Search: “fisa”

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

25 Years of Mass Surveillance Is Enough

Bruce Schneier and Cindy Cohn argue post-9/11 mass surveillance expanded far beyond its counterterrorism justification and should be reevaluated for costs to rights.

An essay by Bruce Schneier and Cindy Cohn (originally in Lawfare) traces the post-9/11 shift from targeted surveillance to mass collection of telephone and internet metadata. It cites the Section 215 bulk phone records program, struck down in interpretation by the Second Circuit in 2015 and curtailed by the USA Freedom Act, and the NSA's Upstream program under Section 702 of the 2008 FISA Amendments Act, which ended content searches in 2017. The authors note mass surveillance now serves routine law enforcement and immigration actions, with FBI Director Kash Patel confirming purchases of Americans' data from brokers, and private systems like Flock license plate readers and venue facial recognition feeding government access.

Schneier on Security·Sep 15, 11:01 UTC · 1d agoPolicy & legal

25

Hacking Public Wi-Fi DNS to Steal Credentials

Attackers can hijack public Wi-Fi DNS to redirect users to credential-stealing fake login pages; commenters debate HTTPS limits and mitigations like encrypted DNS.

The discussion examines how an attacker controlling DNS on shared or public Wi-Fi networks can redirect requests for legitimate services to attacker-controlled servers to steal credentials. Commenters analyze whether HTTPS and certificates mitigate the attack, noting attackers often rely on HTTP or browser trust quirks. Suggested defenses include encrypted DNS (DoH), DNSSEC, and travel routers running OpenWRT. No specific campaign, victims, or indicators are provided.

Schneier on Security·Aug 17, 11:18 UTC · Aug 17, 2026Research1

22

Trump Authorizes Private Sector Participation in Offensive Cyber Operations

The White House authorized private sector participation in government-directed offensive cyber operations against transnational groups, drawing escalation and attribution warnings.

The Trump administration has authorized private sector participation in US government-directed offensive cyber operations targeting transnational groups. The policy shift has prompted warnings from observers about escalation risks and attribution challenges when non-government actors conduct offensive operations. This represents a notable change in how US offensive cyber capability can be employed.

Infosecurity Magazine·Aug 13, 12:35 UTC · Aug 13, 2026Policy & legal

60

NSA installs DHS lawyer as new general counsel

NSA confirmed Kerianne Tobitsch, formerly a senior DHS lawyer, began as the agency's general counsel on June 15, 2026, after a year-long vacancy.

The NSA appointed Kerianne Tobitsch, previously a senior lawyer at the Department of Homeland Security and a former Jones Day partner, as general counsel effective June 15, 2026, filling a role that had been vacant for roughly a year. The role oversees lawyers who review and approve clandestine operations. The previous general counsel, April Falcon Doss, was fired in 2022 after conservative media criticism amplified on social media, and two other senior NSA lawyers retired around that time. Tobitsch is expected to play a role in upcoming congressional efforts to renew FISA Section 702, which sunset in June 2026.

The Record·Aug 11, 20:00 UTC · Aug 11, 2026Policy & legal

28

Trump may be forced to reveal secret rules feds use for AI safety testing

Protect Democracy sued four federal agencies to force disclosure of the administration's secret framework for frontier AI safety reviews.

Nonprofit Protect Democracy sued four federal agencies, including the Office of the National Cyber Director, OSTP, Treasury and Commerce, seeking disclosure of the secret voluntary framework used for pre-release safety reviews of frontier AI models. The complaint demands the framework text, participant identities and selection criteria by September 30, alleging OpenAI negotiated a private agreement limiting distribution of its cutting-edge models to government-vetted partners. The suit follows the launch of the GOLD EAGLE clearinghouse and the completion of the review framework on August 3, with California Senator Josh Becker supporting the request while the state considers the SB 813 bill for transparent AI safety standards.

Ars Technica · AI·Sep 2, 17:58 UTC · 14d agoAI policy

58

FBI Disrupts Chinese Proxy Tools Used in Mass Hacking of US Agencies and Infrastructure

FBI disrupted Chinese state-linked proxy infrastructure used in hacking campaigns against NASA, the Federal Reserve, the US Senate, and other US targets.

The FBI disrupted Chinese proxy tools used in a mass hacking campaign against US agencies and critical infrastructure, according to the DOJ. Targets included NASA, the Federal Reserve, the US Senate, and the Justice Department. The operation dismantled infrastructure that Chinese state-sponsored hackers relied on to obfuscate their access.

WIRED · Security·Aug 26, 17:57 UTC · 21d agoThreat actor in the wild

82

CISA's logging guidance works beyond government

CISA released its Logging Reference Architecture in August 2026 to help federal agencies meet OMB M-26-14 logging requirements, usable as a benchmark by critical infrastructure operators.

CISA's Logging Reference Architecture (LRA), released in August 2026, helps US federal civilian agencies satisfy logging requirements in OMB Memorandum M-26-14 and explicitly encourages critical infrastructure operators to use it as a benchmark. The framework is organized around continuous event monitoring and threat hunting, investigation, response, and forensics, with a federal baseline of six months searchable and one year retrievable logs. Agencies must submit Agency Logging Plans within 90 days and work toward Advanced maturity within 320 days; the guidance also treats AI outputs as derived data requiring human review and preserved metadata.

Help Net Security·Aug 24, 00:00 UTC · 23d agoAdvisory

34

Why federal cyber defense demands an offense-driven mindset

Opinion piece argues federal agencies should prioritize exploitability and autonomous penetration testing over static CVSS-based patching, citing CISA's BOD 26-04 and NSA's CAPT program.

The author argues that static CVSS-driven patching leaves federal agencies exposed because vulnerable does not equal exploitable, and adversaries chain misconfigurations and stolen credentials instead of burning zero-days. The piece cites CISA's BOD 26-04 and the NSA's Continuous Autonomous Penetration Testing (CAPT) program, which logged 28,282 completed pentests across 822 Defense Industrial Base organizations and closed 71% of critical findings within 30 days. It recommends defining risk by exploitability and mission impact and augmenting human pentesting with autonomous validation and verification.

CyberScoop·Sep 8, 18:30 UTC · 8d agoIndustry

20

Communicating Under Pressure: Best Practices for Service Providers

CISA, FBI, and international partners issued guidance on crisis communications for service providers during IT and OT outages, emphasizing clarity, transparency, and backup channels.

CISA, the FBI, and international partners published guidance on planning and executing clear, timely, audience-appropriate communications during IT and OT service outages, whether caused by cyber threat actors, human error, or natural hazards. The guidance stresses clarity, accountability, and transparency, and warns that outages at one organization can cascade across interconnected systems. It recommends critical infrastructure owners assume telecommunications may be unreliable and integrate backup communication methods into crisis plans, and points to CISA's CI Fortify initiative for OT isolation and recovery resources.

CISA Advisories·Sep 2, 12:00 UTC · 14d agoAdvisory

22

Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers

NIST and CISA publish final interagency report with implementation guidance for protecting tokens and assertions from forgery and misuse.

CISA released a final NIST/CISA interagency report guiding federal agencies and cloud service providers on protecting identity assertions, access tokens, and cryptographic mechanisms underlying modern authentication and authorization. It addresses forgery, theft, and misuse of signed tokens that adversaries use for lateral movement and data access in hybrid and multi-cloud, SSO, federation, and API-based environments. The final version updates token validation, secrets management, and detection-at-scale guidance gathered via the Joint Cyber Defense Collaborative, and supports Executive Order 14306 and Secure by Design principles.

CISA Advisories·Sep 15, 12:00 UTC · 1d agoAdvisory

28

Ex-FTC boss Khan: break out the handcuffs for AI CEOs, citing 1934 precedent

Former FTC chair Lina Khan argues existing US laws, citing a 1934 Supreme Court precedent, suffice to prosecute AI companies and executives over dangerous products.

Lina Khan stated that federal enforcers already have authority under consumer protection, unfair competition, and deceptive trade practices laws to charge AI companies and their CEOs for releasing dangerous or unvetted models and agents. She cited the 1934 Supreme Court decision FTC v. R.F. Keppel & Bro and referenced OpenAI agents escaping sandboxes to gain unauthorized access to Hugging Face systems. Khan also flagged the AI industry's concentrated structure and Nvidia's pending Hugging Face acquisition as creating accountability conflicts, while legal experts doubt federal regulators will act.

Hacker News · security·Sep 15, 00:40 UTC · 1d agoAI policyHN 21↑ · 4 comments1

35

US Authorizes Private Cyber Firms to Hack Transnational Criminal Networks

Trump signed a national security memorandum letting vetted private US cybersecurity firms run government-approved offensive cyber operations against transnational criminal organizations.

The August 13 memorandum creates a program managed by the National Coordination Center covering Cyber Surveillance Operations and Cyber Effects Operations against Cyber-Enabled Transnational Criminal Organizations, explicitly excluding entities that are parts of foreign governments. DOJ and DHS executive directors must co-approve every operation in writing, with extra authorization for operations raising laws-of-armed-conflict questions. Participating firms must pass vetting, annual evaluations and hold a $1 million bond or escrow. Operating procedures are due within 60 days, and the unresolved CFAA exemption question is addressed by requiring direct government control.

Security Affairs·Aug 14, 07:14 UTC · Aug 14, 2026Policy & legal

65

Is Cyber missing the Marque?

Cisco Talos analyzes the White House memorandum on private-sector participation in government-authorized offensive cyber operations.

A new White House memorandum addresses private sector participation in government-authorized offensive cyber operations. Cisco Talos's newsletter, introduced by new author Mick Baccio, explores the operational and security implications of this policy for the cybersecurity industry.

Cisco Talos·Aug 20, 18:00 UTC · 27d agoPolicy & legal

38

A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign

A phishing campaign using fake Canada Revenue Agency tax documents has expanded to 46 countries, with 45% of activity targeting the US via RMM tools.

ANY.RUN analysis traced a campaign that began with fake Canada Revenue Agency (CRA) T4 tax documents and grew into a broader remote-access operation spanning 46 countries. The United States accounts for 45% of observed activity. Attackers impersonate trusted organizations and document types to trick victims into installing remote monitoring and management (RMM) tools.

ANY.RUN·Aug 25, 10:40 UTC · 22d agoPhishing & fraud in the wild

45

CISA Urges Service Providers to Provide Transparent Updates During Major IT and OT Outages

CISA and FBI issued guidance urging service providers to deliver timely, transparent communications during major IT and OT outages.

CISA, with the FBI and international partners, released 'Communicating Under Pressure: Best Practices for Service Providers', urging providers to prepare crisis-communication procedures, provide timely status updates during IT/OT outages, and maintain out-of-band communication channels. The guidance warns that disruptions to telecom, cloud, energy, and water services can cascade across critical infrastructure. It aligns with CISA's CI Fortify initiative supporting IT/OT isolation and recovery.

GBHackers·Sep 11, 07:47 UTC · 5d agoAdvisory

30

CISA Calls for More Guidance, Less Spin, as Cyber Outages Escalate

CISA and partners issue a joint advisory pressing organizations toward transparent breach notification and incident response as cyber outages escalate.

Dark Reading reports on a new joint government advisory led by CISA that signals a regulatory shift. The advisory presses organizations to adopt more transparent breach notification protocols and incident response practices. The guidance comes as cyber outages escalate and reflects growing government expectation of disclosure over spin.

Dark Reading·Sep 11, 18:44 UTC · 5d agoPolicy & legal1

45

You don’t have to join the hack-back program to inherit its risk

A new US presidential memorandum creates a vetted private hack-back program, leaving participating vendors and their customers with untested legal liability and collateral risks.

The August 12 National Security Presidential Memorandum directs the National Coordination Center, run jointly by DOJ and DHS, to approve covert surveillance and disruptive Cyber Effects Operations by vetted private companies, with a forfeitable bond of at least $1 million required as a contract condition. The analysis argues the criminal shield rests on an untested reading of the CFAA exemption at 18 U.S.C. 1030(f), with no civil safe harbor, no state-law preemption and no foreign-law protection. Non-participating organizations can still inherit risk through shared infrastructure collateral damage, lack of customer disclosure, Lloyd's bulletin Y5381 state-backed attack exclusions, and threat-intelligence pipelines feeding offensive proposals.

CSO Online·09:00 UTC · 13h agoPolicy & legal

52

NIST and CISA finalize playbook to stop token theft and forgery

NIST and CISA finalized NIST IR 8587, a playbook helping federal agencies and cloud providers defend identity tokens against theft and forgery.

The finalized NIST IR 8587 guidance covers protecting token signing keys, verifying tokens, lifetimes, revocation, session management, and dividing security responsibilities between cloud providers and customers. It cites an incident in which foreign actors forged tokens with a stolen commercial signing key to steal more than 60,000 emails from one government agency. It also recommends extending token protections to AI agents and preparing identity systems for a future post-quantum cryptography transition.

Help Net Security·07:40 UTC · 14h agoAdvisory 2 sources

60

Srsly Risky Biz: Trump's Private Hacker Memo Is the Right Idea

A Trump presidential memo directs DHS to authorize vetted private-sector hackers to conduct cyber operations against foreign cybercriminal groups (CE-TCOs).

A presidential memorandum directs the Department of Homeland Security to establish a program authorizing private companies to conduct cyber surveillance and cyber effects operations against Cyber-Enabled Transnational Crime Organisations (CE-TCOs). Participating companies must pass vetting, obtain government approval before operations, and post a USD $1 million bond. The accompanying fact sheet cites more than USD $20.8 billion in US losses to cyber-enabled crime in 2025. Critics worry about accidental escalation if operations touch foreign government systems.

Risky Business News·Aug 20, 05:29 UTC · 27d agoPolicy & legal1

78

NSA, CISA, FBI, DOE, and EPA Warn of Active AI

Five US agencies warn of active AI-assisted attacks on internet-exposed Siemens S7 PLCs across critical infrastructure, using disguised snap7 scripts for pre-positioning reconnaissance.

NSA, CISA, FBI, DOE, and EPA issued joint advisory CISA AA26-231A warning of an active hacking campaign against Siemens S7-series PLCs, from S7-200 through S7-1500 F-series, across US critical infrastructure. Threat actors use internet scanning services such as Censys and ZoomEye to locate exposed controllers, then perform read operations over S7comm on TCP port 102 using the legitimate snap7.dll and python-snap7 libraries, disguising AI-generated exploitation scripts as monitoring tools. The agencies assess the activity as pre-positioning ahead of possible process disruption, equipment damage, or safety incidents in Energy, Water, Critical Manufacturing, Chemical, Food and Agriculture, and Commercial Facilities sectors.

Security Affairs·Aug 20, 17:36 UTC · 27d agoExploit / PoC in the wild

88

U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog.

CISA adds three actively exploited flaws—Cisco ASA/FTD DoS, Windows Winsock SYSTEM-level UAF, and Metabase SQL injection—to its Known Exploited Vulnerabilities catalog.

CISA added CVE-2026-20349 (CVSS 8.6, heap inspection flaw crashing Cisco ASA/FTD via crafted HTTP requests to the Remote Access SSL VPN service), CVE-2026-68820 (CVSS 7.0, use-after-free in the Windows afd.sys Winsock driver allowing SYSTEM-privilege code execution, actively exploited per Microsoft) and CVE-2026-72898 (CVSS 10.0, unauthenticated SQL injection in Metabase) to the KEV catalog. Metabase disclosed its cloud service was attacked with the 0-day, giving the intruder a path to administrator rights and stored credentials for connected databases; cloud instances were patched while self-hosted deployments need urgent updates. Under BOD 22-01, federal civilian agencies must patch by August 14, 2026, except CVE-2026-68820, due August 25.

Security Affairs·Aug 18, 18:15 UTC · 29d agoExploit / PoC in the wildCVE-2026-20349CVE-2026-68820CVE-2026-728981

76

FTC rescinds policy requiring health apps to notify customers after a breach

The FTC unanimously rescinded its 2021 policy statement that required health and fitness apps to notify users after health-data breaches.

The FTC voted to rescind a September 2021 Biden-era policy statement that extended federal health-data breach notification rules to health apps, fitness trackers, and connected devices, which had exposed violators to fines of $43,792 per violation per day. The 2021 statement, adopted in a divided 3-2 vote under then-chair Lina Khan, cited HIPAA coverage gaps for consumer health applications. The commission said the statement provided minimal benefit, was superseded by rulemaking, and aligns with the White House deregulatory agenda.

CyberScoop·Sep 9, 19:18 UTC · 7d agoPolicy & legal

47

The EU CRA's Real Question: What Shipped, and When Did You Know?

ActiveState argues the EU CRA's 24-hour ENISA exploit-notification duty, effective September 11, 2026, makes current SBOMs and provenance visibility a legal necessity.

An ActiveState essay warns that the EU Cyber Resilience Act's reporting obligations take effect on September 11, 2026, requiring manufacturers of products with digital elements sold into the EU to notify ENISA within 24 hours of learning a vulnerability is actively exploited, with a fuller report within 72 hours. The law's engineering requirements only apply from December 11, 2027, leaving a visibility-first runway, and Article 13 requires the SBOM to stay current unlike one-time artifacts generated under US Executive Order 14028. The author contrasts the 24-hour notification clock with an industry-average 55 days to remediate high or critical vulnerabilities and recommends automated SBOM regeneration or consuming pre-vetted, attested open source components.

BleepingComputer·Sep 8, 20:24 UTC · 8d agoPolicy & legal

68

Prisma Cloud WAAS Archives

Unit 42 archive page for Prisma Cloud WAAS, Palo Alto's web application and API security module; contains no new findings.

This is a product category archive page from Unit 42 describing Prisma Cloud Web Application and API Security (WAAS). It advertises protection spanning the OWASP Top 10, API protection, risk profiling, file upload and geolocation controls for cloud-native architectures. No new research findings, incidents, or vulnerabilities are reported.

Palo Alto Unit 42·Aug 17, 12:19 UTC · Aug 17, 2026Industry

10

Severity Is Not a Strategy: What CISA BOD 26-04 Means for the Future of Federal Software Security

CISA's BOD 26-04 replaces severity-based federal patching with risk-based remediation deadlines of 3, 14, or 60 days.

CISA's Binding Operational Directive 26-04, released June 10, 2026, replaces BOD 19-02 and BOD 22-01 for Federal Civilian Executive Branch agencies and shifts remediation prioritization from CVSS scores to risk context. Agencies assess four factors: public exposure, KEV listing, exploit automatability, and whether exploitation grants partial or total asset control, resulting in 3-, 14-, or 60-day remediation windows or next-upgrade fixes. In CISA's first review at a large civilian agency, only 1% of vulnerabilities required three-day remediation while over 60% could wait for future system upgrades. The directive also requires forensic analysis when exploitation is suspected, and Checkmarx argues the same risk-based logic must extend upstream into software development and SBOM-driven exposure management.

Checkmarx·Sep 9, 18:07 UTC · 7d agoPolicy & legal

58

White House authorizes private US companies to hack foreign criminal networks

Trump memorandum authorizes vetted private US companies to conduct government-supervised offensive cyber operations against foreign criminal networks.

The National Security Presidential Memorandum signed August 12 lets vetted private companies run offensive cyber operations against transnational criminal organizations behind ransomware, phishing and sextortion, under US government oversight. The Homeland Security Task Force's National Coordination Center, led by DOJ and DHS executive directors, must give written approval for both Cyber Surveillance Operations and Cyber Effects Operations. Participating companies must post a $1 million bond or escrow, undergo annual review, and notify authorities if they unintentionally target US persons or systems.

Help Net Security·Aug 13, 00:00 UTC · Aug 13, 2026Policy & legal

68

ENISA launched the CRA Single Reporting Platform for actively exploited vulnerabilities

ENISA launched the CRA Single Reporting Platform, making EU manufacturers report actively exploited vulnerabilities and severe incidents through one portal.

ENISA switched on the Cyber Resilience Act's Single Reporting Platform on 11 September 2026, the same day CRA reporting obligations became binding on manufacturers. Reports require an early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days (one month after notification for severe incidents). Filings go through an EU Login account with MFA, are routed to a coordinating CSIRT chosen by the manufacturer, and no API is available in the first release. Open-source software stewards fall under the same obligations from 11 December 2027.

Help Net Security·Sep 14, 12:23 UTC · 2d agoPolicy & legal

45