Nextgov/FCW - All Content

Compliance theater is over: What FedRAMP 20x means for every vendor selling to government

Hemant Baidwan — Fri, 21 Aug 2026 16:38:00 -0400

Pete Waterman did not mince words at Carahsoft's FedRAMP Summit last month. Speaking about vendors that claim they lack the resources to fix a known, exploitable vulnerability within days, the FedRAMP director said plainly he does not want them in the federal marketplace. After nearly two decades building and authorizing systems for federal customers, I cannot remember the last time a FedRAMP official drew a line that clearly. It is the right line and well overdue.

Waterman's warning was not out of the clear blue as he pointed directly to the recent Hugging Face incident in which AI models operating in a sealed test environment found an unknown flaw, escaped the environment and used stolen credentials to reach a production system before anyone caught it. The lesson is the one the vendor community needs to hear. Attacks now move faster than human-paced patch cycles can keep up with and a compliance program built around periodic reviews will not catch them.

Waterman's comments are a direct challenge to how many government software vendors are still organized with security functioning as a separate review layer that evaluates work after it ships rather than alongside it.

There is a version of FedRAMP authorization that treats compliance as a paperwork exercise. A security team writes policy while a separate engineering team ships code, and a Plan of Actions and Milestones, the government's formal document for tracking open security issues, gets worked down once a quarter when someone remembers to look at it. Waterman named this directly, saying vendors will not meet the government's expectations if compliance staff sit apart from the engineers who build and maintain the product.

The FedRAMP 20x vulnerability detection and response requirements are specific. Providers are expected to begin reducing risk from serious, internet-facing vulnerabilities within two to four days depending on severity. The system's security state must be verified at least every three days. Under the current baseline, that means responding to findings on hard timelines and not whenever the next release cycle comes through. None of that is achievable on a quarterly schedule. It is only achievable if the team shipping your product is the same team fixing your security findings.

Continuous authorization requires continuous delivery. If your infrastructure is defined as code, your software containers are scanned on every build and your deployment pipeline can push a fix to production the same day a critical finding lands, then you are not choosing between moving fast and staying compliant. The pipeline becomes part of the security control itself.

In practice, this means three things:

Automated, frequent scanning. Production environments need to be scanned regularly, with findings routed directly to the engineering team responsible for the fix and not into a queue that a compliance analyst reviews weeks later.
The deployment pipeline as the system of record for change management. Modern automated deployment tools are not obstacles to federal change control requirements. When properly configured they generate the exact evidence trail those requirements ask for.
Deadline-driven remediation, not calendar-driven remediation. Critical findings get worked against hard timelines. If a vendor cannot sustain that pace then the conversation needs to happen before a system goes live and not after.

Vendors who will struggle with FedRAMP 20x are the ones treating security as a gate at the end of the process. Those who will succeed treat the pipeline itself as the control where every code change gets scanned, every container gets verified and every fix ships through the same automated path as every new feature.

The practical guidance coming out of last month's event is straightforward. Audit your patching timeline now! If your process for moving a critical fix from discovery to production takes more than two to four days that gap needs to close before FedRAMP 20x enforcement tightens further. That is not a future-state problem. It is a today problem, and the Hugging Face incident is the clearest evidence yet of why it matters.

FedRAMP authorization built on a modern automated delivery foundation is not just faster to achieve. It is the only version of authorized that will hold up against threats moving at machine speed.

Hemant Baidwan is the Chief Information Security Officer at Knox Systems, where he leads enterprise cybersecurity strategy and the development of AI-driven, cloud-native security platforms. Previously, he served as the CISO and Acting Deputy Chief Information Officer at the U.S. Department of Homeland Security (DHS), where he was responsible for securing one of the largest and most complex civilian federal environments.

]]>

Tech bills of the week: Overseeing algorithm-set rental prices; and halting federal overreach in data center construction

Alexandra Kelley — Fri, 21 Aug 2026 15:33:00 -0400

Monitoring algorithms used in setting rent

A new bill seeks to compel any entity creating rental rates to reveal when algorithms are involved in setting prices for home rentals by leveraging the authorities of the Federal Trade Commission.

The Housing Price Transparency Act, introduced by Rep. Kathy Castor, D-Fla., on Monday, requires firms and organizations overseeing home rental prices to report their use of pricing algorithms that aid in developing, determining and setting housing and rental costs.

The bill would apply existing restrictions stipulated in the Federal Trade Commission Act to algorithmic rental price setting. Violations of the bill, or failure to disclose the use of algorithms in rental prices, would fall under section 18(a)(1)(B) surrounding “unfair or deceptive acts or practices.”

Recourse is also offered to victims of such violations. States are eligible to bring a civil action on behalf of the plaintiffs and seek damages, restitution or other compensation. The FTC itself is also granted the right to enforce the bill’s provisions.

Limiting federal, lawmaker influence over new data centers

Rep. Tom Barrett, R-Mich., introduced two bills on Thursday that look to grant states more autonomy in new data center construction as part of the AI compute boom, focusing on preventing the federal government from overriding local zoning laws and ensuring lawmaker transparency.

The Protecting Local Control of Data Centers Act focuses on prohibiting federal agencies from overriding state and local land-use zoning and permitting laws related to data centers. Federal agencies would also not be able to use federal funds allocated towards data center construction to force state and local governments to surrender their authority.

The No Data Center NDAs Act targets lawmakers who have signed non-disclosure agreements related to data center operations. Under the proposal, sitting lawmakers would not be able to sign NDAs that prohibit the discussion of possible or planned data center locations and resource consumption. Should this bill be passed into law, the House Ethics Committee and the Select Committee on Ethics of the Senate would both be tasked with implementing and overseeing the new NDA restrictions.

“Families in my district are rightly concerned about the effect data centers could have on their utility bills, as well as the land and water in their neighborhood. They deserve to know all the facts and have the final say over any proposed project,” Barrett said in a press release. “That starts with stopping federal overreach and preventing the secrecy pledges that have plagued Michigan and undermined the power of local residents.”

]]>

Counties and cities sue over counterterrorism grant rule changes

Chris Teale — Fri, 21 Aug 2026 13:00:00 -0400

A group of four cities and counties announced a lawsuit this week challenging the Trump administration’s efforts to tie counterterrorism grants to election rule changes.

Harris and El Paso Counties in Texas; the Metropolitan Government of Nashville and Davidson County, Tennessee; and the City of Columbus, Ohio announced they would sue the Department of Homeland Security in federal court over its announcement last month that states must implement various election security measures before they can receive homeland security grants.

The announcement from the Federal Emergency Management Agency came in its funding opportunity for the $1 billion Homeland Security Grant Program and said states would need to take what FEMA called “critical, common-sense steps to protect U.S. elections,” to receive funds.

Those steps included submitting a plan to use hand-marked paper ballots; a manual audit of at least 5% of all ballots cast after every federal election; reconciling the number of voters who participated in each federal election with the number of ballots cast; and using the U.S. Citizenship and Immigration Services’ Systematic Alien Verification for Entitlements system to verify the citizenship status of everyone listed in the state voter registration database and those who work at polling places or operating election systems.

Local leaders said those requirements were unconstitutional and unacceptable, especially as they could result in FEMA holding onto 20% of a state’s award under the grant program, or even cancelling an award altogether.

“Local election offices already face some of the toughest oversight and requirements designed to keep their operations safe and secure,” El Paso County Attorney Christina Sanchez said in a statement. “Imposing additional requirements is both costly and burdensome, while our law enforcement agencies rely on this funding to purchase critical equipment that helps protect and save lives.”

The lawsuit, filed in U.S. District Court in Washington, D.C., said FEMA’s conditions are arbitrary and illegal and violate both the Administrative Procedure Act and the Constitutional separation of powers. The complaint notes that Congress, not the executive branch, has exclusive authority to set the terms of federal spending, and that the states and Congress, not the executive branch, have the power to make rules for federal elections.

“Congress did not create the [grant program] to empower the federal government to control state and local election procedures,” the complaint says. “Yet the Administration has now hijacked the program to do just that.”

The plaintiffs also argued that the new conditions on grant funding could throw the upcoming midterm elections into “chaos.”

“FEMA has offered no reasoned explanation for how overhauling state election administration serves HSGP’s counterterrorism mission, and it has ignored the legal, financial, and logistical chaos these conditions will inflict on state and local governments that are suddenly told — only months before an election — that they must transform how their elections are run,” the complaint says.

This latest gambit from FEMA to influence election administration comes as Republicans in Congress have tried and failed to pass the SAVE America Act, which would codify many of these same rules and others. President Donald Trump has also fired two members of the Election Assistance Commission while another resigned, and the Trump administration has taken legal action to try to obtain voter data from secretaries of state, though it has so far been unsuccessful in court against states opposed to those measures.

The administration also cut staff at the Cybersecurity and Infrastructure Security Agency and ended federal funding for the Elections Infrastructure Information Sharing and Analysis Center. The move to tie grant funding to election-related demands has echoes of an executive order Trump signed last year that sought to impose documentary proof of citizenship requirements and restrict mail-in ballots. A U.S. District Court has since issued a permanent injunction against major provisions of that order.

“This partisan pushback is nothing new,” a FEMA spokesperson said in an email. “We fully expected opposition to common-sense measures designed to protect election security and safeguard the integrity of American democracy. Election security is national security, and protecting our critical infrastructure remains a top priority for the Trump Administration. Concerns over voting processes, data security, and registration practices have made it clear that action is required. This year, states must take critical, common-sense steps to protect U.S. elections before receiving their full Homeland Security Grant Program awards. These new requirements will preserve election integrity.”

The complaint against FEMA’s new rules urges the judge to declare them unlawful and unenforceable and prevent the agency and DHS from imposing election-related requirements on the counterterrorism grant program.

“FEMA has no authority to impose those conditions — not under its governing statute and not under the Constitution,” the complaint says. “Congress authorized FEMA to help jurisdictions protect critical infrastructure from terrorist and cyberattacks. It did not authorize FEMA to decide who may vote, how ballots must be counted, or how states maintain their voter rolls. Never before has FEMA purported to regulate how states and counties run elections. Such a transformative assertion of federal authority in an area of traditional state control requires clear congressional authorization that FEMA does not have.”

]]>

House Democrats ask GAO to review CISA workforce cuts

David DiMolfetta — Fri, 21 Aug 2026 08:00:00 -0400

Five House Democrats are asking Congress’ investigative arm to examine how significant staffing cuts at the Cybersecurity and Infrastructure Security Agency have affected the government’s ability to defend federal networks and critical infrastructure.

The lawmakers are calling on the Government Accountability Office — the top congressional watchdog that audits and evaluates federal programs — to examine the impact of personnel and program reductions enacted at CISA since President Donald Trump returned to the White House, according to a letter first seen by Nextgov/FCW.

The request, addressed to acting Comptroller General Orice Williams Brown, is led by Reps. James Walkinshaw, D-Va., Delia Ramirez, D-Ill., and Bennie Thompson, D-Miss., the ranking member on the House Homeland Security Committee. Ramirez is the top Democrat on the panel’s cybersecurity subcommittee, where Walkinshaw also serves. Reps. Seth Magaziner, D-R.I., and LaMonica McIver, D-N.J., who also serve on the cyber panel, joined the request.

The lawmakers say CISA has lost nearly a third of its workforce “at precisely the moment when our adversaries are accelerating attacks against critical infrastructure,” leaving Congress without a clear picture of which capabilities were lost and whether remaining teams can keep pace with growing cyber and physical threats.

The concerns have grown during the war with Iran, as CISA and the FBI help utilities navigate cyberattacks affecting at least 12 states that some U.S. officials suspect may be tied to Tehran.

The lawmakers are asking GAO to examine how CISA’s workforce has changed over the past five years, including its size, composition, geographic distribution and reliance on contractors. They also want the watchdog to identify which programs were affected by the reductions and what consequences CISA and its industry and government partners have reported.

The letter further asks GAO to evaluate what data CISA uses to make workforce decisions and whether its human capital strategy aligns with its current and future mission needs.

“Little is known about the impact of these workforce reductions on CISA’s programs and services,” the lawmakers write, arguing it’s unclear whether the agency is positioned to replace the skills it has lost.

After this story was published, GAO spokesperson Sarah Kaczmarek confirmed receipt of the request and said the office “has a process it goes through to determine whether we do work and when, which we are working through right now.”

CISA is now attempting to rebuild parts of its workforce after layoffs, voluntary departures and other personnel actions reduced staffing from roughly 3,300 employees to about 2,200. Acting Director Nick Andersen has said the agency plans to hire about 330 people, while Homeland Security Secretary Markwayne Mullin has said CISA may need roughly 600 additional staff and that hiring could take a year or more.

Walkinshaw previously told Nextgov/FCW that restaffing the agency would be “a very difficult thing to do,” noting that cyber personnel have seen colleagues pushed out and their work publicly criticized by administration officials.

The workforce picture has also been complicated by internal DHS transfers. CISA’s former acting director told lawmakers in February that about 70 agency employees were reassigned to other DHS offices, while just over 30 moved into CISA.

At the same time, the administration’s fiscal 2027 budget request calls for eliminating roughly 870 CISA positions, including cutting staff tied to election security, stakeholder engagement and workforce development. House appropriators have since advanced a bill that would provide CISA with about $400 million more than the White House requested and set aside $31 million for critical hires. The measure has not received a House floor vote, and the Senate has not released its version, leaving the agency’s final funding and staffing levels unsettled.

The cuts were part of the Trump administration’s broader push to shrink the federal workforce, but CISA has drawn particular scrutiny over its past election security work.

That fight dates back to Trump’s first term, when he fired CISA’s first director, Chris Krebs, after Krebs rejected Trump’s false claims that the 2020 election had been stolen from him. Republicans have concurrently accused the agency of censoring conservative speech when it worked with social media platforms to flag election- and COVID-related misinformation in and around the 2020 race.

Editor's note: This article has been updated to include comment from GAO.

]]>

VA boosts EHR modernization contract with Oracle by $17B

Edward Graham — Thu, 20 Aug 2026 16:36:00 -0400

Oracle’s contract with the Department of Veterans Affairs for the agency’s new electronic health record system will increase by almost $17 billion as part of a modified agreement, according to an award notice posted on SAM.gov on Wednesday.

VA first contracted with Cerner in 2018 to upgrade its health record system. Oracle subsequently acquired Cerner in 2022 and rebranded the combined unit as Oracle Health.

The announcement comes after VA published a notice last week detailing plans to extend its EHR modernization contract with Oracle for an additional three one-year optional ordering periods. The award increase will now bump up the contract’s total value from just under $10 billion to roughly $27 billion.

“Specifically, this modification will increase the overall contract ceiling and extend the Period of Performance,” last week’s contract modification documents said. “This action is necessary to continue [electronic health record modernization] deployment activities and associated support services until all VA Medical Centers (VAMCs) and related facilities have fully transitioned to the EHR system.”

The agency’s modernization project — part of a broader federal effort to deploy a streamlined, interoperable EHR across VA, the Pentagon, the Coast Guard and the National Oceanic and Atmospheric Administration — has been beset by cost overruns, technical glitches and usability concerns since the first software go live occurred in 2020.

Ongoing issues ultimately led to VA and Oracle renegotiating their contract in May 2023, with the deal being modified from an additional five-year term to five one-year terms. The latest modified agreement now has the ability to cover work through May 2031.

VA said extending its agreement with Oracle was necessary because “unanticipated complexities” slowed software deployments, which resulted in the contract’s ceiling being reached “sooner than originally planned.” The agency added that it “anticipates using the remaining ceiling by the first quarter of fiscal year 2027.”

VA paused most deployments of the new EHR system in April 2023 to remedy the problems slowing software rollouts across its network of 164 medical facilities. The agency announced plans at the tail end of the Biden administration in December 2024 to restart system go-lives at four Michigan-based medical sites in mid-2026.

Current VA Secretary Doug Collins — who has called the EHR modernization project a priority — subsequently added nine additional medical facilities to VA’s 2026 deployment schedule, bringing the total number of site rollouts this year to 13. VA officials previously said they are hoping to finish EHR system deployments at every one of the agency’s medical facilities by 2031.

]]>

Closing federal security gaps in an era of AI-enabled attacks

Travis Rosiek — Thu, 20 Aug 2026 16:30:00 -0400

AI-enabled attacks are shrinking the time between intrusion and operational impact. Yet many government agencies manage IT infrastructure, cybersecurity, data and artificial intelligence (AI) through separate leadership structures.

The organizational divide creates risk. When attackers target sensitive data and move at machine speed, agencies cannot afford fragmented decisions about how information is managed, protected and recovered. They also cannot afford a false sense of security on cyber resilience across silos.

Recent policy moves, including the National Cyber Strategy and a new executive order on AI, are pushing agencies in that direction. The challenge now is execution. Agencies that align IT, security and data leadership will be in a stronger position to limit damage and maintain operations as AI-driven threats continue to evolve.

Closing security gaps between teams

Government IT, security, data and AI leaders often operate with different priorities.

IT teams focus on availability. Security teams focus on reducing risk. Data and AI leaders focus on expanding access and accelerating adoption.

Attackers can exploit organizational gaps as effectively as technical vulnerabilities, especially when agencies don’t know they exist. Therefore, agencies should build cross-functional collaboration into their governance, architecture and operating processes from the beginning.

Shifting from prevention to recovery

No interconnected government environment can be made breach-proof, particularly as adversaries use automation to identify vulnerabilities and accelerate attacks.

Therefore, prevention and compliance do not equal security. Most breached organizations are compliant. True resilience means preparing for failure. Agencies should assume systems will crash, break or be hacked. They should design operations to withstand damage, restore trusted data and resume services quickly.

The strategic focus should expand beyond perimeter defense to include continuous preparation for compromise and rapid cyber recovery. Security teams should regularly test their technology and conduct exercises that evaluate how well their people and processes respond to an increasingly hostile cyber environment.

Furthermore, deploying AI without strict data governance multiplies internal risks. These models need dedicated incident response plans. For example, data poisoning corrupts training data to manipulate outputs. If security teams cannot trust the data, the AI becomes a liability.

AI cannot deliver reliable results without resilient data. Therefore, data resilience should become a foundation of responsible AI adoption.

Building a cyber recovery playbook

Government executives should treat data governance and recovery as strategic priorities rather than back-office IT functions.

Three actions can help agencies prepare for AI-enabled threats:

Audit and reduce the AI attack surface: Map data footprints. Before production, cyber defense and red teams should use threat modeling to evaluate deployment risks and secure underlying data integrity.
Mandate recovery testing, not just prevention: Perimeter defenses fail. True resilience requires testing the ability to restore operations after data compromise. Run adversarial simulations to ask:
- Can we recover quickly from an active directory compromise?
- Can we recover this key system 10 times in a day?
- How do we validate that our backup data has not been impacted?
Deploy autonomous, self-healing architecture: Long-term survival requires shifting funding toward autonomous cyber recovery capabilities. The goal is to build self-healing environments that can isolate threats, purge compromised data and maintain operations.

Closing the gap through responsible AI governance

Agencies should reference the National Institute of Standards and Technology AI Risk Management Framework to map, measure, manage and govern AI risks, as well as The Cybersecurity and Infrastructure Security Agency's (CISA) CI Fortify initiative. CI Fortify helps critical infrastructure operators isolate networks and maintain essential services during severe cyberattacks.

Cross-functional AI oversight boards should include Chief Information Officers, Chief Information Security Officers, legal counsel and data leaders. Joint oversight can reduce shadow AI, clarify accountability and ensure security teams are involved before new systems connect to production environments.

Agencies should also establish authorized development environments where teams can test AI systems without exposing operational networks or sensitive data.

Cybersecurity success should not be measured by the absence of detecting attacks. The more meaningful test is whether an agency can protect trusted data, sustain critical services and recover before disruption becomes mission failure.

Agencies that align IT, security, data and AI leadership can be prepared for the speed and scale of tomorrow’s AI threats.

Travis currently serves as the Public Sector CTO at Rubrik helping organizations become more cyber and data resilient. Prior to Rubrik, Travis held several leadership roles including the Chief Technology and Strategy Officer at BluVector, CTO at Tychon, Federal CTO at FireEye, a Principal at Intel Security/McAfee and Leader at the Defense Information Systems Agency (DISA).

The views expressed in this article are those of the author and do not necessarily reflect the official policy or position of Rubrik.

]]>

FDA considers doctor-like ‘competency-based’ tests for medical generative AI

Christian Robles — Thu, 20 Aug 2026 12:42:00 -0400

The Food and Drug Administration wants the public to weigh in on whether chatbots should pass “competency-based” tests — similar to exams doctors must take — before they are marketed as medical devices.

FDA’s medical device center “is considering a competency-based approach to premarket evaluation of GenAI-enabled devices that is also inspired, at a high level, by how human clinicians are evaluated and credentialed, but would be adapted for the technical, practical, and legal considerations applicable to the regulation of medical devices,“ according to a discussion draft the agency published Tuesday.

FDA would test the final, user-facing generative AI product rather than foundational models and subcomponents, the agency wrote. The test would specifically check if the generative AI product “demonstrates the clinical knowledge, analytic capabilities, safety behavior, communication, and generalizability to support reasonable assurance of safety and effectiveness of the device for its intended use,” the agency added. The tests could involve scoring rubrics and expert adjudication.

But the rigor of the tests would depend on the risk profile of a generative AI product, the FDA wrote. The product’s risk profile could take into account whether a product steers a user toward an action or provides information and the consequences of a user relying on a faulty generative AI output, according to a proposed FDA framework.

Testing alone might not be sufficient, so FDA could also collect real-world evidence to ensure a generative AI product is working as intended, according to the discussion paper.

FDA is not the first to consider a testing regime for generative AI. Over the past year, multiple academics have proposed policies requiring generative AI products to pass licensure exams like the ones doctors must pass to practice medicine. The American Medical Association, the largest U.S. doctors’ group, is also mulling whether AI licenses are the right path forward.

But FDA’s exploration of generative AI testing is notable because it’s the latest step the agency has taken to determine the best way to regulate the emerging technology.

The fact that large language models can constantly evolve and their outputs can vary wildly are among the reasons FDA has found it difficult to regulate generative AI. An FDA advisory committee met in 2024 and 2025 to help the agency begin addressing those regulatory challenges. FDA has also published several requests for information about AI and recently convened health AI companies to guide its thinking.

The agency is giving the public until Oct. 19 to comment on the generative AI discussion draft. Agency officials maintain that the paper is not a policy statement or representative of future draft regulations.

“FDA intends to lead boldly, but with transparency and genuine intellectual humility. With this paper, we are putting our ideas into the public square and inviting challenge and input from the broader ecosystem so that we can refine these concepts before translating them into policy. The guidance we ultimately develop will be stronger for our having done so,” wrote Rick Abramson, the director of FDA’s Digital Health Center of Excellence, on LinkedIn.

]]>

What Trump’s tech strategy means for the military, deterring China, and the future of AI

Patrick Tucker — Wed, 19 Aug 2026 17:52:00 -0400

The newest White House tech strategy pushes faster development of emerging technologies for the military, gives defense innovators more room to experiment, and will broaden the federal market for young defense tech startups. But it also doubles down on a particular approach to developing AI—one that favors a handful of well-connected U.S. tech companies at the expense of other innovative approaches. That could benefit China and slow the U.S. military from getting the tools commanders actually want.

Here’s a breakdown of the winners and losers.

Winners: swarms, deployed AI, faster military technology

The strategy puts a big emphasis on new, tech-driven approaches to warfare, particularly the use of drones and even drone swarms alongside manned and legacy assets. Specifically, it calls for “optimal combinations of lower-cost (and sometimes lower-tech or attritable) platforms that can be deployed in larger numbers and complement more limited numbers of sophisticated platforms.”

Over the last decade, efforts to field autonomous aircraft alongside fighter jets or ships, for instance, have been uneven at best—even when the Pentagon changed its talking points on the necessity for large numbers of low-cost drones—constrained by programs' internal buying policies and previous commitments to other programs' investments. The Replicator program provides a vivid example, hailed as an essential pathfinder but receiving only $1 billion in funding.

The new strategy sets specific “priority areas” for new military research and spending: undersea, space, and AI and autonomy. These priorities are the most relevant to “deterrence in the Indo-Pacific”—as in, preventing China from launching a major conflict. Within those priority areas, it lists “multi-agent systems and swarm intelligence” and various uses of autonomy, from robotics to command and control, as “critical.”

The strategy also takes square aim at policies and practices that slow down military buying of new technologies. Building off other executive orders, it pushes Pentagon buyers to bypass traditional acquisitions in favor of a “mix” of contract types, such as performance-based contracts and other transaction authorities, or OTAs. It also resets the tone for military purchasing toward “faster non-traditional approaches that may involve higher risk but offer high potential reward,” something that commanders, younger defense tech leaders, and even lawmakers have long pushed for.

Perhaps most importantly, it also takes steps to actually grow the market for younger defense tech players beyond just the military. It takes aim at foreign military sales rules and export controls that hobble the sale of much defense tech to allies. That will be especially important for newer defense companies trying to secure early-stage investment to survive. And it calls for other federal agencies to build “streamlined pathways” for smaller companies to at least get their foot in the door, even via partnerships that don’t offer young companies much more than access to federal infrastructure, such as “Cooperative Research and Development Agreements (CRADAs) and Agreements for Commercializing Technology (ACTs).”

Losers: open weights, small AI

While the strategy champions smaller, more innovative players in defense, it also weighs in on the debate about what the future of AI should look like and comes down on the side of Big Tech companies that are pushing a specific, energy-intensive, and deeply unpopular future of AI over emerging strategies favored increasingly by researchers. China will benefit from the oversight, Michael Schiffer, a partner at Scalare Advisors and former Deputy Assistant Secretary of Defense for East Asia, wrote on Tuesday for Just Security.

In its section on critical technologies for support, the strategy lists “Foundation models, including large language, multimodal, and world systems.” The section also includes niche tech areas like brain-computer interfaces but omits entirely open-weight models and open-source software development.

Here’s why that’s important:

Foundation models, such as today’s large language models from companies like OpenAI and Anthropic, represent just one potential method for building AI tools—one that relies heavily on pushing as much data through as much computational infrastructure as possible to achieve something that looks like “reasoning,” but that’s really just plain old probability calculation.

Anthropic co-founder Dario Amodei helped to transform that concept from a research effort into a massive endeavor to acquire computational resources and data as quickly as possible. Amodei explained it simply in a 2023 discussion with Dwarkesh Patel. “It turns out that raw scale—more compute and more data—drives capabilities far more powerfully than complex algorithmic inventions or hand-crafted architectural changes.”

A small handful of frontier AI labs, and their big cloud computer backers, are in a literal race for company survival because there’s only so much power, so many chips to continue to pursue “raw scale.” If, as Amodei says, just having more “more compute” and “more data” means having the best performing models, then whoever has the most of those resources can push out any competitor.

It’s no wonder the AI race has become a concentration of wealth and power, in just a handful of labs with their large cloud compute backers. No wonder, also, that public perception of AI has plummeted: just 18 percent of Americans believe it will be a positive force for the United States, one new poll found. But the foundation model approach does have its fans: large-scale U.S. cloud providers who have invested billions in foundation model labs.

The very way the strategy frames the issue plays to the idea that AI has one future and that winning the AI race or achieving dominance means favoring a handful of players. But it’s also a theme that plays out in many of the White House’s policies and executive orders around AI.

Meanwhile, alternative approaches to building AI are emerging. Rather than race to build more data centers and find more data to throw at the problem of AI, they use parameters that already exist that are freely available, called open weight models, as opposed to closed weights that are protected intellectual property. And they use those in conjunction with alternative architectures that make using those models more energy efficient. Many of these alternative approaches to building AI perform almost as well as what Anthropic and OpenAI are offering, and have the potential to do so at far lower energy costs.

Why it matters to the military

The finite amount of compute power, data, and good will when it comes to AI could become a strategic problem for the U.S. military. If public sentiment undermines congressional and financial support for research and development in the field, officials fear, the country might lose its AI edge to China, which has openly declared its intention to pull ahead.

In the meantime, frontier-AI models also create tactical and operational problems for the militaries that use them. Troops and military units in the field can’t count on the connectivity that tools based on large models need. And in a new report for the Carnegie Endowment for International Peace, Jake Steckler writes, “Ukraine’s computational architecture, consisting of Western cloud access, domestic data centers, and forward-deployed compute nodes, is already straining as it integrates more AI into targeting and coordination.”

Open-weight models don’t appear in the new strategy, though it does list niche and far-fetched concepts like brain-computer interfaces as “critical.” That’s a huge oversight and a potential gift to China, argues Schiffer.

“China’s advances in open-weight AI have exposed the limits of a U.S. strategy built too heavily on the idea of denying them access to American technology and American markets,” he said.

]]>

AI is already on the job, and Census is keeping count

John Breeden II — Wed, 19 Aug 2026 17:19:00 -0400

Most people probably associate the U.S. Census Bureau with the massive effort to count everyone in the country once every 10 years. But Census researchers are hardly sitting around waiting for the next decennial tally. The agency constantly surveys Americans about how they live, work and even play. The resulting information helps government agencies set policy, support programs and track how conditions across the country are changing.

And lately, that changing world includes a lot of artificial intelligence.

In March, the Census Bureau’s Household Trends and Outlook Pulse Survey asked U.S. workers whether they were using AI on the job and, perhaps more importantly, what they were actually doing with it. The results offer a detailed snapshot of how workers are using AI today.

About 55% of U.S. workers said they had used AI for at least one of 11 work-related tasks included in the survey. The most common applications were fairly ordinary. About 37% used AI to search for information or technical help, 32% used it to write communications, documentation or instructions and another 32% had AI help them generate ideas. About 31% used AI to interpret, translate or summarize information while 27% used it for administrative tasks.

In other words, much of workplace AI adoption does not seem to involve building autonomous agents or developing sophisticated machine learning models. People are using it to help with the kinds of things they already do every day.

Many also said it was saving them time. Among workers who had used AI during the previous week, 31% estimated that it saved them one to two hours. Another 15% said they saved three to four hours and 15% reported saving more than four hours.

AI did not save time for everyone. About 10% said it did not save them any time and 3% said using it actually required additional time to complete their work. So, the reported productivity benefits were not universal.

The Census findings cover U.S. workers generally, not government employees specifically. But they raise an interesting question for agencies trying to expand their own use of AI: As employees become more comfortable with the technology, what does practical adoption look like inside government?

I recently moderated a discussion about government AI adoption with government and industry officials that included Pamela McKnight, chief AI officer for Louisville Metro Government in Kentucky. Louisville has taken exactly that kind of approach, combining centralized governance with efforts to get AI capabilities into the hands of employees throughout the organization.

“There has to be an understanding that business will be done differently now,” McKnight said. “It’s not just about educating people about how to use an AI tool, but also identifying a use case within their area and then actually implementing that AI tool into their workstream.”

Rather than expecting a central AI team to discover every possible use case, Louisville has worked to identify employees who are interested in the technology, give them access to training and tools, and encourage those with both interest and aptitude to become AI leaders within their own areas of government.

Louisville's experience offers a government example to place alongside the broader workplace patterns Census measured. Its approach is to let employees identify potential use cases within their own areas, then pair that operational knowledge with access to AI tools, training and support. In Louisville, however, giving employees room to experiment does not mean creating an AI free-for-all, or deploying AI simply because the technology is available.

“You have to have guardrails in place, and we worked very closely with our cyber teams on those, so that is number one,” McKnight said. “And then our office is an enabler. We come along beside them and support and enable them as partners … we train them, we educate them and we show them how to specifically use those different AI tools.”

Another implementation question is which AI tool best fits a particular government task. At another discussion I recently moderated, state and local government officials warned that different AI systems have different strengths and weaknesses.

“Make sure you have the right AI as they are not all created equal and will be better at different things,” said Domain Information Security Officer for the State of Tennessee Brendan Taylor. “And even if you have OpenAI or Mythos, Gemini or whatever, make sure you are using their right product for what you are trying to do. Some are better at security or coding or productivity tasks like making reports. Make sure you are matching with the right solution.”

And while government technology leaders are working through those practical questions, the Census Bureau will continue doing what it does best: measuring what is actually happening.

The Household Trends and Outlook Pulse Survey is conducted every two months to provide timely information about changing social and economic conditions. In this case, it captured a workforce already experimenting with AI in very practical ways. Among workers who had used AI for at least one of the tasks Census measured, 24% said they used it every day during the previous week while another 46% had used it on at least one day.

The survey does not say whether employers should encourage more AI use or what tools they should deploy. But it does provide a useful snapshot of where things stand today: what workers are using AI for, how often they are turning to it and, in many cases, how much time they believe it is saving them.

And for government agencies trying to understand how AI is finding its way into everyday work, that may be one more Census count worth watching.

John Breeden II is an award-winning journalist and reviewer with over 20 years of experience covering technology. He is the CEO of the Tech Writers Bureau, a group that creates technological thought leadership content for organizations of all sizes. Twitter: @LabGuys

]]>

The watchdog gets watched: GAO’s hiring process length faces scrutiny

Sean Michael Newhouse — Wed, 19 Aug 2026 16:24:00 -0400

The Government Accountability Office is an independent legislative branch agency that reviews the effectiveness and efficiency of federal programs. For example, in recent weeks, GAO has issued reports finding that the State Department could be overspending on residences for overseas employees because certain housing standards haven’t been updated in more than three decades and that the Federal Emergency Management Agency cut staff without considering the impacts on disaster operations.

GAO’s own watchdog, however, determined in a report published on Monday that the oversight agency is taking longer to hire than other federal agencies and that there are issues with how it measures certain hiring data, which could impede efforts to shorten the time that it takes to recruit.

“The length of GAO’s hiring process increases the agency’s risk of not meeting its stated goal of hiring well-qualified candidates because prospective employees may accept other job opportunities while waiting for GAO to complete its hiring process,” the inspector general for the GAO wrote.

In fiscal 2024, the IG reported that GAO took an average of about 103 days to hire employees into roles that have been deemed mission critical occupations across government (e.g. information technology management). To compare, the agency’s internal hiring target is 98 to 101 days, and the Office of Personnel Management’s hiring goal for executive branch agencies is 80 days.

For instance, it took executive branch agencies that are part of an OPM dashboard an average of 72.1 days to hire for contracting roles in fiscal 2024 compared with 110.1 days for GAO to recruit for identical positions.

GAO’s chief human capital officer defended the hiring length in a letter attached to the report, noting that the agency “relies heavily on multiple rounds of interviews as an important part of our assessment process.” The official also said that GAO allows potential hires to negotiate their salaries, unlike other agencies, “but which may simultaneously add time to the process and may increase our ability to attract a broader applicant pool.”

The IG also reported that the agency inadvertently excluded 20, about 30%, of its fiscal 2024 mission-critical hires from time-to-hire data and that there’s a discrepancy between whether the hiring process starts when human capital staff consult with a hiring manager about a vacancy or when such consultation is complete.

“By using the consultation completion dates, [Human Capital Office]’s calculations would have undercounted the days spent on some hiring actions,” investigators wrote. “Further, HCO staff indicated that consultations often took longer than the allotted two days. However, because HCO did not record the start date for consultations, it cannot determine how long consultations took or accurately assess the length of its hiring process.”

GAO agreed with two of its IG’s recommendations: to periodically review hiring timelines and address inefficiencies and to update all internal documents to reflect the established target hiring time frames.

With respect to a recommendation to ensure all hiring actions are included in time-to-hire calculations, GAO countered that certain actions, such as annual promotions for analysts, shouldn’t be included. And regarding a recommendation about accurately documenting hiring dates, GAO suggested performing separate tracking of early actions in the hiring process (e.g. consultation with hiring manager).

Regardless, GAO officials said they would implement all of the recommendations by April 1, 2027.

The IG also noted that GAO in fiscal 2025 hired fewer than 10 entry-level employees and experienced a net loss of around 100 staffers because it didn’t backfill positions due to “budget constraints.”

The Office of Management and Budget has previously criticized GAO after the agency on several occasions determined that the administration violated rules around impoundments, which is when the executive branch delays or withholds congressionally approved spending.

For fiscal 2026, House Republicans proposed halving GAO’s spending level, but the final appropriations bill kept the agency’s funding flat.

]]>

Report calls for deterrence mechanisms, government participation in AI-biology security

Alexandra Kelley — Wed, 19 Aug 2026 14:15:00 -0400

Safely managing the use of artificial intelligence technologies in biological research demands advanced threat actor detection. One federal official says there is a need for earlier, additional public investments in these cybersecurity mechanisms.

A new report from the research nonprofit RAND addresses how the increased application of AI tools in biological research fields poses serious threats to global health and national security, particularly as model capabilities rapidly advance.

The study calls the development of a novel pathogen that is then released as a biological weapon the ultimate risk scenario in AI-enabled biotechnology, and it focuses on how to mitigate a hypothetical “high-consequence” biological incident.

Referencing the biological risk chain — a framework that labels the parts of a biological research field, such as genome synthesis, that are susceptible to an attack — the report's authors suggest layering risk mitigation techniques at several points within the chain to monitor and stop threats: model-layer safeguards, access and deployment controls, upstream governance and select physical chokepoint interventions.

Optimal detection systems should be able to identify suspicious activity within nodes of any given network handling sensitive biological data.

“By layering mitigations at multiple points along this chain, it is possible to extend the time required for malicious activity, deter potential nefarious activity or intentions, increase the operational effort necessary to proceed, and raise the likelihood that suspicious behavior is detected and disrupted before release,” the report says.

The authors assert that government support is “central” to the strategy’s effectiveness. While initial voluntary action from academic and industry entities has implemented secure access measures, the report notes that standardization of AI-enabled biological networks is still uneven.

“The government should establish minimum requirements for access controls, user verification, and audit logging that are applicable to AI models and [biological tools] that are above defined risk thresholds, and the government should do so while providing clear guidance on what constitutes adequate credentialing and monitoring for different capability levels,” the report reads.

A senior government AI official told Nextgov/FCW they agreed with this perspective, emphasizing the importance of investing early in risk mitigation strategies, especially in light of the debut and subsequent hacking activity of Anthropic’s advanced Mythos model.

“Implementing this strategy’s mitigations will require investments in new research, institutional adaptation, legal clarification and international coordination,” the senior official said. “We cannot wait for a ‘BioMythos’ moment.”

The senior official added that allocating more resources will be necessary for a robust risk prevention strategy, including additions to the federal workforce.

“The federal government just does not have enough experts left to handle this threat or even be able to coordinate among outside groups without significant immediate investment across multiple departments, including hiring, dedicated authorities and budget increases,” they said.

Security concerns surrounding AI in applied biological sciences and research have spiked following the independent actions of AI models from Anthropic and OpenAI in contained environments, resulting in breaches and harm to external online entities.

The Department of Homeland Security issued a report in 2024 documenting the threat potential of AI-enabled chemical and biological weapons, recommending, among other items, the need for specific federal guidance to govern how models tailored for biological applications are used.

]]>

DOJ charges 17 Iranians in cybertheft campaign

David DiMolfetta — Wed, 19 Aug 2026 12:13:00 -0400

Federal prosecutors have charged 17 Iranians affiliated with the Tehran-based Mabna Institute over an alleged hacking-for-hire operation that stole research and intellectual property from hundreds of universities and compromised email accounts belonging to U.S. government agencies and companies.

The 14-count superseding indictment, unsealed Tuesday, adds eight defendants to a case brought against nine other members of the firm in 2018. Prosecutors said the expanded charges expose a broader network that conducted cyber intrusions for Iran’s Islamic Revolutionary Guard Corps and other Iranian government and university clients.

The Mabna Institute targeted systems belonging to 144 U.S. universities, 178 universities abroad, at least 42 U.S. companies, 11 foreign companies and at least five federal and state government agencies since around 2013, according to the Justice Department.

The victims included the Labor Department, Federal Energy Regulatory Commission, the states of Hawaii and Indiana, the United Nations and UNICEF. The hackers also allegedly targeted HBO and unnamed technology firms and defense contractors.

Prosecutors said the university campaign targeted more than 100,000 professors’ accounts worldwide and successfully compromised approximately 8,000. The hackers used stolen credentials to access journals, dissertations, electronic books and other research spanning fields ranging from medicine and engineering to the social sciences.

All told, the group allegedly stole at least 31.5 terabytes of academic data and intellectual property. U.S. universities had spent more than $3.4 billion to procure or obtain access to the targeted materials, although prosecutors did not characterize that entire amount as a financial loss from the theft.

Some of the stolen material was later sold to customers in Iran through two websites. One offered academic resources taken from universities, while the other allowed customers to use compromised professors’ accounts to enter university library systems directly, according to the indictment.

Prosecutors said Mabna’s founders established the firm to help Iranian universities and research organizations obtain scientific resources from abroad. It employed or contracted with hackers who carried out phishing attacks, searched for vulnerable systems and traded credentials for compromised accounts.

The defendants face charges that include conspiracy to commit computer intrusions, wire fraud and aggravated identity theft. Some of the offenses carry maximum prison sentences of 20 years. The State Department is separately offering a reward of up to $10 million for information leading to the location of five of the defendants.

The charges come amid concerns about Iran’s use of cyber operations during the ongoing war.

Since U.S. and Israeli strikes began in February, suspected Iran-aligned groups have been linked to a disruptive attack against medical technology company Stryker, the compromise of FBI Director Kash Patel’s personal email and attacks against industrial-control systems across several U.S. sectors.

More than 30 Minnesota water systems and water infrastructure in several other states have been targeted in the last month in activity some officials suspect may be tied to Iran. U.S. officials previously told Nextgov/FCW that they expected Iranian and Iran-aligned cyber operations to continue regardless of whether fighting subsided.

]]>

Social Security expands electronic health record sharing to speed up disability claims adjudication

Christian Robles — Tue, 18 Aug 2026 16:00:00 -0400

The Social Security Administration is looking to speed up disability claims adjudication by allowing Americans to consent to their medical providers sending the agency digital copies of their health records through a data sharing superhighway.

In April, Epic — the largest electronic health record vendor for U.S. hospitals — announced that its health system customers are connected to SSA through the Trusted Exchange Framework and Common Agreement, or TEFCA. Through that superhighway, dozens of hospitals and clinics can send digital medical records to SSA, eliminating the need to fax documents to the agency and slashing disability claims processing times by up to 50%.

Jacksonville, Florida-based Baptist Health is among the first Epic customers to start sharing electronic health records with SSA through TEFCA.

Baptist Health has sent SSA several thousand electronic medical records since it started sharing data with the agency through TEFCA at the end of July, Aaron Miri, the health system’s chief digital and information officer, told Nextgov/FCW.

Because of TEFCA, Baptist Health has reduced the number of staff dedicated to processing medical records for SSA to essentially half a person, Miri said in an interview. Before TEFCA, three staffers were manually sending SSA medical records through fax machines and checking that the agency actually received the information, he said.

“We’re seeing time saved, we're seeing accuracy [of medical records] go up, we're seeing happy patients,” Miri said. “It's just positive, positive, positive.”

Dozens of Epic customers in California, Oklahoma, Washington, Arizona and other states have also connected to SSA through TEFCA.

Epic expects more than 550 hospitals and nearly 20,000 clinics will use TEFCA to exchange data with SSA by the end of the month, and all of its customers to eventually migrate to TEFCA, a company spokesperson told Nextgov/FCW.

SSA has connected to 84 health care entities and made 60,595 data requests through TEFCA as of August 13, according to an agency official familiar with its health information technology strategy.

SSA obtaining electronic medical records for disability claims adjudication is not new. The agency has received health information from medical providers through Carequality and eHealth Exchange — two other health data sharing superhighways — for years. But TEFCA has several advantages compared to those pathways.

Medical providers can use their existing connection to the TEFCA rather than starting new legal agreements to connect with the SSA, the Epic spokesperson said. They also no longer have to constantly provide SSA with an updated list of their facilities because TEFCA has a directory SSA can use to identify facilities, they added.

Over 65% of Epic customers are currently sharing records with SSA across TEFCA, Carequality and eHealth Exchange, they said.

But SSA is agnostic whether medical providers use TEFCA or another pathway to share data, so long as patient consent is part of the equation and they share adequate information for disability claims adjudication, the agency official said.

SSA is working with TEFCA Qualified Health Information Networks, or QHINs, besides Epic, which would give more medical providers the ability to send the agency digital health records, according to the agency official.

“eClinicalWorks and NetSmart are actively in various stages of development and testing with SSA today,” they clarified. SSA has a seat on the TEFCA governing council,Nextgov/FCW previously reported.

The Epic spokesperson said the company wants all medical providers — regardless of whether they use Epic software — to electronically send medical records to SSA. But that could prove difficult to achieve.

Many behavioral health, specialty and rural providers do not use electronic health records, meaning they continue to rely on manual record request processing, noted Jennifer Burdick, a divisional supervising attorney at Community Legal Services of Philadelphia. Department of Health and Human Services data backs up that assessment: thousands of substance use and mental health treatment facilities continue to use paper charts instead of software to maintain patient records.

Even though TEFCA promises to speed up claims adjudication for thousands of Americans, disability advocates have warned Americans are finding it hard to access SSA disability benefits. That’s in part because SSA is pushing online servicing and has introduced AI onto its phone lines, according to a Disability Rights Education & Defense Fund report published in March. SSA contested claims that disability benefits are becoming harder to access and touted a decline in its initial pending backlog in a previous statement to Nextgov/FCW.

]]>

The Russian hurdle in Trump’s new offensive cyber program

David DiMolfetta — Tue, 18 Aug 2026 15:26:00 -0400

President Donald Trump’s new plan to enlist private companies to help disrupt cybercriminals abroad may face a fundamental problem when it comes to Russia: distinguishing criminal hackers and state-backed operatives.

Russian intelligence services have long tolerated, protected or intermittently recruited financially-motivated hackers without exercising full control over them. That dynamic gives Moscow easier access to hacking talent, and it complicates a major carveout in Trump’s new directive that excludes groups part of or directed by a foreign government, experts and former U.S. officials say.

“The line between government control, government-affiliated and government-acknowledged is certainly blurry in Russia,” said Michael Daniel, president and CEO of the Cyber Threat Alliance and a former White House cybersecurity coordinator under President Barack Obama. “Determining the exact relationship between malicious actors and the Russian government has long been a challenge and is often impossible.”

A White House memorandum signed last week paves the way for vetted U.S. companies to conduct cyber surveillance and operations that manipulate, disrupt and destroy systems used by foreign criminal groups. Companies would work under contracts with the Justice Department and Department of Homeland Security, and every operation would require written approval.

The memo says eligible targets cannot be “an institutional part of a foreign government” or “wholly operated under a foreign government’s direction.” It then instructs officials to assume a group is not part of, or wholly controlled by, a foreign government unless “clear intelligence” establishes that connection.

Such intelligence collection from spy agencies like the National Security Agency and CIA can help firms determine targeting criteria, though it may not be enough for Russia’s ever-evolving cyber landscape.

“Russia’s cyber web is opaque and always shifting, blurring lines between government and cybercriminal, with no single rule for understanding each and every relationship,” said Justin Sherman, CEO of Global Cyber Strategies, a Washington, D.C.-based research and advisory firm.

Some of that ambiguity is intentional and allows the Kremlin to expand the pool of hackers it can covertly draw upon, Sherman said. It also reflects broader and pervasive corruption conditions inside Russia.

U.S. companies may have insights about those groups but lack the broader intelligence available to the government. Federal agencies, meanwhile, can only share or declassify so much, he said. “Private companies have critical insights in some ways and limited in others,” Sherman said. With an incomplete picture, “you’re bound to get it wrong some of the time.”

Simple indicators don’t necessarily settle attribution questions, he added. Ties with the FSB — Russia’s Federal Security Service that succeeded the Soviet Union’s KGB — do not by themselves prove that a criminal group is state-directed, nor does a Russian intelligence service’s use of tools developed by criminals establish continuous government control.

“Simple, bumper sticker ideas for deciding if a Russian cybercriminal is a state actor or not will often collapse in practice,” said Sherman.

Past cases illustrate how those relationships can work. In 2017, the DOJ charged two FSB officers with directing and protecting criminal hackers involved in the breach of Yahoo. Prosecutors said one of the hackers also conducted separate intrusions for personal profit. The Treasury Department has similarly said Maksim Yakubets, the alleged leader of the Evil Corp cybercrime organization, worked for the FSB and was tasked with projects on behalf of the Russian state while his organization carried out financially motivated attacks.

“The Russians haven’t been strangers to using private sector proxies to get what they want, as long as they’re not attacking them,” said Chris Painter, a former State Department cyber coordinator and White House cyber official. He questioned how a company could determine where a particular group falls along that continuum when the answer is often not immediately apparent, even for well-resourced governments.

The new policy is the latest step in an offensive cyber posture the administration has been building for the last year. Trump’s national cybersecurity strategy, released in March, called for “unprecedented coordination” between government and industry on offensive and defensive missions. It pledged to “unleash the private sector” by creating incentives for companies to identify and disrupt adversary networks.

But that set-up remained unclear for months. National Cyber Director Sean Cairncross said shortly after the strategy’s release that he was “not talking about private sector, industry or companies engaged in a cyber offensive campaign.” Instead, he described companies sharing information and capabilities that would enable the government to respond.

Some industry executives interviewed by Nextgov/FCW in April nevertheless predicted that the government would eventually contract with companies to support cyber operations. They also raised unresolved questions about legal authorities and how experts would define the fine line between creating obstacles for adversaries and hacking them offensively.

The administration moved further in May when its counterterrorism strategy explicitly identified offensive cyber operations as one of the tools Washington could use against threatening groups and the states that support them. That document offered scant details about how such operations would work.

Sherman argued that the U.S. shouldn’t let uncertainty about Russia’s cyber links stop it from taking action. The United States is overdue to reconsider assumptions about restraint and do more to counter Russia’s offensive cyber activity, he said, but a more aggressive posture does not make the underlying attribution decisions any easier.

Daniel said that ambiguity could give Washington leverage. Moscow could either let an operation against known criminals go unanswered or object and risk exposing its ties to them.

“The U.S. could use this formulation to call the Russians’ bluff — either acknowledge a relationship or let the group take the damage,” he said. But maintaining that bind would require the United States to choose its targets carefully. If a company inadvertently struck clandestine personnel from Moscow’s intelligence and security agencies, he added, the operation could create substantially greater consequences.

Cybercriminals routinely operate through hijacked servers and systems belonging to unwitting third parties, meaning companies carrying out hacks may have to distinguish targeted criminals from the infrastructure they have compromised.

“A lot is left to be determined on how the oversight is going to work, how the targeting is going to work,” Painter said. “That’s all supposed to be decided in 60 days,” he said, referring to the timeline the new policy must be developed by.

Painter said the best version of the program would be a tightly controlled process in which the government uses intelligence provided by companies and its own agencies to select legitimate targets. Companies would likely want written assurances that the government had approved a target and that their actions were covered by the program, he said.

The public directive does not explain how responsibility would be divided if a contractor followed an approved plan and the underlying intelligence proved wrong. Much of the operational process will also be governed by a classified annex.

Coordinating government decisions and private-sector activity in something approaching real time will itself be difficult, Daniel said.

“I don’t know of any analogous precedent,” he added.

A DHS spokesperson did not respond to questions about how the administration would distinguish Russian cybercrime groups from state-linked actors or who would bear responsibility if a target were misidentified.

The department “looks forward to implementing President Trump’s directive to combat cyber-enabled transnational crime threatening Americans and our businesses,” the spokesperson said.

“Last year alone, cyber-enabled Transnational Criminal Organizations stole more than $20 billion directly from Americans through rampant fraud, ransomware, and extortion schemes,” White House spokesperson Lauren Bis said when asked the same line of questions. “The Trump administration is mounting an aggressive campaign to disrupt these illicit syndicates and dismantle them at the source.”

The Justice and State departments did not provide comments. Russia’s embassy in Washington was also contacted.

The prospect of operations against pro-Russia cybercriminals carries a possible diplomatic dimension. Trump has continued direct engagement with Russian President Vladimir Putin and has sought to broker an end to the war in Ukraine. The two leaders agreed in July to maintain contact and speak again.

The administration has previously adjusted its cyber posture during negotiations with Moscow. Rep. Don Bacon, R-Neb., who chairs the House Armed Services Committee’s cyber panel, confirmed last year that Defense Secretary Pete Hegseth ordered a brief pause in U.S. Cyber Command operations against Russia as the administration pursued Ukraine talks.

The memorandum requires coordination with the State Department, suggesting diplomatic consequences will be considered before an operation is approved. It does not say publicly how officials would weigh disrupting a Russian cybercrime group against other negotiations with the Kremlin.

“If there’s a decision made that says we’re being careful with Russia now because we’re in some sensitive talks, that will play into it,” Painter said. Companies could also “paint the target on themselves” and face Russian retaliation if their involvement became public, he added. Even if a company is required to keep its role secret, it wouldn’t prevent an adversary or another party from exposing it.

“I understand what they’re trying to do, and if it has really robust oversight, and including targeting and review and oversight of what they’re doing, it might work fine,” Painter said. “But there’s so much of a chance of that going wrong.”

]]>

CISA contemplates whether to hire security software buying help

Ross Wilkers — Tue, 18 Aug 2026 12:56:00 -0400

The Cybersecurity and Infrastructure Security Agency is contemplating whether to hire a contractor to help manage its purchases of cybersecurity software and related tools via a single mechanism.

CISA currently acquires the tools through the Continuous Diagnostics and Mitigation program for protecting civilian government networks and Capacity Building, an arm of the agency that leads federal enterprise cyber governance efforts.

By launching this sources sought notice on Aug. 12, CISA is signaling the start of its evaluation of acquisition approaches that would support roughly $600 million in cyber software purchases per year.

The agency eventually wants that figure to grow to $6 billion per year over the entire contract’s lifecycle, should a contract be created.

CISA is working with the General Services Administration’s Assisted Acquisition Services team to evaluate the market research collected via the request for information. GSA AAS works with other agencies on planning, awarding and managing complex contracts.

In the new notice, CISA describes its desire to bring in a contractor that can aid the agency in managing its enterprise license and materials purchases. The contractor would also work with CISA’s CB team to implement a singular software buying management process and procurement support platforms.

CISA is undertaking this effort as part of its plans to transition away from the CDM program’s current approved product list to a new Cyber Product List and Technical Capability Catalog. The agency describes the latter two initiatives as its baselines for future enterprise cyber software procurements.

The RFI describes the scope of work as covering strategic buying advisory services, acquisition and procurement support, enterprise license management, software asset management, category management, vendor management and procurement analytics. These services would be provided in addition to the cyber tools themselves.

Other requirements include market analysis, historical spend analysis, pricing analysis, procurement strategy development, software category management, enterprise licensing recommendations, and development of cost savings metrics.

Responses to the RFI are due by 5 p.m. ET on Sept. 1.

]]>

Labor looks to AI to tackle accommodation requests from disabled employees

Jory Heckman — Tue, 18 Aug 2026 11:26:00 -0400

Faced with a backlog of accommodation requests from employees with disabilities and medical conditions, the Labor Department plans to use artificial intelligence to triage the workload.

An internal email obtained by Government Executive states that staff at the Civil Rights Center, which processes reasonable accommodation requests, currently must “engage substantively with every request regardless of completeness or likely outcome, limiting capacity and delaying determinations.”

“The process requires case-by-case judgment, but cases vary significantly in complexity and documentation quality: some are well-supported and straightforward, some require additional documentation, and some are not well-supported by the documentation provided,” the email states.

Labor Department employees told Government Executive that the department is facing a backlog of hundreds of RA requests. Several reported waiting months or, in some cases, a year or longer for for reviews, delays they say have hampered productivity at a department charged with protecting the workplace rights of workers with disabilities.

One DOL employee told Government Executive that he submitted a reasonable accommodation request in March 2025, supported by documentation from his primary care and a mental health providers, yet his case remains pending.

“It’s just kind of ironic to me that the Labor Department is violating policies that they set,” he said. “That’s the most frustrating part, to be honest, is that they can’t even abide by their own rules.”

Labor officials wrote in the internal memo that AI will “streamline” this work, citing four AI applications under review “to improve this process.”

The memo stresses these AI tools will play a supporting role in processing reasonable accommodations, and that Civil Rights Center employees “will continue to make decisions on necessary actions (including how and what is requested).”

The department expects that AI “could triage incoming requests by likely complexity and documentation sufficiency, allowing staff to prioritize effectively.” It adds that “AI-assisted document analysis” could flag incomplete or inconsistent medical documentation earlier in the process, “reducing back-and-forth and shortening timelines.”

The memo also states that “Al-enabled communication capability could engage requestors by providing updates, prompting requestors for additional information, and initiate follow-up to keep requests progressing without staff intervention.”

DOL also wrote that “Al could assess whether the accommodation requested is effective for the documented functional limitation,” or suggest “if other equally effective options exist.”

The Labor Department did not respond to a request for comment.

Jodi Hershey, a former reasonable accommodation specialist at the Federal Emergency Management Agency and the founder of the workplace accommodation firm EASE, LLC, said “the problem DOL is trying to solve is real” – many federal agencies don’t have the staff needed to keep up with the volume of incoming accommodation requests.

“I've seen employees wait a year or more for a decision on something they needed on day one — sometimes going without the very accommodation that lets them do their job. So I don't dismiss the impulse to find a faster path. The status quo is already failing disabled employees,” she said.

Hershey said AI “could genuinely help employees” navigate the reasonable accommodation process. “But that's very different from an agency using AI to take the human judgment out of the decision, and that's where this plan worries me,” she said.

“‘A human still makes the final call’ sounds reassuring, but if the AI has already sorted the case, flagged the documents, and suggested an answer, the human is grading the algorithm's homework. Real oversight means a person can actually reach a different conclusion — and that the employee knows a machine was ever involved,” she said.

Michael Fallings, managing partner at Tully Rinckey PLLC, a firm specializing in federal employment law, said he’s represented clients who have waited a year or longer for their agencies to process their reasonable accommodation requests.

While agencies may be tempted to use AI to speed up the work, Fallings warned that processing confidential medical records through AI tools may raise some legal risks.

“I’m sure the government’s thought process is … ‘We may not have the number of staff to handle it,’ but that does then create privacy issues for employees when you’re not using people, you’re using technology,” Fallings said.

Hershey said she was most concerned by the Labor Department’s plans to triage requests by “likely outcome” using AI.

“The employees with the thinnest documentation are often the ones with the least access to good healthcare, or to anyone who can help them navigate the paperwork. If the system quietly moves those cases to the back of the line, you've built a process that works best for the people who needed the least help to begin with,” she said.

"Hundreds of stories like this"

Aliyah Levin, president of the American Federation of Government Employees Local 2391, said the Labor Department is dealing with a backlog of “almost a thousand people that haven’t been accommodated.”

Many employees, she added, were hired for fully remote positions, or only had to report to the office twice per two-week pay period. President Donald Trump’s first-day memo required most federal employees to work onsite — but exempted employees with disabilities.

“This administration came in on day one and eliminated all of our workplace flexibilities — all of them — and said, ‘No matter what, regardless of who you are, whatever deal you’ve got, however you were hired, you now have to have your butt in the seat in an office that you’ve never reported to,’” Levin said.

Levin said one bargaining unit member, an Occupational Safety and Health Administration employee with a blood-pressure condition and vertigo, was hired as a remote worker, but later was told to start reporting to the office.

Levin said the department granted the OSHA employee a remote work accommodation last month, but “there’s hundreds and hundreds of stories like this” where employees are still waiting to hear back.

“It has a disparate impact on veterans, which have varying degrees of disability. It’s affecting them the most,” she said. “We have people who, for whatever reason, they have issues driving. They rarely drive, never drive, and they live in LA. Now they have to drive to get to work.”

Levin said “productivity has plummeted, in terms of implementing the mission.” Among their duties, DOL employees carry out wage theft investigations, workplace safety enforcement, benefits administration, labor statistics, mine safety inspections and veterans' employment programs.

Omar Algeciras, AFGE Local 2391 vice president and a wage and hour investigator, said that when DOL employees “cannot receive the accommodations they need, the public eventually feels the effects.”

"The Department of Labor enforces workplace laws across the country. Employees believe the Department should meet the same standard of fairness, accessibility, and accountability expected of every employer,” Algeciras said.

"Employees are not being protected"

Another Labor Department employee said she’s been waiting nine months for her reasonable accommodation request to be processed. She said she received an interim accommodation while her paperwork is under review, but it's scheduled to run out soon.

“I started reaching out three or four weeks ago, before the expiration, asking for an update – asking about the interactive process being started, and none of that has happened. I haven’t gotten an update,” she said.

The Labor Department, she added, is “supposed to be protecting American workers, and their employees are not being protected.”

A third employee requested a reasonable accommodation to work from home about half of the time in August 2025. The request was granted in February 2026, but he is still waiting for an ergonomic chair and standing desk.

“I am finally seeing some progress, but I just don’t know why a basic chair took so long to get,” he said.

The third Labor Department employee said the department saw a surge in reasonable accommodation requests following the Trump administration’s return-to-office mandate, but a shrinking human resources workforce has been unable to keep up.

“They’re just so backed up because a lot of people took the Fork [in the Road]. They really haven’t filled these positions to be able to process these reasonable accommodations,” the employee said. “People need them.”

The third employee said the HR worker assigned to process his reasonable accommodation request has changed three times so far.

A fourth employee, a combat veteran, said he requested a reasonable accommodation in January to manage his depression and anxiety, but is still waiting to hear back.

“We enforce workers’ protections, but then here I am, dealing with my own dilemma,” he said.

A fifth employee, a disabled veteran who was hired to a fully remote position in 2024, said she requested a reasonable accommodation in April 2025 after being asked to report to the office full-time.

“After adjusting to remote work and the benefits of how it positively impacted my mental health, it really set me in an anxiety spiral, where I was just like’ ‘This is uncomfortable,’” she said.

The employee said the department ultimately shelved her RA request, allowing her to continue working remotely because her husband is a 100% disabled veteran. The Trump administration has exempted spouses of 100% disabled veterans from its return-to-office mandate.

That accommodation may be short-lived. The employee said she received an offer for a new Labor Department job, but was told her military spouse RTO exemption would not apply. To avoid having to relocate across the country, the employee was advised to submit a new reasonable accommodation request, but was warned there are no guarantees it will be accepted.

“They’re telling me maybe if I reapplied for a reasonable accommodation under the new job … then it might be accepted. “I have to accept the new job and then apply for the reasonable accommodation,” the employee said. “But that’s really terrifying, because I am not in a position to move. My spouse has a well-established care team and everything in place. We can’t just pick that up and move.”

]]>

White House S&T strategy calls for new approaches to safeguard US research

Edward Graham — Mon, 17 Aug 2026 18:20:00 -0400

The Trump administration says the nation’s science and technology research ecosystem needs to embrace “novel security solutions” to ensure the U.S. maintains its global edge, according to a new document publicly released on Monday.

The National Security Science and Technology Strategy published by the White House Office of Science and Technology Policy outlines how the U.S. innovation sector should be leveraged and guarded to defend the country. The new document builds off last year’s National Security Strategy, which called, in part, for “protecting the competitiveness of the U.S. economy and bolstering the resilience of the American technology sector.”

To help safeguard the nation’s innovation sector from threats “that could impair U.S. economic and military strength and competitiveness,” the strategy calls for “approaches that protect without inhibiting the productivity and agility of the national security S&T enterprise.”

President Donald Trump previously moved to curtail illicit foreign interference in the nation’s research institutions, most notably through a January 2021 memo that sought to keep adversarial governments from exploiting U.S. science and technology research.

Lawmakers from both parties have also pushed legislation to limit Chinese involvement in federally-funded research projects, and the Pentagon similarly announced on Monday that it called for 30 U.S. academic institutions to review their ties with foreign entities.

But the strategy says research institutions need to take further steps to enhance their threat awareness, including conducting “automated research security vetting” of agency-funded research proposals and performing continuous monitoring of federally-supported projects.

It also calls for “bolstering counter-intelligence support to governmental and non-governmental research centers” — which would give researchers more immediate and timely insights into potential threats — and creating “risk-based review criteria and a repository of sharable information to enhance the efficiency of information collection and sharing among agencies.”

It noted, for instance, that the FBI-led Quantum Information Science and Technology Counterintelligence Protection Team “brings an interagency team of quantum experts and security professionals to fine-tune technology protection and security outreach activities for the quickly evolving quantum R&D community.”

Another section calls for “establishing cybersecurity guidelines for researchers and research institutions,” although it is sparse on the details of what this would look like. The National Science Foundation, for its part, has a research security policy framework that includes some cyber-specific guidance as part of its broader blueprint.

“Given the evolving nature of research security threats, security experts should embrace comprehensive, new, and novel security solutions, particularly where they can be crafted to address unique or nuanced requirements of specific technology fields,” the document said.

The strategy’s implementation section highlights the need to enhance K-12 and higher education training opportunities and bring more skilled talent into the federal workforce — an effort the Trump administration has been undertaking, in part, by prioritizing skills-based hiring over degree requirements.

Notably, however, the strategy references the need to attract more nonimmigrant tech workers to the U.S., which differs from the Trump administration’s prior stance that called for a more restrictive approach.

“The United States will further strengthen its workforce by attracting and retaining top-tier global talent in critical national security S&T fields,” the strategy says. “Agencies will collaborate on using existing authorities to recruit the exquisite talent necessary to ensure the national security S&T Enterprise leads the world in developing and applying these technologies.”

OSTP did not immediately respond to a request for comment about the strategy’s inclusion of the need to attract and retain global talent.

Last year’s National Security Strategy said, in part, that the U.S. “cannot allow meritocracy to be used as a justification to open America’s labor market to the world in the name of finding ‘global talent’ that undercuts American workers.”

Trump issued a proclamation in September 2025 that moved to restrict the number of H-1B visas, saying that the program has harmed American workers. The visas allow U.S. firms to temporarily hire foreign workers, with the tech industry notably using the program to attract nonimmigrant talent. The proclamation attempted to institute a $100,000 H-1B visa fee, although a district court has overturned that mandate.

In addition to calling for the nation’s innovation sector to embrace new security solutions, the strategy said the U.S. needs to speed up its pace of innovation, build up its domestic “technological resilience” and focus its science and technology ecosystem on “maintaining battlefield advantage, countering strategic threats to the homeland, and shaping the competition toward areas of U.S. strength.”

Nextgov/FCW Cyber Reporter David DiMolfetta contributed to this story.

]]>

National crisis and support hotline operations remained consistent despite staffing cuts, watchdog found

Christian Robles — Mon, 17 Aug 2026 15:55:00 -0400

Three hotlines offering Americans mental health crisis support saw the quality of their services remain consistent and their communications increase, even as the federal agencies managing them saw a slight decline in staff, according to a Government Accountability Office report published on Aug. 6.

The 988 Suicide & Crisis Lifeline, Veterans Crisis Line and National Maternal Mental Health Hotline generally saw calls, texts and chats increase in fiscal 2025 compared to fiscal 2024, the watchdog found.

Performance metrics remained largely consistent across the three hotlines amid the spike in communications, according to the report.

The 988 Lifeline saw answer rates — the percentage of contacts routed to crisis contact centers and answered by crisis counselors — hold steady for calls and texts throughout fiscal 2025 at levels comparable to past fiscal years, GAO found. The hotline also saw the average response times for calls remain steady throughout fiscal 2025 but did see large variations in the average response times for texts and chats.

The Veterans Crisis Line saw monthly answer rates for texts, chats and calls remain “high throughout [fiscal] 2025” — 89% to 99% — and “consistent with previous years,” according to GAO. The average response time for answered calls and texts in fiscal 2025 were 8.6 and 27.1 seconds, respectively, which are comparable to the averages from fiscal 2021 through 2024, the watchdog concluded.

The National Maternal Mental Health Hotline saw “high” monthly answer rates for calls and texts of 92% to 95% throughout fiscal 2025, the report found. Throughout the fiscal year, 89% to 94% of hotline contacts had wait times of less than 30 seconds, it added.

Staffing changes

The findings suggest that the performance of all three mental health support hotlines was largely insulated from the operational challenges other federal agencies faced following sweeping 2025 reductions in force.

The departments of Health and Human Services and Veterans Affairs lost some employees working on the hotlines under 2025 reductions in force, GAO found.

The 988 Lifeline coordinating office, for example, saw its headcount drop from 24 to 18 during fiscal 2025, according to GAO. The Substance Abuse and Mental Health Services Administration, which oversees the office, had not backfilled those positions as of February 2026.

But the watchdog cautioned that overall workforce changes for the 988 Lifeline are unknown because the number’s crisis responders are employed by over 200 local crisis contact centers. GAO did not tabulate workforce changes for these local facilities.

A May 2026 survey in JAMA, however, found that 71% of 988 Lifeline center leaders say their center is understaffed and almost 90% of them reported difficulty acquiring resources to hire staff.

“This study suggests that 988 Lifeline center staffing shortages could be associated with operational demands, underscoring the importance of increased investments to bolster the 988 Lifeline workforce,” the medical journal's survey concluded.

The Veterans Crisis Line saw its workforce remain largely steady, dropping to 1,149 in April 2026 from 1,162 in October 2024, according to the GAO report. Additionally, the hotline’s responder turnover rate hit 18% in fiscal 2025, which is on par with the 17% it saw in fiscal 2024, the report added.

HHS lost four of the six full-time employees dedicated to providing oversight of National Maternal Mental Health Hotline operations under an April 2025 reduction in force, the Health Resources and Services Administration told GAO. Those four positions have not been filled and staff from other programs have been fulfilling oversight responsibilities as of March 2026, the agency told GAO.

The watchdog did not assess whether the contractor that operates and staffs the hotline, Postpartum Support International, saw a change in staffing levels.

A spokesperson for Sen. Maggie Hassan, D-N.H., who requested the GAO report, did not return a request for comment by the time of publication.

]]>

CMMC Works. Now let’s sharpen it.

Katie Arrington — Mon, 17 Aug 2026 15:19:00 -0400

I built the Cybersecurity Maturity Model Certification because self-attestation was failing our war industrial base. Contractors could simply promise they were following basic cybersecurity practices, with no verification behind that promise. Our adversaries noticed that gap long before Washington did — and they have not eased up since. If anything, the opposite is true.

Nation-state actors and the ransomware crews they tolerate or direct are more aggressive, better funded, and faster than they were five years ago. This is not the moment to loosen the standard. The Defense Federal Acquisition Regulation Supplement requirements behind CMMC should not change, and I would not support it if they did.

But defending a program doesn't mean pretending it's perfectly aimed. Now that CMMC is a final rule moving into real contracts, it's the right time to ask: are we targeting it precisely enough? I don't think we are yet — and artificial intelligence, used correctly, can help fix that without touching the cybersecurity bar itself.

The problem is targeting, not the standard

CMMC's requirements hinge on controlled unclassified information. But CUI determinations across the war industrial base are inconsistent: Two subcontractors doing nearly identical work can end up with completely different assessments because the call still depends on manual judgment with incomplete visibility into how data actually flows down. Some small businesses get pushed into heavy assessment burdens for data that isn't really CUI. Others handling real, sensitive data slip through with a lighter requirement. Neither outcome helps national security; the first wastes compliance dollars, the second leaves real exposure unaddressed.

AI can do the first-pass sorting here — flagging likely CUI from contract language and statements of work and catching mismatches between what a prime contract designates and what actually flows down to subcontractors — far more consistently than today's patchwork of manual reviews. In this scenario, a human with contracting authority still makes the final call. But that human should be working from a much better starting point than we give them now.

Small business is the economy, not just the supply chain

Small businesses are 99.9% of American companies and employ nearly half the private workforce. And right now, they face threats most aren't equipped to handle: ransomware that can shut down operations overnight; AI-enabled fraud that's harder to spot every year, and a coming reckoning when quantum computing breaks today's standard encryption. The quantum threat is already real, since data harvested now can simply be decrypted later.

I'm glad the Small Business Administration is leaning into this. Its Cybersecurity for Small Business Pilot Program has done real work funding training through state partners. But training grants aren't capital, and no amount of counseling gets a small manufacturer through a ransomware recovery or a quantum-resistant encryption upgrade. Small businesses can't get favorable financing for cybersecurity the way they can for equipment because most lenders don't know how to underwrite it.

We need a dedicated SBA loan program for cybersecurity investment — open to every small business, not just those working with the Department of War — to fund things like multi-factor authentication rollouts, endpoint detection, incident response, and early migration toward quantum-resistant encryption, before it's an emergency instead of a plan.

Same mission, two fronts

Inside the war industrial base, use AI to make sure CUI calls and flow-down match reality. Outside it, give the broader small business economy the capital to defend itself against adversaries who are only getting more aggressive. I still believe unverified promises are not a security strategy. But precision and support aren't the enemies of security — they're what make it sustainable.

Sharpen how we target CMMC, and open the door for every small business to invest in its own war footing. That's not lowering the bar. That's making sure the bar is doing its job.

Katie Arrington is a former South Carolina state legislator and cybersecurity executive who served as DoD CISO for Acquisition and Sustainment starting in 2019, and later returned as DoD CISO/PTDO DoD CIO under the second Trump administration. She spearheaded the Pentagon’s initial efforts to create the CMMC program for defense contractors beginning in 2019, driven by a conviction that contractors needed to actually prove — not just self-attest to — their cybersecurity compliance in order to protect sensitive defense data from adversaries. Her commitment to the program has been described as stemming from a deeply personal mission to secure the Defense Industrial Base from cyber threats that jeopardize national security.

]]>

L3Harris promotes Mehta to CEO in abrupt leadership change

Ross Wilkers — Mon, 17 Aug 2026 09:31:47 -0400

L3Harris Technologies’ board of directors has promoted Sam Mehta to chief executive from his former role as president of space and mission systems in an abrupt leadership change announced Monday.

Chris Kubasik, L3Harris’ CEO since June 2021, stepped down from that position and his other roles as chairman and member of the board of directors effective immediately.

L3Harris said the board determined to enter into a separation agreement with Kubasik after an investigation found conduct by him that was “not consistent with the values of the company as outlined in its code of conduct.” The company added the alleged conduct was not related to its financial reporting, controls, customer relationships or operational performance.

Mehta joined L3Harris in 2023 as president of the communications segment, then added the additional title of president of the space and mission systems segment at the start of this year.

This transition at the very top of L3Harris is taking place in a year where the company announced its intentions to take the missile solutions segment public following a $1 billion investment from the Defense Department.

L3Harris originally eyed the second half of this year for the initial public offering, but Kubasik told investors in July that the IPO is being delayed until at least mid-2027 because of market conditions the company sees as not reflecting the value of Mission Solutions.

Kubasik’s tenure as CEO started with the completion of the integration of L3 Technologies and Harris Corp. following their merger in 2019, and includes the $4.7 billion acquisition of Aerojet Rocketdyne in 2023.

The pending Missile Solutions IPO is not the only move L3Harris has undertaken with respect to its space business. L3Harris closed the sale of a 60% stake in the space propulsion and power systems business this month to AE Industrial Partners, while retaining a 40% stake.

In addition to Mehta’s promotion, Lauren Barnes has moved up to be president of the space and mission systems segment from her prior role as president of spectrum superiority. Christopher Aebli, formerly president of mission critical communications, was elevated to president of the communications and spectrum dominance.

Lewis Hay III, a member of the L3Harris and a predecessor board since 2002, was elected chairman after previously holding the title of lead independent director.

]]>

As warfare becomes engineering, the era of the digital mercenary dawns

Patrick Tucker — Fri, 14 Aug 2026 20:28:52 -0400

Private cyber firms will be allowed to take action against foreign threats under a new White House policy, another step into a future where tech developers are ever more closely entwined with military operations, which now evolve faster than governments can keep up.

Under the policy, announced Wednesday, the U.S. government will pay private cybersecurity companies to “manipulate,” “degrade,” “disrupt,” and “destroy” foreign adversary computer networks. The U.S. government historically reserves the right to take those sorts of actions, although they increasingly do so with help from front-line private workers.

The companies will undergo vetting, be supervised by the departments of Justice and Homeland Security, and be forbidden to take actions that could “result in the loss of life or serious injury,” according to the presidential memo.

“The United States just revived privateering for the digital age,” wrote Jeff Gray, who led training for DHS’s emergency response team and currently leads incident response training with the Cybersecurity and Infrastructure Security Agency.

The phrase recalls the 17th and 18th centuries, when governments issued letters of marque that allowed swashbuckling sea captains to attack foreign merchant ships. That official authorization is what distinguished men like Captain Kidd and Henry Morgan as “privateers,” not pirates. But when they lost that marque, many, like Kidd, went on to be pirates anyway.

Gray acknowledges that the term isn’t a perfect fit; for one thing, letters of marque are granted by Congress, not the president. Nevertheless, he says, “The government is authorizing private actors to conduct offensive cyber operations on its behalf, under its control. That's privateering.”

The memo says hiring private hackers is only logical: “American businesses’ innovative capabilities have historically been underutilized” to “secure a critical offensive cyber advantage for the United States.”

Russia has been doing this sort of thing for years: enlisting, or coercing, private companies and groups to carry out cyberattacks against Western targets.

One cybersecurity exec said the policy makes sense, especially as AI gives adversaries more tools.

“There will be more cyberattacks for sure, so I do think you want to expand the takedown activity as well,” said the executive, a founder of a prominent U.S. cybersecurity firm that works with the U.S. government.

AI-assisted cyberattacks rose 89 percent in 2025, according to a February report from cybersecurity company CrowdStrike.

Gray also described the strategy as “strategically sound.” But he expects it to provoke a short-term increase in attacks, and over a longer timeframe, to cause adversaries to shift tactics, accelerate operations, and gain additional “cover” to hide their operations.

Finally, Gray noted that law-enforcement agencies have long hired private firms for this sort of work, particularly taking down botnets. “The work is still the same. But the environment just got more complicated,” he said.

The cyber exec agreed. “Instead of a law-enforcement person pushing the button, it will be a private-sector person,” said the company founder. “I expect every Israeli cyber startup to jump at the chance.”

Cyberops and physical war

The policy is the latest indication that software weapons are evolving to be as crucial as hardware on the modern battlefield—and that is putting private coders and weapon designers closer to real-world operations. In Ukraine, for example, engineers with drone maker Shield AI and other contractors work closely with soldiers, sometimes under fire, to modify weapons based on digital attacks.

The job of fighting is, more and more, becoming a job of engineering, said one former senior defense official we spoke to in 2025, just after Donald Trump returned to office. The official said that the Pentagon’s new leaders were considering a plan to let drone makers and other tech companies conduct operations under company-owned, company-operated agreements.

The idea was not without precedent. SpaceX operates the Starlink satellites that connect U.S. troops, rather than allowing U.S. personnel to do so. And under the first Trump administration, the Pentagon paid Anduril to maintain and update drones in the field, deploying along with special operations forces.

The official said putting engineers in the field is essential to getting new capabilities to the front lines faster.

“A lot of these technologies,” they said, are “super exquisite, they're fragile, they're very technical. The people that built them are the ones that know how they work.”

Having the weapons’ makers observe and even operate their products in the field reduced red tape in getting new designs approved, changed, or deployed.

The official last year acknowledged that most defense firms don’t operate that way, and federal law outlines boundaries on what defense contractors can and can’t do (engaging in combat is in the "can’t do" column). But ultimately, they said, “If you want capability in 2027 the only way you're going to get is if this happens.”

In April, CENTCOM hired Shield AI to provide intelligence, surveillance, and reconnaissance to U.S. forces with its V-BAT drone, under a contractor-owned, contractor-operated arrangement.

Brandon Tseng, Shield AI’s co-founder, said of the agreement: “We aren’t just bringing the V-BAT product and service to the Navy; we’re bringing a world-class team with a wealth of operational experience and the ability to produce undeniable outcomes for our warfighters.”

]]>

Tech Bills of the Week: Leveraging AI for environmental evaluations; crafting a report on China’s AI ecosystem; and more

Alexandra Kelley and Edward Graham — Fri, 14 Aug 2026 18:31:00 -0400

Using AI for environmental evaluations near military sites

A bill introduced on Aug. 6 aims to fortify the U.S. military by improving the management of natural resources near military installations with the help of AI technology.

The Military Readiness Through Resilient Lands Act — introduced by Reps. George Whitesides, D-Calif., Chrissy Houlahan, D-Pa., and Mike Haridopolos, R-Fla. — seeks to amend the Sikes Act of 1960 to modernize the Pentagon’s conservation efforts for natural resources located on military bases.

The bill would support the conservation provisions stipulated in the Sikes Act by mandating the Department of Defense to assess and, as deemed appropriate, apply AI and other technologies to help develop and maintain site-specific conservation goals and metrics. AI would be used to support the “assessment of natural resources and ecosystem services as relevant to mission readiness, climate resilience, or community safety on military installations.”

In applying advanced technologies like AI to evaluate the status of the environment and natural resources near military bases, Defense can then forecast and prevent natural disasters from impeding national security operations.

“As our nation’s military continues to protect our country, it is imperative that our bases and installations are prepared for potential threats, including natural disasters,” said Whitesides in a press release. “If a wildfire strikes a military installation, like we saw in Camp Pendleton earlier this year, it could shut down its operations, putting all of us at risk. Through the use of advanced technology and cutting-edge monitoring systems, our military can better understand the natural resources that exist on their installations, and take preventative actions to protect the installation from threats like natural disasters.”

Monitoring AI in China

Sen. Jon Husted, R-Ohio, introduced a measure on Aug. 7 that seeks to provide a closer look at China’s AI stack manufacturing sector via an annual review.

The bill, the China AI Power Report Act, tasks the secretaries of the departments of Commerce and State with spearheading an annual report on what China’s government is doing to further advance its AI stack, specifically focusing on its supply chain operations.

The state of semiconductor chips being manufactured and employed in China is the starring topic of the report. The report would assess details like the processing power and efficiency of AI computing chips, corresponding software, chip manufacturing costs, and other chip design and sector details.

“America must continue to compete and win in the technology race, but we know that communist China’s strategy has never been to compete, but to steal and exploit. This bipartisan package would strengthen our understanding of China’s action, improve enforcement and protect American companies, workers and innovations from Chinese espionage,” Husted said in a press release.

The inaugural report would be due 180 days following the bill’s ratification, and then annually for three years. Select congressional committees would receive the report at an unclassified level.

Limiting adversaries’ access to national labs

Rep. Pat Harrigan, R-N.C., introduced a proposal on Friday that seeks to restrict foreign nationals’ access to U.S. national laboratories if the individuals are from China, Russia, Iran, North Korea or Cuba.

The bill would prohibit covered foreign nationals from accessing national lab “facilities, information, or technology as visitors or long-term assignees.” The Energy Department would also be given the authority to grant waivers after consulting with agency intelligence officials and FBI counterintelligence officials in instances “when the benefits to the United States outweigh the national security and economic risks.”

The measure, the Guarding American Technology from Exploitation — or GATE — Act, is a House companion to a bill introduced by Sen. Tom Cotton, R-Ark., in March.

“China, Russia, Iran, and North Korea have spent years targeting American innovation to close the technological gap with the United States,” Harrigan said in a statement. “The GATE Act puts a clear safeguard around critical American research while preserving access when our own counterintelligence professionals determine it serves the national interest.”

Shoring up the cybersecurity of U.S. water infrastructure

Sens. Adam Schiff, D-Calif., and Amy Klobuchar, D-Minn., rolled out a measure on Monday that looks to enhance the cyber defenses of critical U.S. water infrastructure services by empowering the Environmental Protection Agency to conduct cybersecurity assessments of public water systems, and then require corrective steps when significant vulnerabilities are identified in the services.

The EPA would also “establish tiered cybersecurity standards” in consultation with the Cybersecurity and Infrastructure Security Agency, the National Institute of Standards and Technology and other state and local partners and stakeholders.

Large drinking water and wastewater systems would be directed to evaluate cyber risks as part of their current risk and reliance planning measures, and an additional $300 million would be added annually to the Drinking Water and Clean Water State Revolving Funds dedicated to cyber enhancements within critical wastewater services.

“Every American depends on safe, reliable drinking water, yet recent events have exposed just how vulnerable our water systems remain to cyberattacks by foreign adversaries and criminal entities,” Schiff said in a statement. “These threats are not hypothetical—they are happening right now. This legislation gives EPA the tools it needs to protect this critical infrastructure while providing the resources that local water and wastewater systems need to strengthen their cybersecurity without passing the cost on to ratepayers.”

The proposal’s unveiling comes after a wave of cyberattacks linked to Iranian hackers affected more than 30 water utilities in Minnesota last month.

]]>

Gartner has confirmed the battle for authority is happening right now. Is your agency ready for the aftermath?

Brian Chidester — Fri, 14 Aug 2026 15:40:00 -0400

For decades, government agencies have measured digital success by a familiar yardstick: rank on Google, drive clicks to the .gov site and let citizens navigate from there. That yardstick is breaking. Citizens are no longer starting their search for information with a list of blue links; they're starting it with a single AI-generated answer, and in a growing number of cases, they never click through to a source at all.

Gartner has now put numbers behind what many of us have felt building for the past two years. The firm predicts that by 2028, an organization’s organic search traffic will fall by 50% or more as individuals embrace generative AI-powered search, and separately forecasts a 25% decline in traditional search engine volume by the end of this year as AI chatbots and virtual agents take over as answer engines. That's not just a trend. For government, it's a governance problem.

The authority vacuum

When a citizen asks ChatGPT, Gemini or Perplexity how to replace a lost SNAP card or appeal a benefits denial, the AI model doesn't necessarily reach for the agency's website first. It reaches for whatever content it has learned to trust as authoritative. If the agency hasn't structured its content to be clearly sourced, current and machine-readable, the model may pull from a third-party aggregator monetizing confusion or a source from the wrong jurisdiction entirely.

This is the "battle for authority." It isn't a battle for rankings anymore. It's a battle over who gets to be the voice an AI system trusts enough to cite. Right now, most government agencies aren't even aware they're in it.

Recent research on AI-augmented search behavior found that roughly 60% of internet searches now end without a click, because users are satisfied with the AI-generated summary and feel no need to visit the source. For a private brand, that's a conversion problem. For a government agency, it's a legitimacy problem — because if an AI system is quietly becoming the primary interface between citizens and their government, and the agency has no visibility into what that system is telling people, the agency has effectively lost control of its own message.

Three forces are compounding the problem for public sector organizations specifically:

The information ecosystem citizens rely on is already under strain. Gartner's broader research on citizen trust found that a majority of people believe the quality of online information sources has degraded in recent years, driven by misinformation, low-quality content and bot-generated noise. Citizens are being pushed toward AI assistants as a shortcut past that noise — which only raises the stakes for making sure those assistants are pulling from the right government source when they answer.
AI models reward structure, not just accuracy. Being factually correct is no longer sufficient. Generative engines favor content that is written in plain, question-and-answer language, organized with clear headings and short paragraphs, dated and refreshed regularly and backed by verifiable citations and consistent cross-references. A perfectly accurate policy page buried in a dense PDF with no update date is far less likely to be surfaced than a clearly structured FAQ — even if the FAQ is hosted by a third party with a looser relationship to the truth.
Small visibility gaps compound into large trust gaps. Emerging data suggests that even modest improvements in AI citation share can translate into disproportionate downstream effects — a meaningful increase in how often an agency is cited by generative engines has been associated with a substantially larger lift in actual service enrollment. The inverse is just as true: agencies that lose citation share don't just lose traffic, but they also lose the ability to correct misinformation before it reaches citizens who need accurate, time-sensitive guidance on benefits, health alerts or public safety.

What the aftermath looks like

If agencies don't act, the consequences won't be abstract. They'll show up as citizens receiving incorrect eligibility guidance synthesized from outdated or out-of-jurisdiction sources; a widening trust gap as AI-cited misinformation goes unanswered because no one at the agency is monitoring what AI platforms are actually saying; wasted resources as digital teams keep optimizing for a search paradigm that's shrinking, while ignoring the one that's growing; and, over time, a slow transfer of "official voice" status from the agency itself to whichever aggregator, advocacy group or commercial site the AI models learn to trust instead.

None of this is hypothetical anxiety about the future. It's a description of where the traffic and trust data already point.

Building authority before the vacuum fills itself

The good news is that authority in the GEO era is buildable. It's an evidence architecture, not a mystery. Agencies that want to remain the trusted source need to treat AI visibility as seriously as they've historically treated public affairs and constituent communications, which means monitoring what AI platforms are saying about their programs and policies, not just what's ranking on Google; restructuring core content — FAQs, benefit explainers and safety notices — into the answer-first, clearly dated, plainly written format that generative engines are built to extract and cite; and closing the loop between visibility and outcomes, connecting AI citation data to actual service utilization so digital teams can prioritize the highest-impact pages first.

This is precisely the gap we are trying to close for government digital teams — giving agencies visibility into how they're represented across AI platforms, insight into how AI bots are actually using their content and prescriptive, actionable recommendations for closing the authority gap before a citizen encounters bad information instead of good.

The mandate is already here

Mandates like the 21st Century IDEA and a growing body of state and local digital service regulations already require agencies to deliver clear, accessible information to the public. Those requirements didn't anticipate a world where the primary access point to that information is a generative AI model rather than a webpage — but the underlying obligation hasn't changed. Accessibility and accuracy now have to be engineered for machines that summarize on the public's behalf, not just for the humans who used to click through.

The battle for authority Gartner is describing isn't coming; it's underway. Agencies that recognize this now — and start building the structured, monitored, machine-readable authority that AI platforms are built to trust — will be the ones citizens can still find, and still believe, when they ask an AI assistant instead of a search engine. The ones that wait will find out the hard way what happens when someone else becomes the voice of their agency instead.

Brian Chidester is the Head of Industry Strategy for the Public Sector at Adobe.

]]>

Blue states seek to stop DHS from accessing commercial driver's license database

Christian Robles — Fri, 14 Aug 2026 14:41:00 -0400

A group of 22 states is asking a federal court to invalidate a subpoena that would give the Department of Homeland Security access to about 17 million commercial driver's license records.

The coalition argues DHS has no legal authority to demand the truck drivers’ license records and would jeopardize drivers’ privacy if they receive them, according to a lawsuit filed Thursday. The group also alleges the demand is part of a pattern of DHS seeking personally identifiable records to build a “nationwide surveillance system.”

“Once again, the Trump administration is trying to unlawfully seize Marylanders' personal data with no legitimate purpose, no safeguards to protect it, and no warning to the public or consultation with the states,” said Maryland Attorney General Anthony Brown in a press release.

The administration previously sought to turn over Medicaid, Supplemental Nutrition Assistance Program and other state data to immigration enforcement authorities.

The federal government is seeking data going back five years from the Commercial Drivers’ License Information System, or CDLIS — including names, dates of birth, license numbers and Social Security numbers — according to the lawsuit filed in the District Court for the Eastern District of Virginia.

The Federal Motor Carrier Safety Administration, or FMCSA, first asked the American Association of Motor Vehicle Administrators, or AAMVA, for the commercial drivers’ data on June 25, the lawsuit says. The AAMVA raised concerns with the request in a June 30 letter, noting that the FMCSA is not entitled to CDLIS records and it must adhere to U.S. privacy laws.

At an in-person July 23 meeting, FMCSA allegedly threatened to withhold all of AAMVA’s federal grants and contracts and file litigation if it did not inform the Department of Transportation by the next day whether it would hand over CDLIS records, the lawsuit says. The next day, the association told FMCSA it would disclose requested information by or around August 17, the filing continued.

But several days later, DHS served a subpoena asking for the same CDLIS records as FMCSA. That subpoena was withdrawn, but a new one was issued on Tuesday and gave AAMVA until this Monday to respond, according to a court filing.

On Friday, a federal judge ordered an administrative stay, punting the deadline for AAMVA to respond to DHS’ demand to an unknown date. The judge also scheduled a hearing on whether to invalidate the subpoena for this coming Thursday.

The latest subpoena implies DHS is seeking CDLIS data to investigate “illegal practices in commercial driver’s license schools” and conduct immigration enforcement.

“It is incredibly dangerous for illegal aliens, who often don’t know our traffic laws or even English, to be operating vehicles on America’s roads," DHS said in a statement. "These sanctuary politicians must stop giving illegal aliens driver’s licenses before another American gets killed."

AAMVA did not return a request for comment by publication.

Editor's note: This article has been updated to include a statement from DHS.

]]>