1 big thing: Influencer culture comes to cybersecurity 

2. Russia and China get a big win on internet "sovereignty"

3. Iran cuts internet during, and after, protests

4. DHS announces election audits tool

5. Other news from last week

6. Odds and ends

Welcome to Codebook, the cybersecurity newsletter that turns down bribes but is offended you didn't even offer one.

 Today's newsletter is 1,430 words, a 5-minute read.

The Cleveland Browns, who Codebook readers picked to win the Superbowl, won on Thursday in wildly inappropriate fashion, as Brown Myles Garrett ripped of a Steeler's helmet and tried to hit him with it. 

Codebook

A master lock with ones and zeroes instead of the regular numbers.

blue

Decode key cybersecurity news and insights. With Sam Sabin.

Axios Codebook

Standard

1 big thing: Facebook declares war on government spying

2. NSO and Facebook might be waging a proxy war over encryption

3. Russian hackers are keeping very busy

A calendar with photos of the Russian President Vladimir Putin is hanging on a wall in Moscow, Russia

4. Chinese spies are stealing text messages

5. Sanctions hamper Russian radio jamming operation

6. Twitter is banning political advertisements

7. Other news from last week

8. Odds and ends

Welcome to Codebook, the cybersecurity newsletter with a crippling fear of accidentally eating the freshness packets in bags of beef jerky.

Today's newsletter is 1,944 words, a 7-minute read.

Codebook fan pick the Cleveland Browns continued to struggle with play-calling, game-planning and football discipline in a loss to New England. They remain a team with on-field talent two or three letter grades better than their coaching. 

1 big thing: China's move on face-recognition standards

2. Report: Iran debuted new destructive wiper malware

3. The difference between Russia and Ukraine on election meddling

4. Other news from last week

5. Odds and ends

Welcome to Codebook, the cybersecurity newsletter with a line graph.

Today's newsletter is 1,308 words, a 5-minute read.

This is the last Codebook for 2019. We have decided there will be no more cyber news until next year.

1 big thing: All infrastructure is election infrastructure

Illustration of anonymous person in a hoodie with a “I voted” sticker.

2. Elsewhere in elections

3. Codebook club: "Sandworm" by Andy Greenberg

A photo of Maersk containers at a shipping yard

4. Kaspersky finds lost threat group

5. Other news

Welcome to Codebook, the cybersecurity newsletter honing its play-by-play skills just in case hacking becomes a televised sport.

Tips? Ideas? Sandwiches? Hit reply to this email. 

Today's newsletter is 1,691 words, a 6-minute read.

The Browns, who you suckers told me to bet $5 on, were unable to defeat even a struggling Broncos team with a backup quarterback, despite Cleveland quarterback Baker Mayfield's facial hair mysteriously shrinking throughout the day. 

1 big thing: The myth of the sophisticated hacker

2. Exclusive: Over half of Fortune 500 exposed to remote access hacks

3. Trial testimony: Trump team knew WikiLeaks email dump was coming 

4. The surprising cost of hacking payment processors

5. The Department of Justice's busy week

6. Other news from last week

7. Odds and ends

Welcome to Codebook, the irregular cybersecurity newsletter that's not as outlandish as it could be.

Today's newsletter is 1,608 words, a 6-minute read.

We'll return one more time before thanksgiving.

Browns update: Codebook reader pick to win the Super Bowl, the Cleveland Browns, won against a good Bills team on Sunday, but continue to not be on track to win the Super Bowl.

FetchError

National

Government employees involved in the development of the new digital census system, intended to record all census data in 2020, allege cost overruns, spotty design and foreseeable security concerns, Reuters reports.

Why it matters: The obvious parallel — and worst-case scenario — for a faulty census system would be the healthcare.gov rollout disaster during the Obama presidency, which was initially unable to handle the broad scope of its mission. If that's the case with the census, everything from congressional seats to federal funding could be botched for a decade.

Via Reuters, which based its report on 30 interviews with sources associated with the new system, internal communications and budgeting documents, the census system is struggling with problems, including: 

Design: The system is intentionally designed in a way that makes it difficult to swap out or upgrade faulty code, in favor of a cheaper solution, tangling all aspects of the software together.

The contractor hired to build the system is redesigning an off-shelf solution to meet the census' needs, rather than developing from the ground up. Some government workers believe that the commercial system the contractor started with was too far away from the needs of the census to adapt.

Budget: The projected cost of building the system ballooned to $167 million — twice the original cost and approximately $40 million more than what the government thought it would pay for in-house programmers to develop it themselves.

Security: An internal communication showed concerns that the contractor tasked with defending the site was not adequately staffed to perform digital forensics of a breach. Furthermore, security testing revealed severe enough soft spots to cause internal "panic," including a scenario wherein a computer at a Russian internet address was able to tunnel into supposedly secure areas.

What they're saying: A representative from the census said that the Reuter’s story contained “inaccuracies and outdated information,” but would investigate security concerns.

“We are working with leading experts from the public and private sector to ensure the security and performance of our systems make it easy and safe to respond,” the census representative said.

2020 Census Bureau builds war room to battle misinformation

Census Bureau requests citizenship information from states

Report: Government workers concerned new digital census isn't ready

The worst-case scenario for a faulty census system would be the healthcare.gov rollout disaster.

Cities

Census

U.S. News

Technology

Cybersecurity

Government employees involved in the development of the new digital census system, intended to record all census data in 2020, allege cost overruns, spotty design and foreseeable security concerns, <a class="gtmContentClick" data-vars-link-text="Reuters" data-vars-click-url="https://www.reuters.com/article/us-usa-census-technology-specialreport/special-report-2020-u-s-census-plagued-by-hacking-threats-cost-overruns-idUSKBN1Y81H8?feedType=RSS&amp;feedName=technologyNews" data-vars-content-id="50e58135-dd87-4f74-abf7-8c7018e1aa92" data-vars-headline="Report: Government workers concerned new digital census isn&#x27;t ready" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.reuters.com/article/us-usa-census-technology-specialreport/special-report-2020-u-s-census-plagued-by-hacking-threats-cost-overruns-idUSKBN1Y81H8?feedType=RSS&amp;feedName=technologyNews" target="_blank">Reuters</a> reports.Why it matters: The obvious parallel — and worst-case scenario — for a faulty census system would be the healthcare.gov rollout disaster during the Obama presidency, which was initially unable to handle the broad scope of its mission. If that&#x27;s the case with the census, everything from congressional seats to federal funding could be botched for a decade.

Motherboard reported Sunday that a former member of a hacker group notorious for taking over social media accounts was arrested earlier this month, citing law enforcement and members of the group.

Driving the news: According to Motherboard, authorities arrested a onetime member of "Chuckling Squad," a notorious group that, among other mischief, took over Twitter CEO Jack Dorsey's Twitter account in August. That hacker, an unnamed minor, had previously been kicked out of the group

How it works: Chuckling Squad is a prolific user of SIM swapping, a technique through which hackers cajole cellphone companies to transfer a victim's phone number to phones that the hacker controls. From there, SIM swappers can use their access to a supposedly secure phone number to reset account passwords or otherwise tamper with accounts. 

The big picture: The lesson from groups like Chuckle Squad and others using this mode of account takeover is that for people who require the most security and attach cell numbers to their accounts, it's important to turn on whatever added protections a mobile provider has to prevent SIM swapping. Those often including adding a passcode to move the phone number or to only allow that service to be done in person. 

Go deeper: The rule-free world of federal officials' personal accounts

Member of group that hacked Twitter CEO Jack Dorsey's account arrested

Photo: Burhaan Kinu/Hindustan Times via Getty Images

Jack Dorsey

Big Tech

Elon Musk

Social Media

<a class="gtmContentClick" data-vars-link-text="Motherboard reported" data-vars-click-url="https://www.vice.com/en_us/article/gyzawx/authorities-arrest-suspected-jack-dorsey-hacker" data-vars-content-id="5103beb9-50f2-4e1b-a4c3-72af7ececf78" data-vars-headline="Member of group that hacked Twitter CEO Jack Dorsey&#x27;s account arrested" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.vice.com/en_us/article/gyzawx/authorities-arrest-suspected-jack-dorsey-hacker" target="_blank">Motherboard reported</a> Sunday that a former member of a hacker group notorious for taking over social media accounts was arrested earlier this month, citing law enforcement and members of the group.Driving the news: According to Motherboard, authorities arrested a onetime member of &quot;Chuckling Squad,&quot; a notorious group that, among other mischief, <a class="gtmContentClick" data-vars-link-text="took over Twitter CEO Jack Dorsey&#x27;s Twitter account" data-vars-click-url="https://www.axios.com/twitter-ceo-jack-dorseys-account-hacked-5fde6b15-bc03-4521-ace6-9e18b011a129.html" data-vars-content-id="5103beb9-50f2-4e1b-a4c3-72af7ececf78" data-vars-headline="Member of group that hacked Twitter CEO Jack Dorsey&#x27;s account arrested" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.axios.com/twitter-ceo-jack-dorseys-account-hacked-5fde6b15-bc03-4521-ace6-9e18b011a129.html" target="_self">took over Twitter CEO Jack Dorsey&#x27;s Twitter account</a> in August. That hacker, an unnamed minor, had previously been kicked out of the group

From the Valley to D.C., Big Tech players like Facebook, Google and Amazon are under more scrutiny than ever as new technology develops and privacy and antitrust concerns grow in lockstep with companies’ ambitions.

The Department of Justice announced Thursday that Russian nationals Maksim Yakubets and Igor Turashev have been charged with causing tens of millions of dollars in damages stemming from their use of the "Bugat" malware. Neither has been arrested.

Why it matters: Bugat (also frequently called dridex) was one of the most successful theft operations of its type, stealing usernames and passwords from infected computers as they attempted to log on to bank websites. The State Department and FBI are offering $5 million for information that would lead to their arrest, the largest reward offer for a cyber criminal to date.

Driving the news: A Pittsburgh grand jury indicted the pair, also charging Yakubets for his role in an earlier string of thefts using the similarly successful Zeus malware, for which alleged co-conspirators Yuriy Konovaleko and Yevhen Kulibaba have already pleaded guilty.

Justice Department announces charges, $5 million reward for Russian hackers

It's the largest reward offer for a cyber criminal to date, according to DOJ.

Cyberwarfare by Russia

World

<figure><img alt="FBI wanted poster" height="514" id="d0ec71cd-ca01-4da2-ac86-d7840856dc73" src="https://images.axios.com/trfVyjyRoe2zsqsTymPZ9zmNSSU=/2019/12/05/1575561922015.png" width="811"/><figcaption>FBI wanted poster for Maksim Yakubets</figcaption></figure>The Department of Justice <a class="gtmContentClick" data-vars-link-text="announced" data-vars-click-url="https://www.justice.gov/opa/pr/russian-national-charged-decade-long-series-hacking-and-bank-fraud-offenses-resulting-tens?hootPostID=629d449ac4fd1b12d37f66d6551dbec1" data-vars-content-id="66e745b5-e537-4893-ae3e-dd0ce220d4c2" data-vars-headline="Justice Department announces charges, $5 million reward for Russian hackers" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.justice.gov/opa/pr/russian-national-charged-decade-long-series-hacking-and-bank-fraud-offenses-resulting-tens?hootPostID=629d449ac4fd1b12d37f66d6551dbec1" target="_blank">announced</a> Thursday that Russian nationals Maksim Yakubets and Igor Turashev have been charged with causing tens of millions of dollars in damages stemming from their use of the &quot;Bugat&quot; malware. Neither has been arrested.Why it matters: Bugat (also frequently called dridex) was one of the most successful theft operations of its type, stealing usernames and passwords from infected computers as they attempted to log on to bank websites. The State Department and FBI are offering $5 million for information that would lead to their arrest, the largest reward offer for a cyber criminal to date.

China is becoming the most formidable rival America has faced, and the risk of confrontation with Russia, North Korea or Iran still looms. Authoritarians are rising, the chaotic Afghanistan exit revealed the limits of U.S. power, and the pandemic, climate change and other critical challenges continue to pose grave threats.

Chinese tech companies have ramped up efforts to set technical standards for facial recognition, raising concerns among business competitors, political observers and humanitarian advocates.

Why it matters: China has long made a systematic effort to set international standards on data and hardware compatibility across brands so that the standards reflect how Chinese products already work — giving its domestic industries a leg up in engineering races.

But the nation's push to do so on behalf of facial recognition and surveillance industries that it built to surveil and subjugate the nation's Uighur ethnic minority is casting its standards efforts in a new, harsher light.

Driving the news: Several Chinese firms, including ZTE, Dahua and China Telecom, have sought approval at the International Telecommunication Union, a UN technical standards body, for technical standards allowing different companies' surveillance technology — including facial recognition — to work together.

China's surveillance industry has grown in no small part due to funding research and buying equipment to fuel a high-tech human rights crisis. China has sent more than 1 million Uighurs to re-education camps while developing systems that identify race using facial features. 

To be clear: Technical standards do not commit atrocities.

Facial recognition technology has legitimate uses, from unlocking phones to identifying missing persons, and to use data or software across different brands of products, there needs to be standardized hardware and file formats.

But, but, but: China will likely use the technical standards to claim a UN seal of approval for its use of its products. 

Humanitarian groups worry about a feedback loop, where standards set to create Chinese surveillance industry successes will fund more research into technologies domestically used for oppression, which can then be sold for profit to create new business success.

The big picture: China has tried to use this standards approach to corner entire industries, including telecommunications. Facial recognition techniques represent a particularly thorny part of a broader effort to control artificial intelligence standards. 

By the time complex infrastructure schemes are entrenched in poorer nations, including those in Africa and Asia, they become extremely difficult to alter.

“China offers equipment and funding to modernize those countries on the condition they use these standards, making them even harder to change,” said Tom Duesterberg, senior fellow at the Hudson Institute. 

That’s bad for technology. “One thing we don't talk about as much is how China’s rush to entrench its standards precludes other technical standards,” said Kara Frederick, fellow at the Center for a New American Security. “It stops innovation wherever China decides to stop it.” 

Between the lines: Technical standards are conventionally seen as modular schematics for emerging technologies. For instance, they explain how to encode an MP3 file so it will play on any device — not what an MP3 file should be allowed to encode. 

So a technical standards body, at least as we currently envision it, might not be an effective place to address geopolitical or humanitarian issues.

But there aren't too many other battlegrounds for challenging China on the Uighur issue. Several humanitarian groups are taking the human rights fights to the ITU.

There is a second option that some, including Frederick, specifically mention: A U.S. technology policy that funds domestic research and development, so that the U.S. remains in the conversation as China picks future standards fights.

Leaked documents show Chinese businesses are shaping UN facial recognition standards

China's move on face-recognition standards

China will likely use technical standards to claim a UN seal of approval for its use of its products.

Illustration of a person targeted by face-recognition technology

China

Never miss a major tech story

Chinese tech companies have ramped up efforts to set <a class="gtmContentClick" data-vars-link-text="technical standards" data-vars-click-url="https://www.ft.com/content/c3555a3c-0d3e-11ea-b2d6-9bf4d1957a67" data-vars-content-id="9abce7f7-2a13-490a-803e-fbdc44bfaa6a" data-vars-headline="China&#x27;s move on face-recognition standards" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.ft.com/content/c3555a3c-0d3e-11ea-b2d6-9bf4d1957a67" target="_blank">technical standards</a> for facial recognition, raising concerns among business competitors, political observers and humanitarian advocates.Why it matters: China has long made a <a class="gtmContentClick" data-vars-link-text="systematic effort" data-vars-click-url="https://www.uscc.gov/sites/default/files/Research/RiseofChinainTechnologyStandards.pdf" data-vars-content-id="9abce7f7-2a13-490a-803e-fbdc44bfaa6a" data-vars-headline="China&#x27;s move on face-recognition standards" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.uscc.gov/sites/default/files/Research/RiseofChinainTechnologyStandards.pdf" target="_blank">systematic effort</a> to set international standards on data and hardware compatibility across brands so that the standards reflect how Chinese products already work — giving its domestic industries a leg up in engineering races.

Senate Intelligence Committee Chairman Richard Burr (R-N.C.) said this week that Ukraine meets the standard for election meddling that people first held Russia to. But that's not what the numbers show.

Why it matters: While Burr didn't draw a moral equivalence between Russia — which committed several crimes on U.S. soil during the 2016 election — and what we know about Ukraine, he muddled the debate in that direction.

What they're saying: "You considered Russia meddling with just the preference they had before you knew the rest of it," said Burr. "Apply the same standard to Ukraine."

"[I]t was called meddling when it was just Russia had a preference on who would win. And I'm saying, you can't go any further than that until somebody investigates Ukraine..."

But, but, but: Axios analyzed 1,847 news stories from 179 news sources that used the words "Russia," "election," "meddling" and their derivatives between Jan. 1, 2014, and Jan. 1, 2017. And it's pretty clear the concept of Russian election meddling didn't enter the American zeitgeist until the WikiLeaks email leaks on July 25.

That was the first time 10 news sources even used the three words in the same article in one day, and the time newspapers started using all three together to describe the 2016 election.

That set off a chain of events, especially with President Trump's request that Russia hack Hillary Clinton's emails three days later, when the term "Russian election meddling" started to enter the news lexicon.

When the stories weren't talking about Russian cyber measures, they simply weren't talking meddling.

In fact, there wasn't a broad understanding that Russia preferred Trump until after the hacking confirmed it. Republicans argued the hack couldn't be Russia because Russia would prefer a Democrat.

Burr did not respond to a request for comment.

GOP Sen. Richard Burr: "Ukraine was for Hillary Clinton"

Sen. John Kennedy doubles down on claims of Ukrainian interference

Senators briefed that CrowdStrike theory is Russian-backed disinformation campaign

The difference between Russia and Ukraine on election meddling

Sen. Richard Burr said Ukraine interfered in the 2016 election, but that's not what the numbers say.

Russia interference

Politics

Russia

Senate Intelligence Committee Chairman Richard Burr (R-N.C.) said this week that <a class="gtmContentClick" data-vars-link-text="Ukraine meets the standard for election meddling" data-vars-click-url="https://twitter.com/frankthorp/status/1201649575037145093" data-vars-content-id="fa7dc8ad-7f71-4414-b8f2-797d800d37e4" data-vars-headline="The difference between Russia and Ukraine on election meddling" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://twitter.com/frankthorp/status/1201649575037145093" target="_blank">Ukraine meets the standard for election meddling</a> that people first held Russia to. But that&#x27;s not what the numbers show.Why it matters: While Burr didn&#x27;t draw a moral equivalence between Russia — which committed several crimes on U.S. soil during the 2016 election — and what we know about Ukraine, he muddled the debate in that direction.

Joe Uchill

Stories

China's move on face-recognition standards

The difference between Russia and Ukraine on election meddling

Justice Department announces charges, $5 million reward for Russian hackers

Report: Government workers concerned new digital census isn't ready

Member of group that hacked Twitter CEO Jack Dorsey's account arrested

Newsletter editions

Axios Codebook: China succeeds through tech standards — Iran debuts malware — The difference between Russia and Ukraine

Axios Codebook: Cybersecurity influencer payola — UN's dubious cybercrime pact — New election audits tool

Axios Codebook: The myth of sophistication — Fortune 500 get hit — New DNC timeline

Axios Codebook: Election protection mind expansion — Epic "Sandworm" saga — New wrinkle in NSA leak

Axios Codebook: Facebook vs. NSO — A big month for Russian hackers — China's spies steal texts