access management (PAM) solution with role-based access control (RBAC).
  • Regularly audit all user, admin, and service accounts.
  • Use CISA’s SCuBAGear tool to discover cloud misconfigurations.

• Securing Remote Access Services:
  • Disable server message block (SMB) protocol version 1 and upgrade to version 3 (SMBv3).

• Implementing Routine Preventative Measures:
  • Ensure logging is turned on for application, access, and security logs and store longs in a central system.
  • Store logs in a central system which can only be accessed or modified by authorized, authenticated users.
  • Establish and continuously maintain a baseline of installed tools, software, account behavior, and network traffic.
  • Document a list of threats and cyber actors’ primary tactics, techniques, and procedures (TTP) relevant to your sector.
  • Implement periodic security training for all employees and contractors.

U.S. critical infrastructure remains vulnerable to cyberattacks. CISA’s recommendations can reduce prevailing cyber threats to infrastructure sectors and help disrupt Volt Typhoon and other malicious cyber actors from accessing critical infrastructure technologies. Cyberwarfare is just beginning. The U.S. and its allies must prepare for a rise in cyberattacks originating from authoritarian states such as the PRC, Iran, Russia, and North Korea.

By CHHS Extern Dallin Richardson

Those who are paying attention to Supreme Court current events know that following the oral argument in Loper Bright Enterprises v. Raimondo and its companion case, Relentless, Inc. v. Department of Commerce, the doctrine of Chevron deference is likely not long for this world. Chevron doctrine causes courts to yield to an executive agency’s reasonable interpretation of ambiguous statutory language, provided Congress has not weighed in on the precise issue in question. This doctrine is at the core of current administrative law and allows agency experts, specialized in their fields, to aid courts by virtue of their advanced technical acumen. An end to that “doctrine of humility” would place that interpretative power exclusively back in the hands of courts, although – as J. Kagan has said – “we know in our heart of hearts that . . . agencies know things that courts do not.” And as artificial intelligence continues to radically change the fabric of virtually every sector, the expertise which agencies bring to the table will be of ever-increasing importance as an aid in the interpretation of AI legal questions. Such agencies certainly have an advantage over the members of Congress: “Congress knows there are going to be gaps [in any future artificial intelligence legislation] because Congress can hardly see a week into the future with respect to [AI]”.

Looking toward the future and the unpredictable predicaments which AI is sure to cast upon the country, the core question may rather be posed this way, with some further help from Justice Kagan: Where should the balance of official interpretative weight lie? “. . . what Congress is thinking is, ‘Do we want courts to fill that gap? Or do we want an agency to fill that gap?’ When the normal techniques of legal interpretation have run out, on the matter of artificial intelligence, what does Congress want?”

It is a valid concern that, despite the woes of vacillating policy interpretation that some fear in handing the final word back to the courts, letting an executive agency dictate the final interpretation of ambiguous statutory language may have a similar vacillating effect, possibly changing every four to eight years. And of course, there is sure to be far from a uniform interpretive posture or access to expertise across US Circuit Courts. Further, although Justice Thomas now seems ready to sweep away the Chevron doctrine, in 2005 he expressed the majority opinion for National Cable v. Brand X that “agency inconsistency” is no reason to eliminate the Chevron framework.

Some would argue that it doesn’t matter what Congress wants, it matters what Article III of the Constitution says, which is that courts hold the judicial power and thus they alone handle interpretation of law. But proponents of Chevron deference would argue that the doctrine does not undermine judicial authority; rather, it guides a court in resolving legal disputes by deferring to an appointed agency who have both the needed expertise and democratic accountability to the public, making them much more reasonable decision makers in matters of technicality and scientific choice when compared to the hundreds of unelected, relatively inexperienced judges who would otherwise bear the burden.

It is important to remember that the true authority in these matters is Congress; Chevron deference arises only when congressional statutory intent is ambiguous. The guiding principle should always be congressional intent. In oral arguments for Relentless, Inc v. Department of Commerce, J. Kagan opined: “Congress knows that this court and lower courts are not competent with respect to deciding all the questions about AI that are going to come up in the future. And what Congress wants, we presume, is for people who actually know about AI to decide those questions. And also those same people who know about AI are people who . . . are accountable to the political process.”

Regardless of what Congress may or may not want for the future of AI and other legislation, the Court may be poised to speak for hundreds of lower courts across the country and make that decision for them. But how did it come to this? It bears repeating that Congress is the primary statutory authority and the first word on statutory interpretation. Congress could speak for itself and mandate specific interpretive construction. Congress could legislate interpretive authority either to agencies or to the courts. Though Congress cannot be expected to foresee the problems to which AI will give rise, is it unreasonable to expect Congress to tell us who gets to decide in a tiebreaker? Is it too much to ask Congress to indicate when they want a court to have the final word, and when, instead, the relevant agency should provide needed clarity?

By CHHS Extern Mercedes Subhani

On January 4^th, Microsoft announced that it was upgrading its cloud computing service to let European customers store all their personal data only within the European Union. Microsoft claims this move, that will affect Azure, Microsoft 365, Power Platform, and Dynamics 365, is directly aimed to ease customers’ privacy fears of having their information flow into the U.S. where a federal privacy law still doesn’t exist.

This fear of letting their personal data stored in the wild west of the U.S. stems from the Edward Snowden revelations that the American government eavesdropped on people’s online data and communications. Since then, the U.S. has been trying to convince the European Commission that EU citizens’ data will be kept safe. The U.S. was finally successful on July 10, 2023 when the EU adopted its adequacy decision for the EU-U.S. Data Privacy Framework (“Framework”). The EU’s decision “has the effect that personal data transfers from controllers and processors in the Union to certified organizations in the United Sate may take place without the need to obtain any further authorisation.” Despite this transatlantic agreement, Europeans are still not convinced that their data will be kept safe in the U.S. as demonstrated by Austrian privacy activist Max Schrems’ confirmation that his group NOYB will be pursuing legal challenge.

First, although the EU adopted the decision, there is no certainty that the Framework will survive a challenge before the Court of Justice of the European Union. The framework is predicted to be invalidated like its two predecessors was by Max Schrems in Schrems I and Schrems II. Thus, it is very likely that this newly founded EU-US agreement will be invalidated. Secondly, the U.S still does not have a federal data privacy law. The level of data privacy rights an American citizen has, if any, entirely depends on which state they live in. The strongest state privacy law the  U.S has is the California’s Consumer Privacy Act which is still not as protective as the EU’s General Data Privacy Rule. Therefore, not even in the most protective U.S. state can Europeans enjoy the same amount of privacy safeguards as they do in the European Union. Lastly, when the U.S. did try to pass a federal data privacy law, the American Data Privacy Protection Act (“ADPPA”), it still did not fix the root problem Europeans are concerned with which is the U.S. government eavesdropping on people’s online data and communications. ADPPA only targeted the private sector and exempted the public sector of any privacy constraints.

In the current court of public opinion, Europeans have ruled that they cannot trust the U.S. with their personal data. For right now, they are correct in deciding so. However, as Europe presses forward with data rights and the U.S. public grows more concerned about data privacy rights, more politicians will be pressured to respond adequately. We have seen this already with The White House mimicking Europe with its Blueprint for an AI Bill of Rights and how privacy activism organizations have pushed 12 states to pass state data privacy laws with several more states expected to pass their own law in 2024. Eventually, the U.S. will fully regain Europeans’ trust in the U.S with its data.