Implementing PaC involves secure coding, robust access strategies, automated testing, continuous monitoring, and regulatory compliance.

Additional guidance at https://udx.io/guidance

View Guidance

Leveraging Security in a Platform-as-Code Universe

Starting next year, the Army will be able to domestically mass-produce upwards of 10,000 small unmanned aerial systems each month, according to the service. Army Materiel Command is leading a new pilot program dubbed “SkyFoundry” that will allow the service to rapidly develop, test and produce small drones using innovative manufacturing methods. Officials are currently identifying multiple facilities where the platforms will be designed and produced. The department expects it can manufacture at least 10,000 UAS per month once the first site is up and running, Army Vice Chief of Staff Gen. James Mingus said Tuesday. He said during a fireside chat at the annual AUSA conference: “We’ll be at 10,000 a month by this time next year, if not more.” The effort comes as the Pentagon looks to ramp up production of small drones across the services following Secretary of Defense Pete Hegseth’s “Unleashing U.S. Military Drone Dominance” directive, issued in July. The memo requires low-cost, attritable drones to be fielded to every Army squad by the end of 2026 and calls on the military to partner closely with domestic industry to scale up manufacturing.

Rep. Eric Swalwell, D-Calif., sent a letter Tuesday to acting CISA Director Madhu Gottumukkala raising concerns about staffing levels and the direction of the nation’s primary cybersecurity agency, writing that the “Trump Administration has undertaken multiple efforts to decimate CISA’s workforce, undermining our nation’s cybersecurity.” Swalwell, the ranking member on the House Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection, called out the agency for its reported shift of cybersecurity personnel to the Department of Homeland Security’s deportation efforts, on top of the approximately 760 people that have been let go from the agency since January. Swallwell wrote: “Amid reports that the Department of Homeland Security is now forcibly transferring CISA’s cybersecurity employees to other DHS components, it has become apparent that the Department’s exclusive focus on its mass deportation campaign is coming at the expense of our national security,” calling it “further evidence of the Administration’s failure to prioritize cybersecurity” how CISA is engaging in Reductions in Force that could threaten its capacity to prevent and respond to cybersecurity threats. In the letter, he demanded that DHS cease all efforts to cut CISA’s workforce, reinstate employees who were transferred or dismissed, and provide details on the impacts of the agency’s workforce reductions.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

The Army wants to manufacture 10,000 drones per month by 2026

A new report from the password management company NordPass is challenging the idea that federal institutions are more secure than local governments against cybersecurity threats. The study, conducted by NordPass and threat exposure management platform NordStellar, found a total of 53,070 passwords belonging to U.S. civil servants were exposed in public sources since the beginning of 2024. Of the impacted institutions, NordPass found the Department of Defense had 1,897 total exposed passwords, 222 of which were unique. The State Department had 15,272 total exposed passwords, 190 of which were unique, while the U.S. Army had 1,706 exposed passwords, 167 of them unique. The Department of Veterans Affairs also ranked among the top five most-affected institutions, with 1,331 total password exposures, 53 of which were unique. Seven passwords of White House employees were also compromised, according to the study. A State Department spokesperson told FedScoop the agency is “committed to cybersecurity across the department.” They said the agency has instituted multi-factor authentication and regularly rotates credentials.

A Biden-era director of the White House Office of Science and Technology Policy slammed the Trump administration’s cuts to research and development funding Wednesday, warning of adverse effects to areas such as artificial intelligence. Arati Prabhakar said during a panel held by Harvard’s Kennedy School: “Today what we are in the middle of is an assault on the public investment in research unlike anything we have seen in our country’s history.” Prabhakar specifically pointed to the Trump administration’s moves to withdraw support from certain projects, its removal of federal workers at research agencies, its attacks on universities, reversal of immigration policies that bring talent to the U.S., and the administration’s budget proposal that sought to cut federal R&D spending by roughly $44 billion.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

Thousands of federal passwords exposed since early 2024

Federal cyber authorities issued an emergency directive last week requiring federal agencies to identify and apply security updates to F5 devices after the cybersecurity vendor said a nation-state attacker had long-term, persistent access to its systems. The order, which mandates federal civilian executive branch agencies take action by Wednesday, Oct. 22, marked the second emergency directive issued by the Cybersecurity and Infrastructure Security Agency in three weeks. CISA issued both of the emergency directives months after impacted vendors were first made aware of attacks on their internal systems or products. F5 said it first learned of unauthorized access to its systems Aug. 9, resulting in data theft including segments of BIG-IP source code and details on vulnerabilities the company was addressing internally at the time. CISA declined to say when F5 first alerted the agency to the intrusion. CISA officials said they’re not currently aware of any federal agencies that have been compromised, but similar to the emergency directive issued following an attack spree involving zero-day vulnerabilities affecting Cisco firewalls, they expect the response and mitigation efforts to provide a better understanding of the scope of any potential compromise in federal networks. Many federal agencies and private organizations could be impacted. CISA said there are thousands of F5 product types in use across executive branch agencies.

Sens. Maria Cantwell, D-Wash., and Ted Cruz, R-Texas, moved to mandate comprehensive new safety reviews for all aircraft operations near DCA and at all major and mid-size U.S. airports, in a new bipartisan agreement that would also require fleets across the nation to be equipped with more precise situational awareness technology. Their proposal aims to resolve safety issues identified by the federal investigation into the tragic crash in January, where an Army UH-60M Black Hawk helicopter fatally collided with an American Airlines passenger plane over the Potomac River near Ronald Reagan Washington National Airport. All 67 people aboard both aircraft were killed in the collision. In a statement on Thursday, Tim and Sheri Lilley — whose son was the first officer onboard that AA Flight 5342 — called on Congress “to continue moving quickly and decisively to pass and fully implement these reforms, because every person who boards an aircraft depends on it.” The 42-page Cantwell-Cruz Bipartisan Aviation Safety Agreement combines elements of legislation the lawmakers previously put forward separately in the months after the fatal collision. It includes language that directs every military service with an aviation component to sign a memorandum of understanding with the Federal Aviation Administration to share appropriate safety information and expand coordination to prevent future accidents. Another safety failure that came to light in the wake of the crash was associated with the Army Black Hawk helicopter not transmitting via Automatic Dependent Surveillance–Broadcast (ADS-B) technology, which essentially enables aircraft to receive data and information about other systems, weather and traffic — delivered directly in the cockpit. The senators’ proposal would set a clear 2031 deadline for aircraft operators to equip their fleets with the full package of ADS-B capabilities.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

F5 products pose imminent risk to federal agencies

The Centers for Medicare & Medicaid Services appears to be quietly considering Palantir to support its yearslong efforts to build a national provider directory for health care providers and patients across the country. Federal spending records show Palantir to be one of four recipients to receive awards from the Department of Health and Human Services and CMS containing the phrase “national provider directory” and “proof of concept.” The four separate contracts, made public Sept. 30, award $1 to each company and are set to expire Nov. 13. Two sources familiar with the efforts told FedScoop these contracts are for a prototype product with CMS. One source confirmed the prototype is for the agency’s national provider directory, an effort the agency has been exploring for years. CMS has suggested the directory could serve as a centralized data hub for health care provider and facility information nationwide. The move marks the latest sign of civilian agencies’ growing interest in Palantir, which offers extensive data integration and analytics capabilities.

The Department of Energy is requesting proposals for the buildout and maintenance of AI data centers and energy generation infrastructure in and around Oak Ridge National Laboratory. In an RFP published last week, the national lab’s site and environmental management offices said they are seeking proposals from entities interested in entering into long-term leases in Oak Ridge, Tenn. The work on those DOE sites would include “designing, financing, permitting, developing, constructing, installing, owning, maintaining, operating, and decommissioning AI data center and/or energy generation infrastructure,” per the posting. For those sites, Oak Ridge is specifically seeking construction of data center facilities with specialized computing equipment, cooling facilities, infrastructure for energy supply, transmission and storage, and other related equipment and facilities. The DOE said entities responding to the RFP could be private-sector companies with experience in the development and operation of AI data centers, advanced computing facilities or energy storage.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

CMS connects with Palantir for national provider directory project

The Trump administration should reverse cyber personnel and budget cuts, strengthen the Office of the National Cyber Director and expand federal workforce initiatives, the successor organization to the Cyberspace Solarium Commission recommended in a report published Wednesday. The annual implementation report from CSC 2.0 is the first of five iterations to actually determine that the nation has gone backward on enacting the agenda of the landmark bipartisan commission, whose suggestions led to the creation of major new federal organizations and policies, including the national cyber director’s office. In grading the degree to which its 2020 report had been enacted — whether they’re “implemented,” “nearing implementation,” “on track,” “progress limited” or facing “significant barriers” — the percentages dropped in every category, after years of rising or staying steady.

President Donald Trump nominated Lt. Gen. Christopher LaNeve on Monday to serve as the next vice chief of staff of the Army and recommended his appointment to the grade of general. An official hearing date has not been made public, but if confirmed by the Senate, LaNeve will replace Gen. James Mingus, the long-time innovator who was sworn in as the Army’s No. 2 general officer and principal deputy to Chief of Staff Gen. Randy George in January 2024 under the Biden administration. The announcement follows an unusual gathering of hundreds of top U.S. military officials at Marine Corps Base Quantico last month, where Defense Secretary Pete Hegseth stated that he had already removed several high-ranking service members and suggested that more people would be pushed out if they did not conform to his vision for a “less woke” military that’s “fit not fat.” There’s not a fixed term or limit to the position of vice chief of staff, and former officials’ tenures in the capacity vary. A Pentagon spokesperson did not immediately answer questions from DefenseScoop about the timing for or reasoning behind this nomination, but confirmed LaNeve was selected by the president to serve in the post.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

The US is ‘slipping’ on cybersecurity

An open letter released Wednesday has called for a ban on the development of artificial intelligence systems considered to be “superintelligent” until there is broad scientific consensus that such technologies can be created both safely and in a manner the public supports. The statement, issued by the nonprofit Future of Life Institute, has been signed by more than 700 individuals, including Nobel laureates, technology industry veterans, policymakers, artists, and public figures such as Prince Harry and Meghan Markle, the Duke and Duchess of Sussex. The letter reflects deep and accelerating concerns over projects undertaken by technology giants like Google, OpenAI, and Meta Platforms that are seeking to build artificial intelligence capable of outperforming humans on virtually every cognitive task. According to the letter, such ambitions have raised fears about unemployment due to automation, loss of human control and dignity, national security risks, and the possibility of far-reaching social or existential harms. “We call for a prohibition on the development of superintelligence, not lifted before there is broad scientific consensus that it will be done safely and controllably, and strong public buy-in,” the statement reads.  Signatories include AI pioneers Yoshua Bengio and Geoffrey Hinton, both recipients of the Turing Award, Apple co-founder Steve Wozniak, businessman Richard Branson, and actor Joseph Gordon-Levitt.

Pentagon personnel could soon be told to participate in new training programs designed to prepare them for anticipated advancements in biotechnology and its convergence with other critical and emerging technologies, like quantum computing and AI. House lawmakers recently passed an amendment en bloc in their version of the fiscal 2026 National Defense Authorization Act that would mandate the secretary of defense to set up such trainings, no later than one year after the legislation’s enactment. Biotechnology refers to a multidisciplinary field that involves the application of biological systems or the use of living organisms, like yeast and bacteria, to produce products or solve complex problems. These technologies are expected to revolutionize defense, energy, manufacturing and other sectors globally in the not-so-distant future — particularly as they are increasingly paired with and powered by AI. And while the U.S. historically has demonstrated many underlying strengths in the field, recent research suggests the government may be falling behind China, where biotechnology research efforts and investments have surged since the early 2000s. 

The Daily Scoop Podcast is available every Monday-Friday afternoon.
If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

An open letter against superintelligent AI

Edward Forst told lawmakers Thursday that he wasn’t privy to the decision-making behind the General Services Administration’s deal with xAI’s Grok — but if confirmed to lead the agency, he signaled openness to examining the process that led to the procurement of the generative AI chatbot known for having an antisemitic meltdown. During a Senate Homeland Security & Governmental Affairs Committee hearing, ranking member Gary Peters, D-Mich., asked the GSA administrator nominee if he shared his concerns about Grok, pointing to the day the tool “produced racist and antisemitic content widely across [Elon] Musk’s social media platform.” Forst, a former private equity and financial services executive, told Peters that he had “not been a part of the decision” by the GSA to contract for the chatbot from the Musk-owned AI firm. With some additional pressing by Peters, Forst acknowledged that procuring a tool with a history of racist and antisemitic posting is “not, I think, the signal we would necessarily want to send to the country.” Peters attempted to get Forst to commit to pausing use of Grok until the committee received “documentation about the details of the procurement, including whether the GSA actually performed a comprehensive risk assessment.” Forst wouldn’t go that far on Grok, which once referred to itself as “MechaHitler.” But he did says his commitment to the lawmakers is that he will “meet with the team, and I’ll understand the process used in selecting them, and I’ll make sure that we have all the facts and if there was incompleteness to the process, that we’ll rectify it.”

A pair of federal judges said staff use of generative artificial intelligence tools and premature docket entry were behind error-ridden orders they issued, according to letters made public by Senate Judiciary Chairman Chuck Grassley on Thursday. Judges Henry T. Wingate and Julien Xavier Neals, who sit on the U.S. District Courts for the Southern District of Mississippi and District of New Jersey, respectively, both stated in letters that their law clerks had used AI tools to draft orders that were then entered into the dockets before they had been reviewed. Both judges also described measures to prevent repeat issues. The letters come after the orders from both judges were ridden with errors — including misquotes and references to parties not in the current cases — and later withdrawn. Speculation swirled as to whether those judges used AI, which is known to hallucinate, in their orders. Earlier this month, Grassley, R-Iowa, sent letters to both jurists asking for an explanation. The communications published Thursday are responsive to those inquiries. In his response, Neals indicated that previous reporting by Reuters that a “temporary assistant” had used ChatGPT was correct. “In doing so, the intern acted without authorization, without disclosure, and contrary to not only chambers policy but also the relevant law school policy.” Neals said he prohibits generative AI use in legal research and drafting of opinions and orders. While that policy was verbal in the past, he said it is now a “written unequivocal policy that applies to all law clerks and interns, pending definitive guidance from the AO through adoption of formal, universal policies and procedures for appropriate AI usage.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

GSA nominee open to reviewing Grok AI selection process

The Army’s top acquisition official told DefenseScoop that he expects to see further growth in resources for the service’s FUZE initiative. FUZE, which was announced last month by Army Secretary Dan Driscoll, combines elements of multiple technology innovation programs — including the xTech, Small Business Innovation Research and Small Business Technology Transfer (SBIR/STTR), ManTech, and Technology Maturation Initiative efforts — under a more integrated framework to accelerate the delivery of new capabilities to soldiers, according to the service. Driscoll has described it as the Army’s “new cradle-to-grave capital funding model.” Driscoll said at the recent AUSA event that the Army’s goal with FUZE is to contract with startups that have never, ever worked with the United States Army before in just 60 to 70 days. And for companies that the Army has worked with that have prototypes, the intent is to contract in 10 and start “soldier iterations in 30 to 45 days,” he said, adding, “We train like we fight. Acquisition should be no different.” The Army has already aligned $750 million to this model under FUZE, according to Driscoll. Next year, it plans to raise that slightly to $765 million. Brent Ingraham, the new assistant secretary of the Army for acquisition, logistics and technology, said he anticipates that funding levels for those efforts will be higher in subsequent years.

The federal judiciary has distributed interim guidance on artificial intelligence that allows for use of the technology, while also addressing procurement and security of the tools, according to a letter to Senate Judiciary Committee leadership that was made public Thursday. In correspondence to Sen. Chuck Grassley, R-Iowa, Administrative Office of the U.S. Courts Director Judge Robert J. Conrad said an AI task force formed earlier this year developed the guidance and it was distributed to federal courts across the country July 31. Although the policy is a temporary measure while the courts work on more permanent guidance, courts can explore the budding technology in the meantime. Disclosure of the guidance came as part of a response to Grassley’s inquiry about the use of AI in error-ridden orders from two federal judges. In addition to letters from the two judges admitting to clerks’ use of generative AI tools and assurances that they’d implemented measures to prevent future issues, Conrad provided detail on the broader efforts to address the technology within the third branch and the balance between use and risk management. A spokesperson for the judiciary declined to share a copy of the guidance with FedScoop. Conrad, however, provided a description of its scope to Grassley.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

Army wants to boost funding for its FUZE program

Nearly two months after calling on the Office of Management and Budget to bar use of xAI’s Grok chatbot in government, a coalition of advocacy groups is pressing its case further after the General Services Administration struck a deal with Elon Musk’s AI company to deploy Grok across the federal government. In a letter sent Wednesday to OMB Director Russell Vought, the advocacy groups reiterated their concerns in the wake of the GSA OneGov deal, along with recent comments from Michael Kratsios, the director of the White House Office of Science and Technology Policy. “OMB is entrusted with ensuring that AI systems procured by the federal government meet the highest standards of truth-seeking, accuracy and neutrality,” the letter, led by Public Citizen, stated. “Grok has repeatedly demonstrated failures in these areas and Director Kratsios himself has confirmed that such behavior is the precise type that Executive Order 14319 was designed to prevent.” The letter refers to an executive order signed by President Donald Trump in July that seeks to prevent “woke AI,” or ideological biases in models that are used by the federal government. The groups argued in their August letter to Vought that the use of Grok contradicts this order, given its past controversies with spewing antisemitic and pro-Hitler content. Weeks after the letter was sent, GSA inked a deal with xAI to offer Grok models to the government for a nominal cost. Under the deal, federal agencies can buy Grok 4 and Grok 4 Fast for 42 cents until March 2027.

The White House appears to be moving forward with plans to redesign federal government websites, registering a new government domain — techforce.gov — this week. The new URL, which was first discovered Thursday by a bot tracking new government domains, leads to a sign-in page that states “National Design Studio” and “Tech Force” at the top. It includes a form for users to submit their email and receive a code to access the website. Records maintained by the Cybersecurity and Infrastructure Security Agency show the domain was registered Oct. 24 and last changed Wednesday. The domain registration comes more than two months after President Donald Trump signed an executive order launching an “America by Design” initiative focused on both digital and physical spaces. A new National Design Studio and chief design officer will lead the initiative and coordinate agency actions.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

The fight over Grok in government rages on

The Department of Homeland Security’s non-federal government partners in communities across the U.S. can now apply for funding grants for certain counter-drone capabilities to address national security and safety threats posed by the illegal and nefarious use of unmanned aircraft systems. Officials wrote in a notice published online last week: “The funding enables state, local, tribal, and territorial governments, along with first responders and public safety entities, to acquire detection and tracking technologies designed to safeguard public spaces and critical infrastructure.” DHS estimates that $250 million will be obligated for the program in fiscal 2026 alone, and more money is expected to flow. Decisions about individual awards will happen between 30 and 60 days of the application submissions. The department expects to make 12 awards, with the financial assistance amounts to-be-decided and ranging across the winners. All projects will have a performance period of 36 months. Notably, the awardees will not be permitted to use the federal funding to purchase “Enhanced Detect, Track, Identification (DTI) systems,” including those that “capture, record, intercept, demodulate, decrypt, or decode signals” between UAS and ground control stations. Due to significant legal restrictions, privacy concerns and federal airspace regulations, SLTT entities don’t currently have official authorization to employ those types of technologies. Drone threats associated with surveillance, disruption, or attacks, have intensified across the nation in recent years. The U.S. military is significantly expanding work and investments to deploy defensive weapons, modernize electronic warfare capabilities, enhance sensor protection and other tools to protect its facilities in the United States and abroad. And with America hosting major, upcoming global events, agencies and officials have been calling for coordinated efforts to more aggressively confront the risks.

Anduril’s prototype drone developed for the Air Force’s Collaborative Combat Aircraft (CCA) program has taken its first live flight, the service announced Friday. The company conducted the flight of the unmanned fighter jet — known as the YFQ-44A — on Friday at a test location in California, the Air Force said in a press release. Beginning live flight tests of the CCA prototype “expands the program’s knowledge base on flight performance, autonomous behaviors and mission systems integration,” the service noted. The announcement that Anduril has moved into the flight test stage comes after General Atomics conducted the first flight of its CCA offering in August. Both companies are vying for Increment 1 of the CCA program, which is part of the Air Force’s Next Generation Air Dominance (NGAD) family of systems. General Atomics and Anduril received contracts for the first CCA increment in 2024, while the Air Force is also working with Shield AI and RTX to provide the drone’s mission autonomy. With both airframe vendors now in the next stage of the program, the Air Force is one step closer to making a final production decision for Increment 1 — expected in 2026.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

Ahead of the World Cup and Olympics, DHS offers grants for counter-drone tech

Insights and discussions from Usability Dynamics on cybersecurity, cloud automation, and the future of the web.

Leveraging Security in a Platform-as-Code Universe

UDX

Related tracks