> Are they reporting what is a mis-identification of automated vulnerability scanning?

If DHS doesn't have approval/authority, isn't an automated vulnerability scan a cyberattack?