Defense One - All Content

Critical flaws in ubiquitous website software draw urgent warning from NSA, FBI

David DiMolfetta — Wed, 21 Oct 2026 12:30:00 -0400

Two critical flaws in software widely used in websites have the NSA, FBI, and Cybersecurity and Infrastructure Security Agency urging organizations to update their systems or take them offline immediately.

The vulnerabilities affect PHP, a programming language that works behind the scenes to run websites, process forms, and retrieve information. Hackers could exploit the flaws to run commands on an affected server without logging in, potentially allowing them to steal data, change a website’s contents, or take control of it, the agencies said Wednesday.

PHP powers run roughly 70% of websites whose underlying server-side programming language can be identified, according to web technology tracker W3Techs. It is a key part of popular website-building platforms, including WordPress, Drupal, and Joomla.

Palo Alto Networks’ Unit 42 said it identified more than 22.6 million internet-exposed instances that might be vulnerable.

“While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched,” the cyberdefense agency said in a blog post.

A Nextgov/FCW analysis using Shodan, a search engine that catalogs internet-connected systems, identified roughly 900 results associated with U.S. federal, state and local government websites that showed signs of PHP use. Many listed older versions of the software, though it’s unclear if the records reflect the versions currently running on those systems, as Shodan may not yet have captured recent updates.

Governments in Europe have already been taking some websites offline to implement fixes.

“I’d expect a great deal of opportunistic exploitation: attackers don’t need to know what’s vulnerable before they start knocking on doors,” said Trey Darley, the founder of Proper Tools, a cybersecurity standards consultancy. “Meanwhile, defenders can’t reliably count what they need to patch and protect.”

“Right now, the priority is protecting the systems people actually have,” he added.

The U.S. government was involved in coordinating the response ahead of disclosure. OpenAI said it and its partners engaged the White House’s Super Intelligence Force, the Office of the National Cyber Director and Cybersecurity and Infrastructure Security Agency to help security guidance reach organizations responsible for critical infrastructure and other essential services.

The flaws, collectively known as “php2shell,” affect the software beneath websites rather than a single website or application. That means an organization could have carefully secured its own code and still be exposed through the PHP software running it.

Cybersecurity company Wiz said it demonstrated successful attacks against WordPress, Drupal and Joomla installations. Researchers also showed they could read sensitive information from a server’s working memory, including passwords and access credentials.

PHP’s developers also said all installations handling web requests are at risk. Under certain setups, an attack can take place before the website’s own code even executes.

The discovery adds to evidence that AI is helping researchers find and exploit flaws in widely used software. OpenAI said security firm Calif identified a critical flaw using its GPT-5.6 Sol model, while Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led the development and release of fixes.

PHP’s developers released updates Wednesday for supported versions of the software. They said organizations using Linux distributions or long-term support services should check their vendors for updated packages, including fixes adapted for older versions.

The warnings followed an early leak that accelerated plans to disclose and fix the vulnerabilities. A post on the technology forum Hacker News surfaced Tuesday morning and was subsequently removed, but screenshots spread across social media, according to cybersecurity firm Huntress. PHP’s developers then announced that fixes would arrive a day ahead of the planned disclosure, leaving website operators little time to prepare for updates.

Editor’s note: This story is breaking and may be updated.

]]>

Add ‘post-AI’ encryption to your to-do list

John Croxton — Wed, 21 Oct 2026 01:30:19 -0400

Even as federal agencies move their most sensitive systems to new forms of encryption following an order from the White House in June, the release this month by OpenAI of new results to theoretical math problems has sparked concern about whether even proposed post-quantum encryption will be safe from increasingly capable AI models.

Encryption is what keeps online data secure; encrypting a message means applying mathematical equations to disguise its contents to an attacker. But new math techniques could let an attacker decipher encrypted messages without a key: the equivalent of a safecracker using the click of pins in a lock to find the right combination. If existing encryption algorithms fall, huge swaths of the internet would be at risk of attack.

Plans for post-quantum encryption may need to incorporate stronger multi-layered defenses—and move forward more quickly than the White House anticipated—to protect data that hasn’t yet been collected.

Encryption works now because, in practice, there are ways to make it very easy for someone with the key to apply some math and reveal the original message, but not to find the key or solve the equations by brute force in a reasonable amount of time. But the encryption techniques currently in widespread use haven’t been proven theoretically safe; they’re trusted because nobody has been able to crack them so far. So if new math is discovered that makes solving encryption schemes much easier, the foundations of the internet’s security would be at risk.

AI systems have been churning out math discoveries at an unprecedented rate. In May, an OpenAI model disproved the Erdős unit distance conjecture, a well-known problem in a subfield of math called discrete geometry. And in September, the company announced its AI had a solution to the Navier-Stokes equations. The equations make up one of seven Millennium Prize Problems, some of the most important unsolved problems in mathematics.

“It just solved 400 problems, any of which, if a human had solved it, that could have been the highlight of their career, that could have been their tenure case,” Scott Aaronson, author of Quantum Computing Since Democritus and Chair of Computer Science at UT Austin, said in an interview.

Omer Reingold, computer scientist and co-winner of the Gödel Prize in 2009, wrote before the latest release that, “The world of mathematics, including theoretical computer science, is in turmoil. Even the Millennium Prize Problems…are no longer beyond the reach of LLMs.”

The OpenAI papers showed new results, “in just about all areas of math, but with this very conspicuous exception that there was nothing in cryptography. And that can't possibly be an accident,” Aaronson said.

Justin Drake, a security researcher at the Ethereum Foundation, wrote that he believes there was “backroom interventionism.”

“I've witnessed first-hand the U.S. government censoring academic quantum cryptanalysis results. Backroom interventionism is my base case,” he said.

Regardless of whether OpenAI redacted encryption results from this particular release, the flood of new results has prompted fears that AI systems could find weaknesses in existing encryption algorithms. The cryptocurrency industry, which depends on encryption to safeguard its digital currencies, has been particularly alarmed.

As part of the way cryptocurrencies function, many crypto accounts expose some information about themselves when they send money. On X, formerly known as Twitter, Drake wrote, “Today I call upon the blockchain industry to calmly begin planning for ‘bunker mode’. My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses.”

A “fresh address” is one that has never been used to send money to another account, limiting the ways future attackers might break its security.

Other cybersecurity experts are skeptical that AI will have much of an effect on concrete security issues. “Cryptographers are incredibly conservative... we put a lot of buffer into [secure encryption], an enormous amount,” said Bruce Schneier, security guru and author of the bestseller Applied Cryptography.

His concern is more on implementation questions in cybersecurity than the possibility of breakthroughs in theoretical math.

“Computer security is so bad. That's the worry. Finding vulnerabilities in code, hacking into systems. Those are the worries, not the math ... Of all the security things going on, math is the strongest we have,” Schneier added.

Emily Wenger, an assistant professor of electrical and computer engineering at Duke University, who has used machine learning to test the security of post-quantum encryption methods, said she doesn’t think “advanced large language models are going to break all encryption.”

“But when you make practical implementation choices... we found in the past that certain instantiations of these algorithms are insecure,” she said. “There's kind of two ways to break these things. You can either prove something about the math problem, or you can look at implementation choices.”

Aaronson noted that undermining the math behind widely used encryption algorithms like RSA would have sweeping consequences. “These mundane vulnerabilities, you can play the game of whack-a-mole. As soon as you find one, you patch it. Whereas if there's a break of RSA ... if all of our public key crypto systems were broken, then we would really have a problem, the way that we have constructed the internet.”

Dan Boneh, a cryptography expert and professor of computer science and electrical engineering at Stanford, said in a video that losing current forms of encryption “would affect the entire internet... it affects the entire digital world. So, home banking, healthcare, government communications, everything [would be] impacted by such a break.”

But some experts are optimistic that security will ultimately become stronger from the increased attention.

“In the past, when someone would make an assumption and build a [cryptography] system based on it, we'd have to wait 10 years before that system could be deployed, to give people enough time to analyze it. And now all of a sudden we can accelerate this process tremendously using these models... we can just let a model run for a month, try to break it, and if the model can't break it, boy, do we have a lot of confidence that the assumption is valid. So we actually have the prospect to have more confidence in our security than ever before,” Boneh said.

Schneier concurred, saying, “It's an arms race. I think AI is the first technology that's potentially flipping that arms race to a defender advantage … Microsoft used AI to patch 900-something vulnerabilities for a Patch Tuesday last month. But they will never again be problems. You're already being attacked at computer speeds. Now you can be defending at computer speeds.”

Still, any transition would be costly. For a typical commercial firm, building “crypto agility,” or the ability to quickly switch the organization’s data to new types of encryption, may be the best response to encryption uncertainty. But for the defense industrial base, adversaries have been collecting their online data in its encrypted form for years, so switching now would have little effect on their ability to decode existing data.

Intelligence agencies both foreign and domestic have long embraced “harvest now, decrypt later” as a method of espionage, collecting encrypted data over time and storing it, in preparation for breakthroughs that would allow them to crack existing encryption.

“You have to assume that intelligence agencies are vacuuming up your data now, and that's all the more true if you think that AI could potentially discover breaks for these systems within the next year or two,” Aaronson said.

For organizations that deal with restricted or classified information, the prospect of AI math breakthroughs adds another ticking clock to the post-quantum future many have only begun to prepare for.

The federal government is targeting a comprehensive move to post-quantum encryption in the coming years. Agencies must follow Executive Order 14412 and OMB memo M-26-15, requiring them to migrate key systems to post-quantum cryptography in stages from Dec 2030 to 2035. The NSA has its own schedule for national-security systems. Contractors would also be subject to NIST’s cryptographic standards by Dec 2030 under the EO.

But new math results relevant to encryption could require a different approach. Aaronson said of AI undermining classical encryption or post-quantum algorithms, “Either of those could fall without the other. There's no logic.”

The prudent move for organizations may be “crypto agility,” the capacity to swap and layer different algorithms on top of each other as needed. With a proper agility posture, even broken encryption algorithms would not result in widespread harm in most cases.

“You should be getting crypto agility for post-quantum. So you should be doing it already. And if you're not, you should,” Schneier said.

Matthew Green, an associate professor of computer science at the Johns Hopkins Information Security Institute and author of the blog A Few Thoughts on Cryptographic Engineering wrote, “I can’t see the future. Nobody can. But so far, betting against models and in favor of human intelligence being the limit has not worked well for any of us.”

]]>

Military power rising as power of diplomacy falling, diplomats, crisis monitors, allies say

Patrick Tucker — Tue, 20 Oct 2026 19:53:00 -0400

DOHA, Qatar–International norms and humanitarian law are losing influence just as new military capabilities are becoming easier to access—a central theme of two days of talks among diplomats, government officials and humanitarian workers here.

“Conflicts are now a first resort in many cases. Diplomacy and dialog are being delegitimized,” said Pierre Krähenbühl, director-general of the International Committee of the Red Cross.

Krähenbühl was far from alone in his assessment at the Global Security Forum, hosted in this Gulf capital by the Soufan Center and the Qatar International Academy for Security Studies. Officials from Europe and the Middle East, as well as former senior intelligence officials from Australia and Britain, questioned the durability of the alliance structure that the United States and its Western allies put in place after World War II.

"The war in Lebanon today and on Lebanon shows that there are countries, Israel is a case in point, that do not need alliances, for they are engaged in an offensive war, and alliances in today's world are largely defensive,” said Deputy Prime Minister Tarek Mitri of Lebanon, which remains partly occupied by Israeli forces.

But that breakdown isn't happening on its own. Sir John Sawers, former chief of Britain's MI6 intelligence agency, pointed to the United States' declining commitment to its traditional security guarantees, even as the 8-month-old U.S.-Israeli war against Iran has exposed American partners in the Gulf to new threats.

Saudi Arabia, Qatar, and the United Arab Emirates are reconsidering their security relationships with Washington, Sawers said.

“The United States was the guarantor of their security. And what of course these countries have experienced in the last six months is the attacks on them have been provoked by a U.S-instituted war of choice against Iran."

Europe is confronting similar questions as the Russian campaign against NATO grows more brazen and sophisticated. Sawers said America is eroding the international system it helped establish: one of the challenges to the rules-based order is “the United States losing confidence in the system which they designed and which has benefited America enormously.”

Sawers disputed the idea that Europe is rearming simply because of pressure by Donald Trump.

"The reason we're increasing money on defense now isn't because President Trump is telling us to do so. It's because the threat from Russia is much greater than it was before. And the reliability of the United States is less than it was before,” he said.The conference’s host country, Qatar, has found that its longtime efforts to play international mediator no longer keep it safe. The capital came under attack by Israel in 2025, and six months later by Iran.

“It was a surprise because it's the first time that a mediator has been attacked. This never happened,” said Sheikh Saoud bin Abdulrahman Al Thani, Qatar's deputy prime minister and minister of state for defense affairs..

Al Thani identified three threats to Qatar: attacks on its sovereignty, disruptions to energy flows from Gulf Cooperation Council countries, and the spillover of regional conflicts.

Tom Barrack, U.S. special envoy for Syria and Iraq, said the United States remained committed to diplomacy and proposed a path out of the regional violence beginning with a ceasefire, reopening the Strait of Hormuz, and easing economic pressure on the Iranian people. But he cautioned against expecting any agreement to resolve the underlying conflict quickly.

"What we know in the Middle East is there's no such thing as a deal. There's no event. This process is going to continue,” said Barrack, a billionaire financier who served as a go-between from candidate Trump to Gulf princes during the 2016 campaign.Nick Warner, former director-general of Australia's Office of National Intelligence and former ambassador to Iran, put the issue more bluntly: "And the answer to how does the war with Iran end is: it doesn't."

]]>

Pentagon to start expanding Greenland bases next year: official

Meghann Myers — Tue, 20 Oct 2026 14:13:24 -0400

The Pentagon is spending the winter evaluating options for expanding U.S. basing in Greenland, according to a senior defense official, with an eye toward breaking ground on new facilities next year.

The Trump administration announced in September that military outposts at Mestersvig and Narsarsuaq would become U.S. bases, while expanding the existing U.S. footprint at Pituffik Space Base.

“Right now we're in a planning cycle because we're going to run out of execution window, from a weather perspective, to do anything almost immediately,” a senior defense official told reporters at a Tuesday event hosted by the Project on Media and National Security. The official spoke on background because they were not authorized to speak publicly about the plans.

The moves come nearly two years after President Donald Trump, who had sought to purchase the independently-governed Danish territory in his first term, began suggesting that the United States might seize Greenland by force. In January, Trump sought to force a sale with threats to invade the island and impose punitive tariffs on Denmark and other NATO allies. Instead, he settled for expanding a 1951 treaty that allows the U.S. to base forces in Greenland.

Mestersvig, to start, has a 6,000-foot gravel runway, the official said, and has primarily hosted special operations forces.

“And so, as we talk with the teams…what are the options that you need on the northeastern side or on the eastern side of Greenland? What kind of capabilities? What do you want that to do? So we're having that conversation back and forth there,” the official said.

For Narsarsuag in the south, they’re looking at what kinds of upgrades the runway needs to support modern U.S. aircraft.

“So if it's capable of putting in C-130s, great. If I needed to put fighter aircraft in there for some reason…what would that take? How would I expand it?” the official said.

At this point, the official added, the Pentagon is looking less at housing specific capabilities and looking first at what’s even possible, both for equipment and for people.

“If I needed to create a capability and I needed to put people into a location for a period of time, what do I need to think about? I need to think about lodging, I need to think about food. I need to think about energy,” the official said. “So it's all of those types of things, not necessarily a, ‘Hey, I want to station this there right now.’ That's not where we're at in that conversation. We're more in the, ‘that location has this,’ and to the degree that I can do that by making strategic investments, that's smart.”

]]>

State Department orders staff to call AI ‘super intelligence’

David DiMolfetta and Jory Heckman — Tue, 20 Oct 2026 13:42:00 -0400

The State Department has instructed personnel to replace “artificial intelligence” with “Super Intelligence” in official communications and rename its AI-related programs and systems, bringing President Donald Trump’s terminology change into the daily work of U.S. diplomacy, according to two people familiar with the matter and contents of an unclassified cable obtained by Government Executive and Nextgov/FCW.

The cable — dated Monday and addressed to the entire department — tells staff to use “Super Intelligence,” or “SI,” in new letters, emails, public messages, websites, reports, remarks and policy documents, subject to legal exceptions. Existing material should be updated when staff next revise it.

“All official titles and the names of Department governance bodies, systems, platforms, inventories, and programs must use SI in place of AI,” the cable states.

The instructions implement Trump’s Sept. 29 executive order, which directed executive agencies to adopt the new terminology across official communications. The cable shows how that broad instruction is being translated into specific requirements for diplomats and the department’s internal operations.

The order says the wording should reflect the advancing capabilities and promise of American technology. For now, however, it defines “Super Intelligence” as the same technologies and systems covered by the existing statutory definition of AI. In computing science, super intelligence is defined differently than the generative artificial intelligence technologies used today.

In recent weeks, administration officials had previously discussed the terminology change with certain State bureaus, people familiar with the matter said. But the cable appears to be the first organization-wide directive outlining where the new language must be used. The Associated Press previously reported such communications with State’s international organizations bureau.

The transition, while expected for some time, is significant because it would change how U.S. diplomats describe the fast-evolving technology in policy documents and discussions with overseas counterparts.

Foreign organizations retain their own names in internal writings. The cable specifically tells employees not to change references to China’s World Artificial Intelligence Cooperation Organization, even as the department replaces the term in its own materials.

The notice also spells out several exceptions to the replacement rule. Employees must preserve language required by law and existing legal citations, including quotations from statutes, regulations, treaties and other legal instruments. Contracts and grants are also excluded, pending further guidance.

Previously published documents, cables and archived web pages should not be revised or reissued solely to change the terminology, it adds. The instructions also preserve the published titles of existing presidential actions, programs and organizations, such as America’s AI Action Plan, unless the department provides further direction.

One program has already changed names. The cable says the American AI Exports Program is now the American SI Exports Program, citing an earlier State Department cable. The program’s public website already uses that name to describe its work helping American companies sell technology overseas.

For staff handling international agreements or departmental rules, the cable directs questions about terminology to the appropriate policy or legal office.

The vocabulary change is already appearing in senior officials’ public remarks. National Cyber Director Sean Cairncross repeatedly referred to AI as “super intelligence” and “SI” during an Oct. 1 discussion on AI safety, following Trump’s order.

Office of Personnel Management CIO Adam Starr also used “SI” in remarks last week, describing efforts to help agencies adopt the technology. Starr said OPM had launched a SuperIntelligence Governance and Adoption Program, or SI GAP, to assist other agencies.

]]>

Trump appointees asked a federal cybersecurity agency to secretly hack a voting machine

Doug Bock Clark and Andy Mannix, ProPublica — Mon, 19 Oct 2026 20:23:36 -0400

A few months into President Donald Trump’s second term, political appointees at the Department of Homeland Security made an unusual request of its agency focused on cybersecurity: Secretly acquire a voting machine and hack it.

The appointees wanted the Cybersecurity and Infrastructure Security Agency to procure the machine, examine it and report back the findings so they could be given to the White House, according to two former administration officials with knowledge of the request.

The proposition was shocking to CISA’s career staffers, according to one of the former officials. CISA typically worked to thwart hackers. Moreover, the agency had been directed not to alert the voting machine company if it uncovered flaws, contrary to its standard practices. The request made the CISA employees fear they were being asked to take part in political interference.

“My thought was they could keep it in their back pocket to invalidate any [election] results they don’t like,” one of the former officials said. “This goes against everything CISA represents.”

The CISA employees repeatedly told the political appointees that their request was impossible, in part because the agents capable of pulling off such an operation had just been laid off by Elon Musk’s Department of Government Efficiency initiative. The appointees eventually stopped pressing CISA.

Though not acted on, the request shows how the Trump administration has tried to use the agency for its own ends while draining it of resources for one of its critical missions: protecting the nation’s voting systems.

In Trump’s second term, his administration has laid off or pushed out more than 1,000 CISA employees, shrinking the agency by about one-third. The president’s 2027 budget proposal would reduce funding for the agency by another $700 million, which could necessitate 900 additional layoffs.

In response, Democratic lawmakers have called for an investigation into CISA’s ability to do its job and demanded answers as to why federal funds are not being used to support election security as directed by Congress.

Since Trump signed the CISA Act in 2018, the agency has worked with state authorities and voting machine vendors to help protect election infrastructure from cyberattacks. During Trump’s second term, though, CISA has abandoned much of this work. Several state election authorities said the agency provided them no assistance — and no explanation for its absence — during the most critical planning stages for the upcoming midterms.

“There is a difference between deprioritizing and being nonexistent,” said Ryan Macias, an election technology and cybersecurity expert who has worked as a consultant for CISA. In 2025 and through mid-September 2026 — when the bulk of preparations for the election typically would have been completed — “they were nonexistent. Literally nonexistent.”

While Trump has repeatedly warned that America’s elections are vulnerable to hacking, in some cases repeating disproven claims, experts said his administration is undermining the federal government’s role in helping secure them.

Though CISA re-emerged in September with a last-minute security plan for the election, some state officials told ProPublica they fear that what is left of the agency has been compromised by a conspiracy-obsessed presidential administration. In recent months, in reviving debunked theories about the 2020 election, the Trump administration has declassified troves of records, including sensitive material that state officials provided to CISA. Some state authorities said they no longer trusted the administration enough to share information with CISA, a key to the agency’s success in past elections.

“They’ve violated the entire premise of that information-sharing relationship,” said one former high-ranking federal cybersecurity official who now advises state governments on national security. “There’s no fucking way they’re ever going to give any information to CISA. And it’s unclear if they ever will in the future.”

A spokesperson for the White House declined an interview request but defended Trump’s handling of election security in an emailed statement. “President Trump has done more than any other President to ensure we have free and fair elections,” said Lauren Bis.

Bis referred specific questions about CISA’s handling of elections to DHS. DHS and CISA did not respond to interview requests or to a detailed list of questions.

Current and former CISA employees and state election officials describe an agency that has become significantly less equipped to help states fight legitimate cyber threats. State leaders say they have used their own resources to shore up gaps left by CISA, such as paying for sensor technology that can detect unusual activity in election networks. But some services, like intel on foreign actors, can’t be replicated. Some people interviewed said they were worried that Trump and his allies continue to ratchet up rhetoric about voting security, particularly about threats to voting machines. Officials in one large voting jurisdiction said they have met privately with machine vendors to come up with a contingency plan if the federal government seizes their machines or declares them unusable.

“I don’t pay attention to what the president says. I pay attention to what his administration does,” Arizona Secretary of State Adrian Fontes said. “And what they’ve done is basically cut us off and left us on our own.”

Defending elections from hackers wasn’t always part of DHS’s remit.

Throughout the mid-1990s and 2000s, a series of cyberattacks rocked the federal government, demonstrating the emerging threat. In 2007, hackers broke into the Pentagon and stole terabytes of sensitive data. The digital heist, by an unknown foreign adversary, was so damaging that one intelligence leader later described it as an “espionage Pearl Harbor.”

Under George W. Bush, DHS underwent a reorganization to more effectively combat terrorism and respond to disasters like Hurricane Katrina. The department dedicated resources under an office called the National Protection and Programs Directorate to help fortify advanced cyber defense systems and important infrastructure. The office’s work ranged from helping secure events like the Super Bowl to protecting chemical plants to issuing cybersecurity warnings to the private sector and the public. In 2018, Trump signed a bill making the office a stand-alone agency, allowing for more federal funding and transforming it into, essentially, the ultimate tech support desk for anything DHS designated “critical infrastructure.” The bill renamed the agency CISA.

Though Trump helped create CISA, he didn’t much appreciate the work the agency did under its old name to expose the extent of Russia’s meddling in the 2016 presidential election. Russian agents had unleashed a massive disinformation campaign, with a Kremlin-backed troll farm creating thousands of social media accounts posing as Americans and promoting Trump, according to bipartisan reports from the U.S. Senate Select Committee on Intelligence released before the 2020 election. A dozen Russian military agents were indicted for what the Justice Department described as “a sustained effort to hack into the computer networks of the Democratic Congressional Campaign Committee, the Democratic National Committee, and the presidential campaign of Hillary Clinton.”

Trump publicly downplayed this interference, but DHS leadership saw the Russia attack as an escalation. In January 2017, before Trump took office, DHS upgraded America’s elections to the status of critical infrastructure. This placed the polls and all voting technology used in federal elections under the watch of what would soon become CISA.

To carry out this function, CISA needed help. But states and voting machine vendors were wary about sharing data on weaknesses in voting systems, fearing it could be exploited if certain details were to become public. State officials were also reluctant to cede any role in election preparation to the federal government.

Gradually, though, CISA and state election officials negotiated a fragile trust. At its center was a commitment: The sensitive information states and vendors shared with CISA would be kept confidential.

“It took years and years of building trust, of talking to election officials, of hiring people with elections experience who could be validators for the work that CISA wanted to do, before they finally built strong working relationships,” said Derek Tisler, who specializes in election security as counsel for the nonprofit Brennan Center for Justice, a nonpartisan institute based out of New York University School of Law.

Under Director Chris Krebs, CISA hosted penetration testing in which its agents would try to hack into a state’s system to locate weaknesses that could then be patched, along with tabletop exercises simulating a series of potential catastrophes around elections. CISA also offered regular secret-level briefings to secretaries of state to share federal intelligence. And CISA paid for sensor technology that looked for potential malicious online activity on election networks, notifying officials about emerging threats.

“The staffing was there, the expertise was there, the visibility was there, the funding was there,” Macias said.

The consortium shared data as run of the mill as spambots as well as more serious threats. If Virginia caught unusual activity in its system, it could let other states know to be vigilant.

While CISA had prepared for attacks from the Chinese and Russian governments, or lone wolf hackers, few there had expected the threat to elections would come from inside the White House. But when Trump refused to concede to Joe Biden in 2020, claiming the vote had been rigged, CISA became a key component of the guardrails that ultimately led to the election results being certified.

The agency, in a statement co-signed by secretaries of state and voting machine vendors, vouched for the election’s integrity, calling it “the most secure in American history.” When Krebs publicly rebutted claims amplified by the White House as “unsubstantiated” or “technically incoherent,” Trump fired him over Twitter.

As Congress prepared to vote on certifying the election results, it was members of CISA, along with the FBI, who convinced then-Attorney General Bill Barr that the conspiracy theories embraced by the president could be explained by human error, not systemic fraud or hacking.

When Trump returned to the White House in January 2025, his administration immediately started to dismantle CISA. The administrative notices were sent out just a couple of weeks after the inauguration and included the team in charge of dispelling disinformation.

For the employees under the DOGE microscope, work became impossible, said one former senior CISA employee. “Those groups couldn’t even order a pizza.”

DOGE laid off people critical to the agency’s election work, including those who’d worked closely with states. The Trump administration cut funding for the technology that monitored web and election servers, blinding the federal government to breaches it had detected.

When it came time for states to prepare for the 2026 midterms, CISA had disappeared.

On the evening of July 16, in the Black Hills of South Dakota, dozens of election officials and their staffs gathered for a reception near Mount Rushmore. It was the third night of an annual conference for secretaries of state, drawing participants from red and blue states. They’d spent the week discussing state voter roll maintenance and voter ID — issues that at times made for disagreements.

At about 8 p.m., a wave of discomfort swept through the crowd, visible on attendees’ faces as they glanced frequently at their phones, according to people at the event. Any minute now, Trump was going to address the nation on election security. Some at the reception worried he would declare a national emergency, as his allies had urged him to do months earlier, and use it as a pretext to direct the government to seize voting machines.

Then reports on the speech began rolling in, and the mood shifted. The claims Trump was making were unsubstantiated and outlandish. Many had been examined ad nauseam, including by those at the reception, and roundly debunked. The collective anxiety that was palpable moments earlier melted away, as many saw the speech as another attempt to revive disproved theories unlikely to be taken seriously by most voters.

“Everyone just sort of guffawed and put their phones away and went to the bar,” recalled Quinn Raymond, co-founder of VoteShield, a nonprofit that works with states to help monitor voter registration data, who was at the event.

Still, if the speech made little impact, records published by the Trump administration to support the president’s claims damaged the already eroding relationship between CISA and state election officials. The material included raw information states had shared with the agency that was supposed to remain private, such as a log of communications from Election Day 2020 detailing activity being monitored in several states.

“It betrayed the trust of all partners who were willing to share information at the time,” said Geoff Hale, who worked on CISA’s elections team from the agency’s inception until last year. Now he specializes in election security at the Center for Democracy & Technology, a nonprofit that advocates for digital and civil rights.

Bis, the White House spokesperson, denied that the Trump administration broke any agreements in releasing the information. “The release of such information is exactly the sort of transparency news organizations should applaud,” she said. Bis also defended Trump’s speech, saying it had been fact-checked “by the agencies whose evidence was released and did not mischaracterize any information.”

Hale and others said the speech was one of several instances demonstrating the Trump administration’s reckless attitude toward sensitive data collected by CISA. Earlier this year, Politico reported that acting CISA Director Madhu Gottumukkala had uploaded records to ChatGPT, even though DHS had barred its employees from using the unsecure program. A CISA spokesperson told Politico that Gottumukkala had been permitted to use the technology for a “short-term and limited” basis.

Last May, an independent journalist named Brian Krebs exposed that CISA published private data, including passwords, cloud keys and other information, on its public GitHub page, in a folder labeled “Private-CISA.” A CISA spokesperson told the journalist there was no indication that sensitive data was compromised.

Some state election authorities were also alarmed to see the lengths to which the Trump administration went to legitimize the president’s fixation on the 2020 race.

In fall 2025, Missouri election officials produced a memo stating Andrew McCoy Warner, a Department of Justice official and prominent 2020 election conspiracy theorist, had called several clerks asking for access to voting machines. Tulsi Gabbard, then the director of national intelligence, had also led an operation in Puerto Rico to seize election machines. When the private cybersecurity contractor hired to examine the machines, Mojave Research Inc., failed to find evidence supporting claims about 2020, the federal government became “dissastified” with its services and stopped renewing its contract, its CEO later told reporters.

A spokesperson for the Office of the Director of National Intelligence told reporters in August that Mojave’s work ceased because it had completed its contract. Testifying before Congress in March, Gabbard said the seizing of voting machines came at the request of an assistant U.S. attorney in Puerto Rico.

“What happened in the second Trump administration is from almost day one — I mean, literally the first two months — they took all that was built up by Trump 1 and just decimated it,” said David Becker, founder of the nonpartisan Center for Election Innovation and Research, a nonprofit that works with state election authorities. “Election officials lost trust in the federal government.”

It didn’t help that, in his speech, the president mocked CISA’s defense of the 2020 election, calling the statement about it being the most secure in history a “very pat line” concocted as part of a deep-state cover-up. One former career CISA employee described being crestfallen at the Trump administration’s erosion of all they’d accomplished.

“We worked so hard to build that trusted relationship,” said Caitlin Durkovich, former DHS assistant secretary for infrastructure protection and co-founder of the cybersecurity firm Civira Partners. “I don’t know how you put it back together.”

A few weeks after Trump’s speech, the state election officials gathered once more, this time for a video call with Nick Andersen, who had replaced Gottumukkala as CISA’s acting director.

Though the primaries were already under way, this was the first time many had met Andersen, a former cybersecurity adviser to Trump’s White House who had joined CISA a year earlier. Andersen is also a district representative for the Republican Party in Virginia, according to the party’s website. In March, he gave a speech to the Fairfax GOP chapter titled “Fighting Democrat Redistricting.”

Speaking over video in August, the boyish-faced former Marine Corps engineer announced that DHS was preparing to release a plan on how it would work together with state officials to secure the election, according to five people who were present at the video meeting, some of whom shared notes with ProPublica.

Many on the call were stunned at what they perceived as a lack of understanding of election planning. Early voting for the general election was just around the corner. They had spent over a year preparing for the midterms, and there was no more time for ambitious work.

Some peppered Andersen with questions: Where had CISA been when there was still time to make improvements?

Andersen blamed any lapses or perceived breaches in trust on the federal government shutdown in fall 2025, twirling his pen uncomfortably and sipping from a Monster energy drink.

Fontes, Arizona’s secretary of state, was blunt about his feelings regarding working with Andersen and CISA, according to several of the people on the call.

“I told him I didn’t trust him,” Fontes recalled in an interview. “I did raise my voice a little bit, because I’m frustrated — very frustrated — that they would have the temerity to come in, clear the entire deck of competent professionals, stop supporting the states, eviscerate the coordination efforts that they had and then suddenly come in and say: ‘Oh, we’re from the federal government. We’re here to help.’”

Indeed, one recently departed CISA official said attempting to do the agency’s typical election work now would be futile. In previous years, CISA had finished almost all its preparations with the states by Labor Day.

“That ship has sailed,” the official said.

CISA published its security plan for the 2026 election on Sept. 24. The 13-page document describes how, over the past two years, CISA has “recommitted to its statutory mission and remains resolute in strengthening the security of elections.”

State officials said their planning will ensure a secure election, even without help from CISA. Yet they and cybersecurity experts worry that Trump will say the election was hacked if Republicans don’t win in November.

The security plan calls for “leveraging collaborative partnerships” with states the agency has abandoned since Trump took office. Shenna Bellows, Maine’s secretary of state, said she’d welcome that but was skeptical of the agency’s motivations.

“For CISA to promise election officials now, at this point in time, that they are going to be a resource for the 2026 election is too little, too late,” she said.

Jen Fifield contributed reporting. Mariam Elba contributed research.

]]>

Hundreds of federal websites lack key defense against spies, senator says

David DiMolfetta — Mon, 19 Oct 2026 11:00:00 -0400

Sen. Ron Wyden, D-Ore., is urging the Trump administration to close an encryption gap that could let foreign adversaries track visits to sensitive government websites, including the FBI’s tip portal and a veterans crisis line, according to a letter sent to the Cybersecurity and Infrastructure Security Agency and the Office of Management and Budget on Monday and first seen by Nextgov/FCW.

Wyden asked CISA and OMB to require that agencies implement a web security standard that hides the name of the website someone is visiting. The protocol, known as Encrypted Client Hello, protects the website name when a user’s browser connects to a site and has been supported by major browsers and some web infrastructure providers since 2023.

Wyden’s office identified 350 federal web addresses that lack the encryption specification. They include sites that facilitate intelligence community job applications, immigration services, health information, and U.S. diplomatic websites around the world.

“This visibility could lead to malicious eavesdroppers identifying whistleblowers, profiling cleared federal personnel, tracking Americans seeking crisis support, and mapping interactions between agencies,” Wyden wrote to CISA acting director Nick Andersen and deputy federal chief information officer Thomas Flagg.

He also asked OMB, working with CISA and the Office of the National Cyber Director, to require that cloud and network providers support the technology to qualify for federal contracts. He requested responses by Nov. 20.

Nextgov/FCW has requested comments from CISA and OMB.

Federal websites generally encrypt the information people read or submit, though hackers can still learn which sites they visit by monitoring their internet traffic.

The letter singles out two services whose visitors could be particularly vulnerable.

The Department of Veterans Affairs’ Veterans Crisis Line platform uses Amazon Web Services, which does not currently support ECH for the site, according to the letter. Wyden warned that the exposure could help foreign adversaries identify veterans seeking mental health assistance. Additionally, the FBI’s tips.fbi.gov site uses Cloudflare, a provider that supports ECH, but the portal has not enabled it, the senator added, arguing the current arrangement could put people contacting the bureau at risk of identification.

The possible FBI exposure also comes after a prolific criminal hacker group recently stole troves of sensitive employee information tied to the bureau’s jobs portal.

The list of sites without the protocol also includes hotline.oig.dhs.gov, the DHS inspector general’s complaint hotline; civilrights.justice.gov, the Justice Department’s civil rights reporting portal; and apply.intelligencecareers.gov, an intelligence community recruitment site. Federal HIV information sites, including hivinfo.nih.gov and clinicalinfo.hiv.gov, are also listed.

To craft the list, Wyden’s staffers tested federal web addresses using third-party network providers to see if ECH successfully hid which specific websites were being visited, a spokesperson told Nextgov/FCW. The protection only appeared to work on sites relying on Cloudflare’s free service tier, the spokesperson added.

The letter does not establish that adversaries have tracked visitors to any of the listed addresses.

Wyden argued the government can close these gaps using technology already supported by major browsers and deployed across millions of websites. For agencies whose providers support ECH, enabling it can be as simple as changing a setting, he said.

“Modern federal zero trust cybersecurity practices rely on protective software installed directly on agency devices, so enabling [Encrypted Client Hello] would strictly improve the cybersecurity of federal networks,” Wyden wrote.

The effort follows his September call for NSA to update its advice about virtual private networks. A Congressional Research Service analysis requested by his office at the time warned that foreign intelligence services with broad visibility into internet traffic could potentially connect VPN users to websites by comparing traffic patterns.

]]>

Russia has moved past ‘hybrid war.’ Why hasn’t Washington?

Nikkie Lyubarsky — Sun, 18 Oct 2026 09:00:00 -0400

On a recent September afternoon, David Petraeus, the former CIA director, was heading home by train from a security conference in Kyiv. What should have been a routine trip into Poland was upended when the state railway, Ukrzaliznytsia, ordered passengers off the train. Fifteen minutes later, Russian drones were heard overhead, and the train was struck shortly after the last passengers had been evacuated.

The attack is just one of the indications that Russia’s decades-long campaign against the West has outgrown the label of “hybrid war.” While Moscow’s efforts remain below the threshold of open war, they have grown more brazen and kinetic. And while European allies are moving quickly to counter Russia’s escalation, the United States lags behind.

The past few months have seen a striking number of Russian operations against Europe and a sharp change in tactics towards the United States. In August, a Russian drone carrying explosives struck the wing of a Ukrainian cargo plane at Germany’s Leipzig airport, a hub for NATO airlift to the eastern flank; the attack only failed due to a faulty detonator. That was just the most recent incursion into alliance airspace by Russian drones and even jets; IISS has tracked more than 100 confirmed or suspected incursions, including an explosive-laden drone shot down over Lithuania to a drone that struck an apartment building in Romania.

Of the train incident, Ukrzaliznytsia officials have said it was “entirely possible” that the drone had missed its intended target: a diplomatic train carrying two former prime ministers, Sweden’s Carl Bildt and the UK’s Boris Johnson, which had departed from Kyiv earlier than planned. Whether Petraeus was the intended target is irrelevant. The strike was a close call; injuring or killing a former U.S. official would have marked a sharp and reckless escalation in U.S.-Russian relations. This incident nevertheless reflects the Kremlin’s growing comfort with operations that put senior U.S. figures at risk.

Just days after that, the U.S. Justice Department announced a striking indictment that underscored how far the Kremlin’s escalation against the United States has gone. It charged five people connected to Russian intelligence with conspiracy to finance terrorism, and three of them with conspiracy to commit murder for hire. The network allegedly recruited people inside the United States to surveil and ultimately “eliminate” or “disappear” critics of Russia’s war in Ukraine. In one alleged plot, the network sought to have a Russian dissident killed on U.S. soil. Dozens of such plots have been uncovered in Europe but they have remained rare in the United States. This one places Russia alongside Iran, which has repeatedly plotted to kidnap or kill dissidents and former officials on American soil

Analysts have long believed that the Kremlin has sought to maintain deniability, plausible or implausible, when it moves against the West. Plausible deniability refers to a state’s ability to disclaim responsibility because the evidence is too ambiguous to act upon; implausible deniability refers to a state’s denial when attribution is obvious, often a way to signal with only a veneer of “escalation control” or aimed at its domestic audiences such as Russian-speaking communities rather than the targeted government. Yet the bold, sometimes sloppy character of the past year’s operations suggests the Kremlin is increasingly willing to forgo even that to continue to intimidate foreign governments and their citizens and to gather military intelligence. As the war in Ukraine has dragged on, economic pressure on the Kremlin has mounted, and Moscow appears to have entered a new phase in its conflict with the West. Raising the costs of Western support outweighs the value of deniability. At that point, these are no longer hybrid operations, but overt external operations.

European allies, for their part, have begun to escalate their own responses, even as diplomats and officials continue to describe the Russian threat as hybrid. Rather than simply announcing when a Russian drone or ship enters NATO territory, or summoning Russian diplomats, governments across Europe have begun shooting down drones and responding militarily. In late September, Poland’s Deputy Defense Minister Cezary Tomczyk announced that Polish fighter jets would no longer need visual confirmation from a pilot before downing a Russian drone; radar-based “positive identification” would now suffice.

The United States, by contrast, continues to treat the Russian threat as largely latent. To be fair, Russia’s tactics on the European continent remain more brazen and kinetic than those it employs against the United States. But Washington’s NATO commitments alone make Russia’s campaign against Europe an American concern, and Moscow is now escalating against the United States directly as well. If the pattern observed in Europe holds, its operations against the U.S. will grow only more brazen and openly hostile. While some U.S. agencies may recognize the rising threat, as the DOJ’s unsealing of charges against the Russian network and CIA Director John Ratcliffe’s August visit to Moscow could demonstrate, Washington still remains divided on how to classify it, and much of that division stems from the White House itself.

Messaging from the White House over the past month alone is mixed. On Sept. 15, Attorney General Todd Blanche stood in the White House Rose Garden to announce charges against a Russian intelligence network accused of plotting to murder a dissident in the Washington area. Eight days later, the administration invited Vladimir Putin to the G20 summit in Miami. The same month, President Trump signed the most significant Russia sanctions legislation since 2017, only for his administration to reportedly weigh sanctions relief days later.

The administration may view engagement with Russia as necessary to broker an end to the war in Ukraine, but these mixed signals leave agencies without a clear mandate and Russia without a clear message to de-escalate. Treating the Russian threat for what it is requires messaging from the top. A plot by Russian intelligence to commit murder on U.S. soil is a significant escalation, and it demands a clear response. Until Washington decides how it should view the threat from Russia, and respond accordingly, Moscow will continue to escalate until it finds a red line.

This commentary is published in coordination with the 2026 Global Security Forum, of which Defense One is a media partner.

Nikkie Lyubarsky is a Research Associate at The Soufan Center.

]]>

US withdrawal won’t end the region’s ISIS dilemma

Julie Chernov Hwang and Caroline D. Rose — Sat, 17 Oct 2026 09:00:00 -0400

The U.S. military recently completed its withdrawals from Iraq and Syria, ending a decade of leadership in the counterterrorism fight against the Islamic State in the Levant. The gradual drawdown was meant to avoid a sudden vacuum that proxy militias, malign regional actors, terrorist organizations, and great-power rivals could fill, as happened in Iraq and Afghanistan. Yet ISIS, while greatly reduced, persists in Iraq and Syria, which must now build a sustained regional counterterrorism effort to prevent the group’s resurgence.

The absence of an American footprint in the two countries reduces cost and risks to personnel, but it also diminishes visibility into ISIS networks, undermines security relationships, and eliminates a forward position from which Washington could detect and disrupt terrorist threats before they affect U.S. interests and foreign partners.

While ISIS has mounted fewer attacks in Iraq and Syria since 2025, this is evidence not of diminished capacity but of strategic recalibration. In Syria, ISIS has been busy diversifying its targets and methods. In June alone, ISIS attacked oil tankers, commercial trucks, security checkpoints, military regional headquarters, political figures, judges, and buses ferrying personnel from the Ministry of Defense. In July, a bomb killed 10 people at a Damascus café frequented by officials working in the Justice Palace. Two more bombs exploded during President Macron of France’s first state visit, killing 10 and 18 people near the Four Seasons Hotel and Ministry of Tourism respectively.

Counterterrorism infrastructure, never perfect to begin with, can erode quickly after American forces leave. This has been seen in the dissolution of the Counter-ISIS mission and the emptying of ISIS detention camps like Al Hol and Al Roj. It has also been seen in the region’s prisons. As ISIS has lost operational capacity and territory, the group has turned to prison breaks as a strategic imperative, undertaking campaigns like the “Breaking the Walls” Campaign of 2012-13 in Iraq to replenish its ranks.

The threat is acute in Iraq, which took in 5,700 ISIS-affiliated prisoners—not only Iraqis and Syrians, but residents of 61 other countries—after the SDF’s January collapse in northeast Syria. It put them in prisons that were already overcrowded and under-resourced, and accepted responsibility for their detention, interrogation, and trial. The U.S. presence had helped encourage the humane treatment of prisoners and fair trials for those charged with terror crimes, reducing ISIS’ ability to use the prisons for recruiting, networking and organizing. Now, the troops have departed amid real concerns about backsliding.

In Syria, concerns remain about whether Syrian forces can integrate effectively and quickly to sustain ISIS’ defeat, in the face of recent incidents like ISIS infiltration into the Syrian Army and recent high-profile plots and attacks beyond ISIS’ traditional area of operations. Syrian prisons have also been targeted for breakouts, including ISIS’ 2022 attack on Al Sinaa prison and a January attempt at the Shaddadi detention facility.

Throughout the fight against terrorist organizations in Iraq and Syria, American personnel provided intelligence, surveillance, reconnaissance, airpower, special operations capacity, logistics, and local partnerships to local forces. This allowed the U.S. and its partners to monitor and disrupt groups like the Islamic State and defeat its territorial caliphate, while also giving Washington on-the-ground insight into terrorist organizations’ rapidly evolving tactics, as well as local political and security dynamics.

Absent these resources, it is likely the number and severity of ISIS plots and attacks will increase. Washington, its partners, and the Iraqi and Syrian governments must find creative ways to fill the security gaps. Syrian and Iraqi neighbors—Jordan, Türkiye, Lebanon, and other regional players—must begin forging close relationships with Damascus and Baghdad. Without these relationships, the region risks losing years of counterterrorism progress—and the U.S. may be forced to intercede once again.

This commentary is published in coordination with the 2026 Global Security Forum, of which Defense One is a media partner.

Caroline D. Rose is a Senior Director at the New York City-based Soufan Center, a nonpartisan research institution, where she conducts research on the crime-terror nexus, security, counterterrorism, and U.S. defense policy with a focus on Iraq and Syria. She is a Senior Nonresident Fellow at both the New Lines Institute and Orion Policy Institute, both where she writes about trends in terrorism and geopolitics.

Dr. Julie Chernov Hwang is an Associate Professor of Political Science and International Relations at Goucher College. She is a Senior Research Fellow at the Soufan Center & a Harry Frank Guggenheim Distinguished Scholar with over a decade researching terrorist behavior, notably social networks, radicalization, commitment, role assignment, disengagement, rehabilitation, reintegration, repatriation, and deradicalization.

]]>

Marines fielding new tech for prolonged medical care on the battlefield

Meghann Myers — Fri, 16 Oct 2026 15:51:04 -0400

The Marine Corps is preparing for a future battlefield on which the injuries are the same but the ability to quickly fly troops to a trauma hospital is very limited. To close that gap, the service is fielding new tech like mobile blood banks and ultrasounds, with a self-contained power source to keep them running.

The Expeditionary Medical Refrigeration Unit and Mobile and the MEQU mobile blood warmer were deployed to U.S. Central Command this year, where a unit set up a continuous mobile blood bank and sent their notes back to the Marine Corps on how to make it better, officials told reporters Friday during a media round table.

“We were told that the EMRU was instrumental to their ability to maintain a revolving blood bank to ensure that they had what they needed to be ready to care for injured service members,” said Navy Cmdr. Kyleigh Hupfl, clinic for Expeditionary Medical Systems.

The concept of the “golden hour,” the critical time period after a casualty that made all the difference in getting a wounded service member from the battlefield to hospital triage during the Global War on Terror, will be much more complicated in a near-peer fight.

While ground fighters could sometimes shoot down a medevac helicopter in Iraq or Afghanistan, an enemy with more sophisticated surveillance and missile technology will mean commanders have to wait to call in evacuations and work to stabilize casualties on site for much longer than in more recent conflicts.

“We're leaving the golden hour behind, and we're moving toward those longer patient-care hold times,” said Col. Paul Gillikin, program manager for Combat Support systems. “Again, fully recognizing the future fight against a peer competitor, over those great distances in the Pacific—we know that we're not going to have the developed [forward operating bases], the full mobility, the Iron Mountain.”

The No. 1 cause of battlefield death is severe bleeding, so being able to not only slow bleeding but give transfusions on site will be crucial.

“We need to be able to bring cold-chain distribution forward without relying on heavy generators, and we need to be able to do that in a sustainable way. We need to be able to warm that blood so that we don't get that patient in a worse-off situation,” Hupfl said. “We need to be able to see, after that, whether they have continued bleeding, so that the commander can make a risk decision on putting an evacuation asset at risk to get that patient out.”

That’s where the battery-powered EMRU and the associated blood warmer come in, as a mobile system that keeps blood products refrigerated, then heats them to body temp for quick transfusions. The Corps is also fielding the KOSMOS point-of-care ultrasound to assess internal bleeding, and the Marine Corps Squad Power Manager medical kit variant to keep them all running.

“We expect in the Marine Corps to be in distributed environments, where the evacuation will be delayed or contested,” said Brig. Gen. Tamara Campbell, deputy commander of Portfolio Acquisition Executive Marine Corps. “And so the equipment that we're looking at is to take that into account, regardless of the time it takes to apply that care. We need to do that at any time so that any of our soldiers, sailors, Marines—anybody that's within our operating environment needs that level of care.”

]]>

The real job of the Army’s new ‘robotics technicians’ is constant adaptation

Patrick Tucker — Fri, 16 Oct 2026 15:10:17 -0400

You likely have a picture of the future of drone-assisted warfare: a soldier in a trench or a bunker, eyes enveloped in a virtual reality headset, hands clasping a controller, attention on targets below the drone he steers. But the reality of robot-assisted soldiering has already moved elsewhere, according to the military leaders who are training elite forces for future conflict.

On Oct. 2, 10 warrant officers became the Army’s first robotics technicians under the new 390A military occupational specialty. On Tuesday, Maj. Gen. Jason Slider, who commands the U.S. Army John F. Kennedy Special Warfare Center and School at Fort Bragg, described how their jobs will go far beyond remotely piloting or maintaining a drone or ground robot.

“It's important that it's not a pilot. We're not building a pilot. What we're building is a soldier that can adapt a piece of robotic kit to the mission, to the enemy, to the terrain,” Slider said at a Defense One event on the sidelines of the AUSA annual conference.

He described this as one of the most important lessons to emerge from Ukraine in terms of designing doctrine and training for the age of battlefield autonomy.

“We looked at the Nagorno-Karabakh, at Ukraine, and we're studying the ongoing conflicts in the Middle East,” he said. Militaries that “solely focus on pilots quickly lose the advantage to an adversary or an enemy force that can adapt that piece of tech to the mission.”

Adaptation was key to Azerbaijan's 2020 victory over Armenia in Nagorno-Karabakh. A 2021 report from the Center for Army Lessons Learned describes an Azerbaijani tactic in which “remotely piloted Soviet-era AN-2 biplanes flew at low altitudes as decoys to force the Armenians to respond against the perceived threat,” a use of robotics to surprise and confuse the enemy, not just drop bombs on them.

The United States used a similar tactic in the Middle East at the outset of Operation Epic Fury earlier this year, swarming Iranian forces with cheap drones modeled after the Shahed drones that Iran was using against U.S. forces. Both cases show the importance of deploying robotics, autonomy, and semiautonomy in ways the enemy had not yet predicted.

Chief Warrant Officer 5 Michael Updike, one of the architects of the 390A program, said at the Defense One event that the robotics technician military specialty will include aspects of intelligence analysis, command and control, communications, software development under extremely difficult and disconnected conditions, and even acquisition.

“What it encompasses is different pillars of not only software engineering and mechanical engineering but your data science, understanding research and development,” Updike said. “They have to do all that innovation in the field without…large-language models that are connected to the internet.”

The job will also entail rapidly inventing new capabilities on the ground, much as Ukrainian forces have done, and working with contractors who can do so as well.

During the first phase of the 19-week 390A training course, a group of students improved hardware and software to allow drones under electromagnetic attack to communicate with one another in a mesh network.

“They took a high-definition, $1,000 camera, put it on this quadcopter. They were being jammed in frequencies but they were using a mesh network. So, even though one node was taken out, they had multiple nodes where they could still have communications with the quadcopter or the unmanned drone to be able to still accomplish that mission,” Updike said.

To teach the skills of constant adaptation, Slider said, much of the course is designed to “drive failure” and force reconsideration. That’s something that the course architects themselves had to do when f, the students began, in Slider’s words, “outpacing the curriculum” four weeks in. They were too good at drone warfare, which meant that the course wasn’t hard enough. So Slider worked with academics, sources, and international partners to make the course more difficult, adding additional weeks of training.

“The problems that they were able to solve during the culminating exercise were much closer to the need that the operational force was communicating to us,” the general said.

The 390A program won’t be limited to Fort Bragg. This week, acting Army Secretary Adam Telle said, “Traditionally, historically, those types of [military occupational specialty] might live at — with the special forces and never be proliferated throughout the Army.”

Telle said that his office was working with the office responsible for special operations and low-intensity conflict to expand the specialty but did not provide further details.

]]>

The lack of a shared lexicon is undermining responsible AI-military integration

Jason Warner and Sofia Romansky — Fri, 16 Oct 2026 12:11:36 -0400

Today’s headlines are full of killer robots and doomsayers, but the most urgent risk in military AI is more mundane: the people shaping it share neither a common lexicon nor common data.

The problem is not a lack of discussion. The authors have taken part in many global deliberations, both as conveners and as private-sector representatives, and we can report: If the world is to forge responsible governance of AI in the military domain, it will need shared definitions and a way to fuse relevant developments and decisions into something approximating “ground truth.”

The players in AI-military integration come from every realm: governments, militaries, the private sector, academia, the legal system, civil society, human rights, technology, journalism, and more. In multilateral negotiations and colloquial parlance, they speak varied languages—literally and topically. They are guided by varied incentives: some are eagerly pursuing AI-military integration, while others are trying to regulate it. A word like “autonomy” means something different to a general, an engineer, a lawyer, and a human rights advocate, not to mention the nuances born of the 200 or so countries they call home.

The staggering breadth of these players, combined with the wide range of AI applications, means that data about their actions is scattered. It can be found in government contract announcements, legislation, news coverage, court documents, patent applications, and beyond, in nearly every global language. This has made it impossible to track and compare developments within and across countries.

Without common language and common data, humanitarian organizations often talk past supply-chain experts. Tech executives fail to communicate effectively with academic researchers. Efforts to develop responsible AI-military integration cannot move ahead.

This is not a new concern. In 2024, the Responsible AI in the Military Domain Summit, or REAIM—the preeminent forum for global discussions of the topic—urged stakeholders to begin “fostering a common understanding of…capabilities and limitations [of AI-military integration], and a shared understanding of the possible applications…and their potential impacts, including both benefits and risks.” The same year, the United Nations Institute for Disarmament Research Roundtable for AI, Security, and Ethics identified six priority areas for governance, including: “Building a shared and solid knowledge base on AI in the military domain, developed through cross-regional, inter-disciplinary and multi-stakeholder input.” And last year’s report by the Global Commission REAIM urged states to “maintain international repositories of best practices, including AI concepts and definitions, AI capabilities in specific contexts of application…and military AI policies” to support national and international regulatory efforts.

One effort to bridge the data gap is the AI-Military Integration Database, operated by AIMID, a private company whose CEO is one of the authors. The database does a daily scan for news and information about AI-military integration in more than 20 languages—news reports, company announcements, academic articles, legislation, contracts, think tank reports, and more. The result is an ever-growing knowledge graph: a structured, footnoted map of actors, technologies, events and the relationships between them. This makes it possible to see which countries are doing what, with what technologies, from what companies, and for what use cases. In short, AIMID aims to deliver a single, verifiable picture of global AI-military integration, a data-driven “ground truth.”

Among other benefits, the database aims to help allies and partners pool knowledge about testing, evaluation, verification, and validation—supporting innovation and interoperability while avoiding the costly duplication of technical efforts. It might also help reduce tension between global rivals by providing empirical reference points, reducing dangerous interstate misperceptions, and ensuring that states’ security policies are anchored in evidence rather than ambiguity. For anyone concerned with responsible AI-military development—governments, businesses, NGOs, academics, or average citizens—AIMID serves as a unique resource,

But more than merely recognizing that data fragmentation is hindering responsible military-AI progress, defense leaders around the world should next fund and adopt the tools necessary to fully understand the data and intelligence-gathering side of this new ecosystem. Indeed, while organizations like AIMID cannot fully solve the fundamental problem of data fragmentation, they represent some of the best resources available.

This commentary is published in coordination with the 2026 Global Security Forum, of which Defense One is a media partner.

Dr. Jason Warner is the CEO of the AI-Military Integration Database (AIMID). He holds a Ph.D. from Harvard University.

Sofia Romansky is a Strategic Analyst at The Hague Centre for Strategic Studies (HCSS) and Subject Matter Expert for the NATO Defence Education Enhancement Program (DEEP). She previously served as the Project Coordinator of the Global Commission on Responsible Artificial Intelligence in the Military Domain (GC REAIM).

]]>

Fast-flying Shahed drones spur new class of interceptors

Lauren C. Williams — Fri, 16 Oct 2026 07:00:00 -0400

WASHINGTON—A surge in Russia’s use of jet-powered Shahed drones in Ukraine has spurred the need for super fast interceptors to defeat them. And it’s a problem U.S.-based dronemaker Powerus hopes to solve.

“We constantly need to move ahead of the threat. The next threat that we see to get in front of is the jet-powered Shahed drones,” Brett Velicovich, cofounder and president of the dronemaker Powerus, told Defense One. “Jet-powered Shaheds are very difficult to defeat because of how fast they are, and so to defeat those, we need jet-powered interceptors. So that is one of the things that we're looking at…to be able to fly an interceptor at 600 kilometers per hour, 700 kilometers per hour. That's going to require a lot more automation. It's going to require a lot more R&D.”

Newer versions of Shahed drones propelled by jet engines have increasingly been appearing on the Russian-Ukrainian battlefield in recent months, pushing Ukraine to fortify its air defenses. Those fast flying Shaheds require interceptors that can match those speeds—around 370 mph, or 600 kilometers per hour. Other versions of the Shahed fly just over 100 mph. There’s also concern that other security risks could crop up as other nations adopt the newer Shaheds.

Powerus is just about a year old and has former Pentagon and first Trump administration officials on its board.

Velicovich doesn’t have a target date for developing its rocket or jet-powered interceptor, but the goal is to move quickly.

“I spend a lot of time in Ukraine. There's a good chance that by the end of this year, the majority of Russian drones that are sent into downtown Kyiv will be jet-powered,” he said, “so we really need to move at that timeline.”

But churning out rocket- or jet-propelled interceptors at the same rate as the upgraded Shahed drones can be costly and difficult.

“They can build these things for $20,000-$30,000, and they can turn them out in massive, massive quantities. And so, to do that in an interceptor is very difficult,” Velicovich said. “But the technology is getting cheaper and cheaper, so we'll find a solution for that I think pretty soon. The entire industry is racing to figure that out.”

Powerus, which recently went public, has been busy in recent months.

The Rock Hill, S.C.-based company unveiled its fully autonomous interceptor, Guardian 3, during the Association of the U.S. Army’s annual conference here. The anti-drone tech is the latest addition to a family of interceptors, including the semiautonomous Guardian 2 and remotely piloted Guardian 1.

“Guardian 3 takes that final terminal phase of a manual operator out of the loop, and it is fully automated, similar to how you might fire a Patriot missile. The difference between us and the Patriot missiles is that…you can build these Guardian 3 systems in the thousands very easily,” Velicovich said.

The company aims to produce 5,000 interceptors per month by November, with an ultimate goal of being able to deliver 10 times that.

“We want to get to that point where it's just massive, massive scale because these things are a lot like artillery rounds, and we need to build them like artillery rounds. So we need more companies out there that have the industrial capacity…to turn these things out,” he said.

Also at the conference, Powerus signed a deal with Parsons on the showroom floor to pair its radar systems with Guardian interceptors to detect oncoming drone threats.

Earlier this year, the Air Force tapped Powerus in an $82 million deal for counterdrone systems, which includes the Guardian family of interceptors. The company has also branched out to international buyers, striking an unspecified deal with the Pakistan army for unmanned aerial systems.

]]>

Defense Business Brief: Wrapping up AUSA

Lauren C. Williams — Thu, 15 Oct 2026 15:31:35 -0400

WASHINGTON—Six anti-war protestors disrupted an autonomous warfare discussion featuring Pentagon chief Pete Hegseth and the military service secretaries Wednesday at the Army’s annual conference. By the time the third protester shouted denouncements of the U.S.-Iran war, some members of the audience had begun chanting “USA, USA.”

The politically charged atmosphere isn’t typical at the show. But this year, it served as a contrast for what appeared to be a more prominent international presence than previous years—from the number of international companies represented to the size of the displays.

Ukrainian companies made their debut with a massive tent just two blocks from the convention center. Overall, there were 165 international companies and nine international pavilions on the showroom floor, representing Australia, Canada, Denmark, France, Germany, Greece, Israel, Korea, and Norway, the Association of the U.S. Army, or AUSA, told Defense One.

The roughly 2,000-member international delegation was about average, representing 92 countries—including 27 army chiefs, 14 sergeants major of the Army, 17 ambassadors, and two ministers of defense, according to AUSA.

But the ambassador count this year was also higher, AUSA said. That could be an indication that while political tensions rise, there’s still an appetite for diplomacy—and foreign military sales.

Welcome

You’ve reached the Defense Business Brief, where we dig into what the Pentagon buys, who they’re buying from, and why. Send along your tips, feedback, and song recommendations to lwilliams@defenseone.com. Check out the Defense Business Brief archive here, and tell your friends to subscribe!

1:1 with Mike Wior, CEO + co-founder of Allen Control Systems. ACS was one of 10 companies to land a counterdrone IDIQ contract with the Pentagon’s Joint Interagency Task Force-401 last month, and things haven’t slowed down since. The company makes a robotic turret, called Bullfrog, that can turn machine guns into a counterdrone weapon using AI and autonomy.

“We just got our $500 million IDIQ. We are, obviously, working on getting funds into that as quickly as we can…getting to that point where we can prove on the battlefield, yes this works, and we should be replicating this across all the different services that need this type of capability,” Wior told Defense One during a break from the bustling AUSA conference showfloor.
But the lack of a budget could stymie progress the Pentagon is trying to make in cultivating a tech-forward industrial base, he said.
“Is the military going to be able to sustain this new ecosystem of defense tech companies? Can companies survive in this environment? What do they need to survive in this environment…when the military ultimately doesn't have full control over their own budgets?” he said. “It's a challenging environment as a startup.”
But ACS is still pushing forward with a new facility.
“We just opened a 200,000 square foot facility in North Austin” with the goal of increasing production capacity beyond 50 turrets a month once the orders come in, Wior said.
“Whenever the orders come in, we start to fill out that IDIQ, and we can expand pretty quickly…by leveraging commercial off-the-shelf components, we have a lot of flexibility there, and then it's just a matter of expanding the workforce.”
And they’re eyeing international deals.
“We want to see more of an international economy for defense products…and we want to make our technologies available to other countries. Because that's needed, I think, in this environment where if it's just the United States government and they have a two-year appropriations problem, you might lose some really, really great technologies to attrition—just the ability to stay around long enough and participate.”

Up, up, and away. The Army Space and Missile Defense Agency wants “a family of stratospheric systems,” such as high-altitude balloons, in a range of platform sizes that can provide “space-like capabilities” closer to Earth, Col. Joseph Mroszczyk, who leads the agency’s transformation integration directorate for space superiority, told reporters Wednesday.

“From about 60,000 feet to 100,000 feet is what we focus on in the stratosphere. That operational space allows some persistence and broad coverage in an area where you can deliver space-like capabilities in terms of payloads” while also being able to “take advantage of winds that are pushing you where you want to go already…to get either launched effects or other types of payloads for sensing and communications.”
The agency hopes to start multiple experiments in the coming year.

Bonus: The agency is also “working on a virtual space training environment,” Mroszczyk said. “We're building the virtual space layer to be able to visualize and understand how space effects can play in modern operations.”

Biodefense prep. The Army wants biothreats to be a routine feature in major military exercises, as outlined in its updated biodefense strategy released last month.

Turning that doctrine into actual readiness requires incorporating biothreats into “big” military exercises where it's “an operational constraint, and the whole of staff has to come to bear against it,” Alison Tamasi, the Army Nuclear and CWMD Agency’s chief of survivability and effects analysis division, told reporters Monday.
“Our next target on the wall is looking toward some of those routine things like [Army warfighter exercises] where we can start to put bio defense in as one of the injects.”
Context: These can be tabletop exercises, typically at the corps level or lower, where commanders and subject-matter experts map out responses to proposed scenarios, such as a viral outbreak at a port.

Making moves + other news

Anduril will let employees sell shares through a tender offer, bringing the company’s value to about $90 billion.
BAE Systems now has two new counterdrone systems: a multi-domain artillery cannon system and high-power microwave.
Leonardo DRS landed a $500 million IDIQ contract with the Pentagon’s counterdrone task force, JIATF-401, for tactical expeditionary sensing tech.
Merlin Aerospace completed the first flight test of its new autonomous pilot, which is being designed to aid in missions like “maritime search and patrol,” the company announced on social media.
The Pentagon signed an agreement with the Small Business Administration to increase access to strategic capital to help “defense-critical manufacturers, suppliers, and innovators.” In the deal, the Pentagon will identify companies that need financing through its Business Operators for National Defense (BOND) initiative and refer potential candidates to SBA.

]]>

The most important alliances will lead to critical minerals

J. Peter Pham — Thu, 15 Oct 2026 15:00:11 -0400

The raison d’être of the “Concert of Europe,” the preeminent compact between the great powers of the 19th century, was to maintain the balance of power and suppress revolutionary movements. The post-World War II alliance systems sought collective security and deterrence. And the most relevant alliances of the 21st century will be the ones that secure the materials needed for key armaments and new technologies.

In the first decades after the Cold War, the global economy seemed to settle on a dispensation that was heavily digital, light on assets, and tilted toward “just-in-time” manufacturing. It also leaned on heavily financialized business models that privileged services, software, and ever smaller and faster microprocessors.

Then came what American mining entrepreneur Robert Friedland dubbed the “revenge of the miners.” Emerging technologies—starting with electric vehicles and running through data centers and artificial intelligence—required prodigious quantities of material inputs from bulk metals to rare earth elements. And so did modern conflicts, from Russia’s war on Ukraine to the American-Israeli conflict with Iran.

The physical economy is back, and with a vengeance. Years of underinvestment and long lead-up times mean that surging global demand will exceed supplies of most critical minerals for the foreseeable future.

Further exacerbating the challenge for many countries, especially the United States and its traditional allies, is the dominant position that a single country, China, has painstakingly consolidated in the global production and processing of many critical minerals. It produces up to 98 percent of the world’s processed gallium and germanium, 95 percent of its refined magnesium, more than 90 percent of its rare earths and battery-grade graphite, 80 percent of its cobalt and tungsten, and 70 percent of its titanium. China is even the top producer of several metals that are mostly mined elsewhere.

The military effects of this commercial advantage are highlighted by this year’s conflict in the Middle East. One study by researchers at the Payne Institute for Public Policy at the Colorado School of Mines looked at the first 96 hours of combat after the war was launched on Feb. 28. In that period, the scholars estimated, U.S. and Israeli forces deployed 5,197 offensive and defensive munitions, consuming some 2,197 kg of cobalt and 11,444 kg of tungsten—materials of which China controls roughly 80 percent of the supply. (Remember that, unlike metals used in buildings or other manufactured good, metals used in armaments get only one use and cannot be readily recovered or recycled.) The much-discussed challenge of replacing the Pentagon’s depleted arsenal is not only about production facilities but about the materials they need.

The need to reduce this dependence on a geopolitical competitor was the impetus behind President Trump’s Executive Order 14415. It restricts defense contractors’ use of waivers to source critical minerals and other material inputs from foreign adversaries, expanding oversight over supply chains of subcontractors. It also instructs the Secretary of War to fast-track efforts to identify alternatives and other remedies to supply-chain gaps.

Nor is defense materiel the only driver of demand for critical minerals. The AI revolution has turbocharged competition for some two dozen minerals for everything from power infrastructure (prices for copper, for example, hit near-record highs in early September) to transformer cores where grain-oriented electrical steel has been identified as an especially constrained enabling material, while shortages of gallium, germanium, graphite, lithium, cobalt, and rare earths threaten both chip manufacturing and the buildout of data centers.

The U.S. administration’s concerns about supply-chain vulnerabilities are shared with some of America’s closest allies, with the leaders of the G7 striking an urgent tone in the joint declaration on securing supply chains for critical minerals coming out of their June summit in Évian-les-Bains: “In light of the high degree of market concentration, the need to reduce vulnerabilities regarding those resources and the growing use of arbitrary trade restrictions, we recall the urgency of diversifying our supply chains and building our collective resilience.” Moreover, in a marked departure from the past G7 communiqués on the subject which tended to be long on platitudes and short on substance, the group committed to specific quantifiable targets for reducing its members’ dependence on the unnamed “single supplier outside the G7 and partner countries” whose “use of non-market policies and practices and economic coercion, including arbitrary export restrictions and retaliatory measures on critical minerals and their related dual-use items” threaten the security of G7 to less than 60 percent by 2030 for REEs and permanent magnets and thereafter to half “as soon as possible.”

This undertaking will not be easy and is only possible as a collective effort to develop resources where they can be found among friends (or, at least, non-adversaries), supporting processing value chains, and incentivizing production through the judicious use of guaranteed offtake agreements. Success for any alliance will be predicated on its expanding the political geography. While Australia, Brazil, and South Korea were included in the G7 discussions this year, noticeably absent was anyone from Africa, the continent being home to one-third of the earth’s mineral resources, including a majority of some key minerals like cobalt, manganese, and the platinum group metals. Success will depend as well on embracing new technologies to increase production. Infrastructure, too, is the key to unlocking bottlenecks in global critical minerals supply chains, while cultivating numbers of qualified personnel is essential to optimizing the transformation of raw ores into high-purity materials as is the availability of reliable, cost-effective energy at massive industrial scale for all the steps from crushing and grinding to chemical separation and thermal refining—all requirements which in turn will shape the composition of alliances for strategic materiel.

At the start of the Cold War, American journalist Walter Lippmann famously described alliances as resembling chains. Prevailing in the 21st century’s struggle for geopolitical and economic advantage will require forging new links to build a chain that is strong, seamless, and resilient.

Ambassador J. Peter Pham, former U.S. Special Envoy for the Great Lakes and Sahel Regions of Africa and a distinguished fellow at the Atlantic Council, is Executive Chairman of Ivanhoe Atlantic.

This commentary is published in coordination with the 2026 Global Security Forum, of which Defense One is a media partner

]]>

Meet the agency using AI to screen grant applicants for links to potential adversaries

Edward Graham — Thu, 15 Oct 2026 14:51:00 -0400

The Department of Transportation has been using artificial intelligence to determine whether grant recipients have ties to adversarial nations, an agency official said on Wednesday.

The federal government has taken a variety of steps in recent years to limit hostile foreign governments’ access to American research, including restricting access to individuals or entities connected with countries like Iran or Russia. As the U.S. seeks to maintain its dominance over China in the global tech race, the Trump administration and Congress in particular have also been tightening the rules on collaborating with organizations or scientists who could conceivably share sensitive technologies or information with Beijing.

It’s not easy, however, for officials or research institutions to unravel these threads, particularly when bad actors are surreptitiously working on behalf of nation states. But new capabilities could help to better chart these connections.

Neil Chaudhry, senior advisor for AI at Transportation, said his agency has worked with partners to create “some really robust AI tools” to analyze the recipients of its research grants.

“When we get to a down-select from grants that are some really promising research projects, we sort of do a deep dive on the [principal investigators] in the grant that says … do they have direct links to the [Chinese Communist Party] leadership, or do they have links to Russian oligarchs?” Chaudhry said during a panel at the SAP Public Sector Summit in Washington, D.C.

“What we don't want to do is go on a fishing expedition,” he said, adding that identifying these kinds of relationships is “not based on the color of their skin and their nationality or something,” but on factors such as whether an individual or entity may be receiving funding from questionable sources.

“If it's a company that's funded by a [venture capital firm] in Silicon Valley, that VC is probably funded by another VC in the Middle East or in Malaysia, and that VC is then wholly funded by the Chinese industrial bank,” Chaudhry said. “And then when that startup goes out of business, we don't know what just happened to that IP that the U.S. government spent money developing.”

Transportation did not respond to a request for comment by the time of publication.

Transportation’s latest AI use-case inventory, which was published earlier this year, does not include the research grant-focused capability. Although other agencies have been using automation or more in-depth analysis tools to identify potential connections to foreign adversaries, Transportation’s use of AI seems to be relatively unique.

A November 2024 report from the Government Accountability Office found that reviewed agencies had taken a variety of steps to comply with federal requirements mandating that they better identify foreign risks in the Small Business Innovation Research and Small Business Technology Transfer programs. GAO noted that the programs, which were created to allow U.S. small businesses to engage in federally funded R&D, “face risks of foreign actors seeking to illicitly acquire federally funded research and technologies.”

The watchdog noted at the time that some agencies — like the Air Force, National Science Foundation and NASA — were taking some steps “either to automate the processing of due diligence disclosure forms or support the vetting of applicants and identify associated risks.”

]]>

Hegseth, service secretaries discuss ‘generational change’ of Autonomous Warfare Command

Patrick Tucker and Meghann Myers — Wed, 14 Oct 2026 14:07:44 -0400

Defense Secretary Pete Hegseth’s vision for the planned Autonomous Warfare Command over the next two years “is that we're still iterating, we're still adapting, we're still learning, and we're moving faster and faster because we're doing it. We understand how to do it better with each iteration.”

Hegseth sat down to discuss the Defense Department’s efforts to advance its autonomous capabilities with the service secretaries and the Pentagon’s top civilian for special operations during a panel Wednesday at AUSA’s annual meeting in Washington, D.C., but the discussion offered few details on what the forthcoming AUTOWARCOM, scheduled to activate by Oct. 1, 2027, will look like and how it will accomplish its mission.

The secretary, who has ordered cuts to and flag officer positions across the military services, was asked why a four-star combatant command is the correct vehicle to speed up acquisition and fielding of autonomous systems. He said that sometimes a general is the best person to get the job done.

“Let's put rank where we need it to ensure we can drive change quickly,” Hegseth said. “We're going to use rank to drive change with the right people in those positions, but not just legacy formations and commands which have gathered over time and haven't led to battlefield efforts.”

He did not say whether a search is on for commander candidates and what kind of experience he’s looking for.

The Army on Tuesday announced it would rename its Futures and Concepts Command, headed by Lt. Gen. Mac McCurry, to Futures and Autonomy Command, which will be the service’s component command nested under AUTOWARCOM.

The other services haven’t made any announcements about their own forthcoming autonomy commands. The Navy did not immediately respond to a query from Defense One on its plans. The Air Force referred questions to Hegseth’s office.

Much of the discussion focused on the services’ current use of unmanned platforms, as distinct from autonomous systems, which generally function without a human operator.

Hegseth said that AUTOWARCOM would deal not just with procurement, but also with training and doctrine around unmanned systems.

Two of the speakers mentioned an Army effort to open up its test ranges to private companies that make “drone, counter-drone, and long-ranges fires solutions.” Announced in August, the Army Permissive Test Range Expansion effort includes a website that promises a response within four weeks to companies that apply to use the ranges.

“Before, we kept these test ranges to ourselves for our own purposes. We were prioritizing and micromanaging the use of these ranges,” Acting Army Secretary Adam Telle said Wednesday. “To the degree that our bureaucracy is living in the way of our most innovative people from iterating quickly, it's a shame.”

The Army is also working to open “theater innovation labs” outside the United States, said Derrick Anderson, assistant defense secretary for Special Operations and Low-Intensity Conflict. Anderson said the labs, which are being launched in conjunction with U.S. Special Operations Command, meant that “operators sitting here stateside iterating on these autonomous systems” would have a “place to go and iterate” when they go abroad as well.

Anderson added that the Defense Autonomous Warfare Group run by the Defense Innovation Unit will be folded into SOCOM’s new Task Force Autonomous Warfare.

One day before Hegseth took the AUSA spotlight, Army officials had offered some insight into their plans for autonomous warfare on Tuesday, including “appropriate levels of human judgment,” Army Chief Technology Officer Alex Miller said during a panel.

“Things like counter-battery fire, things like air and missile defense, things that happen at a superhuman speed and scale—want to have humans on the loop for decisions, but then we cannot be limited by you know the 20 watts that have up here,” Miller said, pointing to his head. “If we are taking thousands of drones or hundreds of rounds, we can't put that on a human. We want to enable them to be a crew chief for superintelligence and autonomy.”

On Wednesday’s panel, Air Force Secretary Troy Meink said his service is experimenting with autonomous fighter aircraft at Creech Air Force Base in Nevada.

Last year, the Pentagon came under fire for its intentions around autonomous capabilities when AI company Anthropic, then a vendor to the Defense Department, protested the potential use of its models in support of lethal autonomous weapons and mass domestic surveillance.

Currently, artificial intelligence is used in collecting intelligence, identifying battlefield and data management. AUTOWARCOM would ostensibly be an entire combatant command built around autonomous platforms, but none of the senior officials on stage Wednesday identified any of the advancements the department hopes to make in their use.

“It will be a leader in the way we fight going forward, and I think we'll look back and say that was a no-brainer,” Hegseth said. “We should have done it 10 years earlier, but at least we did it.”

Lauren Williams contributed to this report.

]]>

Trump admin's retreat from foreign-influence fight is weakening US defenses, sources say

David DiMolfetta — Wed, 14 Oct 2026 14:00:00 -0400

The Trump administration’s retreat from programs that track foreign influence operations has weakened various cross-sector relationships used to identify and confront those campaigns as midterm elections fast approach — even as artificial intelligence makes those operations easier to deploy — multiple sources told Nextgov/FCW.

State officials say they are receiving fewer election-specific federal briefings than in previous cycles, while others who track foreign influence have observed routine exchanges with government and technology companies fall away. Some also note that federal workforce departures have weakened cooperation with outside partners, including social media platforms, to track false information online.

While the federal government continues to gather intelligence on foreign threats to U.S. elections, some of those who lean on those findings say federal agencies are less reliably sharing information with non-federal researchers and state officials responsible for countering those campaigns. That cooperation began to weaken before President Donald Trump returned to office, and his administration has since dismantled several programs dedicated to countering the problem.

This story is based on interviews with current and former federal officials, state election officials and specialists in cybersecurity and influence operations. Several people spoke on the condition of anonymity to be candid about their views and for fear of retribution. Their concerns come as fast-evolving AI tools now allow foreign influence operators to do more than just generate fake images or audio, instead helping them produce plausible-sounding messages, find audiences to target and autonomously adjust campaigns at a scale not seen before.

The Cybersecurity and Infrastructure Security Agency referred questions about foreign malign influence to the Justice Department, saying that influence operations fall outside CISA’s mission. DOJ did not immediately respond to a request for comment.

“Election security is national security, and protecting our critical infrastructure remains a top priority for the Trump Administration, DHS, and CISA,” a CISA spokesperson said. “CISA works closely with intelligence and law enforcement partners to monitor threats to U.S. critical infrastructure, including election infrastructure.”

The spokesperson added that the agency is committed to supporting state and local election officials “to protect election infrastructure and safeguard our democracy.”

The Office of the Director of National Intelligence did not respond to a request for comment.

Foreign influence operations aim to shape what people believe and how they act, often without revealing who is behind the message. Around elections, that can mean spreading false voting information, stoking political divisions or casting doubt on results. Such messages can be harder to question when they appear to come from or be amplified by fellow Americans and reinforce views people already hold.

One election nonprofit official told Nextgov/FCW that, during the November 2024 election, they received an early-morning text from a colleague in Georgia asking about bomb threats at voting sites, which U.S. officials later deemed may have been tied to Russia. The official was sitting in CISA’s election operations room. Finding out whether other jurisdictions were facing similar threats meant simply walking across the room and asking federal personnel.

“Any time you have federal support to help connect the dots, it’s a game-changer,” the official said, noting that they have not been alerted to or invited to a CISA elections operations room for the coming midterms.

The CISA spokesperson said that, before and during Election Day, the agency will “activate an Incident Coordination Group to establish a unified operational picture, rapidly share critical information, coordinate essential services for stakeholders in the field and strengthen incident response within its mission and authorities.”

Bret Schafer, senior director of policy and research for information operations at the Institute for Strategic Dialogue, said efforts to bring government, technology companies and researchers together grew during Trump’s first term, after Russia’s interference attempts in the 2016 election exposed gaps in their understanding of foreign campaigns.

Each could see activity the others could not. Sharing those findings helped them recognize operations that might otherwise go unnoticed, Schafer said last week on a panel at a national-security law conference hosted by the American Bar Association.

Those routine exchanges with the government have become harder to sustain. Now, “civil society is out on both sides,” he said, adding that he had gone at least two years without an information-sharing conversation with a relevant technology company, and a couple of years without one involving the government.

Much of that cooling began in the Biden administration, when GOP litigation over federal interactions with social media companies made participants more cautious. The Trump administration has gone further. It shuttered CISA work focused on election disinformation, disbanded the FBI’s Foreign Influence Task Force and closed the State Department’s office for countering foreign information threats, all largely on censorship grounds. The ODNI Foreign Malign Influence Center also faced a similar fate last August under then-director Tulsi Gabbard.

An office can retain its responsibilities while losing the relationships that helped it do the work, according to a person familiar with U.S. efforts to address influence operations. But someone who once knew exactly whom to call may find that their counterpart has departed, or that the people still there are unsure whether leadership supports exchanging information.

One current U.S. official described an environment that puts less public emphasis on election security at CISA and across the Department of Homeland Security than in previous cycles, with greater attention to other critical infrastructure matters, including water systems.

The official speculated that employees could hesitate to highlight their election security work after seeing others who worked on elections lose their jobs, though they noted they had not heard staff express that fear directly. The official also acknowledged that midterms generally receive less attention than presidential elections.

The administration has maintained that federal support continues. ODNI has assigned officials to coordinate election threat intelligence, while CISA outlined election support plans last month. Defense Secretary Pete Hegseth also directed Cyber Command and military intelligence agencies to prioritize foreign election threats and coordinate with the Department of Homeland Security last month.

A current Defense Department analyst argued that closing offices focused on tracking influence operations does not necessarily erase expertise, because personnel can continue the work elsewhere in government or as contractors. But it’s unclear how much of that work has continued, or whether those who left government still have access to relevant information and federal contacts they once relied on.

The analyst recalled a strong working relationship with Meta, which operates Facebook and Instagram, when they worked on those issues around two years ago. The analyst could not say whether those exchanges continue today.

Similarly, one former U.S. official recalled preparations for the 2020 election beginning roughly a year before Americans went to vote, with coordination growing more frequent as Election Day approached. Some calls included 80 to 100 participants, including private companies, discussing topics that included ballot security and broadcasting accurate voting information.

“Our nation’s security is best protected when private individuals, private sector, industry and government work together toward a common goal to protect our freedom and way of life, and that includes reporting suspicious and illegal activity and leveraging legal access and authorities to protect the American people and interests,” Erin Joe, special counsel at Wiley Rein LLP and a former senior FBI executive, told Nextgov/FCW in an interview.

At the ABA conference, former DHS Secretary Michael Chertoff argued that the government still has a role in helping people recognize deception. Officials can explain where a message came from or show that a supposed recording was generated by AI, without telling people which political views to accept.

“It is fighting bad speech with good speech,” Chertoff said.

A TikTok spokesperson referred Nextgov/FCW to a webpage outlining steps the company is taking to prepare for midterms and disrupt covert influence operations on its platform. Several other social media companies and AI firms — including Meta, X, Anthropic and OpenAI — did not respond to requests for comment.

Two state election officials described how their offices are responding to misleading information while receiving fewer election-specific federal briefings than in previous cycles.

One said identifying who is behind false messages can be difficult. Their office often focuses on information that could confuse people about when, where and how to vote, as well as threats to election workers.

When a misleading claim surfaces, communications staff and leadership decide whether responding would help voters or draw more attention to something that might otherwise fade away. Threats to election officials are referred to law enforcement, the official said.

The same official said they had not received an election-specific federal briefing “in quite some time,” although they attend regularly held CISA calls about software vulnerabilities and known flaws being exploited by hackers. Those discussions offer little information that is specific to elections, the official said. Monthly meetings through the state’s fusion center still bring together state, local and federal law enforcement to discuss threats to election officials.

The second official said their office sends a representative to federal election-threat briefings whenever they are available, but those briefings have occurred less frequently than in 2024.

That official nevertheless described their election offices as better prepared than in past years, with multiple backup plans, in case disruptions occur.

“We hope that we don’t have to use them. But if we do, they’re there,” the official said.

Those preparations come as AI has lowered the cost and effort required to conduct influence campaigns. AI has played a key role in helping to run these operations, from writing posts and distributing them to studying how people respond, said Snehal Antani, CEO and co-founder of cybersecurity company Horizon3.ai. Operators can test different messages and use the results to adjust their approach, and AI agents can automate much of that work, reducing the time and expertise it once required, he said.

“AI has dramatically reduced the skills required and dramatically accelerated the speed at which this cycle can be executed,” Antani said.

Another former U.S. official added that increasingly capable, downloadable open-source models allow smaller actors to undertake work that once required substantial investment and specialized engineering.

“The barrier to entry is much lower,” the former official said, adding that AI-generated text can blend into everyday online conversations and make it harder to spot than a manipulated image or video with visible flaws.

Russia is more likely to pursue more obvious inflammatory messaging this cycle, while China’s efforts may be more covert to serve longer-term objectives, said another current official, adding that both are expected to make greater use of AI. Pro-Iran outfits have especially leveraged AI more overtly in recent months amid the war that began in late February.

But the official cautioned that more powerful AI tools and more convincing content do not necessarily mean a foreign operation is changing how people vote. An image or video getting lots of views does not mean people believe it or will vote differently because of it, they added.

In some cases, an influence campaign may not even target eligible voters. For instance, content aimed at younger Americans could sway their political stances, but they may not be of legal age to cast a ballot.

And in other settings, a foreign influence operation may not be needed for an American to vote a certain way.

“If I see gas is $7 a gallon, I don’t necessarily need a lot more to go vote blue,” the official said, referring to California voters who have faced record-high fuel prices in some parts of the state.

These foreign threats come as political campaigns at home have increasingly used AI in their advertisements.

The growing use of AI-generated political videos could also make it harder to distinguish real footage from fabricated material, according to research released Wednesday by cybersecurity firm Check Point.

“Video is one of the easier ways to make a claim feel real, since people tend to trust what they can see and hear for themselves,” the company’s findings say. As AI-generated political content becomes more common, it becomes harder for voters to “trust that a video of a candidate is real” and easier for anyone “to dismiss a real video as fake.”

The scale and sophistication of false information today “makes our sensitivity to it a little bit more dull than perhaps in years past,” said Kimberly Kearney, a former CIA case officer.

“We as individuals have to have the desire to know whether what we’re consuming is true or false, or if it feeds into a narrative that is convenient or more comfortable for us,” she said in an interview. “So it starts with that cognitive honesty and awareness to want to know whether what you’re consuming is accurate or if it could have a bias to it.”

]]>

Army converts Futures and Concepts Command to Futures and Autonomy Command

Meghann Myers — Tue, 13 Oct 2026 20:55:24 -0400

When Lt. Gen. Mac McCurry woke up Tuesday morning, he was the commander of the Army’s Futures and Concepts Command. By the afternoon, the service had announced that his outfit will become the recently announced Futures and Autonomy Command.

FASCOM will be the Army’s component organization within the Defense Department’s planned Autonomous Warfare Command, it announced Oct. 1.

“You know, we did decide to keep the patch, because that's honestly one of the hardest things to do,” McCurry said of his command’s uniform insignia, at the AUSA annual meeting in Washington, D.C. “If we can get the patch, we can get autonomy. I haven't ruled out Optimus Prime 6 as my future callsign.”

FASCOM’s commander will also become the Army’s first Portfolio Acquisition Executive for autonomy, with authority over the full procurement effort for autonomous systems.

“We are incorporating autonomous and unmanned systems at every single echelon, across the formation, with the force structure to match, including introducing UAS and robotics military specialties to integrate these technologies at the point of need,” Gen. Christopher LaNeve, the acting Army chief of staff, said Tuesday during a speech at the AUSA annual meeting.

FASCOM will function much the way Army Cyber Command and Army Special Operations Command support U.S. Cyber Command and U.S. Special Operations Command, with an Army mission and force structure that also reports to the joint combatant command.

The point of the larger autonomy project is not to start fully automating existing warfighting functions, said Alex Miller, the Army’s chief technology officer.

Autonomous systems will compile information and help commanders make decision, but there will be “appropriate levels of human judgment” before weapons are fired.

The service secretaries and Defense Secretary Pete Hegseth are slated to discuss more details about AUTOWARCOM on Wednesday during a panel at the final morning of AUSA’s annual meeting.

]]>

FBI disrupts North Korean 'laptop farms' used to fund weapons programs

David DiMolfetta — Tue, 13 Oct 2026 17:00:00 -0400

The FBI searched more than 40 Texas residences and seized 187 laptops and other devices used to help North Korean operatives obtain remote jobs at U.S. companies under false identities, federal prosecutors announced Tuesday.

The effort, dubbed Operation Lonestar Roundup, targeted “laptop farms” that housed employer-issued computers and allowed workers overseas to access them remotely. U.S.-based facilitators configured the devices and transferred earnings to North Korean-controlled accounts, according to the Justice Department.

CrowdStrike, which provided intelligence and technical analysis to support the FBI’s work, said the broader operation affected a campaign targeting more than 70 U.S. companies and included two arrests in Ohio. The company did not identify those arrested or describe the charges in its announcement to reporters. The Justice Department’s Texas release did not address the Ohio arrests.

The scheme gave North Korean workers access to corporate systems while generating revenue for the regime’s sanctioned weapons programs, authorities said. By routing their work through computers physically located in the United States, operatives could conceal that they were working abroad.

“Each laptop seized potentially represents one company that has hired a DPRK IT worker,” FBI Dallas Special Agent in Charge R. Joseph Rothrock said in a statement.

The 187 devices seized in Texas included laptops and keyboard-video-mouse equipment, which can be used to control computers remotely. About 100 devices were recovered in North Texas, according to prosecutors.

CrowdStrike tracks the network under the moniker Famous Chollima and said its work with the FBI disrupted several U.S. laptop farms in late September. Organizations identified in the disrupted operations included businesses in aerospace, energy, financial services, health care, cybersecurity, defense engineering and government technology, the company said.

CrowdStrike described several ways operatives diverted employer-issued computers to the farms. Some filed false police reports claiming their laptops had been stolen so employers would ship replacements to different addresses. Others claimed last-minute moves or obtained jobs through staffing firms, allowing equipment to be redirected without those firms’ knowledge.

Once the computers arrived, facilitators installed hardware and software that enabled overseas workers to operate them, according to CrowdStrike. The company said operatives also disguised equipment used in the scheme to make it harder for security teams to detect.

The action adds to a series of federal investigations into North Korea’s use of fraudulent IT employment to raise money and gain access to sensitive information.

Last June, DOJ announced actions involving searches of 29 known or suspected laptop farms across 16 states. In one case, prosecutors alleged that an overseas worker accessed and stole export-controlled technical information from a California defense contractor developing artificial intelligence-powered equipment. A senior FBI official said at the time that at least one U.S. government contractor had been caught up in the fraudulent hiring schemes.

The schemes have reached direct federal hiring pipelines. In a case disclosed in May 2024, participants tried to obtain contractor positions at Immigration and Customs Enforcement and the Federal Protective Service but could not meet fingerprinting requirements, according to an indictment. Another participant secured a contractor position at the General Services Administration but was terminated five days after an introductory meeting.

The latest seizures are unlikely to end broader DPRK operations. CrowdStrike said the disruptions would probably slow activity primarily in the areas where farms were shut down and were unlikely to have lasting effects, as operatives adapt their techniques to avoid detection.

The Justice Department said the investigation remains ongoing.

]]>

Army re-evaluating munitions procurement goals as Iran war continues

Meghann Myers — Tue, 13 Oct 2026 15:52:28 -0400

The Army’s procurement goals for critical munitions could be shifting, officials said Tuesday in a break from the U.S. government’s typical reticence to talk about the enormous expenditure of weapons during the Trump administration's war on Iran.

Increasing annual production of Patriot air defense missiles, particularly the PAC-3 Missile Segment Enhancement, is high on the priority list, Gen. Frank Lozano, the Army’s fires portfolio acquisition executive, said during a panel at the AUSA annual meeting in Washington, D.C.

“Our goal has always been to get to 2,000, and we've had a lot of discussions about even more interceptors,” he said, “but when we start talking about overall missile output and we start looking at numbers—is it 4,000, is it 6,000, is it 8,000—we're looking at a diverse set of capabilities. Because we have to address the threat, and we need to address the threat in a complementary way, meaning we need to fight on a cost curve that's affordable for the U.S. Army to maintain and sustain that warfighting capability abroad.”

Lozano addressed reports of depleted stockpiles by repeating the government’s insistence that all is well.

“We have to win everywhere, and so when you have to win everywhere, you need to really make sure that from a foundational aspect of the joint force, you have enough depth within your magazine, from from a varying perspective of capabilities, that you're able to contribute to that joint fight in a meaningful way,” he said. “I will continue to double down and echo what our department leadership has stated: we have the capabilities we need to have to fight and win, but it's our job to ensure that victory is achievable in the future inside of any dynamic environment, scenario, fight we might find ourselves in.”

The Army is also “looking into” buying PAC-2 Guidance Enhanced Missile-Tactical, he said.

“Should we buy GEM-Ts? Because they're being produced,” Lozano said. “And so, if it's an effector that's available now, and GEM-Ts are a really good missile in the battle space [in which] they operate…so if we have the opportunity, it's probably something we should take advantage of, and we’re looking into doing that.”

The Army’s ability to scale some of these procurement programs will depend on funding from Congress, said Brent Ingraham, the Army’s civilian acquisition chief.

“We are looking every day, depending on where the budget lands, what a top line looks like, whether it's a reconciliation or not,” Ingraham said. “We have prioritized the missions that we truly need, we think about today and the near future…and so, depending on where the budget ends up, we will have to do some work to reprioritize our systems to focus on those key initiatives.”

]]>

Army plans ‘rodeo’ to round up supply-chain problems

Patrick Tucker — Mon, 12 Oct 2026 23:27:22 -0400

The U.S. Army is planning a "rodeo" to round up problems that slow the deployment of new weapons, and rope in new ways to improve supply chains and make parts in more places, the service’s acting chief said today.

The “Manufacturing Rodeo,” planned sometime in 2027, will serve as a sort of public competition to expose where the industrial base is failing to meet demand and where new players are providing innovative approaches.

“We need to strain the nation's larger industrial base. We're going to stress-test the supply chain, the manufacturing processes, and see where it breaks,” Adam Telle said at the Association of the U.S. Army’s annual conference in Washington, D.C.

Production bottlenecks and a lack of suppliers for many key parts have plagued the Army for decades. The Government Accountability Office, among others, has detailed many breaking points. But, Telle said, those reports don’t capture how bad the problem could become as the Army seeks new drones and counterdrone weapons with components made by companies far from the service’s control.

For instance, he said, the Army needs to “make millions” of one-way attack drones.

“It may look simple, but it's a flying supply chain. If somebody else controls one part, they can break the whole thing,” the acting chief said.

Parts for such drones are largely made in China, which uses its market dominance to help other autocratic states like Russia and Iran attack U.S. forces and partner militaries in Europe.

Telle, who did not name any adversary, said that “an economy that's an extension of the national-security apparatus” can be “ruthlessly efficient” in deploying weapons.

“Over there, you flip a switch, and by law, by design, the economy is nationalized,” he said.

The acting Army chief listed steps the Pentagon has taken to overcome bureaucratic sluggishness in developing and deploying new technologies, such as pushing more acquisition authority down to battalion-level commanders, getting more self-sustained power on U.S. bases, and introducing a program to allow private companies to test new weapons on U.S. Army ranges. New private ranges, such as Second Bend Labs, are also renting time and space to defense startups eager to gain a foothold.

Telle said fostering new companies is more important than any single program.

“When someone tells you the Army's biggest acquisition program is this tank or that helicopter or this missile system, tell them they're wrong. The biggest acquisition program in the Army is building a system of seamless, frictionless, symbiotic relationship with American ingenuity.”

]]>

US Army to stage counter-drug training exercises in South America

Meghann Myers — Mon, 12 Oct 2026 19:42:20 -0400

The Army is looking to refocus its U.S. Southern Command exercises to focus on counter-cartel operations, Gen. Joe Ryan, who heads Army Western Hemisphere Command, said Monday at the Association of the United States Army annual meeting in Washington, D.C.

The move is part of the nascent command’s mission to build a “theater Army,” Ryan said, above and beyond the largely partner training and disaster response missions its U.S. Army North and South predecessors maintained.

“I think what you're going to see ,where we've perhaps done some exercises in the past that were relationship-building exercises to a point, we are going to focus our exercise program going forward to really be focused on those things that contribute to the counter designated terrorist organization threat and cartel threat in the region," he said.

Ryan said the review was directed by SOUTHCOM’s commander, Marine Gen. Frank Donovan, “to better align with current federal priorities and strategy.”

Those priorities include the latest National Defense Strategy’s shift that puts defending the homeland at the top of the list, with the Western Hemisphere as the Pentagon’s priority theater, a concept dubbed the “Donroe Doctrine.”

That focus on SOUTHCOM gave rise to the administration’s strikes on suspected drug trafficking boats in the Caribbean and the raid to capture Venezuelan President Nicolas Maduro.

“Make no mistake; these are designated terrorist organizations," Ryan said. "They are global economic syndicates that have created a business model that is survivable, has survived over decades, and will continue to survive unless we disrupt the economic side of it."

At the same time, the Army is also beefing up its ability to do the legacy mission of crisis response in SOUTHCOM, Ryan said. The service recently got approval to move more aviation assets and personnel down south, to help move people and supplies.

"We're going to grow that footprint down there, where it's a relatively modest footprint to date, given the responsibilities it's tended to, and we're going to give them more aircraft, more crews, more maintainers here over the next couple of fiscal years, to help them address some of the natural disasters and threats in the region," Ryan said. "Because those things become absolutely critical when you're talking about moving supplies, moving people to the point in need, and making assessments."

]]>