We’re Tracking the Future of Security

Category: Government

  • Indonesia Says IKD Digital ID Has Passed 20.5 Million Users

    Indonesia Says IKD Digital ID Has Passed 20.5 Million Users

    Indonesia’s Directorate General of Population and Civil Registration says 20,598,478 residents had activated Identitas Kependudukan Digital, or IKD, by the first half of 2026. The authority presented the figure alongside broader electronic identity registration data.

    The official account describes IKD as a gateway to multiple public services rather than only a digital copy of a physical identity card. Biometric Update separately reported the figures and noted continuing barriers involving connectivity, smartphone access and digital literacy.

    Adoption counts show reach, not security performance. They do not on their own demonstrate fraud resistance, service availability or equitable access, and those outcomes need separate operational evidence.

    Why it matters

    National digital identity becomes critical infrastructure as more services depend on it. Growth should be matched by resilient enrollment, secure account recovery, accessible alternatives and clear governance for verification data shared across agencies.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • South Africa Seeks Facial Recognition for Police Body and Dashboard Cameras

    South Africa Seeks Facial Recognition for Police Body and Dashboard Cameras

    South Africa’s State Information Technology Agency is seeking a supplier for body-worn cameras, vehicle dashboard cameras and supporting software for the national police. Public tender information describes facial recognition, automatic number-plate recognition and integration with other security platforms.

    The procurement is described as a three-year contract including training and maintenance. Public documents cited in the reporting do not state a target budget or a final camera quantity, so those fields remain unknown rather than estimated.

    Biometric Update also highlighted unresolved governance questions around police processing of biometric footage. Procurement requirements establish desired technical functions; they do not by themselves demonstrate that privacy, retention, accuracy and redress rules are complete.

    Why it matters

    Body-camera programs combine evidentiary, operational and civil-rights requirements. Buyers need measurable image-quality and audit controls as well as explicit policies for face searching, retention, access and disclosure before deployment.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Ukraine Considers Unified Biometrics Law to Align With EU Rules

    Ukraine Considers Unified Biometrics Law to Align With EU Rules

    Ukraine is considering a comprehensive law to standardize how biometric data is defined, collected, stored, accessed and overseen. Reporting on a parliamentary study says the current framework is spread across multiple laws and subordinate acts, creating inconsistent terminology and controls.

    The study recommends clearer processing purposes, retention rules, human-rights safeguards, independent oversight and security and interoperability requirements. It also calls for special treatment of automated facial recognition in law-enforcement and security contexts.

    The proposals are part of a policy process rather than an enacted law. Claims about future obligations therefore need to remain conditional until Ukraine adopts final legislation and publishes its operative text.

    Why it matters

    Unified definitions matter because biometric governance cannot be enforced consistently when agencies use different scopes, retention periods or access rules. Interoperability goals also need privacy, audit and redress mechanisms to avoid turning technical integration into uncontrolled data sharing.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • UK Expands Passkey Sign-In for GOV.UK One Login

    UK Expands Passkey Sign-In for GOV.UK One Login

    The UK government is broadening passkey sign-in for GOV.UK One Login, allowing users to authenticate with a device biometric or local passcode instead of entering a password and a separate security code. The option follows a trial and remains an alternative rather than the only sign-in route.

    Biometric Update reported that more than 300,000 users adopted passkeys during the trial. GOV.UK guidance explains that the biometric template used to unlock a credential stays with the user’s device or credential manager and is not sent to One Login.

    A passkey is distinct from the identity-checking process that may compare a selfie with an identity document. It authenticates possession of a cryptographic credential after an account has been established; it does not independently prove the civil identity behind that account.

    Why it matters

    Public-sector passkey deployments can reduce phishing exposure, but recovery and fallback paths remain part of the security boundary. A strong credential can be undermined if enrollment, account recovery or help-desk processes allow weaker impersonation routes.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Japan Digital Agency Says VPN Exploit Exposed Data on About 240,000 People

    Japan Digital Agency Says VPN Exploit Exposed Data on About 240,000 People

    Japan’s Digital Agency has disclosed that a vulnerability in a virtual private network product was exploited to access data connected with approximately 240,000 people. The agency published an official notice and a separate public FAQ describing the incident and response.

    The affected information was held in systems supporting government digital services. Public statements attribute the initial access to the VPN vulnerability; they do not justify broader claims about compromise of every agency platform or identity record.

    The agency’s response illustrates the risk created when a remote-access gateway becomes an entry point to higher-value data. VPN appliances concentrate authentication and network reach, so vulnerability management and segmentation around them are core controls rather than routine maintenance tasks.

    Why it matters

    Government identity and service platforms depend on public trust. Clear scope statements, affected-person notification and evidence about the initial access path help distinguish a bounded breach from speculation about an entire national digital infrastructure.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Pentagon Suspends CMMC Phase II Rollout as Reform Task Force Reviews Program

    Pentagon Suspends CMMC Phase II Rollout as Reform Task Force Reviews Program

    The Department of Defense has suspended Cybersecurity Maturity Model Certification (CMMC) Phase II requirements that were scheduled to take effect November 10, 2026, while a reform task force reviews the program, according to an August 31, 2026 report from Security Info Watch. Phase I self-assessments and current NIST SP 800-171 Revision 2 obligations remain in effect for defense contractors.

    What’s Paused, What Isn’t

    Level 1 self-assessments covering 15 safeguarding requirements from FAR clause 52.204-21 continue on their annual cycle, and Level 2 self-assessments against the 110 security requirements in NIST SP 800-171 Rev. 2 continue every three years with annual affirmation, with results still required in the Supplier Performance Risk System (SPRS). For contracts under DFARS clause 252.204-7012, contracting officers must still verify a current SPRS assessment score before certain awards, extensions or option exercises. Only the timing of third-party CMMC Phase II assessments has changed, not the underlying obligation to safeguard Controlled Unclassified Information, Bill Osborne, vice president of Defense Sector Services at Magna5, told the publication.

    Why It Matters

    The pause gives contractors more time to fix gaps in scope, documentation and System Security Plans before a Third-Party Assessment Organization is engaged, rather than a reason to slow readiness work altogether. Compliance requirements of this kind sit alongside physical protections for critical infrastructure and defense-linked targets that state-linked threat actors continue to probe.

  • CISA Ends Six Free Cybersecurity Assessments for Critical Infrastructure Operators

    CISA Ends Six Free Cybersecurity Assessments for Critical Infrastructure Operators

    The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed it is ending six free assessment programs long used by critical infrastructure operators to evaluate their cybersecurity posture, Cybersecurity Dive reported.

    What’s New

    CISA’s regional field staff will no longer conduct Cyber Resilience Reviews, Cyber Resilience Essentials surveys, Ransomware Readiness Assessments, Incident Management Reviews, External Dependencies Management Assessments or Cyber Infrastructure Surveys. All six relied on CISA’s Cyber Security Evaluation Tool (CSET). Acting Cybersecurity Division head Chris Butera said eliminating the “legacy assessments” would “reduce redundancy for CISA and organizations requesting an assessment,” adding that operators can instead reference CISA’s Cybersecurity Performance Goals.

    Why It Matters

    Experts told Cybersecurity Dive that the Cybersecurity Performance Goals are not a substitute for the hands-on, in-person guidance the discontinued assessments provided. Tatyana Bolton, executive director of the OT Cyber Coalition, said “severe budget cuts have forced CISA into a corner where they can no longer provide the level of hands-on, operational support to critical infrastructure that they once did.” The change follows a reported loss of roughly a third of CISA’s workforce and comes as small utilities and rural operators — among the heaviest users of the free assessments — face rising cyber and physical threats with fewer federal resources to call on.

  • Philippine Nuclear and Naval Targets Hit by Suspected Chinese-Speaking Operator

    Philippine Nuclear and Naval Targets Hit by Suspected Chinese-Speaking Operator

    A suspected Chinese-speaking threat actor breached Philippine nuclear research and naval-related organizations by exploiting known vulnerabilities in internet-facing ownCloud and WordPress systems, stealing sensitive data including nuclear reactor component databases and personnel records, according to Security Affairs and independent research from Hunt.io.

    Known Vulnerabilities, High-Value Targets

    The intrusions exploited two previously disclosed vulnerabilities — CVE-2023-49105 and CVE-2024-28000 — rather than a novel zero-day, underscoring how unpatched, internet-exposed systems remain a viable entry point into sensitive government and defense-adjacent networks years after fixes became available. Hunt.io researchers linked the activity to infrastructure including an IP address at 31.58.209[.]241, and found that stolen data was organized using Chinese-language folder and file names, including terms corresponding to “Nuclear Material Accounts” and “IT Planning,” along with code comments and docstrings that strongly suggest the operator is a native Chinese speaker or highly fluent in the language.

    Intelligence Collection, Not Opportunistic Crime

    Researchers characterized the operation as consistent with targeted intelligence collection against high-value defense and scientific institutions rather than financially motivated cybercrime. The theft of nuclear reactor component data and personnel records from two organizations raises particular concern given the sensitivity of nuclear material accounting information, which is typically subject to international safeguards and non-proliferation reporting requirements.

    Recommended Response

    Security Affairs and Hunt.io both recommend that organizations running ownCloud and WordPress promptly apply available patches, upgrade to supported versions, and enforce strong authentication measures given the continued exploitation of these older, publicly known flaws. The incident adds to a broader pattern of suspected Chinese state-linked operators targeting critical infrastructure and defense-adjacent organizations across the Indo-Pacific region, an area of persistent concern for U.S. and allied cybersecurity agencies monitoring pre-positioning activity ahead of potential regional conflict scenarios.

  • Public Transit and Bus Depot Security Technology

    Public Transit and Bus Depot Security Technology

    Public transit systems present a distinct security challenge: they must remain open, accessible and fast-moving for millions of daily riders while simultaneously protecting vehicles, depots, stations and passengers from crime, vandalism and, in rarer cases, deliberate attack. Unlike a controlled-access facility, a transit network is deliberately porous by design, which shapes the technology choices operators make.

    Onboard and Station Video Surveillance

    Modern transit fleets deploy multi-camera systems on every vehicle, covering the driver compartment, passenger cabin, doors and exterior approach zones, with footage typically recorded locally and synchronized to a central video management system whenever the vehicle returns to a depot or passes through a wireless upload zone. Stations and platforms are covered by fixed and pan-tilt-zoom cameras integrated with the same VMS, allowing operators to follow an incident across a rider’s entire journey rather than reviewing disconnected clips from separate systems.

    Depot and Yard Perimeter Protection

    Bus and rail depots concentrate high-value rolling stock, fuel or charging infrastructure, and maintenance facilities in a single location, making perimeter security a priority distinct from the open transit network itself. Depots typically combine fenced perimeters, access-controlled gates, license plate recognition for fleet and visitor vehicles, and video analytics tuned to detect loitering or unauthorized entry after operating hours, when yards are otherwise unattended.

    Real-Time Operator Communication and Panic Alerts

    Driver safety technology has become a growing focus as assaults on transit operators have drawn regulatory and labor attention. Systems now commonly include silent panic buttons that alert dispatch and trigger live video and audio streaming from the vehicle, GPS-based location tracking integrated with computer-aided dispatch, and in some deployments, driver-facing barriers combined with intercom systems that let control center staff communicate directly with passengers without requiring the driver to intervene.

    Access Control for Employee and Maintenance Areas

    Depots and control centers restrict access to maintenance bays, parts storage and operations rooms using badge-based or biometric access control, often layered with visitor management systems for contractors and vendors who require temporary, auditable access to secure areas.

    Integration With City-Wide Public Safety Systems

    Because transit incidents frequently require a coordinated response involving both transit security and municipal police, many agencies now integrate their video and alert systems with city-wide public-safety platforms, allowing real-time video sharing and location data to reach first responders faster than a traditional phone-based incident report would allow.

  • Trump Signs Executive Order Establishing US Space Academy to Build Civil and Military Space Workforce

    Trump Signs Executive Order Establishing US Space Academy to Build Civil and Military Space Workforce

    President Trump signed an executive order on August 28, 2026, establishing a Presidential Commission on the United States Space Academy, a proposed institution intended to train a pipeline of engineers, operators, and service members for civil, military, and commercial space work, according to the White House’s own text of the order and reporting from NASA, CBS News, and Space.com.

    Trump announced the order during an event at NASA’s Johnson Space Center in Houston, where he also awarded the Congressional Space Medal of Honor to the four-person crew of Artemis II. The commission will be chaired by the NASA administrator, with the assistants to the president for economic policy and for science and technology serving as vice chairs; other members include the secretaries of defense and of the Air Force.

    120-Day Deadline for Recommendations

    The order gives the commission 120 days to submit a report recommending a governance framework for the academy, service obligations for graduates, a physical location, and any legislative changes needed to establish it. The initiative reflects growing federal attention to workforce gaps in space-related fields as commercial companies take on work that historically sat inside government agencies, and follows a year of expanded national-security focus on space and satellite infrastructure.

    No timeline for the academy’s opening has been set; officials said that will depend on the commission’s recommendations and any subsequent congressional action.