Blog

Washington is home to Amazon, Microsoft, and one of the most data-dependent economies in the country. It doesn’t have a generally applicable consumer privacy law. Three attempts at one failed in 2019, 2020, and 2021, and each time the cause it failed was the same fight: the Senate wanted Attorney General-only enforcement, the House wanted…

On August 26, 2026, Bill Gates published a 6,000-word essay arguing that AI will either be “the greatest equalizer ever invented, or the worst source of injustice.” The Guardian, CBS News, and other outlets covered it extensively. Coverage focused on jobs, the Human Reserved concept, and Gates’ personal credibility (the Guardian reminded readers about those…

In August 2026, California’s Department of Financial Protection and Innovation (DFPI) ordered Academy Mortgage Corporation to pay $825,000 for failing to protect 284,443 people’s personal information. That penalty’s the smallest line item on a larger invoice. By my estimate, the total cost runs closer to $9.8 million once you add incident response, breach notifications, identity…

I sat through OpenAI’s Black Hat presentation earlier this month, and on August 20th I saw Alabama’s Attorney General Steve Marshall issue a subpoena against OpenAI under the state’s Deceptive Trade Practices Act. Not the Computer Fraud and Abuse Act, not a state computer crime statute, but a consumer protection law originally designed to go after deceptive business practices. And a…

An update dropped last week on a complex cyber insurance case that I’ve been following, and I took the weekend to read it. When ransomware hits and the insurer pays the claim, the insurer goes hunting for someone to blame. Threat actors are notoriously difficult to collect from, so insurers increasingly pursue the vendors who…

Occasionally my clients ask me for a more thorough explanation of why I’m recommending a given control. In addition to a formal write-up, I’m also sharing a version of that research here. In 2025, the FBI’s Internet Crime Complaint Center (IC3) recorded over three billion dollars in business email compromise (BEC) losses across 24,768 reported…

Another AI safety report dropped on August 18, 2026. Guidelight, a startup founded by two former OpenAI employees, graded five frontier companies on six control practices. Everyone failed. Anthropic and OpenAI tied for the top score at C-plus. Google was D-plus, xAI D-minus, and Meta got an F. Before rolling your eyes at one more…

In August 2026, the Clop ransomware group publicly named more than 40 organizations as victims of a data theft campaign. Shell, Philips, GE, Fiserv, and dozens of others initially appeared on Clop’s leak site with claimed data volumes ranging from 1 GB to several terabytes (Reuters; SecurityWeek). If you’re picturing encrypted laptops and ransom notes,…

On August 1, California’s Artificial Intelligence Transparency Act (CAITA) became operational, making it the first U.S. law to require generative AI providers to embed provenance data in their output and publish free public detection tools. The European Union’s parallel requirements under its AI Act Code of Practice kicked in the same day. Senator Josh Becker,…

Value Context Direction AI policy impact expectation 84% +42pts from 2025 ↑ Up Shadow AI adoption by employees 67% Using non-corporate accounts ↑ Up Complete AI usage visibility 6% Of organizations surveyed — Flat The Big Pivot in Corporate Anxiety The 2026 Littler Annual Employer Survey polled 303 C-suite executives, in-house lawyers, and HR professionals, and it…

On August 12, 2026, Judge Clay D. Land of the U.S. District Court for the Middle District of Georgia handed down an order Aflac had been fighting to avoid. The court largely denied Aflac’s motion to dismiss the consolidated class action stemming from the June 2025 data breach. Core claims survive, and the case heads…

While the security press spent July transfixed by frontier lab agents escaping their sandboxes, somebody built a working offensive AI system from parts anyone can download and pointed it at a nation-state. Teardown of the Taiwan Attack In early July 2026, suspected Chinese cyber operatives used the open-source agent frameworks Hermes and OpenClaw to run…