Wyden’s staff was told by an unidentified CISA expert last year that “they had no confidence in the security of FirstNet, in large part because they have not seen the results of any cybersecurity audits conducted against this government-only network,” the letter said, arguing that it was time for the authority to share its internal audits with CISA, NSA and Congress.
Expand
Wyden’s letter makes reference to Signaling System No. 7 (SS7), a decades-old protocol that allows international cellular networks to exchange information – for example when cell phone users are roaming. The protocol can easily be abused, security experts say, allowing spies or hackers to intercept text messages or pinpoint users’ real time locations.
Although the security problems with SS7 are well-documented, Wyden said the lack of clarity around the safety measures at FirstNet – which was set up in the wake of the Sept. 11, 2001 attacks to provide a robust line of communication for first responders – was particularly worrying.
“These security flaws are also a national security issue, particularly if foreign governments can exploit these flaws to target U.S. government personnel,” his letter said.
Gary Miller, an expert on mobile network security with the University of Toronto-based Citizen Lab, said that Wyden’s concerns were well founded, adding that he too was worried by the “very troubling” opacity around audits.
Wyden called on FirstNet to share any security audits with the NSA and CISA or – alternatively – for the government to commission audits of its own.
