Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Carolyn Hax: Sisters were close — then one accused the other’s husband of abuse

Miss Manners: I’m bothered by a fellow guest not touching their dessert

Ask Amy: My estranged wife is telling my son I’m an adulterer

Book excerpt: The admiral who had a mental breakdown over Fat Leonard

How TikTok changed fashion

How Pope Francis opened the Vatican to transgender sex workers

Under Putin, a militarized new Russia rises to challenge U.S. and the West 

In photos: The 150th running of the Kentucky Derby

Noem explains inclusion of story about shooting pet dog

Bingo, beaded bracelets and volunteer iPhones power Biden’s organizing effort

This obscure N.Y. election law is at the heart of Trump’s hush money trial

Top RNC lawyer resigns after rift grows with Trump

Twitch streamers become go-to news source for campus protest coverage

After years of delay, Boeing to try again with Starliner space capsule

Divided Trump campaign weighs joining TikTok, the app he tried to ban

Kim Godwin steps down suddenly as president of ABC News

The ‘Access Hollywood’ video cemented Trump’s air of invincibility

The New York Times, alone in its outrage over access to Biden

The new cure-all for vacation excess: the IV drip 

What’s the best bus to New York? We tested 5 for comfort and value.

You asked: Do I need a passport for my cruise?

Strangers help Sesame Street puppeteer after heirloom necklace was stolen

Teen grabs wheel when driver passes out and school bus veers into traffic

Cat climbed into Amazon return box, found alive 630 miles away

Missing surfers from U.S., Australia confirmed dead by Mexico

What lies beneath Gaza’s rubble and ruin

Middle East conflict live updates: Israel orders 100,000 civilians to leave Rafah, says it will operate with ‘extreme force’

There’s still time for Congress to Trump-proof the Insurrection Act 

The Post endorses April McClain Delaney and Tom Royals for Maryland’s 6th District

On Press Freedom Day, little to celebrate for Hong Kong’s journalists

Eddie Rosario and Co. lead the Nats to an MLB-best 12th comeback win

CJ Abrams keeps getting better. It’s time to think about an extension.

A frank look at hot dog prices at MLB ballparks

Trump hush money trial live updates: Trump Organization employees testify

Trump Hush Money Glossary

See more coverage in your recommendations

Get the weekly Campaign Moment newsletter

Set alerts for major election developments

Election 2024

The Campaign Moment newsletter

Politics alerts

Welcome to The Cybersecurity 202! Johnny Cash <a href="https://www.youtube.com/watch?v=kMyzoHBtaME">performed</a> at Folsom Prison 54 years ago today.

Below: The White House is bringing in industry leaders to talk about log4j and other open-source software vulnerabilities, and at least 35 people in El Salvador were targeted with NSO Group’s Pegasus spyware.

The government is imagining nutrition-like labels for internet-connected products

Elaine Thompson

An obscure division of the Commerce Department is working on cracking one of the toughest problems in cybersecurity: Making consumers care whether their Internet-connected devices are hackable or not.&nbsp;

It's a big challenge because most consumers only have a foggy understanding about which products are most secure against hacking. Even if they understood better, experts fear security would still rank far lower in buying decisions than factors like price and features.&nbsp;

The big plan from Commerce’s National Institute of Standards and Technology (NIST) is a certificate program that verifies Internet-connected devices meet a set of basic cyber standards such as accepting software patches and allowing users to control what information the devices collect and share about them.

NIST isn’t creating the labels itself but put together a lengthy set of <a href="https://www.nist.gov/system/files/documents/2021/12/03/FINAL_Consumer_IoT_Label_Discussion_Paper_20211202.pdf">recommendations</a> for what they should look like and is hoping an industry association or standards-setting body will take up the challenge.&nbsp;

The ultimate goal: A virtuous cycle in which consumers prize the certificates, so companies try to earn them, stores and e-commerce sites prefer to stock products with certifications, and insurers use the certificates to assess product companies' liability.&nbsp;

The effort, which sprang from President Biden’s big cybersecurity <a href="https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/">executive order</a> in May, marks one of the rare instances in which the government is trying to move beyond hiking cyber defenses in critical industries to actually changing how the broader nation thinks about cybersecurity.&nbsp;

NIST is also pushing a public education campaign that gets consumers to look for and value the certificates in the same way they value certifications that say a product is energy efficient or produced in the United States.&nbsp;

“Making security relatable to someone's daily life and how it can impact them is really critical for the success of this,” Julie Haney, an NIST computer scientist who’s working on the project, told me.

The effort comes as cyber and privacy risks to the average consumer are proliferating. Homes are increasingly stocked with Internet-connected devices such as smart speakers, thermostats and baby monitors — many of them built without security in mind. Hackers frequently compromise those devices to scoop up sensitive information or even <a href="https://www.npr.org/sections/thetwo-way/2018/06/05/617196788/s-c-mom-says-baby-monitor-was-hacked-experts-say-many-devices-are-vulnerable">harass</a> their users. The computing power from those devices has also been stolen by hackers and <a href="https://www.washingtonpost.com/news/the-switch/wp/2016/10/21/someone-attacked-a-major-part-of-the-internets-infrastructure/">harnessed</a> for large-scale cyberattacks.&nbsp;

“People are bringing these things into their homes, into these very personal spaces, and they don't understand the potential security and privacy consequences and risks of that,” Haney said. “The bar really needs to be raised or a lot of people are going to suffer.”

The project sprang from a longstanding idea to create cybersecurity labels for tech products similar to nutrition labels on food.&nbsp;

As NIST studied the idea, however, it became clear they needed something simpler. While most Americans can decode nutrition data like calories and sodium levels, their eyes would go bleary when confronted with their cyber equivalents.&nbsp;

They settled on a certificate, which products either earn or they don’t. But the certificates will be accompanied by a QR code that can lead consumers to far more detailed information if they want it.&nbsp;

To the extent possible, the certificates should be managed by one organization and they should look the same for all products

Mangers should regularly assess how effective the certificates are in guiding consumers’ buying decisions and change them accordingly

Certificates should be easy to find for both in-store and online products and easy to find and consult even after a purchase is made

NIST will release its final set of recommendations on the program next month then conduct a survey by May of existing efforts with similar goals that might take on the certificate effort.&nbsp;

While the program itself could get off the ground soon after that, officials cautioned that changing how Americans think about cybersecurity when they buy tech products will likely take much longer.&nbsp;

“Other consumer labeling programs that were successful, it's not a nine month or one year kind of a timeline,” Warren Merkel, NIST’s chief of standards services, told me. “It's a much longer time to get the consumer education right and to get the awareness right. So, hopefully, we'll be successful in providing a jumping in point for somebody to get on that multiyear path.”

The White House is hosting industry leaders today to discuss cyber vulnerabilities in open-source software

Chip Somodevilla

Representatives from Amazon, Apple, Facebook and Google are among the companies and organizations that will be attending the meeting, a senior official said. It comes in the wake of a <a href="https://www.washingtonpost.com/technology/2021/12/20/log4j-hack-vulnerability-java/">vulnerability</a> in the log4j software library that the U.S. government said was among the most serious in history and could take years to remediate. Nearly a dozen federal agencies and departments will send representatives to the summit, the official said.

The log4j bug has prompted a rush to shore up open-source software, which is vital to large portions of the Internet but typically maintained by volunteers. Other participants at the meeting include: &nbsp;IBM, Oracle and the Apache Software Foundation. It will be hosted by Deputy National Security Adviser Anne Neuberger.

At least 35 people in El Salvador were targeted with NSO Group’s Pegasus spyware

Sebastian Scheiner

The victims included at least 22 journalists from the independent El Faro news site, Mary Beth Sheridan and Craig Timberg <a href="https://www.washingtonpost.com/world/2022/01/12/salvador-pegasus-faro-nso/">report</a>. Some of the journalists’ devices were infected a dozen or more times, which Citizen Lab senior researcher John Scott-Railton called “jaw-droppingly aggressive and persistent.”&nbsp;

The news is already prompting a big response: In an open letter, researchers and nongovernmental organizations have demanded that El Salvador’s attorney general, Rodolfo Delgado, open an investigation into the use of Pegasus in the country. The signatories of the letter — which include Access Now, Amnesty International, and the Committee to Protect Journalists — called for the United Nations to condemn human rights violations of NSO clients and “offer robust support for impartial and transparent inquiries into the abuse.”

A person familiar with the company's operations who spoke on the condition of anonymity to discuss sensitive matters said El Salvador doesn't have an “active system” from the NSO Group, and the company will investigate the allegations. NSO said it considers targeting journalists to be a misuse of Pegasus and it has zero tolerance for such misuse.&nbsp;

Polish lawmakers approved a committee to investigate Pegasus hacks in the country. Three Polish opposition figures say they were targeted by the spyware, leading a top opposition lawmaker to <a href="https://apnews.com/article/technology-canada-europe-spyware-democracy-33585c709d79bfa22297e3b4aacf4372">call</a> the situation in the country a crisis of democracy. The committee was narrowly approved by Poland’s senate, where the opposition party has a small majority. However, the committee can’t require witnesses to testify and lawmakers from the ruling Law and Justice party are refusing to join the committee, the Associated Press’s Vanessa Gera <a href="https://apnews.com/article/technology-middle-east-israel-poland-europe-50ed323d62ecb49e0f5fdf2c54103095">reports</a>.&nbsp;

Pressure is building for the European Union to investigate Pegasus. Renew Europe, the European Parliament’s third largest bloc, called for a committee to investigate spyware accusations, Gera reports. Sophie in ’t Veld, a Dutch member of the European Parliament, called for the European Commission to follow the U.S. government’s lead and “quickly blacklist” NSO.&nbsp;

Check out the Post's full Pegasus Project investigation <a href="https://www.washingtonpost.com/investigations/2021/07/18/takeaways-nso-pegasus-project/">here</a>.&nbsp;

Election administration races are seeing a fundraising surge after Trump’s phony claims

Paul Sancya

This year’s races for top state election officials could see record fundraising as the baseless claim that the 2020 election was stolen becomes a centerpiece of the races, the Brennan Center for Justice’s Ian Vandewalker and Lawrence Norden <a href="https://www.brennancenter.org/our-work/research-reports/financing-races-offices-oversee-elections-january-2022">write</a>.

In the Georgia secretary of state contest, four candidates have raised more than the 2018 winner had at this point. The top fundraiser is Rep. Jody Hice (R-Ga.) who has falsely claimed the 2020 election was rigged.

Michigan Secretary of State Jocelyn Benson (D) has raised $1.2 million, six times what the previous incumbent in the position raised. A Republican challenger, Kristina Karamo, who has promoted the idea that voting machines could have flipped votes to Biden, has raised more than $160,000.

“Increasingly, election denial is a highly visible issue in races for election administration positions,” Vandewalker and Norden write. “Indeed, as far as we are aware, this is the first time in the modern era that questions about the legitimacy of elections have played such a prominent role in contests for election officials.”&nbsp;

An encrypted phone company secretly run by the FBI shipped more phones to the United States than previously known

More than 100 Anom phones were shipped to the United States in 2020, raising questions about whether more of the phones were used in U.S. law enforcement investigations than previously known, Motherboard’s Joseph Cox <a href="https://www.vice.com/en/article/epxp8w/fbi-anom-shipped-100-phones-united-states">reports</a>. It had previously seemed that just about 15 of the phones were used in the United States.&nbsp;

The operation, which lasted three years, <a href="https://www.washingtonpost.com/world/2021/06/08/fbi-app-arrests-australia-crime/">ensnared</a> hundreds of alleged criminals who thought they were using phones custom-made for criminal activity but that were actually controlled by the FBI. Australian law enforcement monitored U.S. phones during the operation because of legal reasons, Cox reports.

The Senate passed cybersecurity legislation to bolster state and local governments

Lawmakers unanimously approved the legislation, which now goes to the House. It will give state and local governments access to upgraded cyber tools, the Record’s Martin Matishak <a href="https://therecord.media/senate-okays-bill-to-promote-cyber-coordination-between-dhs-local-governments/">writes</a>.

<a href="https://about.bgov.com/news/intelligence-nominee-urged-to-stabilize-troubled-homeland-unit/" target="_blank">Intelligence nominee urged to stabilize troubled Homeland unit (Bloomberg Law)</a>

<a href="https://www.cyberscoop.com/fcc-wants-to-revamp-data-breach-laws-for-telecom-carriers/" target="_blank">FCC wants to revamp data breach laws for telecom carriers (CyberScoop)</a>

<a href="https://www.washingtonpost.com/politics/trump-npr-interview/2022/01/12/a2d0a26e-7397-11ec-bc13-18891499c514_story.html" target="_blank">Trump abruptly ends NPR interview after he is pressed on baseless election fraud claims (John Wagner)</a>

<a href="https://www.washingtonpost.com/politics/2022/01/12/are-you-one-1-11-americans-mike-lindell-doesnt-want-arrest/" target="_blank">Are you one of the 1 in 11 Americans Mike Lindell doesn’t want to arrest? (Philip Bump)</a>

<a href="https://therecord.media/cyber-command-ties-hacking-group-to-iranian-intelligence/" target="_blank">Cyber Command ties hacking group to Iranian intelligence (The Record)</a>

<a href="https://www.reuters.com/world/asia-pacific/philippines-election-body-probes-hacking-report-says-no-breach-2022-01-12/" target="_blank">Philippines election body probes hacking report, says no breach (Reuters)</a>

<a href="https://www.washingtonpost.com/dc-md-va/2022/01/12/maryland-cyberattack-ransomware/" target="_blank">Cyberattack on Maryland’s health department was ransomware, officials say (Steve Thompson)</a>

<a href="https://www.bloomberg.com/news/articles/2022-01-12/largest-seller-of-stolen-credit-cards-on-dark-web-shuts-down?srnd=technology-vp" target="_blank">Largest seller of stolen credit cards on dark web shuts down (Bloomberg)</a>

<a href="https://therecord.media/chrome-will-limit-access-to-private-networks-citing-security-reasons/" target="_blank">Chrome will limit access to private networks, citing security reasons (The Record)</a>

Rep. Yvette D. Clarke (D-N.Y.), Rep. John Katko (R-N.Y.), the Department of Homeland Security’s Undersecretary for Policy Robert Silvers, and FBI Assistant Director Bryan Vorndran discuss 2022’s cybersecurity priorities at a Silverado Policy Accelerator <a href="https://silverado.org/events/2022-cybersecurity-priorities-perspectives">event </a>today at 9 a.m.

Silverado Policy Accelerator chairman and co-founder Dmitri Alperovitch, U.S. Secret Service Assistant Director Jeremy Sheridan and FBI Deputy Assistant Director Tonya Ugoretz <a href="https://www.washingtonpost.com/washington-post-live/2022/01/13/securing-cyberspace-with-dmitri-alperovitch-jeremy-sheridan-tonya-ugoretz/?itid=lk_inline_manual_86&amp;itid=lk_inline_manual_98&itid=lk_inline_manual_91">discuss</a> cybersecurity threats at a Washington Post Live event today at 11 a.m.

“I ain’t seen the sunshine since I don’t know when.” Thanks for reading. See you tomorrow.

Georgetown University, MS in Foreign Service

University of Wisconsin - Madison, BA in English

Joe Marks writes The Cybersecurity 202 newsletter focused on the policy and politics of cybersecurity. He previously covered cybersecurity for Politico and for Nextgov. 

Joseph Marks

Society of American Business Editors and Writers, Best in Business award, Newsletter, 2019

American University, MA in journalism and public affairs

University of Rochester, BA in international relations

Aaron Schaffer is assistant editor of The Post's 202 newsletter franchise, where he helps edit The Early 202.