Laws, executive orders, compliance frameworks, government action
RSS feed for this categoryThis article discusses the increasing speed of geopolitical risk and its impact on national cyber defenses, with governments anticipating breaches. It urges organizations to develop strategies for operational resilience by planning for the worst-case scenarios and adapting their readiness and response strategies.
The article discusses the complex issue of accountability when AI agents cause data breaches. While current legal frameworks generally hold humans responsible for the actions of their tools, the increasing autonomy of AI agents raises questions about where liability should lie. This highlights a growing challenge in attributing blame for cyber incidents involving sophisticated AI.
Bank of America was fined $1.2 billion for money laundering offenses due to lax anti-money-laundering (AML) controls. The bank has invested billions in technology to combat financial crime, with a significant portion of third-quarter spending allocated to AML remediation and fixing software vulnerabilities, which also necessitated hiring consultants.
CISA and the FBI have issued a warning to election and campaign officials regarding cyber threats targeting the 2026 U.S. midterm elections. Attackers may employ phishing and smishing tactics to steal credentials, deploy malware, and access sensitive voter and campaign data. The advisory highlights the increasing sophistication of these campaigns, including realistic fake communications across various media.
The article discusses how the Department of Homeland Security (DHS), including ICE, was designed and has been used as a "weapon." It highlights how years of "counterterror" surveillance paved the way for abuses, referencing the ICE raid on Rep. Ilhan Omar.
Hundreds of AI researchers have issued an open letter urging governments and the AI community to implement stricter security measures for training cyber-capable AI models. They advocate for the use of air-gapped systems during training and the establishment of a new international body to oversee AI development best practices and report containment failures.
A forensic review of the UK Legal Aid Agency hack has revealed that the scope of the breach is wider than initially thought. Most of the affected data pertains to applications, claims, and payments submitted between 2007 and 2025.
X (formerly Twitter) has removed over 13,000 accounts suspected of engaging in coordinated inauthentic behavior. The platform cited links to Iran, Russia, and China, though it did not provide public evidence for these attributions.
CISA has added a new vulnerability, CVE-2026-21589 affecting Atlassian products, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This addition emphasizes the importance of timely patching for federal agencies under Binding Operational Directive (BOD) 26-04, which mandates prioritization of vulnerabilities listed in the KEV Catalog.
The Indian government has mandated that telecom providers must display registered caller names alongside phone numbers for all incoming calls on 4G and newer networks starting November 1, 2026. This initiative aims to enhance call identification and combat spam and fraudulent calls.
UK officials are reportedly keeping potential AI safeguards in consideration for the Cyber Security Bill. This comes despite earlier pledges from a minister to take action on the matter.
The UK Legal Aid Agency (LAA) has disclosed that a cyberattack in April 2025 resulted in the theft of records dating back to 1978. The attackers gained access to the agency's IT systems, compromising a significant volume of historical data.
The Metropolitan Police are in hot water with the UK's data protection watchdog for unlawfully uploading 179 individuals' details to a shoplifting platform called Auror. This action was taken without the necessary privacy checks or corporate approval.
The EFF has won a key court victory in its lawsuit challenging the government's "Catch and Revoke" mass surveillance program, which allegedly chills free speech online. The EFF newsletter also covers guides for reducing reliance on Big Tech and a win against anti-VPN laws.
The United Kingdom has imposed sanctions on Cryptomus, a cryptocurrency platform accused of facilitating illicit financial transactions. These transactions are linked to ransomware, darknet markets, fraud, and cybercrime services, which allegedly help Russia evade financial restrictions.
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. These vulnerabilities include code injection and command injection flaws in Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, and Ahsay AhsayCBS. The additions underscore the importance of CISA's Binding Operational Directive (BOD) 26-04, which mandates federal agencies prioritize the remediation of high-risk, exploited vulnerabilities.
US investigators have conducted a crackdown on North Korean IT worker operations, raiding 40 locations in Texas and seizing 187 laptops. These laptops were allegedly used by North Korean workers to mask their real locations while performing freelance work.
The article argues that despite significant technological advancements and increased investment in cybersecurity since 2015, many organizations still grapple with fundamental management challenges like governance, accountability, and organizational silos. These persistent issues, which were present over a decade ago, highlight that the difficulty in cybersecurity lies not in understanding what needs to be done, but in effectively implementing and sustaining those changes across complex organizations.
A California trial court dismissed a case challenging San Jose's use of Automatic License Plate Reader (ALPR) data, which EFF and ACLU of Northern California argued constituted warrantless surveillance. Despite this disappointing ruling, EFF plans to appeal, citing conflicting federal court decisions that have recognized ALPRs as mass surveillance and violations of privacy rights.
CISA has added two new vulnerabilities, CVE-2026-96951 and CVE-2026-104935, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These additions are part of CISA's Binding Operational Directive (BOD) 26-04, which requires federal agencies to prioritize the remediation of high-risk, exploited vulnerabilities on publicly exposed assets.
Developing an AI governance policy is merely the initial phase; the true challenge lies in effectively implementing and enforcing these policies in practical, real-world scenarios. Moving beyond the document to actionable governance is crucial for responsible AI deployment.
Norway's Data Protection Authority has fined Microsoft-owned Xandr $9.6 million for unlawfully processing and sharing sensitive user data from the dating app Grindr. The fine was issued for violations related to GDPR, specifically the sharing of data without explicit user consent. This action highlights ongoing regulatory scrutiny of data handling practices in the digital advertising space.
The federal government has been unlawfully consolidating data, exposing private information through initiatives like DOGE and agency-to-agency data sharing. This consolidation risks mistakes, abuses, and chilling participation in society, particularly for marginalized groups. EFF and other groups are fighting these practices through lawsuits and legislative efforts, advocating for stronger data privacy protections.
Turkey is conducting a state-led crackdown on LGBTQ+ organizations, media, and activists, involving website blocks, detentions, and raids on digital devices. These actions aim to suppress organizations advocating for LGBTQ+ rights and those reporting on their oppression, threatening freedom of expression and association.
Four additional U.S. states have filed lawsuits against router manufacturer TP-Link Systems, alleging the company misled consumers about the security of its routers and its ties to China. These new suits bring the total to five, with Texas having filed its suit earlier in the year. TP-Link has denied the allegations and plans to contest them in court.
This article discusses the growing trend of age verification laws globally, which are being implemented for social media access and other online services. It highlights concerns that these laws, often requiring identity documents for verification, may disproportionately affect individuals who cannot provide such proof, potentially restricting their right to access information.
Customs and Border Patrol's predictive policing units are reportedly using financial data to target individuals for anomalous financial activities. These units are obscuring their involvement by operating through local law enforcement agencies. Lawmakers are urged to address federal agencies' use of predictive policing and the misuse of financial and travel information.
The United Kingdom and Germany have announced a new security pact to counter Russian cyberattacks. This collaboration aims to enhance information sharing and enable coordinated disruption efforts against malicious cyber activities originating from Russia.
Following an attack on its Medicare systems, the Australian government is considering mandatory incident reporting regulations for companies developing advanced AI.
U.S. Senator Kirsten Gillibrand has reintroduced the Data Protection Act, aiming to establish an independent Data Protection Agency. The proposed agency would be responsible for safeguarding the personal data of Americans, addressing what is described as a national data privacy crisis.
Several US states have filed lawsuits against TP-Link, a popular kit maker, alleging that the company misled consumers about the security of its products and its reliance on Chinese suppliers. TP-Link has rejected these allegations, stating they have provided adequate protection and are transparent about their supply chain.
Denmark's national ID system experienced a data breach where unauthorized parties accessed company credentials, exposing the personal data of approximately 8.8 million individuals. The breach, which occurred over 10 days in September, allowed for over 14 million searches of citizen records. Danish authorities are now reviewing security controls and considering stronger identity verification methods beyond just the CPR number.
The President of South Korea has called for the development of tools capable of preventing all cyber-attacks. This push is framed as a necessary "complete security paradigm refresh" to address the evolving threat landscape, particularly in the age of AI.
Privacy International (PI) has responded to the UK Government's consultation on workplace monitoring technologies. PI advocates for stronger protections for workers against invasive surveillance and calls for greater transparency and accountability from employers.
Attackers in Denmark gained access to the CPR data, including names, addresses, and personal identification numbers, of approximately 8.8 million people. This was achieved by exploiting a private Danish company's authorized access to the Central Person Register (CPR).
EPIC has submitted comments on proposed rules for Vermont's Age-Appropriate Design Code. These rules aim to implement specific protections for children within the state.
This article discusses how ongoing litigation surrounding pixel tracking, particularly under the Electronic Communications Privacy Act (ECPA) and the Children's Online Privacy Protection Act (COPPA), can offer valuable guidance for the Supreme Court's upcoming case, Salazar v. Paramount Global. These cases represent broader efforts to combat harmful online tracking and surveillance practices.
The U.S. Senate has passed a bipartisan bill aimed at enhancing cybersecurity within the healthcare sector. This legislative action follows a year where over 730 cyber breaches impacted more than 270 million Americans, with each breach costing an average of $10 million.
Former President Donald Trump has appointed National Intelligence Director Jay Clayton to lead a new federal task force focused on Artificial Intelligence. This decision follows a meeting where Trump engaged with executives from various AI companies at the White House.
CISA has added CVE-2026-88779, a vulnerability in Citrix NetScaler, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This addition is linked to Binding Operational Directive (BOD) 26-04, which mandates federal agencies to prioritize patching such high-risk vulnerabilities, particularly on publicly exposed assets.
The UK's MI5 has issued an alert stating that over 100 academics have been funded by China's Ministry of State Security (MSS) to conduct research that aids in Chinese intelligence gathering. This collaboration, involving the China General Technology Research Institute (CGTRI), is seen as a significant effort by Beijing to enhance its espionage capabilities.
The DEFEND IP Act, a recent site-blocking bill, is criticized for its potential to incentivize censorship and overblocking of websites under the guise of protecting intellectual property. Critics argue that such legislation, similar to past proposals like SOPA/PIPA, undermines the open web by enabling bad-faith actors to block entire websites rather than just infringing content.
Congress is considering the American Copyright Protection Act (ACPA), H.R. 10364, a bill that would allow copyright holders to seek court orders to block Americans' access to foreign websites accused of copyright infringement. This legislation explicitly targets VPN providers, requiring them to take steps to block access, and broadens the definition of what constitutes a "foreign piracy site."
Organizations should prepare for an "AI accountability era" starting in 2027, according to insights from Omdia and Gartner. The coming years will present significant challenges related to AI governance, security, and demonstrating its value.
OpenAI has received a subpoena from California officials related to its AI agents. Attorneys-general are advocating for investigators to have direct access to AI companies' records when incidents occur.
This article argues that organizations face challenges with vulnerability management not due to a lack of scanning tools, but due to unclear ownership of assets. Without defined accountability for fixing identified vulnerabilities, backlogs will continue to grow.
Ecuadorean authorities have ordered free software developer and security expert Ola Bini to be deported from the country, barring his return for 10 years. Bini was detained without a formal order and informed of his visa revocation, with officials citing a secret report alleging he posed a threat to national security. Human rights organizations were denied entry to his deportation hearing.
CISA has added two new vulnerabilities, CVE-2026-102489 and CVE-2026-102490, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. These vulnerabilities, related to Zammad GmbH's Zammad software, pose significant risks and are frequent attack vectors for malicious actors. The article also references Binding Operational Directive (BOD) 26-04, which mandates federal agencies to prioritize remediation of KEV-listed vulnerabilities.
The EU Cyber Resilience Act (CRA) introduces mandatory reporting of actively exploited vulnerabilities and severe incidents within 24 hours for products with digital elements. This regulation aims to reshape international technology markets by emphasizing built-in cyber resilience from the ground up, impacting a wide range of enterprise technologies.
The Marin County Sheriff's Office is accused of illegally sharing automated license plate reader (ALPR) data with out-of-state and federal agencies, violating California law. This action puts drivers at risk and is particularly concerning for vulnerable groups like immigrants and abortion seekers.
