jain.com — data centers, connectivity and security, analyzed daily

Tag: DHS

  • Hack-Back Memo Puts State Hackers Out of Scope, Despite Attacks on 45 Water Systems

    Hack-Back Memo Puts State Hackers Out of Scope, Despite Attacks on 45 Water Systems

    TL;DR · 30-second read

    The Short Version

    The American government will now let approved private companies break into, and even wreck, computers run by foreign criminal hacking gangs. In March, officials said they would not do this.

    Each company must set aside at least $1 million, which it loses if it breaks the rules. Every attack needs written approval from the Justice Department and Homeland Security.

    The catch: hackers working directly for a foreign government are off-limits. That matters because the order came after suspected Iranian attacks on water suppliers in 45 American towns.

    Tom’s Hardware reported that President Donald Trump signed a presidential memorandum on August 12 creating the first US program that lets vetted private companies conduct offensive cyber operations against foreign cybercrime organizations. These include operations that destroy data and systems. Participating firms must post at least $1 million in escrow, which they forfeit if they break program rules. Every operation needs written approval from Department of Justice and Department of Homeland Security officials.

    A National Coordination Center will run the program. Implementation guidance is due within 60 days. The policy reverses public statements administration officials made in March.

    Executive Summary

    The memorandum authorizes two kinds of activity. “Cyber Surveillance Operations” means getting into foreign systems without permission to gather intelligence while staying undetected. “Cyber Effects Operations” means disrupting or destroying those systems and their data. Both large firms and smaller specialists will be eligible. Participants may also sign commercial deals with other private firms and with state and local agencies to receive threat data and propose operations based on it.

    This matters for two reasons. First, it turns offensive cyber activity, long treated as a government monopoly in the US, into something a licensed private sector can do under supervision. Second, its target definition is narrow. A group qualifies as a target unless “clear intelligence exists” that it is part of a foreign government or wholly run at a government’s direction. So the program is aimed at criminal ransomware crews, not at the state-directed actors behind many attacks on physical infrastructure. For operators of water, power and data center infrastructure, that distinction shapes what the program can and cannot do for them.

    The Target Line Runs Straight Through Critical Infrastructure

    The memo arrived after suspected Iranian cyberattacks on water suppliers in 45 US municipalities. It also followed a CISA alert about Iranian hackers targeting programmable logic controllers (PLCs), the small industrial computers that open valves, run pumps and switch equipment at water and energy companies. Yet state-directed hackers fall outside the program’s own definition of a valid target. Private operators could go after a ransomware crew that encrypts a utility’s billing systems. They could not go after a government-run unit tampering with its treatment-plant controllers.

    The line is drawn deliberately. Ransomware crews that operate with a state’s tolerance but not under its formal control stay within scope, a description that fits much of the Russia-based ransomware ecosystem. Once an actor is clearly an arm of a foreign state, the matter stays with government. For utility and industrial security teams, the practical conclusion is that nothing changes for defending operational technology against nation-state intrusion. Segmentation, monitoring and incident response for control systems remain their responsibility. The new program targets the financially motivated threat, not the geopolitical one.

    There is also an ambiguity problem. Eligibility turns on whether “clear intelligence” ties a group to a government, and in practice attribution is often contested and slow. A group judged criminal today may later prove to have state links. That question will matter a great deal to any firm whose operation lands on the wrong side of the line.

    A $1 Million Bond on a Destructive Capability

    The escrow requirement is the program’s main economic control. A minimum of $1 million, forfeited for rule-breaking, is a meaningful commitment for a small specialist firm. Whether it is proportionate to the harm a destructive operation could cause is a separate question. Wiping servers that turn out to be shared with innocent third parties could produce losses well above that figure. The minimum works as a deterrent and an entry filter. It is not obviously a compensation fund.

    The commercial provisions may matter more for the market’s shape. Participants can contract with other private firms and with state and local agencies, receive threat data and propose operations based on it. That creates a potential new service line for security vendors: selling disruption, not just detection. Two background facts point the same way. Congress earmarked $1 billion for offensive cyber operations in last year’s spending bill. Google said in August last year that it was preparing to take part in disruptive actions against cybercriminals. Large platform companies with deep telemetry into criminal infrastructure look like natural participants. Smaller firms may compete on specialized tasks, as the eligibility rules anticipate.

    Escalation, Legal Exposure and a Classified Annex

    DOJ and DHS officials cannot approve operations likely to cause loss of life or amount to an armed attack under international law. The memo does not prohibit such operations outright, however. Approval authority for them sits in a classified annex. Companies weighing participation, and the public, therefore cannot see the full rulebook for the highest-risk cases.

    Personnel face exposure too. Jake Williams, vice president of research and development at Hunter Strategy, told TechCrunch that Americans involved in these operations “could easily be classified as non-uniformed combatants while traveling overseas.” That is a risk that falls on individual employees, not only on their employers, and firms will need to account for it in staffing, travel policy and insurance.

    The speed of the reversal adds uncertainty. In March, Thomas Lind, then a senior adviser at the Office of the National Cyber Director, said the administration had no plans to authorize private offensive operations: “We’re not interested in fighting pirates with pirates.” National Cyber Director Sean Cairncross said the same week that companies running offensive campaigns were not what the administration meant when it asked industry for help. A policy that changed direction within months could change again, which makes long-term investment in offensive capability a harder bet.

    Collateral Risk Is Written Into the Rules

    The memo requires any company that unintentionally hits a US person or a system on US soil to halt operations and notify the government immediately. That clause concedes that operations aimed abroad can land at home. Criminal groups commonly route activity through rented servers and compromised machines owned by unrelated parties. Hosting providers, cloud platforms and data center operators therefore have a direct interest in how approvals weigh that possibility, and in how quickly they would be told if their infrastructure were affected.

    Defenders more broadly face a quieter risk: retaliation. A criminal group whose systems are destroyed by a US firm may not distinguish between that firm and US targets generally. The memo’s safeguards govern how operations are approved. They do not change who absorbs the response.

    Background

    For decades, US law and policy have treated breaking into someone else’s computer as illegal, even when that someone is an attacker. Offensive cyber operations have been reserved for government agencies such as the military and intelligence community. Proposals to let private victims “hack back,” including the Active Cyber Defense Certainty Act introduced in Congress in 2017, never became law. Critics warned of misattribution, collateral damage and escalation.

    Pressure grew as ransomware crews, many operating from jurisdictions beyond the reach of US law enforcement, hit hospitals, pipelines and municipalities. Some large technology firms have already worked with authorities to take down criminal infrastructure, and Google said last year it was preparing to take part in disruptive actions. The August 12 memorandum is the first formal framework for private firms to go further, under federal supervision.

    Sources

    Source: White House authorizes private companies to launch ‘hack-back’ cyberattacks that destroy data and systems, targeting foreign cybercrime organizations. Tom’s Hardware on the August 12 presidential memorandum creating a supervised private offensive cyber program.

  • DHS Breach Missed Twice as False Positive Before Confirmation

    DHS Breach Missed Twice as False Positive Before Confirmation

    Nextgov/FCW reported on July 12, 2026 that a network intrusion at the U.S. Department of Homeland Security (DHS) was ruled a false positive on two separate occasions before analysts ultimately confirmed a genuine breach. The report frames the sequence as a cybersecurity governance failure inside one of the federal government’s most security-conscious departments.

    Executive Summary

    The disclosure is narrow but significant: the same signal (or set of related signals) reached DHS defenders more than once and was dismissed each time before the intrusion was finally validated. In security operations, that pattern is the textbook definition of a triage failure — the detection layer worked, but the human or procedural layer that decides what a detection means did not.

    For a department whose Cybersecurity and Infrastructure Security Agency (CISA) advises the rest of the federal government and the private sector on exactly this class of problem, the reputational and operational stakes are elevated. The reporting does not, at least in the material available, quantify data loss, dwell time, or the identity of the intruder, so the immediate policy question is procedural: how does a mature SOC (security operations center) convert a repeat ‘false positive’ into a re-investigation trigger?

    When ‘False Positive’ Becomes a Systemic Blind Spot

    Modern intrusion detection generates a firehose of alerts, and analysts are trained — correctly — to close most of them as benign. The failure mode the DHS incident illustrates is not that analysts made a bad call once; it is that the same underlying activity was cleared twice. Well-run detection programs treat repeat or recurring signatures as a distinct category, because attackers who are present in an environment tend to generate correlated telemetry over time. If a suppression or closure rule does not force a fresh look when a signal recurs, the organization is effectively teaching itself to ignore its intruder.

    The reporting, as summarized, does not tell us whether the two dismissals were made by the same analyst, the same tooling rule, or across different shifts and teams. Each of those root causes points to a different fix: analyst training, detection engineering, or cross-team hand-off procedure. Without that detail, outside observers should be careful not to overfit a narrative to a single failure mode.

    Governance Questions the Incident Sharpens

    Federal cybersecurity guidance — much of it authored by components within DHS itself — emphasizes continuous monitoring, threat hunting, and ‘assume breach’ postures. A twice-missed intrusion is a useful stress test of whether those doctrines are being executed as designed inside the department that promotes them. Fair questions apply in both directions: critics should ask whether the guidance is realistic given federal staffing and budget realities, and defenders of the current model should explain why the specific controls that were supposed to catch recurrence did not.

    It is also worth noting what the reporting does not establish. There is no public evidence in the summary of foreign-actor attribution, of a specific data set exfiltrated, or of a policy directive being violated. Treating the story as a procedural lesson rather than a scandal is the more defensible reading until additional facts emerge.

    Implications for Operators Outside Government

    The lesson generalizes cleanly to enterprise and infrastructure operators. Any organization running a SIEM (security information and event management platform) or an XDR (extended detection and response) stack should audit how repeat closures on the same asset, user, or indicator are handled. A closure that silently suppresses future related alerts is a very different risk profile from a closure that flags recurrence for mandatory re-review.

    For data center, cloud, and connectivity providers in particular — whose customers increasingly demand SOC 2, ISO 27001, and FedRAMP-style assurances — the DHS episode is a useful prompt to document not just detection coverage but escalation logic. Buyers evaluating vendors would be reasonable to ask, during due diligence, how a provider distinguishes a truly benign recurring alert from an intruder generating similar telemetry over days or weeks.

    Background

    The U.S. Department of Homeland Security was created in 2002 and consolidates a broad set of federal missions including border security, emergency management, and cybersecurity. Within DHS, the Cybersecurity and Infrastructure Security Agency (CISA), established in 2018, is the primary federal body responsible for coordinating civilian cyber defense and issuing binding operational directives to other federal agencies.

    Federal cyber operations rely on a layered stack of endpoint detection, network monitoring, and centralized log analysis, staffed by security operations center analysts who close the great majority of alerts as benign. Repeat-closure failures — where a genuine intrusion is misclassified more than once — are a recognized risk category in the security literature and a common subject of after-action reviews.

    Source: DHS network intrusion was twice ruled a false positive before breach confirmed – Nextgov/FCW — reporting that a confirmed DHS breach had been dismissed as a false positive on two prior occasions.

  • DHS Investigates Breach of Its Own Cyber Threat Information-Sharing Network

    DHS Investigates Breach of Its Own Cyber Threat Information-Sharing Network

    The US Department of Homeland Security said it is investigating a cyber breach at an information-sharing network, Reuters reported on July 1, 2026. The networks DHS operates in this category exist to move cyber threat intelligence — indicators of compromise, vulnerability alerts, incident details — between the federal government and thousands of private-sector and state and local participants.

    Beyond confirming an active probe, DHS has released few details: the agency has not publicly named the specific network, described what data may have been accessed, or attributed the intrusion to any actor.

    Executive Summary

    According to Reuters, DHS confirmed it is probing a cyber breach at an information-sharing network — one of the systems through which the US government and private industry exchange threat intelligence. Information-sharing networks are, in plain terms, the group chat of American cyber defense: when one participant sees an attack, the details are pushed to everyone else so they can block it before it reaches them.

    That is what makes this incident notable regardless of its ultimate scope. A breach of a threat-sharing platform is not just another federal IT compromise; it strikes the mechanism that the entire public-private defense model depends on. Such systems can hold sensitive submissions from companies, contact rosters of security personnel, and a running picture of what defenders know — and don’t know — about active threats.

    The disclosure itself is thin. As of the July 1 report, there is a confirmed investigation and little else on the public record. The honest summary is: something happened to a system that exists to help everyone else respond when something happens, and the details that would establish severity — which network, what data, which actor, how long — remain unanswered.

    The Watchtower Becomes the Target

    Threat information-sharing networks are unusually attractive targets precisely because of what they aggregate. A typical platform of this kind carries indicators of compromise (the technical fingerprints of attacks), early vulnerability warnings, and in some cases incident reports that identify which organizations were hit and how. An adversary with access to that stream gains something rare: visibility into what defenders collectively know. They can see which of their tools have been burned, which intrusions have been detected, and which have not.

    There is also a quieter asset inside these systems — the participant directory. Sharing networks connect security officers across critical infrastructure sectors, and a roster of those people, their organizations, and their communication channels is valuable raw material for targeted phishing and social engineering. Even if no threat data was taken, a compromised membership list would have real downstream consequences.

    None of this is yet established in the DHS case; the report confirms an investigation, not a scope. But it explains why a breach at this particular kind of system draws more attention than its size alone might warrant.

    Trust Is the Product

    The US model of cyber defense is voluntary at its core. Companies are encouraged — through liability protections established in the Cybersecurity Information Sharing Act of 2015 and through programs run by DHS’s Cybersecurity and Infrastructure Security Agency (CISA) — to hand the government sensitive details about attacks they experience. The implicit bargain is that the government protects what it is given. Participation rates in federal sharing programs have historically been a persistent challenge, with companies citing exactly this concern: what happens to our data once it leaves our hands?

    A confirmed breach, even a limited one, tests that bargain. The practical risk is a chilling effect — companies quietly sharing less, later, or through informal channels instead — which degrades the common operating picture for everyone. How DHS handles the next phase matters as much as the intrusion itself: prompt notification of affected participants and a transparent accounting of what was exposed is how sharing regimes retain members after incidents. It is worth noting the system worked in one respect: the breach was detected and publicly acknowledged, which is the behavior these programs ask of their own members.

    Confirmation Without Detail: Reading a Thin Disclosure Fairly

    It is worth being explicit about how little is substantiated here. The public record, per Reuters, consists of DHS confirming a probe. There is no named network, no attribution, no timeline, no data inventory. Early-stage breach disclosures are often thin for legitimate reasons — investigators avoid tipping off an intruder who may still have access, and premature scoping statements frequently have to be retracted. Thin disclosure at day one is normal practice, not evidence of concealment.

    The counterweight is precedent. Federal security agencies have been breached before — CISA itself confirmed in 2024 that it took systems offline after attackers exploited Ivanti VPN flaws — and in past incidents the eventual scope sometimes exceeded initial characterizations. The fair posture for now is neither alarm nor dismissal: treat the confirmation as significant because of what the target is, and treat the severity as genuinely unknown until DHS says more. For enterprises that participate in federal sharing programs, the prudent interim assumption is that anything submitted to a government platform could someday be part of a breach scope, and to calibrate submissions and internal exposure accordingly.

    Background

    The Department of Homeland Security has anchored the US government’s cyber partnership with industry since the mid-2000s, a role concentrated since 2018 in its Cybersecurity and Infrastructure Security Agency (CISA). The model is deliberately collaborative rather than mandatory: the Cybersecurity Information Sharing Act of 2015 gave companies liability protections for handing threat data to the government, and DHS built the plumbing to move it — including the Homeland Security Information Network (HSIN) for sensitive-but-unclassified collaboration and CISA’s Automated Indicator Sharing service for machine-speed exchange of attack indicators.

    Those systems serve thousands of participants across critical infrastructure sectors, from utilities and banks to state and local governments. Federal networks have been high-value targets throughout: the 2015 Office of Personnel Management breach, the 2020 SolarWinds campaign, and 2024 intrusions affecting CISA’s own systems all demonstrated that the agencies coordinating US cyber defense are themselves squarely in adversaries’ sights.

    Source: US Department of Homeland Security says it is probing a cyber breach at information-sharing network — Reuters, reporting DHS’s July 1, 2026 confirmation of an investigation into a breach of a federal threat information-sharing network.

  • Hackers Breached DHS Information-Sharing Network, Reports Say

    Hackers Breached DHS Information-Sharing Network, Reports Say

    Hackers breached a Department of Homeland Security information-sharing network, according to a Nextgov/FCW report published June 29, 2026 citing people familiar with the matter. The network is used to coordinate cyber threat intelligence across federal agencies and with private-sector partners.

    Public details are limited. The report does not identify the attackers, the duration of access, or the specific data affected, and DHS has not publicly detailed remediation steps as of publication.

    Executive Summary

    An intrusion into a DHS information-sharing platform is, by definition, a compromise of the plumbing the federal government uses to warn industry about other compromises. Even absent confirmed data loss, a breach of a threat-sharing channel raises questions about the integrity of indicators, advisories, and coordination that downstream defenders rely on.

    For operators of critical infrastructure — data centers, carriers, cloud providers, utilities — the practical concern is trust in the feed. If adversaries had visibility into what defenders were sharing, they could learn which of their tools and techniques had been detected, and by whom. That informational asymmetry, if it occurred, would be more consequential than any single stolen document.

    As of the June 29 report, the scope, attribution, and dwell time are not public. The story is significant less for what it confirms than for the category of system involved.

    Why A Threat-Sharing Breach Is Different

    Information-sharing networks exist so that a compromise at one organization becomes a warning at every other. They aggregate indicators of compromise (IOCs) — file hashes, IP addresses, domains, tactics — from federal agencies, sector-specific ISACs (Information Sharing and Analysis Centers), and private companies. A breach of that pipe is not the same as a breach of a single agency’s email: it potentially exposes what the defender community collectively knows and does not know.

    The strategic value to an attacker is visibility into detection. Knowing which of your malware samples have been catalogued, which infrastructure has been burned, and which techniques have been attributed lets an adversary rotate tooling before defenders notice. That is a durable operational advantage even if no classified material was taken.

    The Trust Question For Industry Consumers

    Critical infrastructure operators subscribe to DHS and CISA feeds precisely because government has visibility private companies do not. If a sharing platform is compromised, downstream consumers face a temporary integrity problem: were indicators altered, suppressed, or seeded with noise? The answer usually turns out to be no, but the question has to be asked and answered before the feed can be trusted at the same weight.

    Practically, this is where mature security programs lean on defense in depth: multiple feeds, internal telemetry, and vendor threat intelligence that does not depend on a single government source. The incident, whatever its scope, is a reminder that no single feed should be a single point of failure in a detection program.

    Attribution And Restraint

    Early reporting on federal breaches often outpaces confirmed facts. Attribution to a nation-state actor, in particular, tends to leak before formal assessments, and initial scoping estimates frequently move by an order of magnitude in either direction as forensic work proceeds. Readers and buyers should treat the current picture as preliminary.

    What is fair to say now: a breach of a coordination system is inherently more concerning per byte than a breach of a general-purpose network, and the government’s disclosure cadence on this incident will itself be a data point about how the current administration handles federal cyber incidents.

    Background

    The Department of Homeland Security has operated cyber information-sharing programs for well over a decade, with CISA — established in 2018 — now serving as the primary hub for coordination with industry. These programs range from unclassified indicator exchanges with private companies to more restricted channels among federal agencies and cleared partners.

    The premise of threat sharing is collective defense: adversaries reuse tooling and infrastructure, so a detection at one organization can protect many. That premise depends on the integrity of the sharing platforms themselves, which is what makes an intrusion into such a system a distinctive category of incident.

    Source: Hackers breached DHS information-sharing network, people familiar say – Nextgov/FCW — report that a DHS platform used to coordinate cyber threat information with industry and other agencies was compromised.