Search: “State Department”

67 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Policy & legal 48 Threat actor 23 Data breach 19 Industry 10 Ransomware 9 AI safety & security 9 Exploit / PoC 6 Phishing & fraud 5 AI policy 5 AI industry 4 Research 4 Advisory 3 Malware 3 AI tools & infra 2

SeverityAll critical 6 high 51 medium 20 low 4 info 71

Italian tech collective Autistici/Inventati shuts down after US terrorist designation

Italian privacy collective Autistici/Inventati shut down after a US State Department terrorist designation triggered its domain suspension and bank account closure.

The volunteer-run Italian collective Autistici/Inventati, founded in 2001, announced Sunday it would shut down after the State Department labeled it an extremist group on August 26, 2026. The designation led the Public Interest Registry to suspend the group's .org domain on August 28 and its bank, Banca Etica, to suspend its account. The collective hosted roughly 16,000 email addresses, 1,500 websites, 5,500 mailing lists, and about 10,000 blogs, including the Noblogs platform. European Digital Rights warned the move sets a dangerous precedent for non-commercial European hosts and digital sovereignty.

The RecordSep 8, 19:12 UTC · 8d agoPolicy & legal

US offers $10 million for info on Iranian leaders behind CyberAv3ngers water utility attacks

The US offered $10 million for information on six IRGC-CEC officials behind CyberAv3ngers' 2023 hacks of Unitronics PLCs at US water utilities.

The State Department named six Iranian security officials, including IRGC Cyber-Electronic Command head Hamid Reza Lashgarian, and offered up to $10 million for information on their whereabouts. CyberAv3ngers publicly claimed compromises of Israel-made Unitronics Vision PLCs in October 2023, forcing the Municipal Water Authority of Aliquippa, Pennsylvania, to take systems offline and switch to manual operations. The US had sanctioned the six men in February for targeting critical infrastructure, and CISA notified water operators using Unitronics devices while urging default-password changes. A watchdog also criticized the EPA for lacking a comprehensive water-sector cyber risk strategy.

The RecordSep 8, 00:00 UTC · 9d agoPolicy & legal in the wild 3 sources

U.S. Offers $10 Million Reward for Iranian IRGC Cyber Chief Linked to Critical Infrastructure Attacks

The U.S. State Department offered up to $10 million for information on Amir Yaryab, an IRGC cyber chief linked to critical infrastructure attacks.

The U.S. State Department's Rewards for Justice program offers up to $10 million for information identifying or locating Amir Yaryab, who allegedly oversees the Cyber Operations Command of Iran's IRGC Cyber-Electronic Command (IRGC-CEC). Officials tie him to units called Shahid Hemmat and Shahid Shushtari conducting cyber and information campaigns against defense, telecommunications, energy, and finance sectors across the US, Europe, and the Middle East, and to groups including CyberAv3ngers and Dadeh Afzar Arman. CyberAv3ngers compromised at least 75 Unitronics Vision Series PLCs, including 34 in US water and wastewater facilities, between November 2023 and January 2024.

Cyber Security NewsSep 8, 09:14 UTC · 9d agoPolicy & legal

NYS DFS Issues New Cybersecurity Guidance on Risk Assessments for Financial Services Entities

New York DFS issued cybersecurity guidance defining expectations for risk assessments that regulated financial services entities must conduct.

On September 10, 2026, NYS DFS Acting Superintendent Kaitlin Asrow issued new cybersecurity guidance on conducting risk assessments sufficient to inform cybersecurity programs. The guidance covers scope, frequency, and the role of assessments for DFS-regulated financial services entities. It does not describe any incident or vulnerability, but sets regulatory compliance expectations under DFS cybersecurity rules.

DataBreaches.netSep 12, 22:15 UTC · 4d agoPolicy & legal

Risky Bulletin: Dutch intel services to get extensive new powers

Netherlands proposed a bill granting AIVD and MIVD expanded warrantless tapping, faster hacking powers, and forced data disclosure, citing Russia, China, and Iran threats.

The Dutch government introduced a bill greatly expanding surveillance powers of intelligence agencies AIVD and MIVD, allowing up to one year of tapping without pre-approval and simplified hacking operations against 'foreign adversaries'. Agencies could compel Dutch companies or citizens to provide data under threat of charges, share data with the private sector, and oversight bodies would merge into a new CTT board. The bill follows similar overhauls in Ireland, Germany, and France after Russia's invasion of Ukraine. The newsletter also reports Moonwell hacked for $8.7M, a Cosmos EVM bug exploited for ~$3M, ShinyHunters listing McKesson with claimed hundreds of millions of records, and a pro-Kremlin DDoS claim against Norway's government network.

Risky Business NewsAug 31, 03:25 UTC · 17d agoPolicy & legal

Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute

US prosecutors unsealed a superseding indictment charging 17 Iranians in the Mabna Institute's state-sponsored theft of 31.5 terabytes from universities and companies.

The superseding indictment unsealed in the Southern District of New York charges 17 people affiliated with Tehran's Mabna Institute, adding eight defendants to the 2018 indictment of nine. The institute allegedly compromised over 100,000 professor email accounts worldwide, including 8,000 accounts at 144 US universities, and stole at least 31.5 terabytes of academic journals, dissertations, and e-books. US universities spent approximately $3.4 billion procuring the stolen data, and victims also included at least five federal and state agencies, 42 US companies, and 11 foreign companies including HBO. The State Department's Rewards for Justice program is offering up to $10 million for information on four of the defendants.

CyberScoopAug 18, 20:13 UTC · 29d agoPolicy & legal

OpenAI disrupts 20 campaigns to misuse its tech as federal officials mull international use of AI

OpenAI disrupted 20+ nation-state operations misusing ChatGPT, including CyberAv3ngers using it for reconnaissance and malware code debugging.

OpenAI's 54-page threat report detailed more than 20 disrupted operations by actors from China, Iran, Russia, Israel and other countries using ChatGPT for writing malware code, rewriting phishing emails and reconnaissance. Banned accounts linked to Iran's CyberAv3ngers (tied to the IRGC) queried default PLC credentials, asked about obfuscating malicious code and researched known vulnerabilities; OpenAI judged the AI use offered no novel capability. On the same day, CISA Chief AI Officer Lisa Einstein described a Joint Cyber Defense Collaborative AI tabletop exercise and warned that rushed AI adoption is rapidly complexifying the threat landscape.

The RecordSep 8, 00:00 UTC · 9d agoAI safety & security

Treasury’s Scott Bessent says no liability exemptions for AI labs

Treasury Secretary Scott Bessent urged Congress to reject AI labs' requested liability exemptions, arguing creator liability is the best safety guarantee.

Testifying before the House Financial Services Committee, Treasury Secretary Scott Bessent said the government should not grant frontier labs liability waivers, responding to Anthropic CEO Dario Amodei's slowdown essay. He cited Treasury's AI safety work since the release of Anthropic's Mythos model, whose cybersecurity risks prompted an April meeting, and coordination with banks and labs after the July Hugging Face cyberattack. Bessent also highlighted the Gold Eagle clearinghouse run with CISA and called for more US-built open-source models to counter China.

CyberScoopSep 16, 14:10 UTC · 19h agoAI policy

Doctor Doom Thanked Seattle for All the Surveillance Cameras

Activist dressed as Doctor Doom urged Seattle's council to curb Axon and Flock surveillance after a committee voted to redirect $250,000 from CCTV expansion.

Clifford Cawthon, a policy advisor at the Washington State Department of Commerce, appeared at a Seattle Public Safety Committee meeting in costume as Doctor Doom to protest the city's expanding mass surveillance. He criticized Seattle PD's access to 62 cameras feeding an Axon real-time crime center that ingests CCTV, body camera, geolocation, ALPR, and dispatch data from vendors like Axon and Flock. His group Community Not Cameras submitted a petition with five demands, and a committee already voted to move $250,000 away from CCTV expansion pending full council approval.

404 MediaSep 9, 19:25 UTC · 7d agoPolicy & legal

U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches

U.S. Treasury sanctioned nearly 60 Iran-linked entities, including MOIS-affiliated Mabna Institute hackers behind breaches of U.S. critical infrastructure and millions in crypto theft.

The U.S. Treasury launched Operation Economic Outcast, designating nearly 60 Iran-linked entities, individuals, and vessels across nuclear, missile, oil, cyber, and digital asset networks. Five sanctioned individuals are members of the Tehran-based Mabna Institute indicted last week; three allegedly breached and exfiltrated data from U.S. energy, defense, healthcare, IT, and financial organizations since late 2023. TRM Labs traced roughly $16.8 million across 30 wallets tied to the members, and the State Department announced a reward of up to $10 million. The action follows Iranian hacking of FBI Director Kash Patel's email and attacks on over 30 U.S. water and wastewater utilities.

The Hacker NewsAug 26, 05:07 UTC · 22d agoPolicy & legal in the wild

Expanding AI access and cyber defense for federal, state, local, and tribal governments

OpenAI and GSA agreed to provide ChatGPT to federal, state, local, and tribal governments with $0 licenses, 50% off usage, and cyber-defense access.

OpenAI for Government and the U.S. General Services Administration announced a 27-month agreement (October 1, 2026 through December 31, 2028) waiving the $15 per-user monthly license fee and cutting usage costs 50% for federal, state, local, and tribal agencies. More than one million government employees already have ChatGPT access, with eligibility extending across a roughly 23 million-person U.S. public-sector workforce. Every verified government entity is approved for Daybreak Blue cyber-defender access at 50% off, with Daybreak Red available for vulnerability research, exploit validation, and red teaming at standard pricing. The deal builds on the $1 billion Daybreak for Frontline Defenders commitment announced the prior week.

OpenAI NewsSep 10, 07:00 UTC · 7d agoAI industry 2 sources1

The 12 Best Mobile Threat Defense (MTD) Solutions, Compared and Priced

A comparison of 12 mobile threat defense vendors highlights Zimperium's on-device detection and notes Kaspersky's US exit and Wandera's Jamf absorption.

The buyer's guide compares 12 mobile threat defense (MTD) products, naming Zimperium best for fully on-device detection and Microsoft Defender for Endpoint as the best-value bundled option. It reminds readers that Kaspersky cannot legally be sold or updated in the US following a Commerce Department determination, and that Wandera was acquired by Jamf. Most MTD pricing is quote-based per device or per user.

GBHackersSep 10, 08:15 UTC · 7d agoIndustry

Supreme Court denies Trump request to allow USPS mail ballot changes

Supreme Court denied the Trump administration's emergency request to implement USPS mail ballot changes before the 2026 midterms, calling it arbitrary and capricious.

The U.S. Supreme Court rejected 7-2 the Trump administration's petition to change how the U.S. Postal Service handles mail-in ballots for the 2026 midterm elections. Justice Ketanji Brown Jackson wrote the administration was unlikely to succeed, while Justice Brett Kavanaugh cited unreasonably short timelines for state election officials. The blocked executive order would have required USPS citizenship verification, barcode tracking of ballot envelopes, and DHS-compiled "State Citizenship Lists"; a whistleblower alleged a rushed effort to install three restrictive IT verification systems. Justices Alito and Thomas dissented, arguing states and organizations lacked standing.

CyberScoopSep 15, 02:15 UTC · 2d agoPolicy & legal

Treasury sanctions alleged Iranian hackers as part of ‘economic D

US Treasury sanctioned four Iranians linked to MOIS-directed hacks that compromised and exfiltrated data from US critical infrastructure, energy, defense, and financial targets.

The Treasury Department designated four Iranian individuals over alleged hacking and cybertheft against US companies in energy, defense, healthcare, IT, and financial sectors since at least late 2023, as part of an 'economic D-Day' sanctions package. It is the second action in weeks against the group, following an indictment of cybercriminals affiliated with Tehran's Mabna Institute; leadership includes Behzad Mesri, first sanctioned in 2018, and the attacks are described as directed by the Ministry of Intelligence and Security (MOIS). Treasury also expanded secondary-sanction categories across digital assets, technology, gold, aviation, and shipping, and noted some group members pursued personal enrichment, including targeting Iranian companies.

CyberScoopAug 25, 13:48 UTC · 22d agoPolicy & legal

Top 10 Best Endpoint Encryption Software in 2026

A 2026 roundup of ten endpoint encryption products argues the engines are solved and buyers should choose management layers like Intune, Sophos, or Trellix.

The guide ranks ten endpoint encryption options, arguing BitLocker and FileVault have won the engine war so the real purchase decision is the management layer for compliance proof, key escrow, and cross-platform policy. Microsoft BitLocker with Intune is named the baseline for Windows estates, with Sophos, ESET, Trend Micro, Check Point, Trellix, and others covering mixed or regulated fleets. It also warns that TrueCrypt-lineage freeware is unmaintained and that Kaspersky cannot be sold to US customers.

Cyber Security NewsSep 10, 08:15 UTC · 7d agoIndustry

The 12 Best Antivirus (Endpoint Protection) Software for Business, Compared and Priced

GBHackers compares 12 business antivirus products on detection, EDR depth, pricing, and platform coverage, ranking CrowdStrike and Bitdefender joint top at 8.8.

The roundup scores 12 enterprise endpoint protection vendors across detection, EDR depth, management, pricing transparency, and platform coverage. CrowdStrike and Bitdefender tie at 8.8, with Microsoft Defender for Endpoint scoring 8.5 and noted as effectively free for Microsoft 365 E5 licensees. The piece also flags that Kaspersky cannot legally be sold in the US and that Panda and Webroot now sit under WatchGuard and OpenText respectively.

GBHackersSep 8, 10:24 UTC · 8d agoIndustry 2 sources1

A California county wants to hire Tina Peters to help run its elections

Shasta County, California plans to hire Tina Peters, convicted of stealing voting system software, as assistant registrar of voters.

Shasta County registrar of voters Clint Curtis said he plans to hire former Mesa County clerk Tina Peters as assistant registrar after Colorado Governor Jared Polis commuted her nine-year sentence for seven felonies, including identity theft, breaking into an election office, and stealing voting system software. Senators Alex Padilla and Adam Schiff asked California Secretary of State Shirley Weber to provide maximum oversight to prevent Peters from improperly accessing ballots, voting systems, or data of over 100,000 registered voters. The county board of supervisors recently censured Curtis after investigations found he was verbally abusive or physically threatening toward staff.

CyberScoopAug 19, 23:05 UTC · 28d agoPolicy & legal

Five alleged leaders of Black Axe’s operations in South Africa extradited to US

US extradited five alleged Black Axe Cape Town leaders from South Africa to face romance-scam wire fraud and money laundering charges.

The Justice Department announced five alleged leaders of Black Axe's South African wing, all Nigerian nationals, were extradited to the US over romance and advance-fee scams run from at least 2011 until their 2021 arrests in South Africa. Prosecutors say the group used fake identities and threatened to expose victims' sensitive photos, with charges including wire fraud, money laundering, and aggravated identity theft carrying up to 62 years. The extradition follows recent multi-country stings arresting dozens of Black Axe members, including 34 arrests in Spain.

CyberScoopupdated Sep 15, 11:49 UTC · 1d agofirst Sep 14, 18:37 UTC · 2d agoPolicy & legal 3 sources

Ukrainian lawyer's second career as a Conti coder earns him 4 years behind bars

Ukrainian lawyer turned Conti malware coder sentenced to four years in US prison, ordered to forfeit $25,042 in Bitcoin.

Oleksii Oleksiyovych Lytvynenko, 44, a trained lawyer who joined Conti under the handle "henry", pleaded guilty in June to conspiracy to commit wire fraud and was sentenced to four years. He coded a malware loader, researched targets using Google and ZoomInfo, and possessed data stolen from eight US victims who reported over $1.5 million in losses. Investigators found Cobalt Strike running and a Rocket.Chat session over Tor on his laptop when Gardaí arrested him in County Cork, Ireland in July 2023; he was extradited to the US in October 2025. Conti attacked over 1,000 victims across 47 US states and 31 countries, with payouts exceeding $150 million by January 2022.

The Register · Securityupdated Sep 11, 16:07 UTC · 5d agofirst Sep 11, 12:15 UTC · 5d agoPolicy & legal 7 sources

Cyber Command turns to veteran of intelligence agencies for top AI role

US Cyber Command appoints Rear Adm. Ronzelle Green as chief AI officer as its AI budget grows from $5M to $138M.

US Cyber Command has named Ronzelle Green, previously head of research and development at the National Geospatial-Intelligence Agency, as its new Chief Artificial Intelligence Officer, replacing Brig. Gen. Reid Novotny. The command's 'AI for Cyber Operations' budget request grew from $5 million in fiscal 2026 to $138 million in fiscal 2027, aiming to let cyber operators process data and respond to threats faster than humans alone. Sources say Green's priority will be consolidating fragmented AI pilot programs across the organization, in contrast to the NSA's more established Artificial Intelligence Security Center created in 2023.

The RecordSep 10, 18:25 UTC · 6d agoAI policy1· 1 read

Florida and Texas move to block Flock cameras over privacy concerns

Florida and Texas move to end use of Flock license plate cameras, citing privacy concerns and database misuse by police.

Florida's Department of Transportation said it will cease using license plate readers, such as Flock's cameras, on state highways and has 30 days to remove them, following Governor DeSantis calling the technology 'out of control'. Texas separately ordered state agencies to stop funding Flock cameras, citing abuse including the indictment of a Lufkin officer on 100 felony counts for allegedly searching Flock's database without authorization. Flock operates roughly 130,000 license plate readers across the US, and towns including Evanston, Cambridge, and Eugene report the company reinstalled cameras after contracts were terminated.

TechCrunch · SecuritySep 1, 15:00 UTC · 15d agoPolicy & legal

Where the backlash against Flock Safety is having the biggest impact

More than 90 cities ended Flock Safety contracts in August as Texas and Florida restrict license plate reader use amid privacy protests.

Over 90 cities and counties terminated Flock Safety contracts in August, per Secure Justice, which has tracked more than 200 municipal terminations since 2021. Texas Gov. Greg Abbott barred state agencies from funding Flock cameras on Aug. 28 after a report that a state agency secretly diverted $30 million; Florida's transportation department banned ALPRs on state highways and Gov. Ron DeSantis criticized the technology. Los Angeles chose not to renew its LAPD contract over data-ownership terms, and Atlanta's mayor ordered a 30-day review of the roughly 5,000 ALPR cameras in the metro area. Several Flock-related police abuse cases, including a Texas officer indicted on 100 felony counts, have fueled the backlash.

The RecordSep 8, 14:03 UTC · 8d agoPolicy & legal

Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited

Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.

The roundup reports at least 274 internet-facing Zimbra instances compromised via CVE-2026-73570, critical Gitea CVE-2026-60004 added to CISA's KEV catalog after exploitation began, and previously patched Citrix NetScaler flaw CVE-2026-8452 exploited in the wild. It also covers PaperCut NG/MF zero-day attacks, a suspected Iran-linked shutdown of a UK power plant, an FBI seizure of domains tied to a China-linked group that hit NASA, DOJ and the Senate, a cyberattack disrupting Boston Scientific, and the Manchester Airports Group breach. Additional items include Chameleon SEO poisoning phishing, Android car head unit proxy botnet malware, ReliaQuest social engineering by ShinyHunters, fake OpenAI Codex macOS malware, and AI-related workforce and supply chain interviews.

Help Net SecurityAug 30, 00:00 UTC · 18d agoIndustry in the wildCVE-2026-73570 CVE-2026-60004 CVE-2026-8452

The complex corporate web behind a $3.2 billion AI data center

Ars Technica probes diffuse accountability behind TeraWulf's $3.2B Lake Mariner AI data center after a June fire exposed safety and job gaps.

A June fire at the Lake Mariner data center in Somerset, New York exposed missing alarms, a nonfunctioning suppression system, and dry hydrants, highlighting how responsibility is split across TeraWulf (owner-operator), Fluidstack (operator), Google (lease guarantees and equity warrants), and Anthropic (compute customer). The article details local concerns over the gap between promised 165 permanent jobs and a projected 35-40, socialized grid costs, and Governor Hochul's moratorium on hyperscaler development. Anthropic's February 2026 pledge to cover electricity price increases applies to the site but leaves other commitments unverified.

Ars Technica · AISep 7, 11:00 UTC · 9d agoAI industry

Texas Police Used AI to Write Report About Using Flock to Search for Woman Who Had Abortion

Johnson County, Texas deputies used Axon's Draft One AI to write a report about searching 80,000+ Flock cameras for a woman who self-administered an abortion.

Documents show the Johnson County Sheriff's Office used Flock's nationwide camera network and Axon's Draft One, which drafts police reports from body camera audio, in its investigation of a woman's self-administered abortion. The AI-generated report summarized deputies' discussion of legal implications, noting Texas law provided no applicable criminal charges. Flock CEO Garrett Langley has repeatedly claimed the search was a family welfare check, but earlier police reports indicate it was initiated at the behest of the woman's abusive partner.

404 MediaSep 2, 15:57 UTC · 14d agoAI safety & security

Srsly Risky Biz: Trump's Private Hacker Memo Is the Right Idea

A Trump presidential memo directs DHS to authorize vetted private-sector hackers to conduct cyber operations against foreign cybercriminal groups (CE-TCOs).

A presidential memorandum directs the Department of Homeland Security to establish a program authorizing private companies to conduct cyber surveillance and cyber effects operations against Cyber-Enabled Transnational Crime Organisations (CE-TCOs). Participating companies must pass vetting, obtain government approval before operations, and post a USD $1 million bond. The accompanying fact sheet cites more than USD $20.8 billion in US losses to cyber-enabled crime in 2025. Critics worry about accidental escalation if operations touch foreign government systems.

Risky Business NewsAug 20, 05:29 UTC · 28d agoPolicy & legal1

Flock camera use by internal affairs unit puts DC police at odds with officers’ union

DC's Metropolitan Police Department used Flock license plate cameras to track officers under internal affairs investigation, prompting a union grievance and council scrutiny.

The DC Police Union learned in July 2026 that MPD Internal Affairs used Flock ALPR cameras to monitor officers under investigation without their knowledge, filing a grievance that management denied. Secure Justice found more than 90 US cities and counties ended Flock contracts in August 2026 alone, with over 200 terminations since 2021, while Texas and Florida announced new usage restrictions. On September 14, DC Councilmember Brooke Pinto asked Interim Chief Jeffery Carroll ten questions about the department's use of Flock data.

The RecordSep 16, 13:41 UTC · 19h agoPolicy & legal

US, Britain to coordinate on scam center takedowns

The US and UK signed an MOU to jointly investigate Southeast Asian scam compounds behind fraud that stole over $12 billion from Americans last year.

The DOJ and UK's National Crime Agency and Crown Prosecutor signed a memorandum of understanding on Thursday for parallel investigations and information sharing on scam centers, largely run by Chinese gangs using human trafficking victims in compounds across Myanmar, Cambodia, and Laos. The Scam Center Strike Force, with more than 150 personnel from the FBI, IRS, and US Postal Inspection Service, leads the effort; the FBI says cyber-enabled fraud accounted for almost 85% of reported losses, with over $12 billion stolen from Americans last year. An in-person disruption event with private industry partners is planned in London in early October. The initiative follows sanctions on Prince Group and a roughly $15 billion bitcoin seizure linked to its CEO Chen Zhi.

The RecordSep 4, 15:42 UTC · 12d agoPolicy & legal

Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

Trump signed an executive order declaring an emergency to bar foreign bulk-power equipment deemed a national security cyber risk.

The executive order, 'Declaring a National Energy Emergency to Secure the United States Bulk-Power System,' prohibits acquiring, importing, transferring, or installing foreign-produced bulk-power equipment and software deemed risky, citing fears of digital backdoors in Chinese-made grid gear. China supplies roughly 85% of solar supply chain capacity and is a major transformer manufacturer. The Energy Department has 120 days to develop implementing rules; the order revives a 2020 Trump-era measure the Biden administration had suspended after utilities found compliance difficult.

CyberScoopAug 26, 21:47 UTC · 21d agoPolicy & legal1

Man Charged With 3 Felonies For Breaking 3D

Oviedo, Florida police charged a man with three felonies for cutting down an officer's 3D-printed decoy Flock surveillance camera.

After several real Flock Safety cameras were stolen in Oviedo between July 23 and August 3, 2026, police replaced them with 3D-printed decoys built by an officer at home and monitored the fakes. Evan Meyer was arrested after midnight and charged with attempted grand theft, criminal mischief over $1,000, and property crimes against computer equipment, despite the decoy costing only a few dollars of filament. Mayor Megan Sladek said she had no idea the sting was underway, and the department claims no records of the decoy's creation exist, citing an ongoing investigation.

404 MediaAug 25, 15:44 UTC · 22d agoPolicy & legal

Lawmakers call for investigation into impact of CISA staffing cuts

Democratic lawmakers asked the GAO to investigate how CISA's roughly one-third workforce reduction affects its mission and critical-infrastructure protection.

Democratic lawmakers led by House Homeland Security ranking member Bennie Thompson asked the Government Accountability Office to examine how recent staffing cuts at CISA affect its ability to protect critical infrastructure and respond to cyber and physical threats. Nearly 1,000 CISA employees have been fired or quit since the Trump administration began, and acting director Nick Andersen plans to hire 300. The letter also flags the FY2027 budget proposal to eliminate nearly 900 additional positions and cut more than $700 million from the agency. CISA has had no confirmed director since Jen Easterly departed, and GAO confirmed it received the request.

The RecordAug 21, 20:02 UTC · 26d agoPolicy & legal

Early 764 member sentenced to 77 years, longest prison term to date for a nihilistic violent extremist

Kyle Spitze, an early 764 member, was sentenced to 77 years for producing CSAM, the longest sentence for a nihilistic violent extremist.

Kyle William Spitze, an original member of the 764 nihilistic violent extremist network and administrator of the Harm Nation offshoot, was sentenced to 77 years in federal prison. He pleaded guilty in December 2024 to producing child sexual abuse material, possession of CSAM, and distributing animal crush videos, victimizing dozens of girls through coercion, doxing and swatting threats. Investigators found roughly 25 photo albums of abuse imagery on his phone and evidence of animal torture. The Justice Department framed the sentence as a signal in a broader enforcement push against 764, which has seen multiple members arrested or sentenced since 2025.

CyberScoopAug 20, 18:34 UTC · 27d agoPolicy & legal

TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit

TikTok agrees to pay $400 million to settle a DOJ child-privacy lawsuit alleging COPPA violations including collecting data from children under 13.

The DOJ announced that ByteDance-owned TikTok will pay $400 million to settle a 2024 lawsuit alleging massive-scale invasions of children's privacy. TikTok pays $300 million immediately and $100 million upon vacating the prior Musical.ly consent decree. The complaint alleged children under 13 could create accounts, data was collected in Kids Mode, and parental deletion requests went unheeded. DOJ called it one of the largest recoveries ever under COPPA, following TikTok's 2023 €345 million GDPR fine.

The Hacker NewsAug 22, 14:32 UTC · 25d agoPolicy & legal

Risky Bulletin: Russia starts blocking DoH and DoT

Russian users report blocks on DoH and DoT servers, including Cloudflare 1.1.1.1 and Google 8.8.8.8, in an apparent censorship crackdown.

Russian internet users began reporting failures connecting to DNS-over-HTTPS and DNS-over-TLS servers, suggesting a government crackdown on the two privacy protocols. The blocks reportedly cover Cloudflare's 1.1.1.1 and Google's 8.8.8.8 resolvers; Roskomnadzor has not officially confirmed the action. The agency tested a similar block in March on Beeline's network and had named DoH for blocking as early as 2021. The bulletin also briefly notes state-sponsored phishing of EU officials, a DDoS against Norway's Digdir, the ReliaQuest/ShinyHunters dispute, and older ransomware and breach disclosures.

Risky Business NewsAug 26, 03:07 UTC · 22d agoPolicy & legal1

Israel Is Running a Synthetic Think Tank to Influence AI Search Results

Israel funds the Hanover Institute, an AI-generated think tank by ad firm Piro, publishing 100+ articles to influence LLM chatbot answers about Israel.

The Hanover Institute for Public Policy, run by American ad firm Piro Inc and paid for by Israel through HAVAS Media and the state ad agency LaPam, has published more than 100 articles in under a month. The AI detection tool Pangram found tested articles entirely AI-written except their bibliographies, and the site includes an llms.txt file to make it easier for LLMs to scrape. FARA filings show a $900,000 project invoice plus a $100,000 payment, and Piro advertises an 'AI Story Optimization' service for shaping chatbot answers.

404 MediaAug 25, 18:35 UTC · 22d agoAI safety & security

Jail time for Maine child in 764 marks turning point in federal law enforcement

A 17-year-old from Maine became the first minor federally adjudicated for 764 extremist crimes, including child exploitation, signaling a policy shift on prosecuting juveniles.

The FBI said a Maine teenager is the first child federally charged and adjudicated for crimes tied to the nihilistic violent extremist collective 764, part of The Com network. Charges include conspiracy to sexually exploit a child, distributing CSAM, interstate threats, cyberstalking, and identity theft. The case marks a turning point in federal policy on prosecuting juveniles and continues heightened enforcement: Kyle Spitze was sentenced to 77 years and Alexis Chavez to 40 years in related cases. The FBI is investigating more than 500 subjects connected to 764 and its offshoots nationwide.

CyberScoopSep 2, 21:03 UTC · 14d agoPolicy & legal

Engineered Persuasion: Evaluating Personalized Pretexts in LLM-Generated Spear Phishing

A study of 180 US workers found each LLM phishing personalization level raised click-intention odds by 28%, but credibility depends on context fit.

The arXiv paper evaluates how personalized pretexts in LLM-generated spear phishing affect perceived credibility, using 180 US working adults across 1,436 evaluations of emails with four cumulative personalization levels, from workplace context to shared-project details. Convincingness rose 2.40 points per level in sensitivity analysis and click-intention odds increased 28% per level, while non-clickers shifted toward deleting rather than reporting. Qualitative coding showed details matching the recipient's role and routines supported credibility, whereas incorrect, vague, or channel-inappropriate details raised suspicion. The authors argue personalization effectiveness depends on pretext fit, with implications for workplace security training.

arXiv cs.CRSep 3, 19:21 UTC · 13d agoResearch

Meta pledges to overhaul kids’ safety protections, pay $17 billion to settle social media case

Meta settles states' kids' online safety lawsuit for $17 billion, agreeing to landmark usage limits, age restrictions, and independent auditing.

Meta agreed to pay $17 billion to settle a civil suit from nearly every US state and territory alleging it hid research showing Facebook and Instagram are addictive to minors and violated COPPA by collecting data on children under 13. The settlement imposes reforms including two-hour daily limits for users under 18, a midnight-to-6am usage block, non-personalized feed options, and an independent auditor. Meta also settled separately with Texas for about $1 billion.

The RecordAug 26, 18:53 UTC · 21d agoPolicy & legal

Conti Hacker Who Built Malware and Attacked Victims Gets Four-Year Sentence

Ukrainian lawyer and Conti malware developer Oleksii Lytvynenko was sentenced to four years in U.S. prison for wire fraud conspiracy tied to Conti ransomware.

Lytvynenko, 44, admitted coding a loader for Conti and holding stolen data from eight U.S. and four overseas victims; prosecutors linked his actions to attacks on at least 12 companies. Conti infected more than 1,000 organizations across 47 U.S. states and 31 countries between 2020 and 2022, with victim payouts exceeding $150 million. Arrested in County Cork in July 2023 with Cobalt Strike running and an active Rocket.Chat session over Tor, forensic evidence showed his ransomware activity continued after Conti's 2022 collapse.

Security AffairsSep 13, 09:19 UTC · 4d agoPolicy & legal

In most cities, nobody owns the whole network

Former Waco CIO argues cellular-connected water controllers sit outside scanned networks, and accountability plus operating-budget funding—not technology—block segmentation.

Writing as Waco, Texas's former CIO, the author describes July water-sector intrusions that CISA linked to over 100 compromised systems, typically controllers on public cellular links absent from asset lists. The FBI and EPA reported incidents at utilities in at least seven states since July 27, and a Clayton County, Georgia pump station failure triggered a boil-water advisory. He argues accountability and funding—using mechanisms like the Texas Water Development Board's new cybersecurity scoring criteria—are the binding constraints, citing Waco's 43-day segmentation of five treatment plants with operating funds.

CyberScoopSep 8, 10:00 UTC · 8d agoIndustry in the wild