52 articles · 2025 · page 3 of 3
Articles
Week of 24 March 2025
Why the Signal group chat was a channel design failure before it was a leak
A journalist added to a chat of senior officials made the headlines. For agencies at every level, the lasting failure was an approved channel that could not set content limits, confirm who was present and keep the record, all at once.
Week of 17 March 2025
23andMe’s bankruptcy turned a privacy policy into a term of sale
Once 23andMe filed for Chapter 11, its privacy promises stopped being fine print and became a condition that courts, states and bidders had to put a price on. Anyone holding or sharing health-related data should write contracts with that ending in mind.
Week of 10 March 2025
Medusa showed that a clinic’s remote-support software is its ransomware attack surface
The March 2025 Medusa warning read like a shopping list of the remote-access tools hospitals and clinics rely on every day. Stopping attacks like it means governing those tools at three moments: getting in, moving around and switching off defenses.
Week of 3 March 2025
HHS’s end of voluntary comment periods hit grantees hardest and Medicare providers least
By dropping the Richardson Waiver, HHS stopped asking for public comment where the law did not require it. The lost warning fell unevenly: hardest on grant recipients, less on contractors and least on Medicare providers, whose own statute still requires comment.
Week of 24 February 2025
The House budget vote signaled Medicaid churn, a cost hospitals pay at the front desk
A narrow February 2025 House vote set Medicaid on the path to big changes. Beyond lost revenue, more frequent eligibility checks and work requirements would make it costlier to know who is covered, at the front desk, in enrollment help and in billing.
Week of 17 February 2025
Bybit’s signers approved what their screens showed, which was not what they signed
The largest crypto theft on record beat a multi-person approval process without breaking it: attackers simply changed what the approvers saw on screen. Any bank approving payments through software carries the same risk at four points, from how the screen is built to recovery.
Week of 10 February 2025
With the CFPB paused, banks lost the outside signals their customer programs relied on
The CFPB was told to stop work in February 2025, but consumer law stayed the same. What vanished were three outside nudges firms relied on: exam deadlines, published lessons from peers and federal follow-up on complaints. Each had to be rebuilt in-house.
Week of 3 February 2025
In the Treasury payment access dispute, “read-only” was a claim until the records proved it
Set the politics aside and the fight over access to Treasury’s payment systems becomes a rare public lesson in who can touch the money. It came down to four separate controls, and to whether each could be proved rather than simply asserted.
Week of 27 January 2025
DeepSeek arrived in three forms in one week, and each needed a different control
Within days, the same DeepSeek model reached organizations as a phone app, a developer service and freely downloadable files running on U.S. clouds. Blanket bans treated them as one risk. They were three, each owned by a different team.
Week of 20 January 2025
Revoking the AI executive order could not revoke the AI inventory, because Congress had written it
On inauguration day the 2023 AI executive order was revoked, and replacement guidance was weeks away. Agency AI programs could sort their work by what held it up: the order alone, OMB memos awaiting revision, or laws Congress had passed that still applied.
Week of 13 January 2025
DORA’s register of information made every bank a data supplier to EU oversight of its vendors
DORA’s register of technology suppliers looked like paperwork. In fact it was a dataset supervisors would pool to spot concentration and pick critical providers, and its quality depended on three data problems most vendor programs had never solved: identity, dependency and depth.
Week of 6 January 2025
Under FDA’s change-control model, the AI device a hospital validates will not stay the one it runs
FDA’s January 2025 draft on AI devices, read with its December change-control guidance, assumes the software keeps changing after a hospital buys it. Three kinds of change follow: pre-approved updates, updates needing fresh review, and shifts in the hospital itself.