A coalition bill that grants the police more powers to spy on criminal suspects online has been passed by the Australian government.

The Surveillance Legislation Amendment (Identify and Disrupt) bill has created three new types of warrants that enable the Australian Federal Police (AFP) and Australian Criminal Intelligence Commission (ACIC) to modify and delete data belonging to cybercriminal suspects and take over their accounts. 

Using the new data disruption warrants, the AFP and the ACIC can prevent serious offenses from being committed online by modifying, adding, copying or deleting data. Network activity warrants allow the agencies to gather intelligence on criminal activity being carried out by cyber-criminal networks, while account takeover warrants can be used to take control of a suspect’s online account.

An eligible judge or a nominated member of the administrative appeals tribunal (AAT) can issue the data disruption and network activity warrants. However, the account takeover warrants must come from a magistrate who is satisfied that there are reasonable grounds that such a step is required to collect evidence relating to a relevant offense.

On Tuesday, Labor MP Andrew Giles told the lower house that the bill had gained the support of the opposition because “the cyber-capabilities of criminal networks have expanded, and we know that they are using the dark web and anonymizing technology to facilitate serious crime, which is creating significant challenges for law enforcement.”

The Greens flagged that the new powers go against a central recommendation of the Richardson review of the legal framework for Australia’s intelligence community. Richardson found that “law enforcement agencies should not be given specific cyber-disruption powers.”

Recommendations to improve safeguards and oversight concerning the new powers were made earlier this month by the parliamentary joint committee on intelligence and security (PJCIS), though not all of them were implemented.

The committee can review the bill after four years, and the Independent National Security Legislation Monitor will review the bill in 2024.

Kieran Pender, senior lawyer at the Human Rights Law Centre, told Guardian Australia that the new powers granted to the AFP and ACIC under the bill “are unprecedented and extraordinarily intrusive.”

Private data belonging to an alleged treaty violator was accessible to unauthorized FBI agents for months because of a software program flaw.

The glitch in the Palantir program was reportedly exploited by at least four Bureau employees to view data belonging to Singapore resident and US citizen Virgil Griffith. 

Former Ethereum developer Griffith was arrested at Los Angeles International Airport in November 2019 and charged with violating the International Emergency Economic Powers Act by traveling to the Democratic People’s Republic of Korea to give a presentation and technical advice on using crypto-currency and blockchain technology to evade sanctions. 

In January 2020, in a Southern District of New York courthouse, Griffith pleaded not guilty to the charge.  

The Palantir defect exposed data that had been recovered from Griffith’s Twitter and Facebook accounts in March 2020 during the execution of a federal search warrant. Prosecutors in the case against Griffith, who described the glitch in a letter, said it pertained to the program’s default setting.

“When data is loaded onto the Platform, the default setting is to permit access to the data to other FBI personnel otherwise authorized to access the Platform,” wrote prosecutors. 

The prosecutors wrote that word of the unauthorized access came to Griffith’s assigned FBI case agent via an email sent by another agent. The email explained that material seized in the search and entered in Palantir through the program’s default settings had been accessed by FBI analyst.

A letter filed by the Bureau on Tuesday states: “An FBI analyst, in the course of conducting a separate investigation, had identified communications between the defendant and the subject of that other investigation by means of searches on the Platform that accessed the Search Warrant Returns.”

Prosecutors learned that three FBI analysts and an agent had viewed Griffith’s private data owing to the Palantir glitch. None of the FBI employees who accessed Griffith’s data were working on his case. 

Between May 2020 and August 2021, the seized material was accessed at least four times.

Griffith is scheduled to appear in court on September 21. 

The Personal Identifiable Information (PII) of approximately 12,000 cardiology patients has been exposed in a cyber-attack on a healthcare provider based in Utah.

Patient data in the care of Revere Health was compromised when the organization fell victim to a phishing attack on June 21, 2021.

An attacker impersonating the US Agency for International Development (USAID) sent an email to a Revere Health employee that contained a malicious link. When the employee clicked the link, they inadvertently gave the threat actor access to their login credentials. 

The attacker used the stolen credentials to log in to an employee email account that contained information belonging to patients of Revere Health’s Heart of Dixie Cardiology Department in St. George, Utah. No credit card or payment information was among the data accessed by the attacker.

In a patient notification statement, Revere Health said that the compromised data was limited to patient names, dates of birth, medical record numbers, provider names, procedures, and information about appointments. 

“Since this data is relatively limited, we believe that this poses a low-level risk to your personal information,” said the organization.

It continued: “We have no reason to believe that they [the attacker] accessed, or were interested in, patient information. However, we cannot completely rule this out.”

Revere Health said that active monitoring by its IT security team detected the unauthorized activity quickly. Within 45 minutes of the attack’s commencing, the team was able to sever unauthorized access to the compromised email account. 

An investigation into the incident led Revere Health to conclude that stealing patient data was not the assailant’s main intention. 

“From our detailed investigation of this incident, we believe that the intent of this attack was to harvest login credentials from individuals in our organization and not to gather patient information,” stated the healthcare provider. 

“Our security logs suggest that the attacker had three objectives: (1) to spread phishing emails, (2) to gather active usernames and passwords and (3) to attempt financial fraud against Revere Health.” 

Following the incident, Revere Health has updated its security awareness training, enhanced suspicious activity detection protocols, and accelerated its rollout of two-factor authentication software.

More than two-thirds (70%) of cybersecurity professionals believe that the issue of ransomware is being exacerbated by cyber-insurance payouts to victim organizations, according to a new study by cybersecurity firm Talion.

The survey of 200 UK cybersecurity professionals also unveiled some worrying findings about reporting ransomware attacks to law enforcement. When asked why so many attacks are not reported, nearly half (45%) of respondents said that they believe businesses think law enforcement slows down ransomware recovery and they are focused on getting their systems back online. More than a third (37%) said it was because companies have paid a ransom and don’t want to get into trouble.

Additionally, one in 10 of those surveyed said companies didn’t know how to report ransomware attacks to law enforcement.

The report follows a surge in ransomware attacks globally in 2021. Earlier this month, a study from the International Data Corporation (IDC) found that over one-third of organizations worldwide have experienced a ransomware attack or breach that blocked access to systems or data in the previous 12 months. This has led to numerous eye-watering ransoms being paid to cyber-criminals, ramping up the debate on whether it is ever acceptable to pay a ransomware demand.

Commenting on the study, Mike Brown, CEO of Talion, said: “Our study highlights that many organizations are concerned about reporting ransomware attacks to law enforcement out of fear it could have further negative repercussions. All victims want to get back to business as usual as quickly as possible; however, it can be a complicated landscape to navigate. Should you pay the ransom? If so, is it lawful? Organizations should be mindful that it is unlawful to make a payment to terrorist organizations or prescribed groups in breach of international sanctions. What is required is a clear legal framework that allows organizations to make the best, lawful decisions when they are in this high-stress situation. Law enforcement needs to find a way to work with a commercial organization so that they are viewed as a source of expertise and support, not a further obstacle to overcome.”

“In terms of insurance payouts, it is not surprising so many security professionals see them as fuelling the ransomware industry, as they certainly cushion the blow of attacks. However, payouts are not guaranteed, and insurers are getting stricter every day. The best option is, therefore, to prepare for attacks and rehearse your strategy so when your organization gets hit in real life, losses are kept to a minimum.”

In June, Talion launched the #RansomAware campaign, a coalition of cyber security experts, businesses, academia and government to facilitate collaboration and information sharing around ransomware.

Developing more innovative hiring practices is crucial to attracting more talent to the cybersecurity industry, according to panelists speaking during a recent RSA webcast.

The event was held amid growing efforts from the US federal government to attract new candidates to the cybersecurity industry to close the burgeoning skills gap.

Barbara Endicott-Popovsky, executive director of Center for Information Assurance and Cybersecurity and professor at the University of Washington, stated: “It’s been frustrating to watch the lack of awareness of the cyber threats that we face and even more frustrating to spend so much time as we have developing talent and trying to make sure we get the right people to the right places.”

The first step in addressing this issue is to ensure there is much more clarity about the types of people and skills that are needed to work in cyber, according to Lynn Clark, chief of the NSA/DHS Centers of Academic Excellence at the National Security Agency (NSA). “It’s really hard to produce educational programs to prepare people for the workforce if we don’t know what our end objective is,” she outlined.

It is also vital that cybersecurity recruiters recognize the wide variety of motivations candidates have to work in this sector, thereby ensuring they “use the right lure for the right fish,” said Joshua Corman, senior advisor for the Cybersecurity and Infrastructure Security Agency (CISA).

He listed five different drivers (p’s) for those who work in the industry: protectors, purpose, prestige, profit and protest/patriotism, adding that “how you engage and recruit them will be different.”

The discussion then turned to the types of people and skills needed to make up the industry. Endicott-Popovsky observed that traditionally, the cyber industry has primarily been comprised of ‘techies,’ meaning other important skill sets are lacking.

Emily Harding, deputy director and senior fellow with the International Security Program at the Center for Strategic and International Studies (CSIS), said that in her experience, character and mindset are more important than qualifications when looking to recruit candidates for cybersecurity jobs. She believes the ideal person needs to be “smart and can think, and who does not get discouraged by bureaucracy or small hurdles, somebody who doesn’t want a roadmap to accomplish things.”

As well as hackers who can use their technical skills to discover security flaws, Corman feels the cyber industry needs more ‘translators’ in its ranks to translate these flaws into action. During previous experiences, he found that people with backgrounds in areas like law and project management are particularly effective at this role. “The things we were able to do were because we came from incredibly different backgrounds, but we had a common cause, common purpose and could be brought together like a team of Avengers to fight the greatest foes and risks,” he added.

Clark concurred with these perspectives, emphasizing the need for security teams to be comprised of people with strong soft-skills, such as communication and collaboration, alongside “people who understand the technology.” She pointed out, “All the technology in the world is not going to protect us from the hacker who can socially engineer somebody into giving him a password or who can spearphish and get the important information they need to access our systems.”

The panel also agreed that the organizations need to adapt their standard requirements for cybersecurity candidates to enable this type of neurodiversity to become a reality. This includes working with HR and legal departments to reduce the emphasis on formal technical qualifications. Additionally, Harding believes “you have to have that human-to-human connection as much as possible, where you’re going out to career fairs and universities and recruiting.”

The principle of favoring character over qualifications is particularly pertinent when it comes to recruiting for leadership positions. Corman observed that individuals are often pushed into leadership roles based on their technical expertise, which is the wrong criteria to use. “You have to make sure you have the right leaders because they set the tone, the cadence, the value set, the culture, as best they can,” he noted.

More broadly, Corman said that all personnel operating in the rapidly evolving field of cybersecurity must be flexible and willing to learn on the job continuously. “An adaptable person will adapt at the speed of cyber,” he commented.