Anthropic's Fable 5 and Mythos 5 are back after a three-weeks-long restriction saw the security models effectively banned.

Earlier this month, the US government applied export controls to Claude Mythos and Claude Fable 5, banning any foreign users, inside or outside the US, from either model.

As Anthropic had no way of checking the nationality of its users, both models were de facto banned from use. Last week, the restriction was loosened to allow Mythos to be used by US organizations deemed trustworthy.

Now, Anthropic has said the restrictions have been mostly dropped following the introduction of new safeguards.

"Anthropic has agreed to proactively detect and address security risks associated with the models," US Commerce Secretary Howard Lutnick wrote in a letter to the tech company, according to the BBC,

Lutnick later added on social media: "Over the past two weeks, we have worked closely with Anthropic to analyze and approve Fable 5 to ensure alignment across the US Government and strengthen America’s leadership in AI."

Anthropic said it was still working to expand access to Mythos 5 to a wider set of partners in its Project Glasswing program – which gives access to the security model in a managed way – and hoped that would include domestic and international users.

Fable 5 should now be available again for all Claude users, with access reenabled for AWS, Google Cloud, and Microsoft Foundry as quickly as possible.

Why Mythos and Fable were restricted

Fable 5 and Mythos 5 are both security focused models, sharing the same underlying model, Anthropic notes.

As ITPro reported in early June, Fable 5 was built with "strong safeguards to make it safe for general use".

Mythos, meanwhile, has fewer protections in place, and as such was released to a limited number of trusted partners under Project Glasswing for the express purpose of defensive security.

Just days after the release of Fable 5, the government applied strict export controls. That was driven by Amazon researchers finding a way to dodge Fable 5's safeguards to use it to hunt for flaws in software and produce exploits.

Anthropic argued that most of its models could actually uncover the same vulnerability and exploit demonstration, and that the Amazon research didn't make use of any "unique Mythos-level cyber capabilities".

The workaround discovered by Amazon has now been blocked for most instances, with any users attempting similar techniques downgraded to a lesser model. Anthropic admitted that more "benign requests" may be flagged accidentally now, though it hopes to reduce such false positives as the system is improved.

"One particularly important safety mechanism involves classifiers — smaller automated AI systems that, during an interaction, detect when the model is asked to perform a potentially harmful cybersecurity task (or produces potentially harmful outputs)," the company said.

"When this occurs, the classifiers block the model from responding to requests. The ultimate goal of these classifiers is to prevent the model from engaging in uniquely dangerous behaviors."

Beyond the new safety classifiers and other safeguards, Anthropic is working with industry partners including Amazon, Microsoft, and Google to develop a framework for addressing AI model ‘jailbreaking’ techniques, developing a system for judging the severity of such attacks.

Plus, Anthropic said it would work more closely with the US government, offering expanded early access for models that could impact national security and sharing information about jailbreaks or misuse patterns.

The company called for the same rules to apply to its rivals: "These rules should be codified in strong regulation and applied equally across frontier model developers."

Mixed industry reactions

It's no surprise this was sorted quickly. Keven Knight, CEO, of cybersecurity firm, Talion, noted that the US government would not have wanted to risk slowing down AI development, particularly in security.

"Given that China is steadily advancing with its advanced AI model, with a platform that mirrors Mythos being launched by 360 Security Technology last week, the US could not afford to limit access to Anthropic's platforms for much longer," Knight said.

"Restricting access to the platforms would only leave western organisations on the backfoot, and at a time when the AI arms race is really heating up, this would be dangerous."

Though the export ban is now loosened, Andrew Bloster, senior R&D manager at Black Duck, said that won't end the "chilling effect" the incident has had on the use of such models.

"Security leaders globally are now wary to depend on AI as a service models that can be launched with much fanfare and then pulled from the global market," he said, pointing to the rise of sovereign AI.

Bloster added that "technology leaders are more concerned about resilience, data security, and cost, and Fable being permitted back on the world stage might not be enough to earn back global trust."

Though Anthropic was the first company to jump through these hoops, it actually tried to find a good balance between safety and use via Glasswing, said Mike Britton, CIO at Abnormal AI.

"On Mythos, the controlled rollout to a vetted set of US organizations is actually the right model. Limiting access to trusted institutions, with use cases focused on finding and remediating vulnerabilities, is how you derive real security value from a model at this capability level without creating new risks," said Britton.

"The goal should be more secure software — and that's achievable if the access controls stay disciplined over time."

FOLLOW US ON SOCIAL MEDIA

Chinese state-backed threat group Salt Typhoon is believed to have gained access to email systems used by US Congressional Committee staff.

According to reports from the Financial Times, the threat group is thought to have compromised accounts belonging to staff working on the House China Committee.

Aides working at the Foreign Affairs Committee, Armed Services Committee, and Intelligence Committee are also believed to have been impacted by the attacks.

Sources told the FT the incident was first discovered in December.

Exact details on the scope of the incident are yet to be confirmed. A person familiar with the matter told the publication it remains unclear whether the group fully accessed email communications.

Salt Typhoon has cyber agencies on alert

The campaign marks the latest in a string of attacks by Salt Typhoon on US government email systems and telecommunications networks.

A previous attack saw the threat group access and record telephone conversations of “very senior” American political figures, according to Anne Neuberger, deputy national security advisor for cyber and emerging technology under the Biden administration.

This particular campaign saw the group compromise major US telecoms companies, including Verizon, Lumen Technologies, and AT&T.

Salt Typhoon activities have escalated over the last three years, with security agencies on both sides of the Atlantic issuing repeated warnings about the threat posed by the group.

An advisory from the FBI in September noted the group had hit organizations in more than 80 countries as part of an “indiscriminate” hacking campaign.

In mid-2025, it was revealed the threat group also compromised US state National Guard networks. An investigation by the US Department of Defense (DoD) found hackers breached and laid low in compromised networks for almost a year.

The DoD warned the group may have accessed sensitive information pertaining to military and law enforcement operations.

“Deeply concerning” attacks

Benjamin Schilz, CEO at Wire, said the latest campaign “exposes how vulnerable core communications systems remain to nation-state actors”

“The Salt Typhoon espionage campaign highlights a sustained, state-backed assault on U.S. communications infrastructure by China’s Ministry of State Security,” he said.

“Regardless of whether lawmakers’ emails were accessed, the fact this activity went undetected for years is deeply concerning.

“Persistent access of this nature creates the potential to intercept unencrypted communications, including calls, messages, and voicemails across the U.S. population, posing a serious national security risk,” Schilz added.

FOLLOW US ON SOCIAL MEDIA

There's huge uncertainty over the UK-US Tech Prosperity Deal, with reports that the US has pulled out.

The deal, signed in September, saw the two countries agreeing to establish joint R&D, and advance "pro-innovation AI policy frameworks". The plan also called for cooperation on quantum computing and nuclear energy.

At the time, US president Donald Trump said it would "ensure our countries lead the next great technological revolution side by side".

However, reports from the New York Times suggest that talks have stalled due to “broader disagreements”.

This is believed to be in part a reference to the UK's Digital Services Tax, levied at 2% on US tech giants including Google, Amazon, and Apple, and raising around £800 million per year.

Trump is reportedly not a fan of the Online Safety Act, which requires tech companies to protect users from harmful content.

According to the NYT, the US is also concerned about the Economic Prosperity Deal between the two countries. The MOU for the Technology Prosperity Deal made it dependent on “substantive progress” towards the Economic Prosperity Deal signed in May.

The US is reportedly unhappy with perceived trade barriers in sectors such as cars, pharmaceuticals, and steel.

The stalled talks on the deal may just be a tactic to put pressure on the UK, as implied by a statement on X by Trump's science adviser Michael Kratsios.

"In line with Section III of the US-UK Technology Prosperity Deal, we hope to resume work with the United Kingdom once the UK has made substantial progress in implementing its commitments under the Economic Prosperity Deal," he said.

"We look forward to continuing our productive collaboration across AI, quantum, nuclear, and other critical technology areas under the Deal."

Reports from the BBC on Tuesday noted that the deal is still very much alive and kicking. According to the broadcaster, the prime minister’s office said the UK remains in “active conversations with US counterparts at all levels of the government” on the deal.

Who benefits from the Tech Prosperity Deal?

The Tech Prosperity Deal has been widely seen as favorable to the US, Last month, experts told ITPro the agreement was a “strikingly unequal partnership” that allows big tech to expand its presence in the UK unchecked.

According to campaign group Global Justice Now, the UK should be wary of making any more concessions.

"For Trump, collaboration on trade and investment only appears possible if other countries give US corporate giants free reign over their economies – and give up their democratic right to regulate and tax them," said policy and campaigns manager Tim Bierley.

"The news that the US is seeking even more concessions should be a wake-up call for those in government who think we can appease our way out of tariff wars with Trump – the more we concede, the more corporate America will demand."

Broadly speaking, the tech industry is more favorable toward the deal. The Computer & Communications Industry Association (CCIA), which has called for the Digital Services Tax to be repealed, pointed out that other nations are scrapping similar taxes.

“The technology deal was good news for investment and innovation in both countries, and it is unfortunate that lack of progress in broader trade issues resulted in its implementation being suspended," said CCIA senior director Matthew Sinclair.

"The UK should do more to address barriers to trade in digital services, whether that is taxes that single out US multinationals or regulators wielding unprecedented powers without the guardrails that should protect companies against disproportionate or simply misguided attacks on their businesses.”

FOLLOW US ON SOCIAL MEDIA

Tech policy and startup support organisation, the Startup Coalition, has called on the UK government to capitalize on the Trump administration’s H-1B visa crackdown.

On Friday 21 September, the Trump administration said it will ask companies to pay $100,000 per year for H-1B worker visas, which are designed specifically for hiring of foreign workers in specialist occupations.

In an open letter addressed to Home Secretary Shabana Mahmood, the non-profit urged the government to step in following the announcement, describing the move as an “unprecedented opportunity” for the country’s technology sector.

“The introduction of a $100,000 fee for H-1B visas has created uncertainty across Silicon Valley and left tens of thousands of the world's most talented engineers, founders, and researchers reconsidering their futures,” the letter reads.

“This is not a moment for quiet diplomacy or understated British reserve. This is a moment for bold, decisive action.”

Dom Hallas, executive director at the Startup Coalition, said the government faces a “once in a generation chance for Britain to attract genuinely top tier global tech talent”.

Capitalizing on the H-1B crackdown

The open letter recommended several key actions the government should take to step in and lure talent to the country. This includes an expansion of the Global Talent Fund, which is designed to attract science, technology, and engineering talent to the UK.

The non-profit urged the government to introduce changes aimed specifically at supporting talent displaced by US policy changes.

Elsewhere, the letter called for “expedited processing” for H-1B holders and individuals looking to relocate, alongside updates to the Enterprise Management Incentive (EMI) scheme to beef up equity packages.

Notably, the letter highlighted key advantages the UK boasts in terms of talent acquisition compared to the US, including the fact its visa routes are “dramatically cheaper” and can be processed in “week’s not months”.

The Startup Coalition added that the current political situation in the UK offers a greater degree of certainty for workers.

“We offer clear pathways to settlement without lottery systems or arbitrary caps,” it reads.

Trump’s visa bombshell has Silicon Valley sweating

President Trump’s move has shocked Silicon Valley following months’ worth of close ties between big tech and the administration.

Big tech companies rely heavily on H-1B visas to attract talent to the United States, meaning costs for organizations of all sizes could surge as a result of the policy change.

Figures show there are over 700,000 people currently working in the US on H-1B visas, and just 85,000 are awarded annually despite hundreds of thousands of applications.

While the policy change will hurt US enterprises, foreign nationals from a host of countries will also be impacted. Indian nationals are among those expected to feel the biggest impact, according to reports from BBC News.

Indians made up more than 70% of H-1B visas in recent years, with Chinese nationals the second largest pool of talent using the scheme.

The Indian Government’s Ministry of Foreign Affairs issued a statement on 20 September warning the measures are “likely to have humanitarian consequences by way of disruption caused for families”.

“Industry in both India and the US has a stake in innovation and creativity,” the ministry said.

“Skilled talent mobility and exchanges have contributed enormously to technology development, innovation, economic growth, competitiveness, and wealth creation in the United States and India”.

MORE FROM ITPRO

• Google opens doors on UK data center ahead of Trump visit
• The US government's Intel deal explained
• Tech professionals are shunning roles because of these red flags

The US government has taken a 10% stake in Intel, giving the company access to billions in funds to build factories and conduct research – but what exactly does the move mean for the ailing chipmaker?

Under the terms of the long-rumored deal, the Trump administration has bought a 9.9% stake in Intel for $8.9 billion — Reuters noted that works out to $20.47 per share, a discount of about $4 from the company's Friday closing price.

The share purchase will be paid for via two existing grants — agreed but not yet paid — awarded by the previous administration: $5.7bn from the CHIPS act and $3.2bn from the Secure Enclave program.

That doesn't include a $2.2bn tranche of the CHIPS grants that were already paid to Intel. Or, as President Trump said in a post on Truth Social: "The United States paid nothing for these shares, and the shares are now valued at approximately $11 billion dollars."

The nature of those grants requires the funding be spent in the US. Similarly, as part of the deal, the grants are converted into an equity stake, but the terms require the money to be spent inside the US in ways aligned with CHIPS and Secure Enclave.

“As the only semiconductor company that does leading-edge logic R&D and manufacturing in the US, Intel is deeply committed to ensuring the world’s most advanced technologies are American made,” said Intel CEO Lip-Bu Tan.

The deal comes amid a backdrop of a tariffs war that has hit the technology industry hard as well as long-running tensions with China.

Intel's woes

Once the dominant force in the chips market, Intel has struggled to keep up with rivals such as AMD and Nvidia, first during the shift to mobile and now with the rise of generative AI.

At the end of 2024, Intel announced billions in losses — the tech giant's first annual losses since 1986 — followed by cuts to 15% of its job force. Former CEO Pat Gelsinger departed the company after decades, with Intel eventually naming Tan as the new CEO.

Tan swiftly unveiled his own turnaround plans. That included restructuring how the company targets AI and widening its manufacturing to include external clients like rival Nvidia — but also another round of job cuts and the cancellation of chip factories planned in Germany and Poland.

Criticism of new CEO

The deal also reduces, if not resolves, Trump's ongoing — though largely one-sided — war of words with Tan.

Trump said earlier this month that Tan should resign over his ties to Chinese companies, which included hundreds of millions of dollars in investments as well as his role as CEO of Cadence Design, which recently pled guilty to selling software illegally to the Chinese military.

In a social media post, Trump wrote: "The CEO of Intel is highly conflicted and must resign, immediately." Tan replied via a note to staff that he'd always "operated within the highest legal and ethical standards," and called the criticism "misinformation."

As it turns out, there was another solution: cutting a deal.

After a meeting with the Intel CEO, Trump reportedly said of Tan: "He walked in wanting to keep his job and he ended up giving us $10 billion for the United States. So we picked up $10 billion."

That references the requirement that the money be spent investing in American manufacturing and R&D. Intel noted it is already investing more than $100bn to expand its US-based manufacturing facilities, but the money from the new deal is believed to be targeted at speeding up development at Intel's delayed Ohio plant.

Response to the deal

Intel naturally welcomed the agreement. "We are grateful for the confidence the President and the Administration have placed in Intel, and we look forward to working to advance U.S. technology and manufacturing leadership," Tan said in a statement.

In a statement provided by Intel, the deal was welcomed by luminaries from the tech industry. Microsoft CEO Satya Nadella said the deal would "benefit the country", while Dell CEO Michael Dell said he fully supports the agreement.

Dell added it was "great to see Intel and the Trump Administration working together to advance US technology and manufacturing leadership."

AWS CEO Matt Garman said: "We applaud the Trump administration’s efforts to usher in a new era of American innovation in partnership with American companies."

But the deal is not without risks for Intel. The company said in a filing there could be "adverse reactions" to the agreement from investors, employees, and even customers or suppliers, noting that 76% of Intel's sales come from outside the US.

"There could be adverse reactions, immediately or over time, from investors, employees, customers, suppliers, other business or commercial partners, foreign governments or competitors," the filing noted.

"There may also be litigation related to the transaction or otherwise and increased public or political scrutiny with respect to the company."

The deal sparked wider criticism, including one pundit claiming that "Intel should have been sold for car parts three years ago," and others calling it "right-wing socialism" and "pretty darn bonkers."

What's next?

Trump suggested similar deals may be in the pipeline. After announcing the Intel agreement, he told reporters: "I hope I'm going to have many more cases like it."

He later added on social media: "I will make deals like that for our country all day long. I will also help those companies that make such lucrative deals with the United States States [sic]."

The Intel deal follows another agreement with Nvidia and AMD, in which the rival chipmakers are allowed to sell some specific chips to China — but only if they give a 15% cut of those sales to the US government.

MORE FROM ITPRO

• The gloves are off at Intel as new CEO plots major strategy shift
• Intel needs to “get its story right” to turn things around and capitalize on the AI boom
• Intel makes high-level hires while factory workers are warned of layoffs

Cybersecurity experts have issued a stark warning after the Salt Typhoon cyber espionage group breached a US state’s National Guard network.

According to the US Department of Defense (DoD), the group breached and laid low in the compromised network for almost a year, potentially accessing sensitive military and law enforcement data.

The DoD report, released following an FOI request by the Property of the People nonprofit, details a long-running campaign that “extensively compromised” the National Guard network from March 2024 to December last year.

As part of the breach, the Salt Typhoon is believed to have collected and exfiltrated sensitive data, including configuration files for critical national infrastructure (CNI) organizations and state government agencies.

“This data also included these networks’ administrator credentials and network diagrams — which could be used to facilitate follow-on Salt Typhoon hacks of these units,” the DoD warned.

Exact details of which National Guard unit was impacted weren’t disclosed.

Salt Typhoon has previously used exfiltrated network configuration files to “enable cyber intrusion elsewhere”, the DoD report noted. Indeed, between January 2023 and March 2024, it stole 1,462 configuration files associated with 70 US government and CNI identities spanning 12 sectors.

This included organizations in energy, communication, transportation, and wastewater.

The report concluded that Salt Typhoon’s success “could undermine local cybersecurity efforts to protect critical infrastructure”.

Salt Typhoon incident raises serious questions

The incident marks the latest in a string of high-profile attacks by the Chinese-linked cyber espionage group, including attacks on US telecoms firms AT&T and Verizon.

In December last year, White House officials warned that this particular campaign saw the group access and record private conversations of “very senior” US political figures.

Gary Barlet, public sector CTO at Illumio, said the incident once again highlights the group’s proficiency and ability to compromise US government networks.

Barlet, who served as Chief of Ground Networks for the Air Force CIO, warned “all US forces must now assume their networks are compromised,” moving forward.

“Salt Typhoon's compromise of the US National Guard is a significant event and potentially poses a serious threat to many Department of Defense systems,” he said.

“The ability of groups such as Salt Typhoon to move laterally across different units and systems is why government agencies must accelerate Zero Trust adoption and go even further with a breach containment strategy,” Barlet added.

Barlet noted that this isn’t the first breach of DoD systems in recent years. There have been “numerous” instances across the public and private sectors where sensitive information has been compromised by lateral movement.

“The Ponemon Institute highlighted that 55% of organizations admitted a compromised device had infected other devices on the network,” he added.

MORE FROM ITPRO

• How Volt Typhoon eluded detection in the US electric grid for nearly a year
• Breached for years: How long-term cyber attacks are able to linger
• China cyber threats: What businesses can do to protect themselves

IDC has warned that the US government's sweeping tariffs could cut global IT spending in half over the next six months.

The research foundation said the new wave of trade tariffs will drive up technology prices, disrupt supply chains, and ultimately weaken global IT spending.

As a result, the organization said it was developing a 'downside scenario' that would reflect the possibility of a broader trade war with potential retaliatory measures from other countries.

The adjustment to a new baseline of slower growth was IDC's "new reality", it said. However, underlying demand for IT was still "high" and the likelihood of a decline in overall IT spend was low, IDC said.

"Our March 31 forecast of 10% growth for global IT spending will be reduced significantly in April, based on the tariff announcements of April 2," IDC explained in a blog post.

"The situation remains extremely fluid, and subject to new announcements or changes, but a weakening economy will lead to IT spending cuts and delays in the next six months. We will move closer to the previous downside of 5% growth, which reflects a rapid, negative impact on hardware and IT services spending."

IDC has also expressed growing concerns that it could lead to a broader economic slowdown with weaker investment by businesses and consumers. What's more, the impact is likely to unfold quickly as it could happen before any potential economic impact appears in data sheets, IDC said.

The consultancy suggested that agility would be key to navigating this period of uncertainty, warning that it could be several months of disruption before the full picture becomes clear.

US tariffs causing widespread unease

In the immediate aftermath of the tariff announcements, stock markets in the US and Asia dropped.

Companies like Meta, Nvidia, and Amazon saw stock prices fall around 5%. Apple reported a drop of 6% with the iPhone maker's products manufactured in the US, China, and India.

If the current measures announced on 2 April 2 stay in place and indeed trigger an escalation of retaliatory measures that lead to a global recession, IDC said the impact on IT spending will be swift and downward, potentially leading to the worst market performance since the 2008 financial crisis.

MORE FROM ITPRO

• Why today’s economic turmoil will build stronger startups tomorrow
• The benefits of a circular economy in tech
• The UK cybersecurity sector is worth over £13 billion, but experts say there’s huge untapped potential if it can overcome these hurdles

Meta has announced plans to build the world's longest subsea cable in a bid to supercharge global connectivity and drive AI innovation.

The cable, dubbed ‘Project Waterworth’, will be built as part of a multi-billion dollar, multi-year investment by the tech giant that will include the opening of three new oceanic corridors.

Aimed at strengthening the scale and reliability of the world’s digital highways, Meta said it will connect five continents, with landing points in the US, India, South Africa, Brazil, and elsewhere.

In a blog post co-authored by Gaya Nagarajan, Meta’s director of network engineering and global head of network investments Alex-Handrah Aimé, the duo said the project will enable "greater economic cooperation" and boost digital inclusion in these regions.

"For example, in India, where we’ve already seen significant growth and investment in digital infrastructure, Waterworth will help accelerate this progress and support the country’s ambitious plans for its digital economy."

At more than 50,000km - greater than the circumference of the Earth - Project Waterworth is set to be the longest 24 fiber pair cable project in the world.

Meta said it's also deploying first-of-its-kind routing, maximizing the cable laid in deep water, at depths up to 7,000 meters.

It plans to use enhanced burial techniques in high-risk fault areas, such as shallow waters near the coast, to avoid damage from ship anchors and other hazards - whether accidental or otherwise.

"These investments enable unmatched connectivity for our world’s increasing digital needs," said Nagarajan and Aimé.

"As AI continues to transform industries and societies around the world, it’s clear that capacity, resilience, and global reach are more important than ever to support leading infrastructure."

The company has already built more than 20 subsea cables, of which many consist of 24 fiber pairs, rather than the more usual eight-to-16. One project in which it is involved is the 2Africa subsea cable system, which at 45,000km is currently the world’s longest.

Project Waterworth welcomed by US and Indian governments

Project Waterworth has been welcomed by the Indian government in a joint statement by US president Donald Trump and the prime minister of India, Narendra Modi.

The two countries are planning to work with private industry to put forward a US-India Roadmap on Accelerating AI Infrastructure by the end of the year, looking at current constraints on financing, building, powering, and connecting large-scale AI infrastructure.

"Supporting greater Indian Ocean connectivity, the leaders also welcomed Meta’s announcement of a multi-billion, multi-year investment in an undersea cable project that will begin work this year and ultimately stretch over 50,000 km to connect five continents and strengthen global digital highways in the Indian Ocean region and beyond," the statement read.

"India intends to invest in maintenance, repair and financing of undersea cables in the Indian Ocean, using trusted vendors."

MORE FROM ITPRO

• Severed subsea cables prompt network security concerns
• Six nations partner to build subsea cable in the Pacific
• Google's Grace Hopper subsea cable lands in Cornwall

US government IT operations may be wasteful and dated, according to a report from the US Government Accountability Office (GAO).

Government IT acquisitions face major challenges and critical action is needed to implement more effective, cost-efficient solutions, the report said. The GAO offered nine actions that must be taken to make these changes.

A strengthening of oversight and management is needed, the report detailed, including improved effectiveness of those in IT leadership positions such as CIOs and chief artificial intelligence officers (CAIOs).

There needs to be a more detailed strategy for the management of IT systems and applications, and improved levels of monitoring of the performance of IT investments.

Government departments must improve IT acquisition and development practices and strengthen the management of cloud services, supply chains, and telecommunications services.

Similarly, the review called for expanded federal IT capacity and capability through workforce management, technology management, and improved digital services for federal customers.

The federal government invests over $100 billion in maintaining existing IT systems and developing new ones but, according to the GAO, these investments frequently fail, exceed budget, or go over schedule.

“The federal government is not fully reaping the benefits of modern technology to reduce costs and better serve the American people,” Gene L. Dodaro, U.S. Comptroller General and head of the GAO, said.

“As federal IT needs intensify and technologies evolve and become more complex, federal agencies must address the longstanding IT acquisition and management challenges GAO has identified since this area was designated high risk in 2015,” Dodaro added.

Legacy tech woes span both sides of the Atlantic

The US government is not alone in these issues. In the UK, one report found that legacy had been holding back public sector efficiency to the tune of £45 billion in wasted taxpayer money.

"Technology that sits at the foundation of our country has been left to wither and decay under the hands of the previous government, too often grinding to a halt and stalling essential public services – racking up a huge bill for the taxpayer," technology secretary Peter Kyle said at the time.

The report found that over 25% of digital services in UK government departments were outdated, racking up maintenance costs over three to four times higher than if systems were kept up to date.

The US government has announced $500 billion in funding as part of a huge drive to expand AI infrastructure capabilities across the country.

The ‘Stargate Project’ is a new company, backed by industry heavyweights including SoftBank, OpenAI, Oracle, and MGX as initial equity funders.

SoftBank and OpenAI are the lead partners, with SoftBank having financial responsibility and OpenAI taking operational responsibility. Softbank's Masayoshi Son will be the chairman.

Meanwhile, Arm, Microsoft, Nvidia, Oracle, and OpenAI are the key initial technology partners for the project.

The move marks one of the first major tech announcements from the new Trump administration.

"We're announcing the largest AI infrastructure project in history, and it's all taking place right here in America. As you know there's great competition for AI and other things," said President Trump.

"We want to keep it in this country. China's a competitor and others are competitors - we want it to be in this country, and we're making it available."

OpenAI said developments are already underway, starting in Texas with a one-million-square foot data center.

The firm is also evaluating potential sites across the country for more campuses as it puts the finishing touches on definitive agreements. There's expected to be an initial five sites, and eventually as many as 20.

"We will begin deploying $100 billion immediately," OpenAI pledged in a blog post.

"This infrastructure will secure American leadership in AI, create hundreds of thousands of American jobs, and generate massive economic benefit for the entire world."

Oracle, Nvidia, and OpenAI will work closely together to construct and operate the system, building on a collaboration between OpenAI and Nvidia going back to 2016, as well as a more recent partnership between OpenAI and Oracle.

Meanwhile, OpenAI already partners with Microsoft, and says it will continue to increase its use of Azure.

Trump said he would act to help streamline the planning and construction process.

"I'm going to help a lot through emergency declarations because we have an emergency, we have to get this stuff built," he said.

"They have to produce a lot of electricity, and we'll make it possible for them to get that production done very easily, at their own plants if they want, where at the AI plant they'll build energy generation."

Infrastructure expansion hopes tempered by energy concerns

While the infrastructure project has been welcomed by some industry stakeholders, others have raised concerns over the potential environmental impact.

In a LinkedIn post, Mark Nelson of Radiant Energy Group pointed out that the Stargate Project will require an enormous amount of power - and money - to run.

"Each center will want at least 6GW of firm capacity available, minimum, at all times," he said.

"I expect total power costs to run, very roughly, at $4 billion per year per Stargate, or about $100 per MWh. For reference, Microsoft is paying a bit more than $100 per MWh to get 17% of one Stargate's-worth from restarting Three Mile Island."

AI-related energy consumption has become a recurring talking point in the last two years amidst the rise of generative AI.

In particular, the strain placed on energy infrastructure has raised serious concerns, with research by Schneider Electric in December 2024 highlighting the long-term impact on regional grids.

Similar research on this topic found data centers currently consume 4.4% of American energy, and this is set to triple to 12% by 2028.

The study, conducted by the Lawrence Berkeley National Laboratory, predicted power demands for data centers will increase to between 325TWh and 580TWh in the next four years.

Cyber experts have warned UK telecommunications firms and the wider industry must be ready for a barrage of cyber attacks as the Salt Typhoon hacker group claims yet more victims in the US.

Three further companies based in the US, Charter Communications, Consolidate Communications, and Windstream, have been added to the list of telecoms organizations compromised by the Chinese state-affiliated threat actor, according to the Wall Street Journal.

In December 2024, US security officials revealed Salt Typhoon was able to record private conversations of ‘senior political figures’ after compromising major telecom firms including Verizon, AT&T, and Lumen Technologies.

At the end of the month, Verizon and AT&T announced they had successfully removed the hackers from their IT environment, insisting that their networks were secure.

Elsewhere globally, cybersecurity experts have been watching the incident unfold with bated breath, with practitioners accelerating preparations for a looming onslaught of attacks.

Speaking to ITPro, Jamie Akhtar, CEO and co-founder of CyberSmart, warned that despite Salt Typhoon’s recent focus on entities in the US, the UK and other allies should be on high alert.

“Although Salt Typhoon has focused almost exclusively on US telcos thus far, their UK counterparts should be wary. The UK has long been a key ally of the US and, as a result, it’s impossible to rule out that state-sanctioned threats like Salt Typhoon could also be turned on British firms,” he said.

Akhtar added that there are previous notable examples of Chinese state-affiliated threat actors targeting UK infrastructure in the past, such as the APT31-led attacks in 2021.

Rob Pocock, technology director at Red Helix, cautioned that firms based outside the US should not be complacent and assume such attacks will exclusively focus on US-based companies.

The US’ global allies are a particularly appealing target for state-affiliated threat groups, he warned.

“It is highly misguided to assume advanced persistent threat actors like Salt Typhoon are only interested in the US. These threat groups are just as likely to target other nations, particularly US allies,” he warned.

“All critical infrastructure organizations should continue to expect to be targeted and take proactive steps to strengthen their own security – and that of their supply chains. Supply chains are often seen as the weakest link, but organizations can significantly reduce risks by ensuring their suppliers implement robust security measures.”

UK telcos are in the firing line for Salt Typhoon and others

Pocock added that UK telecoms firms represent a prime target for threat actors at present, especially amidst the country’s ongoing 5G SA roll-out.

However, regulations governing the integrity of telecoms firms such as the Telecommunications Security Act (TSA) may help ensure the country’s communications infrastructure is better protected.

“Telcos are right in the firing line when it comes to APT groups because of their critical role in the digital world. In the UK, the ongoing roll out of 5G SA may present different or new threat vectors for these groups to try and target,” he explained.

“Fortunately, telcos in the UK are already well-positioned to address these threats, thanks to their commitments to compliance with the Telecommunications Security Act (TSA) - a regulation designed with these challenges in mind.”

He argued that, instead of introducing entirely new security protocols, the TSA “reflects best practices already enabled within the industry” and compliance would simply help reinforce these existing procedures.

This, Pocock argued, should stand UK-based telcos in good stead in the face of increasingly sophisticated external cyber threats.

“By focusing on optimized toolsets and avoiding over-complication, telcos continue to maintain a high level of security, ensuring their systems are well-protected against evolving threats.”

During a press briefing on 27 December, Anne Neuberger, President Biden’s deputy national security advisor for cyber and emerging technology, said her UK counterparts argued these regulations would have meant the attack was detected and contained far more quickly.

“[T]heir comment to me was, ‘We would have found it faster, we would have contained it faster, it wouldn’t have spread as widely and have had the impact and been as undiscovered for as long had those regulations been in place.’

“And that’s a powerful message,” she recalled.

The US Department of Health and Human Services (HHS) has proposed extensive modifications to existing standards governing how healthcare information is stored and protected in the region.

Set to be published in the Federal Register on 6 January, the changes set out by the HHS would impact the ‘security rule’ of the Health Insurance Portability and Accountability Act (HIPAA).

The HHS said the security rule is one of several HIPAA rules that protect the privacy and security of an individual's protected health information (PHI), which refers to individually identifiable health information that is maintained electronically (ePHI) or otherwise.

The proposed modifications, which would mark the first major update to the HIPAA’s security rule in over 10 years, include new requirements for healthcare organizations to implement security controls such as multi-factor authentication (MFA), network segmentation, and rigorous encryption of healthcare data.

Healthcare organizations will also be required to build an inventory of their technology assets and provide information detailing how ePHI is moved and stored within their networks.

Anne Neuberger, deputy national security advisor for cyber and emerging technology, discussed the upcoming changes at a White House press briefing on 27 December, and outlined the projected costs of implementing these measures.

She said the modifications to the security rule are projected to cost roughly $9 billion during the first year of implementation, and then a further $6 billion for years two-to-five.

Growth in US healthcare breaches prompts action

Neuberger explained that the implementation costs pale in comparison to those incurred by breaches, citing the fact two of the most serious cyber attacks on healthcare organizations in the US ever took place within the last year.

The attack on Change Healthcare, for example, which occurred in February 2024, was one of the largest data breaches ever recorded in the US, which saw the PHI of over 100 million individuals compromised by the ALPHV/BlackCat group.

The threat group was able to steal health insurance information, medical data, as well as other PII including Social Security numbers, driver’s licenses, and passport numbers.

UnitedHealth Group, the parent company of Change Healthcare, admitted to having paid the group a $22 million ransom in order to retrieve the stolen data.

“In 2023, the average cost of a breach in healthcare was $10.1 million. The two biggest healthcare breaches we have ever experienced, Ascension Health and Change Healthcare, both occurred in the last year, and you may have noted Change Healthcare noted that the cost of the breach will be approaching $800 million in the cost of recovery and the cost of operations, and, frankly, in the cost to Americans’ healthcare data and the operations of hospitals affected by it.”

The HHS noted that since its publication in 2003, and revision in 2013, there have been a number of “significant changes to the environment in which healthcare is provided and how the health care industry operates”, adding that cybersecurity is a concern for “every facet of modern health care”.

As a result, it said an alarming growth in serious breaches affecting US citizens’ healthcare information and a “rampant escalation of cyberattacks using hacking and ransomware” required an update to the current security standards governing this data.

“The Department is concerned by the increasing numbers of breaches and other cybersecurity incidents experienced by regulated entities. We are also increasingly concerned by the upward trend in the numbers of individuals affected by such incidents and the magnitude of the potential harms from such incidents.”

Regulated entities will be required to comply with the modified security rule under the HIPAA within 60 days after publication, expected to be 6 January 2024.

The US government is reportedly considering a ban on TP-Link routers after continued breaches and security flaws associated with the devices.

A report from the Wall Street Journal has revealed the US authorities including the Commerce, Defense, and Justice departments are independently investigating whether the firm poses a national security risk.

The sale of TP-Link routers in the US could be prohibited within the next year, sources familiar with the matter told the WSJ, adding that the Commerce Department had already subpoenaed the firm.

The firm, founded in China, controls approximately 65% of the US market for routers used in households and small businesses, according to the report, with many TP-Link devices also used in federal agencies including the Department of Defense.

The action comes after compromised TP-Link devices were found to have been involved in a series of password spray attacks targeting think tanks, government organizations, NGOs, law firms,and the defense sector’s industrial base.

US agencies have raised their frustration over the company’s purportedly lax attitude towards the security of their devices, telling the WSJ that “TP-Link routers are routinely shipped to customers with security flaws, which the company often fails to address”.

The sources added that although routers are often found with bugs, and this extends beyond solely TP-Link devices, the company has routinely failed to cooperate with security researchers who flag issues linked to their products.

A spokesperson for the TP-Link told the WSJ the firm would continue to engage with the US authorities to show it is committed to the integrity of its devices.

“We welcome any opportunities to engage with the U.S. government to demonstrate that our security practices are fully in line with industry security standards, and to demonstrate our ongoing commitment to the U.S. market, U.S. consumers, and addressing U.S. national security risks,” the spokesperson said.

TP-Link devices linked to password spraying campaign

In October, Microsoft published a report on a Chinese threat actor, tracked as Storm-0940, using a covert network of compromised TP-Link routers to eventually launch password spray attacks.

The network, dubbed CovertNetwork-1658, was used to conduct brute-force attacks on Microsoft 365 accounts, VPNs, and SSH accounts in a bid to steal credentials.

The network was then used to launch widescale password spraying attacks using the stolen credentials. Microsoft said it had observed an average of 8,000 compromised devices “actively engaged in the CovertNetwork-1658 network at any given time”.

Microsoft added that the network was mostly made up of cracked TP-Linke devices, noting about 20% of the huge network could be used to perform password spraying at any moment.

“Any threat actor using the CovertNetwork-1658 infrastructure could conduct password spraying campaigns at a larger scale and greatly increase the likelihood of successful credential compromise and initial access to multiple organizations in a short amount of time.”

The incoming Trump administration will likely be faced with the option to pursue action against the company. If banned, it would constitute the most significant action against a Chinese telecom equipment manufacturer since the Trump administration banned the use of Huawei hardware in US infrastructure.

The Biden administration has proposed new know-your-customer requirements on US cloud companies for clients looking to use American infrastructure to train their AI models.

The proposed controls will include obligations on cloud computing businesses to determine whether foreign entities are accessing US data centers to train AI models.

In an interview with Reuters, US secretary of commerce Gina Raimondo named Chinese competition as a particular focus for the regulation, referencing the US’ continued efforts to stop the export of Nvidia’s AI chips to the region.

“We can't have non-state actors or China or folks who we don’t want accessing our cloud to train their models … those chips are in American cloud data centers so we also have to think about closing down that avenue for potential malicious activity”, Raimondo explained.

In addition to restricting China’s access to the chips that underpin the computing power required for training AI models, the US also needs to ensure its own infrastructure is not being used to train Chinese AI models. 

“[The US is] trying as hard as we can to deny China the compute power that they want to train their own [AI] models, but what good is that if they go around that to use our cloud to train their models?”

China indicated its appetite to build and deploy AI models within the country through an announcement from the state regulators approving over 40 new AI models for public use.

Under the new proposal US cloud computing companies such as AWS, Google, and Microsoft will be required to verify the identity of foreign customers who have accounts that utilize cloud services in the US. It was released on Friday 26 January for public inspection and scheduled to be published on Monday 29 January.

“Parochial” approach to cloud platforms could hurt competitiveness

Jeff Watkins, chief product and technical officer at digital transformation consultancy XDesign told ITPro the proposal could have unintended effects such as the proliferation of US-based ‘umbrella companies’ used by China to circumvent the restrictions and access cloud computing services in the region.

“This move might inadvertently encourage the emergence of umbrella companies in the US, allowing countries like China to bypass these new regulations through virtual private networks (VPNs) or similar methods.”

Watkins also voiced concerns that this could drive customers away from US cloud computing services, which would hurt the domestic business and drive revenues for foreign competitors.

“I think it’s a very parochial kind of approach to using the US's cloud platforms, and it could just end up with people moving to non-US data centers - so it may be good news for alternative infrastructure providers,” Watkins explained.

“Additionally, this policy may reduce the global competitiveness of the US cloud services, particularly if such stringent measures aren't adopted globally. Providers are likely to face increased costs due to the need for enhanced monitoring and reporting systems, which will almost certainly translate to higher expenses for end-users.”

A US government IT contractor has been handed two espionage charges due to allegations of passing state secrets to a foreign government. 

Abraham Teklu Lemma, a naturalized US citizen of Ethiopian descent, faces three charges related to the alleged gathering or delivery of national defense documents to aid a foreign government, the Department of Justice (DoJ) said.

Lemma also faces charges of unauthorized possession of national defense information and “willfully retaining” said materials. 

Both espionage charges carry a potential death sentence, according to prosecutors, or “any term of years up to life”. 

The retention charge also carries a maximum sentence of ten years, court filings showed. 

According to court documents, Lemma worked as an IT administrator for the Department of State and as a management analyst for the DoJ. 

During his tenure at both government departments, he was granted ‘top secret’ security clearance and access to classified systems. 

Prosecutors claimed that between December 2022 and August 2023, Lemma made copies of classified information and was able to remove the markings from documents that made clear they were classified.

“Lemma then removed the information, which was classified as ‘secret’ and ‘top secret’, from secure facilities at the Department of State against protocol,” prosecutors said.

“Lemma accessed, copied, removed, and retained this information without authorization.”

Prosecutors did not divulge the content of the documents, but it was revealed that materials allegedly stolen by Lemma related to a “specific country and/or geographic region”. 

According to CBS News, the unnamed country is believed to be Ethiopia. 

Investigators said that Lemma made “several trips” to Ethiopia, and has family contacts in the country. 

Lemma is also accused of having used an “encrypted application” to send the stolen classified material, which related to national defense, to a contact believed to be tied to the intelligence service of the officially unnamed country.

“In these communications, Lemma expressed an interest and willingness to assist the foreign official in providing information,” court filings stated. 

“In one communication, the foreign official stated, “[i]t’s time to continue ur support.”  Lemma responded, ‘Roger that’.”

Lemma’s charges mark the second cyber espionage-related incident involving US government IT workers in the space of a year. 

In September 2022, Jareh Sebastian Dalke, an information systems security designer at the National Security Agency (NSA) was also charged with transmitting classified national defense information to a representative of a foreign government. 

Between June and July 2022, Dalke used an encrypted email account to transmit excerpts of three classified documents to an individual he believed worked for a foreign intelligence agency. 

The individual in question, however, was an undercover FBI agent, court documents revealed. 

“Dalke told that individual that he had taken highly sensitive information relating to foreign targeting of US systems and information on US cyber operations, among other topics,” prosecutors said at the time. 

Public companies will be held to far stricter reporting standards around cyber security incidents after the Securities and Exchange Commission passed rules which require disclosure of events within four days.

The new ‘Form 8-K’ requirements compel companies to report any cyber security incident they consider material within four business days of being discovered and give detailed insight into its timing, scope, nature, and impact.

All businesses will also be required to annually file information on their cyber security risks, strategy, governance, and any potential or prior incidents under a new item in Regulation S-K, the piece of regulation that lays out SEC filing requirements.

Foreign private issuers, meaning foreign companies with fewer than 50% of their voting securities in the hands of non-US residents, will be held to the same disclosure standards.

“Whether a company loses a factory in a fire – or millions of files in a cyber security incident – it may be material to investors,” said SEC Chair Gary Gensler. 

“Currently, many public companies provide cyber security disclosure to investors. I think companies and investors alike, however, would benefit if this disclosure were made in a more consistent, comparable, and decision-useful way. Through helping to ensure that companies disclose material cyber security information, today’s rules will benefit investors, companies, and the markets connecting them.”

Required information in the annual 10-K reports includes the measures being taken by organizations to identify and prevent cyber security threats, the board of directors’ oversight, and management’s handling of cyber security risks.

The changes are due to take effect within 30 days of the release’s publication in the federal register, while the four-day reporting window will take effect 90 days after this publication or 18 December 2023, whichever is later.

Annual reports will be required from fiscal years ending on or after 15 December 2023.

The US Attorney General can delay the deadline of four business days for reports by up to 30 days in situations where the disclosure of the information has been deemed to pose a “substantial risk” to either public safety or national security.

A longer, 60-day delay is also allowed for in the final rule [PDF] in “extraordinary circumstances but requires notification in writing from the Attorney General. Beyond this point, the SEC reserves the right to grant additional delays on a case-by-case basis.

Commissioner Hester M. Peirce dissented against the final rule, and described it as a “test run for future overly prescriptive, overly costly disclosure rules covering a never-ending list of hot topics”.

Commissioner Peirce also suggested that threat actors could use the 8-K requirements to gain insight into businesses’ cyber security measures, as well as to identify lucrative targets for ransomware by probing reports for firms that indicate they stand to lose a lot in attacks.

The US has been behind countries in Europe on the matter of timely data breach notification for years. The GDPR introduced the mandatory 72-hour window for organizations to inform their nation’s data protection authority in 2018, and the UK has retained this even after leaving the EU.

Like the US’ new rules, exceptions can be granted in exceptional circumstances but failure to adequately report a breach can land organizations with sizeable fines of €10 million or 2% of a company’s annual revenue.

Fines are often a last-resort tactic used by regulators who generally agree that their primary role is to raise the quality of data protection and response to incidents rather than freely punishing offences.

The 72-hour window was introduced to improve the rights afforded to residents of countries bound by the GDPR’s rules, as well as raise corporate standards of data protection generally.

Until now, most organizations in the US have not been bound by such rules, bar some exceptions.

The Cyber Incident Reporting Act of 2022 requires organizations responsible for critical national infrastructure (CNI) to report cyber attacks to Cybersecurity and Infrastructure Security Agency within 72 hours from the time they believe the incident took place.

Notice of ransomware payments must similarly be made within 24 hours, and CISA holds the right to subpoena organizations that do not submit timely reports.

Private companies have less clear reporting guidelines, and as deadlines vary state by state there is often uneven insight into the threat landscape at a federal level.

Colorado requires firms to notify Colorado residents within 30 days of an incident occurring, and the state’s Attorney General if more than 500 residents are notified.

In contrast, Alabama only requires individuals involved in breaches to be notified if it’s found that it likely caused them significant harm.

Information security experts have called for a standardized information-sharing framework, to ensure companies not only provide timely reports but also give more detailed insight into attacks than the bare minimum.

The absence of mandatory reporting windows in the US has led to some cases where organizations that have suffered major breaches have been legally allowed to delay disclosure indefinitely, despite many of their clients and stakeholders being affected.

In 2021, GoDaddy took two months to disclose its data breach which exposed the names and email addresses of up to 1.2 million of its users, past and present.

Uber’s CSO infamously covered up a 2016 hack on the company, which exploited the same vulnerability as a separate 2014 attack. The incident saw the theft of the names and email addresses of 50 million users and 7 million drivers.

Allegations at the time of the cover-up’s discovery in 2017 also focused on an alleged $100,000 payment made by then-CSO Joseph Sullivan to the hackers in return for their silence.

Found guilty earlier this year, Sullivan is now serving a three-year term of probation and has been ordered to pay a $50,000 fine.

The White House has published the first implementation plan for its National Cybersecurity Strategy, which aims to improve the strength of the software supply chain and increase public-private collaboration.

Improving the resilience of the market is a key focus, with efforts to establish a long-term software liability framework and reduce gaps in software bills of materials (SBOMs) to ensure unsupported software is not used for critical infrastructure.

The Cybersecurity and Infrastructure Security Agency (CISA) will work with the private sector, non-profits, the open-source community, and academia to establish secure-by-design software and hardware.

In a fact sheet, the White House stated the plan ensures “the biggest, most capable, and best-positioned entities – in the public and private sectors – assume a greater share of the burden for mitigating cyber risk”.

Private sector firms will fall under further requirements laid out by CISA in an effort improve the speed and cohesiveness of reporting following cyber incidents. 

Vendors that knowingly provide deficient cyber security products or services will also be pursued more heavily under the False Claims Act.

A Federal Cyber Insurance Backstop, which would see the government provide assistance in the event of a catastrophic incident, is also under consideration. The plan notes that such a scheme could support an uncertain cyber insurance market.

This initiative is expected to reach completion by Q1 2024, though the plan could be revised at a later date depending on the outcome of the talks.

By the end of 2023, the Office of Management and Budget will lay out stricter Federal Acquisition Regulation (FAR) requirements for the procurement and labeling of Internet of Things (IoT) devices.

For future resilience, the government will invest heavily in the research and development of memory-safe programming languages as well as quantum-resistant cryptographic algorithms which will be necessary to protect encryption in the near future.

The plan is structured around five ‘pillars’, under which lie more than 65 initiatives for improving the federal, public, and private cyber security landscape. 

• Defending Critical Infrastructure
• Disrupting and Dismantling Threat Actors
• Shaping Market Forces and Driving Security and Resilience
• Investing in a Resilient Future
• Forging International Partnerships to Pursue Shared Goals

The White House described the plan as a “living document”, which will be updated annually in line with evolving needs and ambitions for US cyber defense.

On threat actors, the Office of the National Cyber Director is set to work with federal partners as well as those in the private sector to find ways in which existing systems can be used to disrupt cyber criminals.

The document also assigns the Department of State and the Joint Ransomware Task Force (JRTF) to “defeat ransomware” by disrupting the worldwide threat ecosystem.

Ransomware gangs such as LockBit have been in the crosshairs of international law enforcement in recent months. The Department of Justice (DoJ) has ramped up arrests against alleged members of the group, and put out a $10 million bounty for another in May.

CISA, along with JRTF, will also provide training, analysis, planning, and incident response services to private and public sector organizations that oversee critical national infrastructure.

“The National Cybersecurity Strategy Implementation Plan (NCSIP) gives much-needed guidance for agencies on improving cyber resilience,” said Gary Barlet, Federal CTO at Illumio.

“It assigns timebound goals and initiatives to each agency – giving them direction on how to reach the strategy’s clear objectives. These goals and initiatives also display a sense of urgency, which is important, as the pace of technology makes it impossible to imagine the impact it will have on security in three, five, or ten years. It focuses on building cyber resilience now as well as down the road. 

“This plan reflects the urgency of today’s cyber threats, and also demonstrates an understanding of the resource and fiscal challenges agencies face in overcoming these dangers. While the NCSIP doesn’t include direct funding, it does align with the administration’s cyber budget priorities to better position agencies to achieve their objectives and combat cyber attacks. 

“If agencies can align their budgetary responsibilities and resources with these initiatives, then they will be well equipped to bolster their cyber resilience today and tomorrow.”

The Department of Justice (DoJ) has charged a Russian man over his links to major ransomware groups, offering a $10 million award for information that assists his arrest.

Mikhail Pavlovich Matveev, a 30-year-old Russian national, was charged over intentionally damaging protected computers, as well as conspiracy to damage protected computers and to transmit ransom demands. 

He is alleged to have helped deploy the LockBit, Hive, and Babuk ransomware variants to extort money from US and international organizations.

According to the FBI, Matveev is known to have links to both Kaliningrad and St. Petersburg in Russia, where he is understood to reside.

It has long been established that cyber criminals operating in Russia will escape criminal penalties, providing they don’t attack the Russian government or any organizations operating in the country.

Many ransomware groups operate out of Russia due to these ‘safe harbor’ protections. They often never leave the country due to fears of being arrested in territories that have extradition agreements with major powers in the West, and rarely meet criminal punishments as a result.

The DoJ has alleged that on or around 25 June 2020, Matveev and other LockBit operators used the ransomware strain against a New Jersey-based law enforcement agency.

It additionally linked him to a 2021 Babuk attack on the DC police department

“From his home base in Russia, Matveev allegedly used multiple ransomware variants to attack critical infrastructure around the world, including hospitals, government agencies, and victims in other sectors,” said Assistant Attorney General Kenneth A. Polite, Jr. of the Justice Department’s Criminal Division. 

“These international crimes demand a coordinated response. We will not relent in imposing consequences on the most egregious actors in the cyber crime ecosystem.”

In its official wanted notice for Matveev, the FBI listed his known aliases as ‘Wazawaka’, ‘Boriscelcin’, ‘m1x’, and ‘Uhodiransomwar’.

Any individual in possession of information that leads to Matveev’s arrest or conviction has been urged to submit a tip to the FBI. 

The FBI’s Newark Field Office Cyber Crimes Task Force has been put in charge of the case in coordination with a number of European agencies, including the UK’s National Crime Agency.

What are LockBit, Hive, and Babuk?

Both LockBit and Hive are ransomware as a service (RaaS) groups are known for following a double extortion method and are among the most notorious in operation.

The Babuk group is now believed to have retired, but at its peak was linked to attacks such as one on NHS outsourcing firm Serco, and received up to $13 million in paid ransoms.

The DoJ has estimated that victims have paid the three groups a combined $200 million in ransom over the years.

LockBit made headlines in recent months for an attack against Royal Mail International, for which it initially demanded and $81 million  (£65 million) ransom.

Following talks, LockBit leaked 44GB of the firm’s data including salary information, contracts, and vaccine records, and lowered its ransom to $41 million (£33 million).

It has targeted firms such as digital transformation company Orion Innovation and in December attacked a Canadian children’s hospital, an act for which it issued a rare apology and provided a free decryptor.

After falling prey to DDoS attacks, the group had pledged to be ‘more aggressive’ and its strain LockBit 3.0 accounted for 35% of all ransomware activity in Q3 2022.

Hive has been linked to a range of high-profile security incidents in the last year, including an attack on French telco giant Altice, the encryption of systems at Indian energy leader Tata Power, and a widespread assault on Costa Rican healthcare systems. 

Microsoft warned in July 2022 that Hive’s new variant was more sophisticated, having adopted the programming language Rust in its payload executable for improved memory safety and efficiency.

In January, the FBI confirmed a takedown of Hive ransomware operations, though this was deemed unlikely to have lasting effects.

A data breach at the US Department of Transportation (USDOT) has exposed the data of 237,000 former and current federal employees.

The breach was found to have affected USDOT’s TRANServe system for employee commuting reimbursement, which contains personal data pertaining to government workers.

USDOT stressed that no wider transport systems are linked to TRANServe, and no criminal use of the data has been detected at present.

Congress was made aware of the incident via email on 12 May, and USDOT has frozen access to the system while an investigation is underway.

Reuters reported that within the email, USDOT wrote it had "isolated the breach to certain systems at the department used for administrative functions, such as employee transit benefits processing”.

Almost half of those affected still work at the USDOT, with 114,000 current employees affected by the breach in addition to 123,000 former employees.

Federal branches are often subject to cyber security incidents due to the sensitive nature of information stored in their databases.

In January, the Cybersecurity and Infrastructure Security Agency (CISA) stated that federal civilian executive branch (FCEB) agencies had been targeted as part of a phishing campaign that went undetected for months.

Threat actors had socially-engineered victims into opening malicious links over the phone, under the false claim that they had a financial claim to address.

CISA has engaged in an aggressive internal campaign to tighten cyber security across federal computer systems.

In October 2022 it issued new vulnerability detection orders requiring FCEB agencies to perform weekly checks on assets, and fortnightly vulnerability enumeration with results shared on the same regular basis.

CISA frequently updates its list of exploited vulnerabilities, through which it keeps federal agencies appraised of active cyber threats that require immediate mitigation to avoid.

Well-known vulnerabilities such as Log4Shell are often behind attacks on federal systems in the past year, with Iranian state-sponsored hackers discovered to have breached a federal agency in February 2022.

Despite having been discovered in December 2021, Log4Shell issues continue to plague businesses with research by cyber security firm Tenable having found that 72% of firms sre still vulnerable to the vulnerability.

The US government has announced plans to invest $500 million to transform cities in ‘America’s heartland’ into regional ‘tech hubs’. 

The Regional Technology and Innovation Hubs (Tech Hubs) program aims to drive innovation, unlock economic opportunities, and bolster cross-sector collaboration between industry, the education sector, and local and state governments.

Hubs created as part of the program will focus on developing a range of technologies, including artificial intelligence (AI), robotics, biotechnology, cyber security, and more. 

This first notice of funding opportunity will see applications opened for planning grants and Tech Hubs designations, the DoC confirmed. A second stage for applications is expected to launch later this year. 

The Tech Hubs program was authorized through the CHIPS and Science Act, and will see up to $10 billion in total set aside for development of sites and programs across the country. 

The first batch of $500 million will be designated for initial planning grants, while individual grants of up to $75 million will be awarded later in the year to support expansion of the hubs. 

Driving regional innovation

US secretary of commerce, Gina Raimondo, said the launch of the new hubs will deliver economic benefits for regions in the US that have been “historically overlooked”. 

“The Tech Hubs program is a critical piece of President Biden’s Investing in America strategy, and will help us create ecosystems of innovation to strengthen economic opportunity in communities around the country that have historically been overlooked,” she said. 

“We’re going to do that by supercharging our existing innovation foundations, bringing together our premier research institutions with world class companies to create good-paying jobs in these communities, and ensuring the technological advances that define the next century are made in communities across America.”

In a briefing call with reporters last week, Raimondo said the focus on historically overlooked states will spur economic growth and play a key role in addressing the traditional Silicon Valley-centric flow of venture capital. 

Raimondo told reporters that around 80% of US venture capital funding is invested in Northeast and Southern California, as well as the San Francisco Bay Area. 

“There’s so much more potential for tech innovation all across the country,” she said. 

“In the US, we have the best research institutions in the world. That’s indisputable. And frankly, many of them are in America’s heartland.”

Regional support ecosystems

The Tech Hubs program bears similarities to other government-backed programs launched elsewhere globally as administration’s seek to bolster regional support for areas traditionally left behind amid the tech boom. 

The UK government, for example, has signaled its intention to tackle a ‘London-centric’ mindset with regard to venture capital funding and support for tech companies and entrepreneurs. 

In the Spring Statement this year, chancellor Jeremy Hunt unveiled plans to invest £100 million ($125 million) in R&D projects across the country through the Innovation Accelerators program. 

The initiative was framed by the government as a new approach aimed at supporting individual city regions to enhance global competitiveness and create a more level playing field for regions across the country. 

The White House has set its sights on a long-running collaboration involving AI leaders in the private sector to ensure the rapidly developing technology remains safe and ethical.

Big Tech CEOs attended a meeting on Thursday, with both President Joe Biden and Vice President Kamala Harris in attendance, which concluded with them committing to responsible AI development.

Vice President Harris welcomed Sam Altman, CEO at OpenAI, Dario Amodei, CEO at Anthropic, Satya Nadella, chairman and CEO at Microsoft, and Sundar Pichai, CEO at Google and Alphabet, to discuss current market approaches to AI.

Both Harris and Biden sought to impress the importance of risk-prevention strategies in AI development and achieved a commitment from the CEOs to continue to engage with the Biden administration on this.

Coinciding with the announcement of the meeting and the results of it, the National Science Foundation has also officially allocated $140 million in funding to seven new national institutes for AI research will work with federal agencies, industry bodies, and higher education institutes to develop ethical and trustworthy AI solutions.

“President Biden has been clear that when it comes to AI, we must place people and communities at the center by supporting responsible innovation that serves the public good, while protecting our society, security, and economy,” read the White House statement.

“Importantly, this means that companies have a fundamental responsibility to make sure their products are safe before they are deployed or made public.”

The Biden administration has pointed to AI R&D as critical to approaching problems such as cyber security, energy, climate change, and education.

In recent months, generative AI has seen rapid growth through chatbots such as ChatGPT and Bard but has also prompted concerns.

Academic institutions have struggled with the lack of tools to detect AI-generated text, and notable tech pioneers called for a six-month pause of AI development in March over safety concerns.

US lawmakers have begun to explore “accountability measures” for AI, with the National Telecommunications and Information Administration (NTIA) set to launch a public consultation on AI services to inform White House policy.

The Office of Management and Budget has also announced that it will publish draft policy on the potential for AI systems to be used by federal departments and agencies. 

It is hoped that public comment on this draft, combined with an eventual model for federal implementation, could set a precedent for responsible AI use that can be replicated throughout the industry and in state and local governments.

Experts have advised AI firms to adopt greater transparency to avoid future regulatory penalties, particularly given that the EU’s AI Act has sought to place more responsibility on developers for misuse of their AI models.

The bloc’s latest draft of its long-awaited AI legislation also aims to shield businesses from IP theft, as well as set out clear guidelines for the AI systems that pose a risk to human rights such as those used for live facial recognition.

AI firms are increasingly under pressure to conform to regulatory requirements in the EU, with the recent case of Italy banning ChatGPT over GDPR concerns standing out as an early indication of the penalties that could be leveled against tech companies in the near future.

OpenAI has been told it needs to implement ‘right to be forgotten’ controls for ChatGPT in order to be allowed back to Italy, and EU data protection regulators could follow this example for other AI chatbots.

Lawmakers in the US are set to explore potential “accountability measures” for companies developing artificial intelligence (AI) systems such as ChatGPT amid concerns over economic and societal impacts. 

The National Telecommunications and Information Administration (NTIA), the US agency which provides advice to the government on technology policies, said it will launch a public consultation on AI products and services. 

According to the NTIA, insights gathered from this consultation will help inform the Biden administration to develop a “cohesive and comprehensive federal government approach to AI-related risks and opportunities”. 

“NTIA’s ‘AI Accountability Policy Request for Comment’ seeks feedback on what policies can support the development of AI audits, assessments, certifications, and other mechanisms to create earned trust in AI systems that they work as claimed,” the department said in a statement on Tuesday. 

In its statement, the NTIA said that potential audits of AI systems could work in a similar fashion to those conducted in the financial services industry to “provide assurance that an AI system is trustworthy”.

NTIA administrator Alan Davidson said the consultation will help inform the US administration’s long-term approach to AI products and prevent or mitigate any adverse effects. 

“Responsible AI systems could bring enormous benefits, but only if we address their potential consequences and harms. For these systems to reach their full potential, companies and consumers need to be able to trust them,” he said. 

“Our inquiry will inform policies to support AI audits, risk and safety assessments, certifications, and other tools that can create earned trust in AI systems.”

Concerns over AI's growth

The move from the NTIA follows mounting concerns about the potential impact of generative AI systems such as ChatGPT. 

The rapid advent of generative AI products has prompted a degree of hesitancy among lawmakers on both sides of the Atlantic. 

In late March, Italy announced a shock ‘ban’ on ChatGPT amid data privacy concerns. 

The Italian data protection authority voiced serious concerns about the generative AI model and said it plans to investigate OpenAI “with immediate effect”. 

Lawmakers elsewhere in Europe are also thought to be exploring a potential crackdown on AI systems, with German authorities among those cited as having serious concerns. 

While lingering worries over generative AI products such as ChatGPT continue, some industry analysts described the Italian decision as an “overreaction”, saying that such crackdowns could have negative long-term implications for companies in the country exploring the use of AI. 

Andy Patel, researcher at WithSecure, told ITPro that Italy’s decision had essentially “cut off” one of the most transformative tools currently available to businesses and individuals. 

Industry stakeholders have also voiced a growing discontent over the speed of generative AI development. 

Around the time of Italy’s ChatGPT decision, an open letter penned by tech industry figures including Elon Musk called for an immediate halt to “out of control” AI development. 

The controversial letter demanded a six-month pause be imposed on companies building generative AI models and argued that there is a concerning lack of corporate and regulatory safeguards currently in place to moderate generative AI development. 

The IRS accidentally republished 112,000 taxpayer data records in November after they were initially published as a result of a technical error earlier this year.

Blame for the incident has reportedly fallen on an outside contractor working on behalf of the IRS and tasked with managing a database for the government department.

The incident relates to the upload of 990-T forms which contain private information used by tax-exempt entities, including government entities and retirement accounts, to pay income tax on income that comes from specific investments or that which is unrelated to their exempt purpose, according to a letter sent to congressional leaders, Bloomberg Tax reported.

In September 2022, the IRS said that some Form 990-T data had been made available for bulk download in its Tax Exempt Organization Search (TEOS), which shouldn't have been made public. At the time, it removed the files and was set to replace them with updated files in the future.

However, this time a contractor reuploaded older files to the database with the original data, instead of new ones which ensured the forms were set to be kept private. The IRS had given the corrected data to the contractor on 23 November, but the contractor had not removed the old files from their system.

The IRS was only made aware of the files being available again on their website when a third-party researcher reached out. The IRS then told the contractor to remove them immediately.

Around 104,000 of 106,000 forms previously shared in September were reuploaded to the site. Some forms contained names or business contact information, and the IRS is currently contacting people affected by the data breach. When more than 100,000 forms suffer a disclosure, the IRS is forced by the law to inform Congress.

The revenue service is also reportedly reconsidering its relationship with contractor Accenture on this project. IT Pro has contacted the company for comment.

“The IRS is continuing to review the situation to identify opportunities to establish additional controls and strengthen existing controls to protect taxpayer information,” said US Treasury spokesperson John Rizzo.

The US' Department of Justice (DoJ) has begun the seizure of 48 DDoS-for-hire services and brought criminal charges against six individuals involved.

Also involved in the operation is the FBI which was granted approval to take control of the websites as part of a wider international anti-cyber crime operation, the DoJ revealed on Wednesday.

The six arrested defendants allegedly oversaw cyber attacks launched from platforms known as booters. These are services which boot, or drop, a targeted computer from the internet. The services allegedly attacked millions of individuals in the US and around the world, including government agencies, gaming platforms, and educational institutions. The DoJ said that the attacks can also degrade internet services and disrupt connections.

Each defendant allegedly operated at least one site that offered services and subscriptions to booter services, said the DoJ. In each case, the FBI masqueraded as a genuine client and carried out test attacks to confirm the sites functioned as advertised.

Criminal charges have been filed against two defendants in Alaska: John M. Dobbs who allegedly operated IPStressor.com, and Joshua Laing who allegedly operated TrueSecurityServices.io.

In Los Angeles, four defendants have had criminal charges filed against them. Jeremiah Sam Evans Miller was accused of running RoyalStresser.com, Angel Manuel Colon Jr. allegedly ran SecurityTeam.io, Shamar Shattock allegedly operated Astrostress.com, and Cory Anthony Palmer, who was accused of running Booter.sx.

Millions of DDoS attacks were launched from the websites involved, targeting victims across the world, said the DoJ. Some of the services offered “stresser” services which the websites claimed were used for network testing. However, the FBI found that this was a pretence as the site admins and customers are aware that the customer is not attempting to attack their own computers.

“These DDoS-for-hire websites, with paying customers both inside and outside the United States, facilitated network disruptions on a massive scale, targeting millions of victim computers around the world,” said Antony Jung, the FBI special agent in charge of the case.

“Potential users and administrators should think twice before buying or selling these illegal services. The FBI and our international law enforcement partners continue to intensify efforts in combating DDoS attacks, which will have serious consequences for offenders.”

The arrests were made through work carried out in Operation Power OFF, an internationally coordinated effort between law enforcement agencies aiming to take apart DDoS-for-hire schemes across the world.

Other agencies provided the DoJ with assistance in the operation including the UK's National Crime Agency (NCA), Netherlands Police, Europol, and the Brandon Police Service in Canada. It also received support from companies in the private sector including Akamai, Cloudflare, Oracle, Google, Palo Alto Networks, Paypal, as well as the University of Cambridge.

According to the department, the coordinated law enforcement action took place before the holiday period, which usually sees an increase in DDoS attacks across the gaming world.

“Whilst I don’t think that this is insignificant, I do not believe that it will have that much effect on the use of companies like this to perform DDoS attacks,” said Leon Teale, senior penetration tester at IT Governance to IT Pro. “Overall, these site organisers who offer this service know full well the intent of its use and do so regardless of it being illegal and unethical.”

Teale said that the fact the FBI has managed to shut down the companies is simply a statistics game, as users that pay for the services will move to another.

“I suspect there will be a drop in DDoS attacks because of these sites shutting down, but I can’t imagine it will put much of a dent in the overall number of attacks that go on each day across the world,” he added.

At the same time, the FBI, the NCA, and the Netherlands Police have released an advertising campaign to deter potential cyber criminals from using DDoS services. The campaign is in the form of a targeted placement ad which appears in search engines and is triggered by DDoS keywords.

A total of $20 million in US government funds intended for coronavirus relief were stolen by Chinese state-sponsored hackers, according to the US secret service.

It believes that the threat group, tracked as APT41, operated more than 2,000 accounts across its fraud operation, which began in 2020. The group is known for taking advantage of victims who have not yet implemented crucial security updates, especially after their details have been shared by public bodies such as the Cyber security and Infrastructure Security Agency (CISA).

Money intended for businesses and unemployed workers through a variety of government programmes was found to have been stolen by the fraudsters, the first time fraud of this nature has been linked, directly or indirectly, to a foreign state.

The discovery has raised serious questions around national security, and whether or not the group acted for profit or with government backing.

The total amount of money stolen through improper payouts of government COVID funds is unknown. Estimates range from $80 billion to more than $500 billion, of which only a small amount has been recovered or accounted for at the time of writing.

More than a thousand investigations are ongoing, with APT41 and other international actors under scrutiny.

NBC News cited anonymous officials as having indicated that state-backed hackers are seemingly involved in a number of ongoing federal fraud investigations, while investigators have previously indicated that a majority of the stolen funds were taken overseas and will therefore be difficult to track.

In August, the US secret service announced that it had recovered around $286 million, and the agency has since stated that a total of $1.4 billion in illicitly-acquired funds intended for small businesses have been accounted for.

The variety of pandemic schemes for businesses, including the Economic Injury Disaster Loans (EIDL) and Paycheck Protection Program (PPP), increases the difficulty in recovering the funds due to the varied sources.

Five Chinese nationals have been indicted as part of the investigation efforts, though no extradition process has been undertaken.

APT41 is a widely tracked threat actor with a long record of incidents. Cyber security firm Mandiant, for example, this year discovered that APT41 compromised six US government networks since the start of 2021, utilising vulnerabilities such as the Log4Shell flaw.

At the time, researchers were unable to establish a specific motive, but noted that the group has worked for profit in the past. In 2020, the US Department of Justice (DoJ) charged APT41 members with computer intrusions into more than 100 victims in the United States and overseas. These included: software development companies, hardware manufacturers, video game companies, and more.

Concerns over breaches by groups such as APT41 have led to a tightening of security across US government agencies. CISA now requires agencies to patch recent exploits within two weeks of being discovered, and Congress has passed a bill that would ban the Department of Defense (DoD) from vulnerable software.

“If we can come together and really have open and honest conversations about what works well and what went very wrong, we would just be in a much better place to stop this,” Maryland labour secretary Tiffany Robinson told NBC News. “Because this is not over.”

Cyber crime increased noticeably across the pandemic, as fraudsters and threat actors took advantage of newfound hybrid working patterns, the increase of online deliveries, and government funding schemes for their own means. Account takeover fraud rose 2.8 times across the pandemic, and delivery fraud became the most common form of smishing.

Fraud detection and prevention is a rapidly-growing market, and according to a report by Acumen Research and Consulting its value is due to hit $176 billion by 2030.

The US government is set to outline its plans for providing over $42 billion of broadband infrastructure grants to states and territories, in an effort to provide high-speed internet access nationwide.

President Joe Biden’s administration has said that by June 30, it will lay out its strategy for allocating the $42.45 billion in funds provided through its Broadband Equity, Access, and Deployment (BEAD) Program.

This is encompassed within the 2021 Infrastructure Investment and Jobs Act (Bipartisan Infrastructure Bill), which provided $1.2 trillion in spending across a range of areas such as transportation, highways, broadband, water and the electric grid.

The BEAD Program is specifically focused on ensuring that high-speed internet is installed in “unserved locations”, defined as those that fail to meet the FCC’s benchmark speeds for internet to be known as ‘broadband’ (25/3 Mbits/sec).

Additionally, the program will seek to boost speeds in “underserved” areas, those without access to speeds of 100Mbits/sec down and 20Mbits/sec up, the proposed figure for the FCC’s new minimum broadband speeds.

The landscape of broadband access in the United States is complex, and beset with inaccurate measurements. Current distribution guidelines, led by the Commerce Department's National Telecommunications and Information Administration (NTIA) agency, are currently based on the FCC’s Form 477, last meaningfully updated in 2019. However, a draft of the FCC’s new map, based on data collected between 30 June and 1 September 2022, will be released on 18 November.

Since its release, the Form 477 map has been subject to criticism, most notably for its considering a census block as ‘covered’ with broadband if even one respondent within the block reported that they had access.

The new draft seeks to combat these oversights by allowing individuals to challenge the published results, if they are inaccurate reflections of available internet services in selected areas. State and tribal governments will also be able to make challenges on behalf of bulk communities, and in November 2021 commerce secretary Gina Raimondo called for states to "show us a plan that guarantees every single person in your state has access to high-speed affordable internet."

In the FCC’s Fourteenth Broadband Deployment Report, released in January 2021, the agency noted that “fewer than 14.5 million Americans” lacked access to its benchmark broadband speeds. Although this represents a 20% increase in access since the end of 2019, it clearly illustrates the gap separating many millions of citizens from basic broadband speeds.

Data released by Microsoft in 2021 suggests that a far larger figure — as high as 120.4 million people in the US — do not use the internet at broadband speeds. Noting the basic infrastructure still lacking in some communities, some have criticised the FCC’s move to increase its minimum benchmarks for broadband.

“Today, more than 42 million people in our country — 42 million people — do not have access to high-speed Internet,” said Kamala Harris, vice president of the United States in a February address.

“Half of all the people who do not have high-speed Internet say it is because the monthly cost is too high. Well, the President and I know that the cost of living has gone up, and we are working hard to help working families pay their bills.”

In all, the Bipartisan Infrastructure Bill included $65 billion for improving American internet access. This includes other projects such as the Affordable Connectivity Program (ACP), administered by FCC, which comprises $14.2 billion earmarked for providing low-income households with discounted broadband services. For those eligible, this is available in the form of vouchers to lower internet bills by $30 per month, or $75 per month on tribal lands, as well as through one-time $100 discount on the purchase of a laptop, desktop or tablet.

14 million households are believed to have signed up to the ACP to date, and companies directly involved with the program include internet service providers (ISPs) such as AT&T, Comcast, and Verizon.

Satellite connectivity providers such as DISH and SpaceX’s Starlink have sought to provide broadband to underserved rural customers across the United States, by way of connection with its low-Earth orbit (LEO) satellite constellation. In July, the FCC gave SpaceX approval to provide Wi-Fi to moving vehicles, including large trucks, planes, and ships, and the potential for satellite broadband to boost rural business is strong.

Despite this, satellite broadband in its current state lacks the maturity and network load to cater to every unserved or underserved American, and the government continues to play a major role in ensuring that ISPs deliver the speeds they promise, and expand networks wherever possible.

The Federal Communications Commission (FCC) is reportedly moving to ban the sales of all new Huawei and ZTE equipment within the United States, citing national security concerns.

FCC Chair Jessica Rosenworcel circulated a letter, reportedly calling for a formal ban on the authorization of equipment from the firms.

The Secure Equipment Act, passed in 2021 by the Biden administration, requires the FCC to adopt such a rule by November 11, 2022. This was spurred by the FCC’s 2020 designation of both companies as national security threats.

As a result of the designation, US telcos were rendered unable to purchase equipment from either company using federal money, but the proposed ban is set to extend this to all purchases made within the US. It is expected to be put to vote within weeks.

Equipment that has been previously approved by the FCC is unlikely to be included in the ban, which would apply to all new sales and approvals. As a result, the degree to which existing equipment will be removed from US telecommunications networks has yet to be determined.

In anticipation of removing existing equipment from the US network, the FCC created the Secure and Trusted Communications Networks Reimbursement Program (SCRP), which aims to reimburse telecommunications providers with 10 million or fewer customers for the expense of removing and replacing Huawei and ZTE equipment within their networks, obtained before June 30, 2020.

In February, the FCC notified Congress that providers requested $5.6 billion from the program. $1.9 billion dollars has currently been allocated by Congress for the program’s purposes.

“We’ve received over 181 applications from carriers who have developed plans to remove and replace equipment in their networks that pose a national security threat," stated Rosenworcel to Congress, in February.

"While we have more work to do to review these applications, I look forward to working with Congress to ensure that there is enough funding available for this program to advance Congress’s security goals and ensure that the U.S. will continue to lead the way on 5G security.”

On March 12, 2021, the FCC added five Chinese tech firms to its ‘Covered List,’ which designates companies that “pose an unacceptable risk to the national security of the United States or the security and safety of United States persons". These included Huawei and ZTE, as well as Hytera, Hikvision, and Dahua.

In 2022, Kaspersky Lab, China Mobile, China Telecom, Pacific Networks, and China Unicom were added to the list. Beyond Huawei and ZTE, a ban on equipment could apply to all companies listed, and include the subsidiaries and affiliates of all the companies named.

In the UK, similar moves have been underway since 2020 - and speculated for longer - when the government ruled that for national security reasons, all Huawei equipment must be removed from the UK 5G network by 2027.

In an October 13 notice by the Department for Digital, Culture, Media & Sport (DCMS), the government affirmed this decision as law, and sent legal notices to 35 UK network operators with the expected timeline of removal.

Over the summer, BT asked for an extension to the deadline by which it has to remove all Huawei equipment from the telecoms network core, citing delays driven by COVID-19. In light of this, the government has announced that firms will now have until December 31, 2023 to complete the task.

IT Pro has approached the FCC, Huawei, and ZTE for comment.

The White House has unveiled a blueprint for an artificial intelligence (AI) Bill of Rights, hoping to produce a framework that will inform future development practices to protect the public from harm.

The White House Office of Science and Technology Policy has identified five principles that should guide the design, use, and deployment of automated systems to protect the American public in the age of artificial intelligence.

The blueprint aims to act as a guide for society, providing suggestions on how people should be protected from threats while using the technology to reinforce its highest values.

It stated that citizens should be protected from unsafe or ineffective systems. Automated systems should be developed with consultation from diverse communities, stakeholders, and domain experts to identify concerns, risks, and potential impacts of the system.

They should also undergo pre-deployment testing and ongoing monitoring to demonstrate they’re safe and effective, it was proposed.

Secondly, the blueprint highlighted that citizens shouldn’t face discrimination by algorithms and systems should be used and designed in an equitable way.

It calls on designers and developers of automated systems to take proactive and continuous measures to protect individuals and communities from algorithmic discrimination and to use and design systems responsibly.

The blueprint also stated that citizens should be protected from abusive data practices via built-in protections and they should have agency over how their data is used.

“You should be protected from violations of privacy through design choices that ensure such protections are included by default, including ensuring that data collection conforms to reasonable expectations and that only data strictly necessary for the specific context is collected,” the blueprint stated. It called on designers and developers of the systems to seek permission and respect when it comes to the collection, use, access, transfer, and deletion of user data in appropriate ways.

Individuals and their communities should also be free from unchecked surveillance, it proposed. These technologies should be subject to heightened oversight which includes at least a pre-deployment assessment of their potential harms and scope limits to protect privacy and civil liberties.

Continuous surveillance and monitoring should not be used in education, work, housing, or in other contexts where the use of such surveillance technologies is likely to limit rights, opportunities, or access, read the blueprint.

Citizens should also know when an automated system is being used and understand how and why it contributes to outcomes that impact them.

Designers and developers should provide plain-language documentation including clear descriptions of the overall system functioning and the role automation plays, a notice that such systems are in use, what individual or organisation is responsible for the system, and explanations of outcomes that are clear, timely, and accessible.

Lastly, citizens should be able to opt out, where appropriate, and have access to a dedicated individual who can quickly consider and remediate problems they encounter.

“You should be able to opt out from automated systems in favour of a human alternative, where appropriate,” read the blueprint. “Appropriateness should be determined based on reasonable expectations in a given context and with a focus on ensuring broad accessibility and protecting the public from especially harmful impacts.”

Despite the Biden administration pushing forward this framework for a potential AI bill in the future, the US doesn’t have a comprehensive law to regulate the technology. It comes at a time when the European Union proposed in April a set of wide-reaching regulations to combat the misuse of AI.

It aims to protect citizens from the use of AI for mass surveillance by law enforcement and class AI in recruitment or border control management as high risk due to discrimination concerns.

In its current state, the proposed guidelines in the blueprint would not be binding, meaning that if they were formally adopted, they would not be passed into law and would merely act as optional guidelines - a weaker approach than the EU's.

A US senator is reportedly drafting a bill which could change the way that the federal government buys software, potentially impacting the way big tech companies sell their services to the public sector in the country.

According to Bloomberg, Gary Peters, a Michigan Democrat, is drafting the bill, which would force agencies to buy unlimited software licences instead of ones for a specific number of employees. These enterprise licences, which provide software for an unlimited number of users, can help save money by avoiding paying additional costs when software is overused.

The bill would ensure that government buyers would have to review all of their software, including rules on how it can be used on computers, servers, or cloud providers. Peters, who is the chair of the Senate Homeland Security and Governmental Affairs Committee, is still reportedly finalising the bill.

The US Government Accountability Office (GAO) found in 2014 that most agencies didn’t have adequate policies for managing software licences. GAO found that federal agencies weren’t adequately managing their software licences as they didn’t generally follow leading practices in that area.

Two years later, Congress passed a law, the Megabyte Act of 2016, requiring agencies to manage their software licences better and track their purchases. The new bill aims to build on this by also making plans to adopt government-wide licences for popular software as a way to further reduce costs and use its purchasing power to promote interoperability. It also demands agencies to underline any limitations in software licences and think of ways to minimise any restrictions.

The US federal government budgeted around US$92.2 billion for information technology spending in fiscal 2021, according to GAO. Its 24 government agencies negotiate contracts independently of each other.

Licencing rules have been a contentious issue between cloud companies in the past. In 2019, executives from AWS and Google Cloud hit out at Microsoft for changing how it charges customers for using its software on other public clouds. Some accused the tech giant of trying to lock customers into a single vendor with a complicated pricing structure.

This was followed by a leading competition law expert highlighting unfair and anti-competitive licencing practices enforced by major tech firms on customers globally in October 2021. Microsoft and Oracle were the primary targets of the report, which accused Microsoft of enforcing unfair licencing costs and charging customers more to use its products on third-party cloud platforms. The report also accused Oracle of enforcing licencing restrictions which led to a 10x increase in price when using Oracle software in a third-party cloud platform compared to running it on the cloud giant’s Infrastructure.

The White House has unveiled six principles to reform big tech after meeting with experts yesterday.

The US government organised a meeting on tech platform accountability where it focused on the harms that tech platforms cause and the need for greater accountability. The event brought together representatives from various organisations including the Center for Democracy and Technology, the Mozilla Foundation, and Sonos.

The first principle is to promote competition in the technology sector, the Biden-Harris administration said at the event. It said that a small number of dominant internet platforms use their power to exclude market entrants, engage in rent-seeking, and gather intimate personal information that they can use to their advantage. It underlined clear rules are needed to level the playing field for small and mid-sized businesses as well as entrepreneurs.

The second principle is to provide robust federal protections for US citizens’ privacy. The administration called for clear limits on the ability to collect, use, transfer, and maintain our personal data, including limits on targeted advertising. It said especially strong protections were needed for sensitive data like geolocation and health information, including reproductive health.

The third principle is to protect children by putting in place even stronger privacy and online protections for them, including prioritising 'safety by design' standards and practices for online platforms, products, and services.

The fourth principle is to remove special legal protections for large tech platforms. They are currently protected by protections under Section 230 of the Communications Decency Act which broadly shield them from liability even when they host or disseminate illegal, violent conduct, or materials.

The fifth principle is to increase transparency about platforms’ algorithms and content moderation decisions. The administration said that platforms are failing to provide sufficient transparency to allow the public and researchers to understand how and why decisions around their content are made, their potential effects on users, and the very real dangers these decisions may pose.

Lastly, the administration’s sixth principle is to stop discriminatory algorithmic decision-making. It called for strong protections to ensure algorithms do not discriminate against protected groups, such as by failing to share key opportunities equally, by discriminatorily exposing vulnerable communities to risky products, or through persistent surveillance.

“Although tech platforms can help keep us connected, create a vibrant marketplace of ideas, and open up new opportunities for bringing products and services to market, they can also divide us and wreak serious real-world harms,” said the White House. “The rise of tech platforms has introduced new and difficult challenges, from the tragic acts of violence linked to toxic online cultures, to deteriorating mental health and wellbeing, to basic rights of Americans and communities worldwide suffering from the rise of tech platforms big and small.”

Earlier this week, a bipartisan US antitrust bill which might soon be voted on in the Senate faced fierce opposition from tech giants. There were reports that Google, Apple, Amazon, and Meta have spent around $95 million since 2021 to lobby against support for the bill, which the tech giants said will limit their ability to run platforms effectively.

The US has underlined that any company that receives funding from its new CHIPS programme will not be able to invest in its operations in China.

The new $50 billion funding is aiming to boost the US’s semiconductor production capabilities following the chip shortage, at a time when the US and China are experiencing trade tensions.

Commerce Secretary Gina Raimondo underlined yesterday that companies that receive CHIPS funds cannot compromise national security by using the money to invest in China, develop leading-edge technologies in China, or send the latest technology overseas.

Additionally, Raimondo said that the funding won’t be a blank check for companies and it won’t be for them to pad their bottom line. CHIPS funding can’t be used for stock buybacks and is not intended to replace private capital.

She said the funds are intended to help companies maximise the scale of their projects, and warned that the Commerce Department can claw back money. The department will use the clawback authority if companies fail to start their project on time, fail to complete their project on time, and fail to meet their commitments.

“These are some of the most stringent taxpayer protections and guardrails we’ve ever had, and the American people are counting on us to get it right,” said Raimondo. “And it’s a responsibility that we take very seriously.”

Raimondo added that the Commerce Department expects to start receiving applications from companies for the CHIPS funding no later than February 2023.

The commerce secretary also shared the goals the administration hopes to meet with the funding. First, it hopes to make large-scale investments in leading-edge manufacturing, which will target around $28 billion to establish domestic production of logic and memory chips.

Secondly, it’s set to invest around $10 billion in new manufacturing capacity for mature or current-generation semiconductors. It hopes to increase domestic production across a range of chips, including those used in cars or communication technology.

Lastly, it will dedicate $11 billion to research and development programmes, including the creation of a National Semiconductor Technology Center.

A number of Taiwanese government websites were hit by cyber attacks, appearing to originate from China and Russia, during US House speaker Nancy Pelosi’s visit to the island.

The websites of the foreign ministry, main government English portal, and the presidential office were hit by an attack on Tuesday night, the government revealed yesterday, as reported by the AP.

Additionally, Taiwan’s defence ministry also said its website was offline for around an hour at midnight on Wednesday due to a distributed denial of service (DDoS) attack.

The island’s foreign ministry said that the attacks on its website as well as the government’s English portal were linked to Chinese and Russian IP addresses which tried to access the domains up to 8.5 million times per minute.

“As cyber attacks from foreign hostile forces could still occur at any time, the foreign ministry will continue to remain vigilant,” spokesperson Joanne Ou said.

The presidential office added that it’s set to increase its monitoring in the face of hybrid information warfare by external forces.

Taiwan and China have been at conflict over the island’s sovereignty, as the Chinese government sees it as a breakaway province that will one day be part of the country. Taiwan, on the other hand, considers the self-ruled island to be a separate nation, even if independence has never officially been declared.

Taiwan has also accused China of increasing cyber attacks on the island since the 2016 election of president Tsai Ing-wen, who considers Taiwan to be a sovereign nation. Officials have said in the past that government agencies face around five million cyber attacks and probes a day.

In addition to this, Taiwan said in 2020 that Chinese hackers had infiltrated at least 10 government agencies and gained access to around 6,000 email accounts in a bid to steal data.

In response to Pelosi’s visit, China also kicked off its largest ever military drills around the island.

The island is also important to the US since it houses the semiconductor chip giant Taiwan Semiconductor Manufacturing Co (TSMC). Pelosi’s delegation reportedly met with TSMC chairman Mark Liu yesterday to discuss the passage of the CHIPS act in the US, according to the Taipei Times.

It wasn’t clear what was talked about during the discussion, apart from “the chip issue and the meaning behind the passage of the CHIPS act,” and TSMC even said there were no private meetings between Pelosi and the company.

The CHIPS act is important for chipmakers as they can receive US government subsidies and tax incentives for building new chip capacity in the country. However, chip manufacturing costs are much higher in the US than in Taiwan, although TSMC has said in the past that the subsidies would help narrow the manufacturing cost gap.

Additionally, the act underlines that companies that receive the subsidies cannot use it to boost production of advanced chips in China.

However, this could be problematic for China as it’s dependent on Taiwan for semiconductor manufacturing, as while Chinese companies can design these components, they only have a limited capacity to manufacture them, according to Al Jazeera. For now, China has pledged to invest $1.4 trillion between 2020 and 2025 in high-tech industries including semiconductors to try and become more self-reliant in this area.

Meanwhile, TSMC is building a $12 billion fab in Arizona, hoping to produce 5-nanometre chips from 2024. Production costs at the factory are 50% higher than at its factories in Taiwan.

The US and Japan have agreed to foster supply chain resilience in strategic sectors, including semiconductors.

The US secretary of state Anthony Blinken and secretary of commerce Gina Raimondo co-hosted Japan’s minister for foreign affairs Yoshimasa Hayashi and minister of economy, trade, and industry Koichi Hagiuda for the inaugural ministerial meeting of the U.S.-Japan Economic Policy Consultative Committee (EPCC) on July 29, 2022.

The countries welcomed the progress of a joint task force announced in May which was set up to explore the development of next-generation semiconductors and commit to continued cooperation through this mechanism. Local media outlets in Japan reported last week that this included opening a research and development centre for 2-nanometre chips by the end of the year through a partnership between the two countries.

Raimondo praised the passing of the $52 billion CHIPS Act, which is set to boost domestic semiconductor production, and highlighted it would also strengthen the country’s partnership with allies like Japan.

“It will enhance our joint work on supply chains, promote the competitiveness of both of our nations, and importantly, make us less dependent on our adversaries for such a critical piece of technology,” said Raimondo. “I look forward to the day, not too far from now, where here in America we have American-made chips supplying Japanese auto plants here in the United States.”

Hagiuda added that the task force will work to develop the next generation of semiconductors, involving universities in Japan like the University of Tokyo and RIKEN.

“Wisdom will be collected to launch a new R&D organization,” said Hagiuda. “It will be made open to overseas businesses and research institutes, inclusive of Japan, US, and like-minded countries in the region. We hope to make into a hub for the international joint research.”

The US and Japan also intend to continue supporting efforts to deploy secure and open 5G networks globally given an ambition to significantly expand market share of Open RAN in the global 5G market by 2030. This will be done through workshops, seminars, and proof-of-concept projects in third countries, and will promote secure technology options for advanced communications networks, including Open RAN-based approaches to wireless network technology.

The two countries intend to continue to strengthen their coordination on digital policy issues and foster collaboration with partners to promote and support strategically important and mutually beneficial projects of secure and trusted submarine cable systems.

The US and Japan will also continue joint efforts on implementing more effective and agile export controls on critical and emerging technologies, including microelectronics and cyber surveillance systems, to address the misuse of critical and emerging technologies by malicious actors and inappropriate transfers of emerging technology through research activities.

The two countries also affirmed the importance of sharing information relating to threats to critical infrastructure.

Moreover, the US and Japan have committed to enhancing international efforts to address barriers to cross-border data flows, while respecting different approaches to data governance. They hope to advance a common understanding and foundation to promote data-free flow with trust among like-minded democracies.

The two nations also intend to promote information sharing on cyber security threats including through discussion of threat assessment and mitigation efforts in the Japan-U.S. Cyber Dialogue.

Under a new proposal by Federal Communications Commission (FCC) Chairwoman Jessica Rosenworcel, the minimum broadband speeds in America would be raised to 100 Mbits/sec down and 20 Mbits/sec up.

Rosenworcel's Notice of Inquiry raises the issue to her colleagues and will need to be voted on down the line. In 2015, the FCC set the minimum speeds required for an internet service to be considered ‘broadband’ at 25 Mbits/sec down and 3 Mbits/sec up. Internet service providers (ISPs) are currently required to meet these speeds to sell a service as ‘broadband’.

Under Rosenworcel’s predecessor Ajit Pai, the FCC declined to further raise the required speeds. This is despite the increased demand for internet services for working from home and the availability of services such as 4k streaming. Rosenworcel's Notice of Inquiry also proposes a goal of a minimum 1 Gbps/500 Mbits/sec for the future of American internet infrastructure.

If the changes went ahead, ISPs such as Comcast and Verizon might be forced to change pricing to fit the mandated speeds into their packages.

Last year, AT&T executive vice president Joan Marsh criticised proposals to subsidise rollout of fibre to homes and small businesses as unnecessary, stating in a blog post:

“There would be significant additional cost to deploy fiber to virtually every home and small business in the country when at present there is no compelling evidence that those expenditures are justified over the service quality of a 50/10 or 100/20 Mbps product.”

On the likelihood of price increases, Marsh highlighted the “consumer cost challenge” of providing fibre broadband to rural areas at an FCC estimated cost of $100 per month.

“Even the increased Emergency Broadband Fund $50 subsidy will deliver a low-income household less than half of the support it would need to fund such a high-speed service.

“As higher speed networks get deployed to rural America, the current availability challenge could easily become an affordability one.”

A 2021 report by the Government Accountability Office found that current broadband speeds are insufficient to support small businesses, raising the possibility of broadband speed increases to provide support for companies that do not have access to the high speeds enjoyed by larger corporations based in or near major cities.

The report further cites data from the National Federation of Independent Business and from Google to highlight that 8% (2 to 3 million) of small businesses in the US lack access to broadband entirely.

The Biden administration reached an agreement with 20 broadband providers in May to improve internet speeds or cut prices of existing broadband packages to improve broadband access. The move comes as part of the wider Internet for All initiative, a $45 billion plan to expand high-speed broadband connectivity currently in the early stages of deployment.

Last year's Rural Digital Opportunity Fund (RDOF) had been earmarked to provide nearly $10 billion to ISPs via reverse auction to expand internet access in rural areas. Shortly into the bidding process, however, the FCC called the legitimacy of some companies into question.

Expanding high-speed broadband to all Americans would also impact the business model of companies such as SpaceX.

Through their service Starlink, the spacecraft manufacturer and satellite communications company currently provides internet access to tens of thousands of customers in the United States, with a specific goal to give those in remote wilderness areas internet at speeds around 50-250 Mbits/sec down.

The consistency of wired internet versus the frequent outages suffered by satellite internet services could drive rural customers away from Starlink if they were offered a viable, high-speed internet package from a traditional provider.

The National Oceanic and Atmospheric Administration (NOAA) has celebrated the inauguration of two new supercomputers, which it hopes will dramatically improve prediction models.

Named Dogwood and Cactus, each new supercomputer operates at a speed of 12.1 petaflops and were provided as part of an eight-year contract with General Dynamics Information Technology, who are responsible for their maintenance and updates.

Added to the NOAA’s current supercomputer capacity of 18 petaflops, the agency can now utilise a total capacity of over 42 petaflops for research. The additional power will play a key role in next year’s Hurricane Analysis and Forecast System (HAFS), a new and more detailed hurricane forecast model, as well as an upgrade to the Global Forecast System (GFS) this autumn, a boost to all who use the service around the world.

Extreme weather events are a regular occurrence in the United States but are becoming even more common and severe as a result of climate change. Of the $2.155 trillion of damage caused by US weather and climate disasters since 1980, $742.1 billion has been caused in the last five years alone, more than one-third.

A huge $1.1 trillion of that total is due to hurricanes, which also carry the highest total death toll of weather and climate disasters: 6,697. With the upgrade to the system announced this week, researchers will be able to model smaller weather formations in higher resolution, as well as run larger and more frequent simulations to improve model certainty.

Dogwood and Cactus are named after the flora native to their respective bases of Manassas, Virginia and Phoenix, Arizona. They now rank as the 49th and 50th fastest computers in the world.

“Accurate weather and climate predictions are critical to informing public safety, supporting local economies, and addressing the threat of climate change,” stated U.S. Secretary of Commerce Gina M. Raimondo, in a press release.

“Through strategic and sustained investments, the U.S. is reclaiming a global top spot in high-performance computing to provide more accurate and timely climate forecasts to the public.”

Google launched a new company division yesterday focused on the public sector, as it attempts to rapidly expand its services to the government.

Google Public Sector will focus on helping US public sector institutions accelerate their digital transformation, including federal, state, and local governments as well as educational institutions.

The company revealed that the new division will operate as a subsidiary of Google LLC and specialise in bringing Google Cloud technologies, including Google Cloud Platform and Google Workspace, to US public sector customers. It aims to provide various Google products to help institutions better understand their data and automate core processes.

Google Public Sector will provide a full complement of business functions and capabilities, including specialised sales, customer engineering, customer success and services, channel and partner programmes, and security operations.

The new division will also have a separate board of directors. Google said it will serve as an important feedback channel, to ensure its products and services meet the needs of its customers, anticipate future needs, and drive differentiation in the US public sector market. The board will have a chair and additional members, to be named later in the year.

“We believe Google Public Sector can and will play a critical role in applying cloud technology to solve complex problems for our nation—across U.S. federal, state, and local governments, and educational institutions,” said Thomas Kurian, CEO of Google Cloud. “The government has asked for more choice in cloud vendors who can support its missions, and protect the health, safety, and security of its citizens. We are proud to have served the U.S. public sector for many years, and the launch of Google Public Sector will help us rapidly expand our services to the government, now and into the future.”

Additionally, the new division will bring customers an expanded ecosystem of partners with experience in serving public sector institutions. This includes Accenture Federal, Deloitte, SAP, and C3.ai.

The division will offer Google Cloud’s scalable and open infrastructure including compute, storage, and networking, so government agencies can modernise their legacy information systems and build new applications that serve citizens with mission-critical reliability and scalability.

Experts at the new division will also help public sector customers use Google Cloud’s advanced cyber security products to protect their users and data from growing cyber threats. They will also assist agencies and educational institutions in their use of Google Workspace to enable secure communication and collaboration, and the company hopes to attract new employees to the government through the use of these modern tools.

How has Google been involved with the US public sector in the past?

Google has been involved in numerous contracts involving the US public sector and even called on the government in April 2022 to rethink its relationship with its tech giant rival Microsoft. It said that the government should rethink its practice of favouring Microsoft technology when procuring technology and accused the company of having a reputation for cyber security vulnerabilities and poor user perception.

Google said that repeated cyber security breaches on US government systems have interrupted vital work and cost the taxpayer billions of dollars. It also claimed that the government was at a disadvantage due to its approach to procurement, and an over reliance on Microsoft products.

Google Cloud also secured a contract with the US Department of Defense in May 2020, to aid in the detection and countering of cyber threats. No specific sum was disclosed, although the contract was reportedly valued at seven figures.

In the past, it has also partnered with the US Department of Veteran Affairs to improve veteran access to benefits and services. It also signed a five-year agreement with the Department of Energy to provide Google Cloud technologies to help it scale its research efforts.

Google also helped the State of New York to launch a streamlined unemployment application and New York City Cyber Command to detect and prevent cyber threats more quickly. More recently, it partnered with the City of Pittsburgh to move it to cloud-based IT infrastructure and improve the delivery of services for citizens.

However, in 2018, it decided not to renew its contract with the Pentagon’s Project Maven, in which AI technology was used to improve drone performance, after considerable pressure from employees. Despite this, the following year it emerged that the company was using its investment arm to cultivate startup firms that actively engage in military and law enforcement contracts.

The newly-inaugurated president of Costa Rica, Rodrigo Chaves Robles, reportedly declared a state of emergency on Sunday after the country’s government had been hit by Conti ransomware last month.

This is one of the first executive decrees the president has signed, after beginning his presidency on 8 May, as reported by journalist Amelia Rueda. It mandates the need for Costa Rica to invest in cyber security and respond to the ongoing attack.

The first entity to be hit was the Treasury on 18 April, although the full impact of the ransomware is still unknown. It has been without any kind of digital services, meaning that its processes have been forced to be completed manually.

On 6 May, the US Department of State also posted a $10 million bounty for information leading to the identification or location of any individuals who hold a key leadership position in the Conti ransomware group. The department is also offering a reward of $5 million for information leading to the arrest and/or conviction of any individual in any country conspiring to participate in a Conti ransomware incident. It underlined that the group attacked Costa Rica in April, impacting the country’s foreign trade by disrupting its customs and taxes platforms.

“We’ve signed the decree so the country can defend against the criminal attack that cyber criminals are carrying out,” added Chaves. “This is an assault on the nation and we have signed this decree to help us defend ourselves better.”

Conti has released a statement about the attack online where it said Costa Rica could have avoided this by paying a $10 million ransom, as reported by CyberScoop. The post also indicated that around 97% of the stolen data has been published so far, with around 672GB of information taken.

“You also need to know that no organised team was created for this attack, no government of other countries has finalised this attack, everything was carried out by me with a successful affiliate, my name is unc1756,” stated the message. “The purpose of this attack was to earn money, in the future I will definitely carry out attacks of a more serious format with a larger team, Costa Rica is a demo version.”

The message contained links to four Costa Rican websites: the Treasury, the Ministry of Work and Social Security, the Social Development and Family Allowances Fund, and SIUA, a local university.

"With cyberattacks on government and critical infrastructure organisations on the rise, we’re starting to see the very real and devastating consequences of cybercrime brought to life," said Christiaan Beek, lead scientist and senior principal engineer of Trellix Threat Labs. "Not only does the threat of this type of double extortion ransomware have major cost and data privacy implications, but the ongoing disruption to crucial operations such as utilities can impact human life. Malicious actors are using this attack technique as powerful leverage over governments for financial gain. Yet even in cases where the ransom is paid, significant resource will be needed to rebuild systems and processes, as well as manage the long-term consequences of stolen files being shared on the dark web."

In February, a Ukrainian cyber researcher unveiled data belonging to the Conti ransomware gang. The researcher had access to the group’s systems and released the data after the gang declared its support for Russia following the invasion of Ukraine. It includes Bitcoin addresses, chat logs, and negotiations between ransomware victims and Conti attackers.

LinkedIn has settled with the US Department of Labor (DoL) over allegations that the tech company carried out systemic, gender-based pay discrimination.

The DoL announced the settlement yesterday on behalf of 686 female workers in California. A compliance evaluation from its Office of Federal Contract Compliance Program (OFCCP) found that between 1 March, 2015 and 1 March, 2017, LinkedIn failed to comply with Executive Order 11246. The order prohibits federal contracts from discriminating on the basis of race, colour, religion, sex, gender identity, disability, or national origin.

Specifically, it alleged that the company didn’t provide equal pay to the affected female workers in its engineering and marketing job family groups in San Francisco, and its engineering and product job family groups in Sunnyvale.

Under the terms of the agreement, LinkedIn will pay $1.8 million in back wages and interest to the affected workers. It will also conduct a staff training programme to ensure compliance with LinkedIn’s non-discrimination obligations. Lastly, it will also evaluate for the next three years whether the company’s compensation is gender neutral and make salary adjustments if not. It’s also set to revise its compensation policies and practices and agreed to monitoring and reporting to ensure compliance with federal contract obligations.

“Our agreement with LinkedIn resolves alleged pay discrimination that denied 686 female workers at the company’s San Francisco and Sunnyvale locations their full wages,” explained OFCCP regional director Jane Suhr. “In addition to recovering $1.8 million in back wages and interest for these workers, our agreement will ensure that LinkedIn better understands its obligations as a federal contractor and complies in the future.”

The $1.8 million fine comes out to 0.02% of LinkedIn’s $10 billion revenue it achieved for the first time in the fourth quarter of 2021.

LinkedIn published a response on its website where it stated: “While we have agreed to settle this matter, we do not agree with the government’s claims; LinkedIn pays and has paid its employees fairly and equitably when comparing similar work.”

The Microsoft-owned company cited an “equal pay analysis” it conducted in 2021 where it found globally, for every $1 earned by men, its female employees earned $0.999. It added that in the US, its employees of colour earn $1 for every $1 earned by its white employees.

The DoL was criticised in December for propping up the abusive outsourcing business model by treating contractor hires differently than direct hires when enforcing the wage and other provisions in the H-1B statute that are supposed to protect H-1B and US workers. This emerged as HCL Technologies was accused of underpaying its workers on H-1B visas in the US by $95 million annually.

Google has called on the US government to rethink its practice of favouring Microsoft technology when procuring technology, accusing the company of having a reputation for cyber security vulnerabilities and poor user perception.

Repeated cyber security breaches on US government systems have interrupted vital work and cost the taxpayer billions of dollars, said Google Cloud’s Jeanette Manfra, senior director of Global Risk and Compliance in a blog post.

Manfra, who has spent 20 years in the public sector, most recently as the head of the Cybersecurity and Infrastructure Security Agency (CISA)’s cyber security division, claimed that the government was at a disadvantage due to its approach to procurement, and an over reliance on Microsoft products.

She pointed to a recent Google poll of 2,600 US government workers, which found that the majority of those surveyed reported being “very” concerned about cyber attacks against their employers in the coming years. Most of those surveyed (80%) also said that the recent attacks, like the SolarWinds breach, has them concerned about their personal data and privacy, and that of their family members.

Results also showed a lack of satisfaction with legacy software, with over 50% of government workers stating that there are other products or services that could help them do their jobs better.

According to Google's data, around 84% of D.C. metro government employees primarily use Microsoft products at work, including Word, Outlook, Teams, and OneDrive. This is confirmed by another recent study by Omdia which found 85% of government employees use Microsoft productivity software.

“This reliance on a single software suite might suggest that these products are safe and secure, but the Public Opinion Strategies survey found that more than half of all respondents said that the government’s reliance on these Microsoft products actually made the federal government more vulnerable to hacking or cyber attacks,” said Manfra.

However, a US Senate report released last August detailed that seven out of eight federal agencies had failed to protect critical data due to inadequate cyber security policies, rather than problems with their systems. It stated that most agencies failed to install security patches quickly enough, and warned that at least seven out of the eight agencies are still using legacy systems that have reached end of life, and no longer receive vendor security patches.

When survey respondents were asked why their employers used Microsoft services, 45% said the reason was because their employer has always used those products and services and doesn’t want to change, while 55% said because they are the most effective at helping them to do their job.

Manfra said that with so many respondents reporting they're dissatisfied with their legacy IT solutions, it may be time for the government to rethink its approach to procurement.

“As governments work to meet the demands and preferences of their constituents—and their employees—it’s clear that there’s an overreliance on legacy solutions, despite a track record of cyber security vulnerabilities and poor user perception,” she added.

IT Pro has contacted Microsoft for comment.

Despite the tech giant criticising Microsoft for its cyber security, it isn't immune to these kinds of threats either. In February, it had to resolve a critical security flaw in Android 12 with its February 2022 Android security update. In the same month, the company had to release another wave of patches for seven high-severity issues affecting Chrome, including one zero-day vulnerability being actively exploited.

A report highlighted in January that Google Drive accounted for the most malware downloads in 2021, taking the top spot from Microsoft OneDrive. It accounted for 37% of all malicious downloads last year, while OneDrive fell to second place with 20% of downloads.

Google Cloud also revealed in November last year that 86% of compromised Google Cloud Platform instances in 2021 led to cryptocurrency miners being dropped into customers' environments. Its customers were heavily targeted by attackers who were attempting to leverage the high levels of compute available to them without having to pay for it.

Five US democrats have proposed a bill that would develop an electronic version of the US dollar for use by the public.

The bill, the Electronic Currency and Secure Hardware (ECASH) Act, would promote greater financial inclusion, maximise consumer protection and data privacy, and advance US efforts to develop and regulate digital assets, said US representative Stephen Lynch, chairman of the task force on Financial Technology.

US representatives Jesús García, Rashida Tlaib, Ayanna Pressley, and Alma Adams are the other cosponsors of the bill, and are also part of the Committee on Financial Services.

The ECASH Act would establish a two-stage pilot programme led by the Treasury to develop and issue an electronic version of the US dollar that promotes consumer safety and privacy, financial inclusion and equity, and anti-money laundering and counterterrorism compliance.

The bill also requires the Treasury to incorporate key security and functionality safeguards into e-cash that are generally associated with the use of physical currency, including anonymity, privacy, and minimal generation of data from transactions.

It must also be interoperable with existing financial institution and payment provider systems, capable of executing peer-to-peer offline transactions, and distributed directly to the public via secured hardware devices. E-cash would also be regulated similar to physical currency and subject to existing anti-money laundering, counterterrorism, and transaction reporting requirements and regulation.

“As digital payment and currency technologies continue to rapidly expand and with Russia, China, and over 90 countries worldwide already researching and launching some form of Central Bank Digital Currency, it is absolutely critical for the U.S. to remain a world leader in the development and regulation of digital currency and other digital assets,” said Rep. Lynch.

“By establishing a pilot programme within the Treasury for the development of an electronic U.S. Dollar, the ECASH Act will greatly complement and advance ongoing efforts undertaken by the Federal Reserve and President Biden to examine potential design and deployment options for a digital dollar."

Lynch added that the pilot programme will also preserve a role in the US's financial system for smaller anonymous cash-like transactions which are currently transacted in physical dollars and which have seen a rapid decline in use.

"As of this writing in fact, no less than 81 identifiable central banks have launched, piloted or are performing CBDC research, with many more in stealth mode," Jens Seidl, CEO of Currency Research told IT Pro. "It was expected that the US would not shy away from this either, however, we cannot comment on the likelihood of the legislation passing. We do believe it is clear that the Federal Reserve and the payments industry at large will form a view on the potential benefits and risks of a digital dollar. We also don’t expect that such an instrument would replace physical cash in the near future, as there are still important questions to resolve, such as accessibility, resilience and privacy."

The ECASH Act has been designed to be in line with guidance and directives from the US government, including president Biden’s executive order on Ensuring Responsible Development of Digital Assets announced earlier in March. The administration placed the highest urgency on research and development efforts into digital dollar design, including assessments of financial inclusion, possible benefits and risk for consumers, existing payment systems, and national security.

Similarly, the Federal Reserve released a whitepaper in January, warning that the introduction of new centralised digital currencies in other countries could lead to a decrease in the use of the US dollar if they are deemed more attractive.

President Joe Biden has warned that Russia could launch a wave of cyber attacks targeting the US.

Biden previously warned about the potential that Russia could conduct malicious cyber activity against the US, including as a response to the unprecedented economic costs the country imposed on Russia, calling it part of the country's playbook. The president reiterated the warnings in a statement published this week, based on evolving intelligence that the Russian government is exploring options for potential cyber attacks.

Biden called it a critical moment to accelerate work to improve domestic cyber security and bolster national resilience. He underlined that his administration has worked to strengthen the nation’s cyber defences, mandating cyber security measures for the government and critical infrastructure sectors, as well as creating public-private partnerships to enhance security across all critical infrastructure.

The president added that his administration will continue to use every tool to deter, disrupt, and if necessary, respond to cyber attacks against critical infrastructure.

However, he warned the government can’t defend against the threat alone. Most of the US’s critical infrastructure is owned and operated by the private sector and owners and operators must accelerate efforts to lock their digital doors, underlined Biden.

“If you have not already done so, I urge our private sector partners to harden your cyber defences immediately by implementing the best practices we have developed together over the last year,” said Biden.

“You have the power, the capacity, and the responsibility to strengthen the cyber security and resilience of the critical services and technologies on which Americans rely. We need everyone to do their part to meet one of the defining threats of our time — your vigilance and urgency today can prevent or mitigate attacks tomorrow.”

The government has also been implementing legislation to bolster the nation’s cyber security. A bill aiming to force critical infrastructure providers to declare when they have experienced a cyber attack was approved by the Senate earlier this month. Once signed into law by Biden, it looks to enhance the nation’s ability to combat ongoing cyber security threats against critical infrastructure.

Critical infrastructure owners will report to CISA within 72 hours if they’re experiencing a substantial cyber attack, and within 24 hours of making a ransomware payment.

Two US senators have introduced a bill that attempts to ban mergers and acquisitions valued over $5 billion, a move likely to hit the tech industry the hardest.

Senator Elizabeth Warren and representative Mondaire Jones introduced bicameral legislation aimed at stomping out rampant industry consolidation that allows companies to raise consumer prices and mistreat workers.

The bill, titled “Prohibiting Anticompetitive Mergers Act” (PAMA), would ban the biggest, most anticompetitive mergers and give the Department of Justice (DOJ) and Federal Trade Commission (FTC) the power to reject deals in the first instance without court orders and to break up harmful mergers.

Specifically, it would make “prohibited mergers” illegal, including those valued at over $5 billion or those that would result in market shares above 33% for sellers or 25% for employers.

Warren said that for the first time, the PAMA act would require the FTC and DOJ to consider how a merger would impact workers, and reject mergers that would harm them. It would empower the agencies to reject transactions that would exacerbate corporate domination of labour markets and block transactions that would weaken collective bargaining agreements, reduce employee benefits and compensation, or cause layoffs.

The legislation would also establish procedures for the antitrust agencies to conduct retrospective reviews and break up harmful deals that have destroyed competition.

“For the last five decades, big companies have had almost free reign over our economy, squashing competitors, growing bigger and bigger, and abusing their market power to price gouge consumers and crush workers and small businesses,” said Warren.

“This unconstitutional behaviour has to stop. My new bill with Rep. Jones would restore our country’s anti-monopoly tradition by banning the biggest, most anticompetitive mergers and giving the DOJ and the FTC stronger tools to enforce our antitrust laws and restore real competition in our markets.”

Warren mentioned the example of Amazon’s proposed acquisition of MGM Studios, reportedly worth around $8.5 billion, highlighting how she has called on the FTC to consider harms to workers and harms throughout entire business ecosystems as a result of this acquisition. Under the new legislation, this deal would be prohibited.

The tech industry, known for its eye-watering mergers, would likely be hit hardest if the bill ever became law.

Deals such as Microsoft's acquisition of Activision, valued at $68.7 billion, Google’s acquisition of Mandiant for $5.4 billion, Microsoft’s $19.7 billion acquisition of Nuance, and Intel’s acquisition of Tower Semiconductors for $5.4 billion would all have faced much tougher regulatory hurdles.

Legislation aiming to force critical infrastructure companies to declare when they have experienced a cyber attack was approved by the Senate on Friday.

The cross-party provision, authored by US senators Gary Peters and Rob Portman, aims to enhance the nation’s ability to combat ongoing cyber security threats against critical infrastructure.

It passed the Senate as part of government funding legislation and the last step it faces is being signed into law by President Biden.

The provision requires critical infrastructure owners and operators to report to CISA within 72 hours if they’re experiencing a substantial cyber attack, and within 24 hours of making a ransomware payment.

It also gives CISA the authority to subpoena entities that fail to report cyber security incidents or ransomware payments. Organisations that fail to comply with the subpoena can be referred to the Department of Justice.

The provision also requires CISA to launch a programme that warns organisations of vulnerabilities that ransomware actors exploit. It also directs CISA’s director to establish a joint ransomware task force to coordinate federal efforts, in consultation with industry, to prevent and disrupt ransomware attacks.

The Homeland Security and Governmental Affairs US Senate Committee said that once signed into law, the provision will mark a significant step to help the US combat potential cyber attacks sponsored by foreign adversaries, including online threats from the Russian government in retaliation for US support in Ukraine.

“This provision will create the first holistic requirement for critical infrastructure operators to report cyber incidents so the federal government can warn others of the threat, prepare for widespread impacts, and help get our nation’s most essential systems back online so they can continue providing invaluable services to the American people,” said senator Peters, chairman of the committee. “Our provision will also ensure that CISA – our lead cyber security agency – has the tools and resources needed to help reduce the impact that these online breaches can have on critical infrastructure operations.”

CISA director Jen Easterly said the organisation applauds the passage of cyber incident reporting legislation, calling it a game-changer. She underlined that CISA will now have the data and visibility it needs to help better protect critical infrastructure and businesses across the country from cyber attacks.

“CISA will use these reports from our private sector partners to build a common understanding of how our adversaries are targeting U.S. networks and critical infrastructure,” said Easterly. “This information will fill critical information gaps and allow us to rapidly deploy resources and render assistance to victims suffering attacks, analyse incoming reporting across sectors to spot trends, and quickly share that information with network defenders to warn other potential victims.”

The US has been seeking to bolster its cyber defences, as in February it announced it would consider proactively disrupting cyber criminals’ operations even if doing so might impede the state’s ability to arrest and indict the alleged perpetrators. The measures it is considering include providing decryptor keys to ransomware victims or even seizing servers used to launch cyber attacks.

Chinese hackers belonging to the state-backed APT41 group compromised at least six US government networks by exploiting vulnerabilities in internet-facing applications.

The vulnerabilities included a zero-day in the USAHerds application and the Log4Shell flaw in the ubiquitous Java logger Log4j, according to cyber security firm Mandiant, which was this week acquired by Google. The company responded to an APT41 intrusion targeting a US state government computer network in May 2021 and studied the group's activity until February 2022.

APT41 is a prolific Chinese state-sponsored espionage group known to for targeting organisations in both the public and private sectors and for conducting financially motivated activity for personal gain.

Although the goals of APT41’s latest campaign remain unknown, Mandiant’s investigations revealed a variety of new techniques and malware variants used by the hackers.

During the period of investigation, Mandiant found that APT41 successfully compromised at least six US state government networks through the exploitation of vulnerable internet-facing web applications, often written in ASP .NET. In most of the compromises, APT41 carried out .NET deserialization attacks, although Mandiant also observed the group exploiting SQL injection and directory traversal vulnerabilities.

In one instance, APT41 gained access through an SQL injection vulnerability in a proprietary web application but Mandiant detected and contained the activity. However, two weeks later, APT41 re-compromised the network by exploiting a previously unknown zero-day vulnerability in a commercial-off-the-shelf (CoTS) application, USAHerds.

In two other instances, Mandiant began an investigation at one state agency only to find that APT41 had also compromised a separate, unrelated agency in the same state.

Mandiant added that the hacking group was quick to adapt and use publicly disclosed vulnerabilities to gain initial access into target networks, while also maintaining existing operations.

“On December 10th, 2021, the Apache Foundation released an advisory for a critical remote code execution (RCE) vulnerability in the commonly used logging framework Log4J,” wrote the researchers. “Within hours of the advisory, APT41 began exploiting the vulnerability to later compromise at least two US state governments as well as their more traditional targets in the insurance and telecommunications industries.”

Mandiant said that in late February 2022, APT41 re-compromised two previous US state government victims. This closely aligns with APT41’s May-December 2021 activity, representing a continuation of their campaign into 2022 and demonstrating their unceasing desire to access state government networks, said the company.

Mandiant underlined that the goals of the campaign are currently unknown, although it has observed evidence of APT41 exfiltrating Personal Identifiable Information (PII).

“Although the victimology and targeting of PII data is consistent with an espionage operation, Mandiant cannot make a definitive assessment at this time given APT41’s history of moonlighting for personal financial gain,” stated the researchers.

Members of APT41 were charged by the US Department of Justice (DoJ) in September 2020 in connection with computer intrusion campaigns against over 100 victim companies.

The DoJ said their intrusion facilitated the theft of source code, software code signing certificates, customer account data, and valuable business information. It added these intrusions facilitated the defendants’ other criminal schemes, like ransomware or crypto-jacking schemes.

US telecommunications providers have requested $5.6 billion to cover the costs of removing, replacing, and disposing of insecure equipment and services in US networks.

The FCC ordered telecoms companies to begin removing Huawei equipment from their networks in December 2020 as part of the process of revoking China Telecom’s authorisation to operate in the US, based on concerns relating to the companies’ ties to the Chinese government. In July 2020, the FCC went on to officially declare Huawei and ZTE as threats to the US’s national security.

In October last year, the FCC launched the Secure and trusted Communications Networks Reimbursement $1.9 billion programme, created by Congress, to reimburse smaller service providers - those with less than 10 million customers - for their efforts to increase the security of the nation's communications networks.

FCC chairwoman Jessica Rosenworcel notified Congress on 4 February that the FCC has received over 181 applications for around $5.6 billion from carriers who have developed plans to remove and replace equipment in their networks that pose a national security threat.

“While we have more work to do to review these applications, I look forward to working with Congress to ensure that there is enough funding available for this programme to advance Congress’s security goals and ensure that the US will continue to lead the way on 5G security,” said Rosenworcel.

Companies were able to file for funding from the programme between 29 October 2021 and 28 January 2022. As it stands, Congress will have to approve around $3.7 billion more in funding if it wants to comply with the 181 applications put forward by the telecommunications providers.

Huawei and ZTE have also been prevented from receiving new equipment licenses from US regulators, as in November president Biden signed a new law to prevent companies that are seen as security threats from acquiring these licenses. The Secure Equipment Act of 2021 specifies that it applies to equipment already listed in the Secure and Trusted Networks Act of 2019, in which Huawei, ZTE, and other Chinese tech companies are named.

The median inventory of chips held by US companies fell to less than five days worth in 2021, as global companies struggled to deal with the semiconductor shortage.

That's according to the Department of Commerce's Semiconductor Supply Chain Request for Information (RFI), which was issued September 2021. It asked all parts of the supply chain, producers, consumers, and intermediaries, to voluntarily share information about inventories, demand, and delivery dynamics. It recorded over 150 responses from entities located across the world.

The RFI showed that the median inventory held by organisations, including automakers and medical device manufacturers, fell from 40 days in 2019 to less than five days in 2021.

The Commerce department highlighted that if a COVID outbreak, natural disaster, or political instability disrupts a foreign semiconductor facility for even just a few weeks, it has the potential to shut down a manufacturing facility in the US, putting its workers and their families at risk.

The report also found that demand for semiconductors was as much as 17% higher in 2021 compared to 2019, and consumers aren’t seeing commensurate increases in the available supply. The majority of semiconductor manufacturing facilities are also operating at or above 90% utilisation, which means there’s limited additional supply without building new facilities.

Bottlenecks are most concentrated in specific semiconductor inputs and applications. This includes legacy logic chips used in automobiles and medical devices, analog chips used in image sensors and radio frequency, and optoelectronics chips, used for sensors and switches.

The main reasoning for these bottlenecks was identified as the need for additional fab capacity. Additional ones include a lack of raw material inputs for both semiconductors and the other components paired with semiconductors to assemble sub-parts for electric devices.

“The semiconductor supply chain remains fragile, and it is essential that Congress pass chips funding as soon as possible,” said secretary of Commerce Gina M. Raimondo. “With sky-rocketing demand and full utilization of existing manufacturing facilities, it’s clear the only solution to solve this crisis in the long-term is to rebuild our domestic manufacturing capabilities.

"President Biden has proposed $52 billion to revitalize our domestic semiconductor industry, and every day we wait on this funding is a day we fall further behind. But if we address this problem, we can create good jobs, rebuild American manufacturing, and strengthen our supply chains here at home for years ahead.”

The US had asked chipmakers and electronics device makers to voluntarily send in information on their production capacity, inventories, and customers, to understand where bottlenecks may exist in the global supply chain.

However, in October 2021 TSMC revealed it was mulling how best to respond to the request without revealing sensitive client information. The Biden administration hinted it could reintroduce a law to force companies to share the data if they failed to comply with the request.

President Joe Biden has nominated former HPE CEO Meg Whitman to be his ambassador to Kenya, emphasising her corporate and political experience.

Whitman is a board member of Procter & Gamble and General Motors, and national board chair at Teach for America. She is the former CEO of Quibi, a mobile streaming content platform, and former president and CEO of HPE, eBay, and FTD.

Although Whitman has plenty of experience in corporate roles, she has also been politically active for many years. She supported Mitt Romney’s presidential campaign in 2008 before joining John McCain as his national campaign co-chair. In 2010, she ran as a Republican for governor in California but lost to Democrat Jerry Brown. Following this, she switched allegiances and backed Hillary Clinton in the 2016 race against Donald Trump.

Whitman donated $500,000 to the Biden Victory Fund last year, a joint fundraising committee that helped the Biden campaign and the Democratic National Committee, according to CNBC. Furthermore, she also made three donations in her name to the Democratic National Committee, which came to a total of $110,800, as reported by the Register.

Often, wealthy donors in the US get ambassadorships in Democratic and Republican administrations alike. Research from the Center for Responsive Politics shows that over a dozen Obama campaign supporters became ambassadors during his administration. Former President Trump also rewarded big donors with ambassadorships, as reported by NPR.

If approved, Whitman may spend her time by ensuring the negotiations towards a free trade agreement between Kenya and the US go smoothly, or even help US tech companies like Microsoft ensure its technology is adopted more by the Kenyan government.

Whitman called it a day as HPE CEO in 2017, bringing her seven-year reign to an end and giving the reins to the president at the time Antonio Neri. During her time as CEO, she oversaw the split of HP and HPE in 2015, led the acquisitions of Aruba and Nimble Storage, and even helped to complete the $8.8 billion software division spinoff to Micro Focus.

The UK and US have announced a new agreement that will see the two long-term allies develop a deeper cross-border data partnership.

In a joint statement from the Summit for Democracy, the UK secretary of state for Digital, Culture, Media & Sport (DCMS) Nadine Dorries and the United States commerce secretary Gina M. Raimondo said developing a more comprehensive data-sharing agreement will lead to "a more peaceful and prosperous future".

The challenge, the two nations acknowledged, would be to create a data-sharing partnership that both allowed the free-flowing of data across the Atlantic while adhering to the different data protection laws and frameworks adopted by the two countries.

The purpose of creating the data framework is to enhance public safety, national security, and law enforcement investigations, the joint statement read.

"The challenges facing cross-border data flows are increasingly global and require solutions that work across multiple jurisdictions," said Dorries and Raimondo. "We recognise the negative trends that risk closing off international data flows.

"In response, we seek to shape a global data ecosystem in a manner that promotes and advances interoperability between different data protection frameworks, facilitating cross-border data flows while maintaining high standards of data protection and trust.

"We are committed to open and inclusive engagement with international partners, industry, civil society, and consumer and privacy rights groups."

Talks of a cross-border data-sharing agreement between the UK and US have been taking place for years and there were fears that once the UK left the European Union (EU), and was no longer compelled to adhere to GDPR domestically, that such an agreement between the UK and US would undermine data protection laws on home soil.

In 2019, when leaked documents confirmed the US was lobbying the UK for a data-sharing agreement, US officials cited the Asia-Pacific Economic Cooperation-Cross-Border Privacy Rules (APEC-CBPR) agreement as a model the two nations could follow.

The EU has had a watchful eye over the UK and US' data dealings for some time. Later in 2019, the two countries struck up a preliminary agreement with a narrower focus: to make it easier for sensitive data to be accessed across the borders for the purpose of crime fighting.

The move was originally designed to make it easier for UK and US law enforcement to access the data they needed for investigations without too much friction, but the EU then warned both countries that the agreement may not be sufficiently compatible with EU data protection standards.

European Data Protection Board (EDPB) director Andrea Jelinek wrote to the UK at the time saying the agreement may harm the UK's chances of securing a post-Brexit data adequacy agreement with the EU, an agreement it later achieved this year.

Privacy technology prize challenge

Also announced by the two nations at the Summit for Democracy was a brand-new prize competition to encourage the development of, and mature privacy-enhancing technologies (PETs).

The prize challenge will form part of a series of international grand challenges to promote democracy-affirming technologies to accelerate work and overcome gaps in the technology used to protect the privacy of citizens.

It's the thought the work that goes into the challenge will build on the innovation already being made across academia, the private sector, and government, harnessing data to help protect privacy and intellectual property.

"Privacy-enhancing technologies can help our democracies to harness the power of data and AI to support our citizens and businesses - in a way that reinforces our shared values," said Dorries.

"The UK is striving to unlock the power of data across the economy. This prize challenge will build on the UK’s comprehensive National Data Strategy and help to raise the profile of these technologies on both sides of the Atlantic, laying the foundations for future collaboration."

Winners of the prize will be announced at next year's Summit.

ID.me has partnered with Sterling Check to offer an in-person identity verification solution.

Per reports, the New Jersey Department of Labor and Workforce Development (NJDOL) is the first government agency to adopt the new service. Using the solution, the state will increase equity and access to unemployment benefits for residents.

“During the pandemic, unemployment reached 14.8% - the highest rate observed since data collection started in 1948, according to the Congressional Research Service. At the same time, the Federal Trade Commission reported identity theft tied to government benefits increased by 2,920%,” explained ID.me.

To meet the needs of the unemployed while keeping security high, ID.me and Sterling co-developed an in-person verification tool, expanding digital verification options.

The joint solution enables individuals, including those without mobile devices or internet access, to verify their identity at retail locations nationwide. The solution also adds to ID.me’s commitment to “No Identity Left Behind,” an initiative aimed at making digital identity accessible and secure for all citizens.

What’s more, spanning over 650 retail facilities across the US, Sterling's Identity Network offers background and identity checks for a range of financial institutions, including some of the largest in the nation. Local communities can now access in-person identity verification offered by trained technicians. Eligibility for unemployment benefits is determined in accordance with federal law.

As an added benefit, ID.me credentials can also be used to access other government and commercial services.

"Sterling is thrilled to partner with ID.me in expanding secure identity verification and proofing and to provide availability for those without a mobile device or dedicated internet access," said Josh Peirez, Sterling CEO.

Peirez added, "Our industry knowledge, innovative technology and relationships with more than 47,000 clients, paired with ID.me's services allow us to increase access to a verified identity."

This automatically-generated transcript is taken from the IT Pro Podcast episode ‘Can the US take on big tech?’. To listen to the full episode, click here. We apologise for any errors.

Adam Shepherd

Hello, and welcome to the IT Pro Podcast. I'm Adam Shepherd.

Justin Cupler

I'm Justin Cupler.

Zach Marzouk

And I'm Zach Marzouk.

Adam

And today we're playing Monopoly. Now, if you've been paying attention to the intersection of technology and politics over the last year or so, you'll probably have noticed a growing trend of lawmakers railing against big tech companies. This has been particularly pronounced in the US where a number of bills have been launched, with the aim of breaking up the supposed monopolies held by giants like Facebook, Google and Amazon.

Zach

This week, we're taking a look at these proposed laws examining the corporate practices they take issue with and why these practices have arisen in the first place, as well as the potential impact that these bills could have on America's status as an innovation centre.

Adam

So, guys, before we dig into this topic in earnest, let's just start off with a little bit of a chat about what the kind of main issue is with these anti monopoly bills. Why are there so many of them just now?

Justin

I think we're coming off an administration with a lot of turmoil with big tech. I think that's number one. That side of the political parties is charged up right now to take them on. But there's also a collection of the other side that's been charged up for a long term to take on certain parts of it. Section 230 has been a big, big target of them. And it's kind of rolled off the back of that. And then you added all these mergers that have been popping up, that are happening at at a feverish pace lately. I think that's why we're starting to see them consider these antimonopoly bills and push harder on them.

Zach

Yeah, I think with the obvious growth of the internet in the last decade or so, it means that big tech companies' power has grown incredibly, not only in the US, but also across the the world. And I think legislators are now beginning to wake up and realise that they really need to maybe introduced some form of regulation to crack down on their power.

Adam

Yeah, and I think it's worth noting as well, that there are a huge amount of anti monopoly bills and anti monopoly arguments that have emerged over the last couple of years. But they're spread across a pretty diverse set of opinions, you know, they're not all targeting the same kind of problems and talking points. There's actually a huge range of complaints that have been levelled at big tech in this kind of same area. So let's take a look at some of the specific bills that have been launched. Zack, you've been doing a lot of research into this recently. What are the kind of the main ones that are currently looking to gain traction on the floor?

Zach

Okay, so in Biden's executive order that was signed earlier in the year, he wanted to promote competition in the country, and basically focus on areas in which big tech firms are undermining competition and reducing innovation. So this included policies like a greater scrutiny of mergers, encouraging the FTC to establish rules on surveillance and accumulation of data and rules barring unfair methods of competition on internet marketplaces. And then linked to that he also wants to make it easier and cheaper to repair items consumers own. So essentially a right to repair.

Adam

Well, it's something we've heard a lot about over the last couple of years, particularly around things like planned obsolescence.

Zach

Yeah, I think the only tech company who is investigating right to repair right now is Microsoft. And that's only because they were activists, activist investors, who last month pressured the company to start in the midst of an investigation into right to repair. In June, there were five other bills in the House of Representatives that were discussed. So the first bill is called the American Innovation and Choice Online Act which seeks to prohibit discriminatory conduct by dominant platforms, including a ban on self preferencing. There's a second one called the Platform Competition and Opportunity Act, which prohibits acquisitions of competitive threats by dominant platforms, as well as those that expand or entrench the market power of the platforms. The third bill is the Ending Platform Monopolies Act, which looks to eliminate the ability of dominant platforms to leverage their control across multiple business lines to self preference and disadvantage competitors. The fourth bill is called Augmenting Compatibility and Competition by Enabling Service Switching, which essentially brings in new data portability requirements to try and promote competition by lowering barriers to entry and switching costs for businesses and consumers. The fifth bill is called the Merger Filing Fee Modernization Act; it updates filing fees for mergers for the first time in two decades, I think that one's slightly more of like an administration, or like bureaucratic bill.

Adam

And that data portability bill in particular, is something that a lot of people have been paying attention to in a business context. One of the big fears in business IT is this concept of vendor lock in where you know, once you've moved to a service, it can often be very, very difficult to actually get your data out and bring it over to a new service, I'm sure all of us will be familiar on the consumer side with how difficult it is to take your mobile number, for example, from one network to another. And, you know, when you're dealing with a business estate that has maybe terabytes or petabytes, even, of data that you want to take from one, say, cloud storage provider to another, that kind of frustration is just orders of magnitude greater. So we've also seen bills, looking at digital storefronts and the app economy, right?

Zach

Yeah, that was introduced in August. It's called the Open App Markets Act. It declares that Google and Apple have gatekeeper control of the two dominant mobile operating systems as their app stores allow them to exclusively dictate the terms of the app market. So it's looking to break that up.

Adam

Yeah, it's a particularly thorny question, because I'm not sure if anyone has ever tried to use any of the alternative app stores out there. Because there are, there are other app stores that you can use, they usually involve sideloading applications onto your phone through slightly, not dodgy, but by means that are not recommended, let's say. And Amazon operates its own app store, for example. Microsoft operates obviously a separate UWP app store for Windows. But the apps that find their way onto there generally are not good. The selections are usually very, very limited. The quality control is nowhere near as good, as you know, even the Google Play Store, which I think says a lot for anyone that's dived into the bowels of the Play store before. And it does sort of beg the question, Are these two platforms dominant because they're kind of keeping a stranglehold on competition? Or are they dominant because they're just the best options?

Justin

Yeah, I think one of the problems they're gonna have with this is the the consumer demand for more app stores. I mean, I like you said, I've never heard of any other episodes, except for Amazon App Store, and Microsoft. Nor will I go to any others because I just don't trust them. So is there a company out there willing to dive into this and take advantage of this anti monopoly bill? Or are they just spinning their wheels trying to nail Google and nail Apple or whatever?

Zach

So yeah, the last two bills that were proposed, were in October. And they would essentially bar big tech platforms from favouring their own products and services. That's the first one. And then the second bill, was what Justin was talking about, which would basically remove some of the protections given to tech companies by something called Section 230, which is a portion of the Communications Decency Act that exempts them from liability for what is posted on their platforms. All the bills that are being proposed are a result of cross party efforts. So it's both Democrats and Republicans working together to introduce them.

Adam

So what do we think about these bills, then? They're fairly wide ranging, I think it's fair to say. And as Zack mentioned, they kind of broadly, they have broad kind of bipartisan appeal. But do we think that these are kind of legitimate issues that are being brought up?

Justin

I think the the most legitimate one I see on here, the one that has the most grounds to stand on is the limiting of mergers and acquisitions. Because now you have startups that are literally starting up just for the plain goal of being acquired by one of the big giants. And these giants are gobbling them up, changing the name, putting it under their umbrella and running with it. And that that is limiting a lot of innovation. It's limiting people who legitimately want to get a start running, want to run this as an actual startup that's going to be successful. It's limiting those people's ability to do this in lieu of the people who want to go out there and just sell their startup for a billion dollars.

Adam

So looking at mergers and acquisitions landscape, one of the problems or supposed problems that that one of these bills is trying to address is the practice of essentially catch and kill. So big tech companies buying startups that they see as a potential threat, and essentially just subsuming them into, into their kind of existing corporate structure, you know, largely when they're doing something that whichever company it is, is already doing. But is this a problem? I mean, this has been going on really for, you know, as long as, as business acquisitions have been a thing, what is it about big tech's use of this tactic in particular that lawmakers are finding so objectionable, do we think?

Justin

I would say the thing they're seeing the most is the, for example, the ultimate dominance of Google. Now they see this all, I mean, they are the end all be all of tech right now, everything you touch every day, has something to do with Google. And that is through acquisitions, mergers, buying companies, buying, and all of this. And that's where this all came from. And everyone kind of followed suit with them, then them and I believe Microsoft is also one of those ones, that's gobbling up things left and right. And now all the other tech companies below them are doing this exact same thing. So we're seeing this trend; for Google, it was Okay, it's convenient, it was easy for all of us, because we had all these services packaged into one nice tidy package. Now it's getting to a point where everything is going that direction, and it's becoming a problem.

Adam

And you mentioned Microsoft there, I think it's important to highlight that this, or certain elements of this, at least, aren't exactly new, particularly in terms of the self preferential stuff. Of course, Microsoft famously, back in the, back in the 90s, was the subject of a massive antitrust case for effectively killing Netscape by putting Internet Explorer as the default web browser option on Windows, which gave it a huge market share, got a load of people used to using Internet Explorer, and basically, for a long time completely stifled the browser market. So this isn't new, per se. But one of the really interesting things about the the self preferential argument is, I think you could make an argument that it is reasonable for companies to promote their own services and their own products. And it's not something that's unique to tech; when you go to the grocery store, for example, you will quite often see prominently featured, that store's own-brand products, you know, they will be promoted heavily, they will often be discounted or sold under special offers. And that isn't really that much different compared to some of the tactics that tech giants are using to promote their own services - in some cases.

Zach

I think the comparison there would be that there would only be one supermarket in the country. And I think that's the comparison we can make with something like Google.

Justin

But to play devil's advocate on that on that is the fact that there, again comes into simplicity for us as the end user, when they give preferential treatment to these these different softwares and hardwares and things like that. It's because they Yes, it's their their service and their hardware, but it's also easier for them to develop it in house and make it work the right way. When they have to go out and suddely spread out to other places, and then link up with other systems and deal with them. You can run into some issues, there are some you know, there's some software's out there to integrate things like Zapier and things like that, but they don't exactly do, they don't function the way it's supposed to function if it's actually put together and given that preferential treatment.

Adam

Yeah, and I think the existence of platforms like Zapier, and If This Then That, and all of these kind of framework based services really illustrates that point, you know, the fact that we need third party services, to to form the kind of the links between all these services that we're using, illustrates how difficult it is to get these systems to talk to each other. And considering that we, in a lot of cases, need these systems to talk to each other in order to do the things that we need to do, not just on a consumer level, but especially for businesses, it does sort of raise the question, Is it reasonable to kind of make that trade off and say, okay, you know, maybe this makes it a little bit harder for newer competitors to break into the market, but It's also providing an arguably essential service.

Zach

I think there have been some voices in the industry as well who have raised concerns around this bill, the self preferencing one. Essentially, they're asking, Will it ban Google from showing YouTube videos in its results?

Adam

Yeah, and I think with tech in particular, we've reached a point now, where so many systems, particularly the systems that we've already talked about, you know, Facebook, Google, Microsoft, and Apple to certain extents, they're all networked so tightly together, that splitting them up would be incredibly difficult, if not actively impossible. I mean, like, the Facebook outage that we had a couple of months ago, is a prime example of that. The reason that that took as long to fix as it did, is because Facebook has deliberately architected itself in such a way that all of its systems are completely interdependent. And effectively, you can't split it up because WhatsApp's backend infrastructure and back end tooling runs on top of Facebook's platform; it runs on top of Facebook's kind of domain, and unpicking all of that and separating out those services may not even be possible without effectively burning it to the ground and starting again, from scratch. I would imagine Google and Microsoft are both similar in terms of how their systems talk to each other, because that's the most straightforward way to design systems in a lot of cases, you know, you link what you already have together. Facebook, presumably, has also done it with half an eye on making sure that it doesn't get split up at some point, because Facebook in particular has been fielding these particular monopoly questions for a number of years now. But it also just makes good engineering sense. So on that note, then, is it possible to address the kind of concerns that we've already spoken about with regulation? You know, how many of these problems can be legislated for?

Zach

Yeah, I think this is a really good question, you can definitely bring in regulation to curb the power of big tech, but I don't know if it will go far enough, especially since the bills are still being discussed. So we don't know what the end, the final bill would look like. I think if you look at China, and see what they've done in terms of regulation, which is probably like the other end of the scale, the spectrum, compared to the US, they're definitely taking a stance against big tech, you know, they're curtailing the power of tech giants, you know, firing CEOs and so on. But I don't know if the US is going to go all the way and bring in the right legislation that will address the power of big tech.

Adam

So let's dig into that quickly. What kind of measures is China taking at the moment against these kinds of monopolies? Because they're being pretty drastic, right?

Zach

Yeah. So right now China is curtailing the power of their technology platforms. So you may have seen Jack Ma, the Alibaba CEO, he appeared to disappear, if you like, for a while and has now only just resurfaced in Europe. So we're not sure what's going on there. But another CEO stepped down recently, I think, the CEO of TikTok and then before that, the CFO of Bytedance stepped down to focus on TikTok, so I think there's definitely some kind of shift going on there. China brought in a new data law recently. So in China, right now, if you're a tech platform, you're 100% responsible for any content that's published there. Which means that for many companies, social media companies from the West, that is a huge problem, because they don't really mind what's posted on their platforms. Whereas in China, you have to ensure you're following the cyberspace agency's policies, otherwise, you could end up with some kind of penalty or fine, which includes a financial penalty or also a penalty for people who work with data in your business, or even those people at the top. Whereas in the US, you don't really see that happening. I don't think the regulation is going to address that in any way.

Adam

And no. and China, of course, is is famous for being, shall we say, fairly heavy handed with its approach to corporate regulation in particular. And its kind of adherence to, to policy guidelines.

Zach

Microsoft shut down LinkedIn in China the other week, which is related to its online laws. So LinkedIn was one of the last Western social media platforms available in China. And it decided to shut it down in and it's going to introduce a new kind of like job board portal, but without the social media aspect.

Adam

Which is, I think, quite interesting in terms of how companies are kind of approaching compliance in China. But moving things back to the US. Do we think that these proposed regulations are actually capable of solving the challenges that they set out to? Or are these issues simply too big to be tackled with, you know, new laws?

Justin

I think when you come to the preferential treatment, the preference they give their own apps, and their own hardware and so forth, I think that is at this point, it's almost beyond repair. I mean, if you think about it, that would involve taking the the massive being that is Google and trying to break it up into small pieces. How many of Congress's bills are stored on Google Drive right now? Who knows. So breaking that up, is gonna that's gonna be a bear in itself, that's gonna affect everybody. We work in Google Drive, everybody works in Google Drive, they're all linked to different things. And that's all linked to your email, which is all linked to your Slack. And you're gonna blow this up, that's that's probably not going to happen. Will it be some regulation, moving forward, forward looking stuff, I think there will be forward looking regulation. But I do not think it's going to be retroactive, I believe what's going to happen is if they introduce these, it's going to be you're grandfathered in. But don't do it again. As for things like the mergers and acquisitions, I think that again, is going to be the one that they're gonna be able to make the biggest moves on. Because that, again, is a problem. It's a major problem. It's killing innovation in this country, that the big dogs are coming in, as you say, catch and kill, grab these companies that are their potential rivals, and kill them, absorb their technology and move forward. And we see in the automotive space, also these these companies, larger companies, gobbling up battery companies for EVs, absorbing them and spitting them out, and they no longer exist, they just take the batteries and run with them. So I think that's what we're gonna see across the board, tech, automotive, everyone's gonna have that issue. And then the rest of these, it's really hard to say, because they do have, you do have cross platform or cross cross the aisle support. But is there enough cross the aisle support between all of them to get the votes needed to push them through? That remains to be seen that that's really hard to say, because big tech has a lot of reach in politics, they really do. So will they be able to get enough people on board to say, rewrite section 230, that's been on the table for five years. And still, nothing has happened, no one has come forward with any kind of regulation that could possibly replace it or even tweak it a little bit in the past five years, they haven't been able to, they've been pushing so hard on it. So those ones I doubt will; with the two I mentioned, I think moving forward with with the preferential treatments and the overall scope of the mergers and acquisitions, I think those two are the most most most likely to be pushed forward.

Adam

So do we think that there is a possible future where we see Congress stepping in and breaking up some of the bigger tech players, you know, Google, Facebook, Microsoft? Do we think we'll, we could feasibly see some of those divisions hived off into their own companies in the same way that we saw in the UK with the BT Openreach split a couple of years ago?

Justin

We had something similar to that with, I believe it was Bell South. When it came to telephone long distance providers, they had to break up I believe it was into three or four different companies. But there's a big difference. People always point to that one; there's a huge difference. Back then you're talking about physical stuff, you're talking about physical offices, physical lines, physical subscribers, and now you're talking about data and servers and things like, things that are virtual that you now have to divide up. That's that's a whole other undertaking that I'm not sure if Congress has the ability to dive into and really figure out how to do this because they're gonna have to write the regulations to how they will divide this stuff. When you're splitting a line, that's easy, you say, okay,Bell South, you get this line, this telephone company or this new telephone company, gets that line, Verizon, you get that line. But when it comes to this digital stuff, how are you going to break this apart? It's almost impossible.

Zach

One thing we should mention is that the bills are still being discussed. I think they were meant to be put to the floor in October. But it's a little bit peculiar that the legislators are still discussing the bill, which gives me the feeling that they're not quite sure what to do. If you cast your mind back to when Zuckerberg appeared in front of a committee, and you had senators asking fairly strange questions to him. It could be linked to that. I hope it isn't. But it's something to bear in mind.

Adam

Yeah, it's it's the problem that every every effort to regulate the tech industry faces. These regulations are being formulated and dicussed by people who, bless their hearts, just do not fundamentally understand the technologies or the industries that they are dealing with, you know, because they are very complicated, it's a very complicated field, there is a lot of very complex kind of interactions, not even just on on the technical side, but just in terms of the relationships that these companies have to each other, to their customers, to the public, to the wider kind of internet infrastructure. But legislators, generally speaking, don't have the best grasp of that kind of stuff. So it's hard for, it's hard for anyone to try and sort out a problem that they don't understand, which I think is where a lot of frustrations, particularly for people in the industry, come into this. So let's say for a moment that these bills all do go through in more or less the same form that they're currently being discussed. If the bills go through in their current state, what does this do to the business climate in the US? Does this put a damper on innovation? Will it drive companies in the tech sector elsewhere? Or will it kind of have the intended effect in terms of accelerating innovation, providing a more competitive marketplace, you know, all of the silver lining type stuff?

Justin

I think one thing you said, Adam, that that's a good point to bring up, that's probably going to be the biggest benefactor from this are going to be the third party apps, the third party integration apps, and the third party integration, softwares that bring these together, like the Zapiers and so forth. I think that's where we're going to see the biggest innovation if they have to break all these up, because now someone has to come in and put these pieces back together. And these companies are already tuned to doing that, they will just have to get a little bit better at it, and market it. And I think that would be a huge boom in that industry.

Zach

I think it's very hard to think of an internet that isn't based on a platform ecosystem, I definitely think there's a case for thinking about an internet in the future where citizens aren't locked into corporations that hold their data in silos and only exist to I guess, produce profit for shareholders. Maybe we should be thinking about a new kind of social media that wrestles power away from the huge firms. And away from thinking of the platform economy as the only way forward, maybe thinking about more of open source software. Now, I don't think this regulation is going to take us that way. But it may hamper business interests a little bit. But I don't think having regulation is going to stop the US from being pro business at all. Like they've cracked down on monopolies in the past, whether it's Teddy Roosevelt, and so on. But it definitely needs some kind of legislation to prevent them from growing any bigger.

Adam

Mmm. And I think that data portability legislation, in particular is one that could have significant kind of tangible benefits for a lot of consumers and a lot of businesses. A lot of the other ones are kind of fairly abstract economic and market concepts, but legislation to make it easier to move from one service to another, whatever that service is, I think that's something that has a very kind of tangible benefit. So that's something that I could see actually going through in some form. But what about the rest of these bills? Do we think that these anti monopoly efforts in the broad sense are likely to succeed?

Zach

So I think some of the bills right now I have major issues with them, where they don't only hurt big tech firms, but they hurt smaller companies. So I would hope that first those issues are addressed. So the section 230 Bill, which basically protects companies from legal liability for content posted on their platforms, there is a Guardian article with comment from Evan Greer, who's the director of digital rights group Fight for the Future. So basically, the laws is only going to apply to large tech firms with five million or more monthly users. But it could have negative consequences for firms large enough to qualify for that, but still that have fewer resources on Facebook. So Greer basically said that Facebook would be able to survive that kind of bill, but smaller competitors wouldn't. Which is apparently why Facebook is calling for changes to Section 230. As I know it will solidly solidify their dominance and monopoly power. He called the bill well intentioned, but a total mess.

Adam

That's fairly damning.

Zach

Yeah. So I think hopefully, there'll be some changes made before they are out to be voted on, although we're not quite sure when that's going to happen.

Adam

Yeah, they could end up being quietly dropped from the agenda. which has happened before. Well, I'm afraid that's all we've got time for on this week's episode. But thanks once again to Justin and Zack for joining me.

Justin

Thanks for having me.

Adam

You can find links to all of the topics we spoken about today in the show notes and even more on our website, or you can follow us on social media for more. Don't forget to subscribe to the IT Pro Podcast wherever you find podcasts to never miss an episode. And if you're enjoying the show, leave us a rating and a review. We'll be back next week with more analysis from the world of IT but until then, goodbye.

Zach

Bye!