Check Point has announced two critical vulnerabilities in its VPN technology that could allow unauthenticated remote attackers to execute arbitrary code on affected security gateways under certain conditions. These vulnerabilities, tracked as CVE-2026-85102 and CVE-2026-85103, impact both Remote Access VPN and Site-to-Site VPN functionalities. Check Point said its internal research team discovered and resolved these […]
In August, government investigators subjected roughly 50 military officers and civilian employees on the Joint Staff to polygraph tests as part of an inquiry into press leaks about the Iran war and depleted U.S. munitions, according to The New York Times. The newspaper described the scope of the investigation as unprecedented in the modern military.
This is not the first time the Trump administration has used polygraphs in this way; in 2025, it directed that a wave of tests be administered across the executive branch to expose minor leaks.
As someone who has taken roughly a dozen polygraphs during my 27-year career with the CIA, I am wary of how the process is understood – and of the certainty its use can appear to convey.
Polygraphs carry an ominous, almost mythological reputation among Americans. The more familiar and unofficial term – lie detector tests – likely fuels that perception. Television crime dramas have done their part, too, often portraying the device as an oracle for uncovering the truth when conventional methods fail.
In those portrayals, the polygraph is not merely a tool – it’s a window into the soul.
Among those entering government service, especially in national security, the greater anxiety is not the background check but passing the polygraph. My advice is always the same: Don’t lie. It’s the best – and perhaps only – guidance for a process that most assessments have concluded is a more subjective interpretation than empirical science.
Why the polygraph persists
Polygraphs are “pseudo-scientific” in that they measure physiological responses such as heart rate, blood pressure and perspiration. The assumption is that liars betray themselves through spikes in those signals. But this presumes a kind of psychological transparency that simply doesn’t hold up. A person might sweat and tremble simply from fear, anger or frustration – not deceit.
Accordingly, polygraph results are not generally admissible in U.S. courts. Only a handful of states – such as Georgia, Arizona and California – permit their use even under limited conditions. And they typically require that both parties agree to admission and a judge to approve it. Unconditional admissibility remains the exception, not the rule.
And yet, inside many national security agencies, polygraphs remain central to the clearance process – a fact I observed firsthand during my time overseeing personnel vetting and analytic hiring within the intelligence community.
While not treated as conclusive, polygraph results often serve as a filter. A candidate’s visible discomfort – or the examiner’s subjective judgment that a response seems evasive – can stall or end the hiring process. For instance, I know that government agencies have halted clearances after an examiner flagged elevated reactions to questions about past drug use or foreign contacts, even when no disqualifying behavior was ultimately documented.
The FBI’s J. Edgar Hoover headquarters building in Washington in 2016. AP Photo/Cliff Owen
In some cases, an examiner’s suggestion that a chart shows an anomaly has led otherwise strong applicants to volunteer details they hadn’t planned to share – such as minor security infractions, undeclared relationships, or casual drug use from decades earlier – that, while not disqualifying on their own, reshape how their trustworthiness is perceived.
The polygraph’s power lies in creating the conditions under which deception is confessed.
A predictable pattern
No administration has been immune to the impulse to investigate leaks. The reflex is bipartisan and familiar: An embarrassing disclosure appears in the press – contradicting official statements or exposing internal dissent – and the White House vows to identify and punish the source. Polygraphs are often part of this ritual.
During his first term, Trump intensified efforts to expose internal dissent and media leaks. Department guidelines were revised to make it easier for agencies to obtain journalists’ phone and email records, and polygraphs were reportedly used to pressure officials suspected of talking to the press. That trend has continued – and, since 2025, escalated.
Policies at the Pentagon now restrict unescorted press access, revoke office space for major outlets and favor ideologically aligned networks. The line between legitimate leak prevention and the surveillance or sidelining of critical press coverage has grown increasingly blurred.
Not all leaks are treated the same. Disclosures that align with official narratives or offer strategic advantage may be quietly tolerated, even if unauthorized. Others, especially those that embarrass senior officials or reveal dysfunction, are more likely to prompt formal investigation.
Lewis Libby, Vice President Dick Cheney’s chief of staff, rides in the backseat of a limousine on Oct. 27, 2005, in McLean, Va. Win McNamee/Getty Images
Leaks involving classified material draw the sharpest response when they challenge presidential authority or expose internal disputes. That was the case in 2010 with Chelsea Manning, whose disclosure of diplomatic cables and battlefield reports embarrassed senior officials and sparked global backlash. Government reaction often depends less on what was disclosed than on who disclosed it – and to what effect.
A narrow set of disclosures, such as those involving espionage or operational compromise, elicit broad consensus as grounds for prosecution. But most leaks fall outside that category. Most investigations fade quietly. The public rarely learns what became of them. Occasionally, there is a vague resignation, but direct accountability is rare.
What the future holds
The Pentagon polygraph campaign is not likely to eliminate leaks to the press. But it may have a chilling effect that discourages internal candor while diverting investigative energy away from core security priorities.
Even if such campaigns succeed in reducing unauthorized disclosures, they may come at the cost of institutional resilience. Historically, aggressive internal enforcement has been associated with declining morale and reduced information flow – factors that can hinder adaptation to complex threats.
Some researchers have suggested that artificial intelligence may eventually offer reliable tools for detecting deception but caution that the technology is nowhere near operational readiness.
For now, institutions will have to contend with the tools they have – imperfect, imprecise and more performative than predictive.
This is an updated version of a story that was first published on July 9, 2025.
Three years ago, the Defense Department led an ambitious international effort to better protect civilians during combat, a movement built on the bloody lessons of Afghanistan and Iraq.
The Pentagon created a network with European partners, driving the creation of shared standards. Civilian harm experts described the moment as a “unique opportunity” for American leadership by example.
Today, those efforts continue — without the United States, after Defense Secretary Pete Hegseth dismantled the civilian protection mission.
And Thursday, no U.S. delegation will be in the room when the international forum the U.S. cofounded meets at NATO headquarters in Belgium.
The country’s absence from the International Contact Group on Civilian Harm Mitigation and Response summit reinforces the abandonment of a mission the Pentagon had encouraged partners to embrace, said current and former officials. Most spoke to ProPublica on condition of anonymity for fear of retaliation from President Donald Trump’s administration.
They called the step back “humiliating” and “dangerous,” pointing to reports of rising civilian casualties in Iran following strikes on schools and homes.
“There will be a day when people who care about mitigating civilian harm can come back and say, ‘OK, are we ready to solve this problem?’” said Jenny McAvoy, a former Defense Department official who helped shape the U.S. civilian protection program. “But there are already enormous consequences of abandoning this work.”
The Pentagon declined to comment about the lack of U.S. participation in the Brussels talks. A spokesperson previously told ProPublica that the Defense Department factors civilian protections into all phases of operational planning and “remains committed to fulfilling its civilian harm mitigation and response responsibilities.”
The Pentagon adopted the civilian harm mitigation and response mission in 2022 after years of bloodshed in the post-9/11 “forever wars.” Known as CHMR and pronounced “chimmer,” the framework called for a specialized center to collect strike data and for advisers embedded with regional commands to help mitigate the risk to noncombatants.
Not long after, the U.S. teamed up with the Netherlands to coordinate efforts internationally. The two countries had been frequent partners in recent military campaigns, including the fight against the Islamic State group, and were both coming to terms with high-profile civilian casualty incidents. For the United States, years of harm in Iraq and Afghanistan had drawn international outrage and pledges from commanders to better collect data and learn from deadly mistakes.
The Dutch were still addressing the fallout from a 2015 operation in Iraq in which air strikes targeting a car-bomb factory ignited a nearby munitions depot, setting off an enormous explosion that killed at least 70 civilians and wounded hundreds. Dutch responsibility wasn’t revealed until 2019, causing a national scandal and accusations of a cover-up.
In 2023, the U.S. and the Netherlands formed the loose coalition on CHMR. Participants described a small, informal group that has met half a dozen times since 2023 to share best practices and hear briefings on civilian casualty trends.
Advocacy groups said it had taken years to get the U.S. military to think of civilian casualties as more than “collateral damage,” showing commanders how the deaths of innocents were anathema to their morals and strategically harmful to their missions. The eventual adoption of CHMR guidelines by American defense officials helped their counterparts abroad make the case for programs in their own countries.
“By the U.S. putting itself out there and saying, ‘We learned, we can do better,’ it gives permission and makes it OK for other governments to similarly acknowledge, ‘Yeah, we can do better too,’” said McAvoy.
As participants gather this week in Brussels to discuss how to continue strengthening CHMR, however, the early momentum from the U.S. side has evaporated.
Days before the latest summit in Brussels, the United States wasn’t listed as a participant and there was no sign anyone from the Defense Department would attend. Current and former officials predicted either a no-show or, at most, a single delegate from one of the commands showing up.
To experts, the message was clear: The era of U.S. leadership on civilian protection was over.
Foreign ambassadors and heads of diplomatic missions visit Resalat Square in Tehran, Iran, on April 20, 2026, where photos of civilians killed in recent U.S.-Israeli strikes are displayed. Fatemeh Bahrami/Anadolu via Getty Images
“The U.S. stopped participating in this group last year and people assumed that meant the group would die,” said McAvoy. “But the group continued to exist and to meet — without the U.S. — under the leadership of the U.K. and the Netherlands.”
The two-day summit opens with a broad discussion of CHMR, such as how it applies in coalitions or in operations at sea, that includes advocacy groups and academics, a draft agenda reviewed by ProPublica shows. Day 2 is a closed-door session for more intimate talks among senior representatives of member states. The meeting wraps with a “looking ahead” panel.
Past attendees included Austria, Australia, Belgium, Denmark, Finland, Germany and Norway. The nations represent a wide variation in approaches and needs when it comes to CHMR, participants said.
The U.K., for example, doesn’t have a formal framework for civilian harm mitigation and response, and advocates have spent years pushing the British Ministry of Defense to adopt policies similar to those of the United States. Though humanitarian groups generally regarded the American CHMR enterprise as nascent and imperfect, the overall framework provided a worthy standard, said Mae Thompson of the Ceasefire Centre for Civilian Rights, a London-based advocacy group.
Advocates have framed the Pentagon’s rollback as an opportunity for the U.K. to step into a leadership role, Thompson said, and they’ve been encouraged by a recent internal report by the defense ministry that calls for formalization of a program in Britain, including systems to track civilian harm, investigate, and make amends and offer post-harm response.
NATO boasts a civilian protection policy that predates the American model, but the organization is now incorporating elements of the U.S. approach, said Andrew Hyde, who studies U.S.-European relations at the Stimson Center, a nonpartisan foreign policy think tank.
Hyde said international talks are important for sorting out how CHMR applies in joint operations when the United States, NATO and European nations all have different interpretations of harm mitigation. The diminished U.S. role, he said, means NATO and other partners must step up on coordination.
The shift in leadership could end up shielding civilian protection work from the whims of whichever U.S. administration is in power and leading to more enduring reforms, Hyde said.
“NATO has continued to push forward without U.S. support or participation, keeping up the momentum and ready for U.S. re-engagement,” Hyde said.
The Pentagon is shifting its cybersecurity posture to rely more on new capabilities to maintain its digital defenses rather than just bolstering its operational manpower, the department’s IT head said on Wednesday.
Speaking at the Billington Cybersecurity Summit in Washington, D.C., Department of Defense Chief Information Officer Kirsten Davies said, “We can't continue to throw people at the cyber problem; we have to throw technology at the cyber problem.”
Given DOD’s vast size, she said managing cybersecurity means the department has to look at using “everything from automation to machine learning to actually AI,” since the threat environment and range of new and outdated IT systems across its operations presents “a complex Rubik's cube of problems.”
Davies said DOD's thousands of networks include civilian and military components, so “this technology must be ready and available, and it must operate even when it's disconnected.”
Because one small IT problem can ripple across the Pentagon, Davies said it’s also important to “think about leveraging the fantastically skilled people that we have in a much more effective way.”
“As we embrace AI and leverage massive, massive quantities of agentic AI, how do we do that in a way that's supportive of our workforce and provides innovation across that?” she said.
Davies said the department is working to hire employees who know how to use new and emerging tech capabilities, with DOD prioritizing relevant job candidates’ abilities over their educational backgrounds. When it comes to using AI, she said, this means focusing more on applicants who are skilled at prompt engineering — developing instructions for the models to output accurate information.
“Why are we leveraging people for things that technology can do now? Like, let's really build skills and talent that know how to leverage technology very effectively,” Davies said. This mindset has already led to the department working to attract a new crop of cyber professionals.
DOD began accepting applications in July for a new Cyber Registered Apprenticeship Program to bring more cybersecurity talent into the agency, with a particular focus on prioritizing skills-based hiring. The department ultimately closed its first listing four days early after receiving more than 15,000 applications, although DOD has said it plans to open additional rounds of opportunities.
In a previous interview with Nextgov/FCW, Davies said her office was working to transition away from operating as a backend policy shop to taking more of an active role in DOD’s overall mission. She reiterated that mindset on Wednesday, saying that “reform is a big thing for us.”
Davies said this includes reforming the way DOD acquires new products, systems and weaponry. The first step in this process, she noted, was identifying policies and mandates that the department could whittle down or cut entirely — something that equated to more than 60% of relevant DOD guidance.
Now, the department is in the process of carrying out part two of the initiative, which entails looking at the actual process that companies have to go through when it comes to approving new capabilities.
Davies said this process could take anywhere from six to 18 months, but noted that the department just tested out a platform that took that standard timeline “and shortened it to 17 seconds.” She said, however, that the speed of the tested platform is just one component of what the Pentagon must evaluate when it comes to transforming its acquisition strategy.
“That doesn't address what some of the root things are that I still want to address, which is, ‘Are we asking the right questions? Are we demanding the right documentation from software companies?’ Is the output of a 17-second process actually reducing risk?’” she said.
One major step that Davies’ office has taken is its decision to suspend the second-phase requirements for third-party assessments under the Cybersecurity Maturity Model Certification program. The mandatory security framework for defense contractors was stopped in July for a 60-day review by a CMMC Reform Task Force. That assessment period is set to end on Friday.
Davies said the task force has received more than 1,100 responses to a request for information about CMMC’s next steps.
“We wanted to hear more from the defense industrial base on what was important for meaningful, dynamic cybersecurity," she added.
Davies’ remarks came the same day that Washington Technology reported that DOD is moving beyond a suspension of CMMC’s phase two requirements and is effectively implementing a binding regulation that would codify the pause.
Just three days after top military leaders left the Air and Space Force Association’s February conference in Colorado, the U.S. and Israel struck Iran, commencing Operation Epic Fury. Now, more than six months later, service officials are scheduled to gather again outside Washington D.C. to pitch their top budget priorities as the unresolved war wages on.
The Air and Space Force Association's Air, Space & Cyber conference next week comes as the services chug along on major acquisitions programs amid funding uncertainty on Capitol Hill. Those initiatives include fielding Collaborative Combat Aircraft, developing the Sentinel Intercontinental Ballistic Missile, accelerating production on the B-21 bomber and showing progress on the future F-47 fighter jet, and demonstrating key components of the Golden Dome missile defense system. In addition to announcing updates on those programs, military and defense industry leaders will discuss the ongoing conflict.
While top service leaders are sure to focus on the Iran war strategy, one defense analyst said there are still a lot of unanswered questions on modernizing the forces for future conflicts.
“I'm expecting we will hear quite a bit about the war in Iran and lessons learned from the war,” said Kelly Greico, a senior fellow at the Stimson Center. “But I think the really big question for me, that I'm more interested in, is, what are actually the modernization priorities of this leadership team? Last time we heard a lot about readiness, but less emphasis, I would say, frankly, on what the priorities were about where the Air Force is heading in terms of how it's preparing for the future fight.”
Joint Chiefs Chairman Gen. Dan Caine is scheduled to address this year’s conference, as partisan gridlock has imperiled top service programs programs and funding priorities—including F-35 procurement, crucial munitions, and the military-wide Golden Dome missile defense program. On Wednesday, NDIA Emerging Technologies Conference, Caine pushed for fully funding the administration's 13-figure proposal.
“What we need is $1.5 trillion, the configuration of that budget, that's a political decision for policy makers,” Caine said. “But we support that and need that capital to make sure that the deals that the department are negotiating with the wide range of not only NDIA members but broader industry members is essential for us to keep going.”
Caine’s pitch comes after lawmakers scaled back the administration’s $350 billion in requested reconciliation funds to just $60 billion to support Iran war operations. In April, Gen. Kenneth Wilsbach, the Air Force’s top uniformed leader, told lawmakers the service would need supplemental funding to replace aircraft lost during Operation Epic Fury.
After dozens of MQ-9 Reaper drones were destroyed in the fight with Iran, the service is likely to make some announcements about its plans to develop and buy a replacement under its Massed Modular Aircraft program, known as MMA. Service officials during a Pentagon roundtable last week teased that Air Force Secretary Troy Meink would have updates on the effort.
“I would expect at AFA that he'll probably have some comments on what he is envisioning for the MMA, where he wants to go in terms of numbers and timeline and stuff like that, but he absolutely has made it clear to us that his expectation is we need to bring it to the left,” Lt. Gen. Christopher J. Niemi, the Air Force’s chief modernization officer, told reporters.
Guetlein, the Golden Dome director, is also scheduled to speak at the conference..
Last month, the four-star Space Force general warned that the sprawling, military-wide missile defense project was in peril. About 97 percent of the program’s $17.5 billion request this year was based on reconciliation funding. He is scheduled to appear on a panel titled “Defending the Homeland: Making Golden Dome a Reality” alongside Sen. Deb Fischer, R-Neb., and Gen. Gregory M. Guillot, the head of U.S. Northern Command.
Amid the budget uncertainty, Greico said it’s a tall order for the Air and Space Force to accomplish all its goals.
“The Air and Space Forces, together, their budget is, to me, is not sustainable,” Greico said. “Fundamentally, it doesn't make sense how they can do everything that they want to do.”
A lot of this week’s security news has the same awkward answer to one question: “Why was that allowed to work?”
An extension asks for access and takes too much. A trusted service becomes part of a phishing chain. An old bug still gets results. An exposed system stays exposed. A package looks useful right up until it isn’t. Different stories, same basic problem: the path in was often already
Melbourne, Florida, September 10th, 2026, CyberNewswire With its Verification Architecture platform now commercially available and continuing to add new capabilities, OpenMatter Network today announced a strategic realignment of its leadership team designed to accelerate subscription growth, expand industry partnerships and position the company for long-term commercial success. Effective September 1, Mike Anderson has been named […]
Bad actors are misusing Google Play’s Early Access program to push deceptive apps that claim to offer money, rewards, casino winnings, and premium content.
Early Access apps are apps that haven’t been released on the official Android app marketplace. The main idea behind the program is for developers to solicit user feedback for new applications or features they may be working on before their
Nearly one in 10 internet-exposed LiteLLM AI gateways accepted the widely documented default master key, sk-1234, or required no authentication, creating a direct path to LLMjacking, sensitive credential exposure, and in vulnerable versions root-level code execution inside the gateway container. Their internet scan of 3,074 publicly reachable instances found that 294 systems, or 9.6%, accepted […]
TechCrunch reports that Bill Swearingen has spent the past year running largely the same test, over and over again. The goal was to produce a computer-generated pattern that could block the surveillance cameras lining America’s streets from detecting it.
Some 31 million tests later, Swearingen says he can now produce patterns on demand that, when applied to clothing and objects, prevent some of the most commonly deployed license plate readers and surveillance cameras from detecting whatever the pattern covers, from people to vehicles.
His project, which he calls noRecognition, allows people to escape the automatic detection and algorithmic surveillance used across the U.S. and beyond.
Swearingen, a cybersecurity executive and CISO, recently came on the Cybercrime Magazine Podcast and discussed his project, which was shared at the DEF CON 2026 conference in Las Vegas last month.
