Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

Show NLP summaries collection recirc on article pages

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Bishop vanished. His species can still be saved.

VCU grads walk out during Gov. Youngkin’s speech

Northern lights glow worldwide

Courtroom photo ban adds to hurdles for Trump trial journalists

Israel’s shameful ban on Al Jazeera

Checks, not sex, and other takeaways from Trump’s New York hush money trial

I used to dismiss my mom’s advice. Then I found a note she wrote before she died.  

Photos of his mom at lunch are a balm people didn’t know they needed

Dog hit by car loses leg, is adopted by firefighter who helped her

Eighth-inning decision burns the Nats in a 4-2 loss to the Red Sox

Nats win opener at Fenway behind Patrick Corbin and a lockdown bullpen

Commanders rookie DT Johnny Newton needs a second foot surgery

An unexpected sight to behold: Ted Cruz working bipartisan deals

Narrative of Trump snoozing in court takes hold — much to his annoyance

Manafort will no longer take on Republican convention role

Kristi Noem’s dog killing is pure Southern gothic

Claire Messud turns her family’s history into a masterpiece

Joseph Epstein, conservative provocateur, tells his life story in full

Fooled by AI? These firms sell deepfake detection that’s ‘REAL 100%.’ 

Apple apologizes for iPad ad after blowback 

Google’s new ‘Find My’ device network is useful but a stalking risk

Carolyn Hax: Keep scrolling seven hours per day, or give therapy a try?

Ask Amy: Mother isn’t accepting of her gay son

Ask Amy: What do I say about my former walking buddy who yelled at me?

Tens of thousands in Georgia protest Russian-style ‘foreign agents’ law

Israeli operations in north and south Gaza force displaced to flee again

‘Nothing left’: At least 300 dead as flash floods devastate Afghanistan

5 big travel lessons from an accomplished conservationist

Cruise ship drags dead whale into New York, prompting investigation

The case for eating at Italian gas stations

The urgent air defense lessons of April 16 

Are smartphones destroying childhood? It’s complicated.

In the campaign against Donald Trump, do the ends justify the means?

‘Bunker mentality’ at Columbia lit protest spark that spread nationwide

A mystery illness stole their kids’ personalities. These moms fought for answers.

The greatness — yes, greatness — of the Planet of the Apes

US-POLITICS-BIDEN

See more coverage in your recommendations

Get the weekly Campaign Moment newsletter

Set alerts for major election developments

Election 2024

The Campaign Moment newsletter

Politics alerts

Welcome to The Cybersecurity 202! Today marks my first anniversary at The Washington Post. I also recently hit my 25th year as a professional journalist. It’s all been exciting, entertaining, stressful, educational and fulfilling. Probably a lot more adjectives, too.&nbsp;

Reading this online? <a href="https://www.washingtonpost.com/newsletters/the-cybersecurity-202/">Sign up for The Cybersecurity 202 to get scoops and sharp analysis in your inbox each morning.</a>

Below: GOP lawmakers demand content moderation documents from Meta, and a small typo has caused millions of emails meant for the U.S. military to be sent to Mali. First:&nbsp;

White House unveils new cybersecurity labeling plan to tell you when your smart devices are secure

Demetrius Freeman

The Biden administration is rolling out a voluntary program today to label internet of things devices — like smart refrigerators and baby monitors &nbsp;— if they meet cybersecurity benchmarks, similar to the Energy Star labeling program for energy-efficient products.

“We now routinely rely on internet and Bluetooth-enabled devices for tasks as basic as adjusting our thermostat or as complex as securing our homes while we’re away,” Anne Neuberger, deputy national security adviser for cyber and emerging technology at the National Security Council, told reporters Monday in advance of a White House event. “Poorly secured products enable attackers to gain a foothold in American homes and offices, and steal data or cause disruption.”

Device makers and sellers, from Best Buy to Samsung, will be at the event today to show support for the program proposed by the Federal Communications Commission, dubbed U.S. Cyber Trust Mark.

The steps the Biden administration is announcing go back to May of 2021, when <a href="https://www.washingtonpost.com/politics/2021/05/13/cybersecurity-202-biden-administration-issues-executive-order-wake-pipeline-attack/">an executive order</a> that the president signed directed agencies to carry out tests of a labeling initiative. If all goes as planned, the program will be operating in 2024, according to a Biden administration press release.

The most infamous cyber incident involving the internet of things (IoT) <a href="https://www.washingtonpost.com/news/the-switch/wp/2016/10/21/someone-attacked-a-major-part-of-the-internets-infrastructure/">occurred in 2016</a>, when the Mirai malware took over and weaponized IoT devices to carry out a distributed denial of service attack that knocked popular websites like Netflix and Twitter offline. In another case, hackers demonstrated in 2015 that they could get into an internet-connected Jeep and remotely target important elements <a href="https://www.washingtonpost.com/politics/2022/10/18/cars-face-cyber-threats-too/">of the vehicle</a> like its braking system.

The Trust Mark label will go to products that demonstrate common safeguards, like software updates and unique, strong default passwords, <a href="https://csrc.nist.gov/publications/detail/nistir/8425/final">as spelled out</a> by the National Institute of Standards and Technology in September.

Agencies will take several steps as part of today’s announcement:

The FCC will commence a rulemaking process, as well as apply for a national trademark with the U.S. Patent and Trademark Office that would be applied to products that meet the cyber criteria. The commission will use a QR code that links to a national registry of certified devices.

The Justice Department will collaborate with the FCC on oversight of the program to determine what kind of liability a labeled company would have if they don’t meet the cybersecurity standards, or to provide liability shields for companies that do, according to a senior FCC official who spoke on the condition of anonymity to discuss the program in advance of its announcement.

NIST will work to define cyber requirements for consumer-grade routers by the end of this year, in advance of possibly expanding the labeling program to include those routers. The Energy Department will do the same, in partnership with the National Labs and industry, on labeling smart meters and power inverters.

The State Department will work with other countries on harmonizing standards. Beyond the Energy Star inspiration, the program follows countries like Germany and Singapore that have begun cybersecurity labeling schemes.

“Consumers are going to be beneficiaries because they are going to be able to make informed purchasing decisions when they see this mark; they can have peace of mind with the products that they're bringing into their homes adhere to widely accepted security and privacy standards,” said Jessica Rosenworcel, chairwoman of the FCC. “And product manufacturers are also beneficiaries because they are going to be able to differentiate their offerings in the marketplace when they meet these standards.”

Multiple industry associations that will appear at the White House event, such as the Information Technology Industry Council and Consumer Technology Association (CTA), signaled their support in advance of the rollout.

“Research shows consumers want more information on the safety and security of their connected devices, and we agree,” said Gary Shapiro, CEO of the CTA.

Labeling initiatives haven’t always proven flawless or garnered support from across the political spectrum.

<a href="https://www.gao.gov/assets/files.gao.gov/assets/gao-10-470.pdf">A 2010 GAO investigation</a> made up four fake companies and submitted them to the Energy Star certification program, and found that Energy Star only required four of the 20 total products to be verified by an independent third party — and got Energy Star qualifications for things like a gas-powered alarm clock. It rejected two and didn’t answer three others. The Environmental Protection Agency later took steps to address such fraud.

The FCC official said the cyber labeling rulemaking process will include looking into criteria for carrying out tests products must pass to obtain certification.

The Trump administration also took aim at Energy Star with the support of free-market think tanks, but wasn’t able to kill it despite cutting its budget.

“This gets back to what is a legitimate function of government,” Nicolas Loris, a research fellow at the Heritage Foundation, said in <a href="https://www.latimes.com/politics/la-na-pol-trump-energy-star-20170412-story.html">a 2017 Los Angeles Times story</a>. “I don’t see Energy Star as one of those things.”

Energy Star-certified homes are at least 10 percent more energy efficient than homes built to code, <a href="https://www.energystar.gov/about/how_energy_star_protects_environment/energy_efficiency">according to its website</a>. So does that mean the cyber label will make homes 10 percent safer from cyberattacks?

“We’re hoping it’s potentially a lot more than 10 percent, but it’s probably too early to tell,” said a senior administration official, speaking on the condition of anonymity to discuss the program in advance of its announcement.

Small typo for years caused millions of emails meant for U.S. military to be sent to Mali

Jabin Botsford

Millions of emails intended for Pentagon personnel have been inadvertently sent to email accounts in Mali over the past decade because of a typo that stems from similar email domain names, Jacob Judah, Chris Cook, Mehul Srivastava, Max Harlow and Felicia Schwartz <a href="https://www.ft.com/content/ab62af67-ed2a-42d0-87eb-c762ac163cf0">report for Financial Times</a>.&nbsp;

They write: “Despite repeated warnings over a decade, a steady flow of email traffic continues to the .ML domain, the country identifier for Mali, as a result of people mistyping .MIL, the suffix to all US military email addresses.”

Johannes “Joost” Zuurbier, a Dutch internet entrepreneur, was contracted to work with Mali’s internet domain and discovered the “typo leak” that has exposed sensitive U.S. military data a decade ago.

None of the emails are classified, but some appear to be sensitive. For example, one misdirected email included the hotel and travel itinerary of a U.S. Army general and his delegation to Indonesia this year. Other sensitive emails across the board include diplomatic documents, passwords and tax returns.

“Zuurbier has been collecting misdirected emails since January in an effort to persuade the US to take the issue seriously. He holds close to 117,000 misdirected messages — almost 1,000 arrived on Wednesday alone,” according to the report.&nbsp;

It adds: “In a letter he sent to the US in early July, Zuurbier wrote: ‘This risk is real and could be exploited by adversaries of the US.’”

“If you have this kind of sustained access, you can generate intelligence even just from unclassified information,” Mike Rogers, a retired U.S. admiral who formerly ran the National Security Agency and U.S. Cyber Command, told FT.

GOP lawmakers demand content moderation documents from Meta

Shuran Huang

House Judiciary Chair Jim Jordan (R-Ohio) asked Meta CEO Mark Zuckerberg for documents concerning content moderation on its newly launched Threads platform, <a href="https://www.cnbc.com/2023/07/17/house-judiciary-expands-social-media-inquiry-to-metas-threads-.html">Lauren Feiner reports for CNBC</a>.

The request is related to an earlier subpoena from the House panel that’s exploring tech companies’ contact with the Biden administration over content moderation decisions.

Feiner writes: “The letter, obtained exclusively by CNBC, is an early indication of the added spotlight Meta’s newest product could bring to the company in Washington. Threads competes directly with Twitter, which owner Elon Musk wants to shape with his self-declared free speech absolutism in mind, despite at times suspending users including journalists.”

“Indeed, Threads raises serious, specific concerns because it has been marketed as [a] rival of Elon Musk’s Twitter, which has faced political persecution from the Biden Administration following Musk’s commitment to free speech,” Jordan wrote.&nbsp;

Meta’s Threads notably aims to be less focused on news and politics, as our colleague Naomi Nix <a href="https://www.washingtonpost.com/technology/2023/07/14/threads-algorithm-content-moderation/?itid=lk_inline_manual_62">previously reported</a>.

The State Department earlier this month <a href="https://www.washingtonpost.com/technology/2023/07/05/missouri-biden-judge-censorship-ruling-analysis/">canceled a meeting</a> with Facebook to discuss 2024 election preparations and hacking threats, following a judge’s decision to impose limits on the Biden administration’s communications with tech firms. That decision has since been temporarily paused by an appeals court.&nbsp;

NSC urges waiting on FBI investigation details into Microsoft government intrusion

National Security Council spokesperson John Kirby said that an FBI investigation into a China-linked intrusion of Microsoft government email systems is not yet finished and that officials will continue to monitor fixes into the incident to make sure they are working.

Previous reports link the origin of the attack to a Chinese state-linked hacking group, and Kirby notably said there is “no reason” to doubt Microsoft’s previous attribution of the hack.

“Does that mean that you can prevent every single [attack] of every single nature? No, I mean some, unfortunately, sometimes they get through, but it’s not for lack of trying,” he said.

The hackers since May had leveraged a Microsoft digital key and a code flaw to <a href="https://www.washingtonpost.com/national-security/2023/07/12/microsoft-hack-china/">break into</a> the emails of U.S. government agencies and other clients, including the email account of Commerce Secretary Gina Raimondo, as well as State Department accounts.&nbsp;

The breach has put Microsoft’s security practices under scrutiny at a time when some in Congress are growing increasingly concerned about the Pentagon’s <a href="https://www.newsweek.com/pentagons-microsoft-monopoly-raises-cybersecurity-concerns-congress-dod-defense-1804884">heavy utilization</a> of Microsoft products.&nbsp;

<a href="https://therecord.media/senate-dea-bill-targets-end-to-end-encryption-requires-companies-to-report-drugs" target="_blank">Senate bill crafted with DEA targets end-to-end encryption, requires online companies to report drug activity (The Record)</a>

<a href="https://apnews.com/article/france-surveillance-digital-devices-suspects-6018bdb2aee36ef373209555f5ec0019" target="_blank">Bill that would allow French police to locate suspects by tapping their devices is up for a vote (Associated Press)</a>

<a href="https://www.itnews.com.au/news/australian-government-to-vet-5g-6g-security-in-new-lab-598083" target="_blank">Australian government to vet 5G, 6G security in new lab (IT News)</a>

<a href="https://www.theregister.com/2023/07/17/great_firewall_even_greater/" target="_blank">Xi wants to make the Great Firewall of China even greater (The Register)</a>

<a href="https://www.infosecurity-magazine.com/news/eu-prepare-quantum-cyber-attacks/" target="_blank">EU urged to prepare for quantum cyber-attacks (Infosecurity Magazine)</a>

<a href="https://www.securityweek.com/moveit-hack-number-of-impacted-organizations-exceeds-340/" target="_blank">MOVEit hack: Number of impacted organizations exceeds 340 (SecurityWeek)</a>

<a href="https://techcrunch.com/2023/07/17/the-spam-bots-have-now-found-threads-as-company-announces-its-own-rate-limits/?guccounter=1" target="_blank">The spam bots have now found Threads, as company announces its own 'rate limits' (TechCrunch)</a>

Acting national cyber director Kemba Walden and other cyber officials speak at a <a href="https://resources.trendmicro.com/R2R-WT23-WashingtonDC.html?utm_campaign=GBEV2023_NABU_R2RWT&amp;utm_medium=Email&amp;utm_source=MKTO_Invite_CU&amp;utm_content=Register">Chamber of Commerce event</a> on federal cybersecurity standards beginning at 10 a.m.

The Center for Strategic and International Studies convenes a <a href="https://www.csis.org/events/future-quantum-developing-system-ready-quantum">discussion</a> on the future of quantum computing at 11:30 a.m.

The House Energy and Commerce Committee <a href="https://energycommerce.house.gov/events/oversight-and-investigations-subcommittee-hearing-examining-emerging-threats-to-electric-energy-infrastructure">holds a hearing</a> on threats to electric energy infrastructure at 2 p.m.

The Institute for Security and Technology <a href="https://us02web.zoom.us/webinar/register/3516886788995/WN_E9RXxFYGR_C_KnjbvTSraw#/registration">holds a webinar</a> on the open-source software ecosystem at 3 p.m.

Thanks for reading. See you tomorrow.

2022 American Society of Business Publication Editors, Bronze National Award, Government Coverage

2022 American Society of Business Publication Editors, Silver Regional Award, Government Coverage

2022 American Society of Business Publication Editors, Bronze Regional Award, Single Topic Coverage by a Team

2022 Society of Professional Journalists Washington, D.C., Chapter, Finalist, Staff

2021 Best in Business Awards, Honorable Mention, Technology, Small Division (for editing role)

2009 National Press Club Sandy Hume Memorial Ward for Excellence in Political Journalism

2001 Indiana Associated Press Managing Editors, 1st Place, Non-Deadline News Reporting (with another reporter)

2001 Hoosier State Press Association, 3rd Place, Business Writing (team project)

University of Southern Indiana, BA in Print Journalism

Tim Starks is the author of the Cybersecurity 202 newsletter at The Washington Post. He previously served as senior editor at CyberScoop and ran Politico's cybersecurity newsletter. The Evansville, Ind., native also has held reporting roles for CQ Roll Call, the New York Sun and the Evansville Courier & Press.

Tim Starks

George Washington University, BBA in business analytics

Georgetown University, MS in business analytics

David DiMolfetta researches The Cybersecurity 202 and The Technology 202, the morning newsletters at The Washington Post keeping readers up to date on cybersecurity and technology policy.

David DiMolfetta

washpost

The Washington Post

White House

staff

name

prism://prism.query/site-and-tag,/politics/powerpost,cybersecurity202&limit=20

Your daily guide to cybersecurity news and policy, by reporter Joseph Marks.

The Cybersecurity 202

A newsletter briefing on cybersecurity news and policy.

https://newsletter-imgs.s3.amazonaws.com/prod/the-202s/primary/cybersecurity.svg

https://newsletter-imgs.s3.amazonaws.com/prod/the-202s/secondary/cybersecurity.svg

Your daily guide to cybersecurity news and policy, by reporter Tim Starks.

prism://prism.query/site,/us-policy/cybersecurity-policy&limit=20

Cybersecurity Policy

prism://prism.query/site,/politics/powerpost&limit=20

The 202s

The 202s - The Washington Post

PowerPost, by The Washington Post, delivers essential intelligence for D.C. decision-makers.

THE 202s

/politics/powerpost/the-cybersecurity-202

The Cybersecurity 202;Cybersecurity Policy;THE 202s