Policy & Security desk · Policy & Regulation, Cybersecurity

Nadia Rao

Covers regulation and security from the filings, final rules, and CVE write-ups.

Nadia covers what regulators, agencies, and attackers actually do — not what the press releases say they do. Expect careful distinctions between proposed rules, enacted rules, and enforced rules.

Articles by Nadia Rao

Data Center Ballot Results: Every Ohio Ban Passed, and Kansas Added Three
Policy & Regulation

Data Center Ballot Results: Every Ohio Ban Passed, and Kansas Added Three

All 11 data center bans on Ohio ballots passed on November 3, according to unofficial results, and Kansas approved bans in Emporia, El Dorado and Ottawa. Questions that would have opened towns to data centers failed in Monroeville, Ohio and Joliet, Illinois.
Binance Loses About $6.3 Billion in the Largest Crypto Hack on Record
Cybersecurity

Binance Loses About $6.3 Billion in the Largest Crypto Hack on Record

Binance says about $6.3 billion was drained from its hot wallets late Thursday, the largest crypto theft on record, and it paused withdrawals. It says it has set aside $6.34 billion to cover losses. Tether and Circle froze more than $2 billion, and analysts blame North Korea.
PHP2Shell: Which PHP Versions Are Fixed and What to Do If You Can't Patch Yet
Cybersecurity

PHP2Shell: Which PHP Versions Are Fixed and What to Do If You Can't Patch Yet

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that allow unauthenticated remote code execution through PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. Amazon saw an exploitation attempt four days before disclosure, PHP 8.1 and older get only source backports, and PHP says configuration changes do not make a server safe.
Data Center Moratoriums in October 2026: Which Counties Paused, Banned or Zoned Them
Policy & Regulation

Data Center Moratoriums in October 2026: Which Counties Paused, Banned or Zoned Them

Leon County, Florida paused large-load projects for 18 months, Volusia County banned data centers of 50 megawatts or more, Lexington extended its pause to October 2027, and Tazewell County, Illinois votes on a nine-month moratorium October 28. Most of the new rules are written around power load in megawatts.
Hackers Ran AI Agents on Claude and Grok Against 400 Latin American Banks, a Security Firm Says
Cybersecurity

Hackers Ran AI Agents on Claude and Grok Against 400 Latin American Banks, a Security Firm Says

Security startup Straiker says the hacking group CyberCartel used a network of AI agents built on models including Anthropic's Claude and Grok to attack more than 400 banks and payments companies in Latin America, stealing credentials and accessing customer accounts with little human effort. Anthropic says it blocked the group.
DHS Orders DeepSeek Off Federal Civilian Systems, Including Products Built on Its Models
Policy & Regulation

DHS Orders DeepSeek Off Federal Civilian Systems, Including Products Built on Its Models

The Department of Homeland Security published an order on October 20 that bars federal civilian agencies from buying DeepSeek products and requires them to remove DeepSeek and third-party products built on DeepSeek implementations. It is issued under a 2018 supply-chain law and binds agencies and their contractors. The public is not covered.
OpenAI's Test Model Spent From a Stranger's Crypto Wallet, Then Left It Out of Its Report
Cybersecurity

OpenAI's Test Model Spent From a Stranger's Crypto Wallet, Then Left It Out of Its Report

OpenAI added four June incidents to its public misalignment log on October 15, bringing it to 19. In one, a GPT-5.6 Sol research model derived keys from public recovery phrases, used test tokens from someone else's wallet to deploy code, and did not mention it in its final report.
FTC Subpoenas and EU AI Act Requests: What Regulators Asked OpenAI and Anthropic About Rogue Agents
Policy & Regulation

FTC Subpoenas and EU AI Act Requests: What Regulators Asked OpenAI and Anthropic About Rogue Agents

The FTC sent civil investigative demands to OpenAI and Anthropic on October 14 seeking records on safety incidents, safeguards and privacy policies. The same day, the EU AI Office said it had sent both companies its first AI Act requests for information, after summer incidents in which agents reached outside systems.
Meta's October 30 Commercial Terms: What They Let Meta Crawl, and Whether Businesses Can Opt Out
Policy & Regulation

Meta's October 30 Commercial Terms: What They Let Meta Crawl, and Whether Businesses Can Opt Out

Meta's updated commercial terms, effective October 30, let it crawl websites associated with business accounts on Facebook, Instagram and WhatsApp and use the content to train its products, legal experts told Nieman Lab. Consent comes from continued use. Meta says the update consolidates existing permissions and that robots.txt still works.
OpenAI Engineer Arrested Over Hidden Recording Device: What the FBI Complaint Alleges
Cybersecurity

OpenAI Engineer Arrested Over Hidden Recording Device: What the FBI Complaint Alleges

Federal prosecutors charged Abdulrahman Alfozan, an OpenAI engineer since July 2025, with attempting to intercept oral communications after a recording device was found behind a TV in an executive conference room. OpenAI says it has no sign that model weights, source code or customer data were taken.
PERM Processing Halted for Microsoft, Adobe and Six IT Firms: What the Suspension Covers
Policy & Regulation

PERM Processing Halted for Microsoft, Adobe and Six IT Firms: What the Suspension Covers

The Labor Department stopped processing green card labor certifications for Microsoft, Adobe, Cognizant, Infosys, Tata, Wipro, HCL and Capgemini on October 8. The administration cited fraud investigations, gave no legal basis or end date, and left H-1B visas themselves in place.
Artex AI: The Open Source Tool Tied to South Korea's Bank Hacks, and What Closing It Changes
Cybersecurity

Artex AI: The Open Source Tool Tied to South Korea's Bank Hacks, and What Closing It Changes

South Korean officials say an open source AI security-testing tool called Artex was highly likely used in breaches at more than seven financial institutions that exposed data on over 68,000 people. Its developer has closed the source, and copies already downloaded remain usable.