100 articles · Government · page 2 of 5
Articles
Week of 23 June 2025
One alert, three threats: how local agencies should have read the June 2025 Iran warning
After U.S. strikes on Iran, federal warnings described one heightened threat. For cities, counties and utilities it was really three: hacktivist noise, opportunistic attacks on exposed control systems, and patient state operations. Each needs a different owner, a different clock and a different fix.
Week of 5 May 2025
Why the air traffic control rebuild started with the wires
The Newark outages that preceded Washington’s May 2025 air traffic control plan broke in the links between buildings, not in the radar screens. For agencies modernizing systems that cannot stop, the wires, the switchover and the people deserve as much planning as the software.
Week of 31 March 2025
Lighter rules, heavier contracts: OMB’s April 2025 AI memos handed governance to the buyer
OMB’s April 2025 memos lightened internal AI process but asked contracts to carry more of the weight. Agencies that treated every stage of a contract as a governance tool kept bargaining power that review boards alone could not give them.
Week of 24 March 2025
Why the Signal group chat was a channel design failure before it was a leak
A journalist added to a chat of senior officials made the headlines. For agencies at every level, the lasting failure was an approved channel that could not set content limits, confirm who was present and keep the record, all at once.
Week of 3 February 2025
In the Treasury payment access dispute, “read-only” was a claim until the records proved it
Set the politics aside and the fight over access to Treasury’s payment systems becomes a rare public lesson in who can touch the money. It came down to four separate controls, and to whether each could be proved rather than simply asserted.
Week of 20 January 2025
Revoking the AI executive order could not revoke the AI inventory, because Congress had written it
On inauguration day the 2023 AI executive order was revoked, and replacement guidance was weeks away. Agency AI programs could sort their work by what held it up: the order alone, OMB memos awaiting revision, or laws Congress had passed that still applied.
Week of 30 December 2024
Treasury’s breach ran through a remote-support key the agency never held
Attackers walked into Treasury workstations using a stolen key from a vendor’s cloud remote-support service, a key the agency never held. Remote support is powerful insider access by another name, and governing it takes four controls most organizations only partly have.
Week of 9 December 2024
In the RIBridges breach, Rhode Island owned the outage and its vendor owned the evidence
Attackers breached Rhode Island’s vendor-run benefits system, and the public held the state accountable while the vendor held the systems, logs and investigation. The fix is a contract that settles visibility, decisions, costs and exit before anything goes wrong.
Week of 7 October 2024
At American Water, containment was the part customers saw
After a cyberattack, America’s largest water utility kept the water flowing, but customers experienced the incident as a billing portal that went dark. For any utility or agency, what the public sees comes down to four decisions, and most can be made in advance.
Week of 23 September 2024
Helene tested what continuity plans take for granted: staff, signal and signatures
Most continuity plans prepare for losing a building or a computer system. Hurricane Helene took away people, phone and internet service, and the officials who sign off on decisions, across a whole region at once. Each needs its own preparation, years ahead.
Week of 2 September 2024
Europe’s AI treaty attached its duties to the public function, not the payroll
Europe’s new AI treaty covers AI used by public authorities and by private companies acting on their behalf. So an agency’s duties follow the service into its contractors, and the fuzzy edge of “on their behalf” is where governance gaps will open.
Week of 26 August 2024
Sea-Tac’s handwritten boarding passes were a staffing plan in disguise
Ransomware knocked out Port of Seattle systems, and the airport kept moving on paper and goodwill. “Revert to manual” turns out to be a promise about people: which work has a paper version, who does it, for how long, and who re-keys it afterward.
Week of 29 July 2024
Systems contained, data exposed: why Columbus’s reassurance outran its evidence
Columbus could show early that it had contained the attack on its systems. It could not yet show what the stolen data held or whose it was. Each claim needs its own evidence, and borrowing confidence from one to answer the other costs trust.
Week of 1 July 2024
Records over deference: after Loper Bright, an agency’s best defense sat in its files
In five days, four Supreme Court decisions ended deference on what statutes mean, kept old rules open to new challengers, faulted an agency’s explanation and moved penalty cases to juries. What agencies could still defend lived in their records, which most managed badly.
Week of 17 June 2024
Old ban, new deadline: Kaspersky’s exit reached the governments Washington’s 2017 order never covered
Federal agencies dropped Kaspersky years ago. The June 2024 Commerce decision reached counties, school districts, utilities and contractors, with a hard deadline. It showed that replacing a security product is a procurement project with three costs most public budgets had never estimated.
Week of 20 May 2024
How Windows Recall put a possible public record where no records officer could reach it
Microsoft answered Recall’s security critics by keeping screen snapshots on the laptop, locked to the user and set to expire. Those same three choices put the snapshots beyond the search, hold and retention tools agencies rely on for public records and lawsuits.
Week of 15 April 2024
Revised advisories: in April 2024, the vendor’s first word on an edge device was rarely its last
In April 2024, Palo Alto withdrew its own workaround within four days, and MITRE disclosed a breach through Ivanti gateways it had worked to secure. Agencies that could check exposure, integrity and recovery themselves did not need to wait for the next revision.
Week of 1 April 2024
Agencies buy a cloud provider’s security culture whether or not the contract mentions it
A federal review board blamed the 2023 Exchange Online intrusion on Microsoft’s security culture. No agency can audit a culture, but the report showed three places it leaves evidence a buyer can demand: secrets, disclosure and defaults.
Week of 25 March 2024
Easy to grant, hard to defend: M-24-10 put every federal AI exception on the record
OMB’s final AI memo kept the hard deadline: make risky AI safe or switch it off. It also made every way out, whether a determination, a waiver or an extension, carry a named signer, written evidence and a record others would read.
Week of 18 March 2024
The governors’ water letter handed one problem to three state secretaries
In March 2024, the White House and EPA wrote to every governor about attacks on water systems, inviting each state’s environmental, health and homeland security secretaries. That guest list was the story: one problem, three offices, and rarely anyone in charge of all three.