The U.S. government on Wednesday announced the formation of a
new Civil Cyber-Fraud Initiative that aims to hold contractors
accountable for failing to meet required cybersecurity requirements
in order to safeguard public sector information and
infrastructure.
“For too long, companies have chosen silence under the mistaken
belief that it is less risky to hide a breach than to bring it
forward and to report it,” said[1]
Deputy Attorney General Monaco in a press statement. “Well that
changes today, [and] we will use our civil enforcement tools to
pursue companies, those who are government contractors who receive
federal funds, when they fail to follow required cybersecurity
standards — because we know that puts all of us at risk.”
To that end, the government intends to utilize the False Claims
Act (FCA[2]) to go after contractors
and grant recipients for cybersecurity-related fraud by failing to
secure their networks and notify about security breaches
adequately.
The Civil Cyber-Fraud Initiative is part of the U.S. Justice
Department’s (DoJ) efforts to build resilience against
cybersecurity intrusions and holding companies to task for
deliberately providing deficient cybersecurity products or
services, misrepresenting their cybersecurity practices or
protocols, or violating their obligations to monitor and report
cybersecurity incidents and breaches.
In addition, the DoJ also announced the launch of a National
Cryptocurrency Enforcement Team (NCET[3]) to dismantle criminal
abuse of cryptocurrency platforms, particularly focusing on “crimes
committed by virtual currency exchanges, mixing and tumbling
services, and money laundering infrastructure actors.”
The developments also come nearly a week after the U.S. Federal
Communications Commission (FCC) laid out new rules[4]
to prevent subscriber identity module (SIM) swapping scams and
port-out fraud, both of which are tactics[5]
orchestrated[6]
to transfer users’ phone numbers and service to a different number
and carrier under the attacker’s control.
The FCC’s proposal would require amending existing Customer
Proprietary Network Information (CPNI) and Local Number Portability
rules to mandate wireless carriers to adopt secure methods of
confirming the customer’s identity before transferring their phone
number to a new device or carrier. On top of that, the changes also
suggest requiring providers to immediately notify customers
whenever a SIM change or port request is made on their
accounts.