Government Executive - Tech

OPM wants to woo young workers. Can internet memes overcome Trump’s cuts to the civil service?

Sean Michael Newhouse — Thu, 20 Aug 2026 17:33:21 -0400

Updated at 10:20 a.m. ET Aug. 21

As the federal government’s human resources agency, the Office of Personnel Management frequently posts information on its social media about subjects like performance ratings and retirement processing.

On Aug. 6, however, OPM shared a post on its X account of an IMAX theater showing a video encouraging young people to apply to work at agencies with the caption: “Learning why you should join the federal government the way Christopher Nolan intended.”

The post is referencing the movie director’s decision to shoot “The Odyssey," his latest box office hit, entirely with IMAX cameras. It also includes a link to a government early career talent webpage.

Public service now on IMAX pic.twitter.com/lq1F8f2UZ4
— U.S. Office of Personnel Management (@USOPM) August 6, 2026

While the Nolan IMAX post might seem random, OPM Director Scott Kupor said it’s a key part of an effort to recruit more early-career employees into government.

“Yes, we're trying to be funny and kitschy and stuff like that,” Kupor said. “But most of that is in service of a strategy, which is, can we actually find the people that we're interested in talking to and convince them to take 30 seconds out of their busy days and hear what we have to say?”

The underrepresentation of young people in the federal government is a longstanding issue that the Biden administration also sought to fix. As officials in the second Trump presidency take their shot at solving the problem, Michelle Amante, senior vice president of government programs at the Partnership for Public Service nonprofit, warned that the president’s ongoing efforts to downsize the civil service could undermine any attempt at mass recruitment.

“When [Gen Z is] thinking about — ‘where do I want to spend my career [and] where do I want to make a difference’ — it's hard to just brush [the last year-and-a-half] under the rug, regardless of what fancy social media campaign you have,” she said.

“Make the federal government feel more approachable and even fun”

Kiki Nyoh, an OPM spokeswoman, said that the agency’s social media presence is driven by a four-person communications team — most of whom are younger than 30.

“We know how our generation communicates because we are our generation, and we’re using that perspective to make federal service resonate with the next generation of talent,” she said over email.

Christina Harbison, a senior digital adviser, shared that a lot of OPM’s social media content is inspired by a stray comment that someone will make in the office.

“We’re always listening for those unexpected ideas and looking at what people are already engaging with online, then thinking about how we can give it a federal workforce spin,” she said by email. “Content that feels timely, light and culturally relevant tends to make the federal government feel more approachable and even fun.”

For example, Harbison said that a recent post with clips of characters from the popular sitcom “The Office” dancing to tout OPM’s transition away from paper to streamline the retirement process originated with Kupor mentioning that he liked Michael Scott, who is the boss in the show.

Skip the paperwork and start your retirement journey online. Find out how OPM's Online Retirement Application can help make the retirement process faster, easier, and more transparent. Visit: https://t.co/a5CLmMaVPX pic.twitter.com/3BbeuqnJE4
— U.S. Office of Personnel Management (@USOPM) July 9, 2026

Kupor, who is frequently featured in these posts, said that he’s always up for participating, even if he doesn’t understand the humor, such as a recent video he filmed as part of the “what’s on my desk” trend.

What’s in my desk?! Watch to see the items I can’t work without and the items I didn’t know were in my desk pic.twitter.com/kiNXg3Z8OK
— Scott Kupor (@skupor) August 17, 2026

“Quite frankly, I'm willing to try anything,” he said. “You know, at the end of the day, obviously I trust [my staff] to not completely embarrass me.”

Several agencies, including the Homeland Security Department, Transportation Department and Small Business Administration, have launched TikTok accounts in recent weeks after the Justice Department found in July that a 2022 law banning the Chinese social media platform from government devices is no longer applicable because the U.S.-based version of the app is now under majority control by American investors.

When asked if OPM would create a TikTok account, Nyoh replied “stay tuned.”

“They want to hear it from people their own age”

Amante — of the Partnership, which assists agencies with hiring — said she “applauds OPM’s desire to try to expand the way it recruits the next generation” but doesn’t think that its “specific messaging is likely to land well with Gen Z.”

In particular, she criticized OPM’s “Making Government Cool Again” slogan.

“Cool is not really a word that is being used frequently by Gen Z,” she said. “That is a Gen X-era word.”

Pew Research Center defines Gen X as those born between 1965 and 1980 and starts Gen Z with anyone born in 1997.

Writers for Slang Insights, a website led by a “team of linguists, language enthusiasts, cultural researchers and content creators who share a common passion for understanding how language evolves,” reported in an Aug. 4 blog post that “if you’re still saying ‘cool,’ you might be dating yourself.”

Relatedly, a video promoting OPM’s Early Career Talent Network features country singer Kid Rock, a Trump supporter whose peak popularity was in the 2000s.

Amante also suggested that OPM should highlight younger civil servants on social media.

“It's not helpful to only hear the leaders telling [potential hires] what they think they will experience,” she said. “They want to hear it from people their own age.”

“Broad reshaping of government”

OPM’s social media posts encouraging younger workers to apply for the government come after agencies have shed more than 300,000 employees since the end of 2024, according to federal workforce data.

Kupor argued that many of the incentives that the Trump administration used to push out civil servants, such as Voluntary Early Retirement Authority, didn’t apply to early-career workers.

He also contended that there’s an opportunity for a “broad reshaping of government.” Specifically, the OPM director pointed to the importance of addressing skills shortages across the civil service, which the Government Accountability Office has identified as a major issue since 2001, as well as the share of retirement-eligible federal employees, which currently stands at 13.5%.

But the percentage of agency staffers under the age of 30 decreased over the first year of the Trump administration, according to a Partnership analysis, going from 8.9% in September 2024 to 7.9% in January 2026. Researchers attributed this to the mass firings of probationary employees, which generally impacted those who had been hired or promoted within the past year.

And while the Trump administration created Tech Force in 2025 with a goal to bring on 1,000 early-career software and data engineers potentially as soon as the end of March, OPM reported to Government Executive that it has only made 325 hires so far. And the president eliminated initiatives like the Presidential Management Fellows, a nearly 50-year-old program that served as a pipeline for graduate students to consider and pursue a career in government.

Still, Kupor is optimistic.

“I think at the end of the day, people are going to take a job or listen to what I say mostly because I give them either a compelling reason that matches their interests and that shows that we're helping them try to develop their career,” he said. “If we do that well, then I think we'll continue to attract great people. Quite frankly, if that story is not believable or not compelling to folks, then I get it, and we won't have the success that I certainly expect that we'll have.”

Correction: This story has been updated with the correct number of OPM communications staffers younger than 30.

]]>

Social Security expands electronic health record sharing to speed up disability claims adjudication

Christian Robles — Tue, 18 Aug 2026 16:43:00 -0400

The Social Security Administration is looking to speed up disability claims adjudication by allowing Americans to consent to their medical providers sending the agency digital copies of their health records through a data sharing superhighway.

In April, Epic — the largest electronic health record vendor for U.S. hospitals — announced that its health system customers are connected to SSA through the Trusted Exchange Framework and Common Agreement, or TEFCA. Through that superhighway, dozens of hospitals and clinics can send digital medical records to SSA, eliminating the need to fax documents to the agency and slashing disability claims processing times by up to 50%.

Jacksonville, Florida-based Baptist Health is among the first Epic customers to start sharing electronic health records with SSA through TEFCA.

Baptist Health has sent SSA several thousand electronic medical records since it started sharing data with the agency through TEFCA at the end of July, Aaron Miri, the health system’s chief digital and information officer, told Nextgov/FCW.

Because of TEFCA, Baptist Health has reduced the number of staff dedicated to processing medical records for SSA to essentially half a person, Miri said in an interview. Before TEFCA, three staffers were manually sending SSA medical records through fax machines and checking that the agency actually received the information, he said.

“We’re seeing time saved, we're seeing accuracy [of medical records] go up, we're seeing happy patients,” Miri said. “It's just positive, positive, positive.”

Dozens of Epic customers in California, Oklahoma, Washington, Arizona and other states have also connected to SSA through TEFCA.

Epic expects more than 550 hospitals and nearly 20,000 clinics will use TEFCA to exchange data with SSA by the end of the month, and all of its customers to eventually migrate to TEFCA, a company spokesperson told Nextgov/FCW.

SSA has connected to 84 health care entities and made 60,595 data requests through TEFCA as of August 13, according to an agency official familiar with its health information technology strategy.

SSA obtaining electronic medical records for disability claims adjudication is not new. The agency has received health information from medical providers through Carequality and eHealth Exchange — two other health data sharing superhighways — for years. But TEFCA has several advantages compared to those pathways.

Medical providers can use their existing connection to the TEFCA rather than starting new legal agreements to connect with the SSA, the Epic spokesperson said. They also no longer have to constantly provide SSA with an updated list of their facilities because TEFCA has a directory SSA can use to identify facilities, they added.

Over 65% of Epic customers are currently sharing records with SSA across TEFCA, Carequality and eHealth Exchange, they said.

But SSA is agnostic whether medical providers use TEFCA or another pathway to share data, so long as patient consent is part of the equation and they share adequate information for disability claims adjudication, the agency official said.

SSA is working with TEFCA Qualified Health Information Networks, or QHINs, besides Epic, which would give more medical providers the ability to send the agency digital health records, according to the agency official.

“eClinicalWorks and NetSmart are actively in various stages of development and testing with SSA today,” they clarified. SSA has a seat on the TEFCA governing council,Nextgov/FCW previously reported.

The Epic spokesperson said the company wants all medical providers — regardless of whether they use Epic software — to electronically send medical records to SSA. But that could prove difficult to achieve.

Many behavioral health, specialty and rural providers do not use electronic health records, meaning they continue to rely on manual record request processing, noted Jennifer Burdick, a divisional supervising attorney at Community Legal Services of Philadelphia. Department of Health and Human Services data backs up that assessment: thousands of substance use and mental health treatment facilities continue to use paper charts instead of software to maintain patient records.

Even though TEFCA promises to speed up claims adjudication for thousands of Americans, disability advocates have warned Americans are finding it hard to access SSA disability benefits. That’s in part because SSA is pushing online servicing and has introduced AI onto its phone lines, according to a Disability Rights Education & Defense Fund report published in March. SSA contested claims that disability benefits are becoming harder to access and touted a decline in its initial pending backlog in a previous statement to Nextgov/FCW.

]]>

Labor looks to AI to tackle accommodation requests from disabled employees

Jory Heckman — Mon, 17 Aug 2026 06:00:00 -0400

Faced with a backlog of accommodation requests from employees with disabilities and medical conditions, the Labor Department plans to use artificial intelligence to triage the workload.

An internal email obtained by Government Executive states that staff at the Civil Rights Center, which processes reasonable accommodation requests, currently must “engage substantively with every request regardless of completeness or likely outcome, limiting capacity and delaying determinations.”

“The process requires case-by-case judgment, but cases vary significantly in complexity and documentation quality: some are well-supported and straightforward, some require additional documentation, and some are not well-supported by the documentation provided,” the email states.

Labor Department employees told Government Executive that the department is facing a backlog of hundreds of RA requests. Several reported waiting months or, in some cases, a year or longer for for reviews, delays they say have hampered productivity at a department charged with protecting the workplace rights of workers with disabilities.

One DOL employee told Government Executive that he submitted a reasonable accommodation request in March 2025, supported by documentation from his primary care and a mental health providers, yet his case remains pending.

“It’s just kind of ironic to me that the Labor Department is violating policies that they set,” he said. “That’s the most frustrating part, to be honest, is that they can’t even abide by their own rules.”

Labor officials wrote in the internal memo that AI will “streamline” this work, citing four AI applications under review “to improve this process.”

The memo stresses these AI tools will play a supporting role in processing reasonable accommodations, and that Civil Rights Center employees “will continue to make decisions on necessary actions (including how and what is requested).”

The department expects that AI “could triage incoming requests by likely complexity and documentation sufficiency, allowing staff to prioritize effectively.” It adds that “AI-assisted document analysis” could flag incomplete or inconsistent medical documentation earlier in the process, “reducing back-and-forth and shortening timelines.”

The memo also states that “Al-enabled communication capability could engage requestors by providing updates, prompting requestors for additional information, and initiate follow-up to keep requests progressing without staff intervention.”

DOL also wrote that “Al could assess whether the accommodation requested is effective for the documented functional limitation,” or suggest “if other equally effective options exist.”

The Labor Department did not respond to a request for comment.

Jodi Hershey, a former reasonable accommodation specialist at the Federal Emergency Management Agency and the founder of the workplace accommodation firm EASE, LLC, said “the problem DOL is trying to solve is real” – many federal agencies don’t have the staff needed to keep up with the volume of incoming accommodation requests.

“I've seen employees wait a year or more for a decision on something they needed on day one — sometimes going without the very accommodation that lets them do their job. So I don't dismiss the impulse to find a faster path. The status quo is already failing disabled employees,” she said.

Hershey said AI “could genuinely help employees” navigate the reasonable accommodation process. “But that's very different from an agency using AI to take the human judgment out of the decision, and that's where this plan worries me,” she said.

“‘A human still makes the final call’ sounds reassuring, but if the AI has already sorted the case, flagged the documents, and suggested an answer, the human is grading the algorithm's homework. Real oversight means a person can actually reach a different conclusion — and that the employee knows a machine was ever involved,” she said.

Michael Fallings, managing partner at Tully Rinckey PLLC, a firm specializing in federal employment law, said he’s represented clients who have waited a year or longer for their agencies to process their reasonable accommodation requests.

While agencies may be tempted to use AI to speed up the work, Fallings warned that processing confidential medical records through AI tools may raise some legal risks.

“I’m sure the government’s thought process is … ‘We may not have the number of staff to handle it,’ but that does then create privacy issues for employees when you’re not using people, you’re using technology,” Fallings said.

Hershey said she was most concerned by the Labor Department’s plans to triage requests by “likely outcome” using AI.

“The employees with the thinnest documentation are often the ones with the least access to good healthcare, or to anyone who can help them navigate the paperwork. If the system quietly moves those cases to the back of the line, you've built a process that works best for the people who needed the least help to begin with,” she said.

"Hundreds of stories like this"

Aliyah Levin, president of the American Federation of Government Employees Local 2391, said the Labor Department is dealing with a backlog of “almost a thousand people that haven’t been accommodated.”

Many employees, she added, were hired for fully remote positions, or only had to report to the office twice per two-week pay period. President Donald Trump’s first-day memo required most federal employees to work onsite — but exempted employees with disabilities.

“This administration came in on day one and eliminated all of our workplace flexibilities — all of them — and said, ‘No matter what, regardless of who you are, whatever deal you’ve got, however you were hired, you now have to have your butt in the seat in an office that you’ve never reported to,’” Levin said.

Levin said one bargaining unit member, an Occupational Safety and Health Administration employee with a blood-pressure condition and vertigo, was hired as a remote worker, but later was told to start reporting to the office.

Levin said the department granted the OSHA employee a remote work accommodation last month, but “there’s hundreds and hundreds of stories like this” where employees are still waiting to hear back.

“It has a disparate impact on veterans, which have varying degrees of disability. It’s affecting them the most,” she said. “We have people who, for whatever reason, they have issues driving. They rarely drive, never drive, and they live in LA. Now they have to drive to get to work.”

Levin said “productivity has plummeted, in terms of implementing the mission.” Among their duties, DOL employees carry out wage theft investigations, workplace safety enforcement, benefits administration, labor statistics, mine safety inspections and veterans' employment programs.

Omar Algeciras, AFGE Local 2391 vice president and a wage and hour investigator, said that when DOL employees “cannot receive the accommodations they need, the public eventually feels the effects.”

"The Department of Labor enforces workplace laws across the country. Employees believe the Department should meet the same standard of fairness, accessibility, and accountability expected of every employer,” Algeciras said.

"Employees are not being protected"

Another Labor Department employee said she’s been waiting nine months for her reasonable accommodation request to be processed. She said she received an interim accommodation while her paperwork is under review, but it's scheduled to run out soon.

“I started reaching out three or four weeks ago, before the expiration, asking for an update – asking about the interactive process being started, and none of that has happened. I haven’t gotten an update,” she said.

The Labor Department, she added, is “supposed to be protecting American workers, and their employees are not being protected.”

A third employee requested a reasonable accommodation to work from home about half of the time in August 2025. The request was granted in February 2026, but he is still waiting for an ergonomic chair and standing desk.

“I am finally seeing some progress, but I just don’t know why a basic chair took so long to get,” he said.

The third Labor Department employee said the department saw a surge in reasonable accommodation requests following the Trump administration’s return-to-office mandate, but a shrinking human resources workforce has been unable to keep up.

“They’re just so backed up because a lot of people took the Fork [in the Road]. They really haven’t filled these positions to be able to process these reasonable accommodations,” the employee said. “People need them.”

The third employee said the HR worker assigned to process his reasonable accommodation request has changed three times so far.

A fourth employee, a combat veteran, said he requested a reasonable accommodation in January to manage his depression and anxiety, but is still waiting to hear back.

“We enforce workers’ protections, but then here I am, dealing with my own dilemma,” he said.

A fifth employee, a disabled veteran who was hired to a fully remote position in 2024, said she requested a reasonable accommodation in April 2025 after being asked to report to the office full-time.

“After adjusting to remote work and the benefits of how it positively impacted my mental health, it really set me in an anxiety spiral, where I was just like’ ‘This is uncomfortable,’” she said.

The employee said the department ultimately shelved her RA request, allowing her to continue working remotely because her husband is a 100% disabled veteran. The Trump administration has exempted spouses of 100% disabled veterans from its return-to-office mandate.

That accommodation may be short-lived. The employee said she received an offer for a new Labor Department job, but was told her military spouse RTO exemption would not apply. To avoid having to relocate across the country, the employee was advised to submit a new reasonable accommodation request, but was warned there are no guarantees it will be accepted.

“They’re telling me maybe if I reapplied for a reasonable accommodation under the new job … then it might be accepted. “I have to accept the new job and then apply for the reasonable accommodation,” the employee said. “But that’s really terrifying, because I am not in a position to move. My spouse has a well-established care team and everything in place. We can’t just pick that up and move.”

]]>

OneGov savings balloon to over $1.6B as agencies weigh future of AI in contracting

Christian Robles — Fri, 14 Aug 2026 16:27:18 -0400

The OneGov program has saved the federal government about $1.62 billion — including about $1.4 billion through limited-time discounts on artificial intelligence — since its inception, a General Services Administration official said Thursday.

“That number may not capture the full impact because some agencies might have used the OneGov pricing to negotiate pricing on their own contracts outside of GSA’s [involvement],” Birgit Smeltzer, director of the agency’s Office of IT Products, said at the GovCIO Federal AI Forum.

Indeed, the Centers for Medicare and Medicaid Services is one example of an agency that has negotiated technology discounts beyond OneGov. But federal agencies only have limited time access to discounted software through the OneGov program.

Smeltzer said some of the original equipment manufacturers have already agreed to extend the duration of their OneGov discounts or are working on forging new offers. She did not say which manufacturers have already promised to reup discounts or when GSA would announce them.

“Some of the [original equipment manufacturers] have already agreed to extend some of the limited time offers, and some are looking at producing new offers for us,” she said.

GSA officials previously said they want manufacturers to extend OneGov deals as they look to become direct contractors on the Multiple Award Schedule. Officials have also said they want the OneGov initiative to extend beyond technology and software.

Smeltzer forecasted that even though OneGov prices “will eventually increase, the offers have already created significant value for agencies.”

“Leveraging the OneGov has been tremendous in order to really prove value,” said Geoffrey Sage, director of the enterprise services and analysis division within NASA’s Office of Procurement.

OneGov is just one way agencies are thinking about AI and contracting.

NASA has started to talk with industry about how it should use AI in contract evaluations, Sage also said at Thursday’s event. That specific application of AI has been a “thin red line” for the agency to date but it's also a “necessity,” he added, while noting that NASA takes a risk-based approach in deciding to use AI.

“We spend 85 percent of the agency's budget through procurement,” Sage said. “We can't afford AI to trip up and hamper our source evaluation process.”

Federal use of AI to evaluate contracts has recently garnered scrutiny, with some contractors alleging agencies are misusing the technology and relying on hallucinations in their evaluations.

NASA is also using AI to bring its number of contract writing systems down from three to one next year, Sage said.

Federal officials should view industry as collaborators, Anil Chaudhry, senior AI advisor for the Transportation Department, also said at the event.

“As a government employee, you can no longer have a mindset that you're competing with industry. You have to have that mindset that you're collaborating with industry,” he added.

]]>

Intel ops are underway at Space Command’s nascent Alabama HQ

Thomas Novelly — Fri, 14 Aug 2026 13:10:44 -0400

HUNTSVILLE, Ala. — Less than a year after President Trump reversed a Biden-era decision to keep U.S. Space Command in Colorado, space intelligence operations are being conducted in existing offices at Redstone Arsenal while a permanent headquarters is built on base.

By year’s end, SPACECOM plans to have roughly 200 of the 1,800 Colorado-based positions at the Army base. Roughly 50 of those employees are already conducting missions with the command’s Joint Intelligence Support element, or JISE, which is already doing analysis for space operations and coordinating with allies. Those analysts are also coordinating with colleagues working, at least for the next few years, at Space Command’s existing headquarters in Colorado.

“We've designed our facilities with collaboration spaces and with the collaboration tools that allow our personnel here in Huntsville—of course, those numbers are growing—to work back with our people in Colorado Springs to execute our missions,” Whiting told reporters on Wednesday. “So far, our folks are crushing that, and I'm very proud of how they're performing.”

Reporters toured the up-and-coming facilities and saw the progress of the new headquarters on Wednesday during the Space and Missile Defense Symposium here. While the personnel moves and construction projects will not be complete until 2032, military officials said that the combatant command remains focused on its mission.

In April, Gen. Stephen Whiting, Space Command’s leader, hosted a ribbon-cutting ceremony for the Joint Intelligence Support element on base. Wednesday’s tour was among the first access allowed to media outlets.

“Make no mistake, the JISE leading this charge serves as a symbol of our commitment to ensuring mission needs are executed flawlessly throughout this move,” Brig. Gen. Nathan Rusin, who leads the USSPACECOM Intelligence Directorate, said in an April press release.

In 2021, in the last weeks of his first term, Trump announced that Space Command would move its headquarters from Petersen Space Force Base in Colorado to Redstone Arsenal in Huntsville. Several congressional probes followed. In July 2023, President Biden reversed the decision and said it would stay in Colorado.

An April 2025 Defense Department Inspector General’s probe wondered why the 2023 basing decision was made by the White House instead of Air Force Secretary Frank Kendall. The service secretary told lawmakers in 2023 he thought “the projected cost savings, together with the availability of potential mitigation measures, outweighed the operational risks that had been identified” for moving the command to Alabama.

But a May 2025 Government Accountability Office probe showed that if SPACECOM headquarters were to remain in Colorado that “new military construction would be needed to support the headquarters’ operations” and that officials “faced ongoing personnel, facilities, and communications challenges” in setting up a permanent facility out West.

Whiting told reporters that the goal is to have half of SPACECOM at Redstone Arsenal by 2028 with a full move-in completed by 2032. The command’s joint operations center, the main command-and-control hub for space warfare missions, will remain in Colorado until the completion of the new headquarters.

“The opportunity for U.S. Space Command is that we get a purpose-built command and control headquarters out of this, we did not have that in Colorado,” Whiting said. “So to get this facility is going to be an incredible accelerant to our mission.”

]]>

The feds want private companies to take the fight to cybercriminals

Christian Robles — Thu, 13 Aug 2026 13:37:31 -0400

The National Coordination Center will create a program allowing authorized U.S. companies to conduct cyber operations against transnational criminal organizations at the direction of the federal government, according to a memorandum signed by President Donald Trump on Wednesday.

Program executive directors from the departments of Homeland Security and Justice will have the authority to greenlight companies’ cyber operations unless the authorization would result in a loss of life, serious injury or “rise to the level of use of forced or armed attack under international law.”

The federal government would vet and conduct oversight of authorized companies, which would need to enter into contractual agreements with either DHS or Justice.

The specific standards the government will use to screen the companies will be drafted by the program executive directors — in coordination with the Homeland Security Council — within 60 days of the memo’s signing. They will include technical proficiency, proven performance of cyber operations, facility security, personnel vetting, competence and reliability, according to the document.

The group will ensure that program participation criteria enable involvement from large and small companies, and that operations target only transnational criminal organizations.

The memo also allows participating companies to enter into commercial agreements with other private sector entities, federal agencies and state entities. The program executive directors will produce a report on the initiative’s status and submit it to the National Cyber Director and Assistant to the President and Deputy Chief of Staff for Policy and Homeland Security Advisor.

The cybersecurity program seeks to build on a March executive order laying out steps to combat cybercrime. That order was released alongside a national security strategy that called for the government to more directly respond to adversarial threats and secure critical U.S. technologies.

In a statement, Mike Centrella — the head of public policy at SecurityScorecard — said the document “represents an important shift in how the United States approaches cyber threats originating overseas.”

“Strengthening defenses remains critical, but the memorandum recognizes that addressing cybercrime also requires identifying and disrupting the infrastructure and networks that allow criminal organizations to operate,” he said, adding that the guidance “signals an evolution in public-private cybersecurity collaboration — from primarily sharing information about threats toward combining government authorities with private-sector intelligence and capabilities to more actively disrupt them."

]]>

Space Command says it needs to ‘shoot, move and communicate’ in orbit

Thomas Novelly — Wed, 12 Aug 2026 19:19:38 -0400

HUNTSVILLE, Ala. — Space weapons and refuelable satellites are among the items needed to preserve the U.S. military’s orbital edge over China, the head of U.S. Space Command said.

America’s adversaries are targeting U.S. space assets and rapidly developing their own, Gen. Stephen Whiting told attendees at the Space and Missile Defense Symposium on Wednesday. China, for example, has direct-ascent ASAT missiles, ground-based lasers, jammers, and maneuverable, dual-use satellites, he said.

“These developments intend to degrade our current space superiority and would potentially give

China a maneuver and logistics advantage in space – something we would not accept on the land, at sea, or in the air,” Whiting said.

In the four-star’s final Space and Missile Defense Symposium speech as the leader of the combatant command, Whiting told military and industry audience members that there are five major things on U.S. Space Command’s Integrated Priorities List for 2029 to 2033.

“This isn’t just a wishlist. It’s a clear demand signal to several audiences describing the warfighting capabilities we need to meet our mission,” he said.

1. Integrated space fires: Mirroring Army usage, Whiting has used this term throughout his tenure at Space Command to refer to the offensive and defensive capabilities needed to deter orbiting threats.“

We’re a combatant command and we fight to win wars,” he said. “To win, we need credible, acknowledged, kinetic and non-kinetic fires. They are a key component of how we establish space superiority and restore credible deterrence.”

2. Counter-pLEO tech: Whiting said new technology is needed to counter adversaries’ low-Earth-orbit satellite constellations. As of last month, China has launched 200 G60 and 168 SatNet communications satellites as it builds a pair of “mega constellations...to compete with Western proliferated LEO (pLEO) architectures,” according to a Space Force fact sheet.

“I don't want any U.S. force to be put at risk because somebody else might have a proliferated low-Earth-orbit constellation that could find, fix, track, and target them,” Whiting told reporters after his keynote address.

3. Joint, integrated space command and control: Military leaders often stress the centrality of being able to oversee, organize, and order complex space operations.

“We must enhance machine-to-machine connectivity to support decision-making and battle management of this global space fight on tactically relevant timelines,” Whiting said in his address.

4. Dedicated space domain awareness for space engagements: It’s not just for missile defense, Whiting said: space domain awareness needs to expand and evolve to a whole range of space operations, not just one segment of it.

“We must adopt a ‘target-quality track’ mindset to everything we do in space, just like the missile defense community has done for decades,” he said.

5. Sustained space maneuver: Developing satellites that can be refueled to extend their usefulness remains one of U.S. Space Command key priorities. In March, a Chinese commercial satellite used a flexible robotic arm to “to demonstrate on-orbit servicing, refueling, and debris removal,” according to the Space Force.

“Today, our satellites are limited by the fuel they launch with, which leads to a psychology of scarcity. Husbanding that fuel often overrides desired warfighting maneuvers,” Whiting said. “That must change. We must be able to actively avoid threats and maneuver to gain a position of advantage on our adversaries.”

Whiting has pitched some of these items at past symposiums; in 2024, he said his 2027 Integrated Priorities List was topped by space fires and resilient command and control.

“Our space assets need to shoot, move, and communicate just like the rest of the Joint Force,” Whiting said Wednesday. “In short, space needs to fight like the Joint Force, to empower the Joint Force’s ability to fight and undermine our adversaries’ ability to do so.”

]]>

VA’s benefits system overhaul is running into some familiar problems

Edward Graham — Wed, 12 Aug 2026 11:28:50 -0400

Efforts to modernize a Department of Veterans Affairs system that supports the processing of veterans’ benefits claims have been hampered by “insufficient oversight and weak program management,” according to the agency’s Office of Inspector General.

The watchdog warned in an audit released on Tuesday that VA’s Office of Information and Technology has not taken all of the necessary steps to keep the revamp of the agency’s Benefits Enterprise Platform on track, which could potentially affect the processing of veterans’ benefits and other modernization efforts.

The BEP platform — one of 85 legacy systems that VA has identified as needing to be modernized or decommissioned to “improve overall efficiency of claims processing” — helps facilitate the sharing of information between the Veterans Benefits Administration and other “business line systems” that include pension, vocational rehabilitation and employment benefits.

VA awarded Booz Allen Hamilton a $1.1 billion contract in May 2021 to integrate its benefits systems into a new cloud-based Benefits Integration Platform, with the plan calling for the legacy BEP system to be migrated to this new service and then subsequently decommissioned. Although the contract was supposed to be completed this month, OIG noted that the latest timetable from VA said the BEP modernization effort is now slated to be completed in the second quarter of fiscal year 2034.

"Because BEP supports a significant number of systems, there is increased risk that other systems relying on it may experience negative consequences from potential delays in the modernization effort,” the report said.

The audit said the Office of Information and Technology failed to develop “a high-quality, reliable program schedule as recommended by the Government Accountability Office’s Schedule Assessment Guide” for the project and has instead relied on an agile project management tool for the effort — a tool that “does not contain roadmaps or detailed plans for the entire scope of the project.”

OIG also found that the office lacked a reliable lifecycle cost estimate for the modernization initiative, which has resulted in inconsistent funding information being included in various BEP plans and has “limit[ed] VA’s ability to make informed decisions.”

Lack of proper oversight, the watchdog reported, also may have jeopardized the security of veterans’ sensitive personal data when the office “hosted minor applications without conducting required security assessments.” After OIG notified VA officials about documented vulnerabilities — some of which dated as far back as 2021 — the watchdog said VA took the necessary steps to assess the security of its applications and remediate any identified issues.

OIG’s audit recommended that VA take steps to enhance its BEP modernization efforts, including by developing and maintaining a program schedule that aligns with best practices, ensuring that staff are following proper procedures when it comes to storing scheduling information, developing a “reliable, validated life cycle cost estimate” for the project and tracking all relevant project costs. VA officials said they concurred with the watchdog’s recommendations.

The BEP project is just the latest VA modernization initiative to be singled out for criticism by OIG for resulting in significant delays, cost overruns and oversight gaps.

VA is still in the process of developing a new digital GI Bill system, which the watchdog noted in an August 2024 report has seen its cost more than double as a result of “insufficient planning.”

The agency’s large-scale electronic health record modernization project has also been plagued by cost overruns, delays and oversight issues since the deployment effort began in earnest in 2020. The Trump administration has prioritized righting that effort, however, and VA Secretary Doug Collins said earlier this year that an EHR rollout resumption push has been “phenomenal” so far.

]]>

The government was ready to expand its voting security work. Then it pulled the plug

David DiMolfetta — Mon, 10 Aug 2026 14:09:14 -0400

LAS VEGAS — After spending roughly six weeks analyzing Dominion voting systems used in Puerto Rico’s 2024 elections, Mojave Research came back to the Trump administration with findings that startled its researchers.

The systems contained at least a dozen high- or critical-severity software vulnerabilities. Passwords were reused, firewalls were disabled and basic cryptographic protections were poorly implemented. And in Puerto Rico, active cellular hardware modems opened additional pathways into underlying software that was thought to be isolated.

But the small cybersecurity firm found no evidence that any of those weaknesses had actually been exploited, or that votes had been changed. The company still wanted more time to be certain.

Federal officials initially seemed willing to give them considerably more of it. The company was asked to grow the team working on the effort from roughly 10 people to about 60, according to CEO Jason Wareham.

Chief Technology Officer Manbir Gulati also said Mojave received an authorization to proceed with a follow-on effort, hired personnel and was given funding to acquire equipment for examining additional voting systems ahead of the November midterms. A contracting officer had even been brought in to finalize the new agreement, Gulati said.

Then, as Mojave prepared to move ahead, the work was abruptly shut down.

Wareham and Gulati recounted the episode on Friday at DEF CON hacker convention’s Voting Village, where they publicly unpacked their technical findings before sitting down with a small group of reporters and onlookers afterward.

Their account fills in new details about a federal effort that grew out of the Trump administration’s broader focus on voting machines and election interference, and the political pressures that emerged when Mojave’s findings did not support claims of election manipulation.

The ODNI request

Mojave never set out to become an election security provider. Its involvement began last year through the Office of the Director of National Intelligence under then-director Tulsi Gabbard, where it was already performing unrelated technical work for the agency when officials approached the company about examining voting machines and data obtained from Puerto Rico.

Reuters reported in February that the May 2025 operation was tied to an effort involving ODNI and the FBI to investigate allegations that Venezuela had hacked Puerto Rico’s voting systems, though Gabbard’s office denied that Venezuela drove its work and said the examination was focused on technical vulnerabilities. The probe produced no clear evidence of Venezuelan interference.

Wareham said at DEF CON that ODNI asked whether his team of reverse engineers and forensic specialists could travel to Puerto Rico and capture an image of a voting system that had actually been used in an election, without the vendor overseeing the process. He agreed, thinking it would be a relatively small addition to Mojave’s existing contract.

The assignment instead dropped Mojave into a much larger skirmish over American elections. “Ultimately, I made the worst decision of my life in a business context,” Wareham said.

President Donald Trump has spent years falsely maintaining that his 2020 loss was stolen and the product of widespread fraud and foreign interference, claims that have been rejected by courts and officials in his own administration. A 2021 intelligence community assessment found no indication that a foreign actor attempted to alter ballots, vote tabulations or any other technical aspect of the election.

Since returning to office, Trump and allies have revived investigations into the 2020 contest and pushed election security back to the center of his administration’s agenda. Gabbard’s ODNI was one part of that effort, hauling off and analyzing voting systems from Puerto Rico and later becoming involved in a federal investigation of 2020 election records in Georgia.

Wareham said the ODNI officials directly overseeing the company’s technical work wanted the research to continue. Both he and Gulati described the ODNI staff they worked with as professionals who wanted to protect the security of election systems.

The resistance, Wareham said, came from a separate White House collective that was repeatedly dissatisfied Mojave had not produced evidence supporting claims that the 2020 election had been manipulated.

“There was a separate group — let’s call them White House-adjacent — who was dissatisfied,” he said. “They were dissatisfied overall that I was not willing to name and shame at that moment” and declare that Trump had actually won the 2020 election.

Asked whether he believed Mojave’s government work was axed because it failed to find the “smoking gun” some officials wanted, Wareham said: “I believe that was part of the termination, yes.”

Reuters reported in April that Kurt Olsen, a prominent 2020 election-denier and Trump adviser involved in efforts to investigate the election, pressed Mojave to broaden its work in search of evidence that could support those claims.

Olsen, who now works at the Justice Department, turned against the company when its research failed to uncover evidence that the Puerto Rico machines had been hacked. He advocated terminating its work and accused Mojave of secretly receiving money from billionaire George Soros, a frequent target of right-wing conspiracy theories, the news agency reported. ODNI has said Mojave’s contract ended because the company completed its voting-machine analysis.

Wareham said an ODNI official informed him while Mojave was preparing to expand its work that the company had been accused of receiving Soros funding. The allegation prompted him to compile a detailed accounting of the young company’s funding sources within three days and send it up the government chain. Asked who he was told had made the accusation, he said an ODNI official reported to him that it was Olsen.

“One, I’m not funded by George Soros,” Wareham said. “Two, it would be great to be funded by George Soros because I would probably not be here, I’d be on a yacht.”

The company kept moving forward. Wareham said Mojave briefed the White House on some of its findings around September. The firm believed it was heading toward a broader effort to remediate vulnerabilities before the midterms and conduct a deeper analysis for signs that the weaknesses it discovered had ever been actually abused.

Then came the record-long government shutdown. Wareham said that on the day he expected an expanded contract to move ahead, Mojave instead received a stop-work order and no additional funding.

“I think the government shutdown was all that was required, really, to have some folks that I didn’t know were still in the game, again, White-House adjacent, to take their shot,” he said. Wareham stopped short of saying he had direct proof that White House officials ordered Mojave removed because of its findings, but said “it was reported to me it was Kurt Olsen” who led the efforts.

The White House, ODNI and Olsen did not return requests for comment.

Identified vulnerabilities

Mojave had found many issues with the machines it examined. Gulati described the Puerto Rico system during the Voting Village presentation as “deeply insecure,” saying it did not meet the security bar he would expect from “an average low-risk application, let alone critical infrastructure.”

Researchers identified at least 12 major vulnerabilities in commercial software installed on the system, Gulati said. Mojave successfully executed five of them. None were newly discovered flaws, and fixes were already available — in some cases well before the system was used in the election.

Other weaknesses were rooted more deeply in how the system was built and deployed. Some passwords could be easily cracked and others were embedded directly into software. Firewalls were turned off on critical systems and ports were left open. Gulati was particularly critical of the system’s cryptography, which he described as being “in shambles.”

The company does not believe every problem it found necessarily stopped at Puerto Rico, as its formal review covered only one system from one manufacturer in one jurisdiction. Gulati suspects the issues could extend beyond a single voting machine company, though Mojave has not examined enough systems from other manufacturers to establish that.

“I don’t expect that the problems are unique to them,” he said. “I think many manufacturers probably exhibit the same problems.”

Mojave produced an approximately 100-page document of the Puerto Rico findings. Gulati said Mojave has been in discussions with Liberty Vote — which acquired Dominion’s election business last year — and that Liberty told the researchers it does not plan to make changes before November.

Liberty said it has not received Mojave’s report.

“Liberty Vote is not in receipt of any such report so, therefore, we cannot provide any comment,” a spokesperson said. “As always, Liberty Vote is committed to advancing the future of secure American elections.”

No evidence of vote tampering

Looking at the systems headed into the midterms, Gulati said, “I do know that as of now, the state that we have described is going to be pretty similar to what will be deployed in November.”

Despite the extensive findings, Gulati repeatedly returned to what the researchers did not establish: “We found extensive and largely unacceptable weaknesses,” he said in the presentation. “But we did not find evidence that those weaknesses were actively exploited or that votes were altered.”

That distinction has drawn renewed attention as Trump and his allies again focus on election matters.

Last month, the president used a prime-time White House address to release newly declassified intelligence he said showed China interfered in the 2020 election. Among several disclosures, Trump pointed to intelligence showing Beijing had acquired personal information on roughly 220 million American voters. But the documents did not show China altered votes or gained the ability to manipulate voting systems.

Gulati echoed those conclusions Friday when asked about the declassification.

“The China thing isn’t really much of anything,” he said, arguing that a large amount of the voter information at issue could be obtained commercially and should not be confused with access to election systems in ways that can manipulate votes.

“There is no evidence that I know of that says China successfully or any other country has successfully infiltrated our systems and manipulated votes in any way,” he added.

Wareham called the 100-page document a preliminary report and said the firm had wanted another six months to a year to dig deeper into the underlying data.

Gulati said the company’s interactions with the ODNI employees overseeing that work were markedly different from the political pressure the researchers later encountered. “We were never pressured to put anything in our reports that was untrue or politically leaning in a certain way,” he said of those officials.

Wareham said Friday that Mojave itself has pushed for its report to be made public for roughly a year and has recently been told it could soon emerge through a Freedom of Information Act request. Nextgov/FCW could not immediately determine the origin of the FOIA requester. As of publishing time, ODNI’s FOIA logs are available up until January 2025.

“I’m a little annoyed that we are very close to midterms and we had a whole year to freaking figure this out,” Wareham said.

With their government work scrapped, he announced at the Voting Village that he had filed paperwork to create the Machine Assurance Institute, seeking to bring together cybersecurity researchers and election technology companies to examine and independently verify voting infrastructure.

“We wanted to be the national security answer, and put to bed, finally, discussions about prior elections and/or accusations of voter fraud,” said Wareham. “Because, believe it or not, I find it fairly national security-destabilizing to constantly accuse each other of cheating.”

]]>

A crucial cybersecurity system is getting a closer look from Congress

David DiMolfetta — Fri, 07 Aug 2026 15:25:18 -0400

LAS VEGAS — The Cybersecurity and Infrastructure Security Agency sees value in formally placing the world’s dominant software vulnerability tracking program into federal law but is cautioning Congress against imposing rules that could make it harder to adapt as artificial intelligence and international partners reshape the system.

The Common Vulnerabilities and Exposures Program, or CVE, gives publicly known security flaws standardized identifiers so that governments, software companies and researchers can easily communicate about the same issue. It was first created in 1999, and it underpins cybersecurity discussions across both private industry and the national intelligence community.

Policymaking interest in the program followed a funding scare last year that exposed the fragility of the arrangement supporting its functions. MITRE, the scientific research giant that helps operate CVE under a federal contract, warned last April that its funding from the government would imminently expire.

CISA then extended the contract within hours, a sweeping relief for the cybersecurity community that raised fresh questions about why a major global cybersecurity resource leaned so much on a sole U.S. contract. A CISA official previously said that a “broad internal contracting review caused a brief renewal delay in April 2025, but operations continued without disruption and MITRE was ultimately retained as the program operator.”

A legislative proposal reported by Nextgov/FCW in June would formally authorize CVE within the Department of Homeland Security and establish a clearer legal role for CISA, its longtime federal sponsor.

“Defining the importance of the program in legislation in general seems like a very helpful thing,” Lindsey Cerkovnik, branch chief for vulnerability response and coordination at CISA, said Thursday during a panel at the Black Hat cybersecurity conference.

But Cerkovnik, whose office helps oversee CVE, said legislation could become counterproductive if it dictates too precisely how the program must operate.

“When you overdefine how to execute the thing, it can make it very restrictive and difficult,” she said. “In some ways, we are wary of overly-restrictive guidance” that could make CVE less nimble, agile and flexible, she added.

The congressional proposal would also require CISA and the National Institute of Standards and Technology to develop a modernization plan and establish a 15-member board to set CVE policies and priorities. Permanent seats would go to CISA, NIST and top-level CVE authorities, while rotating members would represent industry, academia, researchers and foreign governments.

Reps. Delia Ramirez, D-Ill., and George Whitesides, D-Calif., submitted the proposal as an amendment to the fiscal 2027 defense authorization bill. But the House Rules Committee didn’t select it for floor consideration, preventing it from getting a vote in the full House last month.

Cerkovnik said CISA had reviewed the proposal and saw both benefits and challenges. Formal recognition could help preserve support for the program, although CISA and DHS have maintained its operations without a lapse for more than 26 years, she said.

CISA is CVE’s sole federal sponsor, while MITRE helps execute the program alongside a global network of more than 530 CVE Numbering Authorities, known as CNAs. Those organizations — which include software vendors, research groups and national cybersecurity agencies — can assign identifiers and publish information about vulnerabilities within their areas of responsibility.

The number and variety of those participants has allowed CVE to keep pace with a growing volume of software flaws. AI, however, is widely expected to accelerate vulnerability discovery further and may require the program to make changes that its current structure did not anticipate.

Cerkovnik pointed to a recently announced AI researcher CNA pilot program that would allow selected AI companies to assign CVE identifiers for vulnerabilities uncovered through research using their own models.

That program may need to bring people with AI expertise into its leadership, she said, and rules narrowly prescribing who can serve on CVE boards or how new participants are admitted could complicate that kind of response. Cerkovnik didn’t say the current congressional proposal would block the pilot, instead using it to illustrate why the program needs room to adjust as technology changes.

CVE is also becoming less centered on the United States. The European Union Agency for Cybersecurity, known as ENISA, became a CVE Numbering Authority in 2024 and a CVE Root in November 2025. Roots oversee groups of numbering authorities, helping organizations join the program and maintaining the quality of the vulnerability records they produce.

ENISA has since begun bringing European organizations under its Root, building on the agency’s stated goal of helping strengthen and modernize CVE.

Nuno Rodrigues Carvalho, ENISA’s head of sector for incident and vulnerability services, said on the panel Thursday that the agency now wants to “step up in the coming months” to also be a top-level Root, bringing it to the same level as CISA and MITRE.

He described a more federated model in which organizations in Europe, Japan and potentially other regions oversee nearby numbering authorities and provide further support to the project.

Europe already accounts for roughly one-fifth of the organizations authorized to assign CVE identifiers, Carvalho said. ENISA also operates the European Vulnerability Database, although he emphasized that it relies on CVE identifiers rather than competing with the existing system.

Cerkovnik backed growing foreign participation, arguing the past year had reinforced the need to describe CVE as “a global program and not just a U.S.-centric program.”

AI poses another challenge by potentially increasing the number of vulnerabilities companies and governments must process. Cerkovnik said she expects CVE to scale alongside that growth but is more concerned about whether organizations can determine which flaws demand immediate attention.

“Not all vulnerabilities matter. Not all vulnerabilities matter at the same level,” she said. CISA made a similar argument in a binding directive issued in June that tells federal agencies to base patching deadlines on a variety of factors.

Some lower-risk flaws could be left until a system receives a major upgrade, while the most dangerous vulnerabilities may require action within days. That kind of triage will become more important as AI produces more findings, Cerkovnik said, because neither CVE nor the organizations relying on it can treat every newly discovered flaw as equally urgent.

]]>

The government's AI guardrails are taking shape behind closed doors

Patrick Tucker — Fri, 07 Aug 2026 15:17:18 -0400

No one is saying, officially, what was decided when top frontier AI labs—Google, OpenAI, Anthropic, and Meta—met with White House officials on Tuesday to discuss voluntary guidelines for testing new models.

But Democratic lawmakers described the Trump administration's approach to regulation as “ad-hoc and unpredictable,” and said it’s likely to boost global adoption of rival Chinese models at the worst possible time.

Two officials with one of the labs said that Google, Anthropic, and OpenAI submitted a joint draft of the regulation around nine days ago and then began to work with each other and with the White House to find points of agreement. According to the officials, the labs all agreed they should be able to continue A/B testing as part of the process for developing models, and the White House concurred.

Companies that agree to the framework will submit their models to U.S. inspectors to be evaluated for safety for 30 days before those companies can receive federal funding—including from the Defense Department, whose 2027 budget request seeks more than $54 billion for AI companies, according to the officials.

A June White House executive order adds that models from participating companies would get extra intellectual property protection from Chinese competitors or others who might seek to steal secrets.

The White House is not commenting on how it will conduct the inspections. One of the officials said the the Office of Science and Technology Policy is still trying to set testing standards and how bodies like the National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency will conduct or design tests.

The murkiness around the policy’s details has angered some top lawmakers. In a Tuesday letter, Senate Democrats ask the White House to “provide an unclassified response, with a classified annex if necessary, clarifying the Administration’s current policy and approach to limiting access to advanced AI models.”

The lawmakers also evinced concern about the models' new abilities to defy easy inspection, scrutiny, and limitation.

“During an internal evaluation [in July] OpenAI models escaped their testing environment and used high-level technical capabilities to compromise a third party’s network without any instructions to take those actions,” the letter reads. “The Federal Government cannot be passive as these capabilities emerge.”

AI’s Jurassic Park moment

Last week, Chinese company Moonshot AI released a new open-weight model, Kimi 3, that performs as well as some top U.S. models and is being offered to consumers around the world at a far lower price.

Lawmakers and others are increasingly worried the United States could fall behind China in a race to develop faster, more efficient, more profitable models and to shape the way global populations use, buy, sell, and even build AI. Open weight models have become a key point of contention.

Anthropic wants more scrutiny of open-weight models and more efforts to curb sales of high-performance chips to China to thwart distillation attacks. But others in the industry are taking a more supportive view of open weights.

A former senior White House official and a former senior defense official with direct knowledge of the discussion said Anthropic pushed for more language in the framework to address open-weight security, but came away disappointed.

Anthropic did not comment for this story.

In recent months, several of the newest AI models have broken out of their virtual testing containers.

Anthropic disclosed the first such incident in April, when an early version of their Mythos model was able to “autonomously write some remarkably sophisticated exploits,” including one that allowed it to escape an isolated testing environment that programmers use to test code for effectiveness and safety before it’s released.

Anthropic pulled the model from general release, but made it available under "Project Glasswing" so the government and a handful of large companies could find and fix vulnerabilities in their software.

The White House responded with an export-control ban on June 12, barring access to the model not just to foreign countries but even foreigners in the United States. That meant that Anthropic’s own researchers, many of whom were born outside of the United States, could not work on the model. The White House reversed the ban on June 30.

In July, tensions around a national AI safety strategy, or lack thereof, grew hotter. Both Anthropic and OpenAI revealed new incidents in which models breached their containment. It came as no surprise to many veteran cybersecurity experts. AI researcher and author Gary Marcus, in 2022, predicted such a possibility on his blog, describing it as an “AI’s Jurassic Park Moment.”

Last week, AWS Chief Security Officer Stephen Schmidt told reporters: “Containers are not security boundaries. I actually have a T-shirt that says that, which I started wearing about three years ago.”

AWS hosts multiple models for users through its Bedrock platform. Schmidt said the AI Mythos era requires a far more vigilant approach to cybersecurity, especially for researchers.

“One of the reasons that we built the virtualization infrastructure for AWS using our own Nitro Hypervisors so many years ago was we realized that containers were not an appropriate security boundary then. The same is true for AI. You cannot use an AI container as a security boundary.”

In March, a group of British researchers calculated the sandbox breakout period for various large language models, which proved very accurate months later.

A follow-on paper published this week by the same group describes how to build better containment environments for the models emerging today.

]]>

House probe finds gaps in U.S. effort to remove Chinese telecom risks

David DiMolfetta — Tue, 04 Aug 2026 16:44:05 -0400

Years after federal regulators invoked national security grounds to push three Chinese state-owned telecommunications providers out of the American market, the companies never fully left, a new House probe has found.

China Telecom, China Mobile and China Unicom retained equipment, data-center space and connections to other networks in the United States after the Federal Communications Commission denied or revoked their authority to provide certain telecommunications services, according to a nearly 50-page bipartisan House China Committee investigation planned for release Tuesday and first seen by Nextgov/FCW.

From 2019 to 2022, the FCC denied China Mobile USA’s application to provide international service and revoked authorizations held by China Telecom Americas and China Unicom Americas. But those actions did not require the companies to remove equipment, leave data centers or sever private network links, and the carriers continued offering enterprise networking, internet transit and other services, the panel found.

The committee argues that those remaining footholds could give Beijing’s cyberspies visibility into sensitive traffic, help keep malicious infrastructure online and create opportunities to reroute data or reach U.S. targets. American officials regard China as the country’s leading cyber adversary, with a record of targeting critical infrastructure and stealing military, commercial and personal data.

The three carriers did not respond to detailed requests for comment. Nextgov/FCW also sought comment from the FBI, the Cybersecurity and Infrastructure Security Agency and several U.S. spy agencies. The Defense Intelligence Agency, which produces intelligence findings for the Pentagon, declined to comment.

A spokesperson for China’s embassy in Washington said Beijing “firmly opposes the U.S. overstretching the concept of national security and going after Chinese companies,” adding that China would defend its “legitimate and lawful rights and interests.”

The remaining network ties took on added significance in the committee’s review of Salt Typhoon, the sweeping Chinese espionage campaign uncovered in 2024 where hackers breached major telecom carriers in the United States and abroad. The intrusion reached systems used to comply with court-authorized wiretap requests and allowed the cyberspies to target the communications of senior U.S. officials, including President Donald Trump and Vice President JD Vance.

Reviewing routing data from Sept. 22 to 25, 2024, just as the Salt Typhoon campaign became public, the committee identified 58 groups of internet addresses that CISA had linked to Salt Typhoon servers. China Mobile International’s network appeared in routes to those servers at least 192 times, helping keep the attacker infrastructure reachable as U.S. defenders sought to shut it down, the report said.

The committee does not allege that China Mobile USA employees knew about or participated in the campaign, and it says the routing evidence does not definitively link the company to Salt Typhoon. But the panel argues that the overlap shows how China Mobile’s remaining network ties could help sustain malicious infrastructure.

That finding came from a broader analysis that identified nearly 109,000 incidents from January 2018 through May 2025 in which Chinese or Hong Kong-linked networks allegedly claimed U.S. internet addresses without authorization, potentially diverting American traffic through their systems. The committee classified them as high-confidence hijacks of the Border Gateway Protocol, a bedrock system that directs traffic across networks, but acknowledged that some may have resulted from mistakes or poor network management.

More than 4,200 of the incidents involved China Mobile-controlled networks. In September 2024, eight originated from the same network that appeared in routes to Salt Typhoon servers and diverted traffic belonging to unnamed U.S. network operators, the committee said.

Addressing the threat

Telecommunications networks have long been prized intelligence targets because they can expose private conversations and reveal what political and diplomatic leaders are thinking. Such concerns are compounded by China’s 2017 National Intelligence Law, which requires companies and citizens to assist state intelligence work. Beijing denies that the law compels companies to participate in illegal espionage.

“China’s state telecommunications carriers for too long have enjoyed non-reciprocal access to U.S. domestic networks, but the seriousness of Salt Typhoon gives the FCC and other agencies more than enough justification to restrict or expel them,” said James Mulvenon, a leading authority on Chinese national security issues and vice president of intelligence at risk advisory firm Pamir Consulting.

The committee recommends giving federal agencies greater authority over equipment and private network arrangements that remain after a license revocation, along with targeted removal funding, stronger routing protections and logging requirements for foreign-controlled operators.

Marc Rogers, a veteran telecommunications expert who helped develop the mobile internet in the 2000s and has spent roughly two decades consulting governments and companies on telecom cybersecurity, agreed with many of the panel’s recommendations. Those include treating core telecom systems as high-risk targets requiring closer oversight, strengthening checks on how traffic moves across networks and tightening rules on the foreign-made equipment U.S. carriers can use.

But he disputed the panel’s call to expand “rip-and-replace” efforts targeting legacy telecom equipment, arguing that such programs are economically unrealistic and could significantly disrupt carrier operations.

“On paper it sounds great, until you get someone with operational experience,” Rogers said. “Then they realize you’re basically talking about bulldozing an entire city and building a new one.”

Rogers also said the panel’s recommendations resemble measures in British telecom security law but warned that they would work only if countries act together.

“If only one country takes a strong position, China will just maneuver around them,” he said, adding that the proposals are largely aimed at tactics China has already used. Policymakers should learn from those incidents, Rogers said, while also preparing for how Beijing’s methods may evolve.

The findings underscore the difficulty of removing operators deemed national security risks from a telecommunications ecosystem built on private infrastructure and decades of commercial ties. Regulators can ban specific services without necessarily reaching the equipment, leases and private agreements that preserve connectivity.

The committee based its report on subpoenaed company records, eight interviews conducted under oath, federal records, routing data and network infrastructure scans. It said Cloudflare and unnamed outside cybersecurity experts independently reviewed and verified portions of its routing analysis.

Parent company control and U.S. footprint

Across all three companies, the committee found U.S. subsidiaries that remained dependent on parent or affiliate entities in China or Hong Kong for important technical and operational functions while retaining equipment and network connections inside the United States.

At China Telecom Americas, requests involving connections between U.S. and overseas networks were handled by personnel in Shanghai, Hong Kong or Beijing, according to testimony cited in the report. Service orders could also flow through a parent-controlled system to Shanghai Telecom without a separate contract. The U.S. subsidiary did not keep independent traffic-flow records, leaving employees unable to determine whether a parent or affiliate had changed routes involving equipment in the United States.

China Telecom Americas identified 10 active points of presence — sites where a carrier keeps equipment and connects with other networks — across seven metropolitan areas. A senior engineering official also told the committee that about a quarter of the company’s U.S. transmission hardware was still made by Huawei, whose equipment the FCC has deemed a national security risk.

China Mobile USA, meanwhile, was described by one witness as “basically a sales team,” while another said it had no network engineers. Orders for data center space and network connections were approved at its Hong Kong headquarters, and witnesses could not identify a network operations team based elsewhere.

Despite this, China Mobile USA’s records contained 39 point-of-presence entries across 27 data-center and interconnection facilities. The committee said those sites connected it to carrier backbones, internet exchanges and private networks used by major U.S. technology companies. Investigators identified at least 143 active China Mobile network assets in U.S. facilities.

China Unicom Americas disclosed that seven of its eight directors and two of its three senior managers were Chinese Communist Party members. Its U.S. employees used parent-controlled email and computer systems, and evidence indicated that they operated under cybersecurity, administrative and privacy policies issued by China Unicom Global.

A compliance official told the report’s authors the subsidiary could guarantee its own adherence to U.S. law, but not its parent’s.

A China Unicom Americas compliance official also acknowledged that the subsidiary did not know the identities of some third parties in China that ultimately received services ordered through China Unicom Global. The company had equipment and active connections in roughly 10 U.S. data centers.

Other carrier relations

The report also describes relationships between the three Chinese carriers and companies linked by U.S. authorities to Chinese hacking operations.

China Mobile, in one case, acted as a middleman for CloudRadium, a Hong Kong hosting provider whose infrastructure has repeatedly surfaced in malicious cyber activity, the committee said. Subpoenaed records showed that China Mobile purchased U.S. data center space and network connections on CloudRadium’s behalf, including through a four-year contract valued at $480,000.

The report also links CloudRadium to a Wyoming company of the same name and GlobalData Investments, a California corporation that markets hosting and data center services under the CeraNetworks name. Nextgov/FCW found that the companies’ websites used similar logos, layouts and animations. An email sent to an address listed for Steven Beals, identified online as GlobalData Investments’ chief operating officer, was returned as undeliverable.

The committee also details China Unicom’s relationships with Integrity Technology Group and i-SOON, two Chinese cybersecurity contractors U.S. authorities have linked to state-backed hacking.

A 2024 U.S. advisory identified Integrity Tech infrastructure as the control layer for a botnet of compromised routers and other internet-connected devices operated by Flax Typhoon, a Chinese state-sponsored hacking group. China Unicom Beijing network addresses were used to manage the botnet and connect it to other attack infrastructure and, according to the committee’s report, China Unicom and Integrity Tech formalized a cooperation agreement in November 2023 while the botnet was operating.

China Unicom separately appeared as a corporate partner of i-SOON. The company drew international scrutiny after a large collection of purported internal documents appeared on GitHub in 2024, exposing details about its hacking tools, targets and work for Chinese police and intelligence agencies.

The Justice Department later charged eight i-SOON employees and two Chinese police officers in a years-long hacking campaign, alleging that the company worked with at least 43 intelligence or police bureaus. The charges have not been proven in court.

Integrity Tech’s website was unavailable when Nextgov/FCW attempted to contact the company, and a functioning corporate website for i-SOON could not be located.

“China has been conducting an escalating campaign of cyberattacks on U.S. networks as a form [of] operational preparation of the battlefield,” said Jack Burnham, a senior research analyst in the China Program at the Foundation for Defense of Democracies whose work focuses on China’s military, emerging technologies and science and technology policy.

“Key to these efforts is Beijing’s capacity to access core domestic networks, either via installed equipment, routing relationships, or other interconnections,” Burnham said. “While the FCC has sought to tamp down on Chinese state-owned telecoms firms that pose a national security threat, there is clearly more work to be done, both in terms of regulation and rip-and-replace, to properly handle these threats.”

]]>

GSA’s digital roadmap looks to enhance agencies’ services, CIO says

Edward Graham — Mon, 03 Aug 2026 17:29:57 -0400

The General Services Administration’s push to transform how the U.S. government procures new technologies will radically improve the way public servants deliver services at scale, according to the agency’s IT chief.

The Trump administration has moved to enhance federal adoption of new IT services, including artificial intelligence tools and other products that can automate many of the time-consuming tasks that slow agencies’ citizen-focused operations. GSA has been at the forefront of many of these modernization efforts by helping agencies onboard and experiment with capabilities from leading tech firms in a cost-efficient manner.

In a recent interview with Nextgov/FCW, GSA Chief Information Officer David Shive said the agency’s push to get new capabilities into the hands of federal workers has “disrupted the longstanding practice of how technology is driven into this government."

The typical process for government procurement, he said, was that “academia would create something, and then standards bodies would assess the thing, and then the White House would send out guidance on how to implement the thing and then agencies would then implement the thing.”

Shive added that this approach could take as long as two to three years, which resulted in “all this lost business value in that timeline.”

“Instead, what we're doing now is we're taking a disruptive technology, we're putting thoughtful, logical controls around that thing, and — just like the private sector — building [minimum viable products], building pilots, assessing value and then sharing that with our standards-setting bodies so that their standards are informed not by academic theory, but instead informed by actual use cases in government,” he said.

By shifting the typical procurement approach to speed up tech adoption, Shive said the White House’s governmentwide guidance on large-scale IT implementation efforts is now “based on those actuals rather than theory,” which he added, “has allowed us to drive technology into this government and generate the business value of that enabling technology at a much higher velocity than ever before.”

A new approach to federal tech modernization

Shive framed this as GSA’s digital roadmap for enhancing government services. It’s an approach, he said, that is not just about working to modernize federal systems in a safe and secure manner, but reshaping the entire model for onboarding new technologies downstream so “we buy technology based on these knowings, rather than based on theory.”

One notable example of GSA’s streamlined IT-focused procurement work is the OneGov initiative, which launched in April 2025 with the goal of assisting agencies in their technology modernization efforts by treating the government as one centralized customer. So far, the strategy has led to agreements with more than two dozen tech companies, with many of these deals including temporary discounts of as much as 70% to 90% on relevant products and services, including AI tools.

Shive called the OneGov deals “a perfect example of being able to buy, on a relatively short timescale, AI that allows [agencies] to do exploration and even full-scale implementation, but in a safe contractual model that doesn't lock them into a technology that might not end up being best of class.”

GSA officials previously said that OneGov has led to over $1 billion in cost savings since its launch last year, with the departments of Health and Human Services, Veterans Affairs, Transportation and State among the agencies that have taken advantage of the initiative’s discounted offerings. GSA is also looking at how the current agreements can ultimately lead to longer-term deals and even broader savings beyond the software and tech products that are currently offered.

The agency similarly launched USAi last August as a way for federal employees to experiment with AI capabilities in a trusted sandbox environment. Shive said GSA is able to see how agency personnel are using the platform and its offered AI tools — insights, he added, which “will inform our next round of negotiations” through OneGov.

At the Government Service Delivery conference in June, Shive said during a panel discussion that he believed more AI adoption will allow federal workers to drastically improve customer service delivery.

“Right now, I say we’re 50% of the way there,” he said at the time. “And by this time next year, I suspect we'll be 90% of the way there.”

Shive told Nextgov/FCW that accomplishing this lofty goal also extends beyond tech adoption to organizational change management, which he noted has often been “the biggest challenge historically.”

GSA released a step-by-step guide in June — the Elimination, Optimization and Automation playbook — to help agencies better adopt emerging capabilities in a way that can maximize their operational benefits.

While Shive said the playbook’s main goal is “helping agencies kind of think the same way” when it comes to modernizing their IT services, he added that “the secondary value that we're trying to generate there is that organizational change management part, to demonstrate to our agency partners, ‘look, this doesn't have to be a big, bad, scary thing; it does work.’”

One of the efforts that helped inform the playbook is GSA’s “Million Hour Challenge,” which seeks to eliminate one million hours of employee work during the 2027 calendar year by relying on technology.

Shive noted that this initiative doesn’t solely focus on adopting AI, “but [using] all the tech in the toolbox, including eliminating tools and systems and processes that should no longer be around, optimizing existing processes or automating and augmenting stuff with AI and other things.”

]]>

OPM tells agencies to put tech recruiting at the center of staffing plans

Sean Michael Newhouse — Mon, 03 Aug 2026 16:00:34 -0400

Agencies should prioritize recruiting tech talent in their hiring plans for next fiscal year, the Office of Personnel Management said in guidance released on July 30.

“Planning for technology and planning for talent are no longer separate conversations,” wrote OPM Director Scott Kupor in an associated blog post.

Specifically, agencies should reserve positions for individuals who specialize in areas like artificial intelligence, data science and cybersecurity. The government’s HR agency encouraged officials to fill these roles by utilizing Tech Force and Scholarship for Service.

The Trump administration created Tech Force last year to bring on early-career software and data engineers for two-year tours. While officials set out to recruit 1,000 individuals potentially as soon as the end of March, OPM said in response to a question for this article that it has hired about 300 participants so far.

Scholarship for Service was established in 2000 and covers college tuition for recipients who agree to work in a government cybersecurity role upon graduation. The program was recently updated to emphasize AI competency.

Many scholarship participants told NextGov/FCW last year that agencies rescinded their job offers, as the Trump administration sought to downsize the federal workforce. In all, more than 19,500 technology employees left or were pushed out of the federal government in 2025.

OPM’s guidance also directs agencies to address in their staffing plans how they plan to leverage AI technology, including through reskilling and upskilling current employees.

“This process involves identifying mission-critical positions that deliver the greatest value while understanding how technology can enhance service delivery,” Kupor wrote in the blog. “And it requires an honest look at opportunities to simplify organizations, improve internal processes and maximize the use of taxpayer resources.”

Additionally, the guidance sets a governmentwide target that at least 33% of external hires be in the early stages of their careers and pushes agencies to use the Early Career Talent Network, which OPM created to bolster recruitment of younger workers.

While Kupor frequently touts OPM’s efforts to bring more early-career staffers into government, which has been a longstanding issue for agencies, the Partnership for Public Service, a good government nonprofit, reported that the share of civil servants who are younger than the age of 30 decreased last year. Partnership officials attributed this to the Trump administration’s federal hiring freeze and mass firings of probationary employees, which impacted many individuals who had been in their jobs for less than a year.

The specific annual agency staffing plans that the guidance refers to were mandated by an October 2025 executive order that set new requirements for filling vacancies and new hiring. Kupor also wrote that these plans would provide a “centralized view of workforce needs across agencies” in order to determine which skills the government workforce is lacking and where duplication is occurring.

]]>

U.S. Digital Corps graduates largest class of fellows yet

Christian Robles — Fri, 31 Jul 2026 13:07:24 -0400

The General Services Administration on Wednesday celebrated the graduation of 71 U.S. Digital Corps fellows, marking the largest graduating class since the program’s inception. Those graduates updated the FedRAMP website, helped streamline Agriculture Department environmental reviews and supported other technology projects during their stints in the federal government.

“This government has starved for talent, for people who understand how to do all the things that we want to do to deliver better,” OPM Director Scott Kupor said during graduation remarks.

Some of the graduates of the two-year fellowship program are continuing civil service while others are headed to the private sector.

“For talented technologists like you, there's going to be a lot of paths … but if you want my take, public service is pretty damn great,” GSA Administrator Edward Forst also said during the graduation event.

Following remarks from Forst and Kupor, several U.S. Digital Corps graduates presented slideshows explaining work they did for federal agencies.

One team of three fellows spent their time in the program updating FedRAMP.gov with exact keyword search, the ability to search by clarification and other new features after running feedback sessions with users. The team estimated that the redesign boosted engaged sessions per user by 180%, average engagement time by 10% and views per active user by 28%, according to their PowerPoint presentation.

“Outside of these numbers, though, they represent agency IT teams spending more time finding the right solution for cloud service providers as decisions for documentation they need. This creates better informed decisions across the federal government,” said one of the graduates. The fellows working on FedRAMP.gov also consolidated two older marketplace websites into one.

Other fellows shared how they led a Health Resources and Services Administration project to create an organ transplant-related dashboard and modernized a National Institutes of Health website often used by academics by moving it to the cloud and updating its search engine.

The U.S. Digital Corps launched in August 2021 and had its first cohort of fellows in June 2022, placing early career technologists across numerous federal agencies. But the two-year fellowship is just one of several initiatives the federal government has recently launched to attract young talent.

The Trump administration in December started the U.S. Tech Force, which aims to hire 1,000 early career technologists to work for two-year stints in federal service with the controversial help of private sector companies. The program has a Defense Department-specific recruiting initiative known as the War Force.

The administration’s hiring push comes after nearly 20,000 technology employees left their roles in 2025, according to OPM data.

]]>

GSA official put on leave for social media post saying veterans’ preference in federal hiring is hampering tech recruiting

Sean Michael Newhouse — Thu, 30 Jul 2026 14:14:41 -0400

Updated at 6:00 p.m. ET July 31

A senior official at the General Services Administration recently posted on his personal social media that veterans’ preference in federal hiring is preventing his team from bringing on qualified tech-focused employees.

“Veterans preference is brutally unfair when taken to the extreme of blocking any consideration of non-veterans, but we're seeing that everywhere these days,” wrote Pete Waterman, the director of FedRAMP, a governmentwide program that sets security and risk standards for cloud products. “Even Tech Force wouldn't let us look at normal folks until we made offers to all the veterans first.”

Veterans’ preference gives former armed forces members priority in hiring for certain agency positions. The Trump administration launched Tech Force last year to recruit software and data engineers for two-year positions. While officials initially said they could bring on 1,000 participants by the end of March, the program’s director announced in May that only 180 to 200 hires had been made so far.

“I would love to have everybody here yesterday, but I’m learning the government hiring process does take time,” said Scott Kupor — the director of the Office of Personnel Management, which is overseeing Tech Force — in May.

Screengrab / GovExec

While Waterman’s LinkedIn post received 127 likes and several individuals voiced support, others criticized what he said.

A CEO commented that “As a veteran I can personally tell you there are many qualified veterans that could fill this role.” Likewise, a recruiter for the Treasury Department wrote, “Rather than directing frustration toward veterans or the laws that protect them, the more effective solution is to focus on strengthening HR training.”

Waterman warned that the hiring issues could hurt his program’s effectiveness.

“The future for FedRAMP is pretty dark if we can't hire experts from private sector who have actually worked on cloud services,” he wrote in the post.

GSA Administrator Edward Forst said in a statement to Government Executive that Waterman “has been placed on administrative leave, effective immediately, until further notice.”

“We categorically and completely disagree with a senior employee’s recent remarks denigrating veterans preferences in hiring. GSA has zero tolerance for comments that disparage or disrespect America’s veterans,” he said. "GSA celebrates our veterans and military spouses. They are a critical backbone of our agency: amazing public servants and true heroes whose service continues to strengthen our nation."

Veterans represent approximately 30% of GSA’s workforce and bring invaluable leadership, discipline and experience to our mission every day," Forst added. "Many of our team continue to serve as members of our military reserves. We applaud this dual commitment. We are better for it. This is the ethos of GSA and the federal government.”

Jenny Mattingley, a vice president at the Partnership for Public Service nonprofit who previously worked on federal hiring reform at the Office of Management and Budget, said that the rules around veterans’ preference have largely gone unchanged since they were created after World War II.

“I think what's happened with veterans' preference, along with many other hiring rules, is that they were created in a different time where things moved at a different pace in terms of hiring and where there were only one or two ways into the competitive service,” she said. “So part of the problem is a lot of those rules have really become procedural hurdles rather than achieving the intended outcome.”

But Mattingley emphasized that agencies have flexibility when it comes to implementing veterans’ preference. When she was in government, for example, she helped lead a program that applied veterans’ preference after, instead of before, applicants’ skills were assessed.

“So you're looking at both qualified veterans and qualified non-veterans. Veterans get first preference when agencies are selecting, but they're all technically qualified for the job,” she said. “That was a big change in how veterans' preference was applied. There’s a lot of cultural norms around applying veterans’ preference up front.”

Mattingley also cautioned that the loss of many HR employees as a result of Trump’s staff cuts to the civil service is likely further slowing federal hiring.

“Unless we actually also focus on HR and building out robust HR functions, it kind of doesn't matter if the laws are changed because a lot of this is whether HR has the ability to understand, work with agencies and be strategic about how they apply these laws,” she said.

This story has been updated with a statement from GSA.

]]>

AI's growing role in rulemaking raises new transparency questions

Sean Michael Newhouse — Mon, 27 Jul 2026 17:31:10 -0400

While lawmakers are debating what an appropriate regulatory framework for artificial intelligence should be, experts who spoke at a panel on Monday noted that federal employees have been using the technology for years to develop all sorts of regulations.

Cary Coglianese, a regulation professor at the University of Pennsylvania, said that agencies, for example, have been using AI to analyze thousands of public comments that some proposed rules receive.

“Back in the day, contractors would literally photocopy comments, clip them out and sort them in different categories — and do what essentially natural language processing tools can do now so quickly and rather effectively,” he said.

But as the technology advances, speakers on the panel — which was sponsored by the Coalition for Sensible Safeguards, a left-leaning group of more than 220 regulatory-focused organizations — argued that AI could take over more steps in the rulemaking process, potentially supercharging the Trump administration’s efforts to slash regulations and downsize the federal government.

“I worry a great deal that when you have a government and policymakers basically out to destroy huge portions of the public sector, wholesale implementation of AI will provide them a social veneer just to do that rather than using technology in more positive ways to improve the quality and breadth of public services,” said Ben Zipperer, a senior economist at the Economic Policy Institute.

There are higher stakes for federal agencies compared with private companies when it comes to AI implementation, Zipperer contended, because improper usage could lead to individuals losing their benefits or shaky legal justifications for government actions. Unlike in the private sector, however, the economist emphasized that there isn’t a market factor in government to push back on poor AI implementation.

“A private sector company could replace all their workers with AI, but then their product quality would probably suffer, and they'll lose sales. But there's no profitability check on the public sector,” he said. “So if the public sector uses AI as a way or an excuse to make public servants' jobs worse or to cut public services, there's not a non-political check on that, and public services just suffer.”

There already are high-profile examples of the Trump administration using AI in its cost-cutting initiatives. Department of Government Efficiency staffers in 2025 prompted ChatGPT to assess National Endowment for the Humanities grants and respond in fewer than 120 characters whether they fall under diversity, equity and inclusion programs that officials were targeting for elimination.

Based on that incident, which came to light due to a lawsuit over the canceled grants, Jonathan Walter, a senior policy counsel at the Leadership Conference on Civil and Human Rights, warned that officials could use AI to shut out public feedback they object to on proposed rules.

“It would have been just as easy for them to say, ‘Hey, we're just going to delete or ignore any comment with any mention of race or disparate impact or gender or whatever protected class might have a stake in a rulemaking,’” he said. “Then, there are all of the different downstream consequences that stem from that. It could be that the final rule happens to ignore certain anti-discrimination laws. It might not reflect the amount of participation from a certain group.”

J.B. Branch, a technology expert at Public Citizen, added that he’s worried about which AI systems feds may use — specifically calling out Grok, which has been criticized for generating racist comments as well as responses that are aligned with the opinions of its creator, former DOGE head Elon Musk.

“If someone in the federal government is using Grok, there is a deep concern that whatever output it's providing could be a potentially very biased output,” he said.

Last year, the president signed an executive order that directed agencies to procure “ideologically neutral” and “truth-seeking” AI that is not “woke.”

The Trump administration is pursuing many deregulatory actions, with officials writing in their 2026 regulatory plan that they will “achieve extraordinary cost savings for Americans” and “promote liberty, unleash American energy dominance, preserve products consumers love and eradicate the ideology of [DEI].”

But Lauren McFerran, the executive director of the AFL-CIO Tech Institute, cautioned that an overreliance on AI during the deregulatory process could result in increased judicial scrutiny rather than more rules being cut.

“A court is going to be looking at whether [the agency has] made a rational and supportable connection between the evidence and their reasoning and the ultimate decision. When you get to the more advanced [AI] systems, they're learning from their own processes,” she said. “That creates — the term that tends to be used is a black box. You don't really necessarily know what steps the product undertook to get to certain outcomes, and I think that could be potentially problematic for a court that's trying to review whether the agency, in fact, engaged in the reasonable decision-making process that it was supposed to.”

]]>

Selective Service System seeks software to aid the draft

Ross Wilkers — Fri, 24 Jul 2026 05:00:00 -0400

The window is now open for vendors to start working on and submitting prices for software that can simulate the military’s personnel needs in the event of national emergencies requiring a draft.

While the U.S. military is all-volunteer, the Selective Service System still maintains registration lists of males aged 18-to-25 years old and a second special-skills database based on professional licensing lists of workers in certain health care occupations. The Selective Service System is an independent agency charged with running a draft or drafts in the event they are needed to fill personnel gaps.

By launching this request for quotes on Wednesday, SSS is looking to prepare for emergencies that require it to quickly evaluate staffing and resource requirements through the use of readiness simulation software.

SSS also is tasked with comparing different mobilization and policy scenarios, assessing the operational impacts of surge conditions, identifying potential risks and bottlenecks, and support executive planning and reporting obligations.

The RFQ lists these requirements for the software:

Model the full end-to-end mobilization pipeline
Support configurable scenarios
Provide decision-support analytics for leaders, planners and operators
Operates within an SSS-designated cloud environment
Use anonymized aggregate data
Support complete government ownership and sustainment

SSS is embarking on this search for software ahead of Dec. 18, when the requirement for male U.S. residents aged 18-to-25 years old to register themselves in the system will be replaced with a requirement for SSS to automatically register them by relying on other federal databases.

SSS is an independent agency.

Quotes are due by 2 p.m. Eastern time on Aug. 14. The window for questions to SS closes at 2 p.m. Eastern time on Tuesday, July 28.

]]>

Russian hackers can steal government emails without victims clicking a link, cyber agencies warn

David DiMolfetta — Thu, 23 Jul 2026 14:30:00 -0400

Russian state-backed hackers have exploited a vulnerability in widely used email software to steal messages, passwords and authentication data from Western government agencies and other organizations, U.S. and allied cyber-intelligence authorities said Thursday.

The campaign is notable because it does not require victims to click a malicious link or download an attachment. The exploit can instead activate when someone simply opens or previews an email in an unpatched version of the Zimbra Collaboration Suite — a popular alternative to major collaborative messaging platforms like Microsoft Exchange or Google Workspace — according to a joint advisory issued by the Cybersecurity and Infrastructure Security Agency, National Security Agency and FBI.

The Russian hacking group, known primarily as Laundry Bear, has successfully targeted more than 10 organizations since July 2025, the agencies said. The campaign has hit the defense industrial base, federal and local governments, law enforcement, technology companies, educational institutions, media outlets and nongovernmental organizations.

The hackers sought to steal email addresses, passwords and two-factor authentication tokens, which could allow them to retain access to compromised accounts even after obtaining a victim’s password. Their tools also attempted to collect an organization’s email directory, as much as 90 days of a victim’s communications and other sensitive information.

The Treasury Department’s Financial Crimes Enforcement Network purchased a Zimbra standard support subscription in February 2025, according to federal contracting data listed in GovTribe, a federal market intelligence platform owned by Nextgov/FCW parent company GovExec. The purchase does not indicate whether FinCEN used the vulnerable version of the software or was targeted in the campaign.

“Unlike traditional phishing that attempts to persuade a user to take an action, such as clicking a link or downloading a file, Laundry Bear’s current campaign uses a zero-click exploit that only requires a user to view a malicious email,” CISA said in a statement.

Proofpoint, which also investigated the activity, describes the technique as a “half-click” exploit because the victim must still open or preview the email. The company said no additional interaction is required once the message appears in a vulnerable Zimbra webmail client.

The emails were sent from both attacker-controlled Proton Mail accounts and addresses that had already been compromised, according to Proofpoint.

In one example released by the company, the sender claimed to represent a Belgian media-verification organization and proposed cooperation among European institutions combating disinformation. The message contained a legitimate-looking link to a European Union events calendar, but the malicious code was embedded directly in the email itself.

CISA urged organizations to update all Zimbra mail software, monitor their email systems for suspicious activity and review the technical indicators included in the advisory. Organizations that find evidence of a compromise should follow the agencies’ remediation guidance rather than relying solely on installing the available patch.

“CISA continues to see sophisticated and less sophisticated nation-state cyber groups deploy increasingly novel exploits into a highly successful capability to disrupt critical infrastructure or conduct espionage,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity.

The advisory was also backed by defense, cybersecurity and intelligence agencies from Australia, Canada, New Zealand, the United Kingdom and more than a dozen European countries.

]]>

Transportation looks to AI to accelerate its modernization initiatives

Edward Graham — Tue, 21 Jul 2026 07:00:00 -0400

The Department of Transportation is ramping up its use of artificial intelligence, according to a top agency official, with the emerging capabilities playing an increasingly important role in the agency’s ongoing modernization efforts.

Speaking at GovExec’s Government Efficiency Summit on July 16, Transportation Deputy Secretary Steven Bradbury said internal adoption of the technologies has already helped to accelerate needed software upgrades, with growing workforce use of AI poised to further expand its impact on agency operations.

Transportation released its 1DOT IT strategy last September to help guide its digital infrastructure transformation, which includes a focus on modernizing and replacing its outdated systems.

Bradbury said uses of the emerging capabilities have already helped Transportation speed up its software production timelines from 18 months down to 18 weeks, noting that “when we have a need for new software applications, we can bring AI to bear to help.”

Agencywide experimentation with AI tools has also highlighted a broader range of potential benefits from the technologies, Bradbury said.

He cited internal figures that found that “80% of DOT people are now looking at the uses of AI,” and said current adoption of the capabilities highlights how the technologies can provide further benefits to the American people.

“We're using it in making our rulemaking faster, more effective,” Bradbury said. “We get tens of thousands of comments on the complicated rules that we issue. We need to be able to digest those quickly, understand them [and] respond to them. AI can obviously help with that. Similarly, reviewing hundreds and hundreds of grant applications to make the right decisions about which projects to support through our grantmaking — AI is going to be instrumental in helping us do that as well.”

Beyond internal uses of AI, the capabilities are also set to play a key role in the Trump administration’s broader push to upgrade the nation’s outdated air traffic control system. Transportation Secretary Sean Duffy announced the modernization effort in May 2025, saying at the time that the multi-billion dollar effort would include a modernized flight management system and updated ground radar systems at all U.S. airports.

Although Congress approved $12.5 billion for the modernization effort as part of the Big, Beautiful Bill, Bradbury said “we do need more” to finish the effort by the end of President Donald Trump’s second term.

He noted that the Federal Aviation Administration, which is overseeing the initiative, is already in the process of setting up a Strategic Management of Airspace, Routes and Trajectories — or SMART — system “to use all of the information available, [including] weather, what's going on at the ground [and] where airplanes are being prepared for takeoff across the whole system to know in advance what the conflict points are.”

The FAA announced last month that it awarded Air Space Intelligence a 12-year, $875 million contract for new software and artificial intelligence capabilities, including for the SMART system.

Bradbury said that “AI is going to be essential to make this happen.”

]]>

GSA wants other agencies to borrow what's working on tech

Frank Konkel — Sun, 19 Jul 2026 11:59:52 -0400

As the General Services Administration closes in on achieving its 2026 moonshot goal to save and automate 1 million hours of work for its employees, the agency will showcase and share those internal efforts — and a host of other proven tech efforts — with a governmentwide audience on July 30.

Registration for the Emerging Technology Showcase is open to all federal employees, and though the event will be held in person at the Interior Department’s Yates Auditorium, it will be livestreamed for a virtual audience likely in the tens of thousands.

“The administration has looked at GSA to lead” on approaches that make government more efficient, effective and responsive, GSA Deputy Administrator Mike Lynch said Thursday at the Government Efficiency Summit.

GSA hosted an internal tech demo day in late spring, featuring several agency employees — including Lynch and Chief Information Officer Dave Shive — who showcased several ways technology was being used across the agency to save time, improve efficiencies, deliver better outcomes and services or make employees’ jobs easier. Several thousand employees tuned in, and Lynch said its in the agency’s DNA to share what’s working.

“That's really a core to GSA's mission and a convening function that we've heard: a lot of demand and interest throughout government to expand what we were doing internally and offer it up more broadly,” he added.

One certain talking point for the event will be a step-by-step guide GSA released in June to cut, streamline and automate work called the Elimination, Optimization and Automation playbook. The playbook builds on lessons learned from federal pilots, mature automation programs and GSA’s own extensive internal enterprise efforts to improve operations. One such effort, the agency’s push to save and eliminate 1 million hours of employee work within the calendar year, is pacing far ahead of schedule.

“We're at roughly 850,000 [hours identified], which has been amazing, and we've been blown away with kind of the adoption that's taken place, largely driven by technology,” Lynch said Thursday. “We put that in [the] playbook, and we're now showcasing that as part of the forum on the 30th that should be available to all of government to see where to use that within your own workflows.”

]]>

VA’s push to shorten benefits forms needs more public input

Edward Graham — Wed, 15 Jul 2026 15:34:28 -0400

The Department of Veterans Affairs is pushing for more public feedback on its proposals to reduce the amount of paperwork that veterans and their survivors must complete to apply for benefits.

VA published two recommendations last month proposing to shorten the length of the forms needed to apply for disability compensation benefits and for Dependency and Indemnity Compensation, survivor’s pension and accrued benefits. The department highlighted these ongoing efforts on Wednesday and noted it is accepting additional public input on its recommendations.

VA’s proposal to reduce the amount of paperwork needed to complete the disability compensation benefits form was published in the Federal Register on June 23, with the department saying its Veterans Benefits Administration component is looking to reduce the complexity of the paperwork by the end of calendar year 2026. The outlined recommendation would shorten the form from 15 pages to five pages and decrease the average amount of time needed to fill out the paperwork from 25 minutes to 15 minutes.

“The primary objectives are to enhance the experience for Veterans, lessen the administrative burden and time required to submit a claim for benefits, and accommodate preferences for submitting forms either through VA.gov or via paper, while preserving accessibility,” according to the notice.

The proposal to shorten the DIC application was similarly published in the Federal Register on June 25 and also notes VBA’s desire to reduce the complexity of the form’s paperwork by the end of this year. The notice said the department is looking to shorten the application from 20 pages to seven pages and reduce the average response time from 40 minutes to 25 minutes.

VA said in both proposals that it is looking for comments on how to revise its information gathering process, such as “ways to minimize the burden of the collection of information on respondents, including through the use of automated collection techniques or the use of other forms of information technology.”

Public input on the recommendations, however, has been relatively muted thus far. As of this article’s publication, the two proposals had a combined nine comments — two for the disability compensation benefits recommendation and seven for the proposed DIC application changes. Feedback on both proposals will be accepted through Aug. 24.

VA has already been working over the past several years to shorten or digitize many of the forms that veterans and their beneficiaries must complete to apply for and receive services. These efforts have included a push to create standardized claim and appeal forms, as well as an effort to pre-fill some forms with information from verified VA.gov profiles.

“No Veteran or surviving family member should face unnecessary bureaucratic hurdles when seeking the benefits they’ve earned,” VA Secretary Doug Collins said in a statement. “These proposals reflect our commitment to putting Veterans and their families first — reducing paperwork, saving time, and making the application process as straightforward as possible.”

]]>

Space Development Agency resumes launches with its future in doubt

Thomas Novelly — Wed, 15 Jul 2026 13:20:06 -0400

After a nine-month pause, the Space Development Agency is finally scheduled to launch its next batch of satellites for its sprawling military-communication constellation—even as draft legislation weighs dissolving the agency.

SDA is scheduled to launch its next 21 Tranche 1 satellites on Thursday aboard a SpaceX Falcon 9 rocket from Vandenberg Space Force Base. Their payloads will be part of the data-transport layer of the agency’s Proliferated Warfighter Space Architecture, a network of hundreds of low-earth-orbit satellites to be used for space-based military communications and threat detection. After the first two batches of those satellites were sent into orbit this past fall, SDA paused further launches as officials worked through technical problems.

“We did see software and hardware issues on the ones on orbit right now,” Gurpartap Sandhoo, the Space Development Agency’s director, told reporters on Wednesday. “That's why we kind of delayed and took a pause to make sure we fix at least the known issues. We expect this launch to be a lot smoother than the last one.”

After Thursday’s launch, Sandhoo said, the agency will have roughly half of the transport layer’s satellites on orbit. Satellites for the next layer, known as Tranche 2, are anticipated to start going up in fiscal year 2027.

Despite the delays, Sandhoo said SDA is “in a better place in terms of schedule.”

Yet his agency might not survive long as an independent entity. A draft version of the National Defense Authorization Act aims to fold the agency and authorities into the Space Force’s portfolio acquisition executive.

Sandhoo said SDA employees may have “some concerns” with the draft language. But workers are “here for the mission” and to get the architecture done, he said.

Government watchdogs have repeatedly questioned the technology behind the satellite constellation.

Last year, the Government Accountability Office raised concerns about its laser-communications technology, saying that it “hasn't fully demonstrated that it works in space.” The agency pushed back on the report and said it had achieved “baseline objectives” with tests.

In January, GAO reported that SDA’s program “is at risk of being unable to deliver capability as quickly as planned” and said the agency “should be more realistic and transparent on the technology it can deliver.

Sandhoo pushed back on those findings as well, telling reporters that the agency needs to take risks to bring crucial space-based technologies to the troops.

“I would want you to go back and look at the Apollo program. I mean, you did not wait until Apollo 8 landed before you start building Apollo 9, right? You just had to do it,” Sandhoo said. “That's the kind of mindset we're taking. That's what I think the nation needs right now.”

]]>

AI won’t replace human claims processors, VA officials say, as Democrats worry over staffing levels

Christian Robles — Tue, 14 Jul 2026 12:57:18 -0400

Artificial intelligence tools the Department of Veterans Affairs is using to speed up disability claims processing will not replace human reviewers, agency officials told lawmakers Monday, but Democrats contend claims processing also need sufficient staffing levels, not just new technology.

“Every disability claim is decided by a trained VA employee, not by AI or automation. These tools support human decision making; they do not replace it,” Robert Orifici, acting deputy chief information officer at VA’s Office of Information and Technology, said during a House Veterans’ Affairs Technology Modernization Subcommittee hearing.

“What we really strive to do is look at those really high volume, highly administrative tasks, focus our resources and [apply] really basic automation on those capabilities, so that we are really supporting and augmenting the productivity of our employees,” added Derek Herbert, acting chief production officer at VA’s Veterans Benefits Administration.

Rep. Tom Barrett, R-Mich., who chairs the subcommittee, expressed support for VA’s focus on maintaining human disability claim reviewers, saying Congress “will make sure that there are strong guardrails where no veteran claim is fully decided by AI or automation.”

The comments come as VA is actively using AI to speed up disability claims processing by prepopulating toxic exposure memos veterans must file, streamlining information gathering and facilitating other procedures. VA is also planning to acquire or develop additional AI and automated tools for disability claims, Nextgov/FCW reported in March.

But Rep. Nikki Budzinski, D-Ill., the panel's ranking member, argued that the new technologies may actually hinder VA reviewers’ ability to quickly process claims.

“I hear from employees that the so-called fixes that VA has pushed, like automation and pilots of artificial intelligence tools, often produce incorrect information, compounding issues and slowing production,” Budzinski said.

The congresswoman said new technology cannot solve declines in VA staffing, adding that she is alarmed that VA has lost 1,100 claims examiners this fiscal year, along with 2,700 examiners and 120 IT specialists since January 2025.

Rep. Maggie Goodlander, D-N.H., said she shared Budzinski’s concerns that a lack of adequate VA staffing is leading to less accurate reviews of claims.

Goodlander pressed Hebert to reveal how many claims examiners the VA has on staff and confirm the total has declined since January 2025. Hebert did not have specific numbers but said he would get those to the lawmakers while noting that VA is currently hiring. VA had several open claims examiners positions on usajobs.gov as of Tuesday morning.

Sterling Thomas, the Government Accountability Office’s chief scientist, similarly told lawmakers that federal agencies need a workforce with the right skills to harness new technologies. He argued that solutions such as a federal digital services academy could help VA and other agencies field the talent they need.

Thomas also recommended that VA turn to GAO’s AI framework of key practices as it continues to roll out new AI and automated technologies for claims processing. The framework says federal agencies should document the data used to build AI models, articulate system-level technical specifications, continuously monitor AI performance, assess that performance and take other measures to ensure technology is responsibly deployed.

]]>

DHS network intrusion was twice ruled a false positive before breach confirmed

David DiMolfetta — Mon, 13 Jul 2026 17:15:50 -0400

Department of Homeland Security personnel twice dismissed signs of cyber intruders inside the agency’s Homeland Security Information Network as harmless activity, allowing hackers to remain undetected inside for weeks and eventually steal credential files, according to an internal incident readout viewed by Nextgov/FCW.

HSIN was breached about two months ago, Nextgov/FCW first reported in late June. The network houses sensitive, unclassified data that’s shared between federal, state, local, industry and overseas partner organizations.

Department investigators have still not determined the affiliation of the hackers, according to two people with knowledge of an ongoing probe into the incident. DHS may send staff to brief Congress on the hack in a classified setting in the coming weeks, added the people, who spoke on the condition of anonymity to communicate the department’s thinking.

Between May 15 and May 24, the infiltration was detected by analysts inside FEMA, where they observed the hackers had altered files on testing and live servers, used a legitimate web-server program to run malicious code and deleted activity logs that could have exposed their movements, according to the readout. The activity was ruled a false positive.

Between May 25 and June 3, the hackers used similar methods aiming to leave scant trace of their activity, setting off more alerts that were again dismissed as benign. On June 4, they installed hidden backdoors and stole credential data — typically employed to verify users’ identities and grant access to accounts or systems — where personnel then declared a breach was active.

It’s not clear why the intrusion was deemed benign two times over such a wide timeframe, but the incident highlights how a mistaken assessment can give hackers significantly more time to deepen their access into a target’s environment. The hack involved techniques meant to mask activity as normal, which, generally speaking, can make it very difficult for analysts to determine what is legitimate or not, one of the people said.

It’s also unclear what materials, if any, were copied from HSIN systems, though the fact that hackers targeted credential files indicates they sought out access to accounts or systems beyond what they could initially reach.

"The Department of Homeland Security is aware of a recent cyber incident involving a specific, unclassified legacy information sharing environment," a DHS spokesperson wrote in the same statement it provided earlier this month that confirmed the hack. "We immediately took action to isolate the affected systems, mitigate the vulnerability, and launch a comprehensive forensic investigation. There is no indication that classified networks were impacted, and the system remains operational for our partners. As this is an ongoing investigation, we cannot provide further operational details at this time."

Approved users lean on the network to securely access data, exchange requests with partner agencies, coordinate safety and security for planned events, respond to incidents and share information needed to protect their communities, per its website.

HSIN has been used to support ongoing World Cup games and recent America250 events, Senate Intelligence Committee Vice Chairman Mark Warner, D-Va., said in a statement after the breach was reported.

“The information in HSIN, while not classified, is highly sensitive, and its exposure risks national security,” he said at the time.

As the United States hosts World Cup matches nationwide, the hack could raise questions about whether the intruders gained access to security plans, interagency communications or emergency response plans for one of the world’s most visible sporting events. It’s also possible that World Cup data was not a target.

Nation-state and criminal hackers routinely target U.S. systems to gather intelligence, steal sensitive information and maintain access to government networks. In February, a suspected China-linked breach of an FBI surveillance system likely exposed the phone numbers of people the bureau was monitoring. Last fall, a widespread breach at FEMA let hackers make off with employee data from both the disaster management office and U.S. Customs and Border Protection.

Editor's note: This article has been updated to include a statement from DHS.

]]>