đď¸ Policy & Enforcement
Top Stories 5
The FBI has taken control of virtualine.net, the primary domain of the Russianâlanguage bulletproof hosting provider Virtualine, which was known for supporting phishing, spam, carding, ransomware and illicit content. Court documents detail the providerâs history of ignoring abuse reports and facilitating hackâforâhire services. The seizure aims to hinder the providerâs ability to attract customers, though underlying infrastructure may remain operational.
Key points
- Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech, hosted a range of illegal services and ignored lawâenforcement takedown requests.
- The provider promoted phishing, spam, carding, ransomware support and even hosted sites selling explicit content and hackâforâhire services.
- TRM Labs reported Virtualine received the highest illicitâattributed cryptocurrency inflows among bulletproof hosts, including payments from a Russian drug market and sextortion schemes.
- The FBIâs domain seizure disrupts customer access but does not guarantee the shutdown of the underlying hosting infrastructure.
- The action follows multiple international takedown requests and highlights ongoing challenges in dismantling bulletproofâhosting operations.
The Justice Department has served grand jury subpoenas to election officials across California, demanding the use of federal voter lists to identify alleged nonâcitizen voters. State officials, including Los Angeles County Registrar Dean Logan, say the move seeks to intimidate and override state authority over voter registration. Parallel legal actions in Minnesota have resulted in felony charges against two rightâwing activists for election fraud.
Key points
- The DOJ subpoenaed multiple California election offices, citing up to 190,000 potential nonâcitizen voters based on federal and commercial data.
- State officials argue the data is inaccurate, noting most flagged individuals are naturalized citizens or registration errors.
- Los Angeles County Registrar Dean Logan called the subpoenas an intimidation tactic against state election authority.
- In Minnesota, Hennepin County Attorney charged James OâKeefe and Cam Higby with unlawful voting and identity theft.
- Civil groups and the ACLU are mobilizing to protect voter rights ahead of the November election.
The Nasjonal sikkerhetsmyndighet (NSM) announced that Norwayâs national cyber risk level has been elevated to HIGH, citing increased threats to critical infrastructure and the rise of AIâdriven attacks. NSM released a 21âpoint security measure package for public and private organisations to strengthen resilience.
Key points
- NSM elevated the national cyber risk rating from MODERATE to HIGH, reflecting a threeâfold rise in successful cyber operations against Norwegian entities over the past six months.
- The agency highlighted heightened exposure of defence, space and other criticalâinfrastructure sectors to ransomware, DDoS and compromise attempts.
- AI and large language models are identified as emerging tools that can accelerate vulnerability discovery and offensive cyber activity.
- NSM issued a 21âitem mitigation framework covering phishingâresistant MFA, system hardening, logging, supplyâchain risk management and network segmentation.
- Organisations are urged to use the public âcybersjekk.noâ assessment to gauge their security posture and begin implementing the recommended controls.
The United States, European Union, Australia, Canada, France, Germany, Italy, Japan, the Netherlands, NewâŻZealand, the Republic of Korea and the United Kingdom announced coordinated sanctions targeting North Koreaâs overseas worker programs, malicious cyber activity and illicit cooperation with Russia. The measures aim to cut funding for Pyongyangâs WMD and missile programs.
Key points
- The joint statement cites DPRKâs use of overseas labor and cyberâenabled fraud to finance its nuclear and ballistic missile programs.
- Sanctions also target entities involved in illegal DPRKâRussia military cooperation.
- The action builds on reports from the Multilateral Sanctions Monitoring Team documenting UNâsanctions violations.
- The coalition urges full implementation of all relevant UN Security Council resolutions.
- The statement reaffirms commitment to a complete, verifiable and irreversible denuclearisation of the DPRK.
The UK budget proposes a consultation on assigning liability to technology firms for insecure products, marking a shift from voluntary codes. The move follows pressure from the NCSC and recent highâprofile breaches such as Jaguar Land Rover, and aligns with EU cyberâresilience legislation. No specific regulations are in place yet.
Key points
- The 2024 UK budget includes a bullet point to consult on holding software companies accountable for insecure products.
- The proposal builds on the Law Commissionâs review of product liability and may extend the PSTI Actâs security requirements.
- It responds to NCSC chief Ollie Whitehouseâs calls for a strategic policy agenda and to parliamentary concerns over economic and nationalâsecurity risks.
- The initiative aims to align UK rules with the EU Cyber Resilience Act, which can fine manufacturers up to âŹ15âŻmillion or 2.5% of turnover.
- Past incidents like the JaguarâŻLandâŻRover hack, estimated to cost ÂŁ1.9âŻbillion, underscore the economic impact of insecure software.
Other Updates 10
CISAâs 2030 strategy sets a threeâpillar roadmap for defending, hardening, and prevailing over emerging cyber and physical threats to U.S. critical infrastructure.
Key points
- The strategy positions CISA as the lead coordinator for national cyber defense, partnering with government and industry to lower risk and disrupt malicious activity.
- It prioritizes protection of infrastructure whose disruption would most impact public safety, the economy, and national security.
- CISA will enhance continuity of communications and build resilient partnerships to enable rapid collective response to threats.
- The roadmap aligns with the 2026 National Resilience Strategy and other administration directives.
- Implementation focuses on proactive risk reduction, resource allocation to highâimpact sectors, and capability transformation for resilience.
GCHQâs missing removable media and flawed tracking raise oversight concerns, according to the IPCO annual report.
Key points
- GCHQ acknowledges it cannot determine the scale, location, or recoverability of thousands of lost storage devices.
- IPCOâs 2025 report calls the agencyâs mediaâtracking system insufficient and urges corrective action.
- Some devices may hold data collected under the Investigatory Powers Act, though no breach is confirmed.
- The report also notes a softwareârelated error that led to wrongful counterâterrorism actions against five members of the public.
- GCHQ says it has audited its inventory and updated processes, but the total loss count remains unclear.
DOJ moves to protect Character.AI usersâ data amid bankruptcyâdriven sale plans.
Key points
- The DOJâs bankruptcy office argues that Character.AIâs privacy policy allows the company to sell user chat histories, including personally identifiable information, during a sale.
- A consumerâprivacy ombudsman could be appointed to advise the court on restrictions for data transfer, especially for minors and sensitive health or demographic data.
- Character.AI reports 12âŻmillion active monthly users, with average daily usage of two hours per user.
- Critics say the policy is vague and that users may be unknowingly identified from their chat content even if names are removed.
- The filing follows lawsuits alleging mentalâhealth harms linked to the chatbot and references similar dataâsale concerns in other bankruptcy cases.
Anthropic and OpenAI submit competing recommendations to California on how to halt unsafe frontier AI models.
Key points
- Anthropicâs October 15 letter asks the California AG to obtain court orders to suspend, limit, or halt deployment of highârisk AI models.
- OpenAIâs October 20 letter supports amending SBâŻ53 to mandate that developers maintain effective shutdown controls and use them when needed.
- Both firms back independent safety assessments, periodic risk reporting, and a stateâfunded pool to finance evaluators.
- The proposals are part of the stateâs response to Governor Newsomâs executive order Nâ9â26, which seeks recommendations by NovemberâŻ16.
- Anthropic mentions partnerships with METR, SecureBio and Accenture; OpenAI calls for collaboration with NIST on assessment standards.
Russia establishes a governmentâled protection program for data centers following UAV strikes on major providers.
Key points
- The Ministry of Digital Development (ĐинŃиŃŃŃ) formed a dedicated shield to guard communication infrastructure against external destructive actions, primarily UAVs.
- Five data centers belonging to Yandex, Sberbank and VK were reportedly attacked by drones across various Russian regions.
- Three protection tiers (K1âstrategic, K2âregional/economic, K3âcorporate) were defined, outlining impact durations and required safeguards.
- The average cost of a server rack in Moscow was cited as 170.8âŻkâŻRUB in Q2, highlighting economic considerations for the protection program.
NISTâs new report details a phased, crossâsector plan to adopt postâquantum cryptography by 2035, with accelerated federal deadlines.
Key points
- The NISTIRâŻ8547 document defines useâcaseâspecific migration schedules and highlights the âharvest now, decrypt laterâ risk.
- It references existing PQC standards released in 2024 and sets federal completion targets: 2030 for key establishment, 2031 for digital signatures, 2035 overall.
- The roadmap supports hybrid cryptography approaches and emphasizes prioritizing FIPSâŻ203 for highly sensitive data.
- Guidance is intended for federal agencies, industry partners, and standards bodies, linking to NCCoEâs migrationâtoâPQC project.
- National Security MemorandumâŻ10 and Executive OrderâŻ14412 provide the policy backdrop for the accelerated timeline.
Congressional committees request DoorDashâs AI usage details amid concerns over Chineseâbuilt models.
Key points
- The House Homeland Security and Select Committee on the Chinese Communist Party sent a letter to DoorDash asking for information on its use of Chinese AI model KimiâŻK2.6 from MoonshotâŻAI.
- DoorDashâs founder previously disclosed delegating lowerâlevel AI tasks to the Kimi model, noting cost and performance benefits over other providers.
- Lawmakers argue that reliance on PRCâdeveloped openâweight models raises nationalâsecurity risks despite no prohibitions on their use.
- The request is part of a broader congressional effort, including similar letters to Cursor and Airbnb, to assess U.S. companiesâ exposure to Chinese AI technology.
Erdogan led a board meeting to launch Turkey's Digital Sovereignty Strategy, focusing on AI threats and tech independence.
Key points
- The strategy targets reduced dependence on foreign technologies and development of domestic capabilities through 2030.
- Board members discussed how AI accelerates cyberâthreat scale, speed, and sophistication.
- Key priorities include safeguarding critical infrastructure, enhancing national cyber resilience, and deterring attacks.
- Implementation will be coordinated across public agencies, private sector, and academia with regular monitoring.
- The meeting highlighted risks of algorithmic manipulation and cognitive influence on national security.
Democrats demand the White House keep records of AI chatbot interactions to address security and compliance risks.
Key points
- Democratic reps Jamie Raskin and Robert Garcia sent a letter to President Trump requesting preservation of any AI chatbot prompts and responses used by the president or staff.
- The request references the Presidential Records Act and highlights potential nationalâsecurity vulnerabilities from reliance on unsecured, private AI services.
- Lawmakers cite reports that Trump consulted the Grok chatbot for advice on military actions against Venezuela, calling the practice âdeeply troubling.â
- The letter also asks for a briefing on AI chatbot contracts, documentâretention policies, and cybersecurity safeguards applied in the White House.
FTC subpoenas major airlines and gig firms to reveal dataâdriven pricing and pay algorithms.
Key points
- The Federal Trade Commission sent 45âday information requests to JetBlue, Delta, United, Lyft, Uber, DoorDash, Instacart, Walmart and Target.
- Companies must provide the data inputs, tools and procedures used to set individual customer prices and gigâworker wages.
- The probe follows a 2024 inquiry that relied on thirdâparty consultancies and yielded no concrete findings.
- FTC Chair Andrew Ferguson said the study will focus on direct company disclosures rather than middleâman data.
- The agency previously sought public comment on a policy proposal that could deem undisclosed dataâbased pricing unlawful under the FTC Act.
Additional Signals 13
GM settles for $220âŻmillion after states allege it sold driver data without consent, prompting new privacy safeguards.
Key points
- GM will pay $220âŻmillion to resolve claims that it sold driver location and behavior data to brokers and insurers without explicit consent.
- The settlement requires GM to obtain affirmative consent before collecting or sharing such data and to strengthen its privacy program.
- The disputed "Smart Driver" program, active from 2016â2024, enrolled millions of drivers and linked them to OnStar services.
- Dealerships allegedly received incentives for enrolling customers, and over 370,000 drivers were mistakenly told they were not enrolled.
- A separate Texas lawsuit remains pending, seeking additional penalties and data deletion.
Microsoft warns Entra ID admins to replace SMS/voice MFA with passkeys before the 2027 retirement.
Key points
- SMS and voice MFA will be discontinued for Entra ID workforce tenants on FebâŻ1âŻ2027, affecting signâin and MFA flows.
- Admins should migrate users to passkeys, QRâcode authentication, FIDO2 security keys or other supported methods to avoid disruption.
- Microsoft offers a PowerShell script to locate accounts still using phoneâbased authentication and documentation for passwordless deployment.
- Passkeys will become the default authentication experience for Entra ID starting September 2024.
- Organizations requiring phoneâbased MFA can retain it only via thirdâparty telecom providers configured through the Microsoft Security Store.
Proton says Canadaâs proposed lawfulâaccess bill would prevent its expansion due to privacy concerns.
Key points
- Proton, which serves over 100âŻmillion users with endâtoâend encryption, announced it will not pursue a NorthâAmerican headquarters in Canada if Bill Câ22 passes as drafted.
- The bill would compel electronic service providers to retain extended metadata and keep ministerial orders secret, conflicting with Protonâs privacy model.
- Apple, Meta and Signal have also voiced opposition, warning they could withdraw services if forced to weaken encryption.
- Protonâs CTO Bart Butler warned the powers could be misused by future authoritarian governments and cited past censorship challenges.
- Public Safety Minister Gary Anandasangaree offered to meet with Proton to clarify the legislationâs impact.
A First Amendmentâcentered licensing approach is recommended for AI model weight regulation under export controls.
Key points
- Openâweight AI models are gaining traction, prompting calls for government oversight of model weight distribution.
- Export Administration Regulations administered by the Bureau of Industry and Security are identified as the likely regulatory tool.
- The piece contends that model weights qualify as speech, requiring First Amendment protections for developers and users.
- A licensing regime could balance security concerns with constitutional rights, avoiding heavyâhanded bans on openâweight models.
TikTok staff warned of child safety failures, but executives allegedly failed to act as lawsuits proceed.
Key points
- Employees raised alarms that minors were featured in sexual videos that could be monetized, constituting a potential financial crime.
- Staff identified technical workâarounds allowing users under 18 to bypass ageârestricted content and hide activity from parents.
- Internal documents indicate TikTok avoided ageâverification surveys to prevent FTC scrutiny.
- TikTok is a defendant in multiâdistrict litigation and has settled multiple youthâsafety lawsuits, including an $8âŻmillion Kentucky school district deal and a $100âŻmillion Alabama settlement.
- Company spokesperson dismissed the allegations as cherryâpicked, while deposition testimony describes internal battles to elevate safety issues.
A joint federalâstate initiative, Project Lifeline 250, aims to secure rural South Carolina hospitals with free cyber defenses and backup solutions.
Key points
- The pilot connects rural hospitals with American tech firms and cyber experts to identify vulnerabilities and defend against attacks.
- It will deploy physical backup devices to maintain care continuity after a cyber incident.
- Highârisk and legacy medical devices will be identified and replaced as part of the program.
- The effort builds on the earlier Project Watershed 250 pilot in Texas and involves the Office of the National Cyber Director, SC Critical Infrastructure Cybersecurity program, and private partners.
- Cisco and Cyera are among the industry partners providing expertise and tools.
Questionnaires dominate vendor risk assessments, but regulators now demand independent proof over selfâreported answers.
Key points
- Security teams devote hundreds of hours annually to answering and reviewing vendor questionnaires, a process seen as essential for closing deals despite its unreliability.
- Selfâreported answers are often unverified, and thirdâparty breaches have risen, with the 2025 Verizon DBIR noting a jump from 15% to 30% of incidents involving vendors.
- Regulators such as NYDFS have issued guidance requiring upfront vendor vetting, ongoing riskâbased reassessments, and reliance on independent audit reports rather than vendorâfilled forms.
- The article cites high breach costsâapproximately $4.9âŻmillion per thirdâparty incident per IBMâs 2025 reportâunderscoring the financial risk of inadequate vendor validation.
ICANNâs tightly controlled keyâholder meetings safeguard the DNS root key that underlies internet address resolution.
Key points
- Fourteen vetted experts from around the world meet quarterly in LosâŻAngeles and on the U.S. East Coast to create a master key for the DNS root zone.
- Each primary keyâholder possesses a metal key to a safetyâdeposit box containing a smartcard that activates the keyâgeneration machine.
- Backup keyâholders hold smartcards with code fragments to rebuild the machine if needed, sending photo verification to ICANN annually.
- The ceremony is streamed live and includes multiple layers of physical security such as pin codes, smartcards, biometric scans and a manâtrap entrance.
- ICANN, a U.S.âbased nonâprofit, runs the process to ensure the authenticity of DNS entries and prevent malicious domain spoofing.
Microsoft warns unsupported Windows devices will lose update support after 2027 certificate rotation
Microsoft patches a VPN break introduced by September 2026 Windows 11 updates, with a preview fix and a protocolâselection workaround.
Microsoft warns unsupported Windows devices will lose update support after 2027 certificate rotation
Key points
- The September 2026 Windows 11 security updates broke Always On VPN connections when automatic protocol selection or fallback was enabled, causing connections to hang or error with "port already in use".
- Microsoft confirmed the issue is fixed in the KB5127936 preview update, which restores proper VPN operation for affected devices.
- A temporary mitigation involves configuring VPN profiles to use only SSTP or only IKEv2, avoiding automatic selection.
- The same preview also addresses a separate Remote Desktop nonâadmin access problem introduced by earlier updates.
- Microsoft previously misâflagged the issue as resolved in October 2026 cumulative updates, prompting further confusion among IT admins.
EU approves GDPR tweak that lets major AI firms use European personal data without consent, sparking privacy concerns.
Key points
- The Council adopted Article 88bis, permitting AI systems to process any personal data by default, citing a broad âlegitimate interestâ for AI companies.
- The change overrides GDPR consent rules and adds minimal safeguards, applying to data collected decades ago and to nonâcustomers.
- Privacy activist Max Schrems warned the amendment amounts to a âdigital expropriationâ benefiting US and Chinese AI giants.
- Support came from Germany and other EU powers, with the Irish Presidency steering the proposal.
- The move bypassed a fundamentalârights impact assessment and sidestepped the European dataâprotection expert group.
Noyb accuses Scale AI of illegal worker tracking and biometric collection across four EU countries.
Key points
- Noyb alleges Scale's Outlier platform records mouse clicks, keystrokes, IP addresses and other identifiers, embedding thirdâparty trackers from firms like TikTok and Datadog.
- The complaints claim biometric verification via Persona video and ID documents is mandatory for freelancers to earn money.
- Scale disputes the claims, saying tracking is optâin and biometric checks combat fraud and comply with European law.
- The nonprofit seeks courtâordered fines and governmental investigations into the surveillance of over 900,000 workers.
- Noyb previously secured multimillionâeuro fines against TikTok and Meta for GDPR violations.
A federal appeals court invalidated West Virginiaâs law restricting public officialsâ personal data, marking a win for data brokers and potentially shaping similar legislation nationwide.
Key points
- The 4th U.S. Circuit Court of Appeals held that West Virginiaâs Danielâs Law violates the First Amendment by imposing contentâbased speech limits on data brokers.
- The decision overturns a lower court ruling and nullifies the statute, which required data brokers to obtain permission before publishing officialsâ addresses and phone numbers.
- The courtâs opinion may affect ongoing litigation in New Jersey and other states with comparable Danielâs Law statutes.
- The ruling is seen as a significant victory for dataâbroker companies such as WhitePages, Thomson Reuters, LexisNexis and PeopleConnect, which faced lawsuits over personal data disclosures.
Google enables approved thirdâparty Android stores to offer oneâtap installs and background updates in nonâU.S. regions starting DecâŻ1.
Key points
- Approved stores that pass Googleâs identity checks and submit every app version for malware scanning will receive oneâtap install and automatic backgroundâupdate capabilities on Android 17 QPR2+ devices.
- The program excludes the United States and requires explicit user consent for each install, with visible notifications for large downloads and background installs.
- IT administrators can block these registered stores on managed devices, and stores face removal or extra fees if harmful apps exceed set thresholds.
- Google provides an Android Developer ID API for stores to verify app provenance and recommends blocking apps that fail verification.
- A $10,000 yearly fee applies, and stores remain liable for all catalog content; Google does not moderate the apps themselves.