Know-your-customer executive order facing stiff opposition from cloud industry

Summary: The content discusses a controversial executive order proposed by the White House that aims to require U.S. cloud companies to closely monitor the identities of their customers, in response to the cybersecurity threat posed by Chinese and Russian hackers using U.S. cloud infrastructure.

Threat Actor: Chinese and Russian hackers | Chinese and Russian hackers
Victim: U.S. cloud companies | U.S. cloud companies

Key Point :

  • The proposed executive order is aimed at addressing the cybersecurity problem of Chinese and Russian hackers using U.S. cloud infrastructure for cyberattacks or vulnerability scanning.
  • The National Security Agency’s inability to monitor American networks exacerbates the threat.
  • Cloud companies oppose the proposed rule, citing logistical and financial costs and arguing that sophisticated actors can easily deceive them with fake identities.

A controversial executive order that would require U.S. cloud companies to more closely monitor the identities of their customers will move one step closer to the finish line next week amid opposition from the industry.

The White House’s proposed executive order is meant to address an increasingly serious and visible cybersecurity problem in which Chinese and Russian hackers rent U.S. cloud infrastructure space to carry out cyberattacks or scan for vulnerabilities, allowing them to hide in plain sight by acquiring a domestic IP address. 

The threat is exacerbated by the fact that the National Security Agency is barred from monitoring American networks.

Cloud companies have vehemently opposed the proposed rule, pointing to the vast logistical and financial costs it would impose and arguing that sophisticated actors will be able to easily dupe cloud companies with fake identities, thereby rendering the effort meaningless. An industry comment period closes on Monday. 

“The proposed identity verification requirements for IaaS [infrastructure as a service] providers and foreign resellers are overly burdensome, not sufficiently targeted, and risk advantaging foreign competitors,” the technology industry association NetChoice said in comments filed last week.

NetChoice, which represents two of the three largest cloud providers — Amazon and Google — also took the opportunity to knock their biggest competitor, Microsoft, saying the proposed rule would make the U.S. government even more dependent on the Seattle-based company than it already is. 

“The government’s dependence on Microsoft products raises serious concerns, as evidenced by the company’s recent major security breaches,” the NetChoice comment said. “Diversifying technology providers and using the government’s leverage to drive security improvements at Microsoft are essential.”

Supporters of the executive order say the change is vital and argue that the cloud companies need to be reined in, pointing to a report from the American Security Project last year which documented how Microsoft, Amazon and other cloud companies sell their products to the Chinese government and its military.

National security experts said the ubiquity of cloud-based services makes the executive order a no brainer.

“From a national security perspective, cloud-based services and utilities are literally the keys to the Kingdom these days,” said Paul Rosenzweig, a former Department of Homeland Security official who has since founded Red Branch Consulting, which focuses on national security issues. “We have so far migrated away from server based systems, isolated systems, that it’s not even a debatable trend and it’s only going to accelerate.”

Last month the Cyber Safety Review Board slammed Microsoft’s security practices relating to a 2023 cloud-enabled intrusion which led to Chinese hackers infiltrating the emails of Commerce Secretary Gina Raimondo and U.S. Ambassador to China Nicholas Burns. The report included a series of recommendations for improving cloud security.

Rosenzweig said the Microsoft incident along with several others over the past 18 months have led him to conclude that adversaries like China and Russia take advantage of the U.S. in part through the cloud.

“It all comes down to vulnerabilities and we’ve just got to do something better,” he said. 

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

Source: https://therecord.media/kyc-executive-order-cloud-industry-opposition


“An interesting youtube video that may be related to the article above”