The two expected incoming leaders of the Senate and House homeland security panels expressed reservations Tuesday about the Trump administration’s pick to lead the Cybersecurity and Infrastructure Security Agency because he currently works for the oft-controversial tech company Palantir.

The Trump administration on Monday announced its intent to nominate Michael LoSapio, chief information security officer for Palantir, to fill the long-vacant Senate-confirmed position of CISA director.

The Senate Homeland Security and Governmental Affairs Committee has authority over approving CISA director nominees. A spokesperson for its current chairman, Rand Paul, R-Ky., didn’t respond to a request for comment, but he won’t hold the gavel much longer with Sen. Maggie Hassan, D-N.H., in line to take over as chair in 2027.

Hassan and her counterpart on the House side, prospective Homeland Security Committee Chairman Bennie Thompson, D-Miss., both voiced concerns about Palantir’s work at the Department of Homeland Security and with its subagency, Immigration and Customs Enforcement.

“CISA plays a critical role in protecting our nation’s cybersecurity infrastructure, and the Trump-Vance administration has undermined CISA by cutting its funding, reducing agency staff, and making us vulnerable to cyberattacks from our adversaries,” Hassan said in a statement to CyberScoop. “I will carefully review Mr. LoSapio’s nomination to lead CISA, as I do with any nominee. But given his senior role at Palantir, which has provided tools that helped enable ICE’s lawless behavior under this administration, I have serious questions about whether he has the independence and judgement needed for this position.” 

Thompson expressed apprehensions for similar reasons.

“CISA is at a critical juncture, rebuilding after a year of reckless efforts to hack up the agency. I don’t know much about Mr. LoSapio, but certainly his relationship with Palantir raises very serious concerns given its role in DHS surveillance programs,” he said in a statement to CyberScoop. “I’m concerned that baggage will be an unnecessary distraction from the urgent rebuilding efforts at CISA. I urge my Senate colleagues to thoroughly vet Mr. LoSapio before proceeding with his nomination.”

The current top Democrat on the Senate panel, the retiring Gary Peters of Michigan, also cited the threats CISA is facing amid cutbacks: “Mr. LoSapio must demonstrate that he possesses the independent judgment and qualifications to decisively place national security and the national interest above political pressure.”

The current chairman of the House panel, Andrew Garbarino, R-N.Y., said he appreciated Trump putting forward a nominee given the need for a Senate-confirmed director, something CISA has lacked for his second term, even as he praised the leadership of acting director Nick Andersen.

“I look forward to reviewing the qualifications of Michael LoSapio and urge the Senate to do so with urgency,” he said in a statement.

Unlike another of the top cybersecurity officials in the Trump administration prior to his nomination, National Cyber Director Sean Cairncross, LoSapio comes with technical credentials.

A former Trump administration official said that LoSapio’s name was first floated months ago, and said his cybersecurity certifications and experience managing cyber risk for a major public company would make him a good fit for the role.

A cybersecurity executive who knows and has worked with LoSapio said he was an “exceptional choice” for the job.

“Mike LoSapio is an extremely competent and talented cybersecurity leader. He knows his stuff,” the executive said. “He defends one of the most targeted organizations on the planet” because of Palantir’s sensitive government work.

CISA is primarily a technical agency, so “that work is best done by someone who knows how to do it,” the executive said. LoSapio is also a “high-integrity” person who isn’t “dogmatic or political” or “the kind of person that would be cowed by political pressure.”

But his role at Palantir is drawing criticism, something the executive said he understood given concerns about surveillance in the United States, even as the executive noted LoSapio has proven capable of navigating those “thorny issues.”

Patrick Eddington, a senior fellow at the libertarian Cato Institute think tank, acknowledged LoSapio’s technical background but said his lack of a government background and no public record of weighing in on the subject matter CISA works on adds up to a “thin resume.” More worrisome, he said, is that CISA is a Palantir customer.

“The nominee would come from the vendor whose software is already being bought, without competition, by the office he’d run,” Eddington said. “And the agency responsible for judging the security of federal civilian systems would be led by the former security chief of a vendor whose platforms now run across DHS. That’s where ethics rules would normally help, yet this administration has weakened them.”

Before confirming LoSapio, senators should find out what kind of Palantir stock or other holdings LoSapio has and whether he’ll divest it, whether he’ll recuse himself from Palantir matters for longer than the Trump administration would require, whether he has made bargains to return to Palantir after CISA service and other answers about potential conflicts of interest.

“Bottom line: Palantir’s business is fusing government data at scale, and DHS has made it the default analytics vendor across the department,” Eddington said. “Putting the company’s security chief in charge of the agency that sets the security bar for those systems, with a one-year recusal as the main safeguard, risks making CISA one vendor’s customer, regulator and alumni network all at once. Even if LoSapio is entirely well-intentioned, that’s the wrong setup.”

A Palantir spokesperson didn’t respond to requests for comment.

Even in optimal circumstances for a nominee, it can take some time to work through the Senate confirmation process and then begin shaping an agency as its leader, said Joshua Corman, a former CISA adviser and now executive in residence for public safety and resilience at the Institute for Security and Technology.

Andersen and his team, even amid budget cutbacks, “never gave up” on the agency, Corman said, and set important priorities for “the most life-safety of our critical functions.”

With two years left in Trump’s term, “it may be hard to have much of a dent, no matter who gets the nod, and as such, I really hope they lean on the current steward” in Andersen, Corman said. 

Madison Alder contributed reporting to this story.

The post CISA director pick already drawing concern from Hill Dems over Palantir connection appeared first on CyberScoop.

Andrew Crocker of EFF writes: Today, along with the ACLU, EFF filed an amicus brief in the Sixth Circuit court of appeals in United States v. Sturdivant, a case where police warrantlessly tracked a suspect’s movements using Automated License Plate Reader (ALPR) data. Our brief details the vast, interconnected network of ALPRs that constantly track...

Suzanne Smiley reports: Cybercriminals are infecting devices on a large scale with spyware, increasingly compromising systems belonging to average people, according to a new report from the threat hunting firm iVerify. The company found a rate of 1.07 spyware infections per 1,000 consumer scans of the startup’s free online checks. The security firm reported a...

Victor Tangermann reports: After decades of establishing itself as one of the worst guardians of personal data, Meta raised eyebrows this year by encouraging users to hand over their email logins and credit card information to its new AI agent, Muse. The tool, a privacy nightmare anthropomorphized by a furry apparition, can crawl through years...

Olivia DeRicco reports: Woodley, et al. v. Google LLC, et al. Filed: October 9, 2026 ◆ § 5:26-cv-11715 Read Complaint A class action lawsuit alleges Google and UPS wrongfully disclose users’ private data to third parties by way of the Google Search tracking widget. A proposed class action lawsuit alleges that the Google Search-based “Track...

Democrats’ big win on Election Day, which saw them take control of both the House and Senate, has ramifications for the Cybersecurity and Infrastructure Security Agency, artificial intelligence, surveillance policy and much more.

Here’s what lawmakers and cybersecurity experts have to say about the short-term and long-term prospects on Capitol Hill.

Leadership plans ahead

Maggie Hassan, D-N.H. is in line to take the gavel on the Senate Homeland Security and Governmental Affairs Committee, with Sen. Gary Peters, Mich., retiring.

“Our government’s number one job is to keep people safe, and the Senate Homeland Security and Governmental Affairs Committee must work to ensure that our country remains safe, secure and free from all kinds of threats,” Hassan said in a statement to CyberScoop. “That work involves protecting against terrorism and fentanyl trafficking, but it also includes guarding against emerging threats like artificial intelligence security risks and strengthening our cybersecurity.”

“The Trump-Vance administration has undermined our security on these fronts, including by diverting resources away from combatting fentanyl trafficking and gutting CISA,” she continued. “We need to reverse these cuts, confront these challenges and put public safety first.”

Rep. Bennie Thompson, D-Miss., is poised to return once again as chair of the House Homeland Security Committee, said Democrats are taking over at a “pivotal time for CISA,” with it looking to add staff after cutting back by nearly one-third.

“First and foremost, we will aim to work with CISA to expedite its critical re-staffing effort and to ensure it has the expertise necessary to support stakeholders as they defend against the scale and velocity of AI-enabled cyber-attacks,” he said in a statement to CyberScoop. “Advances in AI can help defenders, but it will also accelerate the consequences of deferred investments in security and CISA must be well-positioned to help critical infrastructure owners and operators rapidly improve their cybersecurity posture.”

“We will prioritize getting resources straight into the hands for defenders — by extending the State and Local Cybersecurity Grant Program and improving support of under-resourced sectors, especially water,” he continued. “We will work to ensure CISA re-establishes its cross-sector coordination capacity, which was diminished when the Trump administration- terminated CIPAC, by making sure the Anchor-CI is eventually up and running and meets the needs of stakeholders. Finally, we will make sure CISA is well-positioned to support the secure development and deployment of AI.”

What happens in the lame-duck session

Before the GOP relinquishes control of the House and Senate to Democrats, though, there’s a lame-duck session ahead. 

Long-term renewal of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) is a bipartisan and industry priority, with it set to expire Dec. 11. Current Senate Homeland Security and Governmental Affairs Chairman Rand Paul, R-Ky., has been the biggest obstacle to reauthorization, but he could get “rolled” by GOP leadership on an extension, said Michael Garcia, a former government cyber official and vice president of the cybersecurity practice at Monument Advocacy. Possible vehicles for CISA 2015 to hitch a ride include an omnibus funding bill or the annual defense policy bill.

The Department of Homeland Security, and its subagency CISA, are currently operating on a continuing resolution that’s also set to expire Dec. 11, where lawmakers could temporarily extend CISA 2015 if a long-term solution can’t be reached in the lame duck. Another continuing resolution before Dec. 11 in lieu of an omnibus spending bill is an option for the lame duck. Both a CR and omnibus spending bill would theoretically include DHS funding, although the agency’s funding has been made more difficult in the past by the presence of Immigration and Customs Enforcement within the department.

Republicans have talked about wanting to get the fiscal 2027 National Defense Authorization Act done in the lame duck. Besides the possibilities of CISA 2015 being included in the bill, Nicholas Leiserson, senior vice president for policy at the Institute for Security and Technology, said the Senate version of the legislation has a pair of very noteworthy cyber provisions: a “very broad” authorization for contractor-owned, contractor-operated offensive cyber operations, and a requirement that every artificial intelligence product sold to the Defense Department have an AI bill of materials.   

Additional leadership shuffle

While Paul is losing his gavel, he’s shown he can be a disruptive force on passing cybersecurity legislation through the Senate in the minority. That makes what he does next possibly determinative for cyber bills, Leiserson and Garcia said. “If he leaves HSGAC, let a thousand cyber bills flourish!” Garia quipped on social media. Paul could opt to become the top Republican on the Senate Health, Education, Labor and Pensions Committee instead of HSGAC.

Nebraska Sen. James Lankford would take over for Paul as top HSGAC Republican in that scenario, and an industry source said he’s viewed as a supporter of CISA 2015.

On Senate Intelligence, the panel’s leadership goes to a lawmaker who has placed a big emphasis on cybersecurity in his congressional career: Mark Warner, D-Va. 

On the House side, while Rep. Andrew Garbarino, R-N.Y., moves to the minority on the Homeland Security panel, he has proven willing to collaborate with Democrats on cybersecurity issues. Rep. Delia Ramirez, D-Ill., is poised to take the gavel of the panel’s cybersecurity subcommittee, and Rep. Vince Fong, R-of California looks set to become the subcommittee’s top Republican and has his own history of bipartisanship. Fong would replace current subcommittee chair Andy Ogles, the far-right Tennessee Republican who lost in the primaries.

One thing to watch in the House, Leiserson said, is how the House looks to tackle AI — through existing committees, a select committee or some other structure. Democrats haven’t put forward a unified front on AI guardrails yet.

With AI models uncovering as many vulnerabilities as they are, “highly capable frontier models are going to drive a lot of discussion” about AI and cybersecurity, said Craig Albright, the Business Software Alliance’s senior vice president for U.S. government relations.

Appropriations, oversight, legislation

If the NDAA or a CISA 2015 extension don’t pass in the lame duck, they’d be priorities in 2027, too.

“CISA 2015 has to happen, and if we can’t get it done, then we can’t move to the next thing,”  said Henry Young, BSA’s policy director. “Once we get it done, there’s an open question about which of these priorities that we’ve talked about gets to be number one. Is it post-quantum cryptography? Is it government IT modernization? Is it frontier AI cybersecurity systems? We don’t know that yet, and we can’t know until we pass this law.”

How damaged the agency CISA is by Trump administration’s budget cuts is something Democrats are expected to scrutinize closely. Another top budget issue is what to do with the expired State and Local Cybersecurity Grants Program housed at DHS, since even if it’s reauthorized, it will require appropriators taking steps to invest in it.

Democrats could take a look at a variety of other Trump administration changes at DHS and CISA, on topics like election security, the Cyber Safety Review Board, the Joint Cyber Defense Collaborative and more. 

More broadly, Leiserson said an area of Democratic cyber oversight is likely to be the Department of Government Efficiency that cut cyber personnel at agencies at and beyond CISA, and “particularly the integrity of systems that DOGE touched when they were given very high privileged access to federal systems.”

If the White House puts forward a permanent nominee for director of CISA, Democrats would be poised to vet that person. They also would have a say in who leads the Office of the National Cyber Director, should the incumbent, Sean Cairncross, depart.

So far, Democrats haven’t put forward a unified posture on expired surveillance authorities known as Section 702, although both Warner and incoming House Intelligence Chairman Jim Himes, D-Conn., have fought in the past for its renewal. The surveillance program is operating similarly still due to a court order, but that order only lasts through next spring.

The post What Democratic control of Congress means for cybersecurity appeared first on CyberScoop.

Justin Caffier writes: It’s been hard to keep track of all the ways in which America has been speedrunning toward a full-blown fascist surveillance state over the first two years of the second Trump administration. That’s partially due to the disorienting, shock-and-awe nature of each fresh injustice. But it’s mostly because of just how many...

Zack Whittaker reports: Security researchers at digital rights unit The Citizen Lab say government spyware makers are abusing global advertising networks to target and hack devices by serving malicious online adverts. A new report published Thursday by the University of Toronto lab, which investigates surveillance and digital rights abuses, said an Israeli company called Discover-Tech...

Justin Caffier writes: It’s been hard to keep track of all the ways in which America has been speedrunning toward a full-blown fascist surveillance state over the first two years of the second Trump administration. That’s partially due to the disorienting, shock-and-awe nature of each fresh injustice. But it’s mostly because of just how many...

Zack Whittaker reports: Security researchers at digital rights unit The Citizen Lab say government spyware makers are abusing global advertising networks to target and hack devices by serving malicious online adverts. A new report published Thursday by the University of Toronto lab, which investigates surveillance and digital rights abuses, said an Israeli company called Discover-Tech...

Thinking of traveling to Russia? Be aware that the Russian government has expanded a pilot program that tracked foreign migrants in Moscow to track them across the entire country. According to a press release from Interfax: All foreign nationals entering Russia will have to install a mobile app (“Amina”) on their phones to track their...

The Trump administration is breaking the law after being more than a month overdue on declassifying a court opinion on the surveillance of U.S. citizens, according to two senators and a coalition of civil liberties groups.

Release of the Foreign Intelligence Surveillance Court (FISC) opinion has been closely tied to reauthorizing Section 702 of the Foreign Intelligence Surveillance Act (FISA), which lapsed this summer, although collection authority has continued under another court ruling that runs through March of next year.

Under Section 702, the government can warrantlessly search foreign targets’ electronic and phone communications using the personal information of Americans who have been in contact with them.

In the FISC opinion that the administration has not declassified, a judge objected to tools the government has created to let analysts process messages. The objection reportedly was over a filtering system that allowed analysts to get information in a way that should be counted as a query of Americans’ information, which is subject to extra protections.

Sen. Ron Wyden, D-Ore., who co-authored a letter to administration officials Monday with Sen. Adam Schiff, D-Calif., had previously said the opinion shows “major compliance problems” and had  objected to a short-term reauthorization of Section 702 until officials agreed to release it.

“As Congress continues to debate the fate of this authority, lawmakers must be able to discuss these abuses openly,” Wyden and Schiff wrote to Director of National Intelligence Jay Clayton and Attorney General Todd Blanche. “Otherwise, the American people will rightly question whether a government that so flagrantly violates basic legal requirements, like the statute requiring declassification, can ever be trusted to not abuse a powerful surveillance tool like Section 702.”

The Senate duo and the coalition of civil liberties groups in a separate letter to congressional leaders said that under the law, the letter was due Sept. 13. Blanche had previously committed to declassify the letter to lawmakers by the statutory deadline. The letter was also overdue by another measurement, with the leaders of the Senate Intelligence Committee saying that they expected the declassification and release by May 15.

A spokesperson for Senate Intelligence Chairman Tom Cotton, R-Ark., didn’t respond to a request for comment, but the office of the leader of the Democratic side of the panel, Sen. Mark Warner of Virginia, did.

“The Vice Chairman has been clear that he supports transparency with regard to Section 702 of FISA,” a spokesperson, Rachel Cohen, said in a statement to CyberScoop. “This is precisely why he and Chairman Cotton urged then-DNI [Tulsi] Gabbard in March to declassify the March 17 FISC opinion. Unfortunately, neither Director Gabbard nor Acting Director [Bill] Pulte were responsive, but Senator Warner expects that DNI Clayton will declassify the opinion, consistent with the bipartisan SSCI letter and as required by law.”

Failure to declassify the opinion should be fatal to reauthorizing the expired surveillance law, the civil liberties groups wrote.

“Congress should refuse to support any reauthorization of Section 702 while the administration actively withholds legally mandated information about how the surveillance program operates,” they wrote. “Further, it must stop relying on executive branch self-policing to protect Americans’ rights and reauthorize Section 702 only with a warrant requirement to access Americans’ private communications.”

The Office of the Director of National Intelligence and the Justice Department didn’t immediately respond to requests for comment.

The post Senators, rights groups say Trump administration breaking law by withholding surveillance court opinion appeared first on CyberScoop.

Frank Landymore reports: Would you like a rude, and perhaps slightly humorous, reminder of how much data surveillance Amazon conducts on its customers? Have we got the thing for you! On Tuesday, one customer shared how she accidentally stumbled on an obscure section on the Amazon website that most of us overlook. It contained, to...

Release Date: Mon, 10/05/2026 WASHINGTON — U.S. Customs and Border Protection announced today it has verified the identity of over 1 billion travelers through facial biometrics, underscoring CBP’s unwavering commitment to enhancing national security, combatting identity fraud, and streamlining legitimate travel. “Accurately verifying the identity of over 1 billion travelers at air, land, and sea...

Source

Margaret Attridge reports: Customers who purchased Samsung Smart TVs sued over claims the technology company collects users’ real-time viewing habits without their permission for commercial purposes. Named plaintiffs Danielle Tillery, Michael Walsh and David Rosenberg, who each bought a Samsung Smart TV between 2014 and 2021, accuse Samsung of violating their data privacy by harvesting...

Source

A bipartisan update to a California wiretapping law will eliminate the right to sue over internet-based surveillance, ending a key provision of a 57-year-old wiretapping law. Advocates say it is an overdue correction meant to prevent frivolous lawsuits, while privacy advocates call it a blow to digital consumer privacy rights.

The California Invasion of Privacy Act, originally passed in 1967, requires a court order for wiretapping, eavesdropping, interception or recording of telephone calls. Over time, courts extended the law to cover most internet-based communications as well, such as email and websites.

 In 2015, lawmakers added a provision allowing residents to sue companies for unauthorized use of certain internet-tracking technologies, such as pen registers, with penalties up to $5,000 per violation, plus triple damages. Last week, Calif. Gov. Gavin Newsom signed SB 690 into law, that removes the right of private citizens to sue websites and mobile applications through CIPA.

Newsom and sponsors of the law say the provision has spawned thousands of lawsuits and demand letters against companies for using common internet-tracking tools, like browser cookies and tracker pixels, that can serve legitimate business purposes.

Pen registers and trap-and-trace devices are primarily used by law enforcement agencies—such as local police, the FBI, and the DEA—as well as national security organizations during active criminal and counterintelligence investigations. Authorized through a court order, investigators use pen registers to log outgoing metadata like dialed phone numbers, IP addresses, and timestamps (and trap-and-trace tools for incoming contacts) to map out a suspect’s communication network without listening to the content of the conversations.

“This measure addresses the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses that unwittingly install software on their websites that at times have tracked and shared the information of visitors to the site,” Newsom wrote in his signing statement. “I applaud the authors’ efforts and align myself with the goal of protecting small businesses from overzealous lawsuits based on a statute written without today’s complex technology landscape in mind.”

According to privacy attorneys at law firm Kelley Drye, the addition of the pen register and trap-and-trace statute in 2015 was meant to codify how law enforcement agencies could obtain court orders for phone metadata without violating CIPA.

 Estimates of lawsuits filed under the provision vary widely. The law was widely supported by business groups like the Chamber of Commerce, which was one of hundreds of California groups that signed in support of the legislation last year.

The Alliance for Legal Fairness, a Virginia-based lobbying firm backing the legislative update, tracked approximately 600 lawsuits under the provision in 2025, according to written comments. Today, the group claims that number has “exploded” to more than 4,000.

According to Shruti Bhutani Arora and Christine Mastromonaco, privacy attorneys for the law firm Pillsbury, plaintiffs and prospective litigants have “sent tens of thousands of demand letters to businesses threatening class-action suits under the CIPA’s pen-register and trap-and-trace provisions for using everyday website tools like cookies, analytics software and pixels.”

A report from the California Assembly Committee on Privacy and Consumer Protection characterized the pen register provision as “the poster child for abusive lawsuits.”

“Enterprising plaintiffs’ attorneys have exploited the statute at scale to go after businesses using third-party software to enable advertising on their websites,” the committee wrote. “Because the potential liability can be staggering, businesses generally settle this litigation hastily, encouraging vexatious litigants to continue blasting out demand letters.”

Meanwhile, most major California labor unions opposed the law, as did the American Civil Liberties Union, the Consumer Federation of California, the Privacy Rights Clearinghouse, the Electronic Privacy Information Center and dozens of civil rights groups.

The committee report also noted opposition by “a broad array of privacy, civil society, legal and immigrant rights organizations.”

The Electronic Frontier Foundation in particular has fought the bill for years. Early versions of SB 690 would have exempted other privacy provisions from private lawsuits, but later versions narrowed the exemption to just pen registers and trap-and-trace devices. 

Privacy groups argue the exemption will make it easier for companies to track, collect and sell consumer data to third parties, including data brokers, while making it harder for individuals to take legal action.

Hayley Tsukayama, director of state affairs at EFF, told CyberScoop that the bill “never should have been signed” and that the organization tried and failed to lobby Newsom to veto it.

“CIPA was originally intended to protect personal privacy against the threat of surveillance of private communications,” said Tsukayama in a statement. “But this ‘reform’ harms privacy by making it impossible for ordinary people to sue companies engaged in unlawful metadata surveillance. That’s especially scary as the federal government and other law enforcement agencies seek data from businesses or data brokers to target people based on their political beliefs, religious affiliations, or health decisions.”

California passed major privacy legislation in 2018, standing up the California Privacy Protection Agency to enforce digital privacy laws. It has some of the strictest data broker laws in the nation, requiring brokers to register with the government and provide consumers with easy, universal opt-out options for data collection.

The post Wiretapping change sparks big privacy fight in the Golden State appeared first on CyberScoop.

Another reminder: if you’re traveling, your cell phone can be searched at the border without a warrant or even reasonable suspicion. They can just do it.  From FourthAmendment.com: At the border, defendant’s cell phone was first manually searched and then forensically searched. Neither was unreasonable under the Fourth Amendment. United States v. Robinson, 2026 U.S....

Source

Kelsey Reichmann reports: In an emergency order, the Supreme Court on Friday agreed to let the Trump administration resurrect a national citizenship database using Social Security information for voter verification during the midterm elections. A lower court blocked the Department of Homeland Security from collecting individuals’ Social Security numbers, citizenship status and other private data...

Source

Sydney Haulenbeek reports: Police wanting to use a device mimicking a cellphone tower to locate people must first get a warrant, a Fourth Circuit panel ruled Thursday. Kerron Andrews was arrested by the Baltimore Police Department in May 2014, after the police secured a court order allowing them to use a cell-site simulator to obtain...

Source

Anthony Kimery reports: A relatively small U.S. Immigration and Customs Enforcement (ICE) contract has revealed unusually specific details about a little-known Homeland Security Investigations (HSI) program that centrally manages the agency’s nationwide location tracking operations. ICE awarded Ensurity Mobile Corp. a $135,000 sole-source purchase order last week for specialized devices for HSI’s Technical Operations unit....

Source