The Case for a Hack-Reporting Requirement

A bipartisan group of senators on Tuesday recommended that the United States consider requiring companies to disclose when they have been hacked.

At the first public hearing before Congress since a massive cyberattack by suspected Russian hackers was disclosed in December, Senate Intelligence Committee Chairman Mark Warner, a Democrat, was joined by the committee’s vice chairman, Republican Senator Marco Rubio, in calling for the measure. Several others, including Senator Angus King, an independent, also voiced their support, as did several of the tech executives who were testifying.

There is currently no federal data breach notification law.

“It is time not only to talk about, but to find a way to take action to impose, in an appropriate manner, some kind of notification obligation on entities in the private sector,” said Microsoft Corp. president Brad Smith. “I think it is the only way we’re going to protect the country, and I think it is the only way we’re going to protect the world.”

FireEye Inc. CEO Kevin Mandia said he supports a requirement that companies notify an appropriate government agency about being hacked. But he urged that it be confidential, to encourage companies to participate amid liability concerns.

The hearing before Warner’s committee on Tuesday included Sudhakar Ramakrishna, the CEO of SolarWinds Corp.—the Texas-based software firm that the hackers compromised as part of the attack. He told the committee that the tool hackers used to compromise the company’s software “poses a grave risk of automated supply chain attacks” across the software industry.

The senators mostly used a light touch in questioning Ramakrishna—who started at SolarWinds in January after the hack was disclosed—about his company’s responsibility in the massive cyberattack. He said his company is investigating three possible ways the attackers may have used to gain access to the company’s networks but haven’t reached a conclusion.

The senators were much tougher on Amazon Web Services (AWS) for not appearing at the hearing despite an invitation. According to SolarWinds, its Orion software platform—which was compromised by the hackers—could be deployed by customers on AWS, among other cloud platforms.

“The operation we will be discussing today used their infrastructure, at least in part,” Rubio said. “Apparently they were too busy to discuss that here today.”

Amazon.com Inc. didn’t immediately respond to a request for comment.

The hackers responsible for the incident inserted malicious code into SolarWinds’ software, which was delivered to as many as 18,000 customers through software updates, though fewer are believed to have been targeted with additional hacking. The White House has confirmed that the hackers leveraged this access to breach more than 100 companies and nine U.S. agencies with follow-on hacking aimed at espionage.

FireEye’s Mandia said the attackers were “exceptionally hard to detect.” He added that the hackers appeared to be highly concerned with remaining hidden. “The minute you could detect these folks and stopped them breaking through the door, they sort of evaporated like ghosts until their next operation.”

FireEye discovered the hacking campaign while investigating a breach of its own networks. Mandia said in his prepared remarks that the company found an intrusion in late November and determined that a third party had accessed their network without authorization. FireEye disclosed the cyberattack in December.

Smith told the committee that Microsoft’s threat hunters and engineers analyzed the attack and estimated that 1,000 developers worked on the attack. “It is the largest and most sophisticated operation of this sort that we’ve seen,” he said.

Another witness at the hearing, George Kurtz, the co-founder and CEO of Crowdstrike, the cybersecurity firm hired by SolarWinds for incident response, called for improvements to federal cybersecurity. He said old computer systems and compliance rules “detract from their core security work.”

While a mandatory data breach notification law is one mechanism by which Congress could improve U.S. cybersecurity, the prospects of passing such a law in 2021 are slim given competing Covid-19 relief priorities, according to Dominique Shelton Leipzig, a privacy and cybersecurity attorney at Perkins Coie LLP. “Realistically, the chances of getting a federal omnibus privacy and data security law are looking more likely to happen next year,” she said.

Businesses want a federal law since they currently have to comply with differing data breach notification laws in all 50 states, she said. “This is the perfect example where companies are calling out for guidance both on the privacy and data security side,” she said.

—With assistance from Kartikay Mehrotra.

Copyright 2021 Bloomberg. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.