SuperMicro Hardware Hack on Server Motherboards

Supermicro Hardware Hack
Supermicro Hardware Hack

Bloomberg reported on February 12, 2021 that a Supermicro hardware hack had been conducted on server motherboards by a Chinese espionage program.  This report follows previous reports by the news agency in 2018 and illustrates the susceptibility of technology manufacturers to supply chain attacks. 

The hack involved embedding a small integrated circuit into the trace on a multilayered printed circuit board.  This malicious hardware was inconspicuous enough to not be detected in quality assurance testing.  Its purpose was to send data from the server to China.  This hack has placed unknown numbers of data centers at risk in the public, private, and defense sectors at risk.

Spy Chips Found in Department of Defense Servers

In the Bloomberg article the United States Department of Defense (DoD) found that large numbers of its servers were sending data to China in 2010.  Previous devices with malicious chips were found in Lenovo laptops used by the U.S. military in Iraq in 2008.  It is not known how much data was compromised by these laptops in Iraq. 

The incident in 2010 involved Supermicro servers on unclassified networks.  While the implanted servers did not send any data regarding military operations, they did provide the Chinese with a partial map of the DoD’s unclassified networks.  Supermicro has stated in response to questions that it had “never been contacted by the U.S. government, or by any of our customers, about these alleged investigations.”

According to Bloomberg sources security experts surmised that the implanted devices could be setting up networks for more extensive hacks or sabotaging entire networks in the event of a conflict between nations.  In 2013 U.S. intelligence agencies including the National Security Agency decided to keep the discovery a secret, install countermeasures, and begin gathering intelligence on China’s motives without alerting it.

Supermicro Hacks Extend Beyond Hardware

Further investigations into the Pentagon breach ascertained that malicious instructions had been embedded in the servers’ BIOS, a set of instructions to the computer configuration that are executed during system start up.  These types of malware are difficult to detect by means available even to users with good security protocols.  These hacks were apparently conducted by Chinese agents early in product development.

Supermicro servers have also been exploited by a security breach generated by firmware updates generated from the company’s site.  These breaches were detected by Intel security executives in 2014.

Hardware Hack and Supply Chain Vulnerabilities

This series of incidents point out the vulnerability to industry supply chains.  Outsourcing manufacture of electronic assemblies to foreign countries is a common practice to reduce costs.  However, business as usual may no longer be an acceptable practice. 

U.S. government officials have in recent years been beating the drum about securing the supply chain, and while this may have immediate ramifications to the public and defense sectors, products destined for the private sector will continue to pose threats for network security and proprietary information. 

Industry has been slow to engage in even basic cyber hygiene practices.  Its willingness to apply stricter controls on its supply chain and manufacturing processes will be interesting to note.  Clearly the Supermicro case along with the SolarWinds hack calls for a serious reassessment of industry protocols and diligence.

Challenges for Information Security Management Systems

Information Security Management Systems (ISMS) are a compilation of policies, procedures, and controls to identify and mitigate risk to data security.  While incident response and asset management are features of these systems, assuring the security of the hardware, firmware, and bios of those assets provides sources of concern beyond the scope of many ISMS currently in place.

The National Security Agency (NSA) Cybersecurity Directorate has released Hardware and Firmware Security Guidance for aiding DoD administrators in the verification of systems currently in use.  This repository is continually updated as new information and guidance become available. 

Although this site is targeted towards the defense sector, it is applicable for organizations in the public sector as well.  A list of hardware and firmware vulnerabilities can also be found in a post on INFOSEC which outlines a number of other vulnerabilities.

CVG Strategy Cybersecurity Solutions

Security of data is essential for any organization.  This includes proprietary data, and the sensitive data of partners and customers.  This latest report on the Supermicro hardware hack underlines the rapidly changing parameters of data security risks. 

CVG Strategy is committed to helping businesses in all sectors, secure their sensitive data.  We can help you meet your information security management system goals.  CVG Strategy QMS experts are Exemplar Global Certified Lead Auditors. 

We can provide the training required to understand and engage in a ISMS and make it meet desired objectives. This process includes defining the context of your organization, creation of internal auditing processes and much more.

The Department of Defense has been undertaking efforts to secure Unclassified Controlled Information (CUI) in its supply chain by the implementation of the Cybersecurity Maturity Model Certification (CMMC) program.  CVG Strategy is helping DoD contractors prepare to for these requirements while meeting interim DFARS 252.204-7012 assessment requirements.

International Trends in Cybercrime 2021

international trends in cybercrime
international trends in cybercrime

International trends in cybercrime show an increasing sophistication by both organized crime and hostile nation states.  These cybercriminals are continuing their efforts against high-value targets that include the industrial, IT, and infrastructure sectors.  This activity is occurring at a time when many organizations are struggling to develop integrated cybersecurity solutions.

Cybercrime Exploitation of Uncertainty

Cybercrime trends show continued use of familiar methodologies, such as Distributed Denial of Service (DDoS), phishing attacks, and ransomware attacks.  They have however, been quick to adapt strategies to tailor their cyber attacks to exploit opportunities presented by issues of the day.  The Microsoft Digital Defense Report released in September 2020 showed a large number of COVOID-19 themed attacks that started in February 2020 that trailed off in April 2020. 

Similar findings were found in EUROPOL’s Internet Organised Crime Threat Assessment.  This bringss additional challenges to law enforcement agencies involved in cybercrime investigations as they must continually respond to a changing cyber threats profile.

Industry Slow to Achieve Cybersecurity Maturity

Many industrial sectors have been reluctant to adopt systematic approaches to cyber hygiene.  Effective cybersecurity for organizations must include an Information Security Management System (ISMS).  An  ISMS is a collection of policies, procedures, controls, and incident responses that systematically address information security in an organization.  It is a framework based on risk assessment and risk management.

This has been the case with numerous businesses in the United States contracting with the Department of Defense (DoD).  In 2020, the interim ruling, DFARS 252.204-7012, placed cybersecurity requirements on Department of Defense (DoD) supply chain contractors vendors to complete security compliance with NIST SP 800-171 DoD assessment methodology.  

This has left many smaller businesses scrambling to meet SPRS Cybersecurity Assessment Requirements.  Once this challenge has been met they must move towards future Cybersecurity Maturity Model Certification (CMMC) to protect Controlled Unclassified Information (CUI) in the defense industry supply chain.

Industry, Infrastructure, Internet of Things Devices, and Industrial Control Systems

Many manufacturers and public infrastructure providers have implemented Internet of Things (IoT) devices to increase efficiency and productivity.  Billions of these devices are currently in use worldwide.  These devices are used in smart home products, wearable technology, health monitoring devices, alarm systems, and transportation equipment.  They can also be found in industrial controls technology, agriculture, military, and infrastructure applications. 

Most manufacturers implement such devices to control processes and gather critical data.  Unless these devices are correctly selected and properly implemented they present vulnerabilities for data breach of personal data, proprietary data, and industrial process control.  For example, in February of 2021 a hacker was able to access controls of a city water treatment facility, increasing levels of lye to dangerous levels.

Managed Service Providers Cybercrime Vulnerabilities

Managed Service Providers (MSP) allow businesses to outsource functions such as human resources, IT, and payroll.  These companies provide tempting targets for cyber crime.  In 2020 there were numerous high profile incidents involving MSPs. 

Once the MSP has been compromised the attack can be spread throughout its clients’ information with the same administrative rights as the service provider.  The attack can then result in stolen data and/or a ransomware attack to the client.

Understanding the Players

Cybercriminals control a vast underground economy worth trillions of dollars a year.  Hacking enterprises offer their services for hire and sell their stolen private and proprietary data online.  These players specialize in specific methods to meet their clients needs.  Beyond the hackers, dealers of stolen data create wealth to fund other activities including human trafficking.

Hostile nation states are key players in cyberattacks.  While countries like China are openly engaged in stealing proprietary information to further its economic gains, others like North Korea have funded their missile development programs through cybercrime.  A United Nations panel reported that North Korea is conducting operations against financial institutions and virtual currency exchanges. 

According to the Microsoft threat report, nation state targets include IT organizations, commercial facilities, critical manufacturing, financial services, and the defense industrial base.  The goals of these attacks is to acquire proprietary and confidential information and disrupt infrastructure facilities.

Responding to the Threats with ISMS

Responding effectively to international trends in cybercrime requires an integration of technological and management measures in an Information Security Management System framework.  This framework should acknowledge that a majority of industry peers have experienced a data breach and create viable incident responses that can detect, respond, and recover.

An ISMS should maintain accurate asset inventory, identify data flows and remote accesses so that an organization can conduct risk assessments and institute effective controls, policies, and procedures. Risk management should also identify the gap between an organization’s current current state of control practices and its desired state and create gap remediation.

These controls must then be integrated with appropriate security management technology.  Such technologies include physical security, multiple layer firewalls, and breach detection.  These tools provide methods to secure, defend, contain, and monitor data.

CVG Strategy Information Security Management System Consultants

International trends in cybercrime present challenges to organizations of all sizes.  We can help you meet your information security management system goals.  CVG Strategy QMS experts are Exemplar Global Certified Lead Auditors.  We can provide the training required to understand and engage in a ISMS and make it meet desired objectives.

New Chinese Export Control Law Released

chinese export control law
chinese export control law

The release of the new Chinese Export Control Law (ECL) were approved by the National People’s Congress on October 17, 2020 and became effective December 1, 2020.  These laws will effect the export of military, dual-use items, nuclear items, and items related to the national security interests if the Chinese government. 

On December 1, 2020 the ECL was further defined through the release of a number of articles that detail such items as controlled items, country and product lists, and enforcement actions.

Previous export laws in China had fallen under a variety of regulations including Customs Law, Criminal Law and Foreign Trade Law.  This new centralized Export Control Law should streamline the states ability to place restrictions on export and trade.  The new ECL are similar in structure, at first glance, to many systems in effect internationally, including the United States and Canada. 

Concerns in the International Community

There are shared concerns in the international community that China may strategically target selected markets and technologies to secure advantages in certain market niches.  This may result in nations strengthening provisions concerning licensing practices and export control of the Wassenaar Arrangement.

The Role of ECL in Chinese Foreign Policy

While citing national security for its implementation of the ECL, the law is seen by many as a response to recent sanctions of the United States against Chinese companies such as Huawei Technologies.  Many importers of goods from China remain hopeful that decisions made by the government apply the laws in a consistent and transparent manner.  It is also important to note that this action occurs at a time when China is seeking to broaden its international economic influence.

State Export Control Administrative Departments

The ECL will be administered and enforced by the State Export Control Administrative Agency to control the export of goods, technologies, or services.  They will apply especially to items for military and nuclear uses and dual-uses.  They will also extend to any items related to China’s international obligations (i.e. non-proliferation treaties and any goods used for terrorist purposes. 

The State Export Control Administrative Agency will be comprised of the State Export Control Administrative Departments (SECADs).  The SECAD shall have the authority to create the Export Control Item List of controlled goods and impose temporary prohibitions for a length of two years on any items seen as a threat to the national security of China.

ECL Framework

To engage in the export of controlled items or transfers of controlled items, applications for licensing are required.  Transport of these items shall be performed by an approved enterprise. As with U.S. export law, the ECL extends to the transfer of technologies and information.  Under the U.S. International Trade in Arms Regulations (ITAR) and the Export Administration Regulations (EAR) such transfers are referred to as deemed exports. 

While the ECL framework is at present is sparse, containing only 49 Articles, 11 of those articles deal directly with the enforcement of the laws.  To be certain, exporters in China, and those engaged in re-exports, transfers, or import of goods from China should treat these provisions with respect.  Furthermore businesses that rely on imported goods or services from China should appraise their supply chain vulnerabilities.

Viewing the ECL in the Larger Picture

The new Chinese Export Control Law is but one development in the country’s agenda.  During the last several years, China has been become a more hostile force to be reckoned with. 

Increased Hostile Rhetoric Towards Taiwan

On January 29, 2021 the Global Times, an English language newspaper operated by the Chinese government, reported that Wu Qian, spokesperson of China’s Ministry of National Defense, said that “Taiwan independence” means war.  He went further to state that, should Taiwan choose to collide with the mainland’s will that they “they will be like a moth to a flame”.

China Island Building in South Seas

The islands, which have been under construction since 2013, have been condemned by the United States and nations in the South China Seas.  The U.S took further action by adding Chinese companies involved in the construction to the Entity List.

The islands allow for the military control of some of the busiest shipping lanes in the world.  The World Court ruled that the building of islands violated the sovereign rights of the Philippines.  This ruling has been supported by Japan, Vietnam, and Australia who also contest China’s assertion of claims to the waters.

Actions in Hong Kong

For decades, the Hong Kong Special Administrative Region (HKSAR) has served as a major conduit for global finance and trade.  The Chinese Communist Party imposed severe security measures under the National Security Law on the area in 2020.  In addition to raising concerns about human rights, these actions are seen to undermine the autonomous status of Hong Kong.  As such, it is now impossible to ensure that exports are not diverted to China’s People’s Liberation Army or Ministry of State Security.

As a result the United States Department of Commerce suspended Hong Kong’s special status for the export of sensitive technologies.  The United Kingdom, has voiced concerns for human rights and trade in Hong Kong and has undertaken an effort to allow citizens of Hong Kong to move to the U.K. and eventually apply for citizenship. 

The European Union (EU) has stated its concerns about the conformity of the National Security Law with Hong Kong’s Basic Law and with China’s international commitments.  The European Union considers it essential that the existing rights and freedoms of Hong Kong residents are fully protected.  How the rest of the world reacts to this crisis will very likely change the dynamics of trade in the region.  It will be important therefore, to continue monitoring this situation.

CVG Strategy Export Compliance Consultants

Given the degree of volatility in the international arena, it is more important than ever that businesses remain aware of developments in trade laws.  The new Chinese Export Control Laws are just one example of a development that could greatly effect a company’s business operations.  CVG Strategy, LLC is recognized the world over as the premier provider of export compliance consultation. 

We can help you develop customized export compliance programs that address your organizations requirements.  We specialize in integrating compliance programs into quality management systems to ensure essential documentation, control, and assessment.  This includes ITAR and  Export Administration Regulations (EAR).  We also can provide assistance with the Canadian Goods Program.

Our ITAR compliance consultants work with businesses of all sizes.  We can provide training for your organization at all levels to keep your team up to date.  We even serve as an outsourced Export Compliance Officer for some clients, who don’t have the bandwidth to dedicate to the function but need it done on a part-time basis.

Karlton Johnson Chairs CMMC Accreditation Body

Karlton Johnson leads CMMC
Karlton Johnson leads CMMC

Karlton Johnson chairs CMMC-AB after serving as interim since September of 2020.  The accreditation body can now continue in its efforts to accredit sufficient assessors to certify the cybersecurity maturity of Department of Defense contractors.  The body had faced a challenges when on September 2, 2020 two members of the Cybersecurity Maturity Model Certification Accreditation Board were voted off in the midst of a conflict of interest controversy involving a pay to play strategy. 

Background on Karlton Johnson

Karlton Johnson, a decorated combat veteran, served as the Chief Information Officer (CIO) for the Multinational Security Transition Command-Iraq building ICT capabilities for a variety of agencies of the Iraqi government. He then went on to serve as the senior U.S. cyber executive for South Korea.  In 2014 Johnson retired from the United States Air Force after 26 years of service as a Colonel.

From military service, Johnson engaged in the private sector where he specialized in overseeing large-scale initiatives from the concept phase to full implementation.  More recently Johnson originally served as vice chair of the accreditation body CMMC-AB and as the acting chair since September 2020.

Challenges Moving Forward

Now that Karlton Johnson chairs the CMMC-AB, it is expected that stability on the board will ensue.  This is based on numerous supportive statements of fellow board members.  This stability will be required to successfully provide accreditation for the large number of cyber security certified assessors needed for implementing CMMC for Department of Defense (DoD) contractors and subcontractors.  This must occur while CMMC requirements are still being finalized.

Background on CMMC

CMMC was created  by the Office of the Under Secretary of Defense for Acquisition & Sustainment as an effective means of implementing risk based management approaches to cybersecurity.  It is a cooperative effort between the DoD and industry and is coordinated by the Cybersecurity Maturity Model Certification Accreditation Board (CMMC-AB).

The CMMC was enacted to place cybersecurity requirements on DoD contractors to achieve levels of cybersecurity maturity to protect Controlled Unclassified Information (CUI)  and Federal Contract Information (FCI) in the defense industrial base supply chain.  Katie Arrington is the current director of CMMC and has stated the necessity of creating an enterprise centric solution for the protection of CUI.

Current Status of CMMC

As of this posting, interim ruling, DFARS 252.204-7012 Interim Rule, has placed immediate cybersecurity requirements on Department of Defense (DoD) supply chain contractors.  Among the changes is a requirement for vendors to complete security compliance with NIST SP 800-171 DoD assessment methodology.  This assessment must be completed by the contractor before DoD contracts can be awarded.  

This assessment is based on a scoring methodology of security requirements.  The methodology is comprised of three levels (basic, medium and high).  The interim rule requires a basic level self-assessment to be completed by the contractor. 

What Lies Ahead?

When the CMMC-AB approves the registration bodies, there will be a set of Third Party Assessment Organizations (C3PAOs) approved.  These Third party organizations are accredited by the official CMMC Accreditation Body and will then be authorized to conduct CMMC assessments and grant CMMC certifications.

CVG Strategy Can Help

Meeting cybersecurity requirements is proving to be a challenge for DoD contractors, especially smaller businesses involved in subcontracting. CVG Strategy can provide pre-assessment training, implementation and subject matter support.  We can also provide integrated solutions for CMMC implementation using proven business management approaches.

ITAR Training Schedule – Export Compliance

ITAR Training Schedule

CVG Strategy, a trusted name in ITAR and Export Compliance consulting and training announces its current ITAR Training Schedule.  CVG Strategy has been providing ITAR compliance training programs now for over a decade.  Our classes are informative, engaging, and provide time for your questions.

CVG Strategy  ITAR Compliance Training Webinars, presented by CVG Strategy’s Senior ITAR Training Manager, Kevin Gholston, provide comprehensive training in all sectors of export compliance including International Traffic in Arms Regulations (ITAR) and Export Administration Regulations (EAR). 

Regular training is essential for companies dealing in defense articles or services and is required by both the Department of State Directorate of Defense Trade Controls (DDTC) and the Bureau of Industry and Security (BIS). 

ITAR Training Schedule for Fall 2022

August 23, 2022                              September 13, 2022                                   October 11, 2022

ITAR Training Schedule

Export Compliance Integration into Quality Management Principles

ISO 9001:2015 quality management system (QMS) requirements include the consideration of external factors such as ITAR regulatory requirements.  Organizations that need to fulfill these requirements  need to be aware of that auditors may be asking about ITAR/export compliance and how it affects their organization.  CVG Strategy can provide implementation, training and support for clients needing an export compliance program.

“We’ve had great success in helping companies with ITAR training and export compliance consulting,” said Cindy V. Gholston, President of CVG Strategy. “With the enhanced focus on external regulations in the new ISO 9001:2015 and AS9100D it’s important to incorporate export compliance as part of their QMS.”

Course Description

CVG Strategy’s ITAR and export compliance training conforms with the guidelines from the Department of State’s Guidelines and the Department of Commerce’s Elements.  CVG Strategy’s ITAR Training Program  keeps compliance professionals up to date on export control and export regulation developments.  This ensures that your company can avoid costly violations.

Course topics include:

  • The legal basis for ITAR and the USML (United States Munitions List)
  • EAR and CCL (Commerce Control List) as administered by the BIS
  • Technical data controls
  • Filing for Export licenses
  • Enforcement of export compliance regulations and penalties
  • How to engage in brokering activities
  • ITAR and EAR classification activities

Our Export Compliance Training Goals

Export compliance is an extremely complex subject.  While it is, without doubt, a subject of extreme importance, most training sessions available to the public are dull.  CVG Strategy encourages class participation and because we limit the size of our classes you have ample opportunity to get clarification on any questions you might have.  As a result students have a better retention of important information.

Our training provides an overview of the ITAR and EAR so that students can confidently approach the many pages of regulations they need to access in their daily functions as members of an export compliance team.

Export Compliance Education is Important

Export Compliance regulations are continually being modified to protect U.S. national security and foreign policy needs.  Failure to comply with these regulations can result in administrative and/or criminal penalties.  These penalties include fines, debarment from export activities, and even imprisonment.  Additionally, incidents that require enforcement can damage the reputation and credibility of your organization.

Enforcement agencies are increasing their efforts to prosecute organizations that violate export violations.  They are also increasing penalties and publicizing actions taken against companies found to be guilty of infractions.  This applies not only to the ITAR and EAR regulations but to denied parties and antiboycott regulations as well.

When evaluating an export compliance program, agencies will access the level and regularity of training provided to members of that organization.  Proper training allows team members to correctly perform export control classifications, identify foreign nationals, and determine which transactions require a license.  Check our ITAR Training Schedule regularly to keep your export team up to date. 

About CVG Strategy

CVG Strategy is a certified 8(a) minority woman-owned consultancy located on the Space Coast of Florida, just south of Cape Canaveral.  Areas of focus include ITAR, Product Qualification Testing, Business Operations and ISO 9001:2015 training and consulting services.  

CVG Strategy provides export consultant services, and online answers to your ITAR questions.  We also offer a wide array of signs, badges, and accessories on our ITAR Store to help keep your facility ITAR compliant.

Teleconferencing Guidance for Education

Teleconferencing Guidance
Teleconferencing Guidance

The Cybersecurity and Infrastructure Security Agency (CISA) has released Teleconferencing Guidance for education.  Remote classroom teleconferencing has continued to grow.  As a result it has been a tempting target for cybercrime.

Recommendations for K-12 Schools

School districts are increasingly using teleconferencing tools to deliver their services.  These tools have increased in availability and capability.  Their use however, comes with risk as the volume and sophistication of cybercrime continues to grow.  As a consequence, schools and school districts must assess risks to both school IT networks and individual users.

Threats to Teleconferencing

Cyber threats are posed by nation-states, criminal organizations, and people inside an organization.  Common tactics used include:

  • Exploiting unpatched software vulnerabilities.
  • Eavesdropping.
  • Hijacking video teleconferencing with inappropriate content.
  • Use of teleconferencing applications to infiltrate other applications.
  • Penetrating sensitive meetings through social engineering to deceive people into divulging private information.
  • Some products may share or sell customer information to third parties.  This data sharing can unintentionally expose student and school information.

Teleconferencing Guidance for Teachers and Students

CISA guidance for teachers and students include:

For Teachers

  1. Only use organization-approved software and tools to host and schedule meetings.
  2. Consider sensitivity of data before exposing it (via screen share or upload) to video conferences. Ensure that only data needed to be shared is visible.
    • Close or minimize all other windows and consider turning off alerts for incoming messages.
    •  If displaying content from organizational intranet sites in public meetings, hide the address bar from participants before displaying the content.
    • Use common sense—do not discuss content you would not discuss over regular telephone lines.
    • When having sensitive discussions, use all available security measures.
    • Ensure all attendees of the meeting are intended participants.
  3. Do not attempt to install software not approved by your school.
  4. Do not make meetings public unless they are intended to be open to anybody.
  5. Have a plan for what circumstances constitute termination of a meeting, who has the authority to make that decision, and how the meeting will be terminated.
  6. Require passwords and use a waiting room to control admittance of guests.
  7. Provide links to meetings directly to specific people and share passwords in a separate email.
  8. Manage screensharing, recording, and file sharing options. Limit who can share their screen to avoid any unwanted or unexpected images. Consider saving locally versus to the cloud.  Change default file names when saving recordings.  Make sure to consult with your organization or district’s counsel about laws applicable to recording video conferences and sharing materials through them

For Everybody

  1. Make certain that your audio and video surroundings are secure and do not reveal any unwanted information.
  2. Move, mute, or disable virtual assistants and home security cameras.  Do not conduct meetings in public places.  Consider using headphones.
  3. If using a personal device
    • Require passwords to log in to device.
    • Only use elevated privileges when performing administrative functions on the device.
    • Close all non school related windows before and during school activities.
    • Keep operating systems and relevant applications up to date.
    • Turn on automatic patching and Anti-Virus software.Check and update your home network.  Use complex passwords for your home Wi-Fi network.  Enable router with encryption protocols such as WPA2 or WPA3.  Disable legacy protocols such as WEP and WPA.
  4. Check and update your home network.  Change default settings and use complex passwords for your broadband router and Wi-Fi network and only share this information with people you trust. Choose a generic name for your home Wi-Fi network to avoid identifying who it belongs to or the equipment manufacturer. Update router software and ensure your Wi-Fi is encrypted with current protocols (such as WPA2 or WPA3), and confirm that legacy protocols such as WEP and WPA are disabled.
  5. Be wary of links sent by unfamiliar addresses, and never click on a link to a meeting sent by a  suspicious sender. Verify that meeting links sent via email are valid.
  6. Do not share student credentials or links, with strangers who may use them to disrupt classes or steal information. Do not share passwords with anyone.
  7. Carefully review meeting invitations sent for sessions. Check to see if the meeting originated from a known teacher or other school employee.  Verify that the address has the district’s or school’s name in the URL.

Teleconferencing Guidance and Cybersecurity Practices for K-12 Organizations

CISA recommends the following Security Practices for K-12 Organizations:

  • Assess organizational needs and determine the appropriate products.
  • Establish organizational distance learning policies or guides to address physical and information security.  Based on these documents, develop easy to understand (e.g. one-page) summaries for teachers, students, and parents.
  • Limit and minimize the number of authorized collaboration tools to reduce the overall amount of vulnerabilities.
  • Maintain the latest versions of software and remove all obsolete versions from managed devices.
  • Instruct users to join web (browser) based sessions that do not require installation of client software. 
  • Prohibit end users from installing client software on school- or district-managed devices.
    (including removing local administration rights).
  • Prevent system administrators from using collaboration tools on the system while logged on with administrative
    privileges.
  • Prohibit the use of collaboration tools and features that allow remote access and remote administration.
  • Clearly educate employees legal, privacy, and document retention implications of using teleconferencing tools.

CVG Strategy

We all have family and friends who are teachers, students, or education administrators, and we acknowledge the difficulties they are enduring during this pandemic.  Therefore we are providing this Teleconferencing Guidance for education for our community.

CVG Strategy cybersecurity experts are committed to keeping organizations’ information secure.  We help businesses and organizations implement ISMS solutions that fit unique requirements and provide the training required to make them work.  Contact Us today to see how we can help.

Industrial Control System Cybersecurity Practices

Industrial Control Systems Cybersecurity
Industrial Control Systems Cybersecurity

Industrial Control System Cybersecurity

Guidance for Industrial Control System (ICS) Cybersecurity was released on May 22, 2020.  This two page infographic is a joint release from the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Energy (DOE), and the UK’s National Cyber Security Centre (NCSC).  This release addresses the urgent need for owners and operators to adopt new technologies and improve operational efficiencies to secure critical infrastructure.

Manufacturing and Infrastructure Highly Vulnerable

A number of recent cyberattacks to industrial targets illustrate the degree of vulnerability and the costs of breached security.  In February 2020 a natural gas compression facility was attacked.  This led to a two day shutdown of the vital facility.  On May 10, 2020 Iran’s port, Shahid Rajaee, was a the victim of an attack.  Subsequently the port was inoperable for days. 

Most industrial sites are comprised of legacy IT systems that predate cybersecurity requirements.  Additionally, many facility managers or maintenance personnel have insufficient expertise in IT and requisite cybersecurity protocols.  Therefore many complex systems have high vulnerabilities that are extremely difficult to secure. 

Most Prevalent ICS Weaknesses and Risks

CISA has identified the following weaknesses and risks to Information Technologies (IT) and Operational Technologies (OT):

Boundary Protection

Unauthorized activity in critical systems is often undetected.  Additionally, there are often insufficient boundary protection between a facilities Industrial Control Systems (ICS) and its enterprise systems.

Principle of Least Functionality

Because of the complexities of industrial sites, there are ever increasing vectors for malicious access to critical systems.  This provides opportunities for rogue internal access.

Insufficient Identification and Authentication

The report sites a lack of traceability and accountability of personnel that have access to large facilities and has special concern for those with administrator access.

Physical Access Control

Inadequate controls on physical access to large facilities is a major problem.  Unauthorized personnel can modify, copy, or delete device programs and firmware.  They can tap into networks, vandalize assets, and add rogue devices to retransmit network traffic.

Recommended Industrial Control System Cybersecurity Measures

A number of recommendations were made in this report.   These recommendations include the following:

Risk Management

The first action taken should be to develop an effective Information Security Management System (ISMS) to identify potential threats.  This process would include compiling and maintaining an inventory of all ICS assets.  Once this has been accomplished policies and procedures can be created.  These procedures should include adequate training of all personnel and provide practice incident responses.  These policies and procedures should establish rules of cybersecurity behavior and promote a culture of information exchange for constant improvement.

Physical Security

Control of physical access is crucial.  Lock downs of electronics, multi-factor authentication, and establishment of controlled spaces are important measures. 

ICS Network Architecture, Perimeter Security, and Security Monitoring

Recommendations include:

  • Network segmentation
  • Multiple layer topologies that prioritize security to most critical communications
  • Configuration of firewalls to control traffic between ICS and corporate IT
  • Restrict persistent remote connection to networks
  • Catalog and monitor all remote connections
  • Measuring baseline network traffic
  • Creation of alarms for network Intruder Detection Systems (IDS)
  • Set up Security Incident and Event Monitoring(SIEM) to monitor, analyze, and correlate eventlogs from across the ICS network to identify intrusion attempts.

Host Security

  • Test all patches in off-line test environments before implementation.
  • Implement application whitelisting on human machine interfaces.
  • Harden field devices, including tablets and smartphones.
  • Replace out-of-date software and hardware devices.
  • Disable unused ports and services on ICS devices after testing to assure this will not impact ICS operation.
  • Implement and test system backups and recovery processes.
  • Configure encryption and security for ICS protocols.

CVG Strategy

CVG Strategy is committed to assisting manufactures establish effective cybersecurity systems.  Our Cyber Security consulting and training programs give you the necessary knowledge to ensure that safeguards are consistently applied to protect valuable information and production assets.  We can help your business develop an effective ISO 27001 ISMS.  We also have expertise in NIST 800-171 and can help with CMMC Certification.  Contact Us today to see how we can help.

FBI Investigating HHS Cyberattack

FBI Investigating HHS Cyberattack
FBI Investigating HHS Cyberattack

The FBI Investigating HHS Cyberattack During Coronavirus Crisis

The AP reported that Attorney General William Barr has announced that the FBI is investigating the HHS Cyberattack that took place on March 16, 2020 for the involvement of foreign governments.  The incident that was originally reported on Sunday March 16, 2020 by Bloomberg, involved a cyberattack on the Department of Health and Human Services (HHS).  The attack attempted to launch disruptive information and impede the agency’s response.  Fortunately, the attempt failed to penetrate the network.  The HHS  was continually monitoring the infrastructure and detected a significant increase in activity.

Government Cybersecurity Preparedness

Government agencies are attractive targets for cyberattacks.  In 2018 President Trump signed into law the creation of the Cybersecurity and Infrastructure Security Agency to bolster the government’s capacity to defend against cyberattacks.  The HHS along with other agencies have been slow to implement improvements to its IT infrastructure.  The Government Accountability Office report issued in February of 2020 states that all but two federal agencies had failed to “effectively monitor the implementation of a voluntary cybersecurity framework”.  The HHS was among those criticized.  The agency did however replace its cybersecurity operation with the HHS-DHS Health Cybersecurity Coordination Center.  It may well be because of this change that this crisis was averted.

Health Industry Preparedness

The HHS published Health Industry Cybersecurity Practices (HICP) to move health providers towards effective practices to protect important and sensitive data.  This information is provided in two volumes, one for small health care organizations and another for medium to large providers.  This effort is well designed but its implementation is difficult to assess.  This is due to the fact that there is no mandate for companies to their information to the government.  Based on a general survey of business cyber preparedness most U.S. companies are not ready to protect critically sensitive data.

CVG Strategy Cybersecurity

CVG Strategy cybersecurity experts are committed to helping businesses attain effective cybersecurity programs.  We can help you implement ISO 27001 Information Security Management Systems to develop a scalable solution to protect your valuable data.  Contact Us today to see how we can help

Public Sector Quality Management

public sector quality management
public sector quality management

Public Sector Quality Management Applications

There have been numerous attempts at implementing public sector Quality Management Systems (QMS) in the past decades.  These attempts have had mixed results due to a number of factors.  Many programs at the federal level, such as those incorporated by the Department of Defense (DOD) in the 1970’s, have been examples of success and continue to be effective in the increase of productivity.  Several states, including Florida, have incorporated programs to  to ensure Management Excellence, Customer Satisfaction, Treatment Excellence and Cost Efficiency in service delivery.  Municipal applications have striven to pursue quality of public services by Identifying and addressing community priorities, collaborating across departments, and ensuring accountability, transparency and measured results.

Differences Between Public and Private Sectors

There are obvious differences between the public and private sectors that inhibit effective quality management of government.  The public sector is not driven by market issues and does not need to maintain a competitive edge.  It is often driven by short term perspectives.  It faces a rotating tier of elected and appointed upper management that makes consistent application of a program difficult.   The public sector also has a tendency to rely on established processes at the expense of efficiency.

Public Transportation and QMS

Public transportation has been a good application for QMS.  This is largely due to availability of solid metrics.  Ridership, customer satisfaction, and effectiveness of vehicle and facility maintenance being such examples.  This is particularly important at a time where many transit arenas are showing  reduced ridership.  Of those programs that have been most effective focus has gravitated towards customer satisfaction, attracting new customers, and reducing costs.

The Need For QMS at the Top

For effective QMS businesses have realized that buy in is required by all stake holders and that upper management must fully embrace processes and the requirement for continual improvement.  Unfortunately this is not the case in very large bureaucracies where there is not a cohesive set of policies across departments.  Additionally, many programs do not have sufficient requirements for proactive evaluation of quality metrics.  In the case of the DOD for example, this often leads to cost overruns caused by quality issue delays in program development.

The Future of Public Sector Quality Management

While the need for effective QMS in the public sector is becoming more desirable due to limits in funding, many issues will need to be overcome in its implementation.  Key among these issues are a culture of complacency and a reluctance to change.  Growth in public sector makes these changes more and more necessary and many administrations of late have undertaken initiatives to make these changes.  It will be interesting to note how these systems evolve.

 

Airbus ITAR and Bribery Penalties Over $3.9 Billion

Airbus ITAR and Bribery Penalties
Airbus ITAR and Bribery Penalties

Airbus ITAR and Bribery a Massive Multi-year Scheme

The Department of Justice recently announced that Airbus ITAR and Bribery Penalties would amount to more than $3.9 Billion in fines to the United States and United Kingdom.  Airbus, based in France, is a leading global manufacturer of commercial and military aircraft.  This case, which involved the coordination of multiple international law enforcement agencies, found that Airbus used third party business partners to bribe government officials and airline executives around the world. 

Charges filed in the United States included conspiracy to violate the anti-bribery provisions of the Foreign Corrupt Practices (FCPA) act and conspiracy to violate the International Traffic in Arms Regulations ITAR.  The nearly 4 billion dollars in fines constitutes the largest global foreign bribery resolution to date.  Airbus engaged in bribery in China, Malaysia, Sri Lanka, Taiwan, Indonesia, and Ghana.  They then engaged in further corruption by concealing those bribes.  This scheme took place between 2008 and 2015 and involved Airbus personnel located in the United States.

Sensitive Defense Technologies Involved

Because sensitive defense technologies were involved in this corruption case, ITAR violations were also committed.   The ITAR are export regulations that prohibit export of defense related technologies to restricted nations.  Violation of ITAR can result in serious criminal and civil penalties.  It can also result in loss of ability to export.  All companies must classify products and services to determine the degree of control required for export to a foreign citizen or foreign chartered corporation.  They must also ensure that all parties to a sell are legitimate and that products will not be unlawfully redistributed. 

Airbus engaged in a criminal conspiracy to knowingly and willfully violate the AECA and ITAR, by failing to provide DDTC with accurate information related to commissions paid by Airbus to third-party brokers who were hired to solicit, promote or otherwise secure the sale of defense articles and defense services to foreign armed forces. 

ITAR Specific Penalties

ITAR specific violations that Airbus committed from 2011 and 2019 involve ITAR part 130 – Political Contributions, Fees and Commissions.  This involved failure to maintain accurate records and report statements of fees or commissions paid to facilitate sales.  Other violations unauthorized retransfers of defense articles from Spain and reexport of defense articles from Spain to Australia.  In a civil settlement Airbus agreed to a 3 year assignment of a Special or Internal Compliance Officer, implementation of extensive remedial compliance measures, and $10 million in for the remedial compliance measures.  Additionally if agreed penalties are not paid, or sufficient corrective actions taken, Airbus faces being debarred or suspended from export transactions.

CVG Strategy

ITAR compliance is important for any company involved in controlled products and services.  While the Airbus ITAR and bribery penalties resulted from a flagrant violation of the law, government export enforcement agencies have shown a increased vigilance in their activities.  As with any other set of laws ignorance is not an excuse.  Get your ITAR questions answered today by our experts.

ISMS System – 27k1 Ltd appoint CVG Strategy LLC

ISMS System
ISMS System

17th February 2020 – Company Announcement

ISMS SystemISMS System

 

 

 

27k1 Ltd Appoint CVG Strategy LLC as First, US Reseller of 27k1 ISMS System

According to the latest ISO 2018 Survey, demand for ISO/IEC 27001 certification in the US has increased by 37% since 2017. Given this growth trajectory and recognizing that ISO 27001 is the global, “gold standard” in information security certification, 27k1 Ltd is delighted to announce that it has taken steps to introduce the 27k1 ISMS (Information Security Management System) software to the US market, appointing CVG Strategy, LLC, as its first US based system reseller.

Many companies are struggling with the implementation of a compliant ISMS for NIST 800-171 using ISO 27001 as solution.  Now, with the U.S. Department of Defense’s announcement of Cybersecurity Maturity Model Certification (CMMC) replacing NIST 800-171, ISO 27001 ISMS will be much easier to implement for all sizes of organizations.  Now, with the 27k1 ISMS System software to support the effort, companies can abandon the spreadsheet approach to process control.

About CVG Strategy LLC

CVG Strategy, based in Viera, Florida is an established Information Security consultancy, focused on delivering a range of Governance, Risk and Compliance solutions, including US DoD Standards, NIST and ISO 27001.

The business is owned and operated by Cindy and Kevin Gholston, who are highly qualified ISMS practitioners. Their team possess extensive knowledge of Quality, ITAR and Export Compliance, Product Test and Cybersecurity. Complemented by effective training and implementation services, their staff include Exemplar Global Certified ISO 27001:2013 Lead Auditors and CISSP Experts.

Directors Comments

Jeremy Martin, Co-Founder of 27k1 Ltd stated that “we are thrilled to be working with CVG Strategy, given their expertise, customer base and their enthusiasm for supporting their customers through the ISO 27001 certification process. Moreover, following the UK’s recent exit from the European Union, we look forward to closer trading relationships between US and UK businesses.”

Similarly, Cindy Gholston, President of CVG Strategy remarked that “In the 27k1 ISMS System we have finally found a total, software compliance solution that takes us away from using spreadsheets, templates and paper documentation. The intuitive design of the system will allow our customers to become more involved with information security and risk management, better understanding their position and at the same time, secure their place on federal and international supply chains.”

ISMS System Pricing

The 27k1 ISMS is priced at US$1,960.00 for a 1 year’s subscription, including full product support. For more information, please visit  https://27k1.com

27k1 Ltd, 25 Main Street, Staveley, Kendal, Cumbria, LA8 9LU, UK

Apple iCloud Full Encryption News Should Raise Concerns

apple icloud full encryption
apple icloud full encryption

Apple Drops Plans for iCloud Full Encryption

As reported by Reuters on January 22, 2020, Apple has dropped plans for full encryption of the iCloud for iPhone users.  This was in response to complaints by the FBI that such encryption would harm investigations.  Certainly the need for the availability of data by law enforcement agencies in cases such as the Saudi Air Force officer who killed three people in Pensacola, Florida, can be argued to be valid.  It should however, raise larger questions as to the total security of cloud based computing and the efficacy of using it for businesses.

Cloud Computing and Businesses

Cloud computing is experiencing tremendous growth in the business sector.  On the face of it, there are many advantages to cloud computing for businesses.  It is a scalable solution that meet a company’s growth, it offloads requirements for back up and disaster recovery, and it improves document control.  That however involves some serious consequences.

Business Cybersecurity

A business’s data is priceless.  When you offload the responsibility for maintaining the security of that data you cannot be certain your best interests are being met.  Ask yourself this. How often do you ask somebody to hold your wallet or pocketbook?  You have no real way of determining security of your data because there is no standard of protection for cloud service providers.

You are also handing over incident mitigation to another party.  In the all too likely event of a data breach, or denial of service, or other cyberattack, a company will have little flexibility to respond to the incident.

Another major concern is the loss of control over users of data inside a company.  Once an employee has access to data in a cloud based system it is impossible to monitor and control how that data is being used.  This is of even greater concern to companies that must operate in compliance to information security regulations.  Examples of such regulations include International Traffic in Arms Regulations (ITAR), and Health Insurance Portability and Accountability Act (HIPAA) where such loss of control can lead to non-compliance which has serious repercussions.

Business Data Security is Important

Maintaining the security of a business’s data is a primary concern in today’s world.  This requires that those that are serious about cybersecurity take the long view and not follow the pack.  Asking the hard questions may bring answers that make seemingly convenient choices far less than appropriate.  Having a comprehensive program to address these concerns such as an Information Security Management System (ISMS) is often the best solution.  CVG Strategy can help you establish and maintain a viable solution for your data security.

 

 

 

ITAR Definitions Changes for 2020

ITAR definitions

Changes in ITAR Definitions

The U.S. State Department has made changes in important definitions of what constitutes an export under the International Traffic in Arms Regulations (ITAR).  These changes are due to take effect on March 25, 2020 and will effect the manner in which companies with ITAR classification must conduct business.  These definitions concern what activities are deemed exports, reexports, retransfers, or temporary imports.  Additionally a new definition has been created concerning “Access Information”.

ITAR definitions

Five Key Changes

Under § 120.54, five new provisions have been made for activities that do not require authorization from the Department of State.  These provisions are as follows:

  1. Items launched into space are now not deemed a controlled event.  A controlled event is defined as an export, reexport, retransfer, or temporary import.
  2. It is not deemed a controlled event to transfer technical data to a U.S. Person within the United States from a person in the United States.
  3. The third provision was added as a result of public comments to proposed rule changes in 2015.  It states that transmissions or other transfers of technical data between and among only U.S. Persons in the same foreign country will not be deemed a reexport provided they do not provide that information to a Foreign Person or a person otherwise prohibited from receipt of such information.
  4. It is now not a controlled event to move a defense article between states, possessions, or territories of the United States.
  5. It is now not deemed a controlled event to send, take, or store technical data when it is appropriately end to end encrypted.  Encryption must be executed in a manner that is certified by The U.S. National Institute for Standards and Technology (NIST), or must exceed a 128-bit security strength.

Definition of Access Information

The Department of Stated has added § 120.55 to define “access information.”  Access Information is defined as methods of unlocking data security parameters.  These would include decryption keys, network access codes, and passwords.  It is important to note that an authorization for release of technical data is required through access information to the same extent as other provisions of data transfer under ITAR,

Definition of Release

Clarifications as to what constitutes a release of technical data have been provided as well.  These controlled events which require authorization include the aforementioned access information.  The definition of release include:

  • The release of access information to cause or enable a foreign person to have access to controlled data.
  • To use access information in a foreign country in a manner that would cause technical data to be in an unencrypted form, including when these actions are performed by a U.S Person abroad.  There is an exemption however, in ITAR § 125.4(b)(9) that allows most U.S. Persons abroad to release technical data to themselves or over their employer’s virtual private network.

CVG Strategy

Our ITAR experts can guide you through the changing requirements of ITAR to keep your company compliant.  We offer a wide array of services to help you keep on track with this important legislation.

%MCEPASTEBIN%

US Space Industry Deep Dive Assessment

US Space Industry
US Space Industry
Photo by SpaceX

US Space Industry ‘Deep Dive’ Final Dataset Findings prepared by the U.S. Department of Commerce, Bureau of Industry and Security (BIS) and its Industrial Base Surveys and Assessments.

In June 2012, the Bureau of Industry and Security (BIS), Office of Technology Evaluation, in coordination with the U.S. Air Force, the National Aeronautics and Space Administration and the National Reconnaissance Office began a survey and assessment of the U.S. space industrial base supply chain network. The principal purpose of this project is to gain an understanding of the complicated network supporting the development, production and sustainment of products and services across the defense, intelligence community, civil and commercial space sectors. Historically, the U.S. Government has had limited visibility into the issues and challenges facing the lower tiers of the space industrial base.

Latest Update: February 28, 2014

BIS has completed its analysis of the Space Deep Dive data (see presentation below). BIS has begun publishing publically available reports that detail findings and recommendations on various topics, including:

Report on the Impact of Export Controls on the Space Industrial Base Now Available;

  • Small businesses in the space industrial base;
  • Financial health of the space industrial base;
  • Employment in the space industrial base; and
  • Challenges to the space industrial base.

Final Dataset Overview

Outreach and Assistance to US Space Industry

In the Space Deep Dive survey, survey respondents were asked if they were interested in information on existing federal and state government programs and services designed to assist their organization better compete in the global marketplace. Working with interagency partners, BIS developed information packages for these areas and distributed them to over 1,300 respondents. The packages are included below:

  1. Business Development
  2. Country Commercial Guides
  3. Energy and Environmentally Conscious Manufacturing
  4. Export Licensing
  5. Financing
  6. Global Export Opportunities
  7. Government Procurement Guidelines and E-Commerce
  8. Manufacturing Technology Development
  9. Marketing Assessment Skills
  10. Patents and Trademarks
  11. Product/Service Development
  12. R & D Programs
  13. Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) contracts
  14. Training Opportunities

For More Information…

For a copy of the U.S. Space Industry Deep Dive survey, go to Space Deep Dive.

To discuss the U.S. Space Industry Deep Dive study with a member of BIS staff, please contact

Brad Botwin
Director, Industrial Base Studies
(202) 482-4060

*All data made available from this survey collection is provided in aggregated form to protect Business Confidential and proprietary information. All information submitted to BIS is protected as Business Confidential under provisions of the Defense Production Act (DPA) of 1950, as amended. Survey responses are also exempt from Freedom of Information Act (FOIA) requests.

ECR-III, BIS Implements Changes to EAR

ECR III

Commerce/BIS Amends EAR, 15 CFR Parts 740 and 774 to Implement ECR-III Changes (Effective July 1, 2014)

79 FR 263-295: 15 CFR Parts 740 and 774; RIN 0694-AF58; Control of Military Training Equipment, Energetic Materials, Personal Protective Equipment, Shelters, Articles Related to Launch Vehicles, Missiles, Rockets, Military Explosives, and Related Items

AGENCY: Bureau of Industry and Security, Department of Commerce.

ACTION: Final rule.

SUMMARY:

This rule implements four previously proposed rules, and adds to the Export Administration Regulations (EAR) ECR-III controls on energetic materials, personal protective equipment, shelters, military training equipment, articles related to launch vehicles, missiles, rockets, military explosives, and related items that the President has determined no longer warrant control on the United States Munitions List (USML). This rule also adds to the EAR controls on items within the scope of the Munitions List (WAML) of the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies (Wassenaar Arrangement) that are not specifically identified on the USML or the Commerce Control List (CCL), but that were subject to USML jurisdiction. Finally, this rule moves certain items that were already subject to the EAR to the new Export Control Classification Numbers (ECCNs) created by this rule. This rule is being published in conjunction with the publication of a Department of State, Directorate of Defense Trade Controls rule revising USML Categories IV, V, IX, X, and XVI to control those articles the President has determined warrant control in those categories of the USML. Both rules are part of the President’s Export Control Reform Initiative. The revisions in this final rule are also part of Commerce’s retrospective regulatory review plan under Executive Order (EO) 13563.

DATES: This rule is effective July 1, 2014

FOR FURTHER INFORMATION CONTACT: For questions regarding energetic materials and related items controlled under ECCNs 1B608, 1C608, or 1D608 and personal protective equipment, shelters and related items controlled under ECCNs 1A613, 1B613, 1D613 or 1E613, contact Michael Rithmire, Office of National Security and Technology Transfer Controls, at (202) 482-6105 or [email protected]. For questions regarding military training equipment and related items controlled under ECCNs 0A614, 0B614, 0D614 or 0E614, contact Daniel Squire, Office of National Security and Technology Transfer Controls, at (202) 482-3710 or [email protected]. For questions regarding items related to launch vehicles, missiles, rockets, and military explosive device controlled under ECCNs 0A604, 0B604, 0D604 or 0E604 and ECCNs 9A604, 9B604, 9D604 or 9E604, contact Dennis Krepp, Office of National Security and Technology Transfer Controls, at (202) 482-1309 or [email protected].

ADDRESSES: Commerce’s full retrospective regulatory review plan can be accessed at: http://open.commerce.gov/news/2011/08/23/commerce-plan-retrospective-analysis-existingrules.

SUPPLEMENTARY INFORMATION:

Background

This final rule is part of the Administration’s Export Control Reform (ECR-III) Initiative. In August 2009, President Obama directed the Administration to conduct a broad-based review of the US export control system to identify additional ways to enhance national security. In April 2010, then-Secretary of Defense Robert M. Gates, describing the initial results of that effort, explained that fundamental reform of the US export control system is necessary to enhance our national security. Implementing ECR-III includes amending the International Traffic in Arms Regulations (ITAR) and its US Munitions List (USML), so that they control only those items that provide the United States with a critical military or intelligence advantage or otherwise warrant such controls, and amending the Export Administration Regulations (EAR) to control military items that do not warrant USML controls. This series of amendments to the ITAR and the EAR will reform the US export control system to enhance our national security by: (i) improving the interoperability of US military forces with allied countries; (ii) strengthening the US industrial base by, among other things, reducing incentives for foreign manufacturers to design out and avoid US-origin content and services; and (iii) allowing export control officials to focus government resources on transactions that pose greater national security, foreign policy, or proliferation concerns than those involving our NATO allies and other multi-regime partners.

On April 16, 2013, BIS published a final rule setting forth the framework for adding to the CCL items that the President has determined no longer warrant control on the USML through the creation of “600 series” Export Control Classification Numbers (ECCNs) (78 FR 22660, April, 16, 2013) (herein the “April 16 (initial implementation) rule”). The “600 series” structure is described in the preamble to that rule at pages 22661-22663 and 22691- 22692 and in regulatory text at page 22727 and is not repeated here. This rule follows that structure in creating new ECCNs to control energetic materials and related items, personal protective equipment, shelters and related items, military training equipment and related items, and articles related to launch vehicles, missiles, rockets, military explosives and related items on the CCL.

The changes described in this rule and the State Department’s ECR-III rule amending Categories IV, V, IX, X and XIV of the USML are based on a review of those categories by the Defense Department, which worked with the Departments of State and Commerce in preparing the amendments. The review was focused on identifying the types of articles that are now controlled by the USML that either (i) are inherently military and otherwise warrant control on the USML, or (ii) if of a type common to civil applications, possess parameters or characteristics that provide a critical military or intelligence advantage to the United States and that are almost exclusively available from the United States. If an article was found to satisfy either or both of those criteria, the article remains on the USML. If an article was found not to satisfy either criterion, but is nonetheless a type of article that is “specially designed” for military applications, then, generally, it is identified in one of the new “600 series” ECCNs created by this rule. No articles from Category XVI – Nuclear Weapons Related Articles are identified in “600 series” ECCNs.

Section 38(f) of the AECA (22 U.S.C. 2778(f)) obligates the President to review periodically the USML “to determine what items, if any, no longer warrant export controls under” the AECA. The President must report the results of the review to Congress and wait 30 days before removing any such items from the USML. The report must “describe the nature of any controls to be imposed on that item under any other provision of law” (22 U.S.C. 2778(f)(1)). The Department of State made the congressional notification required by Section 38(f) of the AECA for removal of these items from the USML.

All references to the USML in this rule are to the list of defense articles that are controlled for purposes of export, reexport, retransfer, temporary import, or brokering pursuant to the ITAR, and not to the list of defense articles on the United States Munitions Import List (USMIL) that are controlled by the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) for purposes of permanent import under its regulations at 27 CFR part 447. Pursuant to section 38(a)(1) of the AECA, all defense articles controlled for export or import, or that are subject to brokering controls, are part of the “USML” under the AECA. All defense articles described in the USMIL or the USML are subject to the brokering controls administered by the US Department of State in part 129 of the ITAR. The transfer of defense articles from the ITAR’s USML to the EAR’s CCL, for purposes of export controls, does not affect the list of defense articles controlled on the USMIL under the AECA for purposes of permanent import or brokering controls.

On January 18, 2011, President Barack Obama issued Executive Order (EO) 13563, affirming general principles of regulation and directing government agencies to conduct retrospective reviews of existing regulations. The revisions in this final rule are part of Commerce’s retrospective regulatory review plan under EO 13563.

Proposed rules

This rule implements amendments to the EAR proposed in the following four rules:

  1. “Revisions to the Export Administration Regulations (EAR): Control of Energetic Materials and Related Items That the President Determines No Longer Warrant Control Under the United States Munitions List (USML)”, (RIN 0694-AF53) (77 FR 25932, May 2, 2012) (herein “the May 2 (energetic materials) rule”);
  2. “Revisions to the Export Administration Regulations (EAR): Control of Personal Protective Equipment, Shelters, and Related Items the President Determines No Longer Warrant Control Under the United States Munitions List (USML),” (RIN 0694-AF58) (77 FR 33688, June 7, 2012) (herein “the June 7 (protective equipment) rule”);
  3. “Revisions to the Export Administration Regulations (EAR): Control of Military Training Equipment and Related Items the President Determines No Longer Warrant Control Under the United States Munitions List (USML)” (RIN 0694-AF54) (77 FR 35310, June 13, 2012) (herein “the June 13 (training equipment) rule”); and
  4. “Revisions to the Export Administration Regulations (EAR): Articles the President Determines No Longer Warrant Control Under the U.S. Munitions List That Are Related To Launch Vehicles, Missiles, Rockets, and Military Explosive Devices” (78 FR 6750, January 31, 2013) (RIN 0694-AF56) (herein “the January 31 (launch vehicles) rule”).

BIS’ responses to those comments and changes that apply only to a single set of controlled items are addressed in discrete sections below. Discussion of changes made by this rule that apply more broadly (cross references to ECCN 0A919, notes on forgings and castings, the United Nations reason for control, removal of the .y.99 paragraphs separate definitions for “accessories” and “attachments” and the composition of the entries for software and technology) all follow immediately below.

Broadly applicable changes made by this rule Cross References to ECCN 0A919.

In keeping with the pattern established in “Revisions to the Export Administration Regulations: Military Vehicles; Vessels of War; Submersible Vessels, Oceanographic Equipment; Related Items; and Auxiliary and Miscellaneous Items That the President Determines No Longer Warrant Control Under the United States Munitions List” (78 FR 40892) (July 8, 2013) (herein “July 8 (vehicles, vessels and miscellaneous equipment) rule”), this final rule adds to the “related controls” paragraph of Product Groups A, B, C, and D of the “600 series” ECCNs the following sentence: “See ECCN 0A919 for foreign-made ‘military commodities’ that incorporate more than a de minimis amount of U.S.-origin “600 series” controlled content.” This is a non-substantive change from what was proposed.

Forgings and Castings.

The four proposed rules on which this rule is based included a note in ECCNs 0A604.x, 1B608.x, 1A613.x, 0A614.x, 0B614.x and 9A604.x which stated that: “Forgings, castings, and other unfinished products, such as extrusions and machined bodies, that have reached a stage in manufacture where they are clearly identifiable by material composition, geometry, or function as commodities controlled by [ECCN].x are controlled by [ECCN].x.”

This final rule adds the phrase “mechanical properties” to notes in ECCNs 0A604.x, 1A613.x 0A604.x and 9A604.x, because there may be circumstances when the mechanical properties, as well as the material composition, geometry or function, of a forging, casting, or unfinished product may have been altered specifically for a part or component controlled by one of those ECCNs. The omission of “mechanical properties” from the lists in the proposed rules was an error that is being corrected in this rule. This final rule removes the note from ECCNs 1B608.x and 0B614.x because it is not relevant to product group B ECCNs, which apply to test, inspection, and production equipment.

 United Nations (UN) Reason for Control.

None of the four proposed rules on which this rule is based included the United Nations (UN) reason for control in any of their ECCNs. Consistent with the April 16 (initial implementation) rule, this final rule includes the UN controls described in § 746.1(b) of the EAR in all of the ECCNs that it creates. These controls are consistent with the amendments contained in a final rule that BIS published on July 23, 2012 (77 FR 42973), titled “Export and Reexport Controls to Rwanda and United Nations Sanctions under the Export Administration Regulations.” That rule amended § 746.1 of the EAR to describe the licensing policy that applies to countries subject to a United Nations Security Council (UNSC) arms embargo and to limit the use of license exceptions to such countries. Applying that licensing policy and related license exception restrictions to the new “600 series” ECCNs that are created by this final rule is appropriate, because of the military nature of the items controlled under these new ECCNs.

Paragraph .y.99.

The May 2 (energetic materials) rule, the June 7 (protective equipment) rule and the June 13 (training equipment) rule proposed including .y.99 paragraphs to ECCNs 1B608, 1D608, 1E608, 1A613, 1B613, 1D613, 1E613, 0A614, 0B614, 0D614 and 0E614. Those paragraphs would have imposed the antiterrorism (AT Column 1) reason for control on items that would otherwise be controlled in that ECCN but that had been determined to be subject to the EAR in a commodity jurisdiction determination issued by the Department of State and that are not elsewhere identified on the CCL (i.e., were designated as EAR99). Applying the AT Column 1 reason for control would have increased the number of circumstances under which these items would require a license. As stated in the preamble to the April 16 (initial implementation) rule (See 78 FR 22660, 22663, April 16, 2013), BIS agreed with a commenter that the burden of tracking down and analyzing whether items formally determined not to be subject to the ITAR that were also EAR99 items because they were not identified on the CCL outweighs the once-contemplated organizational benefits of creating the .y.99 control. Such items have already gone through an interagency review process that concluded whether the items were subject to the ITAR. Thus, BIS has determined that any such items should retain EAR99 status if not otherwise identified on the CCL and this final rule does not contain any .y.99 paragraphs.

Accessories and Attachments.

The May 2 (energetic materials) rule, the June 7 (protective equipment) rule, and the June 13 (training equipment) rule enclosed the phrase “accessories and attachments” in quotation marks throughout their regulatory texts, in keeping with the July 15 (framework) rule, which proposed a single definition for that phrase. Subsequently, BIS published a proposed rule entitled “‘Specially Designed’ Definition” (77 FR 36409, June 19, 2012), which proposed, inter alia, creating separate, but identical definitions for “accessories” and for “attachments” to allow for instances when only one of the terms would be used. The April 16 (initial implementation) rule, which became effective on October 15, 2013, adopted that change as a final rule. Accordingly, this final rule identifies “accessories” and “attachments” as separate terms wherever they appear throughout the regulatory text.

Consistency of Controls.

This final rule diverges in certain instances from the four proposed rules on which it was based with respect to the composition of the ECCNs. Software and technology ECCNs related to end items, production or other equipment, or materials generally control software and technology for the development and production of those items, and for some combination of the following six elements: operation, installation, maintenance, repair, overhaul, or refurbishing of those items. Separate technical teams determined the scope of control for different groups of ECCNs. As a result, different software and technology entries varied in the number and type of functions controlled.

While this variation was not technically inappropriate, and did not receive public comments when proposed in four separate rules, BIS is concerned that retaining this variation would complicate compliance. Standard text across ECCNs is a simpler approach. Therefore, each software ECCN in this final rule will control software for “development,” “production,” operation, or maintenance of the relevant items. Each new “600 series” technology ECCN in this final rule will control technology for “development,” “production,” operation, installation, maintenance, repair, overhaul, or refurbishing of those items. To the extent that a particular function does not apply to a particular item because no software or technology to perform the function with respect to that item exists, no burden is imposed. Controlling a larger number of functions in technology ECCNs is not an increase in burden, because all six functions are now controlled for technology on the USML. Similarly, all “production” “equipment” ECCNs will control test, inspection, and production equipment “specially designed” for the “development,” “production,” repair, overhaul, or refurbishing of the relevant items.

Dated: December 26, 2013

Kevin J. Wolf, Assistant Secretary for Export Administration

Space Coast Ambassador – More Than NASA

Community
space coast ambassador

Everyone is a Space Coast Ambassador

CVG Strategy is a Space Coast Ambassador and an investor in the Economic Development Commission of Florida’s Space Coast .  Kevin Gholston is Vice President for CVG Strategy, a defense and manufacturing consultancy.

In the early 1960’s, the Space Race officially began and Cape Canaveral experienced rapid growth. This new industry had national impact and, coupled with Patrick Air Force Base, attracted numerous defense and commercial manufacturers to the Space Coast who ultimately planted roots and expanded business operations. Today, Brevard County remains an active player in the defense market and boasts one of the largest concentrations of defense manufacturers in the entire state of Florida. This is prime ground for the cultivation and generation of new technological advancements.

Networking Assets

The United States has war fighters across the world. Here on local soil, we also have a cadre of soldiers who engineer and manufacture cutting edge tools and technology that ultimately make our troops safer and more effective during combat. As new advances continue to evolve and change, we must be sure that these companies have the necessary support to enhance our global defense capabilities.

Instead of establishing entire departments for process improvement, market development, quality certifications and testing programs, defense companies are able to offset these large scale operations by turning to experts like CVG Strategy (a Space Coast Ambassador).

CVG Strategy is no stranger to the defense market. This team of consultants focuses on improving products and operational processes for defense companies through the utilization of Brevard County’s inherent network of military testing labs. These resources, combined with the large presence of defense manufacturers already here, make Brevard County an attractive alternative to companies scattered across the country.

Defense Learns Lessons of History

It is imperative that products manufactured for our military work properly and do not fail when exposed to the weather and other harsh operational conditions. Our defense capabilities are among the best in the world, but they haven’t always been so. Early in World War II, systems were hurried to the battlefields, such as magnetic torpedoes that rarely worked and vehicles that could not cross rivers. U.S. troops in Korea had guns that jammed and food rations that could not be eaten in freezing weather.

After this series of mishaps, the Department of Defense established standards to qualify future military products. Today we use MIL-STD-810 Department of Defense Test Method Standard for environmental engineering considerations and laboratory tests for environmental testing. By making use of local testing facilities, six independently certified labs in total, various methods can be applied to products right here in our own backyard.

Large manufacturers such as Harris, DRS and others also use these labs to qualify their products for deployment. CVG Strategy takes on the role of educator and works with companies who provide components and systems to these prime contractors to ensure testing standards are understood and exceeded.

Existing Opportunity

There has never been a more opportune time to continue to build the defense cluster in Brevard County. With the amount of testing we are able to conduct right here in Brevard, companies we encounter are quick to engage in conversation regarding the Space Coast as a top notch business destination.

As part of the Economic Development Commission, it is my duty, along with the entire business community, to enhance the organization’s business development efforts by marketing the county’s unique advantages to colleagues and like companies.

I know firsthand the benefits that come from a top-notch business retention program. Several years ago, I relocated to Brevard County to become the CEO of a local manufacturer. We immediately turned to the EDC to lead the way on our efforts to expand.

Ultimately, they helped the company find a permanent home in Brevard. Their work allowed us to flourish in a critical time when the war in Iraq peaked. With the rapid expansion and support of the EDC, the company was able to supply crucial materials to our war fighters, resulting in thousands of lives saved.

Brevard County remains an ACTIVE PLAYER in the defense market and boasts one of the LARGEST concentrations of defense manufacturers in the entire state of Florida.

Now I have the opportunity with my own company to pay it forward. The business-friendly environment we have in Brevard County is rare and it is up to us as local business leaders to keep the momentum alive. CVG Strategy invests in the EDC and gives our time to support their efforts to attract and retain new companies because we are here to stay.  Every business in Brevard County is a Space Coast Ambassador.