A new report from the password management company NordPass is challenging the idea that federal institutions are more secure than local governments against cybersecurity threats. The study, conducted by NordPass and threat exposure management platform NordStellar, found a total of 53,070 passwords belonging to U.S. civil servants were exposed in public sources since the beginning of 2024. Of the impacted institutions, NordPass found the Department of Defense had 1,897 total exposed passwords, 222 of which were unique. The State Department had 15,272 total exposed passwords, 190 of which were unique, while the U.S. Army had 1,706 exposed passwords, 167 of them unique. The Department of Veterans Affairs also ranked among the top five most-affected institutions, with 1,331 total password exposures, 53 of which were unique. Seven passwords of White House employees were also compromised, according to the study. A State Department spokesperson told FedScoop the agency is “committed to cybersecurity across the department.” They said the agency has instituted multi-factor authentication and regularly rotates credentials.

A Biden-era director of the White House Office of Science and Technology Policy slammed the Trump administration’s cuts to research and development funding Wednesday, warning of adverse effects to areas such as artificial intelligence. Arati Prabhakar said during a panel held by Harvard’s Kennedy School: “Today what we are in the middle of is an assault on the public investment in research unlike anything we have seen in our country’s history.” Prabhakar specifically pointed to the Trump administration’s moves to withdraw support from certain projects, its removal of federal workers at research agencies, its attacks on universities, reversal of immigration policies that bring talent to the U.S., and the administration’s budget proposal that sought to cut federal R&D spending by roughly $44 billion.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

Starting next year, the Army will be able to domestically mass-produce upwards of 10,000 small unmanned aerial systems each month, according to the service. Army Materiel Command is leading a new pilot program dubbed “SkyFoundry” that will allow the service to rapidly develop, test and produce small drones using innovative manufacturing methods. Officials are currently identifying multiple facilities where the platforms will be designed and produced. The department expects it can manufacture at least 10,000 UAS per month once the first site is up and running, Army Vice Chief of Staff Gen. James Mingus said Tuesday. He said during a fireside chat at the annual AUSA conference: “We’ll be at 10,000 a month by this time next year, if not more.” The effort comes as the Pentagon looks to ramp up production of small drones across the services following Secretary of Defense Pete Hegseth’s “Unleashing U.S. Military Drone Dominance” directive, issued in July. The memo requires low-cost, attritable drones to be fielded to every Army squad by the end of 2026 and calls on the military to partner closely with domestic industry to scale up manufacturing.

Rep. Eric Swalwell, D-Calif., sent a letter Tuesday to acting CISA Director Madhu Gottumukkala raising concerns about staffing levels and the direction of the nation’s primary cybersecurity agency, writing that the “Trump Administration has undertaken multiple efforts to decimate CISA’s workforce, undermining our nation’s cybersecurity.” Swalwell, the ranking member on the House Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection, called out the agency for its reported shift of cybersecurity personnel to the Department of Homeland Security’s deportation efforts, on top of the approximately 760 people that have been let go from the agency since January. Swallwell wrote: “Amid reports that the Department of Homeland Security is now forcibly transferring CISA’s cybersecurity employees to other DHS components, it has become apparent that the Department’s exclusive focus on its mass deportation campaign is coming at the expense of our national security,” calling it “further evidence of the Administration’s failure to prioritize cybersecurity” how CISA is engaging in Reductions in Force that could threaten its capacity to prevent and respond to cybersecurity threats. In the letter, he demanded that DHS cease all efforts to cut CISA’s workforce, reinstate employees who were transferred or dismissed, and provide details on the impacts of the agency’s workforce reductions.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

The Trump administration pushed forward Friday with plans to fire federal employees amid the government shutdown, directing reductions-in-force at the Departments of Health and Human Services, Education, and Housing and Urban Development, among other agencies. Prior to and during the current shutdown, the White House repeatedly threatened to lay off additional federal workers in a bid to further its efforts to shrink the size of the government. The Trump administration maintains Democrats are to blame for the shutdown, though Democrats contend that a spending bill from Republicans — who control all levers of power — wouldn’t adequately fund health care. Russ Vought, the director of the Office of Management and Budget, posted on X early Friday afternoon that the “RIFs have begun,” without offering additional details. An OMB spokesperson told FedScoop the RIFs began and are “substantial.” In a preview of his discussions with Vought last week, President Donald Trump said in a post to his social media platform that they would target “Democrat Agencies,” calling them “a political SCAM.” According to a court filing from the Trump administration late Friday, at least 4,100 federal workers across eight federal agencies may have been sent RIF notices, with the bulk of the staff reductions at HHS, with 1,100 to 1,200 workers impacted, and the Department of Treasury, with 1,446 workers impacted.

Deploying artificial intelligence requires taking on the right amount of risk to achieve a desired end result, a National Institute of Standards and Technology official who worked on its risk management framework for the technology said on a panel last week. While federal agencies, and particularly IT functions, are generally risk averse, risks can’t entirely be avoided with AI, Martin Stanley, an AI and cybersecurity researcher at the Commerce Department standards agency, said during a FedInsider panel on “Intelligent Government” last week. Stanley said: “You have to manage risks, number one,” adding that the benefits from the technology are compelling enough that “you have to go looking to achieve those.” Stanley’s comments came in response to a question about how the federal government compares to other sectors that have been doing risk management for longer, such as financial services. On that point specifically, he said the NIST AI Risk Management Framework “shares a lot of DNA” with Federal Reserve guidance on algorithmic models in financial services. He said NIST attempted to leverage those approaches and the same plain, simple language. “We talk about risks, we talk about likelihoods, and we talk about impacts, both positive and negative, so that you can build this trade space where you are taking on the right amount of risk to achieve a benefit,” Stanley said.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

Federal agencies’ latest status updates on how they’re using artificial intelligence reveal persistent barriers and variability on where agencies stand with ”high-impact” use cases. The release of the 2025 AI compliance plans offers one of the first in-depth glimpses at how federal agencies are addressing issues of AI risk management, technical capacity and workforce readiness under the second Trump administration. Those documents, which were required under the Trump administration’s AI governance memo to agencies, were supposed to be released publicly by Sept. 30. As of publication time, FedScoop located roughly 20 plans and 14 strategies across 22 agencies. For nine of the roughly two dozen Chief Financial Officers Act agencies, FedScoop was unable to find either a plan or a strategy. The U.S. Department of Agriculture and the Nuclear Regulatory Commission, meanwhile, produced only strategies. FedScoop and DefenseScoop attempted to contact the CFO Act agencies that didn’t produce both documents, but the agencies either didn’t respond or didn’t provide the documents. Two of those agencies, NASA and the Justice Department, noted the government shutdown in their responses, and both the DOJ and Department of Defense indicated they were working to post at a later date. Agencies were also required to submit AI strategies for the first time this year. Those documents contain some of the same information as the compliance documents, including plans to train the workforce, examples of use cases, and systems for governance. The compliance plans, meanwhile, which are in their second year, have changed only slightly from their previous iterations, with some agencies showing progress on their implementation of the technology and risk management practices.

A top Senate Democrat introduced legislation Thursday to extend and rename an expired information-sharing law, and make it retroactive to cover the lapse that began Oct. 1. Michigan Sen. Gary Peters, the ranking member of the Homeland Security and Governmental Affairs Committee, introduced the Protecting America from Cyber Threats (PACT) Act, to replace the expired Cybersecurity and Information Sharing Act of 2015 (CISA 2015) that has provided liability protections for organizations that share cyber threat data with each other and the federal government. Industry groups and cyber professionals have called those protections vital, sometimes describing the 2015 law as the most successful cyber legislation ever passed. The 2015 law shares an acronym with the Cybersecurity and Infrastructure Security Agency, which some Republicans — including the chairman of Peters’ panel, Rand Paul of Kentucky — have accused of engaging in social media censorship. As CISA 2015 has lapsed and Peters has tried to renew it, “some people think that’s a reauthorization of the agency,” Peters told reporters Thursday in explaining the new bill name.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

The Environmental Protection Agency’s pledge to “get out of the way” on chemical reviews to accelerate the buildout of artificial intelligence data centers doesn’t mean those reviews would be any less “robust,” a top EPA nominee told lawmakers Wednesday. Appearing before the Senate Environment & Public Works Committee, Douglas Troutman — President Donald Trump’s pick for assistant administrator for toxic substances — was pressed by Sen. Ed Markey, D-Mass., about comments made by EPA Administrator Lee Zeldin last month following a White House roundtable with AI and data center leaders. In a Sept. 18 press release, Zeldin announced that the EPA would begin prioritizing the review of new chemicals — under the Toxic Substances Control Act (TSCA) — that would be used in data center projects. Markey asked Troutman, a former chemical industry lobbyist, what provisions in federal toxic safety laws indicate the EPA can “get out of the way of reviewing chemicals for safety.” Troutman responded that “nothing will change with regard to the robust review based on the risk-based statute enacted under Section Five of TSCA.” Markey appeared unconvinced, telling Troutman that if he’s confirmed, he will “be under orders from Administrator Zeldin to get out of the way.” The Massachusetts Democrat made the case that “big tech bosses” with ties to the administration could lean on the agency to bypass regular review protocols.

Voting rights groups are asking a court to block an ongoing Trump administration effort to merge disparate federal and state voter data into a massive citizenship and voter fraud database. Last week, the League of Women Voters, the Electronic Privacy Information Center (EPIC) and five individuals sued the federal government in D.C. District Court, saying it was ignoring decades of federal privacy law to create enormous “national data banks” of personal information on Americans. On Tuesday, the coalition, represented by Democracy Forward Foundation, Citizens for Responsibility and Ethics in Washington (CREW), and Fair Elections Center, asked the court for an emergency injunction to halt the Trump administration’s efforts to transform the Systematic Alien Verification for Entitlements into an immense technological tool to track potential noncitizens registered to vote. Until this year, SAVE was an incomplete and limited federal database meant to track immigrants seeking federal benefits. In an Oct. 7 court filing, the groups said an immediate injunction was needed to prevent permanent privacy harms due to the “illegal and secretive consolidation of millions of Americans’ sensitive personal data across government agencies into centralized data systems” through SAVE.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

A federal workers’ union is suing the Education Department after agency employees on furlough or administrative leave discovered that their automatic email replies had been changed to a message blaming Democratic lawmakers for the ongoing government shutdown. The complaint, filed by the American Federation of Government Employees, asks a court to prohibit the Education Department’s alleged efforts to “put political speech in federal employees’ mouths.” “Forcing civil servants to speak on behalf of the political leadership’s partisan agenda is a blatant violation of federal employees’ First Amendment rights,” the suit stated, adding that “employees are now forced to involuntarily parrot the Trump Administration’s talking points with emails sent out in their names.” The suit came one day after some furloughed workers discovered that their automatic out-of-office email replies were changed without their knowledge, from neutral language to partisan messaging that blamed Democrats for the shutdown, which began last Wednesday.

Three House Democrats questioned the Department of Homeland Security on Monday over a reported Immigration and Customs Enforcement contract with a spyware provider that they warn potentially “threatens Americans’ freedom of movement and freedom of speech.” Their letter follows publication of a notice that ICE had lifted a stop-work order on a $2 million deal with Israeli spyware company Paragon Solutions, a contract that the Biden administration had frozen one year ago pending a review of its compliance with a spyware executive order. Paragon is the maker of Graphite, and advertises it as having more safeguards than competitors that have received more public and legal scrutiny, such as NSO Group’s Pegasus, a claim researchers have challenged. A report earlier this year found suspected deployments of Graphite in countries across the globe, with targets including journalists and activists. \

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

Defense Secretary Pete Hegseth issued a new edict last week to reduce the time personnel spend on cybersecurity training, among other reforms. The directive came in a Sept. 30 memo to senior Pentagon leadership and DOD agency and field activity directors, ordering the military departments, in coordination with the Pentagon’s chief information officer, to “Relax the mandatory frequency for Cybersecurity training.” Hegseth also called for narrowly tailoring records management training to service member roles and allowing flexibility in training delivery, as well as automating information management systems to eliminate training requirements. Additionally, Hegseth directed the military departments and other Pentagon leaders to “relax” the mandatory frequency for controlled unclassified information (CUI) training; remove Privacy Act Training from the Common Military Training (CMT) list; eliminate the mandatory frequency for “Combating Trafficking in Persons” refresher training after appropriate legislation is enacted; consolidate mandatory training topics, “as appropriate”; and develop an integrated CMT program plan. The changes are to be “implemented expeditiously,” per Hegseth’s directive.

Federal courts are upgrading their cybersecurity on a number of fronts, but multifactor authentication for the system that gives the public access to court data poses “unique challenges,” the Administrative Office of the United States Courts told Sen. Ron Wyden in a letter last week. Wyden, D-Ore., wrote a scathing August letter to the Supreme Court in response to the latest major breach of the federal judiciary’s electronic case filing system. The director of the Administrative Office of the United States Courts responded on behalf of the Supreme Court. It is “simply not the case” that the courts have, in the words of Wyden, “ignored” advice from experts on securing the Case Management/Electronic Case Files (CM/ECF) system, wrote Robert Conrad Jr., director of the office. Conrad wrote in the Sept. 30 letter: “Substantial planning for the modernization effort began in 2022, and we are now approaching the development and implementation phase of the project. We expect implementation will begin in the next two years in a modular and iterative manner.” In recent years, the office has been testing technical components on its modernization effort, and is centralizing the operation of data standards to enable security, Conrad said.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

When Katie Arrington was named to her role performing the duties of the CIO for the Department of Defense, which the Trump administration is now calling the Department of War, she took that charge seriously. As such, she’s not just keeping a seat warm until the Senate approves a new CIO. Instead, Arrington, who knows what it takes to get things dones in the Pentagon, has been helllbent to drive IT reform to deliver better software and digital services that warfighters depend on. In an energetic new episode of CTRL + ALT + DEFENSE, Arrington shares why she returned to the Pentagon during the second Trump administration, what’s in store for the department’s IT and much more.

Former State Department employees whose roles were eliminated as part of a reduction-in-force still received information about whether they would be needed during the government shutdown — including some workers who were told their positions were “excepted.” While the full extent of the issue wasn’t immediately clear, three such employees shared those notifications with FedScoop on the condition of anonymity for fear of retaliation. Others were also aware of the problem even if they didn’t receive the messages themselves. In response to a FedScoop request for comment, a State spokesperson indicated the department was aware of the issue and had taken steps to address it, confirming there were “minor” discrepancies with data, saying that the department immediately worked to resolve any outstanding issues. Of the three State Department notices reviewed by FedScoop, one informed the RIF’d employee that their position was “excepted” and explained that those roles are defined as those needed for emergencies that threaten life and property or are essential for national security. It then ordered that worker to “report to work on your next regularly scheduled workday.” The other two already RIF’d employees were told that they would be furloughed during the shutdown but that it was “in no way a value judgement on the work you do for the Department.” Those employees were also instructed to review their department emails for updates despite not being able to access that information. Of the three RIF’d employees, only one — a foreign service officer — is still on the department’s payroll.

As employees at the Education Department prepared for a looming government shutdown this week, several set an automatic email reply to inform others of their furloughed status. But by Thursday morning, some furloughed workers discovered that their automatic email replies had been altered, without their knowledge, to include a message blaming Democratic senators for the ongoing government shutdown. According to two furloughed Education Department employees, the agency sent workers suggested language to use for their out-of-office messages earlier this week, but the language was “neutral” regarding the shutdown. One of the employees, speaking on the condition of anonymity, told FedScoop they and other furloughed staff mostly cut and paste from the suggested language with little to no changes when setting their automatic replies. But when they checked their automatic email replies Thursday morning, the message changed and included partisan language mentioning Democrats, the employee said. The other furloughed worker said they set the generic text for their OOO email Wednesday morning and the message was changed by Wednesday night.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

It’s day two of the federal shutdown, and with the Senate on leave, there won’t be any sort of appropriations deal until Friday at the earliest — though many have doubts about that possibility. As federal agencies adjust to the new normal with hundreds of thousands of federal employees furloughed and the White House threatening more layoffs targeting those who’ve been sent home, FedScoop took the time to compile a near-complete look at how agency IT organizations are affected. An analysis of the nearly two dozen civilian Chief Financial Officer Act agencies found that some agencies explicitly outlined plans to scale back IT operations amid the shutdown, while others deemed several IT staff members essential for managing technology and cybersecurity infrastructure. For instance, at the Department of Commerce’s Office of the CIO, just one individual is tasked with taking responsibility for shutdown tasks and assurance that the office will continue to work on critical IT functions. If the lapse in funding continues for an extended period, there is also the potential for staff to be recalled on an intermittent or full-time basis for cybersecurity and maintenance work, and limited staff may be called for administrative functions. While at the Labor Department, the Office of the Assistant Secretary for Administration and Management has selected “a minimal IT staff” within the OCIO to oversee tech operations. Those employees are now tasked with managing Labor’s technology services, applications and website, in addition to having other IT security responsibilities that support the agency’s excepted and exempt staff.

A nonprofit legal group is suing a handful of federal agencies, calling on the federal bodies to release documents related to the use of artificial intelligence to carry out the Trump administration’s “deregulation agenda.” The lawsuit, filed by Democracy Forward on Wednesday, asks a court to require the General Services Administration, Office of Personnel Management, Office of Management and Budget and the Department of Housing and Urban Development to comply with public records laws amid concerns over how AI is being used to “weaken” existing federal regulations. Democracy Forward said it reviewed both public records and documents obtained through FOIA requests and found GSA plays a “central role” in the White House’s efforts to overhaul regulations. The nonprofit cited an apparent email trail, in which a GSA-affiliated email informs other agencies of “significant progress” in reviewing its internal and external policies to ensure consistency with President Donald Trump’s directives. The suit further pointed to reports of an AI tool called SweetREX developed by an affiliate of the Department of Government Efficiency.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.