In big news this week for our Kiwi neighbours, New Zealand opened ^[1] its first national Computer Emergency Response Team (CERT). CERT NZ ^[2], a deliverable of New Zealand’s 2015 Cyber Security Strategy ^[3], has been established within the Ministry of Business, Innovation and Employment with NZ$22.2 million funding over four years. CERT NZ will ^[4] be the centrepiece of New Zealand’s cyber architecture and be responsible for cyber vulnerability and threat identification, incident reporting, response coordination and general readiness support for the Kiwi economy. Communications Minister Simon Bridges stated ^[5] that the CERT ‘will make it easier for people at work and at home to understand, prevent and recover from cyber security incidents’.

Twitter resisted ^[6] pressure from the US government last month to unmask the identity of an individual tweeting criticism about President Trump from account @ALT_USCIS ^[7]. The social media platform filed a law suit to block the administration’s request, citing users’ First Amendment rights ^[8] to freedom of speech. Twitter’s move was backed by the American Civil Liberties Union, who described it ^[9] as ‘an affront to our fundamental right to anonymous expression’. Customs and Border Protection proceeded to withdraw the summons ^[10] the day after Twitter filed the lawsuit. This is a positive development after the administration cracked down ^[11] on federal agency social media activity in January.

Spanish police arrested ^[12] Russian computer programmer Pyotr Levashov in Barcelona this week in collaboration with the FBI. While rumours are circling ^[13] about potential connections between this arrest and the 2016 US presidential election campaign hacking, the central focus looks to be Levashov’s responsibility for the Kelihos botnet ^[14]. This botnet has enslaved hundreds of thousands of computers and used the resulting network to facilitate international malicious cyber activities such as the mass distribution of spam, spreading of ransomware, and theft of login credentials. The US Department of Justice announced ^[15] it’s undertaking ‘an extensive effort to disrupt and dismantle the Kelihos botnet’ and the botnet operator is expected ^[16] to be extradited to the US.

The transition ^[17] from the Internet’s current IP system for web addressing IPv4 to the next generation protocol IPv6 may not be as seamless as we would hope. The transfer is necessary ^[18] to fulfil the exponential Internet demand and support. While the current system offers four billion unique IP addresses, IPv6 will offer 340 undecillion. Unfortunately, new research ^[19] from the NATO Cooperative Cyber Defence Centre of Excellence in Estonia indicates that this complex transition may be introducing vulnerabilities to the system.

In an effort to combat fake news, Google is expanding a fact check program ^[20] for its search and news services to the entire globe. The company’s idea of providing fact checks to help its users ‘divine fact from fiction’ was initially piloted ^[21] in the US and UK at the end of last year, but is now available to the whole world. Google isn’t undertaking the checks in-house, but relying ^[22] on the validations of third party organisations such as PolitiFact ^[23], FactCheck.org ^[24] and Snopes ^[25]. This tool is a great step in the right direction to combat the spread of misinformation online, providing readers with an indication ^[26] of how authoritative a source is and whether it reflects the general consensus view.

Notorious hacker(s), the Shadow Brokers ^[27], have stepped back in the limelight over the weekend, releasing more alleged hacking tools of the NSA. After leaking a number of stolen NSA exploits in August last year, the group tried and failed ^[28] to auction off the contents of a second cache for an asking price of $1 million. This week the Shadow Brokers group has published the password needed to decrypt this second cache along with a political rant ^[29] at President Trump on Medium, chastising him for abandoning his ‘base’. Despite the fanfare, many have been left disappointed ^[30] by this second dump, which consists mostly of tools that are much older and target operating systems that are generally no longer in service. NSA’s friends over at Langley haven’t had a good week ^[31] either with Wikileaks releasing the third tranche of the Vault 7 leak on CIA cyber tools, titled ‘Grasshopper’ ^[32], last Friday.

Dallas learned an important lesson on infrastructure security this week with the city’s emergency warning system being compromised ^[33] by a hacker. The network of sirens across the city were activated just after midnight on Friday night, triggering public panic ^[34], more than 4,400 911 calls and an emergency call wait time of six minutes. The incident highlights the vulnerability of critical national infrastructure and the impact its compromise can have on a government’s ability to deliver essential services. The city has requested ^[35] assistance from the Federal Communications Commission to identify the source of the breach.

And to finish things off, we’ve got your weekly report reading sorted. Check out McAfee Labs Threat Report ^[36], which focuses on intelligence sharing, the Mirai IoT botnet and other threat statistics. Dip into the cyber workforce dilemma with the US Government Accountability Office’s report ^[37] on how the government should train and recruit the cybersecurity workforce to address the threats to federal IT systems. Lastly, the Center for a New American Security’s Phishing in Troubled Waters ^[38] will take you through the state of cyber espionage across the Pacific and the Strait of Taiwan. Happy reading!