Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

Show NLP summaries collection recirc on article pages

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

France tries to shed its rude reputation ahead of the Olympics

Don’t be a jerk at the airport: A guide for headphones

The new cure-all for vacation excess: the IV drip 

Middle East conflict live updates: WHO says health services in south Gaza will run out of fuel in three days

Commerce Department revokes more export licenses to China’s Huawei

U.S. signals optimism for Gaza cease-fire as Israel moves into Rafah 

In Arizona, election workers trained with deepfakes to prepare for 2024

Election 2024 latest news: Biden back in the battleground state of Wisconsin

How Trump’s allies amplify his Truth Social messages to the wider world

Nats go over .500 the hard way by beating the O’s and Corbin Burnes

A look at what has changed since the Nationals were last above .500

Baseball can crush rookies. Why hasn’t it crushed Trey Lipscomb?

‘Look at the U.S.A.’: A photographer’s reflection on post-9/11 conflict

In photos: The scene after tornadoes struck Michigan and Oklahoma 

The FTC’s noncompete clause rule goes too far

The next global crisis could come from the sun. We should prepare now.

The crisis Biden and Trump don’t want to deal with

RFK Jr’s ‘history lesson’ on Russia’s invasion of Ukraine flunks the fact test

The Trump-Biden battle over the 2017 tax cut

That time football legend, rig-driving eligible bachelor Biden was arrested

Postal worker finds WWII-era letters, drives 5 hours to deliver them

Strangers help Sesame Street puppeteer after heirloom necklace was stolen

Teen grabs wheel when driver passes out and school bus veers into traffic

A college professor wants to use Section 230 against Big Tech

Apple plays up AI potential in new iPads

Ask Amy: I want to be closer with my brother. He never reaches out to me.

Miss Manners: I’m offended by a golfer’s skirt choice

Carolyn Hax: Family pushes siblings to ‘make amends’ after their mother’s death

In court, Stormy Daniels pulled a Trump on Trump 

Social Security has to be fixed. But you still need your own savings.

An I bond is now at 4.28 percent. Are they still a good deal?

Use these 6 points to say no to a college you and your kid can’t afford

US-VOTE-POLITICS-ECONOMY-BIDEN

See more coverage in your recommendations

Get the weekly Campaign Moment newsletter

Set alerts for major election developments

Election 2024

The Campaign Moment newsletter

Politics alerts

Good morning! I’m Ellen Nakashima, a national security reporter at The Post who covers national security and intelligence issues. You can follow me on <a href="https://bsky.app/profile/ellenwapo.bsky.social">Bluesky</a>, <a href="https://mastodon.sdf.org/@WaPoEllen">Mastodon</a> or <a href="https://twitter.com/nakashimae">X</a>.&nbsp;

Was this forwarded to you? <a href="https://www.washingtonpost.com/newsletters/the-cybersecurity-202/">Sign up here.</a>

Below: The U.K. denies a report on nuclear site hacking, and U.S. agencies fall behind on meeting federal cybersecurity requirements. First:

Clandestine online operations now require sign-off by senior officials

Charles Dharapak

Following a controversy over the Pentagon’s use of clandestine information operations, the U.S. military has eliminated dozens of false online personas it created in recent years and has curtailed the use of such operations overseas, according to senior defense officials.

Clandestine online operations now require sign-off by senior Pentagon officials, the CIA and the State Department, according to the officials, who spoke Monday on the condition of anonymity because of the matter’s sensitivity.

The new policy follows a review and pause initiated last year by the undersecretary of defense for policy, Colin Kahl, who stepped down in July. His review, <a href="https://www.washingtonpost.com/national-security/2022/09/19/pentagon-psychological-operations-facebook-twitter/">first reported</a> by The Washington Post, was prompted by an outcry following the publication of an <a href="https://graphika.com/reports/unheard-voice">August 2022 report</a> by internet researchers Graphika and Stanford Internet Observatory. The researchers revealed takedowns by platforms including Facebook and Twitter — now called X — of more than 150 bogus personas and media sites, and suggested that the accounts might have been created by the U.S. military.

In the wake of the review, “new levels of oversight — to include coordination within the interagency — is now being applied to the department’s MISO activities,” said a Pentagon spokesperson, Lisa Lawrence, referring to military information support operations, the Pentagon’s term for psychological or information operations.

The Post confirmed with U.S. officials last year that many of the accounts examined by the researchers were indeed used by the U.S. military, and in particular U.S. Central Command (Centcom), whose area of operations includes the Middle East, North Africa, and Central and South Asia.

Some of the accounts taken down included a made-up Persian-language media site that shared content reposted from the U.S.-funded Voice of America Farsi and Radio Free Europe. One fake account posted an inflammatory tweet claiming that relatives of deceased Afghan refugees had reported bodies being returned from Iran with missing organs. The tweet linked to a video that was part of an article posted on a U.S.-military affiliated website.

If such accounts are unmasked as being the work of the U.S. government seeking to impersonate grass-roots activists, it could erode — or further erode — the United States’ credibility abroad with target audiences in the developing world, U.S. officials said.

Combatant commands continue to undertake information operations online using identifiable U.S. military accounts. But the practice of deploying sham accounts to attempt to influence overseas audiences has been dramatically reduced, senior Pentagon officials said. “It’s nowhere near the volume it was previously now that there’s oversight and greater scrutiny given to all of them,” said one official.

The operations by Centcom, which had taken place within the past several years, did not gain much traction, according to Graphika and Stanford Internet Observatory. The campaigns involved posts, for instance, that advanced anti-Russia narratives and cited the Kremlin’s “imperialist” war in Ukraine and warning of the conflict’s direct impact on Central Asian countries.

The researchers concluded that the military’s overt accounts actually attracted more followers. Such overt, attributed activity forms the bulk of MISO.

Indeed, said the Pentagon officials, military psychological operations “should not go away but we just need to make sure it’s being done judiciously and lawfully.”

In July, the Defense Department issued an <a href="https://media.defense.gov/2023/Nov/17/2003342901/-1/-1/1/2023-DEPARTMENT-OF-DEFENSE-STRATEGY-FOR-OPERATIONS-IN-THE-INFORMATION-ENVIRONMENT.PDF">updated information operations strategy</a>, which did not address clandestine activity. In general, it said that “a coherent” information operations strategy “requires a clear understanding of the drivers that shape” audiences’ perceptions and that the intelligence community must “gain a better grasp on the motivations that drive behaviors.” Only once that is done can “informational power … be effectively applied.”

U.K. denies Guardian report of Sellafield nuclear site hacking

Christopher Furlong

Britain denied reporting from the Guardian that the nation’s Sellafield nuclear site was breached by Russia- and China-linked hackers.

The <a href="https://www.theguardian.com/business/2023/dec/04/sellafield-nuclear-site-hacked-groups-russia-china">Dec. 4 report</a> claims that hackers as far back as 2015 have deployed malware on Sellafield’s systems and that some of the site’s most sensitive activities, like moving radioactive waste and monitoring for dangerous material leaks, have been compromised.

The British government <a href="https://www.reuters.com/world/uk/britain-says-no-evidence-sellafield-nuclear-site-has-been-hacked-2023-12-04/">denied</a> the reporting in a statement to Reuters. “Our monitoring systems are robust and we have a high degree of confidence that no such malware exists on our system,” the U.K. said. “This was confirmed to the Guardian well in advance of publication, along with rebuttals to a number of other inaccuracies in their reporting,” the statement added.

The original Guardian report said that “it is likely foreign hackers have accessed the highest echelons of confidential material at the site, which sprawls across 6 sq km (2 sq miles) on the Cumbrian coast and is one of the most hazardous in the world.” The outlet said the claim was corroborated by unnamed sources.

The findings come amid a <a href="https://www.theguardian.com/business/series/nuclear-leaks">broader investigation</a> from the outlet about safety and security lapses at the nuclear site, which made plutonium for Britain’s nuclear weapons program during the Cold War.

Sellafield was designated as an entity that failed to consistently meet robust cybersecurity measures, the Guardian adds, citing sources at the Office for Nuclear Regulation (ONR) and the security services.

“Some specific matters are subject to ongoing investigations, so we are unable to comment further at this time,” a spokesperson told the outlet. The Guardian noted that the spokesperson confirmed that Stellafield wasn’t meeting cyber standards.

ONR gave a similar perspective to Reuters, saying it did not see evidence of state-affiliated hackers breaching the site’s systems but that, broadly speaking, it was not meeting cyber standards set by regulators.

“In a statement, Sellafield also declined to comment about its failure to tell regulators, instead focusing on the improvements it says it has made in recent years,” according to the Guardian.

Around half of 23andMe users affected in breach

Around 6.9 million users — &nbsp;number far greater than the scope of accounts initially hacked — were affected in an incident targeting 23andMe users in October, <a href="https://techcrunch.com/2023/12/04/23andme-confirms-hackers-stole-ancestry-data-on-6-9-million-users/">TechCrunch’s Lorenzo Franceschi-Bicchierai reports</a>. A chunk of the data — on 5.5 million users who opted in to a data-sharing feature called DNA Relatives, which lets users share some ancestry data — included “the person’s name, birth year, relationship labels, the percentage of DNA shared with relatives, ancestry reports and self-reported location,” Franceschi-Bicchierai writes.

“In disclosing the incident in October, 23andMe said the data breach was caused by customers reusing passwords, which allowed hackers to brute-force the victims’ accounts by using publicly known passwords released in other companies’ data breaches,” Franceschi-Bicchierai writes.

The new figures indicate that about half of the company’s customers were affected in the incident.&nbsp;

Besides the 5.5 million users, 23andMe said that another group of around 1.4 million users who opted in to DNA Relatives had family tree information accessed during the breach, Franceschi-Bicchierai reports.

The company is “in the process of providing notification to users impacted by the incident as required by applicable law,” the company said in an <a href="https://www.sec.gov/ix?doc=/Archives/edgar/data/1804591/000119312523287449/d242666d8ka.htm">SEC filing</a> on Friday. The company required all users to reset their passwords earlier this year, and last month required all users to use multifactor authentication, according to the filing.

In October, a hacker claimed to have <a href="https://www.wired.com/story/23andme-credential-stuffing-data-stolen/">stolen and published</a> data from the site, mostly from people of Ashkenazi Jewish ancestry. The hacker offered the data for sale online. The company said in the SEC filing that it was working to remove the data “from the public domain,” and that as of the date of the filing, “the Company believes that the threat actor activity is contained.”

In October, our colleague Joseph Menn notably <a href="https://www.washingtonpost.com/technology/2023/10/06/23andme-hacked-data/?itid=lk_inline_manual_57">reported</a> that the data pilfered from 23andMe “could cover more than half of the company’s 14 million customers, based on the number of people who have opted to make their data visible to relatives, including distant cousins.”

Several agencies falling behind in meeting OMB cyber priorities, report finds

Sarah Silbiger

A U.S. Government Accountability Office report <a href="https://www.gao.gov/products/gao-24-105658?utm_campaign=usgao_email&amp;utm_content=topci_infosec&amp;utm_medium=email&amp;utm_source=govdelivery">released Monday</a> says that while several federal agencies have been working to boost their cybersecurity posture, 20 have not fully met requirements for event logging, in which cyber incidents are logged and retained.

“The Office of Management and Budget (OMB) required agencies to reach the advanced (tier 3) level by August 2023. The tier 3 level means that logging requirements at all criticality levels are met,” the GAO report says. But just three of the 23 agencies designated under <a href="https://www.cio.gov/handbook/it-laws/cfo-act/#:~:text=The%20CFO%20Act%20gave%20OMB,systems%2C%20and%20strengthening%20financial%20reporting.">more stringent OMB management</a> have met that third-tier level, the findings state.

Logging has become a major topic of discussion in cyber circles, following hacks reported in July that were carried out by Chinese cyber operatives and that <a href="https://www.washingtonpost.com/national-security/2023/07/12/microsoft-hack-china/?itid=lk_inline_manual_63">breached the email accounts</a> of federal officials in the State Department and Commerce Department.&nbsp;

Lack of staff, technical challenges and limitations in cyberthreat information sharing have made it more difficult for agencies to adopt optimal cybersecurity practices, the GAO adds. Agencies were expected to analyze and adopt the third-tier standards by an August deadline.

The nearly <a href="https://www.gao.gov/assets/d24105658.pdf">80-page report</a> also details that all 23 of the agencies have begun endpoint detection and response frameworks that seek to detect digital threats across entire networks.

<a href="https://www.cnn.com/2023/12/04/politics/manuel-rocha-us-ambassador-charged/index.html" target="_blank">Former US ambassador to Bolivia charged with being a covert agent of Cuba’s government (CNN)</a>

<a href="https://www.reuters.com/world/us/fbi-chief-urge-senate-panel-renew-us-global-surveillance-power-2023-12-05/" target="_blank">FBI chief to urge Senate panel to renew U.S. global surveillance power (Reuters)</a>

<a href="https://www.nextgov.com/cybersecurity/2023/12/house-bill-looks-shore-federal-cyber-workforce/392465/" target="_blank"> House bill looks to shore up federal cyber workforce (Nextgov/FCW)</a>

<a href="https://www.politico.com/news/2023/11/30/wyden-block-senate-vote-nsa-cyber-command-00129432" target="_blank">Wyden to block Senate vote on new NSA, Cyber Command lead (Politico)</a>

<a href="https://www.404media.co/asking-chatgpt-to-repeat-words-forever-is-now-a-terms-of-service-violation/" target="_blank">Asking ChatGPT to repeat words ‘forever’ is now a terms of service violation (404 Media)</a>

<a href="https://cyberscoop.com/cisa-fbi-epa-water-unitronics/" target="_blank">Feds: Iran-linked hacking campaign a 'clarion call' for digital defenses (CyberScoop)</a>

<a href="https://www.nextgov.com/artificial-intelligence/2023/12/human-operators-must-be-held-accountable-ais-use-conflicts-air-force-secretary-says/392457/?oref=ng-home-top-story" target="_blank">Human operators must be held accountable for AI’s use in conflicts, Air Force secretary says (Nextgov/FCW)</a>

<a href="https://english.elpais.com/international/2023-12-05/witness-in-pegasus-case-accuses-pena-nieto-of-ordering-spying-operation-on-carlos-slim.html" target="_blank">Witness in Pegasus case accuses Peña Nieto of ordering spying operation on Carlos Slim (El País)</a>

<a href="https://www.reuters.com/technology/cybersecurity/japanese-tech-lobby-warns-against-eu-cybersecurity-labelling-scheme-2023-12-05/" target="_blank">Japanese tech lobby warns against EU cybersecurity labelling scheme (Reuters)</a>

<a href="https://www.vice.com/en/article/wxjb9n/how-online-fights-affect-real-world-battlefields" target="_blank">How online fights affect real world battlefields (Motherboard)</a>

<a href="https://venturebeat.com/security/hugging-face-dodged-a-cyber-bullet-with-lasso-securitys-help/" target="_blank">Hugging Face dodged a cyber-bullet with Lasso Security’s help (VentureBeat)</a>

<a href="https://www.cnn.com/2023/12/01/politics/ransomware-attack-credit-unions/index.html" target="_blank">Ransomware attack causes outages at 60 credit unions, federal agency says (CNN)</a>

<a href="https://arstechnica.com/cars/2023/12/automakers-data-privacy-practices-are-unacceptable-says-us-senator/" target="_blank">Automakers’ data privacy practices “are unacceptable,” says US senator (Ars Technica)</a>

<a href="https://www.bloomberg.com/news/articles/2023-12-04/tiktok-videos-reanimating-hamas-victims-spur-deepfake-challenge?srnd=technology-vp" target="_blank">TikTok struggles to take down deepfake videos of Hamas’ victims (Bloomberg News)</a>

ODNI Intelligence Community CIO Adele Merritt and others speak at a <a href="https://www.gdit.com/perspectives/emerge-quantum/">General Dynamics Information Technology discussion</a> on quantum computing beginning at 8 a.m.

The German Marshall Fund <a href="https://www.gmfus.org/event/russias-cyber-war-against-ukraine-lessons-and-policy-challenges">convenes a discussion</a> on Russian cyberwarfare against Ukraine at 9 a.m.

FBI Director Christopher A. Wray <a href="https://www.judiciary.senate.gov/committee-activity/hearings/12/05/2023/oversight-of-the-federal-bureau-of-investigation">testifies</a> to the Senate Judiciary Committee at 10 a.m.

The House Homeland Security Committee <a href="https://homeland.house.gov/hearing/identity-management-innovation-looking-beyond-real-id/">holds a hearing</a> on identity management innovation at 2 p.m.

The House Energy and Commerce Committee <a href="https://energycommerce.house.gov/events/full-committee-markup-of-44-pieces-of-legislation">marks up</a> a slew of spectrum, privacy and tech bills at 2 p.m.

Thanks for reading. See you tomorrow.

Pulitzer Prize for Public Service, 2014

Gerald Loeb Award 2014, NSA stories

Society of American Business Editors and Writers enterprise award 2009, for the story "Banking Regulator Played Advocate over Enforcer"

Daily Californian Alumni Association Alumna of the Year, 2017

Pulitzer Prize for reporting on Russian interference in the 2016 presidential election, 2018

Pulitzer Prize for Public Service in 2022 for an investigation of the Jan. 6 assault on the U.S. Capitol

The Prince of Tennessee

City University, London, MA in international journalism

University of California at Berkeley, BA in humanities

Ellen Nakashima is a national security reporter with The Washington Post. She was a member of three Pulitzer Prize-winning teams, in 2022 for an investigation of the Jan. 6 assault on the U.S. Capitol, in 2018 for coverage of Russia's interference in the 2016 election, and in 2014 and for reporting on the hidden scope of government surveillance. 



Ellen Nakashima

George Washington University, BBA in business analytics

Georgetown University, MS in business analytics

David DiMolfetta researches The Cybersecurity 202 and The Technology 202, the morning newsletters at The Washington Post keeping readers up to date on cybersecurity and technology policy.

David DiMolfetta

washpost

The Washington Post

Cybersecurity Pentagon Internet Mystery

name

prism://prism.query/site-and-tag,/politics/powerpost,cybersecurity202&limit=20

Your daily guide to cybersecurity news and policy, by reporter Joseph Marks.

The Cybersecurity 202

A newsletter briefing on cybersecurity news and policy.

https://newsletter-imgs.s3.amazonaws.com/prod/the-202s/primary/cybersecurity.svg

https://newsletter-imgs.s3.amazonaws.com/prod/the-202s/secondary/cybersecurity.svg

Your daily guide to cybersecurity news and policy, by reporter Tim Starks.

prism://prism.query/site,/us-policy/cybersecurity-policy&limit=20

Cybersecurity Policy

prism://prism.query/site,/politics/powerpost&limit=20

The 202s

The 202s - The Washington Post

PowerPost, by The Washington Post, delivers essential intelligence for D.C. decision-makers.

THE 202s

/politics/powerpost/the-cybersecurity-202

The Cybersecurity 202;Cybersecurity Policy;THE 202s