Sign up for our daily briefing

Make your busy days simpler with Axios AM/PM. Catch up on what's new and why it matters in just 5 minutes.

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Catch up on coronavirus stories and special reports, curated by Mike Allen everyday

Catch up on coronavirus stories and special reports, curated by Mike Allen everyday

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Denver news in your inbox

Catch up on the most important stories affecting your hometown with Axios Denver

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Des Moines news in your inbox

Catch up on the most important stories affecting your hometown with Axios Des Moines

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Minneapolis-St. Paul news in your inbox

Catch up on the most important stories affecting your hometown with Axios Twin Cities

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Tampa Bay news in your inbox

Catch up on the most important stories affecting your hometown with Axios Tampa Bay

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Charlotte news in your inbox

Catch up on the most important stories affecting your hometown with Axios Charlotte

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Please enter a valid email.

Please enter a valid email.

Subscription failed
Thank you for subscribing!

Illustration: Sarah Grillo/Axios

Security experts are drawing differing lessons from the latest report of the alleged use of secret NSA hacking tools by a criminal group. Some argue the NSA needs more oversight, while others say that organizations need to be more vigilant about updating the systems the NSA tools target.

The big picture: These two remedies aren't mutually exclusive. But neither is easy to achieve. 

Driving the news: The debate flared after the New York Times reported that attackers responsible for Baltimore's recent ransomware incident used a program believed to be created by the NSA.

  • The same program was at the center of WannaCry, a landmark global malware disaster in 2017.
  • All it takes to stop that program's line of attack is to update Windows.

Background: The NSA code, known as EternalBlue, leaked in 2017 as part of a year-long dump of agency files online by a cryptic hacker group called the Shadow Brokers.

  • EternalBlue can be used to turn Windows malware into worms — malicious code that spreads by itself from machine to machine.
  • By the time of the WannaCry outbreak, Microsoft had already released a patch that protects Windows systems from EternalBlue.

Between the lines: Whether the NSA needs more oversight in developing tools has no bearing on whether people should patch, and vice versa. And fully achieving either solution alone might not be possible.

  • While there are a ton of bad reasons organizations delay patching systems, there are good reasons, too. Installing untested updates can create chaos for niche software and hardware.
  • And there's already more oversight in place for agencies than most people realize.

Details: The executive branch does have an oversight structure in place, known as the vulnerabilities equities process. Any time agencies want to keep a vulnerability they discover secret so it can be used for surveillance, they have to make their case in front of a special interagency panel.

  • "The VEP is meant to be a risk minimizing process, but that doesn't mean there is no risk," said Michael Daniel, current president and CEO of the Cyber Threat Alliance and the former cybersecurity coordinator at the Obama White House when the VEP was created.
  • The process takes into account the possibility that a vulnerability might be leaked, stolen or discovered, but that will always be a risk, since there's always a chance a target will intercept a tool.
  • Nonetheless, Daniel argues, most Americans wouldn't want to place severe limits on the use of such tools that the intelligence community couldn't do its job.

Where it stands: After WannaCry, it's likely that the VEP has already adopted a stricter approach toward approving "wormable" tools.

  • We know from WannaCry and subsequent attacks that organizations are slow to apply patches. That's a consideration in the process.
  • When the Trump administration posted the criteria for the VEP in 2017, one of them read: "Will enough [U.S. systems] actually install [a] patch to offset the harm to security caused by [adversaries using a] vulnerability?"
  • Daniel notes that even pre-WannaCry, wormable tools don't mesh well with the U.S. intelligence philosophy. Security researchers outside the government often comment on the relative restraint observed by modern U.S. government-built malware to avoid hitting unintended targets.

The bottom line: Ultimately, there may be less room to build out oversight than critics hope and a ceiling to how much applying updates can improve security.

Go deeper

Updated 3 hours ago - Politics & Policy

Coronavirus dashboard

Illustration: Eniola Odetunde/Axios

  1. Health: Most vulnerable Americans aren't getting enough vaccine information — Fauci says Trump administration's lack of facts on COVID "very likely" cost lives.
  2. Education: Schools face an uphill battle to reopen during the pandemic.
  3. Vaccine: Florida requiring proof of residency to get vaccine — CDC extends interval between vaccine doses for exceptional cases.
  4. World: Hong Kong puts tens of thousands on lockdown as cases surge — Pfizer to supply 40 million vaccine doses to lower-income countries — Brazil begins distributing AstraZeneca vaccine.
  5. Sports: 2021 Tokyo Olympics hang in the balance.
  6. 🎧 Podcast: Carbon Health's CEO on unsticking the vaccine bottleneck.

DOJ: Capitol rioter threatened to "assassinate" Alexandria Ocasio-Cortez

Supporters of former President Trump storm the U.S. Captiol on Jan. 6. Photo: Kent Nishimura / Los Angeles Times via Getty Images

A Texas man who has been charged with storming the U.S. Capitol in the deadly Jan. 6 siege posted death threats against Rep. Alexandria Ocasio-Cortez (D-N.Y.), the Department of Justice said.

The big picture: Garret Miller faces five charges in connection to the riot by supporters of former President Trump, including violent entry and disorderly conduct on Capitol grounds and making threats. According to court documents, Miller posted violent threats online the day of the siege, including tweeting “Assassinate AOC.”

Schumer calls for IG probe into alleged plan by Trump, DOJ lawyer to oust acting AG

Jeffrey Clark speaks next to Deputy US Attorney General Jeffrey Rosen at a news conference in October. Photo: Yuri Gripas/AFP via Getty Images.

Senate Majority Leader Chuck Schumer (D-N.Y.) on Saturday called for the Justice Department inspector general to investigate an alleged plan by former President Trump and a DOJ lawyer to remove the acting attorney general and replace him with someone more willing to investigate unfounded claims of election fraud.

Driving the news: The New York Times first reported Friday that the lawyer, Jeffrey Clark, allegedly devised "ways to cast doubt on the election results and to bolster Mr. Trump’s continuing legal battles and the pressure on Georgia politicians. Because Mr. [Jeffrey] Rosen had refused the president’s entreaties to carry out those plans, Mr. Trump was about to decide whether to fire Mr. Rosen and replace him with Mr. Clark."