US authorities suspect Russian hackers are behind the current attack, which has been labelled a "grave risk" to government and private networks, as its perpetrators exploit a vulnerability in security software made by Texas-based SolarWinds to infiltrate computer systems.
Although the attack is apparently focussed on US targets, our government's Computer Emergency Response Team (Cert NZ) has issued an urgent advisory that any local servers protected by SolarWinds' Orion software should be isolated until they can be patched, and passwords changed.
So New Zealand - which has lagged Australia and others in beefing up cyber-defences amid a flurry of attacks in 2020 - will benefit from US attempts to nullify the attempts to compromise SolarWinds.
On the face of things, you might think any US President would support - or even champion - such efforts.
But US President Donald Trump is now threatening to veto the $740b defence bill, with its new cyber measures - because it lacks a provision he requested on the totally unrelated topic of muzzling the big social media platforms.
Back in May, Twitter and Facebook began to slap warning labels on some of Trump's social media posts, stating they violated their community policies by glorifying violence or, in other instances, that they made allegations about mail-in voter fraud and other topics that were in dispute.
Incensed, Trump signed an Executive Order directing the Federal Communications Commission to take steps that would undermine a key legal shield for social media companies. Specifically, a 1996 law, Section 230 of the Communications Decency Act, which essentially bars people from suing providers of an "interactive computer service" for libel if users post defamatory messages on their platforms because they are not regarded as traditional publishers.
Trump gave the FCC two months carry out his order, but the effort went nowhere. Legal scholars and industry pundits were not clear what the President actually wanted with his muddy wording. In any case, the FCC is an independent agency not subject to his control, and has not power to over-ride existing laws.
Hence the President's last-minute attempt to kneecap Facebook and Twitter with a "rider" on the Defence Bill, and his threat to use his power to veto the legislation of it lands on his desk without that provision.
The US President does have the power to veto (kill) any particular newly-passed law.
But Congress can, in turn, over-ride his veto with a two-thirds majority.
And it looks like that could well be what happens here.
The defense bill had bipartisan support and passed by large majorities in the House of Representatives (335 to 78) and the Senate (84 to 13).
So far, Republicans have given no indication they will bend to Trump's will and add his desired social media provision, so the last days of his administration could see him suffer the embarrassment of his first-ever veto over-ride.
For his part, Trump has sought to play-down the SolarWinds attack, contradicting his own Secretary of State. He has also suggested, without any evidence, that China rather than Russia is behind the attack.
"This cyber attack likely perpetrated by the Russians spotlights the glaring vulnerabilities of our federal cyber security system," Susan Collins, the Republican senator from Maine, said on Friday.
"The president should immediately sign the NDAA [National Defense Authorization Act], not only to keep our military strong but also because it contains significant cyber security provisions that would help thwart future attacks," she added.
If Trump does veto the legislation, it will continue Trump's questionable recent record with cyber defence.
Cyber-security boss sacked
On November 18, he fired Christopher Krebs, the well-regarded director of the Cybersecurity and Infrastructure Security Agency (CISA) for making "innacurate" claims about the election.
CISA issued statements dismissing claims by Trump that large numbers of dead people could vote or that someone could change results without detection.
The 2020 election was, "The most secure in American history," Krebbs said.
Democrat Adam Schiff said Trump's move to fire Krebbs was "pathetic and predictable from a president who views truth as his enemy."
