All news in category “Regulation and Policy Brief”

📰 Texas Attorney General Ken Paxton has sued five TV manufacturers — Sony, Samsung, LG, Hisense, and TCL — alleging they used Automated Content Recognition (ACR) to secretly record and transmit users' viewing activity without consent. The complaints filed in Texas state courts claim some TVs capture screenshots every 500 milliseconds, monitor viewing in real time, and send that data to corporate servers where it is allegedly sold for advertising. Paxton also raised concerns that the China-based vendors may be subject to China's National Security Law, potentially exposing U.S. consumer data to foreign authorities. An LG spokesperson declined to comment on the pending matter; other vendors had not responded at the time of reporting.

⚖️ The essay opposes a proposed ten‑year moratorium and an impending Executive Order that would bar states from regulating artificial intelligence, arguing this would cede power to a few dominant AI firms and undermine local consumer protections. It highlights growing state efforts in places like California, New York, Massachusetts, Utah, and Texas and rejects the industry claim that a regulatory patchwork would fatally stifle innovation. The authors advocate that the federal government should support state-led experimentation and fund public-interest AI models rather than preempt state authority, and note that the President signed an Executive Order shortly after publication.

🔒 The UK National Cyber Security Centre (NCSC) has published a practical playbook urging businesses to embed Cyber Essentials across supply chains and to use its new Supplier Check tool to verify supplier certification (CE or CE Plus). It highlights that firms with turnover under £20m qualify for free cyber‑liability insurance and incident response support when certified. The seven-step guidance covers risk mapping, defining security profiles, setting and enforcing minimum security requirements, incentivizing CE, embedding adoption into procurement and monitoring uptake.

🛡️The NCSC published findings from an Active Cyber Defence 2.0 pilot that evaluated cyber-deception solutions across 121 UK organisations and 14 vendors. The report highlights barriers including inconsistent terminology, a lack of impartial guidance, difficulty producing outcome-based metrics, and risks from misconfiguration. The centre plans large-scale deployment of honeypots, honeytokens and cloud traps and urges planning, continual tuning and peer learning to realise benefits safely.

🛡️ CISA released Cross-Sector Cybersecurity Performance Goals (CPG 2.0) providing measurable actions for critical infrastructure owners and operators to achieve a foundational cybersecurity baseline. The update aligns with the latest NIST Cybersecurity Framework revisions and incorporates lessons learned from recent incidents and threats. CPG 2.0 introduces a governance-focused component that emphasizes accountability, risk management, and the integration of cybersecurity into day-to-day operations. The goals are streamlined and outcome-driven to guide investment, benchmark progress, and reduce risk in measurable ways.

🛡️CISA released version 2.0 of its Cross-Sector Cybersecurity Performance Goals (CPGs), aligning the framework with NIST Cybersecurity Framework 2.0 and three years of operational insights. The update consolidates IT, OT, and IoT goals into unified objectives, adds a new Govern function to strengthen leadership accountability, and expands guidance on zero trust, supply chain risk, and incident communication. CISA presents the streamlined, better-documented goals as practical, measurable, and voluntary actions organizations can adopt regardless of size.

🔎The Financial Conduct Authority (FCA) has launched Firm Checker, a consumer-facing tool to verify whether a financial firm is authorised and whether its contact details match the regulator's records. The FCA says its Financial Services Register contains additional information on firms not covered by the tool, including crypto restrictions, historic fines and permissions. Industry commentators welcomed the move but warned the tool is not a silver bullet and called for broader action to tackle social engineering and money-mule networks.

🔒 Governments in the UK and Portugal have introduced proposals and legislation to provide legal protection for computer security researchers, recognizing that outdated laws can deter responsible vulnerability testing. UK security minister Dan Jarvis proposed amending the 1990 Computer Misuse Act to create a statutory defense for good-faith research that meets defined safeguards. Portugal's new law similarly shields researchers who do not seek financial advantage and who respect data protection rules, aligning with measures already adopted in the Netherlands, France, and Belgium.

🔒 The Chrome Root Program and the CA/Browser Forum have adopted new requirements (Ballots SC-080, SC-090, and SC-091) to phase out 11 legacy Domain Control Validation methods. These deprecated checks — including email, fax, SMS, postal mail, phone-based contacts, and reverse lookup methods — are being retired to reduce the risk of fraudulent certificate issuance. The policies update the TLS Baseline Requirements and encourage stronger, automated, cryptographically verifiable methods such as ACME, with full security value realized by March 2028 while operators transition.

🛡️ The compromise 2026 NDAA directs large new cybersecurity mandates for the Department of Defense, including contract requirements to harden mobile phones used by senior officials and enhanced AI/ML security and procurement standards. It sets timelines (90–180 days) for mobile protections and AI policies, ties requirements to industry frameworks such as NIST SP 800 and CMMC, and envisions workforce training and sandbox environments. The law also funds roughly $15.1 billion in cyber activities and adds provisions on spyware, biologics data risks, and industrial base harmonization.

🧑‍💻 Save the Children’s senior advisor on Protecting Children from Digital Harm summarizes a Google-commissioned study by Livity that centers over 7,000 European teenagers. Teens report technology supports learning and wellbeing when built with a human-first approach and when they can participate in design rather than be cut off. They use AI regularly for schoolwork and creative tasks and call for clear, age-appropriate guardrails, stronger default privacy and safety settings, and AI/media literacy in curricula.

🧑‍💻 A Google‑commissioned study by youth specialists Livity centers the voices of over 7,000 European teenagers to show how adolescents want technology designed with people in mind. Teens report widespread, routine use of AI for learning and creativity and ask for clear, age‑appropriate guidance rather than blanket bans. The report recommends default-on safety and privacy controls, curriculum-level AI and media literacy, clearer reporting and labeling, and parental support programs.

🛡️ The EU directive NIS2, in force in Germany since 06 December 2025, risks becoming a paperwork-heavy exercise unless organisations adopt automation and DevSecOps. The article argues security must be planned and enforced by technology, using Infrastructure as Code, policies-as-code and CI/CD pipelines so controls and evidence (commits, pipeline logs, SBOMs) are revision-proof. Solutions such as CIEM, CNAPP and SIEM can centralise IAM, vulnerability and incident data so auditability is produced by the platform rather than by post-hoc Word documents.

⚠️ CISA and international partner agencies have issued guidance warning that integrating AI into operational technology (OT) for critical infrastructure can introduce new security and safety risks. The guidance highlights threats such as prompt injection, data poisoning, data collection issues, AI drift and hallucinations, as well as human de‑skilling and cognitive overload. It urges adoption of secure design principles, cautious deployment, operator education and consideration of in‑house development to retain long‑term control.

🔒 Portugal has amended its cybercrime law to exempt cybersecurity researchers and ethical hackers from prosecution, with the change published in the Diário da República on 4 December. The amendment, titled “Acts not punishable due to public interest in cybersecurity,” creates a legal exception for good-faith vulnerability research provided strict conditions are met. Researchers must avoid economic gain, refrain from DoS, social engineering, phishing and data theft, report findings to the system owner and the data protection regulator, and delete sensitive data within 10 days of a fix.

🔍 The UK Information Commissioner’s Office (ICO) has asked the Home Office for urgent clarity after a National Physical Laboratory (NPL) report identified racial bias in the retrospective facial recognition (RFR) algorithm Cognitec FaceVACS-DBScan ID v5.5 used by police. The study found far higher false positive rates for Asian (4%) and Black (5.5%) subjects compared with white subjects (0.04%), with an observed disparity between black males (0.4%) and black females (9.9%). Deputy information commissioner Emily Keaney said the ICO was disappointed it had not been informed earlier and stressed that public confidence, transparency and proper oversight are essential while the Home Office moves to operationally test a replacement algorithm.

🔒 A new Check Point brief warns that cyber attacks against the U.S. have evolved into coordinated geopolitical tools employed by states, criminal networks, and ideological groups. These operations now aim to influence policy, erode public trust, and target critical infrastructure rather than being mere technical intrusions. The report urges leaders to prioritize resilience, improve cross-sector coordination, and strengthen information-sharing and recovery capabilities.

🔐 Vaillant CISO Christoph Reiß says rising geopolitical tensions and the professionalization of cybercrime — amplified by accessible AI tools — are elevating the threat to the heating and energy sector. Vaillant relies on a holistic, multilayered security strategy that combines preventative and reactive measures and protects IT, production, and customer products. Employee-focused training, from gamification to practical compliance, is central, and Reiß highlights regulatory complexity (e.g., NIS2, DORA, Cyber Resilience Act) while urging organizations to start, don’t wait on pragmatic implementation.

🛡️ Portugal amended its cybercrime law to create a clear safe harbor for good-faith security research under new Article 8.o-A. The change exempts certain acts that would previously be illegal if performed solely to identify and responsibly disclose vulnerabilities, provided strict conditions are met: immediate notification to the system owner and the CNCS, no excessive financial gain, non-disruptive techniques, GDPR compliance, and deletion of obtained data within ten days of remediation. Tests carried out with owner consent are also covered but still require CNCS notification.

📱 The Senate Committee on Armed Services concluded that unsecured use of non‑approved messaging apps is a wider problem in the Department of Defense. It found that Secretary Pete Hegseth violated policy by sharing operational details on Signal from a personal device two hours before a strike and inadvertently added a journalist to the group. The reports cite broader “shadow communications,” limited audit evidence, and recommend approved alternatives, training, and tighter authority controls.