President Biden has made cybersecurity a top priority for the Biden-Harris Administration at all levels of government. To advance the President’s commitment, and to reflect that enhancing the nation’s cybersecurity resilience is a top priority for DHS, Secretary Mayorkas issued a call for action dedicated to cybersecurity in his first month in office. This call for action focused on tackling the immediate threat of ransomware and on building a more robust and diverse workforce.
In March 2021, Secretary Mayorkas outlined his broader vision and a roadmap for the Department’s cybersecurity efforts in a virtual address hosted by RSA Conference, in partnership with Hampton University and the Girl Scouts of the USA.
The
United States Department of Homeland Security (DHS) is the U.S. federal executive department responsible for public security, roughly comparable to the interior or home ministries of other countries. Its stated missions involve anti-terrorism, border security, immigration and customs, cyber security, and disaster prevention and management.
It began operations on March 1, 2003, after being formed as a result of the Homeland Security Act of 2002, enacted in response to the September 11 attacks. With more than 240,000 employees, DHS is the third-largest Cabinet department, after the departments of Defense and Veterans Affairs. Homeland security policy is coordinated at the
White House by the Homeland Security Council. Other agencies with significant homeland security responsibilities include the departments of Health and Human Services, Justice, and Energy.
SEPTEMBER 11 2001 - AGENCY CREATION
In response to the September 11 attacks, President George W. Bush announced the establishment of the Office of Homeland Security (OHS) to coordinate "homeland security" efforts. The office was headed by former
Pennsylvania governor Tom Ridge, who assumed the title of Assistant to the President for Homeland Security. The official announcement states:
The mission of the Office will be to develop and coordinate the implementation of a comprehensive national strategy to secure the United States from terrorist threats or attacks. The Office will coordinate the executive branch's efforts to detect, prepare for, prevent, protect against, respond to, and recover from terrorist attacks within the
United
States.
Ridge began his duties as OHS director on October 8, 2001. On November 25, 2002, the Homeland Security Act established the Department of Homeland Security to consolidate U.S. executive branch organizations related to "homeland security" into a single Cabinet agency. The Gilmore Commission, supported by much of Congress and John Bolton, helped to solidify further the need for the department. The DHS incorporated the following 22 agencies.
FUNCTION
Whereas the Department of Defense is charged with military actions abroad, the Department of Homeland Security works in the civilian sphere to protect the
United States within, at, and outside its borders. Its stated goal is to prepare for, prevent, and respond to domestic emergencies, particularly terrorism. On March 1, 2003, DHS absorbed the U.S. Customs Service and Immigration and Naturalization Service (INS) and assumed its duties. In doing so, it divided the enforcement and services functions into two separate and new agencies: Immigration and Customs Enforcement and Citizenship and Immigration Services. The investigative divisions and intelligence gathering units of the INS and Customs Service were merged forming Homeland Security Investigations, the primary investigative arm of DHS. Additionally, the border enforcement functions of the INS, including the U.S. Border Patrol, the U.S. Customs Service, and the Animal and Plant Health Inspection Service were consolidated into a new agency under DHS: U.S. Customs and Border Protection. The Federal Protective Service falls under the National Protection and Programs Directorate.
1ST TRUMP ADMINISTRATION
A 2017 memo by Secretary of Homeland Security John F. Kelly directed DHS to disregard "age as a basis for determining when to collect biometrics."
On November 16, 2018, President Donald Trump signed the Cybersecurity and Infrastructure Security Agency Act of 2018 into law, which elevated the mission of the former DHS National Protection and Programs Directorate and established the Cybersecurity and Infrastructure Security Agency. In fiscal year 2018, DHS was allocated a net discretionary budget of $47.716 billion.
BIDEN ADMINISTRATION
In 2021, the Department of Justice began carrying out an investigation into white supremacy and extremism in the DHS
ranks, under Joe
Biden.
DHS also halted large-scale immigration raids at job sites, saying in October 2021 that the administration was planning "a new enforcement strategy to more effectively target employers who pay substandard wages and engage in exploitative labor practices."
In 2023, the U.S. Customs and Border Patrol began using an app which requires asylum seekers to submit biometric information before they enter the country.
In June 2024 John Boyd, the head of the DHS Office of Biometric Identity Management, announced at a conference that the agency "is looking into ways it might use facial recognition technology to track the identities of migrant children." According to Boyd, the initiative is intended to advance the development of facial recognition algorithms. A former DHS official said that every migrant processing center he visited engaged in biometric identity collection, and that children were not separated out during processing. DHS denied collecting the biometric data of children under 14.
UKRAINE - TEMPORARY PROTECTED STATUS FOR 18 MONTHS
WASHINGTON MARCH 3RD 2022 — The Department of Homeland Security (DHS) announced the designation of Ukraine for Temporary Protected Status (TPS) for 18 months.
“Russia’s premeditated and unprovoked attack on Ukraine has resulted in an ongoing war, senseless violence, and Ukrainians forced to seek refuge in other countries,” said Secretary Alejandro N. Mayorkas. “In these extraordinary times, we will continue to offer our support and protection to Ukrainian nationals in the United States.”
A country may be designated for TPS when conditions in the country fall into one or more of the three statutory bases for designation: ongoing armed conflict, environmental disasters, or extraordinary and temporary conditions. This designation is based on both ongoing armed conflict and extraordinary and temporary conditions in Ukraine that prevent Ukrainian nationals, and those of no nationality who last habitually resided in Ukraine, from returning to Ukraine safely. These conditions result from the full-scale Russian military invasion into Ukraine, which marks the largest conventional military action in
Europe since
World War
II. This invasion has caused a humanitarian crisis with significant numbers of individuals fleeing and damage to civilian infrastructure that has left many without electricity or water or access to food, basic supplies, shelter, and emergency medical services.
Individuals eligible for TPS under this designation must have continuously resided in the United States since April 11, 2022. Initial applicants for TPS under this designation must demonstrate that they have been continuously physically present in the United States since April 19, 2022, the effective date of this designation of Ukraine, before USCIS may grant them TPS. Ukraine’s 18-month designation will go into effect on the publication date of the forthcoming Federal Register notice. The Federal Register notice will provide instructions for applying for TPS and an Employment Authorization Document (EAD). TPS applicants must meet all eligibility requirements and undergo security and background checks.
US
DEPARTMENT OF HOMELAND SECURITY - DHS
LOGO
NATIONAL TERRORISM ADVISOR
In 2011, the Department of Homeland Security phased out the old Homeland Security Advisory System, replacing it with a two-level National Terrorism Advisory System. The system has two types of advisories: alerts and bulletins. NTAS bulletins permit the secretary to communicate critical terrorism information that, while not necessarily indicative of a specific threat against the United States, can reach homeland security partners or the public quickly, thereby allowing recipients to implement necessary protective measures. Alerts are issued when there is specific and credible information of a terrorist threat against the United States. Alerts have two levels: elevated and imminent. An elevated alert is issued when there is credible information about an attack but only general information about timing or a target. An Imminent Alert is issued when the threat is very specific and impending in the very near term.
On March 12, 2002, the Homeland Security Advisory System, a color-coded terrorism risk advisory scale, was created as the result of a Presidential Directive to provide a "comprehensive and effective means to disseminate information regarding the risk of terrorist acts to Federal, State, and local authorities and to the American people". Many procedures at government facilities are tied into the alert level; for example a facility may search all entering vehicles when the alert is above a certain level. Since January 2003, it has been administered in coordination with DHS; it has also been the target of frequent jokes and ridicule on the part of the administration's detractors about its ineffectiveness. After resigning, Tom Ridge said he did not always agree with the threat level adjustments pushed by other government agencies.
In January 2003, the officeSince its inception, the department's temporary headquarters had been in Washington, D.C.'s Nebraska Avenue Complex, a former naval facility. The 38-acre (15 ha) site, across from American University, has 32 buildings comprising 566,000 square feet (52,600 m2) of administrative space. In early 2007, the department submitted a $4.1 billion plan to Congress to consolidate its 60-plus Washington-area offices into a single headquarters complex at the St. Elizabeths Hospital campus in Anacostia, Southeast Washington, D.C.
The move was championed by District of Columbia officials because of the positive economic impact it would have on historically depressed Anacostia. The move was criticized by historic preservationists, who claimed the revitalization plans would destroy dozens of historic buildings on the campus. Community activists criticized the plans because the facility would remain walled off and have little interaction with the surrounding area.
In February 2015 the General Services Administration said that the site would open in 2021. DHS headquarters staff began moving to St. Elizabeths in April 2019 after the completion of the Center Building renovation. was merged into the Department of Homeland Security and the White House Homeland Security Council, both of which were created by the Homeland Security Act of 2002. The Homeland Security Council, similar in nature to the National Security Council, retains a policy coordination and advisory role and is led by the assistant to the president for homeland security.
HEADQUARTERS
Since its inception, the department's temporary headquarters had been in Washington, D.C.'s Nebraska Avenue Complex, a former naval facility. The 38-acre (15 ha) site, across from American University, has 32 buildings comprising 566,000 square feet (52,600 m2) of administrative
space. In early 2007, the department submitted a $4.1 billion plan to Congress to consolidate its 60-plus Washington-area offices into a single headquarters complex at the St. Elizabeths Hospital campus in Anacostia, Southeast Washington, D.C.
The move was championed by District of Columbia officials because of the positive economic impact it would have on historically depressed Anacostia. The move was criticized by historic preservationists, who claimed the revitalization plans would destroy dozens of historic buildings on the campus. Community activists criticized the plans because the facility would remain walled off and have little interaction with the surrounding area.
In February 2015 the General Services Administration said that the site would open in 2021. DHS headquarters staff began moving to St. Elizabeths in April 2019 after the completion of the Center Building renovation.
CYBER SECURITY
The DHS National Cyber Security Division (NCSD) is responsible for the response system, risk management program, and requirements for cyber-security in the U.S. The division is home to US-CERT operations and the National Cyber Alert System. The DHS Science and Technology Directorate helps government and private end-users transition to new cyber-security capabilities. This directorate also funds the Cyber Security Research and Development Center, which identifies and prioritizes research and development for NCSD. The center works on the Internet's routing infrastructure (the SPRI program) and Domain Name System (DNSSEC), identity theft and other online criminal activity (ITTC), Internet traffic and networks research (PREDICT datasets and the DETER testbed), Department of Defense and HSARPA exercises (Livewire and Determined Promise), and wireless security in cooperation with Canada.
On October 30, 2009, DHS opened the National Cybersecurity and Communications Integration Center. The center brings together government organizations responsible for protecting computer networks and networked infrastructure.
In January 2017, DHS officially designated state-run election systems as critical infrastructure. The designation made it easier for state and local election officials to get cybersecurity help from the federal government. In October 2017, DHS convened a Government Coordinating Council (GCC) for the Election Infrastructure Subsection with representatives from various state and federal agencies such as the Election Assistance Commission and National Association of Secretaries of State.
RUSSIAN MILITARY CYBER ACTORS TARGET US & GLOBAL CRITICAL INFRASTRUCTURE
The Federal Bureau of Investigation
(FBI), Cybersecurity and Infrastructure Security Agency (CISA), and National Security Agency (NSA) assess that cyber actors affiliated with the
Russian General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155) are responsible for computer network operations against global targets for the purposes of espionage, sabotage, and reputational harm since at least 2020. GRU Unit 29155 cyber actors began deploying the destructive WhisperGate
malware against multiple Ukrainian victim organizations as early as January 13, 2022. These cyber actors are separate from other known and more established GRU-affiliated cyber groups, such as Unit 26165 and Unit 74455.
To mitigate this malicious cyber activity, organizations should take the following actions today:
- Prioritize routine system updates and remediate known exploited vulnerabilities.
- Segment networks to prevent the spread of malicious activity.
- Enable phishing-resistant multifactor authentication (MFA) for all externally facing account services, especially for webmail, virtual private networks (VPNs), and accounts that access critical systems.
This Cybersecurity Advisory provides tactics, techniques, and procedures (TTPs) associated with Unit 29155 cyber
actors - both during and succeeding their deployment of WhisperGate against Ukraine
- as well as further analysis (see Appendix A) of the WhisperGate malware initially published in the joint advisory, Destructive Malware Targeting Organizations in Ukraine, published February 26, 2022.
FBI, CISA, NSA and the following partners are releasing this joint advisory as a collective assessment of Unit 29155 cyber operations since 2020:
- U.S. Department of the Treasury
- U.S. Department of State (Rewards for Justice)
- U.S. Cyber Command Cyber National Mission Force (CNMF)
- Netherlands Defence Intelligence and Security Service (MIVD)
- Czech Military Intelligence (VZ)
- Czech Republic Security Information Service (BIS)
- German Federal Office for the Protection of the Constitution (BfV)
- Estonian Internal Security Service (KAPO)
- Latvian State Security Service (VDD)
- Security Service of Ukraine (SBU)
- Computer Emergency Response Team of Ukraine (CERT-UA)
- Canadian Security Intelligence Service (CSIS)
- Communications Security Establishment Canada (CSE)
- Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
- United Kingdom National Cyber Security Centre (NCSC-UK)
For additional information on Russian state-sponsored malicious cyber activity and related indictments, see the recent U.S. Department of Justice (DOJ) press releases for
June 26,
2024, and September 5,
2024, FBI’s Cyber Crime
webpage, and CISA’s Russia Cyber Threat Overview and Advisories webpage.
INEFFECTIVENESS, WASTE & LACK OF TRANSPARENCY
The department has been dogged by persistent criticism over excessive bureaucracy, waste, ineffectiveness and lack of transparency. Congress estimates that the department has wasted roughly $15 billion in failed contracts (as of September 2008). In 2003, the department came under fire after the media revealed that Laura Callahan, Deputy Chief Information Officer at DHS with responsibilities for sensitive national security databases, had obtained her bachelor, masters, and doctorate computer science degrees through Hamilton University, a diploma mill in a small town in Wyoming. The department was blamed for up to $2 billion of waste and fraud after audits by the Government Accountability Office revealed widespread misuse of government credit cards by DHS employees, with purchases including beer brewing kits, $70,000 of plastic dog booties that were later deemed unusable, boats purchased at double the retail price (many of which later could not be found), and iPods ostensibly for use in "data storage".
A 2015 inspection of IT infrastructure found that the department was running over a hundred computer systems whose owners were unknown, including Secret and Top Secret databases, many with out of date security or weak passwords. Basic security reviews were absent, and the department had apparently made deliberate attempts to delay publication of information about the flaws.
DATA MINING
On September 5, 2007, the Associated Press reported that the DHS had scrapped an anti-terrorism data mining tool called ADVISE (Analysis, Dissemination, Visualization, Insight and Semantic Enhancement) after the agency's internal inspector general found that pilot testing of the system had been performed using data on real people without required privacy safeguards in place. The system, in development at Lawrence Livermore and Pacific Northwest National Laboratory since 2003, has cost the agency $42 million to date. Controversy over the program is not new; in March 2007, the Government Accountability Office stated that "the ADVISE tool could misidentify or erroneously associate an individual with undesirable activity such as fraud, crime or terrorism." Homeland Security's Inspector General later said that ADVISE was poorly planned, time-consuming for analysts to use, and lacked adequate justifications.
FUSION TERRORISM PREVENTION
Fusion centers are terrorism prevention and response centers, many of which were created under a joint project between the Department of Homeland Security and the U.S. Department of Justice's Office of Justice Programs between 2003 and 2007. The fusion centers gather information from government sources as well as their partners in the private sector.
They are designed to promote information sharing at the federal level between agencies such as the CIA, FBI, Department of Justice, U.S. military and state and local level government. As of July 2009, DHS recognized at least seventy-two fusion centers. Fusion centers may also be affiliated with an Emergency Operations Center that responds in the event of a disaster.
There are a number of documented criticisms of fusion centers, including relative ineffectiveness at counterterrorism activities, the potential to be used for secondary purposes unrelated to counterterrorism, and their links to violations of civil liberties of American citizens and others.
David Rittgers of the Cato Institute notes:
a long line of fusion center and DHS reports labeling broad swaths of the public as a threat to national security. The North Texas Fusion System labeled Muslim lobbyists as a potential threat; a DHS analyst in Wisconsin thought both pro- and anti-abortion activists were worrisome; a Pennsylvania homeland security contractor watched environmental activists, Tea Party groups, and a Second Amendment rally; the Maryland State Police put anti-death penalty and anti-war activists in a federal terrorism database; a fusion center in Missouri thought that all third-party voters and Ron Paul supporters were a threat ...
EMAIL INTERCEPTION
In 2006, MSNBC reported that Grant Goodman, "an 81-year-old retired University of Kansas history professor, received a letter from his friend in the Philippines that had been opened and resealed with a strip of dark green tape bearing the words "by Border Protection" and carrying the official Homeland Security seal." The letter was sent by a devout Catholic Filipino woman with no history of supporting Islamic terrorism. A spokesman for U.S. Customs and Border Protection "acknowledged that the agency can, will and does open mail coming to U.S. citizens that originates from a foreign country whenever it's deemed necessary":
All mail originating outside the United States Customs territory that is to be delivered inside the U.S. Customs territory is subject to Customs examination," says the CBP Web site. That includes personal correspondence. "All mail means 'all mail,'" said John Mohan, a CBP spokesman, emphasizing the point.
The department declined to outline what criteria are used to determine when a piece of personal correspondence should be opened or to say how often or in what volume Customs might be opening mail.
Goodman's story provoked outrage in the blogosphere, as well as in the more established media. Reacting to the incident, Mother Jones remarked "unlike other prying government agencies, Homeland Security wants you to know it is watching you." CNN observed "on the heels of the NSA wiretapping controversy, Goodman's letter raises more concern over the balance between privacy and security."
FREEDOM OF INFORMATION ACT PROCESSING PERFORMANCE
In the Center for Effective Government analysis of 15 federal agencies which receive the most Freedom of Information Act (FOIA) requests, published in 2015 (using 2012 and 2013 data), the Department of Homeland Security earned a D+ by scoring 69 out of a possible 100 points, i.e. did not earn a satisfactory overall grade. It also had not updated its policies since the 2007 FOIA amendments.
HUMAN RIGHTS ABUSES - CALLS FOR ABOLITION
While abolishing the DHS has been proposed since 2011, the idea was popularized when Alexandria Ocasio-Cortez suggested abolishing the DHS in light of the
human
rights abuses against detained migrants by the Immigration and Customs Enforcement and Customs and Border Protection agencies.
In 2020, the DHS was criticized for detaining protesters in Portland, Oregon. It even drew rebuke from the department's first secretary Tom Ridge who said, "It would be a cold day in hell before I would consent to an uninvited, unilateral intervention into one of my cities”.
On August 10, 2020, in an opinion article for USA Today by Anthony D. Romero, the ACLU called for the dismantling of DHS over the deployment of federal forces in July 2020 during the Portland protests.
IN
FICTION
When Homeland
Security hear of a man running at absurd speeds on a Panamanian
beach, they devote significant resources to securing that technology,
involving DARPA
and the CIA
in the planned bio-technology acquisition, in cooperation with the DSTL
and MI6. Ignoring illegality and
accountability, as their black ops team swing into action - shades of Bourne
Identity and Indiana
Jones.
In
the original fictional story, the rogue directors of DARPA and the National
Intelligence Agency (NIC) are Dr
Stefan Raengst and Iras
Charmian.
But
they had not figured on John
Storm and the crew of the AI Elizabeth
Swann, the most advanced zero emission ship on the ocean.
HOMELAND
SECURITY CONTACTS
The Honorable Alejandro Mayorkas
Secretary of Homeland Security
Washington, DC 20528
ATTN: Firstname Lastname -or- Office Title
CISA - NGL Stop 0630
Cybersecurity and Infrastructure Security Agency
1110 N. Glebe Road
Arlington, VA 20598-0630
Please direct media inquiries to CISAMedia@cisa.dhs.gov or call 703-235-2010.
https://www.dhs.gov/
https://www.cisa.gov/
https://www.dhs.gov/
https://www.cisa.gov/
https://www.fbi.gov/investigate/cyber
https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/russia
https://www.justice.gov/opa/pr/russian-national-charged-conspiring-russia-military-intelligence-destroy-ukrainian
https://www.justice.gov/opa/pr/five-russian-gru-officers-and-one-civilian-charged-conspiring-hack-ukrainian-government
|
