Category: US Department of Homeland Security

Source: US Department of Homeland Security

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

• CVE-2024-38189 Microsoft Project Remote Code Execution Vulnerability
• CVE-2024-38178 Microsoft Windows Scripting Engine Memory Corruption Vulnerability
• CVE-2024-38213 Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
• CVE-2024-38193 Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability
• CVE-2024-38106 Microsoft Windows Kernel Privilege Escalation Vulnerability
• CVE-2024-38107 Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Source: US Department of Homeland Security

UFLPA Entity List Will Now Restrict Goods from 73 PRC-Based Companies from Entering the United States 
 

WASHINGTON – Today, the U.S. Department of Homeland Security (DHS) announced the addition of five entities based in the People’s Republic of China (PRC) to the Uyghur Forced Labor Prevention Act (UFLPA) Entity List, bringing the total entities listed to 73. These additions build on DHS’s commitment to eradicate forced labor and promote accountability for the PRC’s ongoing genocide and crimes against humanity against Uyghurs and other religious and ethnic minority groups in the Xinjiang Uyghur Autonomous Region (XUAR). 

Effective August 9, 2024, U.S. Customs and Border Protection (CBP) will apply a rebuttable presumption that goods produced by Century Sunshine Group Holdings, Ltd., Kashgar, Construction Engineering (Group) Co.; Ltd., Rare Earth Magnesium Technology Group Holdings, Ltd.; Xinjiang Habahe Ashele Copper Co., Ltd., and Xinjiang Tengxiang Magnesium Products Co., Ltd. will be prohibited from entering the United States. 

“As DHS identifies more entities across different sectors that use or facilitate forced labor, we act to keep their tainted goods out of our nation’s supply chains,” said Secretary of Homeland Security Alejandro N. Mayorkas. “Today’s announcement strengthens our enforcement of the Uyghur Forced Labor Prevention Act and helps responsible companies conduct due diligence so that, together, we can keep the products of forced labor out of our country.  We will continue to implement this law with full force in our efforts to fight the exploitation and abuse of the Uyghur people and other persecuted groups and protect a free and fair market.” 

Including the five entities identified today, the FLETF – chaired by DHS and whose member agencies also include the Office of the U.S. Trade Representative and the U.S. Departments of Commerce, Justice, Labor, State, and the Treasury – has added 73 entities to the UFLPA Entity List since the UFLPA was signed into law in December 2021. The UFLPA Entity List includes companies that are active in the apparel, agriculture, polysilicon, plastics, chemicals, batteries, household appliances, electronics, and food additives sectors, among others. Identifying these additional entities provides U.S. importers with more information to conduct due diligence and examine their supply chains for risks of forced labor to ensure compliance with the UFLPA. 

“We have shown again through today’s enforcement actions that the United States is committed to keeping goods made with forced labor out of U.S. supply chains,” said DHS Under Secretary for Policy Robert Silvers, who serves as Chair of the FLETF. “Companies must conduct due diligence and know where their products are coming from. The Forced Labor Enforcement Task Force will continue to designate entities in a variety of sectors that meet the criteria for inclusion on the UFLPA Entity List, and U.S. Customs and Border Protection will continue its vigilant enforcement at our ports.”   

The FLETF has reasonable cause to believe, based on specific and articulable information, that two entities meet the criteria for inclusion under Section 2(d)(2)(B)(ii) of the UFLPA by working with the government of the XUAR to recruit, transport, transfer, harbor or receive forced labor of Uyghurs, Kazakhs, Kyrgyz, or members of other persecuted groups out of the XUAR; two entities meet the criteria for inclusion under Section 2(d)2(B)(v) of the UFLPA, which identifies facilities and entities that source material from the XUAR or from persons working with the government of Xinjiang or the Xinjiang Production and Construction Corps for purposes of the “poverty alleviation” program or the “pairing-assistance” program or any other government labor scheme that uses forced labor; and one entity meets both criteria under Sections 2(d)(2)(B)(ii) and (v) of the UFLPA.  

Xinjiang Habahe Ashele Copper Co., Ltd. is a company located in the XUAR that mines nonferrous metals, including zinc, copper and silver. Xinjiang Habahe Ashele Copper Co., Ltd. is a subsidiary of one of the world’s largest mining company, and produces approximately 10% of that company’s copper and silver. The United States Government has reasonable cause to believe, based on specific and articulable information,  that Xinjiang Habahe Ashele Copper Co., Ltd. works with the government of the XUAR to recruit, transport, transfer, harbor, or receive Uyghurs, Kazakhs, Kyrgyz, or members of other persecuted groups out of the XUAR. Information reviewed by the FLETF, including publicly available information, indicates that Xinjiang Habahe Ashele Copper Co., Ltd. works with the Habahe County government of the XUAR to recruit Kazakh workers through PRC labor programs to mine metals, such as zinc, copper, and silver in the XUAR . The FLETF therefore determined that the activities of Xinjiang Habahe Ashele Copper Co., Ltd. satisfy the criteria for addition to the UFLPA Entity List described in section 2(d)(2)(B)(ii).   

Kashgar Construction Engineering (Group) Co., Ltd. is a company based in Kashgar, Xinjiang, China, that manufactures structural components and materials for construction, and is  engaged in general construction, construction engineering and operations, and real estate development and operations. The United States Government has reasonable cause to believe, based on specific and articulable information, that Kashgar Construction Engineering (Group) Co., Ltd. works with the government of the XUAR to recruit, transport, transfer, harbor, or receive Uyghurs, Kazakhs, Kyrgyz, or members of other persecuted groups out of the XUAR. Information reviewed by the FLETF, including publicly available information, indicates that Kashgar Construction Engineering (Group) Co., Ltd. has repeatedly participated in the transfer and recruitment of ethnic minorities from Xinjiang, including Uyghurs, through Jiashi County Xinjiang government labor programs. The FLETF therefore determined that the activities of Kashgar Construction Engineering (Group) Co., Ltd. satisfy the criteria for addition to the UFLPA Entity List described in section 2(d)(2)(B)(ii).  

Century Sunshine Group Holdings, Ltd. is a company based in Hong Kong that manufactures magnesium fertilizer and magnesium alloys. The United States Government has reasonable cause to believe, based on specific and articulable information, that Century Sunshine Group Holdings, Ltd. sources material, specifically magnesium, from the XUAR. Information reviewed by the FLETF, including publicly available information, indicates that Century Sunshine Group Holdings, Ltd. has established its magnesium production base in the XUAR through its vertically-integrated subsidiaries, and sources magnesium from the XUAR. The FLETF therefore determined that the activities of Century Sunshine Group Holdings, Ltd. satisfy the criteria for addition to the UFLPA Entity List described in section 2(d)(2)(B)(v).  

Rare Earth Magnesium Technology Group Holdings, Ltd. is a company based in Hong Kong that manufactures and sells magnesium alloy products. The United States Government has reasonable cause to believe, based on specific and articulable information, that Rare Earth Magnesium Technology Group Holdings, Ltd. sources material, specifically magnesium, from the XUAR.  Information reviewed by the FLETF, including publicly available information, indicates that Rare Earth Magnesium Technology Group Holdings, Ltd., a principal subsidiary of Century Sunshine Group Holdings, Ltd., operates Century Sunshine Group Holdings, Ltd.’s magnesium product business, and sources magnesium from its magnesium production base located in the XUAR. The FLETF therefore determined that the activities of Rare Earth Magnesium Technology Group Holdings, Ltd. satisfy the criteria for addition to the UFLPA Entity List described in section 2(d)(2)(B)(v).  

Xinjiang Tengxiang Magnesium Products Co., Ltd. is a company based in Hami, Xinjiang, China, that manufactures magnesium and magnesium alloy products. The United States Government has reasonable cause to believe, based on specific and articulable information, that Xinjiang Tengxiang Magnesium Products Co., Ltd. works with the government of the XUAR to recruit, transport, transfer, harbor, or receive Uyghurs, Kazakhs, Kyrgyz, or members of other persecuted groups out of the XUAR. Information reviewed by the FLETF, including publicly available information, indicates that Xinjiang Tengxiang Magnesium Products Co., Ltd. receives Uyghurs or members of other persecuted groups that the local Yizhou District government transfer from Xinjiang. The United States Government also has reasonable cause to believe, based on specific and articulable information, that Xinjiang Tengxiang Magnesium Products Co., Ltd. sources material, specifically the raw materials required to produce magnesium, such as coal and dolomite, from the XUAR.  Information reviewed by the FLETF, including publicly available information, indicates that Xinjiang Tengxiang Magnesium Products Co., Ltd., a wholly-owned subsidiary of Rare Earth Magnesium Technology Group Holdings, Ltd. and a principal subsidiary of Century Sunshine Group Holdings, Ltd., operates a magnesium production facility in the XUAR and sources raw materials from the XUAR, including coal and dolomite, to produce magnesium. The FLETF therefore determined that the activities of Xinjiang Tengxiang Magnesium Products Co., Ltd. satisfy the criteria for addition to the UFLPA Entity List described in sections 2(d)(2)(B)(ii) and 2(d)(2)(B)(v).  

The bipartisan Uyghur Forced Labor Prevention Act, signed into law by President Joseph R. Biden, Jr., in December 2021, mandates that CBP apply a rebuttable presumption that goods mined, produced, or manufactured wholly or in part in the XUAR or produced by entities identified on the UFLPA Entity List are prohibited from importation into the United States unless the Commissioner of CBP determines, by clear and convincing evidence, that the goods were not produced with forced labor. CBP began enforcing the UFLPA in June 2022.  Since then, CBP has reviewed over 9,000 shipments valued at more than $3.4 billion under the UFLPA.  Additionally, Homeland Security Investigations, through the DHS Center for Countering Human Trafficking, conducts criminal investigations into those engaging in or otherwise knowingly benefitting from forced labor, and collaborates with international partners to seek justice for victims.    

Today’s announcement supports President Biden’s Memorandum on Advancing Worker Empowerment, Rights, and High Labor Standards Globally.  The memorandum represents the first whole-of-government approach to advance workers’ rights by directing federal agencies engaged abroad to advance international recognized labor rights, which includes DHS’s work implementing the UFLPA.  

This expansion of the UFLPA Entity List reflects DHS’s prioritization of efforts to combat the introduction of forced labor into U.S. supply chains. This commitment is outlined in the Department’s recent Quadrennial Homeland Security Review, which added combating crimes of exploitation, including labor exploitation, as the newest and sixth DHS mission. Last month, DHS published updates to the UFLPA strategy, which outlines how the FLETF has significantly advanced our objectives through several initiatives including strong enforcement by CBP; expansion of the UFLPA Entity List; designating new high priority sectors for enforcement; and greater collaboration with stakeholders.

You can read more about the FLETF by visiting: https://www.dhs.gov/uflpa.  

Source: US Department of Homeland Security

Helps organizations buying software understand manufacturers approach to cybersecurity

WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) released today Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem which helps organizations buying software better understand their software manufacturers approach to cybersecurity and ensure that secure by design is one of their core considerations.

An organization’s acquisition staff often has a general understanding of the core cybersecurity requirements for a particular technology acquisition. However, they frequently don’t assess whether a given supplier has practices and policies in place to ensure that security is a core consideration from the earliest stages of the product development lifecycle.

This guide provides organizations with questions to ask when buying software, considerations to integrate product security into various stages of the procurement lifecycle, and resources to assess product security maturity in line with secure by design principles. Informed by the threat landscape, it provides categorized sets of actions that, if done correctly will demonstrate to the customer that the software manufacturer is taking actions that will drive down exploitable defects and misconfigurations – a safer product for the customer.

“We are glad to see leading technology vendors recognize that their products need to be more secure and voluntarily join the Secure by Design pledge. Businesses can also help move the needle by making better risk-informed decisions when purchasing software,” said CISA Director Jen Easterly. “This new guide will help software customers understand how they can use their purchasing power to procure secure products and turn Secure by Design into Secure by Demand.”

This guide is concise and usable by any customer of software during procurement discussions with third party resellers or service providers. Recommendations in this guide include obtaining the manufacturer’s software bill of materials that lists third-party software components, roadmaps that identify how they plan to eliminate classes of vulnerability in their products, and publicly available vulnerability disclosure policy, if one is operated.

This guide compliments the “Software Acquisition Guide for Government Enterprise Consumers: Software Assurance in the Cyber-Supply Chain Risk Management (C-SCRM) Lifecycle” that was recently published.

Organizations are encouraged to review both the Secure by Demand Guide and Software Acquisition Guide and implement recommended actions.

For more information, please visit Secure by Design.

###

About CISA 

As the nation’s cyber defense agency and national coordinator for critical infrastructure security, the Cybersecurity and Infrastructure Security Agency leads the national effort to understand, manage, and reduce risk to the digital and physical infrastructure Americans rely on every hour of every day.

Visit CISA.gov for more information and follow us on Twitter, Facebook, LinkedIn, Instagram

Source: US Department of Homeland Security

During emergency events, the Department of Homeland Security (DHS) works with its federal, state, local, and non-governmental partners to support the needs of the people in the areas that may be impacted.

In such circumstances, U.S. Immigration and Customs Enforcement (ICE) and U.S. Customs and Border Protection (CBP) remind the public that sites that provide emergency response and relief are considered protected areas. To the fullest extent possible, ICE and CBP do not conduct immigration enforcement activities at protected areas such as along evacuation routes, sites used for sheltering or the distribution of emergency supplies, food or water, or registration sites for disaster-related assistance or the reunification of families and loved ones.

At the request of FEMA or local and state authorities, ICE and CBP may help conduct search and rescue, air traffic de-confliction and public safety missions. ICE and CBP provide emergency assistance to individuals regardless of their immigration status. DHS officials do not and will not pose as individuals providing emergency-related information as part of any enforcement activities.

DHS is committed to ensuring that every individual who seeks shelter, aid, or other assistance as a result of a natural disaster or emergency event is able to do so regardless of their immigration status.

DHS carries out its mission without discrimination on the basis of race, religion, gender, sexual orientation or gender identity, ethnicity, disability or political associations, and in compliance with law and policy.

For information about filing a complaint with the DHS Office for Civil Rights and Civil Liberties about these matters, please visit our Make a Civil Rights Complaint page.

Source: US Department of Homeland Security

WASHINGTON — Today, the Department of Homeland Security (DHS) Blue Campaign and Lyft, Inc. announced that more than one million Lyft drivers in the United States and Canada can now access a tutorial program to help them detect and prevent human trafficking. Today’s announcement builds on efforts earlier this year during Super Bowl 2024, when Lyft, Inc. provided resources to drivers in Las Vegas to help them to recognize the signs of this crime. Human trafficking can be more prevalent during large-scale events due to the sheer volume of people and anonymity that large gatherings provide.

“The Department of Homeland Security is committed to bringing a whole-of-society approach to our counter-human trafficking mission,” said Secretary of Homeland Security Alejandro N. Mayorkas. “By partnering with key private sector leaders like Lyft – whose drivers interact with millions of riders every year – we are better able to shine a light on this heinous crime; identify, protect, and support victims; and bring perpetrators to justice. I am grateful for Lyft’s continued commitment to combating the scourge of human trafficking and encourage other stakeholders to join us in this critical work.”

We are committed to working with DHS to help educate drivers about how to identify and report a possible crime if they suspect a rider is a victim or perpetrator of human trafficking,” said Ameena Gill, Vice President Safety and Customer Care at Lyft. “Our hope is that the driver community, which gives hundreds of millions of rides a year, can become an even greater force for good by helping identify these crimes and combat human trafficking.”

Over the last several months, DHS and Lyft have worked on developing this first-of-its kind tutorial for a ride-share company that features the Blue Campaign’s human trafficking resources in Lyft’s driver-only in-app Learning Center. It will help raise awareness of this crime, teach drivers the signs that indicate someone may be a victim, and offer resources for assistance, including guidance for how drivers can contact the right authorities. DHS will continue to work to provide access to resources and information to partners across the passenger transportation service industry.

Blue Campaign is a national public awareness campaign housed within the DHS Center for Countering Human Trafficking (CCHT). Established in 2010, the Blue Campaign educates the public, law enforcement, and other industry partners to recognize the indicators of human trafficking, and how to appropriately respond to possible cases. The CCHT coordinates efforts of 16 DHS offices and Components to combat human trafficking through law enforcement operations, victim protection and support, intelligence and analysis, and public education and training programs. Learn more about the CCHT’s accomplishments.

Anyone who suspects human trafficking is encouraged to report it to law enforcement – tips can be submitted anonymously online or by calling 866-347-2423. Individuals can also contact the National Human Trafficking Hotline at 888-373-7888 or humantraffickinghotline.org.

Source: US Department of Homeland Security

WASHINGTON – Today, the Cybersecurity and Infrastructure Security Agency (CISA) announced the release of its “Software Acquisition Guide for Government Enterprise Consumers: Software Assurance in the Cyber-Supply Chain Risk Management (C-SCRM) Lifecycle.” Developed by the Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM) Task Force, this guide consolidates relevant software assurance guidance and frameworks into a single document and enables stakeholders to easily navigate through these requirements in a clear, concise manner. 

“The ICT SCRM Task Force Software Assurance Working Group created the guide for acquisition and procurement organizations to initiate discussions with their cybersecurity staff and enterprise risk owners, such as Chief Information Officers and Chief Information Security Officers, to ensure the security of their software acquisitions,” said CISA National Risk Management Center Assistant Director and ICT SCRM Task Force Co-Chair Mona Harrington. “It provides critical federal guidance, including CISA’s Secure by Design principles, and a list of questions that should be addressed to mitigate risk exposure from software obtained from third parties. 

Many well-known cyber-attacks have exploited vulnerabilities and weaknesses in software and within software supply chains in proprietary and open-source software, adversely impacting private sector and government enterprises. This recurring issue prompted an increased need to rebalance responsibilities for cybersecurity risks between software suppliers and consumers. The Software Acquisition Guide is in response to the core challenges of software assurance and cybersecurity transparency in the acquisition process, focusing primarily on software lifecycle activities. 

“This Guide provides a foundation for addressing product security principles within the software lifecycle, including design, development, deployment, and operational use,” said Robert Mayer, Senior Vice President of Cybersecurity and Innovation at USTelecom and ICT SCRM Task Force Co-Chair. “I am thankful to the Software Assurance Working Group for their significant contribution having worked with numerous entities over the last two years to ensure the Guide will be relevant and useful to acquisitions and procurement professionals.” 

By engaging in candid discussions of software supply chain processes, better, risk-informed decisions can be made for the acquisition and procurement of software products and services. Consumers, demanding security be built into the products and services they purchase, can function as the market signal, driving systemic changes across the software supplier ecosystem. 

“The anticipation for the release of Software Acquisition Guide not only garnered attention from Task Force members but also sparked an outpouring of interest from various stakeholders at the ICT SCRM Task Force Conference that took place on June 12, 2024,” said John Miller, Senior Vice President of Policy for Trust, Data, and Technology and General Counsel, Information Technology Industry (ITI) Council and ICT SCRM Task Force Co-Chair. “This Guide serves as a useful tool for customers of acquisition and procurement organizations who can use this guidance as a basis for describing, assessing, and measuring security practices relative to the software life cycle. A huge thank you to the Software Assurance Working Group for their work and diligence in creating such a thorough and groundbreaking document.”  

The ICT SCRM Task Force also developed an accompanying Spreadsheet that complements the Software Acquisition Guide and assists users with navigating the document. 

The Task Force will host a webinar on the Software Acquisition Guide in the fall.  Registration information will be posted on the ICT SCRM Task Force website. 

###

About CISA 

As the nation’s cyber defense agency and national coordinator for critical infrastructure security, the Cybersecurity and Infrastructure Security Agency leads the national effort to understand, manage, and reduce risk to the digital and physical infrastructure Americans rely on every hour of every day.

Visit CISA.gov for more information and follow us on Twitter, Facebook, LinkedIn, Instagram.

Source: US Department of Homeland Security

WASHINGTON – Today, the Cybersecurity and Infrastructure Security Agency (CISA) announced its first CISA Chief Artificial Intelligence Officer, Lisa Einstein. This selection reflects CISA’s commitment to responsibly use AI to advance its cyber defense mission and to support critical infrastructure owners and operators across the United States in the safe and secure development and adoption of AI. Einstein has led CISA’s AI efforts since 2023 as CISA’s Senior Advisor for AI. Since 2022, Einstein also served as the Executive Director of the CISA Cybersecurity Advisory Committee.

“I am proud of how our team at CISA has come together in the last two years to understand and respond to rapid advancements in AI—many of which have significant implications for our core missions of cyber defense and critical infrastructure security,” said CISA Director Jen Easterly. “Lisa Einstein has been central to that effort. Beyond her technical expertise, she’s an inspirational leader who has brought together colleagues across the agency around a clear and impactful vision. I could not be more thrilled to have her take on this important new role, which will help us continue to build AI expertise into the fabric of our agency and ensure we are equipped to effectively leverage the power of AI well into the future.”

Strong cybersecurity is foundational to trustworthy AI, and the responsible use of AI is increasingly relevant for the security of critical infrastructure. CISA has established this new position to institutionalize our ongoing efforts to responsibly govern our own uses of AI and to ensure critical infrastructure partners develop and adopt AI in ways that are safe and secure.

“I care deeply about CISA’s mission – if we succeed, the critical systems that Americans rely on every day will become safer, more reliable, and more capable. AI tools could accelerate our progress. But we will only reap their benefits and avoid harms from their misapplication or abuse if we all work together to prioritize safety, security, and trustworthiness in the development and deployment of AI tools,” said Einstein. “It has been a privilege to work with the dedicated and talented CISA team and with our partners across the United States and around the world over the last two years. I am honored to serve in this new role to help CISA tackle this important challenge.”

For more on CISA’s work on AI, visit cisa.gov/ai.

###

About CISA 

As the nation’s cyber defense agency and national coordinator for critical infrastructure security, the Cybersecurity and Infrastructure Security Agency leads the national effort to understand, manage, and reduce risk to the digital and physical infrastructure Americans rely on every hour of every day.

Visit CISA.gov for more information and follow us on Twitter, Facebook, LinkedIn, Instagram. 

Source: US Department of Homeland Security

On Friday, July 26th, Secretary of Homeland Security Alejandro N. Mayorkas met with Honduran Foreign Minister Enrique Reina to address irregular migration and combat transnational organized crime through continued strong cooperation. The Department of Homeland Security (DHS) welcomed Honduras’ recent investments to strengthen support for Hondurans abroad, including expanding its U.S. consular network. The Honduran government has also worked on internal efforts to generate local agricultural employment opportunities through recently passed legislation that seeks to address internal displacement and reduce emigration push factors. Foreign Minister Reina updated Secretary Mayorkas on Honduras’ work to promote the use of lawful pathways to come to the United States, including H-2A and H-2B visa programs. He also thanked Secretary Mayorkas for the recently announced actions to promote family unity for noncitizens married to a U.S. citizen and the recent extension of Employment Authorization Document validity for certain Temporary Protected Status beneficiaries, including certain Hondurans.

Honduras agreed to further streamline its coordination with the United States on removals of Honduran noncitizens who do not have a legal basis to remain in the United States. Through bilateral efforts, Honduras has increased its capacity to receive removal flights and will begin electronically verifying the nationality of Hondurans subject to removal orders across its entire U.S. consular network to afford more expeditious processing and reduced time in custody. To support those returning home, Honduras is also working to expand its reintegration programs, including with U.S. support.

Collective migration management efforts have effectively reduced the number of Hondurans encountered at the U.S. Southwest Border and fewer have fallen prey to smugglers who have no regard for their safety. The Presidential Proclamation and joint interim final rule issued by DHS and the Department of Justice (DOJ) have now been in effect for seven weeks, helping reduce the total number of encounters, including of Hondurans, at our Southwest Border by 55%. The Border Patrol’s 7-day average has decreased to below 1,800 encounters per day. 

Source: US Department of Homeland Security

WASHINGTON – Today, as part of their public service announcement series for the 2024 election cycle, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) jointly released Just So You Know: DDoS Attacks Could Hinder Access to Election Information, Would Not Prevent Voting. This public service announcement is to raise awareness that Distributed Denial of Service (DDoS) attacks on election infrastructure, or adjacent infrastructure that supports election operations, could hinder public access to election information, but would not impact the security or integrity of election processes. The PSA is part of the agencies’ ongoing commitment to provide the public with information and the election infrastructure community with the support they need to run safe and secure elections.

“With Election Day less than 100 days away, it is important to help put into context some of the incidents the American public may see during the election cycle that, while potentially causing some minor disruptions, will not fundamentally impact the security or integrity of the democratic process,” said CISA Senior Advisor Cait Conley. “DDoS attacks are one example of a tactic that we have seen used against election infrastructure in the past and will likely see again in the future, but they will NOT affect the security or integrity of the actual election. They may cause some minor disruptions or prevent the public from receiving timely information. It is important to talk about these potential issues now, because nefarious actors, like our foreign adversaries or cybercriminals, could use DDoS incidents to cast doubt on the election systems or processes. An informed public is key to neutralizing the impact of foreign influence operations and disinformation, which is why we put out this advisory on what a DDoS attack could – and couldn’t – do.”

“DDoS are low-level attacks that work by overwhelming websites with traffic to render them inaccessible,” said FBI Deputy Assistant Director Cynthia Kaiser. “Given the prevalence of false claims about DDoS attacks in prior U.S. and foreign elections, we are warning that DDoS attacks against election-related websites could temporarily disrupt access to some online election functions, like voter look-up tools, but would not prevent voting or compromise the integrity of voting systems. This warning highlights the importance for voters to seek out information about how to vote prior to Election Day and demonstrates the FBI’s and CISA’s continued commitment to sharing information with the public about potential cyber threats.”

This publication is to help educate the public on what DDoS attacks are, their effects on election infrastructure, recommendations for voters, and victim reporting information.

CISA and the FBI encourage the public to report information concerning suspicious or criminal activity, such as DDoS attacks, to their local FBI field office, by calling 1-800-CALL-FBI (1-800-225-53240, or online at ic3.gov). DDoS attacks impacting election infrastructure can also be reported to CISA by calling 1-844-Say-CISA (1-844-729-2472), emailing report@cisa.dhs.gov, or submitting online at www.cisa.gov/report. To learn more, visit Just So You Know: DDoS Attacks Could Hinder Access to Election Information, Would Not Prevent Voting on CISA.gov.

###

About CISA 

As the nation’s cyber defense agency and national coordinator for critical infrastructure security, the Cybersecurity and Infrastructure Security Agency leads the national effort to understand, manage, and reduce risk to the digital and physical infrastructure Americans rely on every hour of every day.

Visit CISA.gov for more information and follow us on Twitter, Facebook, LinkedIn, Instagram. 

Source: US Department of Homeland Security

Secretary of Homeland Security Alejandro N. Mayorkas released the following statement on the arrest of alleged leaders of the Sinaloa Cartel Ismael Zambada Garcia (“El Mayo”) and Joaquin Guzman Lopez:

“The Sinaloa Cartel pioneered the manufacture of fentanyl and has for years trafficked it into our country, killing hundreds of thousands of Americans and devastating countless communities. The Biden-Harris Administration has taken a relentless, unprecedented, and comprehensive approach to combating the scourge of fentanyl. Today, two of the Cartel’s alleged top leaders – Ismael Zambada Garcia (“El Mayo”) and Joaquin Guzman Lopez – are in U.S. custody and will be brought to justice. I commend the dedicated, brave agents and officers of Homeland Security Investigations and the FBI whose years of work, alongside others in the law enforcement community, have, at great personal sacrifice, disrupted and dismantled cartel operations across the world.”