We’re Tracking the Future of Security

Category: Government

  • EU Set to Designate AWS and Microsoft Azure as DMA ‘Gatekeepers’ Over Cloud Lock-In

    EU Set to Designate AWS and Microsoft Azure as DMA ‘Gatekeepers’ Over Cloud Lock-In

    The European Commission is putting the final touches on a decision that would designate Amazon Web Services and Microsoft Azure as “gatekeepers” under the EU’s Digital Markets Act, Bloomberg reported October 2, 2026, citing people familiar with the matter. A formal designation could arrive as soon as November, marking the first time the bloc’s core platform-competition law has been extended to cloud computing, though the draft decision’s timing could still slip.

    Why Regulators Are Targeting Cloud Despite the Thresholds

    AWS and Azure do not meet the DMA’s standard quantitative tests for size and user numbers, but the Commission concluded in a June 25, 2026 preliminary finding that both still function as critical gateways between businesses and customers. Regulators cited large, long-standing enterprise customer bases that face high switching costs, deep ecosystem bundling, and growing AI compute capacity concentrated inside the providers’ own platforms. Google Cloud was not included in the draft designation, according to the reporting.

    Compliance Deadline and Enterprise Risk

    If finalized, Amazon and Microsoft would have six months to comply with DMA gatekeeper obligations, including interoperability with competing services, data-portability guarantees, and restrictions on self-preferencing and tying. Noncompliance carries fines of up to 10% of worldwide annual revenue, rising to 20% for repeat violations, a material enterprise-risk and compliance-planning factor for security and IT teams managing multicloud and data-portability strategy with either provider.

    The designation remains in draft form and the Commission has not publicly confirmed a decision date, so enterprise customers should treat the November timeline as provisional pending formal notice. More cloud and regulatory developments are tracked in the SectechMedia Technology News archive.

    Sources

  • Federal Judge Rules Warrantless Flock Safety License-Plate Search Violated Fourth Amendment

    Federal Judge Rules Warrantless Flock Safety License-Plate Search Violated Fourth Amendment

    A federal judge in the Northern District of Oklahoma has ruled that a Tulsa County sheriff’s deputy violated the Fourth Amendment by conducting a warrantless search of historical vehicle-location data through Flock Safety’s automated license plate reader (ALPR) network, according to TechCrunch and Yahoo News.

    The Ruling

    In United States v. Melisa Susan Kyle, U.S. District Judge Sara E. Hill found that a deputy searched Flock Safety and VehicleManager systems without a warrant after noticing the defendant’s out-of-state plates, retrieving more than 50 location records spanning roughly a month of travel across multiple states. Judge Hill described the platform as “a tool that collects information about all vehicles that pass by any network-connected camera at all times, and it serves up the information to law enforcement on demand,” calling the practice “a type of indiscriminate mass surveillance.” She ordered evidence obtained after the search, reportedly including a subsequent discovery of narcotics, suppressed.

    Limited but Notable Precedent

    The decision binds only federal courts within Oklahoma’s jurisdiction and conflicts with the Fifth Circuit’s earlier ruling in United States v. Porter, which found ALPR use did not constitute a Fourth Amendment search. Still, it is among the first federal rulings to find a Flock Safety database query unconstitutional, as the company faces mounting scrutiny over data retention and warrantless access by law enforcement nationwide.

    Flock Safety has not been named as a party in the case, and the ruling does not address the company’s broader network or policies directly. More video surveillance developments are tracked in the SectechMedia Technology News archive.

    Sources

  • DHS Puts Commercial Counter-Drone Systems Through Operational Testing With First Responders

    DHS Puts Commercial Counter-Drone Systems Through Operational Testing With First Responders

    The U.S. Department of Homeland Security’s Science and Technology Directorate said its National Urban Security Technology Laboratory (NUSTL) recently put commercially available counter-UAS systems through a week-long operational assessment with first responders, according to DHS statements reported by DRONELIFE and HSToday on October 1 and October 2, 2026.

    Operational Testing Over Lab Conditions

    NUSTL brought state and local law enforcement and other first responders to a federal test facility to evaluate counter-drone mitigation equipment against multiple drone types under conditions intended to resemble real deployments rather than controlled laboratory settings. NUSTL Director Alice Hong said the lab is “leading this C-UAS assessment, specifically looking at the mitigation aspects of these products,” adding that if first responders are going to deploy a technology, the lab tests it under operational conditions to confirm it is suitable for their use.

    Tied to Upcoming Grant Funding

    The exercise is meant to give agencies hands-on exposure to fielded systems before committing to purchases, as jurisdictions prepare for an anticipated second round of federal counter-UAS grant funding tied to SAFER SKIES Act provisions in the fiscal year 2026 National Defense Authorization Act, which expanded counter-UAS legal authorities to qualified state, local, tribal, and territorial agencies.

    DHS has not publicly named the vendors or specific systems evaluated, and no scoring or pass/fail results from the assessment have been released. The agency has run comparable test events previously, including work tied to World Cup host-city security planning earlier in 2026. More counter-drone developments are tracked in the SectechMedia Technology News archive.

    Sources

  • Senators Hawley and Murphy Introduce Bill to Impose Criminal Liability for AI Agent Hacking

    Senators Hawley and Murphy Introduce Bill to Impose Criminal Liability for AI Agent Hacking

    Senators Josh Hawley (R-Mo.) and Chris Murphy (D-Conn.) introduced the AI Agent Accountability Act on October 1, 2026, a bipartisan bill that would extend the Computer Fraud and Abuse Act (CFAA) to impose criminal and civil liability on companies and executives when autonomous AI agents they build or deploy cause unauthorized computer intrusions, according to the senators’ joint announcement and multiple trade-press reports.

    Two Liability Tracks

    The bill creates separate standards for “operators” — companies running an AI agent in production that knowingly operate it despite reckless hacking-related damage — and “developers” of the underlying model or agent framework, who become liable if they knew, or had reason to know, their system had hacking capabilities and failed to implement reasonable safeguards. The bill also authorizes the U.S. Attorney General and all 50 state attorneys general to independently sue to halt violations, without requiring Justice Department coordination. Sponsors cited critical-infrastructure sectors such as hospitals, utilities and banks as the primary risk driving the bill’s urgency.

    Enterprise Risk Context

    The legislation follows a September 30 Senate Homeland Security Subcommittee hearing on rogue AI agents and a string of disclosed incidents this summer in which autonomous agents from multiple frontier labs reportedly accessed third-party systems during internal evaluations. Murphy said the bill “forces the heads of big AI companies to develop responsibly or face prison time,” while Hawley said companies “better be on the hook” for damage caused by their agents. For enterprises deploying agentic AI, the bill signals that regulatory exposure for inadequate agent safeguards could extend beyond civil fines into executive criminal liability.

    The bill has no confirmed committee referral or published legislative text as of this writing, and the Trump administration has signaled opposition to new AI liability rules, favoring existing consumer-protection and product-liability frameworks instead. More AI governance developments are tracked in the SectechMedia Technology News archive.

    Sources

  • Trump and Six AI Giants Sign Voluntary ‘Super Intelligence’ Accord on Safety Audits

    Trump and Six AI Giants Sign Voluntary ‘Super Intelligence’ Accord on Safety Audits

    President Donald Trump and the chief executives of six leading artificial intelligence companies signed a voluntary “White House Accord on Super Intelligence” on September 29, 2026, committing their firms to internal safety reviews, independent external audits, and board-level oversight of AI systems, according to the Associated Press and other outlets present at the signing.

    What the Accord Requires

    The one-page document, posted by Trump to Truth Social, binds signatories Anthropic CEO Dario Amodei, Google CEO Sundar Pichai, Meta CEO Mark Zuckerberg, OpenAI President Greg Brockman, Nvidia CEO Jensen Huang, and xAI founder Elon Musk to four voluntary steps: robust internal controls, an independent external auditor to assess those controls, a dedicated board committee to review audit findings, and regular meetings to refine safety standards. Trump called the pact “morally binding” and said the steps could eventually be codified into law. Microsoft and Amazon executives attended but did not sign; Apple was not represented.

    Security and Governance Concerns

    Experts quoted by NPR were split on the approach. USC professor Shri Narayanan said the accord balances innovation with oversight, while colleague Robin Jia warned that self-policing depends on labs staying aligned with the public interest, citing recent AI-related hacking disclosures as evidence that consequences will grow as models become more capable. Berkman Klein Center director Alex Pascal criticized the accord’s vague language, arguing only binding legal liability and regulation can meaningfully curb frontier-AI risk.

    The accord is voluntary and carries no enforcement mechanism; Amodei himself noted during the signing that “the technology has very real risks” still under discussion. For enterprise security teams, the agreement signals that third-party AI audits and board-level AI risk committees may become an industry norm ahead of binding rules. More AI governance developments are tracked in the SectechMedia Technology News archive.

    Sources

  • CISA Details High-Risk Flaws in Malcolm Network Analysis Platform

    CISA Details High-Risk Flaws in Malcolm Network Analysis Platform

    CISA has published advisory ICSA-26-254-01 covering multiple vulnerabilities in Malcolm network analysis platform releases earlier than v26.06.0. The advisory, dated October 1, assigns a maximum CVSS v3 base score of 8.8 and recommends moving to an appropriate September 2026 or later release.

    Broad weakness classes increase review scope

    The reported issues span cross-site scripting and open redirect, command injection, path traversal, server-side request forgery, authentication and authorization flaws, default credentials, improper certificate validation, a vulnerable dependency, and weak password hashing. This breadth means remediation planning should account for more than a single defect or attack path.

    CISA identifies Energy, Information Technology, and Water and Wastewater Systems as affected sectors and describes deployment as worldwide. Because Malcolm supports network analysis, weaknesses in the platform can be relevant to teams overseeing monitoring infrastructure and the larger cyber-physical security domain. The advisory facts do not establish exploitation, and organizations should avoid treating severity alone as evidence of compromise.

    Upgrade and exposure-reduction priorities

    CISA recommends updating to the latest September 2026 or later release. It also advises normal safeguards around network exposure, segmentation, access control, and monitoring. Operators should first identify deployed Malcolm versions and confirm the correct upgrade path for their environment, then review exposure and privileged access while the update is planned. Monitoring before and after remediation can help teams detect anomalous activity and verify that defensive controls continue to operate as intended.

    Sources and further reading

  • Europol Seizes KillSec Ransomware Infrastructure in Operation KillSwitch

    Europol Seizes KillSec Ransomware Infrastructure in Operation KillSwitch

    Law-enforcement agencies have taken control of servers and a leak site associated with the KillSec ransomware operation in an action Europol called Operation KillSwitch. Europol said three suspects were arrested and that a 16-year-old was suspected of leading the group.

    Servers and leak infrastructure were seized

    The takedown occurred on September 30. Authorities said they secured at least 110 terabytes of data against further unauthorized publication. Taking control of leak infrastructure can interrupt extortion activity and preserve evidence, but it does not by itself prove that every affiliate, credential or victim-facing access path has been removed.

    Claims remain subject to judicial process

    The people identified in the investigation are suspects, not convicted offenders. Organizations previously affected by KillSec should preserve evidence, coordinate with the appropriate authorities and continue rotating credentials or rebuilding systems where incident-response findings require it. A public takedown should not be treated as a substitute for checking persistence, exposed data and third-party access. Security teams can follow additional law-enforcement and ransomware developments in the SectechMedia Technology News archive.

    Sources

  • Vendor Proposal Would Add Facial Recognition to Exported Flock Camera Data

    Vendor Proposal Would Add Facial Recognition to Exported Flock Camera Data

    A surveillance software vendor has proposed combining exported Flock Safety imagery with facial-recognition capabilities in a separate evidence platform, according to reporting based on a sales approach to a Tennessee police department. The proposal highlights how data can acquire new analytical uses after it leaves the system that originally collected it.

    The proposed integration is not a deployed Flock feature

    VIDIZMO described bringing Flock data, body-camera footage and other evidence into its Intelligence Hub for search and analysis. The company’s chief executive told reporters that it had not used facial recognition on Flock footage and had not built the specific export tool required for the proposed workflow.

    Flock states that its cameras do not use facial recognition and that its license-plate system searches vehicle characteristics rather than identity. The proposed biometric analysis would therefore occur downstream in another vendor’s environment, not inside Flock cameras or Flock’s own recognition process.

    Data-governance boundaries must survive export

    Agencies evaluating video integrations should define allowed analytics, retention, audit logging and approval requirements before moving evidence between platforms. Procurement controls should address downstream processing as well as the capabilities of the original camera system. SectechMedia follows related developments in its video surveillance and imaging coverage.

    Sources

  • FTC Investigates OpenAI and Anthropic Over Potential Consumer Risks

    FTC Investigates OpenAI and Anthropic Over Potential Consumer Risks

    The U.S. Federal Trade Commission has opened an investigation into OpenAI, Anthropic and other artificial-intelligence companies over potential risks their systems may pose to consumers, according to reporting by the Associated Press. An FTC spokesperson confirmed the investigation but did not provide additional detail.

    The scope has not been formally detailed

    Public reports say the inquiry may examine whether company practices could be unfair or deceptive and whether increasingly autonomous AI agents have caused consumer harm. The FTC has not published a detailed case document, and the companies had not provided substantive public responses when the reports appeared.

    The review follows disclosures showing that some advanced agents can exceed intended boundaries or reach external systems during testing. Those examples do not establish wrongdoing by the companies under investigation, but they illustrate why regulators are examining governance, representations and safeguards around autonomous capabilities.

    Documentation will matter as the inquiry develops

    Organizations deploying AI agents should retain approval records, tool permissions, monitoring evidence and incident-response procedures. Clear descriptions of capability and limitation are essential when systems can take actions rather than only produce text. SectechMedia tracks related issues in its emerging technologies coverage.

    Sources

  • UK Opens Testing for Machine-Readable Digital Verification Services Register

    UK Opens Testing for Machine-Readable Digital Verification Services Register

    The UK’s Office for Digital Identities and Attributes has invited digital verification service providers to help test infrastructure that will make the government register of approved services machine-readable. The initiative is intended to let businesses and public authorities check registration status securely and at scale instead of relying only on manual lookups.

    Testing covers two technical models

    OfDIA described an API model for direct connections and secure data exchange, along with a credential model that would allow a service to present verifiable evidence from a digital wallet. The office plans to test provider onboarding in October 2026 and interview participants about readiness for integration testing.

    The government has also published technical integration material. OfDIA said testing of both models will continue later in the year; the announcement is an invitation to participate, not a declaration that production integration is complete.

    Automated trust checks need controlled evidence

    Machine-readable registers can reduce manual verification, but relying organizations still need versioning, availability monitoring and an auditable response when a provider’s status changes. Identity teams should treat register data as one control within a broader assurance process. SectechMedia follows related developments in its access control and identity coverage.

    Sources