Senator probes DOJ's safeguarding of hacking tools

The ransomware attack on the city of Baltimore has reignited a long-running debate about whether the National Security Agency is doing enough to protect the hacking tools and exploits it develops. Now, a Democratic senator is sniffing around to see if the same concerns exist at other federal agencies.

In a June 5 letter, Sen. Ron Wyden (D-Ore.) asked Attorney General Bill Barr what the Department of Justice and its component agencies are doing to keep their tools from being leaked or stolen, as the NSA's were in 2016 when a mysterious group known as the Shadow Brokers published them on the open internet.

"Just as the American people expect the government to protect its nuclear, chemical and biological weapons, so too do Americans expect that the government will protect its cyber arsenal from theft by hackers and foreign spies," Wyden wrote.

The senator referenced a number of public reports documenting DOJ and component agencies' use of such tools, from purchasing communications monitoring software from an Italian surveillance company and exploiting security vulnerabilities in the Firefox web browser to install malware on at least 8,000 computers in 2015 to the FBI using third-party hacking tools to break into iPhones and other encrypted devices during criminal investigations.

Wyden asked Barr if any of DOJ's offensive cyber capabilities have "fall[en] into the wrong hands," have been discovered "in the wild" by security researchers or foreign governments or have later been used in attacks against U.S. entities.

He also asked if any of the capabilities were developed by foreign companies and if so, whether DOJ is taking steps to ensure they aren't surreptitiously communicating with foreign servers where they could potentially be stolen or seized by other nations.

The Washington Post first reported on Wyden's letter.

The concerns come at a time when policymakers are increasingly concerned about blowback and collateral damage from the government losing control of its cyber capabilities.

The NSA tools released by the Shadow Brokers were later repurposed by third parties and used in a number of high-profile cybersecurity incidents, such as the WannaCry and NotPetya attacks in 2017. More recently, the New York Times reported that EternalBlue, a SMB exploit that was among the U.S. government tools leaked, was present in the malware used to carry out a ransomware attack on Baltimore's IT systems.

The NSA has since disputed that allegation, while experts have debated whether the blame should fall more on the city for failing to take advantage of security patches released by Microsoft two years ago.

Since the 2016 leaks, the government has revamped what is known as the Vulnerabilities Equities Process, which pulls in representatives across the federal government to decide which zero-day vulnerabilities are disclosed to the general public and which are retained for intelligence or national security purposes.

Grant Schneider, federal chief information security officer and chairman of the VEP board, told reporters in April that while the government used to broadly search for and collect software vulnerabilities regardless of whether there was a clear use for them, that process has since become more targeted.

"We don't do that really anymore, we're focusing our resources now on: 'I'm trying to achieve a particular objective and … what vulnerabilities exist in order for me to achieve that objective,'" Schneider said. "So, it is far more narrowly focused than the broad-brush [approach]."