All news in category “Regulation and Policy Brief”

🔒 The FCC has expanded its Covered List under the Secure and Trusted Communications Networks Act to include all consumer routers manufactured outside the United States, effectively banning the sale of new foreign-made models. The move follows a National Security Determination that identified foreign-produced routers as a significant supply-chain threat and cited recent compromises linked to groups such as Volt, Flax, and Salt Typhoon. The agency permits limited exemptions and an alternative approval path for vendors that transparently disclose ownership, manufacturing, and supply-chain details and commit to onshoring critical component production. Existing routers remain available, but consumers may face reduced model availability and higher prices as certification adds time and cost.

🔐At a Royal United Services Institute event reviewing the Cyber Monitoring Center’s first year, Ciaran Martin questioned whether the UK’s £1.5 billion loan guarantee to Jaguar Land Rover set an unfortunate precedent. He urged a clearer framework — whether compulsory insurance, tax incentives, or defined triggers for state intervention — instead of ad hoc bailouts. Tracey Paul of Pool Re warned of a growing cyber insurance protection gap and argued structured public‑private partnerships are needed to bridge it. Analysts cautioned that blanket government backstops risk creating moral hazard and reducing investment in cyber resilience.

🚨 The head of the UK's National Crime Agency, Graeme Biggar, warned at the launch of the NCA's National Strategic Assessment that online platforms and algorithms are 'radicalizing' teenagers into cybercrime, alongside other harms. He said technology is reshaping crime and that tech companies must take responsibility. Biggar highlighted rising UK-based attackers, surges in online fraud and sextortion, and the creation of the Online Crime Centre to speed data sharing across government and industry.

🔒China is planning to develop national post-quantum cryptography standards within three years, prioritizing finance and energy for early migration. Chinese experts say they favor structureless lattice algorithms over the algebraic lattice designs adopted elsewhere, arguing better long-term security. Organizations should begin hybrid deployments now to reduce 'harvest now, decrypt later' risk and to maintain flexibility for future compliance.

🔒 The FCA has issued clarified rules on reporting cyber-related incidents and supplier outages to give firms greater certainty about what to report and when. The update creates a streamlined regime coordinated with the PRA and the Bank of England, introduces a single reporting portal, removes duplicated reporting for payment service providers and credit rating agencies, and refines required information so most firms can use a short form. Firms have 12 months to prepare; the changes take effect on 18 March 2027.

🔒The Trump administration's ban on Anthropic as a supply-chain risk forces CISOs to locate, isolate, and potentially remove a specific AI model across complex environments. The Pentagon memo gives 180 days and requires contractor certification, but enterprises lack comprehensive inventories and visibility into AI usage. Experts debate whether existing SBOM methods suffice and warn that removal can be disruptive without careful governance.

🚨 The U.S. Department of the Treasury's Office of Foreign Assets Control has sanctioned six individuals and two entities tied to a DPRK-run IT worker scheme that secured remote jobs, stole data, and funneled salaries back to North Korea to finance weapons programs. The operation—tracked as Coral Sleet/Jasper Sleet (also called PurpleDelta/Wagemole)—used stolen identities, fabricated personas, VPN services, and AI-enabled tools to conceal origins, launder funds, and deploy malware or extort victims. OFAC named Amnokgang Technology Development Company and several facilitators, currency converters, and account enablers; security firms and Microsoft warn the campaign leverages Astrill VPN, AI faceswaps, agentic LLM misuse, and offshore operations to maintain persistent, low-cost access.

🔒 Escalating threats and expanding regulation have materially increased corporate exposure to cybersecurity and privacy disputes, with 2025 showing a marked rise in class actions and litigation risk. The piece identifies key drivers for 2026: sophisticated state-sponsored actors using AI, intensified federal initiatives and enforcement, proactive state regulator actions, growing third‑party/vendor risk, and inventive litigation tactics such as qui tam and False Claims Act claims. It urges organizations to revisit fundamentals — data inventories, governance, third‑party oversight, incident response and public statements — to reduce legal and operational exposure.

🔒 The Council of the European Union has sanctioned three companies and two individuals from China and Iran for cyberoperations that targeted devices and critical infrastructure. The measures name Integrity Technology Group (linked to the Raptor Train botnet), Anxun Information Technology (i‑Soon) and Iranian firm Emennet Pasargad. Listed parties face asset freezes and prohibitions on accessing funds, and natural persons are subject to travel bans through EU territory.

🔐 In a March 2026 episode of Brass Tacks, Professor Oreste Pollicino argues that cybersecurity has transitioned from a technical specialty to a constitutional concern that underpins trust and fundamental rights. He warns that fear-driven enforcement undermines cooperation and urges regulators to act as mediators by fostering dialogue, literacy, and mutual learning with the private sector. The episode advocates governance over punishment, calls for harmonization rather than uniformity, and supports naming accountable individuals to enable communication instead of creating scapegoats.

🛡️ Cloudflare is contesting Italy’s Piracy Shield, a regulator-run portal that requires rapid blocking of sites nominated by unnamed media companies, after refusing to register and being fined €14 million. The company says the system lacks due process, transparency, and judicial oversight, routinely causes overblocking, and conflicts with the Digital Services Act. Cloudflare has appealed the fine, sought disclosure of enforcement records, and is pursuing remedies in Italian courts and with EU authorities. It warns the scheme endangers global Internet infrastructure and user rights.

🤝 Google announced it has signed the Industry Accord Against Online Scams & Fraud with major industry partners including Adobe, Amazon, LinkedIn, Meta, Microsoft and OpenAI. The agreement commits participants to unify capabilities, share threat intelligence and coordinate defenses against sophisticated, cross-border scam networks. Google said it will expand technical support and deploy AI-driven detection tools, building on $15 million in Google.org funding. In 2026 the company will share more through the Global Signal Exchange and publish guides on data sharing, private sector referrals to law enforcement, and public policy frameworks.

🔒 The article argues the cyber perimeter was never dead but was abandoned, leaving unsupported firewalls, routers, and remote access appliances as easy footholds for attackers. It outlines the FBI’s Operation Winter SHIELD, a concentrated two-month effort targeting weak authentication, excessive privileges, and unpatched edge devices, and CISA’s BOD 26‑02, which mandates removal of end-of-life perimeter hardware within 18 months. The piece warns that neglecting edge devices undermines identity-first strategies and urges CISOs to regain total edge visibility and enforce disciplined asset lifecycles, strong hardware-based authentication, rapid patching, and strict privilege controls.

⚖️ Police Scotland was fined £66,000 and reprimanded after an Information Commissioner’s Office (ICO) investigation found the force extracted and then mistakenly shared the full contents of a female detective’s phone with the officer she accused of rape. The disclosed material reportedly included intimate photos, medical records and contact details. The ICO said the force failed to limit data sharing, implement appropriate organisational and technical measures, and notify the regulator within the required 72‑hour timeframe.

🔒 The Cybersecurity and Infrastructure Security Agency and MITRE have renegotiated the contract supporting the 26-year-old CVE program, averting the imminent funding cliff that triggered a one-day panic in 2025. Sources indicate the program has been elevated from a discretionary line to a protected budget item within CISA, providing multi-year operational stability. While the move reduces near-term shutdown risk, the agreement remains opaque to many stakeholders and raises outstanding questions about modernization, performance measurement, and governance.

🔒 The Trump Administration published a national cyber strategy on March 6, 2026, presenting a broad framework to strengthen US digital defenses, counter foreign adversaries and accelerate technological innovation. The plan centers on six policy pillars, covering offensive and defensive operations, streamlined cybersecurity and data regulation, federal network modernization, critical infrastructure and supply chain protection, leadership in emerging technologies and workforce expansion. It stresses proactive use of the full range of government tools — including offensive cyber operations, law enforcement and economic sanctions — alongside deeper public–private coordination. Industry leaders welcomed the priorities but warned implementation will depend on funding, contracting vehicles and clear operational authorities.

🔒 The UK government will establish an Online Crime Centre in April to disrupt large-scale cyber-enabled fraud by combining expertise from government, intelligence agencies, police, banks, mobile networks and major tech firms. The centre will identify and shut down scam accounts, websites and phone numbers, block scam texts, freeze criminal accounts and target overseas scam compounds. The strategy also plans to deploy AI for fraud detection and scam-baiting chatbots to gather intelligence, while introducing a new fraud victims charter to standardise support and reimbursements.

🛡️ The German law implementing the NIS-2 directive came into force on 6 December 2025, introducing stricter incident reporting and registration requirements. The Bonn-based Federal Office for Information Security (BSI) reported a surge of more than 4,000 registrations in the final week before the deadline and expects further last-minute filings. Affected organisations must report significant incidents within 24 hours, provide updates within 72 hours and submit a final report after one month, with potential fines for serious violations.

🛡️ The German implementation of the NIS-2 directive came into force on December 6, 2025, prompting a last-minute rush of registrations to the Federal Office for Information Security (BSI). The BSI recorded more than 4,000 new registrations in the final week as organisations checked whether the rules apply to them. The law mandates rapid incident reporting — initial notification within 24 hours, updates within 72 hours and a final report after one month — and serious violations may lead to fines.

⚖️ Advocate General Athanasios Rantos advised that, under PSD2, banks must immediately refund customers for unauthorised transactions resulting from phishing unless the bank has reasonable grounds to suspect the customer committed fraud and communicates those grounds in writing to the competent national authority. Banks may later seek reimbursement if they can prove the customer acted intentionally or with gross negligence. This opinion is advisory, not a final CJEU ruling.