Subject: Legislation introduced to safeguard personal information
Source: Homeland Preparedness News
https://homelandprepnews.com/stories/83402-legislation-introduced-to-safeguard-personal-information/
U.S. Sen. Rand Paul (R-KY), chair of the Senate Homeland Security and Governmental Affairs Committee, introduced legislation this week that would repeal a federal mandate for states to share citizens’ personal data.The Safeguarding Personal Information Act of 2025 would effectively eliminate the Real ID across the country. If passed the bill would repeal the federal mandate requiring states to redesign their driver’s licenses to meet federal standards. Paul said the legislation would eliminate the implementation of a de facto national identification mandate.
“REAL ID is effectively creating a national ID card with no limit on the personal information being shared between all 50 states, the District of Columbia, possessions, and territories,” Paul said. “My bill repeals this dangerous mandate and restores the privacy, due process, and First Amendment rights stripped away in 2005. The government should not have a dossier on every American. You should never have to ‘show your papers’ to travel freely within your own country or enter a building your tax dollars paid for.”
Subject: AI risks can’t be avoided, must be managed, NIST official says
Source: FedScoop
https://fedscoop.com/ai-risks-cant-be-avoided-must-be-managed-nist-official/
Deploying artificial intelligence requires taking on the right amount of risk to achieve a desired end result, a National Institute of Standards and Technology official who worked on its risk management framework for the technology said on a panel this week. While federal agencies, and particularly IT functions, are generally risk averse, risks can’t entirely be avoided with AI, Martin Stanley, an AI and cybersecurity researcher at the Commerce Department standards agency, said during a Wednesday FedInsider panel on “Intelligent Government.” “You have to manage risks, number one,” Stanley said, adding that the benefits from the technology are compelling enough that “you have to go looking to achieve those.”
Stanley’s comments came in response to a question about how the federal government compares to other sectors that have been doing risk management for longer, such as financial services. On that point specifically, he said the NIST AI Risk Management Framework “shares a lot of DNA” with Federal Reserve guidance on algorithmic models in financial services.
He said NIST attempted to leverage those approaches and the same plain, simple language. “We talk about risks, we talk about likelihoods, and we talk about impacts, both positive and negative, so that you can build this trade space where you are taking on the right amount of risk to achieve a benefit,” Stanley said. […]
In This Story
- AI Risk Management Framework
- Artificial Intelligence (AI)
- National Institute of Standards and Technology (NIST)
Source: Futurism via Newser
https://www.newser.com/story/376101/chatgpt-is-wrecking-real-life-marriages.html
Instead of going to couples therapy, why not just vent to AI instead? Futurism reports that ChatGPT is finding its way into marriages and divorces, with disgruntled spouses using the AI to write breakup messages, justify arguments, and even replace their partners in late-night conversations. For some, what began as a quirky tool for quick advice has turned into a wedge that drives them apart from their partners, and therapists say they’re seeing a rise in people talking to AI about their most intimate conflicts instead of facing them head-on. As one put it bluntly, “We’re seeing people outsourcing their most intimate conflicts to a machine.”
Source: The New York Times via Newser
https://www.newser.com/story/376599/frustrated-job-seekers-try-to-outsmart-ai-resume-bots.html
By hiding prompts in their résumés to get past AI screeners – As artificial intelligence becomes the new gatekeeper for job applications, some job seekers are getting creative—if not a little sneaky. Recruiters are reporting a surge in candidates embedding hidden instructions directed at chatbots in their résumés, using invisible text or code, all in an effort to trick AI-powered screening tools into ranking them higher. It’s an understandable move: about 90% of employers now use AI to evaluate résumés, per the World Economic Forum. Applicants are responding to the trend. ManpowerGroup, the largest staffing firm in the US, now detects hidden text in about 10% of the résumés it scans with AI, the company tells the New York Times.
Still, the hacks sometimes work, the Times found. One recent college grad reports applying for 60 jobs in her field with a regular résumé and landing only one interview. After slipping in some AI-friendly prompts suggested by ChatGPT, she says her luck reversed: six interviews and a job offer, all from just 30 applications. “It was a complete 180,” she says. Some companies say they’re tweaking their software to catch the prompts. ComputerWorld reports other employers are devaluing the résumé entirely and instead relying on LinkedIn profiles or portfolios and platforms like GitHub to evaluate candidates.
Source: BleepingComputer
https://www.bleepingcomputer.com/news/security/fake-inflation-refund-texts-target-new-yorkers-in-new-scam/
An ongoing smishing campaign is targeting New Yorkers with text messages posing as the Department of Taxation and Finance, claiming to offer “Inflation Refunds” in an attempt to steal victims’ personal and financial data.
The Inflation Refund is an initiative from New York State that automatically sends refund checks to eligible residents to help offset the effects of inflation.
Those who qualify include taxpayers who filed a return, meet certain income thresholds, and were not claimed as dependents by another filer. New Yorkers do not need to apply, sign up, or provide any personal information to receive their checks, as they are automatically sent to qualified taxpayers.
In a new smishing attack seen by BleepingComputer, text messages claim to be part of the state’s “Inflation Refund Initiative,” urging recipients to click a link to provide information for the refund to be processed.
On September 28, Governor Kathy Hochul’s office issued a warning about the scam, stating that the scammers are sending text messages, emails, and direct mail to trick people into providing sensitive payment information.
[…]
Subject: Satellites Are Leaking the World’s Secrets: Calls, Texts, Military and Corporate Data
Source: WIRED
https://www.wired.com/story/satellites-are-leaking-the-worlds-secrets-calls-texts-military-and-corporate-data/
Satellites beam data down to the Earth all around us, all the time. So you might expect that those space-based radio communications would be encrypted to prevent any snoop with a satellite dish from accessing the torrent of secret information constantly raining from the sky. You would, to a surprising and troubling degree, be wrong.Roughly half of geostationary satellite signals, many carrying sensitive consumer, corporate, and government communications, have been left entirely vulnerable to eavesdropping, a team of researchers at UC San Diego and the University of Maryland revealed today in a study that will likely resonate across the cybersecurity industry, telecom firms, and inside military and intelligence agencies worldwide.
The group’s paper, which they’re presenting this week at an Association for Computing Machinery conference in Taiwan, is titled “Don’t Look Up”—a reference to the 2021 film of that title but also a phrase the researchers say describes the apparent cybersecurity strategy of the global satellite communications system. “They assumed that no one was ever going to check and scan all these satellites and see what was out there. That was their method of security,” Schulman says. “They just really didn’t think anyone would look up.”
[…]
Subject: British businesses urged to keep hard copies amid rising cyberattacks
Source: UPI.com
https://www.upi.com/Top_News/World-News/2025/10/14/cyberattacks-aganst-businesses-more-than-double/1901760430677/
Oct. 14 (UPI) — British cybersecurity authorities said Tuesday the country was facing “nationally significant” attacks almost daily from hostile states or sophisticated criminal gangs in an escalation that has seen incidents more than double in the 12 months to August.
“The best way to defend against these attacks is for organizations to make themselves as hard a target as possible. That demands urgency from every business leader: hesitation is a vulnerability, and the future of their business depends on the action they take today.”
Horne, said it was also critical for every company and organization to have a plan for how they would keep running if their IT systems stopped working, or they were locked out, and how they would recover them quickly.
The warning came as senior government ministers wrote to business leaders telling them to keep hard copies of critical data after a string of attacks that crippled the operations of major retailers and shut down production lines for five weeks at Jaguar Land Rover, the country’s largest automaker, causing major disruption and costing billions of dollars.
…
Topics
Source: FedScoop
https://fedscoop.com/artificial-intelligence-agency-pilots-process-intelligence/
The government AI landscape shifted recently when the General Services Administration announced federal agencies could access various AI chatbots for just $1. This bold move drastically lowers the barrier for agencies — and in many cases, state, local, and tribal governments that can leverage GSA procurement vehicles — to test and deploy AI. It also reflects a larger trend: agencies are rushing to apply AI to everything from procurement and finance to citizen services.
But cheap and fast access to AI does not guarantee success. In fact, a recent MIT study found that 95% of AI pilots fail to deliver expected returns. For governments navigating tight budgets, workforce shortages, and growing public expectations, there is no margin for wasted investment. AI is too important to get wrong.
When AI fails in government, it isn’t just a wasted pilot project. It means missed opportunities to improve service delivery, reduce costs, and rebuild trust in government. The stakes are too high for trial-and-error experiments.
Process Intelligence (PI) addresses this gap.
Think of PI as a process “X-ray” that shows how work gets done today — and where reforms will stick tomorrow. It lets leaders test changes in a digital environment before making costly investments. By grounding AI adoption in this clear picture of operations, PI ensures that modernization efforts deliver real results.
Every agency — federal, state, and local agency — faces the same modernization challenge: how to do more with less while meeting rising expectations for accountability and service. AI can help, but only if applied strategically.
[…]
Source: WIRED
https://www.bespacific.com/when-face-recognition-doesnt-know-your-face-is-a-face/
Wired [no paywall]- “An estimated 100 million people live with facial differences. As face recognition tech becomes widespread, some say they’re getting blocked from accessing essential systems and services…
From phones to hotel rooms, your face increasingly acts as a digital key. Over the past decade, rapid machine learning and AI advancements have led to the creation of a range of face recognition technologies—meaning that more than ever before, your appearance can be used as a digital identifier.
—
Abstracted from beSpacific
Copyright © 2025 beSpacific, All rights reserved.
Source: Cybersecurity Dive
https://www.cybersecuritydive.com/news/cisa-layoffs-reassignments-dhs-white-house-government-shutdown/802723/
[h/t Sabrina] The Trump administration is pursuing twin strategies to shrink the Cybersecurity and Infrastructure Security Agency, laying off staffers and ordering others to either take new jobs elsewhere or leave the government.The layoffs and forced relocations are the latest phase of the White House’s massive downsizing of CISA, which experts warn could further deplete the U.S.’s already weakened cyber-defense force. While the full consequences of the staff reductions remain unclear, they could include diminished support for critical infrastructure organizations and a reduced readiness to counter evolving nation-state and criminal threats.
…
Filed Under:
Source: Android Headlines
https://www.androidheadlines.com/2025/10/google-messages-adds-key-verifier-to-protect-users-from-sim-swap-and-impersonation-attacks.html
Google Messages now supports Key Verifier, a security tool that ensures users are truly messaging the right person by verifying encryption keys. The update also adds malicious link detection and recovery contact options to strengthen overall account safety.
How certain are you that the person you’re messaging is who they say they are? You might have saved the contact of a friend, family member, or co-worker on your phone. Their name pops up in a message, so you assume it’s them. Usually, you’d be correct. However, attacks like SIM swapping and impersonation means there’s always a chance it might not be them. Thankfully, if you’re using Google Messages, Google has rolled out support for its Key Verifier tool.
For those unfamiliar, Key Verifier is a new security feature designed to confirm you’re actually texting the person you think you are. How does it work? The tool verifies encryption keys used in end-to-end encrypted RCS conversations. The goal is to protect users against sophisticated attacks like SIM swapping and impersonation.
Encryption keys can be quite long and complicated, which is kind of the point. However, Key Verifier simplifies this through QR codes. This is versus forcing users to compare long strings of numbers. Each user scans the other’s QR code to confirm matching encryption keys. Once verified, Google Messages displays a visual confirmation, like a checkmark, showing the encryption keys are properly matched and the conversation remains private.
The feature becomes especially important when someone’s encryption key changes. An encryption key changes when you get a new device, swap SIM cards, or update your encryption protocol. Think of it like a house. When you move into a new home, obviously the lock and key change as well.
[…]
See also: https://blog.google/technology/safety-security/how-google-protects-against-scams-2025/
Source: Krebs on Security
https://krebsonsecurity.com/2025/10/email-bombs-exploit-lax-authentication-in-zendesk/
Cybercriminals are abusing a widespread lack of authentication in the customer service platform Zendesk to flood targeted email inboxes with menacing messages that come from hundreds of Zendesk corporate customers simultaneously.
Zendesk is an automated help desk service designed to make it simple for people to contact companies for customer support issues. Earlier this week, KrebsOnSecurity started receiving thousands of ticket creation notification messages through Zendesk in rapid succession, each bearing the name of different Zendesk customers, such as CapCom, CompTIA, Discord, GMAC, NordVPN, The Washington Post, and Tinder.
The abusive missives sent via Zendesk’s platform can include any subject line chosen by the abusers. In my case, the messages variously warned about a supposed law enforcement investigation involving KrebsOnSecurity.com, or else contained personal insults.
Moreover, the automated messages that are sent out from this type of abuse all come from customer domain names — not from Zendesk. In the example below, replying to any of the junk customer support responses from The Washington Post’s Zendesk installation shows the reply-to address is [email protected].
In all of the cases above, the messaging abuse would not have been possible if Zendesk customers validated support request email addresses prior to sending responses. Failing to do so may make it easier for Zendesk clients to handle customer support requests, but it also allows ne’er-do-wells to sully the sender’s brand in service of disruptive and malicious email floods.
Subject: Ars Live recap: Is the AI bubble about to pop? Ed Zitron weighs in
Source: Ars Technica
https://arstechnica.com/ai/2025/10/ars-live-recap-is-the-ai-bubble-about-to-pop-ed-zitron-weighs-in/ [thx Don]
On Tuesday of last week, Ars Technica hosted a live conversation with Ed Zitron, host of the Better Offline podcast and one of tech’s most vocal AI critics, to discuss whether the generative AI industry is experiencing a bubble and when it might burst. My Internet connection had other plans, though, dropping out multiple times and forcing Ars Technica’s Lee Hutchinson to jump in as an excellent emergency backup host.During the times my connection cooperated, Zitron and I covered OpenAI’s financial issues, lofty infrastructure promises, and why the AI hype machine keeps rolling despite some arguably shaky economics underneath. Lee’s probing questions about per-user costs revealed a potential flaw in AI subscription models: Companies can’t predict whether a user will cost them $2 or $10,000 per month.You can watch a recording of the event on YouTube or in the window below.
“A 50 billion-dollar industry pretending to be a trillion-dollar one”
I started by asking Zitron the most direct question I could: “Why are you so mad about AI?” His answer got right to the heart of his critique: the disconnect between AI’s actual capabilities and how it’s being sold. “Because everybody’s acting like it’s something it isn’t,” Zitron said. “They’re acting like it’s this panacea that will be the future of software growth, the future of hardware growth, the future of compute.”
[…]
Zitron and I agree that current AI assistants are being marketed beyond their actual capabilities. As I often say, AI models are not people, and they are not good factual references. As such, they cannot replace human decision-making and cannot wholesale replace human intellectual labor (at the moment). Instead, I see AI models as augmentations of human capability: as tools rather than autonomous entities.
[…]
When will the bubble pop?
Zitron predicted the bubble would burst within the next year and a half, though he acknowledged it could happen sooner. He expects a cascade of events rather than a single dramatic collapse: An AI startup will run out of money, triggering panic among other startups and their venture capital backers, creating a fire-sale environment that makes future fundraising impossible.
[…]
+ lots of comments