Despite the significant sanctions put on Russia since the full scale invasion in Feb. 2022, the Russian cyber industry made more money in 2024 than ever before. @jshermcyber.bsky.social looks at how Russian cyber firms have adapted and what American policymakers can do.

🚨NEW ISSUE BRIEF🚨 In “Securing data in the AI Supply Chain,” CSI fellow @jshermcyber.bsky.social writes about the seven data components powering AI and the risks they face. Read it here: www.atlanticcouncil.org/in-depth-res...

UPCOMING BRIEFING—The Impact on Central Asia of Russia’s War on Ukraine: Opportunities for U.S. Engagement 📅September 4 🕑2pm 🏛️Rayburn 2200 Join our expert panel for a discussion about how Russia's war on Ukraine has shifted political & economic dynamics in Central Asia. (1/2)

The Kremlin’s unspoken agreement with hackers? Don’t cross certain lines. When an FSB officer failed to protect the cybercriminals who paid him, the consequences were swift. @jshermcyber.bsky.social explains what this means for Russia’s cyber underworld. 🔗

NEW: Credit reporting giant TransUnion has confirmed a data breach involving more than 4.4 million customers' personal information. TransUnion claims "no credit information was accessed" in the late-July breach, which it said involves its U.S. consumer support operations.

We've received a lot of applications from non U.S. students to this. Please note you must apply with an .edu email to be considered. If you're interested in training and are not a student in the USA we have a full list of upcoming public trainings here: www.bellingcat.com/workshops/

@warmatters.bsky.social joins today’s @lawfaremedia.org Daily to discuss his new book “War in the Smartphone Age.” We talked about everything from ‘context collapse’ on social media to the future of ‘participatory warfare.’ Listen wherever you get your podcasts! podcasts.apple.com/us/podcast/t...

On Lawfare Daily, @jshermcyber.bsky.social spoke to @warmatters.bsky.social about his new book “War in the Smartphone Age,” the role of smartphones and related technologies in war, how smartphones and other devices are reshaping open-source intelligence, and more.

Last week, Reuters published two articles by journalist Jeff Horwitz reporting concerning details about Meta's AI chatbot policies and products and how they affect children and vulnerable adults. Tech Policy Press invited experts to submit reactions to the reports—here are their responses:

“Technological isolationism is now both a reality and a desired goal for many in the Russian government and technology sector,” writes @jshermcyber.bsky.social in this issue brief. Read more here:

Excited to see my upcoming book on Amazon’s current ranking of “hot new releases” in national security! Preorder “Navigating Technology and National Security” here: www.amazon.com/Navigating-T...

I'm headed back on tour for my book EMPIRE OF AI! Starting next week, I'll be on the road again with stops in the US, UK, Europe & Asia. Here are my upcoming events open to the public, with more to come. Event details & ticket reservations at empireofai.com/#tour.

What does cybersecurity have to do with broadband, AI, and your Member’s next hearing? Come find out. Our 6-part Fall 2025 program for Hill staffers starts Sept 26. Weekly Friday sessions (w/ lunch!) 🔗 Apply now: bit.ly/ACCongressio...

NEW: How’s Russia’s cyber industry adapting to sanctions, a new security environment, etc. post-Russia’s full-scale, illegal war on Ukraine in Feb. 2022? Hint: three Russian cyber firms made more money in 2024 than ever. My new report for CNA out today: www.cna.org/analyses/202...

On Lawfare Daily, @jshermcyber.bsky.social spoke to @sambresnick.bsky.social about his recently published report, “Big Tech in Taiwan,” on 17 companies’ Taiwan entanglements, and how greenfield foreign direct investments, data centers, supply chains, and more expose those companies to Taiwan.

In Russia’s cyber ecosystem, even FSB officers aren’t untouchable. @jshermcyber.bsky.social dives into the sentencing of an officer who took bribes from hackers but failed to deliver protection. It’s about more than corruption—it’s a warning to others. 🔗

Will Big Tech support Taiwan in the event of a conflict? How exposed are they — financially, operationally, etc.? Georgetown’s Sam Bresnick joins me on today’s @lawfaremedia.org to discuss Hear about Google, Cisco, Maxar, and more and their Taiwan exposures podcasts.apple.com/us/podcast/t...

Competition is a cybersecurity issue, but @Jshermcyber.bsky.social says policymakers must “acknowledge how questions of market concentration may not address other questions around the security and resilience of underlying foundational technologies”

As Putin wages war on Ukraine, he intensifies his repression of the Russian people. Banning private messaging apps & forcing Russians to use MAX will increase surveillance while further limiting their access to information about the outside world.

My (first) book comes out Dec. 11!! "Navigating Technology and National Security" dives into the story of how the US came to govern so much technology—startup investments and data flows; TikTok and Grindr; cloud systems and AI models—through national security powers. www.amazon.com/Navigating-T...

Russia is pushing a “super app” messenger for all citizens — including so it can ban WhatsApp and reduce reliance on Telegram. What could possibly go wrong? My 5-minute breakdown on Australian Broadcasting Corporation: www.abc.net.au/listen/progr...

Flip-flopping on chip export controls to China to claim a “win” now — in exchange for deepening semiconductor business ties in China — is a long-term national security mistake. My latest Barron’s column (gift link): www.barrons.com/articles/tru...

“Consumers deserve robust privacy protections and rights over their own data, regardless of the type of business collecting and processing that information...” ➡️ Read EPIC's latest white paper by Law Fellow Caroline Kraczon and Scholar in Residence @jshermcyber.bsky.social: epic.org/documents/un...

On Lawfare Daily, @jshermcyber.bsky.social sits down with @candacerondeaux.bsky.social to discuss Yevgeny Prigozhin and his founding of the Wagner Group, Wagner and Russia’s full-scale invasion of Ukraine in 2022, and more.

New paper by Caroline Kraczon and I @epic.org on how states can better hold data brokers accountable: epic.org/documents/un...

📊📜 Today, EPIC published "Unbridled and Underregulated: Removing FCRA and GLBA Exemptions from Privacy Laws to Hold Data Brokers Accountable, a white paper by Law Fellow Caroline Kraczon and Scholar in Residence Justin Sherman @jshermcyber.bsky.social: epic.org/documents/un...

New for @lawfaremedia.org: Don’t want to put people serving their country and our national security at risk? Instead of allowing countless, unrestrained private-sector data practices, putting strong, comprehensive data protections into law would help both consumers *and* national security.

In June, the Justice Department Inspector General published a report on the FBI's efforts to mitigate the risks of ubiquitous technical surveillance. @jshermcyber.bsky.social argues that better data privacy and security protections could combat UTS-related risks.

“Terminating diplomats with tech expertise and years of public service, and telling other countries ‘figure out your own cybersecurity,’ only makes the U.S. more vulnerable,” I tell @ericgeller.bsky.social about recent State Department firings. Full story: www.cybersecuritydive.com/news/state-d...

"Terminating diplomats with tech expertise and years of public service, and telling other countries 'figure out your own cybersecurity,' only makes the U.S. more vulnerable," said @jshermcyber.bsky.social, the chief executive of the advisory firm Global Cyber Strategies.

The State Department's dismantling of its cyber diplomacy bureau and firings of more than a dozen people will set back efforts to combat foreign hackers and promote U.S. security interests, experts told me. My Cybersecurity Dive story with new details: www.cybersecuritydive.com/news/state-d...

From Tiktok to AI models to routers, the U.S. government has used bans to address national security risks associated with Chinese technology. Geoffrey Gertz and @jshermcyber.bsky.social look at how American policymakers could expand their toolkit to respond to foreign technology risks.

Good story about the murky, mostly lawless world of data brokers and their trade in Australians' personal details. By @joshtaylor.bsky.social #infosec www.theguardian.com/world/2025/j...

New Barron’s column: export control chaos = US companies likely to keep clashing w/ Trump admin on China, tech, national security; Beijing can step back and let the US take blame for the volatility, but must balance rhetorical gains w/ real damage to its tech giants. www.barrons.com/articles/exp...

After op-ed columns at WIRED and Slate, I'm excited to be writing one for Barron’s on tech/business/geopolitics. My latest: the AI diffusion rule is gone, but government-business tensions on China/national security/market expansion/tech are still brewing. www.barrons.com/articles/the...

Restricting direct sales of US data to China, Russia, etc. is a start—but that still leaves wide open the risk of many indirect data broker sales that threaten US national security. Comprehensive data privacy + security laws are the answer. @lawfare.bsky.social www.lawfaremedia.org/article/data...

To protect American's data, the U.S. gov't is focused on restricting direct data sales to traditional adversaries like China and Iran, but @jshermcyber.bsky.social argues that to ensure real data privacy, Congress should implement restrictions on the sale of many kinds of data to any buyer.

From banning Sam Altman’s “Tools for Humanity” iris-scanning crypto project, to stopping Meta from mining user data for training AI, Brazil has been a global trailblazer in issues of privacy and data protection.

1. You give your genetic data to 23andMe 2. It goes bankrupt—and now the data’s all for sale Whether you worry about invasive adtech firms or law enforcement surveillance, there are clear lessons from the 23andMe bankruptcy For @georgetownprivacy.bsky.social @epic.org medium.com/center-on-pr...

23andMe's bankruptcy reminds us that policymakers can and should do better in mitigating the risks from any potential bankruptcy-data fallout ahead of time. Read EPIC Scholar in Residence Justin Sherman's (@jshermcyber.bsky.social) analysis: epic.org/bankrupt-gen... #23andMe #DNA #GeneticData

🏦 ✅ EPIC submitted testimony in support of California SB 361, which would require data brokers to disclose whether they collect account login credentials, government-issued ID numbers, citizenship and immigration status, union membership, sexual orientation, and biometric data.

Our Executive Director, Lisa LeVasseur, inspired by Sarah Wynn-Williams’ "Careless People," warns of the fatal risks tied to neglecting software "component" products like SDKs and APIs. Read more at the the Harvard Carr Center for Human Rights Policy site: www.hks.harvard.edu/centers/carr...

Apparently, telling a data broker you opt out of them selling your data or that you want to delete it, if they’re not legally forced to listen, is “privacy snake oil.” I break down this ridiculous industry argument here for @epic.org: epic.org/dont-believe...

New for @epic.org: a recent industry op-ed claimed some data deletion firms are “selling privacy snake oil” and that “it needs to stop.” I break down the misleading arguments here. Let’s not forget which companies are collecting and selling your data without your consent: epic.org/dont-believe...

🧬 Americans are rightly concerned about the privacy of their genetic data as 23andMe goes up for sale. investors.23andme.com/news-release... #23andMe #DNA #Genetics

My past Barron’s column relevant again today: The US needs to better protect our genetic data — and failing to do so undermines the US’ own citizens’ privacy, national security, and international credibility www.barrons.com/articles/gen...

TODAY - Webinar - State Privacy Legislation 2.0: New Directions and Legislative Challenges (Tues, Mar 18, 12 PM ET) – I will chat with Monique Priestley (VT Legislature). Register free: teachprivacy.com/webinar-stat...

A certain AI company should really stop talking as if every single ML application on earth is an LLM (it’s not), that mass data scraping/ingestion without any consent is “necessary” (again, nope), and that doing so is also “necessary for” any/all ML applications (it isn’t). epic.org/scraping-for...

Greetings from SXSW. Just saw Meredith Whittaker (Signal CEO) gave a great talk on why everyone needs privacy even if you don’t think you do. And how being a nonprofit removes the temptation to “further monetize” information you have on your users

Great job alert: ProPublica is hiring a computational journalist, "someone who will use technology and data to identify and unlock stories that would otherwise be out of reach." Salary: $120K-$140K Remote: ✅ Come join us!