A CISO's Guide to Avoiding Jail After a Breach

Maybe we have the cybersecurity we deserve

Companies have focused more on making the consumer recovery process from fraud and data breaches easier than on better security. Most people seem OK with that.

A brief history of AI executives calling for regulation

The industry is in a panic, but it’s been claiming to want legal guardrails for years — with few meaningful results.

Lina Khan on Twitter / X

Law enforcers already have authority to charge companies and their CEOs for creating and releasing dangerous, unvetted, or defective products. We shouldn’t let discussions about new legal regimes distract from the fact that there’s no AI exemption from laws already on the books —…— Lina Khan (@linamkhan) September 13, 2026

Autonomy and Innovation

Incentives favor offense when it comes to agentic cybersecurity; it’s the same dynamic that will limit incumbents and fuel startups in the long run.

Lawsuit says Anthropic, OpenAI, Google and SpaceXAI of illegal agreement to slow AI

Anthropic CEO acknowledged potential antitrust hurdles, writing that it would assist if the US government were to mediate ‘or at least enable’ cross-lab discussions

Why AI companies can’t be trusted to self-regulate

From aviation to banking, high-risk industries are subject to independent oversight and meaningful penalties. AI companies should be no exception.

Trying Tailscale.

Like most folks working in infrastructure engineering in 2014, I really enjoyed Google’s BeyondCorp whitepaper. My foremost personal interest was grounded in the fact that Uber’s contemporaneous security implementation didn’t include a VPN, so it was interesting to see a well-thought description of fostering security without over-reliance on a hardened network for employee devices. I had a second, longer-term, personal interest as well, which was never again having to argue with a coworker about why they needed to log into the VPN before accessing a secure resource.

The Lawful Access Two-Headed Surveillance Monster: How Bill C-22 Went Off the Rails - Michael Geist

The government’s plans for lawful access have gone off the rails. In recent days, Signal has warned it would pull out of the Canadian market rather than comply with Bill C-22. Windscribe, the Toronto-headquartered VPN provider, has said it would relocate its headquarters out of Canada and NordVPN has warned it would consider following suit. Apple and Meta have both raised public concerns about the bill’s effect on encryption and cybersecurity. The Canadian Chamber of Commerce, the Cybersecurity Advisors Network, civil liberties groups, and a long line of legal and security experts have all called for changes. The chairs of the U.S. House Judiciary and Foreign Affairs Committees have written to Public Safety Minister Gary Anandasangaree warning that the bill threatens U.S. national security and the integrity of cross-border data flows. Even the bill’s own oversight body, the National Security and Intelligence Review Agency, has told the SECU committee it does not have the access it needs for effective oversight. If the government thought it could push through the bill largely unnoticed, it has been proven painfully wrong as there are now trade frictions with the U.S., the prospect of leading companies exiting the Canadian market, and weaker cybersecurity protections for ordinary users. How did Canada’s lawful access plan go awry so quickly?

An Attack on Tech Freedom, an Assault on Dissent

We live in a world of surveillance states, militarized police, and crackdowns on dissent. Meanwhile, corporate behemoths will often ally with the state to shut down dissident speech or aid and abet surveillance.  In this context, it’s important for independent groups to develop and maintain encrypted communications platforms and independent web hosting. But the Trump...

Introducing ONCE

Once upon a time you owned what you paid for, you controlled what you depended on, and your privacy and security were your own business. We think it’s that time again.

AI agents aren’t ‘going rogue.’ Frontier labs are skipping security basics.

Cyber experts say AI labs’ containment and monitoring failures — not agents with minds of their own — are to blame for recent alarming hacking reports. CISOs should vet their AI vendors and tighten security basics as safeguards.

Bill C-22’s Groundhog Day: Why the Government’s Dismissal of Signal, Apple and the U.S. Congress Concerns Runs Back the Disastrous Online News Act Playbook - Michael Geist

Secure messaging service Signal yesterday became the latest company to warn that Bill C-22, the lawful access bill, could force it to leave the Canadian market rather than comply with provisions it says would compromise its end-to-end encryption and create new cybersecurity risks. Signal vice-president Udbhav Tiwari told the Globe and Mail that the company “would rather pull out of the country than be compelled to compromise on the privacy promises we have made to our users.” The comments are part of a steady stream of similar warnings from Apple, Meta, the Canadian Chamber of Commerce, the Cybersecurity Advisors Network, and the chairs of the U.S. House Judiciary and Foreign Affairs Committees. Despite growing concern, the government’s response has been to launch a misleading social media campaign and repeatedly insist that the experts and companies are mistaken.

U.S. and U.K. Take Largest Action Ever Targeting Cybercriminal Networks in Southeast Asia

Treasury Designates One Scam Network As A Transnational Criminal Organization; Cuts Another Off from U.S. Financial SystemWASHINGTON — Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) and Financial Crimes Enforcement Network (FinCEN), in close coordination with the United Kingdom’s Foreign, Commonwealth, and Development Office (FCDO), took complementary actions against criminal networks responsible for targeting citizens of the United States and other allied nations through online scams and the laundering of stolen funds. OFAC has imposed sweeping sanctions on 146 targets within the Prince Group Transnational Criminal Organization (Prince Group TCO), a Cambodia-based network led by Cambodian national Chen Zhi that operates a transnational criminal empire through online investment scams targeting Americans and others worldwide. In addition, FinCEN finalized a rule under section 311 of the USA PATRIOT Act to sever the Cambodia-based financial services conglomerate, Huione Group, from the U.S. financial system.  For years, Huione Group has laundered proceeds of virtual currency scams and heists on behalf of malicious cyber actors.“The rapid rise of transnational fraud has cost American citizens billions of dollars, with life savings wiped out in minutes,” said Secretary of the Treasury Scott Bessent.  “Treasury is taking action to protect Americans by cracking down on foreign scammers.  Working in close coordination with federal law enforcement and international partners like the United Kingdom, Treasury will continue to lead efforts to safeguard Americans from predatory criminals.”OVER $16 BILLION LOST TO ONLINE SCAMS SPURS U.S.–U.K. ACTIONU.S. losses to online investment scams have steadily increased over the last several years, totaling over $16.6 billion.  A U.S. government estimate indicated that Americans lost at least $10 billion to Southeast Asia-based scam operations in 2024, a 66 percent increase over the prior year, with scams like those perpetrated by Prince Group TCO being particularly significant.  Over the course of the past decade, transnational organized criminal groups, like Prince Group TCO, have established profitable cyberfraud operations across Southeast Asia, particularly in Cambodia.  Prince Group TCO remains a dominant player in Cambodia’s scam economy and has controlled illicit financial flows of billions of dollars.  The actions taken by OFAC and FinCEN were in close coordination with the U.K.’s FCDO, which took complementary actions against criminal networks responsible for targeting citizens of the United States and other allied nations through online scams and the laundering of stolen funds.The U.K.’s FCDO has concurrently imposed sanctions on Prince Holding Group, Chen Zhi, and his key associates.  Today’s bilateral sanctions actions are accompanied by the unsealing of a criminal indictment in the U.S. District Court for the Eastern District of New York against Chen Zhi.  This coordinated action is the result of close coordination between the Federal Bureau of Investigation (FBI), the U.S. Attorney’s Office for the Eastern District of New York, as well as the U.K.’s FCDO.HUIONE GROUP IS CUT OFF FROM U.S. Financial System for Laundering Billions Linked to DPRK and Southeast Asia Scam NetworksAlongside today’s coordinated sanctions action, Treasury’s FinCEN issued a section 311 final rule that severs Huione Group from the U.S. financial system. As described in the final rule, Huione Group serves as a critical node for laundering proceeds of cyber heists carried out by the Democratic People’s Republic of Korea (DPRK), and for TCOs in Southeast Asia perpetrating virtual currency investment scams, commonly known as “pig butchering” scams, among others.  Significantly, Huione Group laundered at least $4 billion worth of illicit proceeds between August 2021 and January 2025.  Of the $4 billion worth of illicit proceeds, FinCEN found that Huione Group laundered at least $37 million worth of virtual currency stemming from DPRK cyber heists, at least $36 million from virtual currency investment scams, and $300 million worth of virtual currency from other cyber scams. By finalizing this rule, covered financial institutions are now prohibited from opening or maintaining correspondent accounts for or on behalf of Huione Group, and are required to take reasonable steps not to process transactions for the correspondent account of a foreign banking institution in the United States if such a transaction involves Huione Group, preventing indirect access by Huione Group to the U.S. financial system.  DESIGNATION OF PRINCE GROUP TRANSNATIONAL CRIMINAL ORGANIZATION Prince Group TCO is composed of Cambodia-based Prince Holding Group, its Chairman and CEO, Chen Zhi, his close associates and business partners, and their core commercial interests, all of which operate in furtherance of Prince Group TCO’s criminal enterprise.  Headquartered in Phnom Penh, this multi-national conglomerate has investments in entertainment, finance, and real estate.  Prince Holding Group’s promotional and marketing materials conceal its laundry list of transnational crimes including the construction, operation, and management of scam compounds reliant on human trafficking and modern-day slavery where industrial scale cyberfraud operations target victims around the world, including U.S. citizens. Today, OFAC additionally designated a network of 117 Prince Group TCO-affiliated businesses, the vast majority of which are offshore shell companies that engage in no apparent real commercial or business activity, as well as one associated official.  OFAC has determined these entities and individual are in fact owned or controlled by, or purport to act for or on behalf of, members of Prince Group TCO.  A list of these targets, designated as part of Prince Group TCO’s network pursuant to Executive Order (E.O.) 13581, as amended by E.O. 13863 (“E.O. 13581, as amended”), is included in Annex I to this press release. Additionally, Treasury targeted Prince Group TCO’s burgeoning operations in Palau, where the TCO works with known organized crime facilitators to lease an island and set up resorts.  Treasury has taken this action in support of Palau’s ongoing efforts to protect against predatory investments by transnational organized criminal groups originating from the People’s Republic of China.   CYBERFRAUD EMPIRE ENGANGES IN HUMAN TRAFFICKING, TORTURE, SEXTORTION, AND MONEY LAUNDERING Chen Zhi is a 38-year-old Chinese émigré who has since renounced his Chinese citizenship and has built a business empire in Cambodia through the Prince Group TCO.  Chen Zhi, via the Prince Group TCO, comingles illicit revenues with the legitimate Cambodian economy, laundering these ill-gotten gains through a complicated network of over 100 shell and holding companies all around the world.  Under Chen Zhi’s leadership, the criminal revenues generated by the Prince Group TCO’s have been instrumental in supporting its ostensibly legitimate business ventures, most of which operate through entities under the control of Prince Group TCO, including Prince Holding Group, Prince Bank Plc. (Prince Bank), and Prince Huan Yu Real Estate Cambodia Group Co. Ltd.Prince Group TCO profits from a litany of transnational crimes including sextortion—a type of fraud involving the solicitation for eventual blackmail of sexually explicit materials, often from minors—money laundering, various frauds and rackets, corruption, illegal online gambling, and the industrial-scale trafficking, torture, and extortion of enslaved workers in furtherance of the operation of at least ten scam compounds in Cambodia.In these compounds, workers are often lured by the promise of well-paid jobs in customer service, tech support, and related fields, but are instead held against their will and made to scam people from around the world in so-called “pig butchering” and other fraud schemes.  These schemes involve cultivating, sometimes over the course of months, elaborate relationships with victims, gaining their trust and confidence, then inducing them to “invest” funds in fraudulent investment platforms ultimately controlled by scammers.  The butchering comes when the scammers go dark after taking every dollar they can from their victims.The cruelty of this criminal activity is twofold:  the scammers are—not always, but often—victims themselves of human trafficking for forced labor.  They are subjected to barbaric methods of control at the hands of their captors including physical abuse, isolation, restriction of movement, arbitrary fines and fees, threats of sexual exploitation, and the confiscation of personal documents and electronics.  In recent months, numerous reports have surfaced online of people enduring horrific treatment at sites associated with Prince Group TCO.Treasury actions against this growing transnational threat are ongoing, and include OFAC’s designations against Burmese and Cambodian cyber scam facilitators on September 8, 2025, Burmese Warlord Saw Chit Thu on May 5, 2025, and Philippines-based computer infrastructure company Funnull Technology Inc. on May 29, 2025.  FinCEN also published a September 2025 Notice on financially motivated sextortion and a September 2023 Alert on virtual currency investment scams described above. LUXURY HOTEL AND CASINO INVOLVED IN EXTORTION, FORCED LABOR, AND MURDERAmong the most notorious of Prince Group TCO’s scam compounds are those under the umbrella of Jin Bei Group Co. Ltd. (Jin Bei Group), a luxury hotel and casino company that also operates a series of compounds throughout Cambodia linked to reports of extortion, scamming, forced labor, and the gruesome murder of 25-year-old Chinese national Yi Ming Dali in 2023. In a 2022 takedown of a Chinese money laundering network in New York, FBI identified 259 U.S. persons who collectively lost $18 million to scammers at Jin Bei Group.  This sum represents just one takedown of one network associated with the scam compounds under Prince Group TCO’s operation and is only a fraction of total losses inflicted on U.S. persons by this group.While Prince Holding Group has made attempts to distance the conglomerate from scam operations, extensive public reporting links the conglomerate to the Jin Bei Group compounds and a June 2025 press release published by the Cambodian government confirms that Jin Bei Casino is owned by Prince Holding Group with Chen Zhi as the CEO. PRINCE GROUP TCO OFFICIALS COORDINATE CRIMINAL ACTIVITIESChen Zhi has directed the flow of billions of dollars in illicit funds in close coordination with vice-chairmen and financial assistants who manage Prince Holding Group’s various subsidiaries.  These associates oversee the operation of both licit and illicit activities, and correspond with banks, government officials, and other witting and unwitting partners on Chen Zhi’s behalf.  Together, these individuals compose the Prince Group TCO along with the core commercial interests of the TCO.  Today’s action targets several Prince Group TCO members and associates, including Guy Chhay, Lei Bo, Ing Dara, Zhu Zhongbiao a.k.a. Jack Zhu, Sin Huat Alan Yeo a.k.a. Alan Yeo, Zhou Yun a.k.a. Sandy Zhou, Chen Xiuling a.k.a. Karen Chen, Wei Qianjiang, and Thet Li.Guy Chhay, Zhu Zhongbiao, and Ing Dara serve as Directors of Cambodian Heng Xin Real Estate Investment Co. Ltd., an entity also involved in Prince Group TCO’s scam business and the parent company of Jin Bei Group.  Guy Chhay was formerly a director of Jin Bei Group and is currently one of two shareholders in Prince Bank alongside Chen Zhi.  Lei Bo served as Chairman of the Board of Directors of Prince Huan Yu Real Estate (Cambodia) Group Co., Ltd., and oversaw the construction of the Golden Fortune Resorts World Co. Ltd. scam compound (a.k.a. Golden Fortune Science and Technology Park) near Chrey Thum, a village south of Phnom Penh.  He and Ing Dara maintain an ownership interest in the Golden Fortune scam compound, where locals have told journalists that they’ve seen workers “beaten until they are barely alive” before being forcefully returned after escaping.  Jack Zhu is wanted by Chinese law enforcement for charges related to money laundering and, alongside Ing Dara, directs a number of companies under the Jin Bei Group name.Sandy Zhou and Alan Yeo serve as financial assistants and wealth managers for Chen Zhi.  They coordinate large wire transfers, correspond with banks, manage accounts, and work to obfuscate Prince Holding Group’s corrupt and criminal activities.  Karen Chen oversees Prince Holding Group companies based in Mauritius, Taiwan, and Singapore.  She is listed in corporate documents as the ultimate owner of numerous companies controlled by Prince Group TCO that share the same Singapore address and include the holding company that managed Chen Zhi’s luxury yacht.Thet Li is a close associate of Chen Zhi who serves as a de facto illicit finance CFO for Prince Group TCO. Thet Li is involved in bulk cash smuggling and managing dirty money in Prince Holding Group’s financial flows.Wei Qianjiang oversees Warp Data Technology Lao Sole Co., Prince Group TCO’s Laos-based bitcoin mining operation.  This venture has funneled large quantities of bitcoin into wallets controlled by Chen Zhi.OFAC is designating Prince Group TCO pursuant to E.O. 13581, as amended, for being a foreign person that constitutes a significant transnational criminal organization.OFAC is designating Chen Zhi, Lei Bo, Zhu Zhongbiao, Guy Chhay, Ing Dara, Thet Li, Chen Xiuling, Wei Qianjiang, Cambodian Heng Xin Real Estate Investment Co. Ltd., Jin Bei Group Co. Ltd., Golden Fortune Resorts World Co. Ltd., and Warp Data Lao Sole Co. Ltd. pursuant to E.O. 13581, as amended, for being owned or controlled by or having acted or purported to act for or on behalf of, directly or indirectly, Prince Group TCO.OFAC is also designating Prince Holding Group, Prince Bank Plc., Sin Huat Alan Yeo, and Zhou Yun, pursuant to E.O. 13581, as amended, for being owned or controlled by or having acted or purported to act for or on behalf of, directly or indirectly, Chen Zhi. OFAC is designating Prince Huan Yu Real Estate Cambodia Group Co. Ltd. pursuant to E.O. 13581, as amended, for being owned or controlled by or having acted or purported to act for or on behalf of, directly or indirectly, Prince Holding Group.ORGANIZED CRIME FACILITATORS ENABLE PRINCE GROUP TCO’S PREDATORY INVESTMENTS ON PALAUPrince Group TCO has worked with Wang Guodan (a.k.a Rose Wang), a Palau-based organized crime facilitator, to establish a luxury resort in Palau.  Grand Legend International Asset Management Co., Ltd. (Grand Legend) is a Chen Zhi-controlled company in Palau that is affiliated with the Prince Group TCO.  Grand Legend acquired a 99-year lease to Ngerbelas Island in Kayangel, Palau, where it is in the process of developing the luxury resort.  Chen Xiao’er and Yang Jian are directors of Grand Legend. Yang Yanming, Shih Ting-yu, Michelle Reishane Wang, and Huang Chieh are on the Palau-based management team of Grand Legend. Rose Wang is a Palau-based hotel owner and transnational organized crime facilitator who has helped Prince Group TCO establish commercial interests in Palau.  Rose Wang handled local administrative affairs for Grand Legend and helped the company obtain the lease for Ngerbelas Island. Rose Wang is the vice-president of Palau’s Overseas Chinese Federation, which may conduct unofficial diplomacy for China.  In 2018, Rose Wang introduced the notorious criminal boss Wan Kuok Koi (a.k.a. Broken Tooth), who was attempting to set up casinos in Palau, to the then-President of Palau.  OFAC sanctioned Broken Tooth in December 2020 pursuant to E.O. 13818 for his organization’s role in spreading crime and corruption across Southeast Asia and Palau.Jing Pin Inc. and Aqua Pure Water Inc. are two companies in Palau owned or controlled by Wang Guodan.  Jing Pin Inc. is a hotel and restaurant company.  Aqua Pure Water Inc. is a bottled water company. OFAC is designating Grand Legend International Asset Management Co., Ltd. pursuant to E.O. 13581, as amended, for being owned or controlled by, or having acted or purported to act for or on behalf of, directly or indirectly, Chen Zhi. OFAC is designating Chen Xiao’er, Yang Jian, Yang Yanming, Shih Ting-yu, Michelle Reishane Wang, Huang Chieh pursuant to E.O. 13581, as amended, for being owned or controlled by, or having acted or purported to act for or on behalf of, directly or indirectly, Grand Legend.OFAC is designating Rose Wang pursuant to E.O. 13581, as amended, for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, Grand Legend. OFAC is designating Jing Pin Inc. and Aqua Pure Water Inc. pursuant to E.O. 13581, as amended, for being owned or controlled by, or having acted or purported to act for or on behalf of, directly or indirectly, Rose Wang.SANCTIONS IMPLICATIONSAs a result of today’s action, all property and interests in property of the blocked persons described above that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC.  In addition, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also blocked.  Unless authorized by a general or specific license issued by OFAC, or exempt, OFAC’s regulations generally prohibit all transactions by U.S. persons or within (or transiting) the United States that involve any property or interests in property of designated or otherwise blocked persons.In addition, persons that engage in certain transactions with the individuals and entities designated today may themselves be exposed to sanctions or subject to an enforcement action. Non-U.S. persons are also prohibited from causing or conspiring to cause U.S. persons to wittingly or unwittingly violate U.S. sanctions, as well as engaging in conduct that evades U.S. sanctions.  OFAC’s Economic Sanctions Enforcement Guidelines provide more information regarding OFAC’s enforcement of U.S. sanctions, including the factors that OFAC generally considers when determining an appropriate response to an apparent violation.The power and integrity of OFAC sanctions derive not only from OFAC’s ability to designate and add persons to the SDN List, but also from its willingness to remove persons from the SDN List consistent with the law.  The ultimate goal of sanctions is not to punish, but to bring about a positive change in behavior.  For information concerning the process for seeking removal from an OFAC list, including the SDN List, please refer to OFAC’s Frequently Asked Question 897 here and to submit a request for removal, click here.For more information on the persons designated today, click here.View the chart on the individuals and entities designated today.The final rule for Huione Group, as submitted to the Federal Register, can be found here.###

Four Functional Quadrants for Trust & Safety Tools: Detection, Investigation, Review & Enforcement (DIRE) <div> <br> </div>

Public discourse and regulatory debates about online trust and safety have long been dominated by a focus on rules, not tools: preoccupied mostly by the questio

AI Companies Should Report Pre- and Post-Mitigation Safety Evaluations

The rapid advancement of AI systems has raised widespread concerns about potential harms of frontier AI systems and the need for responsible evaluation and oversight. In this position paper, we argue that frontier AI companies should report both pre- and post-mitigation safety evaluations to enable informed policy decisions. Evaluating models at both stages provides policymakers with essential evidence to regulate deployment, access, and safety standards. We show that relying on either in isolation can create a misleading picture of model safety. Our analysis of AI safety disclosures from leading frontier labs identifies three critical gaps: (1) companies rarely evaluate both pre- and post-mitigation versions, (2) evaluation methods lack standardization, and (3) reported results are often too vague to inform policy. To address these issues, we recommend mandatory disclosure of pre- and post- mitigation capabilities to approved government bodies, standardized evaluation methods, and minimum transparency requirements for public safety reporting. These ensure that policymakers and regulators can craft targeted safety measures, assess deployment risks, and scrutinize companies’ safety claims effectively.