Government Executive - Tech

Space Command says it needs to ‘shoot, move and communicate’ in orbit

Thomas Novelly — Wed, 12 Aug 2026 19:19:38 -0400

HUNTSVILLE, Ala. — Space weapons and refuelable satellites are among the items needed to preserve the U.S. military’s orbital edge over China, the head of U.S. Space Command said.

America’s adversaries are targeting U.S. space assets and rapidly developing their own, Gen. Stephen Whiting told attendees at the Space and Missile Defense Symposium on Wednesday. China, for example, has direct-ascent ASAT missiles, ground-based lasers, jammers, and maneuverable, dual-use satellites, he said.

“These developments intend to degrade our current space superiority and would potentially give

China a maneuver and logistics advantage in space – something we would not accept on the land, at sea, or in the air,” Whiting said.

In the four-star’s final Space and Missile Defense Symposium speech as the leader of the combatant command, Whiting told military and industry audience members that there are five major things on U.S. Space Command’s Integrated Priorities List for 2029 to 2033.

“This isn’t just a wishlist. It’s a clear demand signal to several audiences describing the warfighting capabilities we need to meet our mission,” he said.

1. Integrated space fires: Mirroring Army usage, Whiting has used this term throughout his tenure at Space Command to refer to the offensive and defensive capabilities needed to deter orbiting threats.“

We’re a combatant command and we fight to win wars,” he said. “To win, we need credible, acknowledged, kinetic and non-kinetic fires. They are a key component of how we establish space superiority and restore credible deterrence.”

2. Counter-pLEO tech: Whiting said new technology is needed to counter adversaries’ low-Earth-orbit satellite constellations. As of last month, China has launched 200 G60 and 168 SatNet communications satellites as it builds a pair of “mega constellations...to compete with Western proliferated LEO (pLEO) architectures,” according to a Space Force fact sheet.

“I don't want any U.S. force to be put at risk because somebody else might have a proliferated low-Earth-orbit constellation that could find, fix, track, and target them,” Whiting told reporters after his keynote address.

3. Joint, integrated space command and control: Military leaders often stress the centrality of being able to oversee, organize, and order complex space operations.

“We must enhance machine-to-machine connectivity to support decision-making and battle management of this global space fight on tactically relevant timelines,” Whiting said in his address.

4. Dedicated space domain awareness for space engagements: It’s not just for missile defense, Whiting said: space domain awareness needs to expand and evolve to a whole range of space operations, not just one segment of it.

“We must adopt a ‘target-quality track’ mindset to everything we do in space, just like the missile defense community has done for decades,” he said.

5. Sustained space maneuver: Developing satellites that can be refueled to extend their usefulness remains one of U.S. Space Command key priorities. In March, a Chinese commercial satellite used a flexible robotic arm to “to demonstrate on-orbit servicing, refueling, and debris removal,” according to the Space Force.

“Today, our satellites are limited by the fuel they launch with, which leads to a psychology of scarcity. Husbanding that fuel often overrides desired warfighting maneuvers,” Whiting said. “That must change. We must be able to actively avoid threats and maneuver to gain a position of advantage on our adversaries.”

Whiting has pitched some of these items at past symposiums; in 2024, he said his 2027 Integrated Priorities List was topped by space fires and resilient command and control.

“Our space assets need to shoot, move, and communicate just like the rest of the Joint Force,” Whiting said Wednesday. “In short, space needs to fight like the Joint Force, to empower the Joint Force’s ability to fight and undermine our adversaries’ ability to do so.”

]]>

VA’s benefits system overhaul is running into some familiar problems

Edward Graham — Wed, 12 Aug 2026 11:28:50 -0400

Efforts to modernize a Department of Veterans Affairs system that supports the processing of veterans’ benefits claims have been hampered by “insufficient oversight and weak program management,” according to the agency’s Office of Inspector General.

The watchdog warned in an audit released on Tuesday that VA’s Office of Information and Technology has not taken all of the necessary steps to keep the revamp of the agency’s Benefits Enterprise Platform on track, which could potentially affect the processing of veterans’ benefits and other modernization efforts.

The BEP platform — one of 85 legacy systems that VA has identified as needing to be modernized or decommissioned to “improve overall efficiency of claims processing” — helps facilitate the sharing of information between the Veterans Benefits Administration and other “business line systems” that include pension, vocational rehabilitation and employment benefits.

VA awarded Booz Allen Hamilton a $1.1 billion contract in May 2021 to integrate its benefits systems into a new cloud-based Benefits Integration Platform, with the plan calling for the legacy BEP system to be migrated to this new service and then subsequently decommissioned. Although the contract was supposed to be completed this month, OIG noted that the latest timetable from VA said the BEP modernization effort is now slated to be completed in the second quarter of fiscal year 2034.

"Because BEP supports a significant number of systems, there is increased risk that other systems relying on it may experience negative consequences from potential delays in the modernization effort,” the report said.

The audit said the Office of Information and Technology failed to develop “a high-quality, reliable program schedule as recommended by the Government Accountability Office’s Schedule Assessment Guide” for the project and has instead relied on an agile project management tool for the effort — a tool that “does not contain roadmaps or detailed plans for the entire scope of the project.”

OIG also found that the office lacked a reliable lifecycle cost estimate for the modernization initiative, which has resulted in inconsistent funding information being included in various BEP plans and has “limit[ed] VA’s ability to make informed decisions.”

Lack of proper oversight, the watchdog reported, also may have jeopardized the security of veterans’ sensitive personal data when the office “hosted minor applications without conducting required security assessments.” After OIG notified VA officials about documented vulnerabilities — some of which dated as far back as 2021 — the watchdog said VA took the necessary steps to assess the security of its applications and remediate any identified issues.

OIG’s audit recommended that VA take steps to enhance its BEP modernization efforts, including by developing and maintaining a program schedule that aligns with best practices, ensuring that staff are following proper procedures when it comes to storing scheduling information, developing a “reliable, validated life cycle cost estimate” for the project and tracking all relevant project costs. VA officials said they concurred with the watchdog’s recommendations.

The BEP project is just the latest VA modernization initiative to be singled out for criticism by OIG for resulting in significant delays, cost overruns and oversight gaps.

VA is still in the process of developing a new digital GI Bill system, which the watchdog noted in an August 2024 report has seen its cost more than double as a result of “insufficient planning.”

The agency’s large-scale electronic health record modernization project has also been plagued by cost overruns, delays and oversight issues since the deployment effort began in earnest in 2020. The Trump administration has prioritized righting that effort, however, and VA Secretary Doug Collins said earlier this year that an EHR rollout resumption push has been “phenomenal” so far.

]]>

The government was ready to expand its voting security work. Then it pulled the plug

David DiMolfetta — Mon, 10 Aug 2026 14:09:14 -0400

LAS VEGAS — After spending roughly six weeks analyzing Dominion voting systems used in Puerto Rico’s 2024 elections, Mojave Research came back to the Trump administration with findings that startled its researchers.

The systems contained at least a dozen high- or critical-severity software vulnerabilities. Passwords were reused, firewalls were disabled and basic cryptographic protections were poorly implemented. And in Puerto Rico, active cellular hardware modems opened additional pathways into underlying software that was thought to be isolated.

But the small cybersecurity firm found no evidence that any of those weaknesses had actually been exploited, or that votes had been changed. The company still wanted more time to be certain.

Federal officials initially seemed willing to give them considerably more of it. The company was asked to grow the team working on the effort from roughly 10 people to about 60, according to CEO Jason Wareham.

Chief Technology Officer Manbir Gulati also said Mojave received an authorization to proceed with a follow-on effort, hired personnel and was given funding to acquire equipment for examining additional voting systems ahead of the November midterms. A contracting officer had even been brought in to finalize the new agreement, Gulati said.

Then, as Mojave prepared to move ahead, the work was abruptly shut down.

Wareham and Gulati recounted the episode on Friday at DEF CON hacker convention’s Voting Village, where they publicly unpacked their technical findings before sitting down with a small group of reporters and onlookers afterward.

Their account fills in new details about a federal effort that grew out of the Trump administration’s broader focus on voting machines and election interference, and the political pressures that emerged when Mojave’s findings did not support claims of election manipulation.

The ODNI request

Mojave never set out to become an election security provider. Its involvement began last year through the Office of the Director of National Intelligence under then-director Tulsi Gabbard, where it was already performing unrelated technical work for the agency when officials approached the company about examining voting machines and data obtained from Puerto Rico.

Reuters reported in February that the May 2025 operation was tied to an effort involving ODNI and the FBI to investigate allegations that Venezuela had hacked Puerto Rico’s voting systems, though Gabbard’s office denied that Venezuela drove its work and said the examination was focused on technical vulnerabilities. The probe produced no clear evidence of Venezuelan interference.

Wareham said at DEF CON that ODNI asked whether his team of reverse engineers and forensic specialists could travel to Puerto Rico and capture an image of a voting system that had actually been used in an election, without the vendor overseeing the process. He agreed, thinking it would be a relatively small addition to Mojave’s existing contract.

The assignment instead dropped Mojave into a much larger skirmish over American elections. “Ultimately, I made the worst decision of my life in a business context,” Wareham said.

President Donald Trump has spent years falsely maintaining that his 2020 loss was stolen and the product of widespread fraud and foreign interference, claims that have been rejected by courts and officials in his own administration. A 2021 intelligence community assessment found no indication that a foreign actor attempted to alter ballots, vote tabulations or any other technical aspect of the election.

Since returning to office, Trump and allies have revived investigations into the 2020 contest and pushed election security back to the center of his administration’s agenda. Gabbard’s ODNI was one part of that effort, hauling off and analyzing voting systems from Puerto Rico and later becoming involved in a federal investigation of 2020 election records in Georgia.

Wareham said the ODNI officials directly overseeing the company’s technical work wanted the research to continue. Both he and Gulati described the ODNI staff they worked with as professionals who wanted to protect the security of election systems.

The resistance, Wareham said, came from a separate White House collective that was repeatedly dissatisfied Mojave had not produced evidence supporting claims that the 2020 election had been manipulated.

“There was a separate group — let’s call them White House-adjacent — who was dissatisfied,” he said. “They were dissatisfied overall that I was not willing to name and shame at that moment” and declare that Trump had actually won the 2020 election.

Asked whether he believed Mojave’s government work was axed because it failed to find the “smoking gun” some officials wanted, Wareham said: “I believe that was part of the termination, yes.”

Reuters reported in April that Kurt Olsen, a prominent 2020 election-denier and Trump adviser involved in efforts to investigate the election, pressed Mojave to broaden its work in search of evidence that could support those claims.

Olsen, who now works at the Justice Department, turned against the company when its research failed to uncover evidence that the Puerto Rico machines had been hacked. He advocated terminating its work and accused Mojave of secretly receiving money from billionaire George Soros, a frequent target of right-wing conspiracy theories, the news agency reported. ODNI has said Mojave’s contract ended because the company completed its voting-machine analysis.

Wareham said an ODNI official informed him while Mojave was preparing to expand its work that the company had been accused of receiving Soros funding. The allegation prompted him to compile a detailed accounting of the young company’s funding sources within three days and send it up the government chain. Asked who he was told had made the accusation, he said an ODNI official reported to him that it was Olsen.

“One, I’m not funded by George Soros,” Wareham said. “Two, it would be great to be funded by George Soros because I would probably not be here, I’d be on a yacht.”

The company kept moving forward. Wareham said Mojave briefed the White House on some of its findings around September. The firm believed it was heading toward a broader effort to remediate vulnerabilities before the midterms and conduct a deeper analysis for signs that the weaknesses it discovered had ever been actually abused.

Then came the record-long government shutdown. Wareham said that on the day he expected an expanded contract to move ahead, Mojave instead received a stop-work order and no additional funding.

“I think the government shutdown was all that was required, really, to have some folks that I didn’t know were still in the game, again, White-House adjacent, to take their shot,” he said. Wareham stopped short of saying he had direct proof that White House officials ordered Mojave removed because of its findings, but said “it was reported to me it was Kurt Olsen” who led the efforts.

The White House, ODNI and Olsen did not return requests for comment.

Identified vulnerabilities

Mojave had found many issues with the machines it examined. Gulati described the Puerto Rico system during the Voting Village presentation as “deeply insecure,” saying it did not meet the security bar he would expect from “an average low-risk application, let alone critical infrastructure.”

Researchers identified at least 12 major vulnerabilities in commercial software installed on the system, Gulati said. Mojave successfully executed five of them. None were newly discovered flaws, and fixes were already available — in some cases well before the system was used in the election.

Other weaknesses were rooted more deeply in how the system was built and deployed. Some passwords could be easily cracked and others were embedded directly into software. Firewalls were turned off on critical systems and ports were left open. Gulati was particularly critical of the system’s cryptography, which he described as being “in shambles.”

The company does not believe every problem it found necessarily stopped at Puerto Rico, as its formal review covered only one system from one manufacturer in one jurisdiction. Gulati suspects the issues could extend beyond a single voting machine company, though Mojave has not examined enough systems from other manufacturers to establish that.

“I don’t expect that the problems are unique to them,” he said. “I think many manufacturers probably exhibit the same problems.”

Mojave produced an approximately 100-page document of the Puerto Rico findings. Gulati said Mojave has been in discussions with Liberty Vote — which acquired Dominion’s election business last year — and that Liberty told the researchers it does not plan to make changes before November.

Liberty said it has not received Mojave’s report.

“Liberty Vote is not in receipt of any such report so, therefore, we cannot provide any comment,” a spokesperson said. “As always, Liberty Vote is committed to advancing the future of secure American elections.”

No evidence of vote tampering

Looking at the systems headed into the midterms, Gulati said, “I do know that as of now, the state that we have described is going to be pretty similar to what will be deployed in November.”

Despite the extensive findings, Gulati repeatedly returned to what the researchers did not establish: “We found extensive and largely unacceptable weaknesses,” he said in the presentation. “But we did not find evidence that those weaknesses were actively exploited or that votes were altered.”

That distinction has drawn renewed attention as Trump and his allies again focus on election matters.

Last month, the president used a prime-time White House address to release newly declassified intelligence he said showed China interfered in the 2020 election. Among several disclosures, Trump pointed to intelligence showing Beijing had acquired personal information on roughly 220 million American voters. But the documents did not show China altered votes or gained the ability to manipulate voting systems.

Gulati echoed those conclusions Friday when asked about the declassification.

“The China thing isn’t really much of anything,” he said, arguing that a large amount of the voter information at issue could be obtained commercially and should not be confused with access to election systems in ways that can manipulate votes.

“There is no evidence that I know of that says China successfully or any other country has successfully infiltrated our systems and manipulated votes in any way,” he added.

Wareham called the 100-page document a preliminary report and said the firm had wanted another six months to a year to dig deeper into the underlying data.

Gulati said the company’s interactions with the ODNI employees overseeing that work were markedly different from the political pressure the researchers later encountered. “We were never pressured to put anything in our reports that was untrue or politically leaning in a certain way,” he said of those officials.

Wareham said Friday that Mojave itself has pushed for its report to be made public for roughly a year and has recently been told it could soon emerge through a Freedom of Information Act request. Nextgov/FCW could not immediately determine the origin of the FOIA requester. As of publishing time, ODNI’s FOIA logs are available up until January 2025.

“I’m a little annoyed that we are very close to midterms and we had a whole year to freaking figure this out,” Wareham said.

With their government work scrapped, he announced at the Voting Village that he had filed paperwork to create the Machine Assurance Institute, seeking to bring together cybersecurity researchers and election technology companies to examine and independently verify voting infrastructure.

“We wanted to be the national security answer, and put to bed, finally, discussions about prior elections and/or accusations of voter fraud,” said Wareham. “Because, believe it or not, I find it fairly national security-destabilizing to constantly accuse each other of cheating.”

]]>

A crucial cybersecurity system is getting a closer look from Congress

David DiMolfetta — Fri, 07 Aug 2026 15:25:18 -0400

LAS VEGAS — The Cybersecurity and Infrastructure Security Agency sees value in formally placing the world’s dominant software vulnerability tracking program into federal law but is cautioning Congress against imposing rules that could make it harder to adapt as artificial intelligence and international partners reshape the system.

The Common Vulnerabilities and Exposures Program, or CVE, gives publicly known security flaws standardized identifiers so that governments, software companies and researchers can easily communicate about the same issue. It was first created in 1999, and it underpins cybersecurity discussions across both private industry and the national intelligence community.

Policymaking interest in the program followed a funding scare last year that exposed the fragility of the arrangement supporting its functions. MITRE, the scientific research giant that helps operate CVE under a federal contract, warned last April that its funding from the government would imminently expire.

CISA then extended the contract within hours, a sweeping relief for the cybersecurity community that raised fresh questions about why a major global cybersecurity resource leaned so much on a sole U.S. contract. A CISA official previously said that a “broad internal contracting review caused a brief renewal delay in April 2025, but operations continued without disruption and MITRE was ultimately retained as the program operator.”

A legislative proposal reported by Nextgov/FCW in June would formally authorize CVE within the Department of Homeland Security and establish a clearer legal role for CISA, its longtime federal sponsor.

“Defining the importance of the program in legislation in general seems like a very helpful thing,” Lindsey Cerkovnik, branch chief for vulnerability response and coordination at CISA, said Thursday during a panel at the Black Hat cybersecurity conference.

But Cerkovnik, whose office helps oversee CVE, said legislation could become counterproductive if it dictates too precisely how the program must operate.

“When you overdefine how to execute the thing, it can make it very restrictive and difficult,” she said. “In some ways, we are wary of overly-restrictive guidance” that could make CVE less nimble, agile and flexible, she added.

The congressional proposal would also require CISA and the National Institute of Standards and Technology to develop a modernization plan and establish a 15-member board to set CVE policies and priorities. Permanent seats would go to CISA, NIST and top-level CVE authorities, while rotating members would represent industry, academia, researchers and foreign governments.

Reps. Delia Ramirez, D-Ill., and George Whitesides, D-Calif., submitted the proposal as an amendment to the fiscal 2027 defense authorization bill. But the House Rules Committee didn’t select it for floor consideration, preventing it from getting a vote in the full House last month.

Cerkovnik said CISA had reviewed the proposal and saw both benefits and challenges. Formal recognition could help preserve support for the program, although CISA and DHS have maintained its operations without a lapse for more than 26 years, she said.

CISA is CVE’s sole federal sponsor, while MITRE helps execute the program alongside a global network of more than 530 CVE Numbering Authorities, known as CNAs. Those organizations — which include software vendors, research groups and national cybersecurity agencies — can assign identifiers and publish information about vulnerabilities within their areas of responsibility.

The number and variety of those participants has allowed CVE to keep pace with a growing volume of software flaws. AI, however, is widely expected to accelerate vulnerability discovery further and may require the program to make changes that its current structure did not anticipate.

Cerkovnik pointed to a recently announced AI researcher CNA pilot program that would allow selected AI companies to assign CVE identifiers for vulnerabilities uncovered through research using their own models.

That program may need to bring people with AI expertise into its leadership, she said, and rules narrowly prescribing who can serve on CVE boards or how new participants are admitted could complicate that kind of response. Cerkovnik didn’t say the current congressional proposal would block the pilot, instead using it to illustrate why the program needs room to adjust as technology changes.

CVE is also becoming less centered on the United States. The European Union Agency for Cybersecurity, known as ENISA, became a CVE Numbering Authority in 2024 and a CVE Root in November 2025. Roots oversee groups of numbering authorities, helping organizations join the program and maintaining the quality of the vulnerability records they produce.

ENISA has since begun bringing European organizations under its Root, building on the agency’s stated goal of helping strengthen and modernize CVE.

Nuno Rodrigues Carvalho, ENISA’s head of sector for incident and vulnerability services, said on the panel Thursday that the agency now wants to “step up in the coming months” to also be a top-level Root, bringing it to the same level as CISA and MITRE.

He described a more federated model in which organizations in Europe, Japan and potentially other regions oversee nearby numbering authorities and provide further support to the project.

Europe already accounts for roughly one-fifth of the organizations authorized to assign CVE identifiers, Carvalho said. ENISA also operates the European Vulnerability Database, although he emphasized that it relies on CVE identifiers rather than competing with the existing system.

Cerkovnik backed growing foreign participation, arguing the past year had reinforced the need to describe CVE as “a global program and not just a U.S.-centric program.”

AI poses another challenge by potentially increasing the number of vulnerabilities companies and governments must process. Cerkovnik said she expects CVE to scale alongside that growth but is more concerned about whether organizations can determine which flaws demand immediate attention.

“Not all vulnerabilities matter. Not all vulnerabilities matter at the same level,” she said. CISA made a similar argument in a binding directive issued in June that tells federal agencies to base patching deadlines on a variety of factors.

Some lower-risk flaws could be left until a system receives a major upgrade, while the most dangerous vulnerabilities may require action within days. That kind of triage will become more important as AI produces more findings, Cerkovnik said, because neither CVE nor the organizations relying on it can treat every newly discovered flaw as equally urgent.

]]>

The government's AI guardrails are taking shape behind closed doors

Patrick Tucker — Fri, 07 Aug 2026 15:17:18 -0400

No one is saying, officially, what was decided when top frontier AI labs—Google, OpenAI, Anthropic, and Meta—met with White House officials on Tuesday to discuss voluntary guidelines for testing new models.

But Democratic lawmakers described the Trump administration's approach to regulation as “ad-hoc and unpredictable,” and said it’s likely to boost global adoption of rival Chinese models at the worst possible time.

Two officials with one of the labs said that Google, Anthropic, and OpenAI submitted a joint draft of the regulation around nine days ago and then began to work with each other and with the White House to find points of agreement. According to the officials, the labs all agreed they should be able to continue A/B testing as part of the process for developing models, and the White House concurred.

Companies that agree to the framework will submit their models to U.S. inspectors to be evaluated for safety for 30 days before those companies can receive federal funding—including from the Defense Department, whose 2027 budget request seeks more than $54 billion for AI companies, according to the officials.

A June White House executive order adds that models from participating companies would get extra intellectual property protection from Chinese competitors or others who might seek to steal secrets.

The White House is not commenting on how it will conduct the inspections. One of the officials said the the Office of Science and Technology Policy is still trying to set testing standards and how bodies like the National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency will conduct or design tests.

The murkiness around the policy’s details has angered some top lawmakers. In a Tuesday letter, Senate Democrats ask the White House to “provide an unclassified response, with a classified annex if necessary, clarifying the Administration’s current policy and approach to limiting access to advanced AI models.”

The lawmakers also evinced concern about the models' new abilities to defy easy inspection, scrutiny, and limitation.

“During an internal evaluation [in July] OpenAI models escaped their testing environment and used high-level technical capabilities to compromise a third party’s network without any instructions to take those actions,” the letter reads. “The Federal Government cannot be passive as these capabilities emerge.”

AI’s Jurassic Park moment

Last week, Chinese company Moonshot AI released a new open-weight model, Kimi 3, that performs as well as some top U.S. models and is being offered to consumers around the world at a far lower price.

Lawmakers and others are increasingly worried the United States could fall behind China in a race to develop faster, more efficient, more profitable models and to shape the way global populations use, buy, sell, and even build AI. Open weight models have become a key point of contention.

Anthropic wants more scrutiny of open-weight models and more efforts to curb sales of high-performance chips to China to thwart distillation attacks. But others in the industry are taking a more supportive view of open weights.

A former senior White House official and a former senior defense official with direct knowledge of the discussion said Anthropic pushed for more language in the framework to address open-weight security, but came away disappointed.

Anthropic did not comment for this story.

In recent months, several of the newest AI models have broken out of their virtual testing containers.

Anthropic disclosed the first such incident in April, when an early version of their Mythos model was able to “autonomously write some remarkably sophisticated exploits,” including one that allowed it to escape an isolated testing environment that programmers use to test code for effectiveness and safety before it’s released.

Anthropic pulled the model from general release, but made it available under "Project Glasswing" so the government and a handful of large companies could find and fix vulnerabilities in their software.

The White House responded with an export-control ban on June 12, barring access to the model not just to foreign countries but even foreigners in the United States. That meant that Anthropic’s own researchers, many of whom were born outside of the United States, could not work on the model. The White House reversed the ban on June 30.

In July, tensions around a national AI safety strategy, or lack thereof, grew hotter. Both Anthropic and OpenAI revealed new incidents in which models breached their containment. It came as no surprise to many veteran cybersecurity experts. AI researcher and author Gary Marcus, in 2022, predicted such a possibility on his blog, describing it as an “AI’s Jurassic Park Moment.”

Last week, AWS Chief Security Officer Stephen Schmidt told reporters: “Containers are not security boundaries. I actually have a T-shirt that says that, which I started wearing about three years ago.”

AWS hosts multiple models for users through its Bedrock platform. Schmidt said the AI Mythos era requires a far more vigilant approach to cybersecurity, especially for researchers.

“One of the reasons that we built the virtualization infrastructure for AWS using our own Nitro Hypervisors so many years ago was we realized that containers were not an appropriate security boundary then. The same is true for AI. You cannot use an AI container as a security boundary.”

In March, a group of British researchers calculated the sandbox breakout period for various large language models, which proved very accurate months later.

A follow-on paper published this week by the same group describes how to build better containment environments for the models emerging today.

]]>

House probe finds gaps in U.S. effort to remove Chinese telecom risks

David DiMolfetta — Tue, 04 Aug 2026 16:44:05 -0400

Years after federal regulators invoked national security grounds to push three Chinese state-owned telecommunications providers out of the American market, the companies never fully left, a new House probe has found.

China Telecom, China Mobile and China Unicom retained equipment, data-center space and connections to other networks in the United States after the Federal Communications Commission denied or revoked their authority to provide certain telecommunications services, according to a nearly 50-page bipartisan House China Committee investigation planned for release Tuesday and first seen by Nextgov/FCW.

From 2019 to 2022, the FCC denied China Mobile USA’s application to provide international service and revoked authorizations held by China Telecom Americas and China Unicom Americas. But those actions did not require the companies to remove equipment, leave data centers or sever private network links, and the carriers continued offering enterprise networking, internet transit and other services, the panel found.

The committee argues that those remaining footholds could give Beijing’s cyberspies visibility into sensitive traffic, help keep malicious infrastructure online and create opportunities to reroute data or reach U.S. targets. American officials regard China as the country’s leading cyber adversary, with a record of targeting critical infrastructure and stealing military, commercial and personal data.

The three carriers did not respond to detailed requests for comment. Nextgov/FCW also sought comment from the FBI, the Cybersecurity and Infrastructure Security Agency and several U.S. spy agencies. The Defense Intelligence Agency, which produces intelligence findings for the Pentagon, declined to comment.

A spokesperson for China’s embassy in Washington said Beijing “firmly opposes the U.S. overstretching the concept of national security and going after Chinese companies,” adding that China would defend its “legitimate and lawful rights and interests.”

The remaining network ties took on added significance in the committee’s review of Salt Typhoon, the sweeping Chinese espionage campaign uncovered in 2024 where hackers breached major telecom carriers in the United States and abroad. The intrusion reached systems used to comply with court-authorized wiretap requests and allowed the cyberspies to target the communications of senior U.S. officials, including President Donald Trump and Vice President JD Vance.

Reviewing routing data from Sept. 22 to 25, 2024, just as the Salt Typhoon campaign became public, the committee identified 58 groups of internet addresses that CISA had linked to Salt Typhoon servers. China Mobile International’s network appeared in routes to those servers at least 192 times, helping keep the attacker infrastructure reachable as U.S. defenders sought to shut it down, the report said.

The committee does not allege that China Mobile USA employees knew about or participated in the campaign, and it says the routing evidence does not definitively link the company to Salt Typhoon. But the panel argues that the overlap shows how China Mobile’s remaining network ties could help sustain malicious infrastructure.

That finding came from a broader analysis that identified nearly 109,000 incidents from January 2018 through May 2025 in which Chinese or Hong Kong-linked networks allegedly claimed U.S. internet addresses without authorization, potentially diverting American traffic through their systems. The committee classified them as high-confidence hijacks of the Border Gateway Protocol, a bedrock system that directs traffic across networks, but acknowledged that some may have resulted from mistakes or poor network management.

More than 4,200 of the incidents involved China Mobile-controlled networks. In September 2024, eight originated from the same network that appeared in routes to Salt Typhoon servers and diverted traffic belonging to unnamed U.S. network operators, the committee said.

Addressing the threat

Telecommunications networks have long been prized intelligence targets because they can expose private conversations and reveal what political and diplomatic leaders are thinking. Such concerns are compounded by China’s 2017 National Intelligence Law, which requires companies and citizens to assist state intelligence work. Beijing denies that the law compels companies to participate in illegal espionage.

“China’s state telecommunications carriers for too long have enjoyed non-reciprocal access to U.S. domestic networks, but the seriousness of Salt Typhoon gives the FCC and other agencies more than enough justification to restrict or expel them,” said James Mulvenon, a leading authority on Chinese national security issues and vice president of intelligence at risk advisory firm Pamir Consulting.

The committee recommends giving federal agencies greater authority over equipment and private network arrangements that remain after a license revocation, along with targeted removal funding, stronger routing protections and logging requirements for foreign-controlled operators.

Marc Rogers, a veteran telecommunications expert who helped develop the mobile internet in the 2000s and has spent roughly two decades consulting governments and companies on telecom cybersecurity, agreed with many of the panel’s recommendations. Those include treating core telecom systems as high-risk targets requiring closer oversight, strengthening checks on how traffic moves across networks and tightening rules on the foreign-made equipment U.S. carriers can use.

But he disputed the panel’s call to expand “rip-and-replace” efforts targeting legacy telecom equipment, arguing that such programs are economically unrealistic and could significantly disrupt carrier operations.

“On paper it sounds great, until you get someone with operational experience,” Rogers said. “Then they realize you’re basically talking about bulldozing an entire city and building a new one.”

Rogers also said the panel’s recommendations resemble measures in British telecom security law but warned that they would work only if countries act together.

“If only one country takes a strong position, China will just maneuver around them,” he said, adding that the proposals are largely aimed at tactics China has already used. Policymakers should learn from those incidents, Rogers said, while also preparing for how Beijing’s methods may evolve.

The findings underscore the difficulty of removing operators deemed national security risks from a telecommunications ecosystem built on private infrastructure and decades of commercial ties. Regulators can ban specific services without necessarily reaching the equipment, leases and private agreements that preserve connectivity.

The committee based its report on subpoenaed company records, eight interviews conducted under oath, federal records, routing data and network infrastructure scans. It said Cloudflare and unnamed outside cybersecurity experts independently reviewed and verified portions of its routing analysis.

Parent company control and U.S. footprint

Across all three companies, the committee found U.S. subsidiaries that remained dependent on parent or affiliate entities in China or Hong Kong for important technical and operational functions while retaining equipment and network connections inside the United States.

At China Telecom Americas, requests involving connections between U.S. and overseas networks were handled by personnel in Shanghai, Hong Kong or Beijing, according to testimony cited in the report. Service orders could also flow through a parent-controlled system to Shanghai Telecom without a separate contract. The U.S. subsidiary did not keep independent traffic-flow records, leaving employees unable to determine whether a parent or affiliate had changed routes involving equipment in the United States.

China Telecom Americas identified 10 active points of presence — sites where a carrier keeps equipment and connects with other networks — across seven metropolitan areas. A senior engineering official also told the committee that about a quarter of the company’s U.S. transmission hardware was still made by Huawei, whose equipment the FCC has deemed a national security risk.

China Mobile USA, meanwhile, was described by one witness as “basically a sales team,” while another said it had no network engineers. Orders for data center space and network connections were approved at its Hong Kong headquarters, and witnesses could not identify a network operations team based elsewhere.

Despite this, China Mobile USA’s records contained 39 point-of-presence entries across 27 data-center and interconnection facilities. The committee said those sites connected it to carrier backbones, internet exchanges and private networks used by major U.S. technology companies. Investigators identified at least 143 active China Mobile network assets in U.S. facilities.

China Unicom Americas disclosed that seven of its eight directors and two of its three senior managers were Chinese Communist Party members. Its U.S. employees used parent-controlled email and computer systems, and evidence indicated that they operated under cybersecurity, administrative and privacy policies issued by China Unicom Global.

A compliance official told the report’s authors the subsidiary could guarantee its own adherence to U.S. law, but not its parent’s.

A China Unicom Americas compliance official also acknowledged that the subsidiary did not know the identities of some third parties in China that ultimately received services ordered through China Unicom Global. The company had equipment and active connections in roughly 10 U.S. data centers.

Other carrier relations

The report also describes relationships between the three Chinese carriers and companies linked by U.S. authorities to Chinese hacking operations.

China Mobile, in one case, acted as a middleman for CloudRadium, a Hong Kong hosting provider whose infrastructure has repeatedly surfaced in malicious cyber activity, the committee said. Subpoenaed records showed that China Mobile purchased U.S. data center space and network connections on CloudRadium’s behalf, including through a four-year contract valued at $480,000.

The report also links CloudRadium to a Wyoming company of the same name and GlobalData Investments, a California corporation that markets hosting and data center services under the CeraNetworks name. Nextgov/FCW found that the companies’ websites used similar logos, layouts and animations. An email sent to an address listed for Steven Beals, identified online as GlobalData Investments’ chief operating officer, was returned as undeliverable.

The committee also details China Unicom’s relationships with Integrity Technology Group and i-SOON, two Chinese cybersecurity contractors U.S. authorities have linked to state-backed hacking.

A 2024 U.S. advisory identified Integrity Tech infrastructure as the control layer for a botnet of compromised routers and other internet-connected devices operated by Flax Typhoon, a Chinese state-sponsored hacking group. China Unicom Beijing network addresses were used to manage the botnet and connect it to other attack infrastructure and, according to the committee’s report, China Unicom and Integrity Tech formalized a cooperation agreement in November 2023 while the botnet was operating.

China Unicom separately appeared as a corporate partner of i-SOON. The company drew international scrutiny after a large collection of purported internal documents appeared on GitHub in 2024, exposing details about its hacking tools, targets and work for Chinese police and intelligence agencies.

The Justice Department later charged eight i-SOON employees and two Chinese police officers in a years-long hacking campaign, alleging that the company worked with at least 43 intelligence or police bureaus. The charges have not been proven in court.

Integrity Tech’s website was unavailable when Nextgov/FCW attempted to contact the company, and a functioning corporate website for i-SOON could not be located.

“China has been conducting an escalating campaign of cyberattacks on U.S. networks as a form [of] operational preparation of the battlefield,” said Jack Burnham, a senior research analyst in the China Program at the Foundation for Defense of Democracies whose work focuses on China’s military, emerging technologies and science and technology policy.

“Key to these efforts is Beijing’s capacity to access core domestic networks, either via installed equipment, routing relationships, or other interconnections,” Burnham said. “While the FCC has sought to tamp down on Chinese state-owned telecoms firms that pose a national security threat, there is clearly more work to be done, both in terms of regulation and rip-and-replace, to properly handle these threats.”

]]>

GSA’s digital roadmap looks to enhance agencies’ services, CIO says

Edward Graham — Mon, 03 Aug 2026 17:29:57 -0400

The General Services Administration’s push to transform how the U.S. government procures new technologies will radically improve the way public servants deliver services at scale, according to the agency’s IT chief.

The Trump administration has moved to enhance federal adoption of new IT services, including artificial intelligence tools and other products that can automate many of the time-consuming tasks that slow agencies’ citizen-focused operations. GSA has been at the forefront of many of these modernization efforts by helping agencies onboard and experiment with capabilities from leading tech firms in a cost-efficient manner.

In a recent interview with Nextgov/FCW, GSA Chief Information Officer David Shive said the agency’s push to get new capabilities into the hands of federal workers has “disrupted the longstanding practice of how technology is driven into this government."

The typical process for government procurement, he said, was that “academia would create something, and then standards bodies would assess the thing, and then the White House would send out guidance on how to implement the thing and then agencies would then implement the thing.”

Shive added that this approach could take as long as two to three years, which resulted in “all this lost business value in that timeline.”

“Instead, what we're doing now is we're taking a disruptive technology, we're putting thoughtful, logical controls around that thing, and — just like the private sector — building [minimum viable products], building pilots, assessing value and then sharing that with our standards-setting bodies so that their standards are informed not by academic theory, but instead informed by actual use cases in government,” he said.

By shifting the typical procurement approach to speed up tech adoption, Shive said the White House’s governmentwide guidance on large-scale IT implementation efforts is now “based on those actuals rather than theory,” which he added, “has allowed us to drive technology into this government and generate the business value of that enabling technology at a much higher velocity than ever before.”

A new approach to federal tech modernization

Shive framed this as GSA’s digital roadmap for enhancing government services. It’s an approach, he said, that is not just about working to modernize federal systems in a safe and secure manner, but reshaping the entire model for onboarding new technologies downstream so “we buy technology based on these knowings, rather than based on theory.”

One notable example of GSA’s streamlined IT-focused procurement work is the OneGov initiative, which launched in April 2025 with the goal of assisting agencies in their technology modernization efforts by treating the government as one centralized customer. So far, the strategy has led to agreements with more than two dozen tech companies, with many of these deals including temporary discounts of as much as 70% to 90% on relevant products and services, including AI tools.

Shive called the OneGov deals “a perfect example of being able to buy, on a relatively short timescale, AI that allows [agencies] to do exploration and even full-scale implementation, but in a safe contractual model that doesn't lock them into a technology that might not end up being best of class.”

GSA officials previously said that OneGov has led to over $1 billion in cost savings since its launch last year, with the departments of Health and Human Services, Veterans Affairs, Transportation and State among the agencies that have taken advantage of the initiative’s discounted offerings. GSA is also looking at how the current agreements can ultimately lead to longer-term deals and even broader savings beyond the software and tech products that are currently offered.

The agency similarly launched USAi last August as a way for federal employees to experiment with AI capabilities in a trusted sandbox environment. Shive said GSA is able to see how agency personnel are using the platform and its offered AI tools — insights, he added, which “will inform our next round of negotiations” through OneGov.

At the Government Service Delivery conference in June, Shive said during a panel discussion that he believed more AI adoption will allow federal workers to drastically improve customer service delivery.

“Right now, I say we’re 50% of the way there,” he said at the time. “And by this time next year, I suspect we'll be 90% of the way there.”

Shive told Nextgov/FCW that accomplishing this lofty goal also extends beyond tech adoption to organizational change management, which he noted has often been “the biggest challenge historically.”

GSA released a step-by-step guide in June — the Elimination, Optimization and Automation playbook — to help agencies better adopt emerging capabilities in a way that can maximize their operational benefits.

While Shive said the playbook’s main goal is “helping agencies kind of think the same way” when it comes to modernizing their IT services, he added that “the secondary value that we're trying to generate there is that organizational change management part, to demonstrate to our agency partners, ‘look, this doesn't have to be a big, bad, scary thing; it does work.’”

One of the efforts that helped inform the playbook is GSA’s “Million Hour Challenge,” which seeks to eliminate one million hours of employee work during the 2027 calendar year by relying on technology.

Shive noted that this initiative doesn’t solely focus on adopting AI, “but [using] all the tech in the toolbox, including eliminating tools and systems and processes that should no longer be around, optimizing existing processes or automating and augmenting stuff with AI and other things.”

]]>

OPM tells agencies to put tech recruiting at the center of staffing plans

Sean Michael Newhouse — Mon, 03 Aug 2026 16:00:34 -0400

Agencies should prioritize recruiting tech talent in their hiring plans for next fiscal year, the Office of Personnel Management said in guidance released on July 30.

“Planning for technology and planning for talent are no longer separate conversations,” wrote OPM Director Scott Kupor in an associated blog post.

Specifically, agencies should reserve positions for individuals who specialize in areas like artificial intelligence, data science and cybersecurity. The government’s HR agency encouraged officials to fill these roles by utilizing Tech Force and Scholarship for Service.

The Trump administration created Tech Force last year to bring on early-career software and data engineers for two-year tours. While officials set out to recruit 1,000 individuals potentially as soon as the end of March, OPM said in response to a question for this article that it has hired about 300 participants so far.

Scholarship for Service was established in 2000 and covers college tuition for recipients who agree to work in a government cybersecurity role upon graduation. The program was recently updated to emphasize AI competency.

Many scholarship participants told NextGov/FCW last year that agencies rescinded their job offers, as the Trump administration sought to downsize the federal workforce. In all, more than 19,500 technology employees left or were pushed out of the federal government in 2025.

OPM’s guidance also directs agencies to address in their staffing plans how they plan to leverage AI technology, including through reskilling and upskilling current employees.

“This process involves identifying mission-critical positions that deliver the greatest value while understanding how technology can enhance service delivery,” Kupor wrote in the blog. “And it requires an honest look at opportunities to simplify organizations, improve internal processes and maximize the use of taxpayer resources.”

Additionally, the guidance sets a governmentwide target that at least 33% of external hires be in the early stages of their careers and pushes agencies to use the Early Career Talent Network, which OPM created to bolster recruitment of younger workers.

While Kupor frequently touts OPM’s efforts to bring more early-career staffers into government, which has been a longstanding issue for agencies, the Partnership for Public Service, a good government nonprofit, reported that the share of civil servants who are younger than the age of 30 decreased last year. Partnership officials attributed this to the Trump administration’s federal hiring freeze and mass firings of probationary employees, which impacted many individuals who had been in their jobs for less than a year.

The specific annual agency staffing plans that the guidance refers to were mandated by an October 2025 executive order that set new requirements for filling vacancies and new hiring. Kupor also wrote that these plans would provide a “centralized view of workforce needs across agencies” in order to determine which skills the government workforce is lacking and where duplication is occurring.

]]>

U.S. Digital Corps graduates largest class of fellows yet

Christian Robles — Fri, 31 Jul 2026 13:07:24 -0400

The General Services Administration on Wednesday celebrated the graduation of 71 U.S. Digital Corps fellows, marking the largest graduating class since the program’s inception. Those graduates updated the FedRAMP website, helped streamline Agriculture Department environmental reviews and supported other technology projects during their stints in the federal government.

“This government has starved for talent, for people who understand how to do all the things that we want to do to deliver better,” OPM Director Scott Kupor said during graduation remarks.

Some of the graduates of the two-year fellowship program are continuing civil service while others are headed to the private sector.

“For talented technologists like you, there's going to be a lot of paths … but if you want my take, public service is pretty damn great,” GSA Administrator Edward Forst also said during the graduation event.

Following remarks from Forst and Kupor, several U.S. Digital Corps graduates presented slideshows explaining work they did for federal agencies.

One team of three fellows spent their time in the program updating FedRAMP.gov with exact keyword search, the ability to search by clarification and other new features after running feedback sessions with users. The team estimated that the redesign boosted engaged sessions per user by 180%, average engagement time by 10% and views per active user by 28%, according to their PowerPoint presentation.

“Outside of these numbers, though, they represent agency IT teams spending more time finding the right solution for cloud service providers as decisions for documentation they need. This creates better informed decisions across the federal government,” said one of the graduates. The fellows working on FedRAMP.gov also consolidated two older marketplace websites into one.

Other fellows shared how they led a Health Resources and Services Administration project to create an organ transplant-related dashboard and modernized a National Institutes of Health website often used by academics by moving it to the cloud and updating its search engine.

The U.S. Digital Corps launched in August 2021 and had its first cohort of fellows in June 2022, placing early career technologists across numerous federal agencies. But the two-year fellowship is just one of several initiatives the federal government has recently launched to attract young talent.

The Trump administration in December started the U.S. Tech Force, which aims to hire 1,000 early career technologists to work for two-year stints in federal service with the controversial help of private sector companies. The program has a Defense Department-specific recruiting initiative known as the War Force.

The administration’s hiring push comes after nearly 20,000 technology employees left their roles in 2025, according to OPM data.

]]>

GSA official put on leave for social media post saying veterans’ preference in federal hiring is hampering tech recruiting

Sean Michael Newhouse — Thu, 30 Jul 2026 14:14:41 -0400

Updated at 6:00 p.m. ET July 31

A senior official at the General Services Administration recently posted on his personal social media that veterans’ preference in federal hiring is preventing his team from bringing on qualified tech-focused employees.

“Veterans preference is brutally unfair when taken to the extreme of blocking any consideration of non-veterans, but we're seeing that everywhere these days,” wrote Pete Waterman, the director of FedRAMP, a governmentwide program that sets security and risk standards for cloud products. “Even Tech Force wouldn't let us look at normal folks until we made offers to all the veterans first.”

Veterans’ preference gives former armed forces members priority in hiring for certain agency positions. The Trump administration launched Tech Force last year to recruit software and data engineers for two-year positions. While officials initially said they could bring on 1,000 participants by the end of March, the program’s director announced in May that only 180 to 200 hires had been made so far.

“I would love to have everybody here yesterday, but I’m learning the government hiring process does take time,” said Scott Kupor — the director of the Office of Personnel Management, which is overseeing Tech Force — in May.

Screengrab / GovExec

While Waterman’s LinkedIn post received 127 likes and several individuals voiced support, others criticized what he said.

A CEO commented that “As a veteran I can personally tell you there are many qualified veterans that could fill this role.” Likewise, a recruiter for the Treasury Department wrote, “Rather than directing frustration toward veterans or the laws that protect them, the more effective solution is to focus on strengthening HR training.”

Waterman warned that the hiring issues could hurt his program’s effectiveness.

“The future for FedRAMP is pretty dark if we can't hire experts from private sector who have actually worked on cloud services,” he wrote in the post.

GSA Administrator Edward Forst said in a statement to Government Executive that Waterman “has been placed on administrative leave, effective immediately, until further notice.”

“We categorically and completely disagree with a senior employee’s recent remarks denigrating veterans preferences in hiring. GSA has zero tolerance for comments that disparage or disrespect America’s veterans,” he said. "GSA celebrates our veterans and military spouses. They are a critical backbone of our agency: amazing public servants and true heroes whose service continues to strengthen our nation."

Veterans represent approximately 30% of GSA’s workforce and bring invaluable leadership, discipline and experience to our mission every day," Forst added. "Many of our team continue to serve as members of our military reserves. We applaud this dual commitment. We are better for it. This is the ethos of GSA and the federal government.”

Jenny Mattingley, a vice president at the Partnership for Public Service nonprofit who previously worked on federal hiring reform at the Office of Management and Budget, said that the rules around veterans’ preference have largely gone unchanged since they were created after World War II.

“I think what's happened with veterans' preference, along with many other hiring rules, is that they were created in a different time where things moved at a different pace in terms of hiring and where there were only one or two ways into the competitive service,” she said. “So part of the problem is a lot of those rules have really become procedural hurdles rather than achieving the intended outcome.”

But Mattingley emphasized that agencies have flexibility when it comes to implementing veterans’ preference. When she was in government, for example, she helped lead a program that applied veterans’ preference after, instead of before, applicants’ skills were assessed.

“So you're looking at both qualified veterans and qualified non-veterans. Veterans get first preference when agencies are selecting, but they're all technically qualified for the job,” she said. “That was a big change in how veterans' preference was applied. There’s a lot of cultural norms around applying veterans’ preference up front.”

Mattingley also cautioned that the loss of many HR employees as a result of Trump’s staff cuts to the civil service is likely further slowing federal hiring.

“Unless we actually also focus on HR and building out robust HR functions, it kind of doesn't matter if the laws are changed because a lot of this is whether HR has the ability to understand, work with agencies and be strategic about how they apply these laws,” she said.

This story has been updated with a statement from GSA.

]]>

AI's growing role in rulemaking raises new transparency questions

Sean Michael Newhouse — Mon, 27 Jul 2026 17:31:10 -0400

While lawmakers are debating what an appropriate regulatory framework for artificial intelligence should be, experts who spoke at a panel on Monday noted that federal employees have been using the technology for years to develop all sorts of regulations.

Cary Coglianese, a regulation professor at the University of Pennsylvania, said that agencies, for example, have been using AI to analyze thousands of public comments that some proposed rules receive.

“Back in the day, contractors would literally photocopy comments, clip them out and sort them in different categories — and do what essentially natural language processing tools can do now so quickly and rather effectively,” he said.

But as the technology advances, speakers on the panel — which was sponsored by the Coalition for Sensible Safeguards, a left-leaning group of more than 220 regulatory-focused organizations — argued that AI could take over more steps in the rulemaking process, potentially supercharging the Trump administration’s efforts to slash regulations and downsize the federal government.

“I worry a great deal that when you have a government and policymakers basically out to destroy huge portions of the public sector, wholesale implementation of AI will provide them a social veneer just to do that rather than using technology in more positive ways to improve the quality and breadth of public services,” said Ben Zipperer, a senior economist at the Economic Policy Institute.

There are higher stakes for federal agencies compared with private companies when it comes to AI implementation, Zipperer contended, because improper usage could lead to individuals losing their benefits or shaky legal justifications for government actions. Unlike in the private sector, however, the economist emphasized that there isn’t a market factor in government to push back on poor AI implementation.

“A private sector company could replace all their workers with AI, but then their product quality would probably suffer, and they'll lose sales. But there's no profitability check on the public sector,” he said. “So if the public sector uses AI as a way or an excuse to make public servants' jobs worse or to cut public services, there's not a non-political check on that, and public services just suffer.”

There already are high-profile examples of the Trump administration using AI in its cost-cutting initiatives. Department of Government Efficiency staffers in 2025 prompted ChatGPT to assess National Endowment for the Humanities grants and respond in fewer than 120 characters whether they fall under diversity, equity and inclusion programs that officials were targeting for elimination.

Based on that incident, which came to light due to a lawsuit over the canceled grants, Jonathan Walter, a senior policy counsel at the Leadership Conference on Civil and Human Rights, warned that officials could use AI to shut out public feedback they object to on proposed rules.

“It would have been just as easy for them to say, ‘Hey, we're just going to delete or ignore any comment with any mention of race or disparate impact or gender or whatever protected class might have a stake in a rulemaking,’” he said. “Then, there are all of the different downstream consequences that stem from that. It could be that the final rule happens to ignore certain anti-discrimination laws. It might not reflect the amount of participation from a certain group.”

J.B. Branch, a technology expert at Public Citizen, added that he’s worried about which AI systems feds may use — specifically calling out Grok, which has been criticized for generating racist comments as well as responses that are aligned with the opinions of its creator, former DOGE head Elon Musk.

“If someone in the federal government is using Grok, there is a deep concern that whatever output it's providing could be a potentially very biased output,” he said.

Last year, the president signed an executive order that directed agencies to procure “ideologically neutral” and “truth-seeking” AI that is not “woke.”

The Trump administration is pursuing many deregulatory actions, with officials writing in their 2026 regulatory plan that they will “achieve extraordinary cost savings for Americans” and “promote liberty, unleash American energy dominance, preserve products consumers love and eradicate the ideology of [DEI].”

But Lauren McFerran, the executive director of the AFL-CIO Tech Institute, cautioned that an overreliance on AI during the deregulatory process could result in increased judicial scrutiny rather than more rules being cut.

“A court is going to be looking at whether [the agency has] made a rational and supportable connection between the evidence and their reasoning and the ultimate decision. When you get to the more advanced [AI] systems, they're learning from their own processes,” she said. “That creates — the term that tends to be used is a black box. You don't really necessarily know what steps the product undertook to get to certain outcomes, and I think that could be potentially problematic for a court that's trying to review whether the agency, in fact, engaged in the reasonable decision-making process that it was supposed to.”

]]>

Selective Service System seeks software to aid the draft

Ross Wilkers — Fri, 24 Jul 2026 05:00:00 -0400

The window is now open for vendors to start working on and submitting prices for software that can simulate the military’s personnel needs in the event of national emergencies requiring a draft.

While the U.S. military is all-volunteer, the Selective Service System still maintains registration lists of males aged 18-to-25 years old and a second special-skills database based on professional licensing lists of workers in certain health care occupations. The Selective Service System is an independent agency charged with running a draft or drafts in the event they are needed to fill personnel gaps.

By launching this request for quotes on Wednesday, SSS is looking to prepare for emergencies that require it to quickly evaluate staffing and resource requirements through the use of readiness simulation software.

SSS also is tasked with comparing different mobilization and policy scenarios, assessing the operational impacts of surge conditions, identifying potential risks and bottlenecks, and support executive planning and reporting obligations.

The RFQ lists these requirements for the software:

Model the full end-to-end mobilization pipeline
Support configurable scenarios
Provide decision-support analytics for leaders, planners and operators
Operates within an SSS-designated cloud environment
Use anonymized aggregate data
Support complete government ownership and sustainment

SSS is embarking on this search for software ahead of Dec. 18, when the requirement for male U.S. residents aged 18-to-25 years old to register themselves in the system will be replaced with a requirement for SSS to automatically register them by relying on other federal databases.

SSS is an independent agency.

Quotes are due by 2 p.m. Eastern time on Aug. 14. The window for questions to SS closes at 2 p.m. Eastern time on Tuesday, July 28.

]]>

Russian hackers can steal government emails without victims clicking a link, cyber agencies warn

David DiMolfetta — Thu, 23 Jul 2026 14:30:00 -0400

Russian state-backed hackers have exploited a vulnerability in widely used email software to steal messages, passwords and authentication data from Western government agencies and other organizations, U.S. and allied cyber-intelligence authorities said Thursday.

The campaign is notable because it does not require victims to click a malicious link or download an attachment. The exploit can instead activate when someone simply opens or previews an email in an unpatched version of the Zimbra Collaboration Suite — a popular alternative to major collaborative messaging platforms like Microsoft Exchange or Google Workspace — according to a joint advisory issued by the Cybersecurity and Infrastructure Security Agency, National Security Agency and FBI.

The Russian hacking group, known primarily as Laundry Bear, has successfully targeted more than 10 organizations since July 2025, the agencies said. The campaign has hit the defense industrial base, federal and local governments, law enforcement, technology companies, educational institutions, media outlets and nongovernmental organizations.

The hackers sought to steal email addresses, passwords and two-factor authentication tokens, which could allow them to retain access to compromised accounts even after obtaining a victim’s password. Their tools also attempted to collect an organization’s email directory, as much as 90 days of a victim’s communications and other sensitive information.

The Treasury Department’s Financial Crimes Enforcement Network purchased a Zimbra standard support subscription in February 2025, according to federal contracting data listed in GovTribe, a federal market intelligence platform owned by Nextgov/FCW parent company GovExec. The purchase does not indicate whether FinCEN used the vulnerable version of the software or was targeted in the campaign.

“Unlike traditional phishing that attempts to persuade a user to take an action, such as clicking a link or downloading a file, Laundry Bear’s current campaign uses a zero-click exploit that only requires a user to view a malicious email,” CISA said in a statement.

Proofpoint, which also investigated the activity, describes the technique as a “half-click” exploit because the victim must still open or preview the email. The company said no additional interaction is required once the message appears in a vulnerable Zimbra webmail client.

The emails were sent from both attacker-controlled Proton Mail accounts and addresses that had already been compromised, according to Proofpoint.

In one example released by the company, the sender claimed to represent a Belgian media-verification organization and proposed cooperation among European institutions combating disinformation. The message contained a legitimate-looking link to a European Union events calendar, but the malicious code was embedded directly in the email itself.

CISA urged organizations to update all Zimbra mail software, monitor their email systems for suspicious activity and review the technical indicators included in the advisory. Organizations that find evidence of a compromise should follow the agencies’ remediation guidance rather than relying solely on installing the available patch.

“CISA continues to see sophisticated and less sophisticated nation-state cyber groups deploy increasingly novel exploits into a highly successful capability to disrupt critical infrastructure or conduct espionage,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity.

The advisory was also backed by defense, cybersecurity and intelligence agencies from Australia, Canada, New Zealand, the United Kingdom and more than a dozen European countries.

]]>

Transportation looks to AI to accelerate its modernization initiatives

Edward Graham — Tue, 21 Jul 2026 07:00:00 -0400

The Department of Transportation is ramping up its use of artificial intelligence, according to a top agency official, with the emerging capabilities playing an increasingly important role in the agency’s ongoing modernization efforts.

Speaking at GovExec’s Government Efficiency Summit on July 16, Transportation Deputy Secretary Steven Bradbury said internal adoption of the technologies has already helped to accelerate needed software upgrades, with growing workforce use of AI poised to further expand its impact on agency operations.

Transportation released its 1DOT IT strategy last September to help guide its digital infrastructure transformation, which includes a focus on modernizing and replacing its outdated systems.

Bradbury said uses of the emerging capabilities have already helped Transportation speed up its software production timelines from 18 months down to 18 weeks, noting that “when we have a need for new software applications, we can bring AI to bear to help.”

Agencywide experimentation with AI tools has also highlighted a broader range of potential benefits from the technologies, Bradbury said.

He cited internal figures that found that “80% of DOT people are now looking at the uses of AI,” and said current adoption of the capabilities highlights how the technologies can provide further benefits to the American people.

“We're using it in making our rulemaking faster, more effective,” Bradbury said. “We get tens of thousands of comments on the complicated rules that we issue. We need to be able to digest those quickly, understand them [and] respond to them. AI can obviously help with that. Similarly, reviewing hundreds and hundreds of grant applications to make the right decisions about which projects to support through our grantmaking — AI is going to be instrumental in helping us do that as well.”

Beyond internal uses of AI, the capabilities are also set to play a key role in the Trump administration’s broader push to upgrade the nation’s outdated air traffic control system. Transportation Secretary Sean Duffy announced the modernization effort in May 2025, saying at the time that the multi-billion dollar effort would include a modernized flight management system and updated ground radar systems at all U.S. airports.

Although Congress approved $12.5 billion for the modernization effort as part of the Big, Beautiful Bill, Bradbury said “we do need more” to finish the effort by the end of President Donald Trump’s second term.

He noted that the Federal Aviation Administration, which is overseeing the initiative, is already in the process of setting up a Strategic Management of Airspace, Routes and Trajectories — or SMART — system “to use all of the information available, [including] weather, what's going on at the ground [and] where airplanes are being prepared for takeoff across the whole system to know in advance what the conflict points are.”

The FAA announced last month that it awarded Air Space Intelligence a 12-year, $875 million contract for new software and artificial intelligence capabilities, including for the SMART system.

Bradbury said that “AI is going to be essential to make this happen.”

]]>

GSA wants other agencies to borrow what's working on tech

Frank Konkel — Sun, 19 Jul 2026 11:59:52 -0400

As the General Services Administration closes in on achieving its 2026 moonshot goal to save and automate 1 million hours of work for its employees, the agency will showcase and share those internal efforts — and a host of other proven tech efforts — with a governmentwide audience on July 30.

Registration for the Emerging Technology Showcase is open to all federal employees, and though the event will be held in person at the Interior Department’s Yates Auditorium, it will be livestreamed for a virtual audience likely in the tens of thousands.

“The administration has looked at GSA to lead” on approaches that make government more efficient, effective and responsive, GSA Deputy Administrator Mike Lynch said Thursday at the Government Efficiency Summit.

GSA hosted an internal tech demo day in late spring, featuring several agency employees — including Lynch and Chief Information Officer Dave Shive — who showcased several ways technology was being used across the agency to save time, improve efficiencies, deliver better outcomes and services or make employees’ jobs easier. Several thousand employees tuned in, and Lynch said its in the agency’s DNA to share what’s working.

“That's really a core to GSA's mission and a convening function that we've heard: a lot of demand and interest throughout government to expand what we were doing internally and offer it up more broadly,” he added.

One certain talking point for the event will be a step-by-step guide GSA released in June to cut, streamline and automate work called the Elimination, Optimization and Automation playbook. The playbook builds on lessons learned from federal pilots, mature automation programs and GSA’s own extensive internal enterprise efforts to improve operations. One such effort, the agency’s push to save and eliminate 1 million hours of employee work within the calendar year, is pacing far ahead of schedule.

“We're at roughly 850,000 [hours identified], which has been amazing, and we've been blown away with kind of the adoption that's taken place, largely driven by technology,” Lynch said Thursday. “We put that in [the] playbook, and we're now showcasing that as part of the forum on the 30th that should be available to all of government to see where to use that within your own workflows.”

]]>

VA’s push to shorten benefits forms needs more public input

Edward Graham — Wed, 15 Jul 2026 15:34:28 -0400

The Department of Veterans Affairs is pushing for more public feedback on its proposals to reduce the amount of paperwork that veterans and their survivors must complete to apply for benefits.

VA published two recommendations last month proposing to shorten the length of the forms needed to apply for disability compensation benefits and for Dependency and Indemnity Compensation, survivor’s pension and accrued benefits. The department highlighted these ongoing efforts on Wednesday and noted it is accepting additional public input on its recommendations.

VA’s proposal to reduce the amount of paperwork needed to complete the disability compensation benefits form was published in the Federal Register on June 23, with the department saying its Veterans Benefits Administration component is looking to reduce the complexity of the paperwork by the end of calendar year 2026. The outlined recommendation would shorten the form from 15 pages to five pages and decrease the average amount of time needed to fill out the paperwork from 25 minutes to 15 minutes.

“The primary objectives are to enhance the experience for Veterans, lessen the administrative burden and time required to submit a claim for benefits, and accommodate preferences for submitting forms either through VA.gov or via paper, while preserving accessibility,” according to the notice.

The proposal to shorten the DIC application was similarly published in the Federal Register on June 25 and also notes VBA’s desire to reduce the complexity of the form’s paperwork by the end of this year. The notice said the department is looking to shorten the application from 20 pages to seven pages and reduce the average response time from 40 minutes to 25 minutes.

VA said in both proposals that it is looking for comments on how to revise its information gathering process, such as “ways to minimize the burden of the collection of information on respondents, including through the use of automated collection techniques or the use of other forms of information technology.”

Public input on the recommendations, however, has been relatively muted thus far. As of this article’s publication, the two proposals had a combined nine comments — two for the disability compensation benefits recommendation and seven for the proposed DIC application changes. Feedback on both proposals will be accepted through Aug. 24.

VA has already been working over the past several years to shorten or digitize many of the forms that veterans and their beneficiaries must complete to apply for and receive services. These efforts have included a push to create standardized claim and appeal forms, as well as an effort to pre-fill some forms with information from verified VA.gov profiles.

“No Veteran or surviving family member should face unnecessary bureaucratic hurdles when seeking the benefits they’ve earned,” VA Secretary Doug Collins said in a statement. “These proposals reflect our commitment to putting Veterans and their families first — reducing paperwork, saving time, and making the application process as straightforward as possible.”

]]>

Space Development Agency resumes launches with its future in doubt

Thomas Novelly — Wed, 15 Jul 2026 13:20:06 -0400

After a nine-month pause, the Space Development Agency is finally scheduled to launch its next batch of satellites for its sprawling military-communication constellation—even as draft legislation weighs dissolving the agency.

SDA is scheduled to launch its next 21 Tranche 1 satellites on Thursday aboard a SpaceX Falcon 9 rocket from Vandenberg Space Force Base. Their payloads will be part of the data-transport layer of the agency’s Proliferated Warfighter Space Architecture, a network of hundreds of low-earth-orbit satellites to be used for space-based military communications and threat detection. After the first two batches of those satellites were sent into orbit this past fall, SDA paused further launches as officials worked through technical problems.

“We did see software and hardware issues on the ones on orbit right now,” Gurpartap Sandhoo, the Space Development Agency’s director, told reporters on Wednesday. “That's why we kind of delayed and took a pause to make sure we fix at least the known issues. We expect this launch to be a lot smoother than the last one.”

After Thursday’s launch, Sandhoo said, the agency will have roughly half of the transport layer’s satellites on orbit. Satellites for the next layer, known as Tranche 2, are anticipated to start going up in fiscal year 2027.

Despite the delays, Sandhoo said SDA is “in a better place in terms of schedule.”

Yet his agency might not survive long as an independent entity. A draft version of the National Defense Authorization Act aims to fold the agency and authorities into the Space Force’s portfolio acquisition executive.

Sandhoo said SDA employees may have “some concerns” with the draft language. But workers are “here for the mission” and to get the architecture done, he said.

Government watchdogs have repeatedly questioned the technology behind the satellite constellation.

Last year, the Government Accountability Office raised concerns about its laser-communications technology, saying that it “hasn't fully demonstrated that it works in space.” The agency pushed back on the report and said it had achieved “baseline objectives” with tests.

In January, GAO reported that SDA’s program “is at risk of being unable to deliver capability as quickly as planned” and said the agency “should be more realistic and transparent on the technology it can deliver.

Sandhoo pushed back on those findings as well, telling reporters that the agency needs to take risks to bring crucial space-based technologies to the troops.

“I would want you to go back and look at the Apollo program. I mean, you did not wait until Apollo 8 landed before you start building Apollo 9, right? You just had to do it,” Sandhoo said. “That's the kind of mindset we're taking. That's what I think the nation needs right now.”

]]>

AI won’t replace human claims processors, VA officials say, as Democrats worry over staffing levels

Christian Robles — Tue, 14 Jul 2026 12:57:18 -0400

Artificial intelligence tools the Department of Veterans Affairs is using to speed up disability claims processing will not replace human reviewers, agency officials told lawmakers Monday, but Democrats contend claims processing also need sufficient staffing levels, not just new technology.

“Every disability claim is decided by a trained VA employee, not by AI or automation. These tools support human decision making; they do not replace it,” Robert Orifici, acting deputy chief information officer at VA’s Office of Information and Technology, said during a House Veterans’ Affairs Technology Modernization Subcommittee hearing.

“What we really strive to do is look at those really high volume, highly administrative tasks, focus our resources and [apply] really basic automation on those capabilities, so that we are really supporting and augmenting the productivity of our employees,” added Derek Herbert, acting chief production officer at VA’s Veterans Benefits Administration.

Rep. Tom Barrett, R-Mich., who chairs the subcommittee, expressed support for VA’s focus on maintaining human disability claim reviewers, saying Congress “will make sure that there are strong guardrails where no veteran claim is fully decided by AI or automation.”

The comments come as VA is actively using AI to speed up disability claims processing by prepopulating toxic exposure memos veterans must file, streamlining information gathering and facilitating other procedures. VA is also planning to acquire or develop additional AI and automated tools for disability claims, Nextgov/FCW reported in March.

But Rep. Nikki Budzinski, D-Ill., the panel's ranking member, argued that the new technologies may actually hinder VA reviewers’ ability to quickly process claims.

“I hear from employees that the so-called fixes that VA has pushed, like automation and pilots of artificial intelligence tools, often produce incorrect information, compounding issues and slowing production,” Budzinski said.

The congresswoman said new technology cannot solve declines in VA staffing, adding that she is alarmed that VA has lost 1,100 claims examiners this fiscal year, along with 2,700 examiners and 120 IT specialists since January 2025.

Rep. Maggie Goodlander, D-N.H., said she shared Budzinski’s concerns that a lack of adequate VA staffing is leading to less accurate reviews of claims.

Goodlander pressed Hebert to reveal how many claims examiners the VA has on staff and confirm the total has declined since January 2025. Hebert did not have specific numbers but said he would get those to the lawmakers while noting that VA is currently hiring. VA had several open claims examiners positions on usajobs.gov as of Tuesday morning.

Sterling Thomas, the Government Accountability Office’s chief scientist, similarly told lawmakers that federal agencies need a workforce with the right skills to harness new technologies. He argued that solutions such as a federal digital services academy could help VA and other agencies field the talent they need.

Thomas also recommended that VA turn to GAO’s AI framework of key practices as it continues to roll out new AI and automated technologies for claims processing. The framework says federal agencies should document the data used to build AI models, articulate system-level technical specifications, continuously monitor AI performance, assess that performance and take other measures to ensure technology is responsibly deployed.

]]>

DHS network intrusion was twice ruled a false positive before breach confirmed

David DiMolfetta — Mon, 13 Jul 2026 17:15:50 -0400

Department of Homeland Security personnel twice dismissed signs of cyber intruders inside the agency’s Homeland Security Information Network as harmless activity, allowing hackers to remain undetected inside for weeks and eventually steal credential files, according to an internal incident readout viewed by Nextgov/FCW.

HSIN was breached about two months ago, Nextgov/FCW first reported in late June. The network houses sensitive, unclassified data that’s shared between federal, state, local, industry and overseas partner organizations.

Department investigators have still not determined the affiliation of the hackers, according to two people with knowledge of an ongoing probe into the incident. DHS may send staff to brief Congress on the hack in a classified setting in the coming weeks, added the people, who spoke on the condition of anonymity to communicate the department’s thinking.

Between May 15 and May 24, the infiltration was detected by analysts inside FEMA, where they observed the hackers had altered files on testing and live servers, used a legitimate web-server program to run malicious code and deleted activity logs that could have exposed their movements, according to the readout. The activity was ruled a false positive.

Between May 25 and June 3, the hackers used similar methods aiming to leave scant trace of their activity, setting off more alerts that were again dismissed as benign. On June 4, they installed hidden backdoors and stole credential data — typically employed to verify users’ identities and grant access to accounts or systems — where personnel then declared a breach was active.

It’s not clear why the intrusion was deemed benign two times over such a wide timeframe, but the incident highlights how a mistaken assessment can give hackers significantly more time to deepen their access into a target’s environment. The hack involved techniques meant to mask activity as normal, which, generally speaking, can make it very difficult for analysts to determine what is legitimate or not, one of the people said.

It’s also unclear what materials, if any, were copied from HSIN systems, though the fact that hackers targeted credential files indicates they sought out access to accounts or systems beyond what they could initially reach.

"The Department of Homeland Security is aware of a recent cyber incident involving a specific, unclassified legacy information sharing environment," a DHS spokesperson wrote in the same statement it provided earlier this month that confirmed the hack. "We immediately took action to isolate the affected systems, mitigate the vulnerability, and launch a comprehensive forensic investigation. There is no indication that classified networks were impacted, and the system remains operational for our partners. As this is an ongoing investigation, we cannot provide further operational details at this time."

Approved users lean on the network to securely access data, exchange requests with partner agencies, coordinate safety and security for planned events, respond to incidents and share information needed to protect their communities, per its website.

HSIN has been used to support ongoing World Cup games and recent America250 events, Senate Intelligence Committee Vice Chairman Mark Warner, D-Va., said in a statement after the breach was reported.

“The information in HSIN, while not classified, is highly sensitive, and its exposure risks national security,” he said at the time.

As the United States hosts World Cup matches nationwide, the hack could raise questions about whether the intruders gained access to security plans, interagency communications or emergency response plans for one of the world’s most visible sporting events. It’s also possible that World Cup data was not a target.

Nation-state and criminal hackers routinely target U.S. systems to gather intelligence, steal sensitive information and maintain access to government networks. In February, a suspected China-linked breach of an FBI surveillance system likely exposed the phone numbers of people the bureau was monitoring. Last fall, a widespread breach at FEMA let hackers make off with employee data from both the disaster management office and U.S. Customs and Border Protection.

Editor's note: This article has been updated to include a statement from DHS.

]]>

Transportation loses its top tech official amid wave of CIO departures

Alexandra Kelley — Fri, 10 Jul 2026 06:00:00 -0400

The chief digital and information officer of the Department of Transportation is resigning from his position effective Sept. 4, according to an email obtained by Nextgov/FCW.

Pavan Pidugu, who has been the CDIO at the agency since February 2025, sent the email Thursday announcing his departure to his staff and expressing gratitude for his colleagues and their work. He wrote that serving alongside “this incredible team for the past many years has been one of the most rewarding experiences of my career.”

“When we set out on this journey together, we shared a bold vision to fundamentally transform how technology serves the Department and the American public. Thanks to your hard work, dedication, and true builder mentality, we didn't just meet those expectations—we exceeded them,” the email continued.

Pidugu told Nextgov/FCW in August 2025 that he wanted to turn the Transportation IT shop into a place “where we build technology,” modernizing the agency amid the federal operations overhaul executed by the Department of Government Efficiency during the start of the second Trump administration. Pidugu led the crafting of the department’s “1DOT IT strategy,” which guided Transportation’s modernization agenda.

He said in the Thursday email that, during his tenure, his office achieved “unprecedented milestones” in their tech policy efforts, including conducting a mass, agency-wide transition to Gmail software to achieve about 70% cost savings, creating the internal T-Cloud environment and pursuing long-term plans to migrate legacy IT infrastructure.

The contract between Transportation and Google through software reseller Carahsoft is particularly important, with a value ceiling of $89 million to bring the Google Workspace suite to the agency and build a “modern collaboration environment,” as Pidugu called it in his Thursday email. The department was able to leverage the software at discounted rates negotiated through the General Services Administration’s OneGov program.

“These accomplishments are a direct testament to your talent and your willingness to embrace a product-centric culture,” Pidugu wrote. “By working together, we have broken down historic silos to operate as a truly unified enterprise.”

In his email, Pidugu did not state his reason for resigning or who will take up his position after he leaves.

Over the course of the week, reports of at least three federal CIOs planning to depart their posts in the government have emerged. Federal CIO Greg Barbaccia is set to leave his role by the end of August, and the Department of the Interior CIO Paul “Macca” McInerny also stepped down from his position last week. Department of Housing and Urban Development CIO Eric Sidle has been tapped to take over leading the Interior tech shop.

Pidugu received a Federal 100 award this year for his work at the Transportation Department in 2025.

GovExec Editor-in-Chief Frank Konkel contributed to this report.

]]>

HUD's tech chief appears headed for Interior

Edward Graham and David DiMolfetta — Thu, 09 Jul 2026 16:02:15 -0400

Department of Housing and Urban Development Chief Information Officer and Chief Artificial Intelligence Officer Eric Sidle is expected to soon take up the Department of Interior’s top tech post after the latter agency’s CIO departed, according to two people familiar with the matter.

He is finalizing the paperwork process and could be onboarded in the next one to two weeks, said both people, who spoke on the condition of anonymity because the selection has not been made public.

Sidle joined HUD in May 2025 after serving in the private sector for a number of years in a variety of tech-specific roles. He previously worked for two years at tech consulting firm Fabrum Advisors as a technology advisor, operating partner and coach.

Prior to that position, Sidle oversaw autonomous driving hardware at NIO, served as chief technology officer at ChargePoint and worked as an engineering manager for special projects at Apple.

Interior’s prior CIO Paul “Macca” McInerny — a former SpaceX engineer that aligned himself with the Department of Government Efficiency’s mission — left the department last week after just over a year in the role, with a top strategy official at the agency, Matt Luby, tapped as interim CIO, Nextgov/FCW reported Monday.

One suspected source of frustration under McInerny involved the department’s effort to consolidate and speed up permitting systems — including systems tied to Bureau of Land Management leasing and energy development — that would likely demand significant overhauls to the agency’s IT stack.

HUD and Interior spokespeople did not return multiple requests for comment.

Sidle has publicly discussed his push to bolster anti-fraud initiatives while at HUD, an effort that aligns with the Trump administration’s broader “war on fraud.”

Speaking at the Government Service Delivery conference in Washington, D.C., last month, Sidle said HUD’s outdated technologies and disparate databases made it difficult to identify companies gaming the agency’s programs, noting that the median age of its systems was 20 years.

“Across different agencies, we’re now talking about how we’re going to be dealing with data sharing, Delta Sharing and all this other stuff,” he said, adding that “even before AI, just the basics of data analytics wasn’t being done — let alone now you have AI, which is going to take off and be able to protect this.”

]]>

GSA taps White House design team to revamp Login.gov

Frank Konkel — Wed, 08 Jul 2026 15:45:04 -0400

Login.gov, the government’s identity-proofing platform housed within the General Services Administration, is collaborating with the National Design Studio to enhance the user experience of millions of Americans who regularly use the shared service.

The collaboration aims to “make it easier for people to access government services, while operating with privacy, transparency, and security at the core of everything we do,” according to an internal email sent to staff Tuesday by Greg Hogan, acting assistant commissioner of Login.gov, and obtained by Nextgov/FCW.

Currently, more than 100 million Americans have accounts through Login.gov to access a variety of government services like Social Security accounts, unemployment insurance, passport services and more across 50 states and agencies.

The National Design Studio was stood up via an August 2025 executive order to improve how Americans experience and interact with government agencies online and in-person. Housed within the Executive Office of the President and headed by Joe Gebbia, the National Design Studio has collaborated with several agencies across government, including on a major effort with the Office of Personnel Management to make federal retirement applications fully electronic.

Per Hogan’s email, “ND Studio has drafted a proposed set of changes that will help modernize and streamline the sign up, sign in, and identity proofing process.” Hogan makes clear that while National Design Studio is providing a service to Login.gov, it “does not oversee or operate” the service, nor is it “building a replacement Login.gov website.”

The National Design Studio instead built a separate “experimental version” of the site to test different design concepts and improvements that it pitched to leadership.

“The ND Studio will have resources available to support us in real-time thinking through these immediate changes and identifying areas where their expertise would be beneficial for the long term,” Hogan said in the email. “I believe our combined skills can greatly benefit the American public.”

“Our team at GSA remains responsible for every change made to the service. Any proposal must go through our normal reviews for engineering, security, accessibility, privacy, compliance, performance, and product before it gets shipped to users. We’ll implement only changes that improve the user experience and meet our standards,” he added.

]]>

House Homeland committee seeks briefing on DHS network hack

David DiMolfetta — Tue, 07 Jul 2026 18:07:31 -0400

House Homeland Security Committee staff are requesting a briefing from the Department of Homeland Security on the breach of the agency’s Homeland Security Information Network, according to a committee aide with knowledge of the matter.

Staffers are hoping to be briefed on the intrusion — first reported by Nextgov/FCW last week — by Friday, said the aide, who spoke on the condition of anonymity because the matter is sensitive.

Hackers are believed to have penetrated HSIN sometime between late May and early June, though their affiliation and whether any contents were pilfered from the platform is unclear, a person familiar with the matter previously said.

Approved users lean on the network to securely access data, exchange requests with partner agencies, manage operations, coordinate safety and security for planned events, respond to incidents and share mission-critical information needed to protect their communities, according to its website. HSIN carries unclassified but sensitive information shared among federal, state, local, territorial, tribal, international and private-sector partners.

The intrusion comes as the U.S. oversees security for World Cup games across the country, placing added scrutiny on the systems federal, state and local officials use to coordinate major events. A breach of the platform may raise concerns about whether hackers gained insight into security planning, interagency coordination or response procedures surrounding one of the most visible international events hosted predominately in the United States.

Senate Intelligence Committee Vice Chairman Mark Warner, D-Va., said last week that the network is being used to support the World Cup and America250 events. He added that it played a key role for emergency responders during last year’s mid-air collision between an American Airlines flight and an Army Black Hawk helicopter outside Washington, D.C.

“The information in HSIN, while not classified, is highly sensitive, and its exposure risks national security,” Warner said. “DHS and DOJ must thoroughly investigate who breached HSIN, what the attackers accessed, and ensure all DHS partners are provided with timely information and the tools necessary to mitigate any associated risks from the breach.”

When asked by Nextgov/FCW about the committee briefing request, a department spokesperson sent the same statement it provided last week that confirmed the hack.

The statement said staff “immediately took action to isolate the affected systems, mitigate the vulnerability, and launch a comprehensive forensic investigation,” and added that an investigation is ongoing and more details can’t be provided.

]]>

Greg Barbaccia to leave federal CIO role at end of August

David DiMolfetta — Tue, 07 Jul 2026 15:00:00 -0400

Federal CIO Greg Barbaccia is leaving government service, capping off an 18-month tenure as the government’s top IT lead where he sought to overhaul how the U.S. agencies acquire and interact with tech services.

Barbaccia will depart Aug. 31, according to a White House official with knowledge of the matter, who requested anonymity to communicate the departure. It’s not clear where Barbaccia is headed next.

The Office of Management and Budget confirmed his departure date.

“Greg has done an excellent job as Federal CIO and Chief AI Officer,” a spokesperson told Nextgov/FCW. “He will certainly be missed when his time here comes to an end.”

The move was first reported by FedScoop.

“Greg Barbaccia has been an incredible partner at GSA. He has fundamentally reshaped our work on the federal government’s technology and the products GSA delivers across the federal workforce on behalf of the American taxpayer,” GSA Administrator Edward Forst said in a statement to Nextgov/FCW. “I’m deeply grateful for his extraordinary service to President Trump and the American people.”

Barbaccia joined OMB in January 2025 after a decade at Palantir and later stints at blockchain intelligence firm Elementus and Theorem, a machine-learning-enabled asset manager. A former Army intelligence sergeant and intelligence community analyst, Barbaccia had not worked in government since 2009 and had not previously served as an agency CIO.

Barbaccia was charged as federal CIO with overseeing governmentwide IT policy, helping shape the federal technology budget and setting the direction for agency modernization efforts. He also served as the federal chief AI officer and became the government’s service delivery lead under the Government Service Delivery Improvement Act.

During his tenure, he pushed agencies to rethink how they buy and manage technology, arguing that the government should default more often to buying commercial tools rather than building systems in-house. He also sought tougher enforcement of FITARA, the 2014 law giving agency CIOs authority over technology investments, and explored ways for OMB to more closely track major IT decisions across agencies.

Barbaccia also made culture a central theme of his tenure, saying his role had become less about “deep diving” into technical architecture and more about changing how the government thinks about technology, compliance and modernization. He pushed the federal CIO office to gather more feedback from agency technology leaders and sent staff into the field for in-person meetings with agencies.

“I came into the job thinking this would be much more of a technical undertaking about deep diving into technical systems and technical architecture,” he told Nextgov/FCW in February. “I’m understanding changing the culture and the way we think about tech and the government is a way more effective means of making change, so that's what I’m focused on — primarily changes across culture, tech and then the compliance regime.”

His departure comes after a turbulent period for the federal technology workforce, including Department of Government Efficiency’s push to downsize government as a whole, broad personnel losses across government — including portions of the federal tech workforce — and a reshuffling of many agency CIO roles. Barbaccia has acknowledged those disruptions but argued that artificial intelligence and a new early-career U.S. Tech Force program could help the government rebuild technical capacity.

Barbaccia also championed a “digital front door” for government services, questioning why taxpayers must repeatedly provide the same information to different agencies. That vision, he said, would require more responsible data sharing and a willingness to make difficult decisions around identity proofing, including the future of Login.gov and the government’s use of commercial identity tools.

During his tenure, the federal government began to confront a new class of advanced AI models that officials and researchers say will forever overhaul how organizations manage defensive and offensive cyber strategies. The models’ advent has raised ongoing questions for agency technology leaders about model-sharing and coordination amid a recent export control debacle that impacted parts of the government.

Nextgov/FCW Managing Editor Edward Graham contributed to this report.

Editor's note: This article has been updated to include a statement from GSA Administrator Edward Forst.

]]>

Trump says Pulte can declassify ‘whatever’ he wants, sparking fears of exposing intelligence secrets

David DiMolfetta — Mon, 06 Jul 2026 09:00:00 -0400

President Donald Trump said Wednesday that acting spy chief Bill Pulte can declassify “whatever” records he wants and can declassify “almost everything,” a sweeping green light that has alarmed former intelligence officials, who warn that careless releases could expose sensitive intelligence capabilities and sidestep standard review processes with other spy agencies.

Trump said Wednesday that acting Director of National Intelligence Bill Pulte would only serve in the job for “a month or two months or something,” but has his permission in the interim to release classified records.

“Bill is there just for a fairly short period of time,” Trump told reporters at Joint Base Andrews in Maryland. “But while he’s there, I said you can declassify whatever you want.”

Under U.S. law, records declassification is usually handled through a structured review process meant to identify national security risks before materials are released. Trump’s comments appear to give Pulte political backing to move aggressively, but they don’t necessarily address how agencies with involvement in any records would be consulted first.

“My guess is that NSA and CIA are losing their minds at the idea of Pulte declassifying a lot of stuff,” said a former official, who, like others for this story, spoke on the condition of anonymity to be candid and for fear of retribution.

“If Pulte actually runs the traps and considers damage and balances, he won’t declassify much. If he doesn’t care about blowing up cyber exploits, putting foreign relationships at risk, or getting people killed, he could declassify a lot,” the former official added.

Intelligence records are typically reviewed by the agency that produced them before release, particularly if disclosure could expose that agency’s operations, but that consultation might be skipped entirely under Pulte, a second former official said.

An ODNI spokesperson did not immediately return a request for comment.

Trump has placed Pulte at the center of a wider declassification push that began under former Director of National Intelligence Tulsi Gabbard, who used her role atop ODNI to release records tied to Trump-era grievances over alleged weaponization inside the intelligence community. ODNI’s own public releases under Gabbard included documents the office claimed exposed efforts by intelligence officials to undermine Trump’s 2016 victory and material it said showed a conspiracy used during his 2019 impeachment proceedings.

The declassification push is part of a broader campaign to challenge an intelligence community the president has long accused of working against him. Since the 2016 Russia investigation, Trump and his allies have argued that intelligence and law enforcement shops have used their powers to damage his presidency.

“Trump’s statement alone saying that Pulte has this authority is damaging to national security because any person thinking about volunteering or working with the United States might think twice now, and is more likely to go to the Brits or another service,” a third former official said, adding that if Pulte moves to declassify intelligence involving other agencies, he would be in violation of the law.

The president “just signaled to any person providing intelligence to the United States that their intelligence can be released at Pulte’s whim, thus putting their entire security and safety in jeopardy,” the third former official added.

The White House has assembled a task force collecting thousands of pages of intelligence and law enforcement documents, mostly related to the 2020 election, with plans to declassify some of them in ways that could support Trump’s claims about election irregularities and fraud, NBC News reported Tuesday.

Trump’s declassification plans land against a long-running backdrop of concerns over his administration’s handling of sensitive intelligence. During his first term, officials said he shared highly classified information provided by the Israelis with Russian officials in the Oval Office. Separately, Russian and U.S. news reports later identified Oleg Smolenkov, a former Russian government official living near Washington, as a possible CIA source who had disappeared from Russia in 2017 after allegedly providing information on Russian President Vladimir Putin’s role in the Kremlin’s 2016 election interference efforts.

Trump was later indicted in June 2023 over classified records kept at Mar-a-Lago, including documents prosecutors said involved highly sensitive national defense information, though the case was dismissed and later dropped after he returned to office. Former President Joe Biden also faced a classified documents investigation, but a special counsel declined to charge him on grounds that there was not enough evidence to convict him of “willfully” retaining the sensitive materials.

Pulte’s short tenure has already produced early staffing changes at ODNI that have removed around 50 career and political staff from their roles in the office. The moves follow a broader downsizing campaign started under Gabbard.

The personnel churn included the sidelining of Will Ruger, the deputy director of national intelligence for mission integration. Pulte also brought in a new chief of staff, Christina Norton, who served as Pulte’s chief of staff at the Federal Housing Finance Agency and as the RNC’s election integrity director, helping oversee its 2024 poll-watching operation. Her move into ODNI has sharpened concerns that the office could be drawn further into Trump’s push to revisit election-related claims.

Trump’s comments come after he slowed a Senate push last month to quickly confirm Jay Clayton as permanent intelligence chief, allowing Pulte to take over the office on a temporary basis. Trump said Wednesday that Clayton would get his Senate hearing in two weeks.

Clayton’s nomination has drawn a generally positive response from senators. But Democrats have reacted furiously to Pulte’s elevation, and even some Republicans have expressed concern about installing someone with no prior intelligence community experience as acting DNI. The fight has already affected Section 702 of the Foreign Intelligence Surveillance Act, a key spying authority that had appeared headed for reauthorization in early June before Democrats balked in protest of moving forward with Pulte at the head of ODNI.

]]>