Search: “House of Lords”

UK's Online Safety Act has made 'absolutely no difference,' kids say

UK Children's Commissioner tells Lords committee the Online Safety Act has 'made absolutely no difference' and criticizes Ofcom over risk assessment transparency.

England's Children's Commissioner Dame Rachel de Souza testified that more than a year after key Online Safety Act child-protection duties took effect, children report no meaningful change in accessing harmful content. She criticized Ofcom for refusing to share companies' safety risk assessments under section 393(1) of the Communications Act 2003, and planned to use statutory powers to compel disclosure. She argued the OSA has not kept pace with AI-driven harms (citing the 'Grok nudifying' controversy) and urged Ofcom to 'use its teeth,' contrasting the UK's approach with Meta's proposed $18 billion US child-safety settlement.

The Register · Security·Sep 3, 09:14 UTC · 13d agoPolicy & legal1

UK cyber bill targets AI users, not the vendors building it

UK ministers rejected Lords amendments that would have brought AI vendors into the Cyber Security and Resilience Bill's scope.

Cybersecurity minister Baroness Lloyd of Effra told the Grand Committee that regulating frontier AI developers through the UK Cyber Security and Resilience Bill would not prevent misuse by hostile actors, pointing instead to the AI Security Institute and the voluntary AI Cyber Security Code of Practice, which informed the ETSI EN 304 223 standard. Rejected amendments included requirements for AI vendors to demonstrate red lines such as evading human oversight, and last-resort powers to shut down a datacenter or widely deployed AI system during emergencies. The bill instead extends the NIS 2018 regime to managed service providers, datacenter operators and designated critical suppliers, imposing duties on regulated organizations rather than technology providers.

The Register · Security·Sep 2, 09:44 UTC · 14d agoAI policy

UK Legal Regulator Raises AI Misuse Concerns

UK's Solicitors Regulation Authority warns law firms about AI hallucination risks and client data leaks.

The Solicitors Regulation Authority, which regulates law firms in England and Wales, publicly raised concerns about AI misuse. Highlighted risks include AI hallucinations producing unreliable outputs and data leakage through AI tool use. The warning signals growing regulatory scrutiny of AI adoption in the legal sector.

Infosecurity Magazine·Aug 18, 08:17 UTC · 29d agoAI policy

Peers ask why UK cyber bill leaves execs off the personal liability hook

UK peers propose amendments to the Cyber Security and Resilience Bill adding personal executive liability and board-level cyber responsibility; government defends fines-only approach.

Baronesses Kidron and Ludford backed amendments to the UK Cyber Security and Resilience Bill that would introduce personal civil liability for senior executives and mandate board-level cybersecurity responsibility, citing NIS2 and financial-sector accountability rules. Cybersecurity minister Baroness Lloyd defended the bill's existing regime of fines up to £17 million or 4% of annual turnover, with governance requirements to come via secondary legislation. Peers also debated the bill's 24-hour and 72-hour incident reporting requirements, with Baroness Harding proposing an additional 14-day intermediate report and a one-month final report.

The Register · Security·Sep 7, 09:15 UTC · 9d agoPolicy & legal

UK government seeks powers to secretly block risky tech suppliers

UK amendments to the Cyber Security and Resilience Bill would let ministers secretly ban risky tech suppliers across critical sectors.

The UK government published amendments to the Cyber Security and Resilience Bill creating 'vendor-related directions' that allow ministers to order companies in critical sectors to stop buying from a supplier, restrict its products, or remove installed equipment on national security grounds. The powers extend beyond telecoms to managed service providers, data centers, digital infrastructure and the energy, water, transport and health sectors, adapting the mechanism used to restrict Huawei in UK 5G while removing some transparency safeguards. Ministers would not have to publicly name the vendor, could withhold details on national security or commercial grounds, and could bar recipients and consultees from discussing the orders, though the government would report annually to Parliament on directions issued. The amendments will be considered at committee stage in the House of Lords in September.

The Record·Aug 26, 13:53 UTC · 21d agoPolicy & legal

House passes bill to equip local law enforcement with scam-fighting tools

The U.S. House passed the GUARD Act, letting local law enforcement use federal grants to investigate financial scams and trace stolen cryptocurrency.

The bipartisan GUARD Act (Reps. Zachary Nunn, Scott Fitzgerald, Josh Gottheimer) passed the House, allowing existing DOJ grant funds to be used for fraud analysts, victim-support training, blockchain tracing software, and financial-information sharing with law enforcement. It addresses scams like pig butchering, often run by transnational criminal groups overseas; Americans lost a record $11.4 billion to crypto-related fraud in 2025, including $8.6 billion in investment fraud. Senators Katie Britt and Kirsten Gillibrand introduced a Senate companion in July 2025, and the House also passed a bill retroactively eliminating the 'scam tax' on stolen funds for 2021-2025 victims.

The Record·Sep 16, 18:28 UTC · 6h agoPolicy & legal

U.K. Supreme Court Opens Door for Spyware Victims to Sue Foreign States

UK Supreme Court ruled Bahrain not immune from spyware litigation, letting two dissidents pursue claims over FinSpy hacking; case returns to the High Court.

The UK Supreme Court ruled in The Kingdom of Bahrain v. Shehabi that Bahrain is not immune from litigation over its alleged use of FinSpy spyware against two Bahraini dissidents living in the UK. Citizen Lab researchers Siena Anstis, Natalia Krapiva, and Kate Pundyk, writing in Lawfare, called the decision a milestone for accountability in transnational repression. The case now returns to the UK High Court, where attribution, causation, and injury must be proven.

Citizen Lab·Sep 2, 14:14 UTC · 14d agoPolicy & legal in the wild

ICO Reprimands Criminal Records Office After 2023 Breach

The UK ICO formally reprimanded ACRO Criminal Records Office over a 2023 breach caused by patching and security monitoring failures.

The UK Information Commissioner's Office issued a formal reprimand to ACRO Criminal Records Office following a breach in 2023. The regulator found failures in patching and security monitoring contributed to the incident. The action underscores regulator expectations for timely patching and monitoring at data-holding organizations.

Infosecurity Magazine·Aug 13, 08:30 UTC · Aug 13, 2026Policy & legal

UK’s Police National Legal Database Reveals Data Breach

Infosecurity Magazine·Aug 4, 08:40 UTC · Aug 4, 2026Data breach

Ministry of Justice apologizes after court staff accessed Southport victims' files

UK Ministry of Justice apologized after court staff accessed Southport attack victims' files without authorization, exposing sensitive personal data with no evidence of third-party sharing.

The UK Ministry of Justice apologized after court staff accessed case files related to victims and survivors of the 2024 Southport murders without authorization, including sensitive personal data assessed as high risk for some individuals. There is no evidence the information was shared with third parties. HM Courts and Tribunals Service and HM Prison and Probation Service are investigating, and the Information Commissioner's Office has been informed. The incident follows similar unauthorized record access at North West Ambulance Service and Aintree University Hospital.

The Register · Security·Sep 16, 10:42 UTC · 14h agoData breach

PNLD Confirms Data Breach Affecting UK Police and Justice Staff

Security Affairs·Aug 3, 12:23 UTC · Aug 3, 2026Data breach1

Norway announces investigations into telecom Telenor’s work with Myanmar junta

Norwegian police opened crimes-against-humanity and sanctions investigations into Telenor's data handovers to Myanmar's junta, raiding its Oslo headquarters.

Norway's National Criminal Investigation Service is investigating Telenor for complicity in crimes against humanity for repeatedly handing over historical customer traffic data to Myanmar's military regime between the February 2021 coup and the March 2022 subsidiary sale. The Police Security Service is separately probing sanctions violations because the sale to M1 Group included sanctioned surveillance equipment transferred without foreign ministry permission. The subsequent resale passed historical call data of over 18 million people to junta-linked owners, and a class action on behalf of 1,200 people alleges the data enabled arrests, torture, and at least one execution.

The Record·Sep 15, 20:01 UTC · 1d agoPolicy & legal

Is Cyber missing the Marque?

Cisco Talos analyzes the White House memorandum on private-sector participation in government-authorized offensive cyber operations.

A new White House memorandum addresses private sector participation in government-authorized offensive cyber operations. Cisco Talos's newsletter, introduced by new author Mick Baccio, explores the operational and security implications of this policy for the cybersecurity industry.

Cisco Talos·Aug 20, 18:00 UTC · 27d agoPolicy & legal

How to report an AI Act violation in the EU

Help Net Security·Aug 10, 00:00 UTC · Aug 10, 2026Data breach1

Delaware Consumer Privacy and Data-Breach Law Updates

Delaware's governor signed HB 380 and HB 381 amending the state privacy act and breach notification law.

On September 2, 2026, Delaware's Governor signed House Bill 380 and HB 381. HB 380 amends the Delaware Personal Data Privacy Act (DPDPA), enacted in 2023 and effective January 1, 2025. HB 381 separately amends Delaware's computer security breach notification law. Joseph J. Lazzarotti of JacksonLewis summarizes the changes.

DataBreaches.net·Sep 13, 14:50 UTC · 3d agoPolicy & legal

UK Fraud Cases Hit Record High in 2026

Cifas reports UK fraud cases reached a record high in 2026, driven by account takeover and identity fraud.

Cifas data shows UK fraud cases hit a record high in 2026. Account takeover and identity fraud are the main drivers of the surge. The figures indicate rising fraud pressure on UK consumers and financial institutions.

Infosecurity Magazine·Aug 19, 08:45 UTC · 28d agoPhishing & fraud

Risky Bulletin: Dutch intel services to get extensive new powers

Netherlands proposed a bill granting AIVD and MIVD expanded warrantless tapping, faster hacking powers, and forced data disclosure, citing Russia, China, and Iran threats.

The Dutch government introduced a bill greatly expanding surveillance powers of intelligence agencies AIVD and MIVD, allowing up to one year of tapping without pre-approval and simplified hacking operations against 'foreign adversaries'. Agencies could compel Dutch companies or citizens to provide data under threat of charges, share data with the private sector, and oversight bodies would merge into a new CTT board. The bill follows similar overhauls in Ireland, Germany, and France after Russia's invasion of Ukraine. The newsletter also reports Moonwell hacked for $8.7M, a Cosmos EVM bug exploited for ~$3M, ShinyHunters listing McKesson with claimed hundreds of millions of records, and a pro-Kremlin DDoS claim against Norway's government network.

Risky Business News·Aug 31, 03:25 UTC · 16d agoPolicy & legal

EU begins enforcing AI Act, putting AI models under the microscope

Help Net Security·Aug 4, 00:00 UTC · Aug 4, 2026AI policy

Key lawmaker suggests action on AI safety legislation will wait until 2027

House Energy and Commerce Chairman Brett Guthrie declined to commit to a 2026 vote on the FRONTIER Act, pushing AI safety legislation toward 2027.

House Energy and Commerce Chairman Brett Guthrie said he would not pledge a timeline for a committee vote on the bipartisan FRONTIER Act, signaling action likely waits until 2027. The bill, co-sponsored by Jay Obernolte and Lori Trahan, has support from OpenAI, Anthropic, and lawmakers across party lines. At the same event, White House adviser David Sacks endorsed Elon Musk's proposal for cross-industry pre-release model testing, while Hugging Face CEO Clem Delangue argued existing cyberattack liability suffices but urged mandatory disclosure of AI-agent attacks. The debate follows incidents of rogue AI agents launching cyberattacks, including roughly 700 OpenAI agents hacking Hugging Face's platform.

The Record·Sep 16, 21:07 UTC · 4h agoAI policy

17 draft Cyber Resilience Act standards are open for comment

ETSI publishes 17 draft harmonised standards detailing EU Cyber Resilience Act compliance, open for comment until between mid-September and mid-November 2026.

Seventeen draft standards covering the higher-risk tier of products with digital elements, including password managers, antivirus software, connected toys and wearables, are open for comment. Following a Harmonised Standard grants manufacturers the presumption of conformity with the Cyber Resilience Act, whose obligations apply through the end of 2027 to importers, distributors, service providers and developers. The drafts went to 41 member organisations plus societal partners ANEC, ECOS, ETUC and SBS, with closing dates varying by vertical.

Help Net Security·Aug 14, 00:00 UTC · Aug 14, 2026Policy & legal

Three intrusions at UK criminal records office went undetected for two years

UK ICO reprimands ACRO criminal records office after three undetected intrusions over two years exposed thousands of records, including domestic violence victims.

The UK Information Commissioner's Office reprimanded ACRO Criminal Records Office after three intrusions between July 2021 and June 2023 exploited a Kentico customer portal unpatched since September 2019 and ignored Trend Micro antivirus alerts, including four quarantined Mimikatz detections. An attacker maintained persistent access for roughly seven months and staged data of nearly 11,000 people for exfiltration, though ACRO could not confirm exfiltration due to insufficient logging. ACRO notified more than 84,000 people on a precautionary basis; the Medusa ransomware group claimed the incident, and network segmentation kept attackers out of the Police National Computer.

The Record·Aug 12, 13:08 UTC · Aug 12, 2026Data breach in the wild