Nextgov/FCW - All Content

Tech bills of the week: Creating a Congressional Office of Technology; Enhancing data center transparency; and more

Edward Graham — Fri, 30 Oct 2026 17:57:00 -0400

Standing up a Congressional Office of Technology

House lawmakers introduced a bipartisan bill on Thursday to establish an independent Congressional Office of Technology that can provide the legislative branch with unbiased information about the impacts of emerging technologies, including artificial intelligence.

The legislation — introduced by Reps. Mark Takano, D-Calif., Sean Casten, D-Ill., Bill Foster, D-Ill., Don Beyer, D-Va., and Jay Obernolte, R-Calif. — would revise and upgrade what was once the congressional Office of Technology Assessment, which operated from 1974 to 1995.

“Congress cannot continue flying blind into the future. We must have an office of independent experts as we face important decisions to guide emerging technology,” Takano said in a statement. “Establishing the Congressional Office of Technology will enable Members of Congress to work with experts across disciplines, receive informed and unbiased feedback on legislation, and gain detailed understandings of the issues that will impact our nation. I am proud to lead this bipartisan legislation alongside my colleagues who share my commitment to independent scientific expertise.”

Requiring disclosures about data center development

Legislation introduced by Rep. Eugene Vindman, D-Va., on Thursday looks to enhance transparency around data center development by requiring involved companies to publicly disclose information on their ownership, resource consumption and the potential impact of the facilities on the surrounding communities.

The proposal would require that data center operators behind current and proposed facilities submit this information to the Energy Department’s Energy Information Administration for collection and reporting. Companies would have to report on questions about their expected energy and water usage, if they have signed non-disclosure agreements with government officials and whether their facilities are located “within 1,000 feet of a school, national park, hospital, or home.”

Operators who fail to disclose the required information or submit misleading or incomplete responses would be subjected to fines of as much as $1 million per day.

“As data centers continue to expand across Virginia, the public needs clear, reliable information on how they impact local communities, infrastructure, and household costs,” Vindman said in a statement. “My legislation will shine a light on this rapidly growing industry, hold companies accountable, and give Virginians the information they need to make informed decisions about data center development.”

Enhancing the cybersecurity of cloud environments

Rep. Rich McCormick, R-Ga., introduced a measure on Monday that calls for the National Institute of Standards and Technology to develop “new standards, methodologies, and recommendations” to help strengthen the cybersecurity of cloud-based infrastructure.

The proposal calls, in part, for upgrading FedRAMP “to align with new cloud security standards and strengthen cybersecurity disclosures for federal cloud providers.” The bill also encourages the use of artificial intelligence tools to detect unusual cyber activity within cloud environments and would establish a voluntary “Cloud Security Certification Program” through accredited testing labs.

“From our financial information and medical records to our national security and critical infrastructure, our most sensitive information is stored and accessed through cloud-based systems,” McCormick said in a statement. “Our adversaries, including China, are constantly looking for ways to exploit vulnerabilities, launch cyberattacks, and steal sensitive American information. We cannot afford to leave Americans exposed to these threats.”

Improving the nation’s emergency alert system

Rep. Kevin Mullin, D-Calif., introduced a measure on Thursday that looks to enhance the nation’s emergency alert system by directing the Federal Communications Commission to craft “metrics, goals, and minimum requirements” for wireless emergency alerts.

The required performance metrics include tracking speed, coverage and geographic targeting of issued alerts. The FCC would also be directed to assess the use of enhanced capabilities including “more precise geotargeting, longer alert messages, multilingual alerts, and device compatibility,” as well as require that wireless providers better label emergency alerts.

Mullin said he introduced the legislation “because the federal government needs to improve the Wireless Emergency Alert system so that communities can trust they’ll receive timely and accurate information when they need it most.”

Combatting human traffickers’ use of AI

Rep. James Gallagher, R-Calif., rolled out legislation on Thursday that directs the State Department to evaluate “whether its Office to Monitor and Combat Trafficking in Persons has access to the specialized technical expertise necessary to identify and respond to these evolving threats.”

The proposal comes after officials have raised concerns about the role artificial intelligence can play in driving human trafficking, including in a 2025 State report that warned that emerging technologies can be used to automate and expand victim grooming.

“Human traffickers are using new technology to prey on innocent children, and we cannot allow the federal government to fall behind,” Gallagher said in a statement, adding that “we need to make sure the people responsible for combating trafficking have the expertise necessary to recognize these threats and help stop them.”

]]>

VA professional association asks Congress ‘to pause further deployments’ of new EHR

Edward Graham — Fri, 30 Oct 2026 17:24:00 -0400

A leading association representing physicians and dentists across the Department of Veterans Affairs’ network of almost 170 medical facilities is calling on lawmakers to halt additional rollouts of the agency’s new Oracle Health electronic health record system until independent evaluations of the software can be conducted.

In an Oct. 12-dated letter, the National Association of Veteran Affairs Physicians and Dentists asked Congress “to pause further deployments of the Oracle electronic health record (EHR) while protecting funding for patient care and safety at the sites already converted, and to allow deployments to resume only when VA has demonstrated that the system can support safe, reliable care.”

The request from the professional association — which says it represents the interests of approximately 20,000 physicians and dentists — was sent to the chairs and ranking members of the House and the Senate Veterans’ Affairs, Appropriations, Oversight and Government Reform and Homeland Security and Governmental Affairs panels.

Nineteen VA medical sites now use the new EHR system, with the agency completing its most recent go-lives at two facilities in Ohio and Alaska on Saturday. The modernization project is part of a broader federal push to deploy a single interoperable federal EHR system across agencies like the Defense Department, Coast Guard and National Oceanic and Atmospheric Administration, although VA’s component of the initiative has been slowed by roadblocks.

After facing a host of technical and usability challenges, cost overruns and patient safety concerns since the first modernized software rollout in 2020, VA paused most deployments of the Oracle Health EHR system in April 2023 to address the numerous issues plaguing the modernization project.

The Biden administration announced plans in December 2024 to resume deployments of the new software at four Michigan-based VA medical facilities in 2026. VA Secretary Doug Collins subsequently raised the total number of site rollouts this year to 13.

The missive, which NAVAPD disclosed on Thursday, comes on the heels of increased lawmaker scrutiny about the cost and future of VA’s massive modernization project, even as the agency has touted its successful resumption of EHR deployments.

VA initially signed a $10 billion contract with Cerner in May 2018 to modernize its legacy health record system, known as the Veterans Health Information Systems and Technology Architecture, or VistA. Cerner was subsequently acquired by Oracle in 2022 and rebranded as Oracle Health.

The agency and Oracle moved last month, however, to extend their contract to include an additional $17 billion ceiling and three one-year option periods — a move that reportedly surprised lawmakers from both parties.

Following a contentious House Veterans’ Affairs Committee hearing on the EHR modernization project last month, Democrat and Republican lawmakers voted 19-0 to subpoena both Oracle Chairman and Co-founder Larry Ellison and Oracle CEO Mike Sicilia to appear before the panel to further discuss the EHR modernization project’s cost and status.

As part of the fiscal year 2027 VA budget measure, NAVAPD asked top lawmakers to only allow EHR deployments to continue after VA “has completed an independent patient-safety assessment at the converted sites, corrected the critical deficiencies that assessment identifies, and documented each site's readiness with meaningful input from frontline physicians, dentists, and nurses, and reported the results to the Committees.”

The association also called for the committees to require that VA report and publicly disclose any documented patient safety events at the medical facilities using the new Oracle Health EHR software.

In addition to this future reporting requirement, NAVAPD also asked the House Veterans’ Affairs Committee to obtain patient safety incident data from Oracle “when its executives appear under subpoena.”

A spokesperson for Rep. Mike Bost, R-Ill., who chairs the House committee, told Nextgov/FCW that the panel “has and will continue to have oversight of the VA electronic health records deployment and program to ensure it delivers modern healthcare for veteran patients and VA providers nationwide,” and noted that “as part of that oversight, the Committee intends to hear from the CEO of Oracle on November 19th in an open hearing on progress made, as well as the look ahead going forward.”

]]>

Democrats press OpenAI over safety researcher firings, security incidents

Grace Dille — Fri, 30 Oct 2026 16:01:00 -0400

A group of 20 House Democrats is pressing OpenAI CEO Sam Altman for answers about the company’s dismissal of three safety researchers, questioning whether the firings could discourage employees from raising concerns about AI safety risks.

In an Oct. 29 letter, led by Rep. Greg Casar, D-Texas, the lawmakers said their concerns come as the company continues to experience “a slew of cybersecurity incidents.”

“We demand that you commit to not firing whistleblowers sharing information related to the safety of your models and that you keep your current pause on your most capable models in place until independent third-party oversight is in place,” they wrote.

According to the lawmakers, the researchers were dismissed after OpenAI examined their personal phones and found disappearing messages enabled on the Signal app in conversations with an outside researcher. The company reportedly fired the researchers for violating “clear policies for handling sensitive information.”

The researchers dispute this account, saying they never shared any confidential information with outside parties.

“These firings raise concerns about how whistleblowers are treated inside OpenAI and how much OpenAI employees can engage with external parties, including when those external parties are conducting independent investigations of the company’s practices,” the lawmakers wrote.

The lawmakers want to know what information the three fired employees shared and why the sharing of that information was a fireable offense. They also want to know if OpenAI has fired other employees for expressing concerns over the safety of their models.

The letter also connected the dismissals to other cybersecurity incidents, pointing to the recent Hugging Face incident in which OpenAI agents escaped their testing sandboxes during a cybersecurity evaluation.

Months before the Hugging Face breach, the lawmakers said two OpenAI employees warned executives that the company’s latest models “were not being appropriately monitored during testing, and executives responded that the tests needed to move forward as quickly as possible to release the models on time.”

The lawmakers questioned why OpenAI continued developing the models despite those warnings. They want to know what additional steps the company plans to take following the Hugging Face incident to ensure similar cybersecurity incidents do not occur.

The group of Democrats also pressed Altman for a list of all of the security incidents the company is investigating. They also want to know if OpenAI can stop its models when they take unauthorized actions.

The letter calls for a response to their questions by Nov. 13.

Casar and other lawmakers have previously pressed OpenAI for information about its security practices. In August, Casar led a separate congressional inquiry into the company’s Hugging Face incident, seeking details about how its AI agents bypassed security restrictions.

]]>

FBI is involved in response to $6.3 billion Binance hack linked to North Korea

David DiMolfetta — Fri, 30 Oct 2026 12:34:00 -0400

The FBI is working with government and industry partners after hackers stole an estimated $6.3 billion from cryptocurrency exchange Binance, an attack researchers have linked to North Korea.

“The FBI is aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts and coordinate appropriate investigative steps,” the bureau told Nextgov/FCW. It did not attribute the intrusions to North Korea.

Blockchain intelligence firm TRM Labs estimated that hackers transferred $6.36 billion out of Binance’s digital wallets Thursday, most of it in about 20 minutes. The company described it as the largest cryptocurrency theft on record, more than four times the $1.5 billion taken from rival exchange Bybit in February 2025.

TRM attributed the attack with high confidence to TraderTraitor, the North Korean hackers the bureau previously blamed for the Bybit theft.

Binance allows customers to buy, sell and hold digital currencies. The attack targeted wallets the company uses to handle those assets across multiple cryptocurrency networks. The company said its preliminary investigation suggests the breach began with a compromised laptop belonging to an engineer who works on its software and operations. The attacker then accessed an internal service and submitted withdrawals without authorization.

Earlier this year, the U.S. intelligence community assessed that Pyongyang has been able to net at least $1 billion annually in cryptocurrency heists and other financial crimes to fund its weapons programs.

“Decades of investment in cybersecurity have strengthened traditional defenses, yet the growing complexity of digital banking and AI have created new vulnerabilities,” said Phoebe Hodgson, a banking and payments senior analyst at GlobalData.

Binance said it temporarily halted deposits and withdrawals while conducting security checks. It pledged to cover all losses using its emergency protection fund and company money and said it would publish an updated accounting of the assets backing customer balances once repairs were complete.

Hackers can make stolen cryptocurrency harder to recover by exchanging it for other digital currencies and moving it between wallets. After the Bybit hack, the FBI said attackers had spread the stolen funds across thousands of wallets, and the bureau urged cryptocurrency companies to block further transfers.

North Korea has been stealing cryptocurrency for years as part of a broader effort to evade sanctions and raise money for the regime and weapons research.

Its operations have also involved the use of false identities meant to obtain remote technology jobs. Earlier this month, U.S. authorities announced the disruption of “laptop farms” in Texas that helped DPRK operatives pose as U.S.-based employees and send their earnings back to the regime.

]]>

ODNI seeks economic data platform

Ross Wilkers — Fri, 30 Oct 2026 09:00:00 -0400

The federal government’s office for overseeing all U.S. intelligence activities has embarked on a new search for technology to help it better understand the overall economic landscape, including foreign investment and supply chain developments.

The Office of the Director of National Intelligence is eyeing a new data platform to help it better ingest economic and financial data from multiple sources, either through a complete offering or component-level offerings that can be assembled together.

ODNI launched this new market research effort on Monday through its Office of Economic Security and Emerging Technologies, which is also looking to automation as a way for tying different records to the same company or entity.

ODNI envisions the platform as focusing on the collection, organization and correlation of unclassified datasets such as commercially-available and publicly-available information.

The request for information describes how following the rollout, the platform should function as the U.S. government’s primary reference point for helping agencies in the intelligence community and select other areas contribute to overall economic security objectives.

Data management and integration, automated entity resolution, and bulk access to the data via application programming interfaces are ODNI’s primary goals

Contractors interested in this requirement can respond by filling out a matrix accompanying the RFI spelling out capabilities they have to offer, as well as writing a 15-page submission detailing their approaches and ideas for ODNI.

Responses to the RFI are due by 5 p.m. Eastern time on Nov. 16.

]]>

Ex-government tech leaders pitch new vision for America.gov

Christian Robles — Fri, 30 Oct 2026 09:00:00 -0400

A group of civic technologists is urging the next administration to automate benefits enrollment rather than just build a one-stop shop for residents to apply for them.

New administrations have long promised to build one-stop shops Americans can use to navigate government programs such as Social Security. The Trump administration’s version of that vision is America.gov, an artificial intelligence-powered chatbot that provides Americans with information about government programs and will allow Americans to apply for certain programs next year.

But one-stop shops don’t solve all of the challenges Americans face in navigating the social safety net, according to a Tech Viaduct paper released Friday.

“We can only go so far, even with AI, at band-aiding over and piecing together a really broken and really inconsistent safety net,” Marina Nitze, former CTO of the Veterans Affairs Department under President Barack Obama and lead paper author, told Nextgov/FCW.

The next administration should fix the technical back end of the social safety net, in addition to offering a digital front door like America.gov, the paper argues.

By doing so, Americans would be able to use America.gov, as well as any AI agent, company or nonprofit, to assess whether they qualify for a government program and submit the necessary data, the paper envisions.

There are four steps to fix the back end of the social safety net, according to the paper.

The first step is for the administration to document the eligibility criteria for benefits administered by agencies such as the Social Security Administration.

The second step is to establish one authoritative source for each eligibility criterion — such as income and citizenship status — that benefit programs must accept as the truth for eligibility determination.

The third step is to rewrite program eligibility criteria so that the authoritative sources can actually serve as the basis for eligibility determinations. Tech Viaduct previously urged Congress to take the lead in standardizing technical definitions used for eligibility determinations such as disability, homelessness and income.

The final step is to validate that benefit programs pass standardized test scenarios to prove they are following the law.

The four-step process is simple on paper but has multiple complexities.

For example, some data will not have authoritative sources, such as a common SNAP question about whom someone regularly prepares food with, according to Nitze. In those cases, government officials should determine whether the question should be eliminated, streamlined or replaced with self-attestation, she said.

States may need financial incentives to determine how authoritative sources integrate with existing information technology systems for programs like SNAP and Medicaid, Nitze added.

To advance the four-step process, there needs to be a “commanding presidential directive to hold agency heads accountable” and collaboration with Congress in rewriting statutes as needed, according to the paper.

Pitching the vision

Tech Viaduct is a project of Democratic think tank Searchlight Institute that is preparing day one plans for the next administration.

Project staffers will attend the “What’s Next” conference in Denver in a few weeks to pitch 2028 campaigns on the new paper titled “Integrated Benefits: Our Vision for America.gov,” according to the Searchlight Institute.

Mikey Dickerson, the first administrator of the U.S. Digital Service and a senior Tech Viaduct advisor, is slated to speak at the event along with 2028 hopefuls such as former Transportation Secretary Pete Buttigieg.

The Tech Viaduct team plans “to make the case that Integrated Benefits is a precondition to any future Democratic trifecta being able to enact its most ambitious plans — from universal health care to a reformed tax system and more,” the think tank told Nextgov/FCW.

But the paper argues that its new vision for benefits delivery is bipartisan.

“For conservatives who are more concerned about waste and fraud, adjudicating the same facts independently in every program is maddeningly expensive for federal, state, and local budgets alike,” the paper states. “Done well, [the four steps] will combat fraud by making honest mismatches disappear, so the real fraud stands out.”

]]>

Officials suspect Iran in series of cyberattacks on military base freezers

David DiMolfetta — Thu, 29 Oct 2026 20:52:00 -0400

U.S. officials suspect Iran-linked hackers are behind a series of cyberattacks that have targeted freezers at military bases around the country and caused them to malfunction, according to two people familiar with the matter.

The outages have affected around six commissaries, the on-base grocery stores serving military personnel. The people spoke on the condition of anonymity to communicate sensitive knowledge about the intrusions, which began around late August.

It’s not clear how exactly the cyberintruders may have accessed the freezer systems, though various digital vulnerabilities tied to freezer controls can expose the equipment to hacking and sabotage. It’s possible the assessments may change as investigators learn more about the hacks.

The attacks, if fully confirmed to be tied to Iran, would demonstrate the nation’s ability to disrupt certain military-related equipment inside the United States through cyber means, and comes as the Trump administration is reportedly planning follow-up strikes on Iran after the U.S. midterm elections next week.

The attribution would also fit a broader pattern of suspected Iranian activity against equipment controlling water treatment processes in recent months.

Iran has previously combined hacking in lead-ups to elections. During the 2024 presidential campaign, U.S. officials attributed the theft of Trump campaign material to Tehran⁠.

Cyber Command and various Defense Department law enforcement units are probing the freezer incidents. French authorities are also working with officials examining the matter. Earlier this month, hackers overrode temperature controls on commercial refrigeration equipment at some 350 French establishments, which forced supermarkets to discard spoiled food.

The investigation draws attention to the computers that control everyday equipment used to store and handle food, an often overlooked area of cybersecurity where a hack can spoil supplies or interrupt distribution of goods.

The Food and Agriculture Information Sharing and Analysis Center, an industry group that shares cyber threat intelligence on the nation's food supply, has warned that attackers can target internet-accessible industrial controls that may not have optimal cyberdefenses in place.

]]>

US signs emerging technology deal with Finland

Grace Dille — Thu, 29 Oct 2026 17:04:00 -0400

The United States signed a Technology Prosperity Deal with Finland on Thursday in an effort to deepen technological cooperation and accelerate the adoption of emerging technologies.

The memorandum of understanding specifically cites artificial intelligence, quantum technologies and research and industrial security among the key areas of cooperation.

“Finland has world-class capabilities in quantum, in telecom, in nuclear and in nuclear energy, in space systems, in engineering, in biotech. I mean, you name it, and Finland has world-class capabilities, so it’s an incredibly important partnership for us,” Secretary of State Marco Rubio said during the signing ceremony.

For each area of cooperation, the memo also lists several focus areas for collaboration between the two countries.

For AI, the countries plan to promote development and exports across the full AI and network technology stack, partner to finance trusted technology stack exports, and strengthen existing research and development in 5G and 6G and next-gen communication technologies.

On the quantum front, the memo says the countries “intend to deepen cooperation to accelerate the development, commercialization, and responsible deployment of quantum technologies in ways that enhance prosperity and security.”

That includes collaborating through leading quantum institutions and national laboratories, supporting joint research investments into quantum manufacturing, advancing interoperable standards for quantum technologies, and endorsing and advocating for the adoption of post-quantum cryptographic standards.

As for research and industrial security, focus areas include strengthening security in research and industry, as well as establishing a bilateral research security dialogue and information exchange on threats and security concerns.

The countries also signed a Critical Minerals Framework on Thursday, which Rubio described as “the foundation of tech” and will cover efforts ranging from semiconductors to energy infrastructure.

]]>

Pentagon investigates suspected cyberattack behind military freezer failures

David DiMolfetta — Thu, 29 Oct 2026 16:54:00 -0400

The Pentagon is investigating a suspected cyberattack behind freezer malfunctions that spoiled food at military bases across the United States in August, according to a U.S. official familiar with the matter.

The outages affected some six commissaries — the on-base grocery stores serving military personnel — per the official, who spoke on the condition of anonymity to discuss the situation. At Fort Huachuca in Arizona, officials reported that a freezer had entered defrost mode and heated its contents, leaving food spoiled.

Reuters first reported Thursday that investigators were treating the incidents as a possible hack. It’s unclear who might be responsible or whether investigators have conclusively determined what caused the failures.

Cyber Command and various Defense Department law enforcement units are probing the incident. French authorities are also working with officials examining the matter. Earlier this month, hackers overrode temperature controls on commercial refrigeration equipment at more than 350 French establishments, forcing supermarkets to discard spoiled food.

The unusual U.S. outages and the possibility of hacking were initially flagged in August by the Signal and Silence blog. Stars and Stripes subsequently reported the involvement of military investigators, and The Telegraph also reported officials’ contact with French authorities.

A 2021 DHS assessment of threats to food and agriculture specifically identified refrigeration failures and shipping delays as cybersecurity risks that could cause spoilage and shortages.

The Food and Agriculture Information Sharing and Analysis Center, an industry group that shares cyber threat intelligence on the nation's food supply, has warned that attackers are targeting internet-accessible industrial controls that may not have optimal cyberdefenses in place.

The agri-food sector’s sensitivity to downtime often gives ransomware groups leverage to demand payment, the organization said in a separate report.

Lawmakers have sought to improve federal protections. A bipartisan group reintroduced the Farm and Food Cybersecurity Act in 2025, following an earlier proposal introduced in 2024.

]]>

DHS leak exposes contact information on intelligence personnel

David DiMolfetta — Thu, 29 Oct 2026 14:57:00 -0400

Contact information and organizational affiliations for personnel in the Department of Homeland Security’s Office of Intelligence and Analysis have been exposed in a leak of some 41,000 agency records published Wednesday.

Nextgov/FCW called numbers listed in the data for two I&A officials. One call reached a voicemail greeting identifying the official by name. The second person answered and offered little comment, but appeared to acknowledge that the listed number was theirs. Nextgov/FCW is withholding both officials’ names and positions.

The findings confirm the leak extends partly to the Homeland Security Department’s main intelligence arm, whose work includes counterterrorism, cyber threat analysis and transnational organized crime⁠. I&A is a member of the U.S. intelligence community and connects federal intelligence with information from state and local authorities and private-sector partners.

The entire scope of the exposure within I&A remains unclear, though around 75 records viewed by Nextgov/FCW appeared to tie personnel to the office. Both I&A field operations and headquarters staff are listed in the data.

The broader collection — which includes personnel in Immigration and Customs Enforcement, Homeland Security Investigations, the Cybersecurity and Infrastructure Security Agency and a slew of other department components — was published by transparency nonprofit Distributed Denial of Secrets.

Famed Swiss hacker and journalist known as “maia arson crimew” also said she was involved in working through the data, which was provided by a hacktivist group calling itself the Department of Peace.

The data includes names, phone numbers, email addresses, job titles and internal group memberships across the department. Some entries are historical, including records associated with former employees, Nextgov/FCW confirmed Wednesday.

Exposed contact details could help foreign intelligence services or criminals identify intelligence personnel and approach them with messages or calls designed to appear legitimate.

The leak is a potentially “severe operational failure” that puts safety of undercover personnel at risk, said Dray Agha, a senior tactical response manager at cybersecurity firm Huntress. “Exfiltrating this directory data gives hostile actors a complete map of sensitive departments and their internal reporting structures.”

The Department of Peace described the breach as retaliation for Secretary Markwayne Mullin’s pledge to intensify immigration enforcement. The publishers said the release could support public records requests and scrutiny of DHS operations.

“DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively,” a department spokesperson said. “We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available.”

The group claimed it obtained the records through an Okta single sign-on service used by DHS, which allows employees to access multiple workplace applications through one login. Nextgov/FCW has not directly confirmed that account. An Okta spokesperson previously said the company is secure and hasn’t seen evidence of compromise.

“The danger here goes well beyond a list of names. Connecting someone’s identity to their job, contact information and operational role gives an adversary a targeting map,” said Alissa Knight, the CEO of Assail’s federal government arm. “It can make impersonation more convincing, expose sensitive personnel and create risks that extend beyond the network.”

The exposure comes during a period of upheaval for I&A over the last year. Nextgov/FCW previously reported⁠ that the office underwent substantial workforce reductions in 2025, following a more sweeping downsizing plan that was paused after objections from law enforcement and other organizations that rely on its threat reporting.

DHS has also faced scrutiny over its ability to detect intrusions. Earlier this year, personnel twice dismissed signs of hackers inside the Homeland Security Information Network before confirming a breach, Nextgov/FCW first reported.

The incident also follows a separate but similar disclosure of FBI employee information involving intelligence and surveillance personnel⁠. That incident, claimed by prolific criminal hacking group ShinyHunters, exposed details that could help outsiders identify employees whose work is not widely known and tailor efforts to deceive or threaten them.

]]>

House Democrats call on Trump to preserve AI chatbot records

Grace Dille — Thu, 29 Oct 2026 12:17:00 -0400

The top Democrats on the House Judiciary and Oversight panels are calling on President Donald Trump to preserve his conversations with artificial intelligence chatbots, including billionaire Elon Musk’s Grok.

Reps. Jamie Raskin, D-Md., and Robert Garcia, D-Calif., sent a letter to Trump on Wednesday demanding that the White House preserve “any prompts” that the president or his staff have submitted to AI chatbots such as Grok, ChatGPT, Claude, Gemini or Perplexity. They also said the White House must preserve any AI-generated outputs in response to those prompts.

The lawmakers said their request “is not optional,” noting that the Presidential Records Act requires the adequate documentation of presidential records.

“Preserving the President’s and his advisors’ AI prompts is thus essential to preserving an accurate historical record and informing future administrations against the gaping national security vulnerabilities created by this Administration’s apparent reliance on unsecured, privately operated AI systems,” they wrote.

Raskin and Garcia are also requesting a closed-door briefing with the president and his staff by Nov. 11 on their use of AI chatbot technologies.

The lawmakers said their request is informed by reporting from Time that said Trump “sought the chatbot’s advice on carrying out some of your presidential duties, including asking Grok to opine on how Venezuelans would respond to the capture of President Nicolás Maduro.”

Weeks later, the lawmakers said, Trump “ordered the U.S. military, without congressional authorization, to attack Venezuela and capture President Maduro.” They added that Trump “reportedly ‘came away thinking Grok was ingenious.’”

The top Democrats called the episode “deeply troubling” because Trump allegedly consulted a chatbot, not Congress, on military operations. They also said the unsecured use of AI chatbots exposes the United States to national security risks and “malign influence from unknown and unaccountable third parties.”

The lawmakers are requesting details on the White House’s document retention policies governing AI-generated materials, AI chatbot contracts, Trump’s use of AI chatbots, and cybersecurity safeguards applied to AI chatbot usage.

"The White House preserves all required records in accordance with the law," a White House official told Nextgov/FCW.

Editor's note: This article has been updated to include comment from the White House.

]]>

GSA left sensitive information in its Google Drive exposed, watchdog finds

Christian Robles — Thu, 29 Oct 2026 08:00:00 -0400

The General Services Administration did not effectively protect physical security, personally identifiable data and general proprietary business information stored within its Google Drive, according to an audit released Tuesday by the agency’s Office of Inspector General.

In a limited search of GSA’s Google Drive, the OIG found 116 files containing controlled unclassified information, or CUI, that were improperly shared with employees and contractors who did not have a legitimate business reason to know those details. The exposed data included Social Security numbers, phone numbers, proprietary research, vendor proposals and site plans for a Washington, D.C. building.

GSA IT’s review determined that the identified documents were “not exposed externally” and found “no indication of malicious intent,” according to a response letter from David Shive, GSA’s chief information officer.

The watchdog attributed the improper exposure of sensitive information to “deficiencies” in GSA’s oversight.

The OIG said the agency did not effectively manage a third-party data loss prevention tool, used to prevent and detect CUI exposures.

That tool searches documents shared in GSA’s Google Drive for CUI-related keywords or phrases. If the tool detects CUI, it performs a “pre-designed response,” which could include restricting access to the document, flagging the document to GSA’s Security Operations and Engineering Division and sending an automated email to the document owner, according to the OIG audit.

But GSA did not fully complete annual reviews of the tool’s search terms to ensure it detected CUI and did not incorporate “many relevant terms” from agency guidance into tool searches, the watchdog concluded. Tool searches also failed to detect documents that included search terms.

GSA also did not implement a tool feature known as optical character recognition that could have prevented CUI exposures, did not document program decisions affecting CUI protection in the Google Drive and was not aware of the tool’s file size limit of 15 megabytes, OIG wrote.

In addition to mismanagement of the tool, OIG found GSA lacked an approval process for properly sharing sensitive information and a standard naming convention that could help prevent CUI exposures in its Google Drive.

The office gave GSA seven recommendations to prevent future CUI exposures:

Restrict access to all 116 CUI documents exposed in GSA’s Google Drive to only GSA users with a lawful government purpose for accessing them.
Identify and restrict access to other CUI documents not found through OIG’s audit.
Notify individuals affected by the exposed information in accordance with GSA policy.
Implement additional controls, such as an approval process for sharing CUI documents, a standard naming convention for CUI documents and new agency training materials.
Improve management of the data loss prevention tool through annual search term reviews and use of CUI guidance terms.
Assess and implement new data loss prevention tool features, such as optical character recognition and methods to identify CUI documents larger than 15 megabytes.
Develop a process to document and maintain operational decisions for the data loss prevention tool.

Shive said GSA IT agrees with all of the recommendations and is “working on a plan to address them.”

He added that GSA IT took “significant corrective action to strengthen the protection of sensitive information across GSA’s Google Workspace” while OIG was conducting its audit.

Those actions included updating internal procedures, restricting access to documents shared domain-wide “as appropriate,” and evaluating additional controls and tools to flag CUI exposure. The agency also adopted the optical character recognition feature that OIG recommended be implemented, according to Shive’s letter.

The report released Tuesday is not the first time OIG has found that GSA did not adequately protect sensitive information stored on Google technology.

In August 2014, the office reported that GSA did not protect information about child care centers, courthouses, water sources, building automation systems, security systems and fire alarm systems in its Google cloud computing environment. OIG issued additional reports between 2015 and 2017 that raised concerns about GSA’s ability to protect sensitive information within the Google environment.

In April 2025, the office found GSA’s Google Drive contained documents with sensitive information that users did not need to know, such as CUI, safety environmental management surveys and vendor financial information.

]]>

DHS personnel leak exposes contact details and sensitive job information

David DiMolfetta — Wed, 28 Oct 2026 22:07:00 -0400

Searchable records identifying more than 41,000 current and former Department of Homeland Security employees and contractors were published Wednesday, exposing contact information and details about sensitive assignments across the department, according to the organizations behind the release.

The transparency nonprofit Distributed Denial of Secrets — known as DDoSecrets — said it received the data from a hacktivist group calling itself the Department of Peace. The group claimed to have obtained the records through an identity service used by DHS. Famed Swiss hacker and journalist known as “maia arson crimew” also had involvement. She said in an X post that she was not involved in procuring the data and “worked on this story as a journalist conducting source work, research and data work.”

The information includes names, phone numbers, email addresses, job titles and internal group memberships, with records covering Immigration and Customs Enforcement, Customs and Border Protection, the Cybersecurity and Infrastructure Security Agency and other parts of DHS. Some entries describe roles involving surveillance, computer forensics and undercover work.

Nextgov/FCW corroborated portions of the data, including one official’s work phone number that the reporter for this story had independently obtained before the leak. Checks of several other listed numbers showed they were associated with AT&T, which provides communications services to DHS. LinkedIn profiles for several people named in the data also matched the job titles and positions listed in the records.

Some of the records also appear to be historical. Nextgov/FCW identified names of employees in CISA who have since left their roles at the cyberdefense agency housed in DHS.

DHS said it was “aware of a potential breach and is actively working to address the situation swiftly and effectively.” The department said it was working to protect employees and would provide more information when available.

The release, dubbed “Icepick,” offers a view into how personnel and responsibilities are organized across DHS. Its publishers described that visibility as a tool for public accountability. The exposure of employees’ assignments and professional connections can also help malicious actors identify sensitive targets and craft convincing impersonation attempts.

The Department of Peace said the breach was a response to DHS Secretary Markwayne Mullin’s pledge to intensify immigration enforcement.

“On July 17th, Markwayne Mullin said he was ‘turning up the heat.’ This is what happens to ICE when you do that,” a group spokesperson told the outlet. The group previously claimed a DHS hack involving contractor records in March.

DDoSecrets co-founder Emma Best said the latest release could support journalism, public records requests and congressional oversight.

The hackers said they collected the data from an Okta single sign-on service used by DHS. Such services let employees access multiple workplace applications through one login. Okta said it was aware of the reporting but had found no evidence of a compromise of its own systems.

“Okta is secure, and we have no evidence our data or systems were compromised,” a company spokesperson said.

The disclosure follows other recent incidents involving federal personnel information. A breach claimed by criminal hacker group ShinyHunters exposed sensitive FBI employee records, including information about intelligence and surveillance roles. Separately, a Defense Manpower Data Center breach affecting roughly 3 million people involved months of unauthorized access to a file-sharing system.

]]>

FCC commissioner hopes Cyber Trust Mark products reach shoppers within a year

David DiMolfetta — Wed, 28 Oct 2026 13:45:00 -0400

FCC Commissioner Olivia Trusty said Wednesday she hopes consumers will begin seeing products bearing the U.S. Cyber Trust Mark within the next year, offering a new outlook for the device-security labeling program as officials work to finalize requirements for its rollout.

Speaking at a Consumer Technology Association event, Trusty said the Federal Communications Commission expects to seek public comment on technical requirements and testing procedures in the coming months. The agency on Tuesday opened a separate proceeding covering label design, certification renewal and checks on products after they enter the market.

FCC Chairman Brendan Carr assigned Trusty to oversee implementation of the voluntary program, which is intended to help shoppers compare the cybersecurity protections of connected household products such as cameras, appliances and baby monitors.

The update is the first in several months to address the program’s status. First envisioned during the Biden administration, the mark is akin to the Energy Star label that helps shoppers identify energy-efficient products.

The timeline for the rollout has seen significant delays. In January 2025, then-White House cyber official Anne Neuberger said officials expected labeled products on shelves that year. But the initiative has also undergone major changes in the second Trump administration. The FCC selected ioXt Alliance as lead administrator in April, after UL Solutions withdrew following an FCC national security review under Carr of its alleged ties to China.

The label is designed to make security easier to assess before buying a device. A shopper can readily compare a camera’s price and picture quality, Trusty said, but may struggle to determine how well it is protected or how long its manufacturer will provide security updates.

A parent should not have to “become a cybersecurity expert before selecting a baby monitor,” she added.

Products qualifying for the mark would carry a label accompanied by a QR code directing shoppers to security information, including the manufacturer’s support commitment and instructions for securely configuring the device.

The label can’t guarantee a product will never face a cybersecurity threat, Trusty noted.

Several steps still stand between the program and labeled products reaching store shelves. The FCC must finish its technical requirements and testing procedures, then move ahead with accreditation for the organizations that will test and certify devices, Renee Roland of the agency’s Public Safety and Homeland Security Bureau said on a panel following Trusty’s speech.

Manufacturers can begin preparing now, said Peter Thermos of Palindrome Technologies, a cybersecurity testing company participating in the program. That includes identifying weaknesses in their products and establishing how they will deliver security updates to customers.

Earning the label would bring continuing responsibilities to address vulnerabilities and support those devices, Thermos said, adding "that’s where the responsibility starts."

Grace Burkard, who leads ioXt’s work as administrator, said technical recommendations have recently been published, but the product registry and consumer education effort remain works in progress. Additional working groups are expected in the coming months.

Officials also want shoppers to understand the label’s limits. Certification would not eliminate the need to configure a device securely, Roland said, and the FCC is seeking feedback on how to handle complaints and check that products continue meeting requirements after they go on sale.

]]>

CMS opens sign-ups for surprise medical billing dispute portal

Christian Robles — Wed, 28 Oct 2026 13:40:00 -0400

Health care providers and payers will soon manage disputes involving surprise out-of-network medical bills through a centralized platform from the Centers for Medicare and Medicaid Services, replacing legacy single-use web forms.

Through the IDR Gateway platform, users will be able to start and respond to the federal independent dispute resolution, or IDR. They will also be able to access information through dashboards and reports and monitor dispute updates throughout the IDR process, according to CMS.

The No Surprises Act created the IDR process to settle out-of-network payment disagreements between providers and payers, protecting patients from negotiations and surprise medical bills.

The IDR Gateway platform was first announced in March, but sign-ups did not start until Sept. 15. Importantly, it has not yet fully replaced the legacy IDR process.

Starting on Nov. 13, users will be able to submit important forms — a Notice of IDR Initiation, Notice of IDR Initiation Response, Notice of Certified IDR Entity Selection, and Notice of Offer — through the CMS platform. All IDR web forms, except for the Notice of IDR Initiation – Resubmission, will no longer be available outside of the IDR Gateway platform on Jan. 15, so users will have to create online accounts to navigate the IDR process.

Users must digitally identify themselves using Login.gov, ID.me, a federal personal identity verification card or credentials from CMS’ Enterprise User Administration or Identity Management system to create an account. In addition to providers and payers, designated third-party representatives, CMS-certified dispute arbitrators and other parties involved in the IDR process can create an account to navigate disputes.

The portal’s initial release will not include application programming interface access to dispute data or features supporting the 30-business-day open negotiation period before the IDR process can be initiated, according to a CMS technical guidance document.

The IDR Gateway platform could address the inadequacies facing legacy single-use web forms.

The federal government estimated that only about 22,000 disputes would be initiated through the IDR process each year, but CMS has instead seen millions of cases. Between April 15, 2022, and Sept. 30, 2026, 7,798,616 disputes have been initiated and 7,304,875 have been closed, resulting in a backlog, according to CMS data.

Moreover, under the current IDR process, single-use web forms trigger email notifications to providers, payers and CMS. The email traffic can make it difficult for parties to track a dispute’s status and stay on top of legal deadlines, Jeffrey Davis, senior policy advisor at Holland & Knight, told Nextgov/FCW.

The IDR Gateway platform is meant to “help clarify and keep everyone kind of on the same page of where we are in different parts of the process,” he said.

But under the initial IDR Gateway implementation, parties will continue to receive email notifications and track dispute information in the portal, according to the technical guidance document.

Still, the American Hospital Association, a major hospital trade group, said in a statement to Nextgov/FCW that it “has supported the build out of the IDR Gateway platform to improve all parties’ ability to track a case and streamline action steps. In addition, the AHA expects the Gateway will help federal regulators with oversight of the program by capturing whether timelines and other requirements are being met.”

“Health plans support the goal of having a secure, centralized platform that can bring greater transparency to disputes within the IDR process,” Chris Bond, a spokesman for major payer trade association AHIP, also said in a statement to Nextgov/FCW.

“However, there are still significant changes that are needed to protect consumers and employers from the costly provider-led abuse of the arbitration process, including fixing the flawed incentives that drive unprecedented volume through IDR, greater oversight of IDREs, and guardrails on inflationary IDR awards,” he added.

AHIP has argued that the IDR process has cost Americans $22.4 billion in “wasteful spending” from 2022 to 2025 and has been abused by private equity-backed groups.

Lawmakers have sought to reform the IDR process, with Rep. Frank Pallone, D-N.J., going as far as to propose replacing arbitration with a new payment system.

]]>

NASA, Google test AI-powered medical robot for deep space missions

Grace Dille — Wed, 28 Oct 2026 12:16:00 -0400

NASA is testing an artificial intelligence-powered robotic system that could help astronauts with routine maintenance and medical support without waiting for instructions from mission control.

NASA’s Human Research Program, Johnson Space Center Robotics Team and Jet Propulsion Laboratory collaborated with Google Public Sector to develop the system.

Under its Artemis program, NASA will send astronauts on increasingly difficult missions to explore more of the Moon, followed by missions to Mars.

According to a Tuesday blog post from Google, an astronaut on a future deep space mission to Mars could face round-trip communication latencies of up to 44 minutes, making autonomous support for medical needs increasingly important.

“Researchers at NASA are developing new tools utilizing super intelligence (SI) technology to support a variety of research efforts, missions, and programs,” a NASA spokesperson said in a statement to Nextgov/FCW. “Work is ongoing by NASA and a variety of partners to analyze and assess these tools for potential future applications.”

The latest effort builds on the development of the Crew Medical Officer Digital Assistant, an automated system that NASA and Google collaborated on to help astronauts with real-time medical guidance.

The new “proof-of-concept physical, robotic system” is designed as a payload handler that can manage cargo, logistics and equipment. When the system is not being used for routine maintenance, it can provide medical support.

For example, Google said that the robot could retrieve and prepare an ultrasound machine for an astronaut who is experiencing extreme back pain — a possible sign of kidney stones.

In early laboratory demonstrations, the robot achieved an 85% baseline success rate in locating and moving a medical bag. The system used the open-source Pi0 model, developed by AI software and research company Physical Intelligence and run on Google Cloud infrastructure.

Google said its team used Google Cloud G4 computing instances to train and fine-tune the 4-billion parameter Pi0 model in just 2.5 hours.

“The ultimate goal is to build a robotic system that can execute a variety of tasks via simple voice instructions, under the astronauts’ direct supervision and command,” Jim Kelly, vice president of federal sales at Google Public Sector, wrote in the blog post.

“For instance, the robot might be directed to assist with routine health monitoring — such as capturing basic vitals or simple ultrasounds — under the strict guidance of a human crew medical officer,” Kelly added. “This ensures astronauts receive the physical assistance they might not be able to perform by themselves, without ever replacing human decision-making.”

]]>

China’s ‘Volt Typhoon’ quietly built another hacking network following US crackdown, new findings say

David DiMolfetta — Wed, 28 Oct 2026 12:00:00 -0400

In January 2024, a quartet of U.S. cyber and intelligence officials issued a stark public warning about Chinese hackers embedding themselves into critical infrastructure around the country. Volt Typhoon, as the group is known, was targeting systems like power grids and transportation networks, positioning itself to sabotage them should the U.S. become involved in a conflict with Beijing over Taiwan, officials assessed.

The FBI at the time had just struck at a network of compromised routers used by the hackers to conceal their intrusions. The operation, conducted in December 2023 and announced the following month, disabled the main arm of the staging ground, dubbed KV Botnet, subsequent research found. It was a major disruption of the group’s infrastructure, accompanied by a public campaign to alert organizations to the threat.

But as U.S. investigators dismantled parts of KV and worked to notify victims, another Volt Typhoon operation was quietly taking shape, according to findings released Wednesday by Black Lotus Labs, the threat intelligence arm of Lumen.

That network, dubbed Silent Train, has supported a three-year campaign against government systems, telecommunications providers, defense contractors, satellite services, universities, technology firms and various critical infrastructure operators, according to the research.

Built around chains of compromised routers, corporate networking equipment and everyday internet-connected devices, Silent Train gave the hackers ways to reach targets while concealing where their activity originated. Volt Typhoon used it to target and, in some cases, compromise organizations across those sectors, according to Lumen.

Those organizations include Energy Department facilities around the U.S. that have been targeted over the last year, according to a person with knowledge of the matter. Multiple utility providers have also been dealing with Volt Typhoon-related issues over a similar timeframe, according to a former U.S. official. Both people were granted anonymity to discuss sensitive details of recent intrusions linked to the hackers.

The findings paint a picture of how much of Volt Typhoon’s activity remained outside public view, even as the U.S. worked to expose and disrupt it, and they underscore the Chinese hackers’ persistence in gaining footholds inside American systems.

Access to organizations that supply power, communications and other vital services could give Beijing opportunities to interfere with civilian life and military operations during a crisis, a dynamic that has long been a concern of current and former officials dealing with China-linked cyber threats.

U.S. officials had cautioned early on that dismantling KV would not end the campaign. In March 2024, then-NSA cybersecurity director Rob Joyce said investigators were still finding victims of the hacking group. By May, officials detailed multiple covert networks supporting the hackers.

Lumen’s findings provide a more detailed view of one such operation. Most targets were U.S. government entities, defense contractors and universities with defense relationships. IT companies and managed service providers — firms that operate their customers’ technology infrastructure — were also prominent targets.

The hackers heavily targeted entities in Hawaii, California and Texas, a concentration Lumen believes reflected an effort to position for disruption of U.S. defense and infrastructure networks connected to the Indo-Pacific.

“Many of the organizations targeted in these areas occupied positions of trust and connectivity upon which military, government, and civilian operations depend,” the report says.

Telecom providers were among the targets reached through enterprise IT management tools. Such platforms can offer an especially valuable entry point because they are built to oversee other systems and give administrators broad access.

“Threat actors typically need to traverse networks, identify administrators, locate key systems, and establish multiple footholds to gain visibility. Volt Typhoon bypasses this by targeting management platforms directly, which already have visibility, access, and administrative functions,” the report reads.

Lumen observed more than 27 classes of devices used in Silent Train, ranging from TP-Link routers and Netgear equipment to enterprise platforms like Fortinet appliances. Some compromised devices had no known security flaws, which Lumen said suggested the hackers may have exploited previously undiscovered vulnerabilities.

Silent Train also relied on brief, carefully managed connections rather than keeping the same access paths continuously active. After conducting operations, the hackers removed traces of their activity and dismantled connection paths, according to Lumen. The access windows lasted about four hours on average, with some active for only a few minutes.

The persistence of the campaign echoes a warning then-FBI Deputy Director Paul Abbate gave in August 2024 that U.S. efforts had fallen short of deterring the hackers.

Despite the government’s interventions, he said, “it just has not had the deterrent effect that we would want to see.”

Washington has also tried diplomatic pressure. Then-Secretary of State Antony Blinken and Nathaniel Fick, the State Department’s former top cyber diplomat, pressed Chinese officials to halt Volt Typhoon’s activities during an April 2024 visit to China, Fick told reporters the following month.

“Secretary Blinken was very clear that holding American critical infrastructure at risk — especially civilian critical infrastructure — is dangerous. It’s escalatory. It’s unacceptable,” Fick said at the time.

]]>

DHS secretary plans post-election security review

David DiMolfetta — Wed, 28 Oct 2026 10:19:00 -0400

Homeland Security Secretary Markwayne Mullin plans to review the nation’s election security posture after the midterms and consider changes aimed at bolstering public confidence in voting systems.

Mullin outlined the plans during an all-hands address at the Cybersecurity and Infrastructure Security Agency’s headquarters Tuesday, according to a CISA official with direct knowledge of the remarks. The official was granted anonymity because they were not authorized to discuss details of the speech.

The secretary told employees he intended to hold a “debrief” after the elections and weigh whether changes to systems were needed to improve trust in election outcomes among voters. He also said DHS was not seeking to “suppress” votes and said the department’s goal is ensuring ballots are secure and legally cast.

The scope of that review and the changes Mullin might pursue remain unclear. But his remarks come as the Trump administration has sought greater control over election procedures, including attempted restrictions on mail voting that would require voters to appear on new Postal Service lists before their ballots could be transmitted.

More recently, the Justice Department asked Washington state to withhold ballots from hundreds of people flagged as alleged noncitizens, following a similar effort in California. Audits and studies have consistently found noncitizen voting to be rare.

Election cybersecurity work can include protecting voter registration records, keeping voter check-in systems available and preventing attacks that knock polling-place information or results websites offline. Disrupting those services can cause confusion and delays for voters, though they do not directly affect how people cast their ballots.

Foreign influence campaigns can separately seek to discourage participation or undermine confidence in the outcome by spreading false claims about candidates or amplifying divisive political issues online. Current and former officials previously told Nextgov/FCW that cuts to certain federal programs have weakened relationships used to identify and counter foreign influence campaigns, even as artificial intelligence makes deceptive messages easier to produce and spread.

Sen. Mark Warner, D-Va., and Rep. Jim Himes, D-Conn. — the top Democrats on the Senate and House Intelligence panels — said last week that U.S. intelligence has described Russian disinformation and more targeted Chinese influence efforts. The lawmakers said they have seen no indications of a foreign operation to manipulate voting machinery or alter ballots.

Mullin’s address was first reported by Politico. His remarks come as CISA tries to boost election security support following staffing and program cuts that state officials say have disrupted their access to federal expertise.

The agency’s September election plan assigns its 10 regional directors an election adviser role and describes a free platform for sharing threat information among election officials, state intelligence hubs and federal partners. Mullin pledged at the time that the plan would be “implemented in full.”

Some state officials have warned that renewed assistance arrived too late for parts of their midterm preparations. One Arizona cybersecurity official said last month that their state had been without a CISA cybersecurity adviser since March 2025.

The debate over CISA’s election work stretches back to 2020, when the agency affirmed the security of that year’s election and rejected President Donald Trump’s false claims that it had been stolen. Trump and his allies have since accused CISA of enabling government censorship through its work to counter election-related disinformation.

Those grievances have helped shape much of the administration’s efforts to narrow the agency’s role during Trump’s second term. In the last year, officials have also undertaken acute efforts to scrutinize the security of voting infrastructure.

Although voting machines and related systems contain known security vulnerabilities, officials and cybersecurity experts have found no evidence that these flaws have been widely exploited in a way that would alter election outcomes.

]]>

FEC takes down electronic filing platform after attempted hack

David DiMolfetta — Wed, 28 Oct 2026 10:06:00 -0400

The Federal Election Commission has pulled down multiple filing systems amid reports indicating that the agency was targeted in a cyberattack.

The hacking attempt, first reported by Reuters, put the government’s primary campaign finance regulatory agency in the crosshairs. The FEC does not administer U.S. elections, and cyber incidents related to the commission would not affect how votes are cast in next week’s midterm elections.

A notification email obtained by Nextgov/FCW indicated that several systems remained offline, including various filing search features, campaign finance report validation tools, and other feeds and channels. The notice adds another update will be provided Wednesday morning.

On Tuesday night, an FEC spokesperson referred Nextgov/FCW to a commission status update page, adding that electronic filing systems are offline and that staff are “actively working to restore service.”

An update issued around 8:20 p.m. ET Tuesday night says an issue has been identified and a fix is being implemented.

The incident is timely, as it comes days before midterm elections will be held in the U.S. and as groups pour record levels of money into campaign efforts. The disruption hinders organizations from submitting the FEC’s required 24-hour and 48-hour disclosure reports, which detail political spending on individual races.

A disruption to campaign finance reporting can limit timely public visibility into election spending, said Gabrielle Hempel, a security operations strategist at cybersecurity firm Exabeam.

“What is the backup process, how are filings received and disclosed while the system is down? How quickly can the agency restore service without sacrificing the integrity of the data? Disruptions like these can have a massive impact on public trust without ever actually touching a ballot,” Hempel said.

]]>

Federal workforce cuts linked to lower satisfaction scores across government services

Jory Heckman — Wed, 28 Oct 2026 10:00:00 -0400

Americans’ satisfaction with public-facing services provided by the federal government has fallen for the first time in five years, according to new findings released by the American Customer Satisfaction Index.

ACSI reports that citizen satisfaction has fallen to a score of 68.6 out of 100 – a 2.6% decrease.

This marks the first decline tracked by the index since 2021, when many federal employees were put on mandatory work-from-home schedules at the height of the COVID-19 pandemic and agencies struggled to bring more of their public-facing services online.

Forrest Morgeson, director of research emeritus at the ACSI, said the data shows a “pretty clear link” between the decline of satisfaction scores and deep cuts in the federal workforce driven by the Department of Government Efficiency (DOGE).

The federal workforce has seen a net decrease of about 264,000 employees since the start of the second Trump administration, according to the latest data from the Office of Personnel Management.

Only two agencies – the State Department and the General Services Administration – saw higher year-over-year scores. Scores for three departments – Commerce, Veterans Affairs and Treasury – remain unchanged. The remaining 10 agencies studied saw lower scores.

Agency officials have repeatedly talked about deploying artificial intelligence tools to make their remaining employees more productive and to mitigate last year’s staffing losses. IRS Chief Executive Frank Bisignano recently described an “AI-first” vision of the agency to employees.

But Morgeson said these AI investments are not yet translating into consistent improvements for the public.

“If you start the workforce reduction before you've got those technologies fully embedded in your processes, it can be disruptive. People can feel it in terms of slower services, less efficient service,” he said. “If it's getting harder because of reduced workforces, then that's going to shine through.”

The report also finds declines in how satisfied citizens feel getting help from agencies both over the phone and online. Several agencies have overhauled their websites to ensure that citizens can seek help online before having to pick up the phone.

“Self-service technology is terrific, and I think many of us prefer it, but it's only terrific as long as it works,” Morgeson said. “It's great until you need somebody to intervene, and otherwise it can be a real burden.”

The State Department saw the biggest year-over-year improvement in scores, driven by the success of the Bureau of Consular Affairs’ online passport renewal platform. More than half of all online passport renewals are now done through the portal, which was launched in 2024.

GSA, which is home to USA.gov – a one-stop-shop for public-facing services provided by the federal government – also saw a slight boost.

“Digital-first delivery continues to resonate with citizens when agencies invest in it,” the ACSI report states.

The Small Business Administration saw a 9% decline in satisfaction scores – the largest decrease of any agency. While SBA rolled out tools to cut processing times for non-complex loans under $500,000, the report states that those efficiency gains have been offset by a 43% reduction in its workforce.

The Department of Agriculture, last year’s top-scoring agency, saw the second-largest decline. USDA carried out a 20% staffing reduction last year, and employees expect further attrition if the department moves forward with plans to relocate about 2,600 of its employees across the country. A federal court is currently keeping those relocations on hold.

The IRS saw no change in scores, despite s hedding more than a quarter of its workforce last year.

“As the IRS expands its use of technology to simplify the taxpayer experience, overall satisfaction is expected to remain modest relative to other agencies given the inherent challenges of its tax collection role,” the report states.

]]>

GSA unveils token-based OneGov pricing for Claude

Christian Robles — Tue, 27 Oct 2026 18:36:00 -0400

Anthropic will offer federal, state and local agencies a 40% discount on token-based usage for Claude models under a OneGov deal announced Tuesday.

Under the new agreement, agencies do not need to make minimum purchases and can access the discount directly through resellers and on major cloud platforms.

OpenAI brokered a similar 50% discount with the General Services Administration on token-based usage through a 27-month-long OneGov agreement that kicked in at the beginning of the month.

“As agencies increasingly integrate AI into their regular operations, providing consumption-based access is the next logical step,” said Laura Stanton, acting commissioner of GSA’s Federal Acquisition Service, in a press release announcing the OpenAI deal.

The consumption-based discount for Claude lasts for 27 months, expiring on Jan. 31, 2029, according to a GSA website.

Anthropic said in a blog post that the discounted Claude pricing would go into effect Tuesday and that the price cuts offered through the OneGov agreement "are estimated to save the government $1 billion."

The announcement comes days before a Claude OneGov deal is set to expire on Oct. 31. Under that expiring agreement, federal agencies have had access to Claude for Enterprise and Government for $1 per user.

Last week before the new Anthropic OneGov deal became public, the Department of Health and Human Services announced its intent to award a sole-source contract for Claude models.

The OneGov program has generated more than $1.8 billion in savings, including roughly $1.6 billion through AI agreements, GSA said in its release unveiling the new Claude discount.

Editor's note: This article has been updated to include the length of Anthropic and GSA's OneGov agreement.

]]>

White House takes Texas water cybersecurity model to rural hospitals

David DiMolfetta — Tue, 27 Oct 2026 17:10:00 -0400

The White House and South Carolina officials launched a six-month cybersecurity pilot Monday to help rural hospitals defend against hackers and keep treating patients during attacks, extending an approach first tested with water utilities in Texas.

The initiative, Project Lifeline 250, will connect participating hospitals with technology companies offering assistance at no cost. National Cyber Director Sean Cairncross and South Carolina Gov. Henry McMaster announced the effort at Newberry Health Hospital.

The program will focus on strengthening hospital networks, providing backup technology to maintain critical services after an attack and identifying and replacing high-risk or outdated devices. It brings together the Office of the National Cyber Director, South Carolina’s Critical Infrastructure Cybersecurity program, the State Law Enforcement Division and industry partners, including Cisco, Cyera, Microsoft, Trellix and Zscaler.

“Project Lifeline 250 connects the world-leading American industry with rural hospitals and uses the greatest American tools and capabilities to defend hospital networks; deploy physical back up devices after an initial incident to ensure an impacted hospital can still provide critical care; and identify high-risk and legacy devices and replace them,” Cairncross said.

The launch follows Project Watershed 250, a six-month pilot announced Aug. 31 in San Antonio, Texas. That effort pairs Texas water and wastewater providers with government and private-sector specialists to find security weaknesses and help fix them using cybersecurity and artificial intelligence tools.

Both projects seek to bring technical assistance to organizations that provide essential services but often lack the money and staff to adequately secure their systems. Officials did not specify when the six-month period would begin or how assistance would be maintained and financed if the program expands.

Cairncross had previously previewed plans to expand beyond the water sector at September’s Billington Cybersecurity Summit, saying the administration wanted to test specific solutions before applying them more broadly.

Hospital cyberattacks can interfere with the systems clinicians use to retrieve medical records, review test results and coordinate care. Rural providers typically have fewer financial resources than larger health systems to protect those functions.

Other incidents present even greater risks. Critical patients were diverted from the University of New Mexico Health System on Monday following a cyberattack that severely disrupted operations.

And in South Carolina, the state’s AnMed health system experienced weeks of disruption after a July cyberattack, including limited access to medical records. Its emergency and urgent care locations remained open, but normal operations did not resume until mid-September.

The major 2024 hack of UnitedHealth’s Change Healthcare subsidiary delayed prescriptions and disrupted insurance payments across the country, leaving rural clinics and hospitals struggling to cover expenses. It impacted roughly 193 million people, according to an analysis from the Department of Health and Human Services posted last year.

]]>