Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

Show NLP summaries collection recirc on article pages

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Boeing delays spaceflight again as it continues to struggle with leak

These ISIS news anchors are AI fakes. Their propaganda is real.

Why this company’s biggest fans turned against it

Puppy abandoned with heart-rending note is adopted, named Minerva

Man, 91, shocks tiny firehouse with $500K gift: ‘Nobody knew how much I’d saved’

Retired cop meets abandoned baby he helped 23 years ago: ‘What are the odds?’

With its energy network nearly destroyed, Ukraine already fears the winter

Mexican taquería’s new Michelin star puts street eats on par with gourmet food

IDF recovers bodies of 3 Israelis killed on Oct. 7

The world’s coolest hotels want to tell you a story

Cruise ships to return to Baltimore two months after bridge collapse 

Some cruise prices are about to get a little more clear

Biden continues outreach to Black voters; Trump heading to Minnesota

At campus protests, ‘DO NOT TALK TO THE MEDIA’!

CNN gets a presidential debate — and a much-needed win

Did Trump’s lawyers catch Michael Cohen in a ‘lie’? Let’s take a look.

Now playing off-Broadway: Trump’s synchronized sycophants

Biden faces pressure to pardon ex-Baltimore prosecutor Marilyn Mosby

Joey Gallo returns, but Nats endure another quiet offensive night

A taco will always be a taco — no matter what we call it

Walter Johnson’s jersey from 1920 showdown with Babe Ruth is up for auction

Ask Amy: Can’t a single woman eat alone without interruption?

Miss Manners: Miss Manners: Gag gift falls flat

Carolyn Hax: Is it weird to ask other people to care about you?

In photos: The scene in Houston after severe storms killed at least 7 people

D.C.’s secret garden

Best Places to Work in the Federal Government 2023

Trump promises tax cuts and fewer rules. CEOs shouldn’t fall for it.

Tariffs against China hamstring the transition to a clean energy future

The Post’s choices in Northern Virginia’s U.S. House primaries

Trump

See more coverage in your recommendations

Get the weekly Campaign Moment newsletter

Set alerts for major election developments

Election 2024

The Campaign Moment newsletter

Politics alerts

Welcome to The Cybersecurity 202! Mismatched music covers are a mixed bag of stunts and surprising effectiveness, but the <a href="https://www.youtube.com/watch?v=NmIWkiTZ8qM">Afghan Whigs' version of “Creep” by TLC</a> won’t get out of my brain so for me it’s the latter. Although … since the Whigs have argued convincingly they’re an R&amp;B band despite forming as a “grunge” group, maybe it’s not so mismatched.

Below: Peiter “Mudge” Zatko testifies on Capitol Hill, and the U.S. government calls out foreign influence operations by Russia. First:

First in The Cybersecurity 202: Much-awaited security guidance arrives today from the Biden administration

Andrew Harnik

A White House office is publishing guidelines this morning for how federal agencies and government contractors will comply with President Biden’s demand last year that federal systems and vendors meet common cybersecurity standards.

The memo — which The Cybersecurity 202 is first reporting — is perhaps the most-awaited cybersecurity guidance from the Office of Management and Budget (OMB) since Chief Information Security Officer Chris DeRusha joined the Biden administration at the beginning of 2021, he told me.

It stands to affect the security of government systems and therefore the ability of feds to provide services, as well as the process for billions of dollars worth of federal contracts. That, in turn, could pressure any company that might want to do business with the federal government to meet the government standards, as a senior administration official told reporters last year before rolling out Biden’s executive order that spawned today’s memo.

“We’re all using Outlook email. We’re all using Cisco and Juniper routers,” <a href="https://www.whitehouse.gov/briefing-room/press-briefings/2021/05/12/background-press-call-by-senior-administration-officials-on-executive-order-charting-a-new-course-to-improve-the-nations-cybersecurity-and-protect-federal-government-networks/">the official said</a>. “So, essentially, by setting those secure software standards, we’re benefiting everybody broadly.”

Besides the memo, OMB is set to publish a blog post this morning from DeRusha.

“The guidance, developed with input from the public and private sector as well as academia, directs agencies to use only software that complies with secure software development standards … and will allow the federal government to quickly identify security gaps when new vulnerabilities are discovered,” he writes.

OMB hasn’t yet broadly shared the final draft with industry, which had expressed some nervousness about how <a href="https://www.washingtonpost.com/politics/2021/05/20/cybersecurity-202-industry-groups-express-cautious-optimism-about-biden-executive-order-software-standards/">details of the executive order</a>, and <a href="https://www.fedscoop.com/industry-consensus-software-compliance-process/">today’s memo</a>, might look.

Biden’s <a href="https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/">May 2021 cybersecurity executive order</a> listed many mandates, ranging from requiring agencies to employ security tools like encryption to establishing a Cyber Safety Review Board to analyze major cyberattacks. The memo followed a series of high-profile hacks, one of which, the breach of software company SolarWinds, let spies <a href="https://www.whitehouse.gov/briefing-room/press-briefings/2021/02/17/press-briefing-by-press-secretary-jen-psaki-and-deputy-national-security-advisor-for-cyber-and-emerging-technology-anne-neuberger-february-17-2021/">worm their way into at least nine federal agencies</a>.

One of the memo’s directives was for the National Institute of Standards and Technology to create a foundation for developing secure software. <a href="https://csrc.nist.gov/Projects/ssdf">NIST’s final framework</a> includes top-level steps like:

“Produce well-secured software with minimal security vulnerabilities in its releases.”

“Identify residual vulnerabilities in software releases and respond appropriately to address those vulnerabilities and prevent similar vulnerabilities from occurring in the future.”

OMB ordered agencies to <a href="https://www.whitehouse.gov/omb/briefing-room/2022/03/07/omb-statement-on-enhancing-the-security-of-federally-procured-software/">begin adopting that framework</a> this March, but left out some steps, which leads us to today’s memo.

“The number one thing that we heard from industry was, ‘We all want to follow secure development practices, but we need to ensure a consistent approach across agencies and treatment of vendors — we don’t want 100 agencies doing this a hundred different ways,’” DeRusha said. “Absolutely agree with that. And so that’s the goal of this memo.”

A somewhat controversial topic is at the center of one of the memo’s steps. Agencies must receive something called a “self-attestation” from a software producer before using that software. Essentially, the software provider vouches for the security of their product. If a provider is found to be out of compliance later, an agency could no longer use it, according to OMB.

A Defense Department program for vetting the cybersecurity of Pentagon contractors featured third-party auditors because the department determined that self-attestations weren’t a reliable indicator of contractor security, <a href="https://www.nextgov.com/cybersecurity/2022/02/nist-suggests-agencies-accept-word-software-producers-executive-order/361644/">Nextgov reported</a>. DOD has subsequently retreated from that requirement, <a href="https://federalnewsnetwork.com/commentary/2022/01/the-pentagons-new-cybersecurity-model-is-better-but-still-an-incremental-solution-to-a-big-challenge/">to a degree</a>.

Another major component of the memo is the amount of information agencies could collect under it. For instance, it states that federal agencies may require prospective contractors to supply an ingredients list for tech systems, known as a Software Bill of Materials. <a href="https://www.washingtonpost.com/politics/2022/01/26/an-ingredients-list-software-could-help-prevent-next-log4j/">Some have touted that</a> as a measure that could’ve helped quickly clean up the bug in a hugely popular piece of code known as log4j.

That’s data that “we can leverage to protect all other federal agencies,” DeRusha said.

It might take a while for all this guidance to become reality. The memo contains an appendix with a baker’s dozen deadlines for federal agencies, ranging from three months to two years.

But DeRusha touted the big picture in his blog post.

“The guidance released today will help us build trust and transparency in the digital infrastructure that underpins our modern world and will allow us to fulfill our commitment to continue to lead by example while protecting the national and economic security of our country,” he writes.

Twitter whistleblower highlights company’s cybersecurity practices in testimony before Senate panel

Tom Brenner

Former Twitter security chief Peiter “Mudge” Zatko told members of the Senate Judiciary Committee that executives at the company were financially incentivized to ignore key cybersecurity problems, and he also expanded on claims that foreign government operatives could have had access to sensitive data at the company, Cat Zakrzewski, Joseph Menn, Faiz Siddiqui and Cristiano Lima <a href="https://www.washingtonpost.com/technology/2022/09/13/twitter-whistleblower-peiter-zatko-testifies/">report</a>. Zatko also grounded his testimony in examples that senators could understand — like their own Twitter accounts being hijacked.

“It doesn’t matter who has keys if you don’t have any locks on the doors,” he said. “It’s not far-fetched to say an employee inside the company could take over the accounts of all the senators in this room.”

In the hearing, Zatko also warned about insider threats at Twitter. “A week before his January firing, Zatko testified, the FBI had warned security staff that a Chinese agent for the Ministry of State Security was employed at the company,” my colleagues write. “Twitter ads paid for by the Chinese government also could have elicited information, including locations of users who click on them, he said.”

Russia secretly spent more than $300 million on foreign political campaigns since 2014, U.S. says

Maxim Shipenkov

A new U.S. intelligence review said that the money was funneled to candidates and political parties in more than two dozen countries, Missy Ryan <a href="https://www.washingtonpost.com/national-security/2022/09/13/united-states-russia-political-campaign/">reports</a>. The Biden administration declassified the review in an attempt to try to counter Russia’s attempts at foreign influence around the world, a senior U.S. official told reporters.

In a cable provided to reporters, the State Department named Russian oligarchs who it said were involved in “financing schemes.” The oligarchs include Yevgeniy Prigozhin, who U.S. officials <a href="https://www.washingtonpost.com/news/worldviews/wp/2018/02/16/the-rise-of-putins-chef-yevgeniy-prigozhin-the-russian-accused-of-manipulating-the-u-s-election/?itid=lk_inline_manual_10">charged</a> in 2018 with trying to interfere in the 2016 election by funding a Russian troll farm.

<a href="https://www.nbcnews.com/tech/security/disinformation-text-message-problem-answers-rcna41997" target="_blank">The biggest election disinformation event of the 2022 midterm primaries: Text messages (NBC News)</a>

<a href="https://www.politico.eu/article/eu-intelligence-chief-cancels-taiwan-trip-after-beijing-gets-his-secret-plans/" target="_blank">EU intelligence chief cancels Taiwan trip after Beijing learns his secret plans (Politico Europe)</a>

<a href="https://therecord.media/buenos-aires-legislature-announces-ransomware-attack/" target="_blank">Buenos Aires legislature announces ransomware attack (The Record)</a>

<a href="https://www.bloomberg.com/news/articles/2022-09-13/indonesia-set-to-pass-new-data-privacy-law-after-spate-of-leaks?srnd=technology-vp" target="_blank">Indonesia set to pass new data privacy law after spate of leaks (Bloomberg)</a>

<a href="https://theintercept.com/2022/09/12/keith-alexander-nsa-spac-investment-scheme/" target="_blank">Former NSA chief Keith Alexander accused of pump-and-dump investment scheme (The Intercept)</a>

Current and former executives at social media companies <a href="https://www.hsgac.senate.gov/hearings/social-medias-impact-on-homeland-security">testify</a> before the Senate Homeland Security Committee today at 10 a.m.

A Senate Judiciary Committee panel <a href="https://www.judiciary.senate.gov/meetings/protecting-americans-private-information-from-hostile-foreign-powers">holds</a> a hearing on protecting Americans’ personal information from hostile foreign actors today at 3:30 p.m.

Deputy national security adviser Anne Neuberger <a href="https://upgather.com/defense-talks/agenda/">speaks</a> at a DefenseScoop event Thursday at 9 a.m.

The House Homeland Security Committee <a href="https://homeland.house.gov/activities/hearings/building-on-our-baseline-securing-industrial-control-systems-against-cyberattacks">holds</a> a hearing on the cybersecurity of industrial control systems Thursday at 10 a.m.

A House Oversight and Reform Committee panel <a href="https://oversight.house.gov/legislation/hearings/project-federal-information-technology-make-it-work">holds</a> a hearing on federal IT on Friday at 9 a.m.

Rep. Mike Turner (R-Ohio), the top Republican on the House Intelligence Committee, <a href="https://www.heritage.org/homeland-security/event/countering-foreign-malign-influence-while-protecting-civil-liberties">speaks</a> at a Heritage Foundation event on countering foreign misinformation and disinformation while protecting civil liberties Monday at 1 p.m.

Thanks for reading. See you tomorrow.

2022 American Society of Business Publication Editors, Bronze National Award, Government Coverage

2022 American Society of Business Publication Editors, Silver Regional Award, Government Coverage

2022 American Society of Business Publication Editors, Bronze Regional Award, Single Topic Coverage by a Team

2022 Society of Professional Journalists Washington, D.C., Chapter, Finalist, Staff

2021 Best in Business Awards, Honorable Mention, Technology, Small Division (for editing role)

2009 National Press Club Sandy Hume Memorial Ward for Excellence in Political Journalism

2001 Indiana Associated Press Managing Editors, 1st Place, Non-Deadline News Reporting (with another reporter)

2001 Hoosier State Press Association, 3rd Place, Business Writing (team project)

University of Southern Indiana, BA in Print Journalism

Tim Starks is the author of the Cybersecurity 202 newsletter at The Washington Post. He previously served as senior editor at CyberScoop and ran Politico's cybersecurity newsletter. The Evansville, Ind., native also has held reporting roles for CQ Roll Call, the New York Sun and the Evansville Courier & Press.

Tim Starks

Society of American Business Editors and Writers, Best in Business award, Newsletter, 2019

American University, MA in journalism and public affairs

University of Rochester, BA in international relations

Aaron Schaffer is a researcher on The Post's News Research team.