A federal judge dismissed a lawsuit from the federal government seeking to preemptively block Democratic Senate candidate Mary Peltola from assuming office if she wins her race.

The Department of Justice sued Alaska last month, arguing that an alleged scheme by Peltola to recruit Daniel J. Sullivan, an independent candidate who shares a name with incumbent Republican Sen. Dan S. Sullivan, would confuse voters.

Peltola’s campaign, the Democratic Senate Campaign Committee and civic groups including the League of Women Voters of Alaska and Common Cause all filed motions to dismiss the lawsuit, arguing the federal government lacks standing and constitutional authority to weigh in on Alaska’s elections.

They also said the court cannot grant relief because there is no legal way to determine whether a voter mistakenly voted for one Sullivan over the other without violating the secret ballot.

U.S. District Judge Sharon Gleason reached the same conclusion, noting in an order “the absence of any explanation from the United States as to how its requested relief could redress its alleged injury while simultaneously maintaining the secrecy of the ballot.” She also wrote that she “cannot grant the United States the relief it seeks because the United States has failed to establish the redressability prerequisite for Article III standing.”

Gleason’s opinion recounts Daniel J. Sullivan’s independent candidacy. Alaska Director of Elections Carol Beecher decertified it in June, later testifying that she did not believe he was running in good faith. State courts disagreed and restored his candidacy, and the Alaska Supreme Court upheld that ruling. 

Alaskan election officials still took steps to distinguish the two candidates, listing their full names and labeling them “Incumbent,” “Republican candidate” and “Independent.” Alaska’s ranked-choice system lets voters rank both Sullivans, so they are not limited to a single candidate.

State officials and election experts also noted that nearly 60,000 Alaskan voters have already cast early or mail ballots, and there is no feasible way to reissue them.

The government’s one-sentence response said the state could segregate ballots and asked the court to allow a federal investigation into whether any voters were deceived. Gleason rejected that approach, saying the government offered no explanation of how ballot segregation or a law enforcement inquiry into voters’ intent could be carried out while preserving ballot secrecy.

Gleason also questioned the government’s constitutional basis, writing that the executive branch has no legitimate role in determining which candidates appear on Alaska’s ballots. The government said it was not seeking to change the time, place or manner of the election, but Gleason noted that its requests, including limits on certification, ballot segregation and an investigation of voters’ intent, all concern those matters, which are the state’s responsibility.

The lawsuit drew heavy media attention and concern from democracy advocates, but legal experts widely viewed it as exceptionally weak.

“Today’s ruling marks a victory for Alaska state sovereignty and Alaskan voters,” said David Becker, executive director of the nonprofit Center for Election Innovation and Research and a former voting rights attorney at DOJ. “By soundly rejecting the administration’s unlawful and now unsuccessful attempt to interfere, the court concurred with the State of Alaska that this is purely a matter of state law and that, under the U.S. Constitution, the federal government has no role in determining how Alaska certifies its Senate election.”

The post Federal court tosses Trump lawsuit challenging Alaska Senate certification appeared first on CyberScoop.

A Florida judge ruled this week that ex-Overstock CEO Patrick Byrne is not liable in a lawsuit brought by a Dominion Voting Systems executive over a film that accuses the former electronic voting hardware and software company  executive of saying he “made sure” that Republican presidential candidate Donald Trump wouldn’t win reelection in 2020.

The lawsuit, brought in 2022 by Eric Coomer, a former director of product strategy and security at Dominion Voting Systems, concerns comments made in a 2020 film produced by Byrne titled “The Deep Rig.”

In the film, which alleges a conspiracy to manipulate 2020 election results in favor of Democrat Joe Biden, a man identified as Joseph Oltmann claimed he listened to a conference call led by organizers of “Antifa,” wherein another participant mentioned that “Eric” “The Dominion Guy” was also on the call.

In the film, Oltmann says a man identified as “Eric” told others on the call that Trump wouldn’t win reelection because he had “made sure of it.” Coomer denies taking part in any such call, and filed a lawsuit against Byrne and seven other individuals and entities for defamation.

U.S. District Judge Tom Barber’s decision did not address most of the substantive claims in the lawsuit, such as Byrne’s ultimate legal responsibility for the statements by Oltmann that made it into the film.

Because the lawsuit was originally filed in Colorado, it must meet a state law requirement for defamation claims involving matters of public concern. Coomer must show “clear and convincing evidence” that Byrne or others involved in making the film knew the claims were false and defamatory, or acted with reckless disregard for the truth.

“Where the challenged speech involves a matter of public concern, as it undeniably does here, the plaintiff also bears the burden of proving, by clear and convincing evidence, that the challenged statement is materially false and was made with actual malice,” wrote Barber in his opinion.

The standard is not whether a reasonable person would have investigated the claims before airing them, but whether the defendant “in fact entertained serious doubts as to the truth of [the] publication, or was highly aware of its probable falsity.”

In this case, Barber said it’s not impossible to clear that standard for public figures, but under Colorado law, Coomer would have a hard time providing clear and convincing evidence that Byrne “in fact subjectively disbelieved or had serious doubts about Oltmann’s story.”

Barber further wrote that technology has given “a powerful microphone” and large followings to people who would otherwise be dismissed as “kooks” and conspiracy theorists. These people make statements that are “objectively and demonstrably wrong” but who hold firm to their core beliefs because they “genuinely and sincerely believe what they say with every fiber of their being, even when objective evidence may suggest otherwise.”

Still, he said the current language and meaning of the Colorado law is clear, suggesting it was a matter for higher courts or legislators to clarify or change.

“Under the actual malice standard, unless it can be proven that the speaker subjectively believed his or her statements to be untrue, the law imposes no liability,” Barber wrote. “That is a policy choice that might deserve reexamination by the appropriate decision makers – the United States Supreme Court and the Colorado courts.”

Byrne’s attorney, Peter Ticktin, called the ruling a “victory” in a statement to CyberScoop.

“This is a substantial victory for Patriot Patrick Byrne and for the principles at stake in this case,” Ticktin said. “The court’s decision speaks for itself. We are pleased that the facts and applicable law resulted in summary judgment in our client’s favor.”

Coomer sued Byrne in his personal capacity, and Dominion Voting Systems was not a party to the lawsuit. 

The voting machine giant was awarded more than $1.8 billion in combined legal settlements over the past two years from Fox News, Newsmax and MyPillow CEO Mike Lindell, all of whom made allegations that Dominion voting machines were used to maliciously flip or alter votes.

The post Lawsuit against Ex-Overstock CEO tied to 2020 election film falls apart over question of ‘actual malice’ appeared first on CyberScoop.

LEGAL BRIEF By Max Stul Oppenheimer, Esq. On August 26, Meta and the Attorneys General of 51 US states and territories filed a request that a federal district court judge approve the settlement of a complaint. The settlement proposal is 130 pages long (although 53 of them are signature pages for all the parties and […]

The Federal Trade Commission is asking a court to force the owner of multiple digital security and privacy companies from further operations, saying the businesses are serially defrauding their customers out of millions of dollars.

Earlier this month, the FTC filed a federal lawsuit in Ohio against Dmitry Belkin and 12 of his businesses, alleging they engaged in unfair and deceptive trade practices under the Federal Trade Act and violated the Telemarketing Act’s prohibition against deceptive and abusive telemarketing acts since at least 2020.

The majority of Belkin’s companies, with names like Digital Forensics Corp., 1^st All Data Recovery and Remote Backup Corp., advertised services to help people deal with ongoing online romance or “sextortion” scams, where a scammer threatens to publish a nude or sexual photo of the victim unless they pay a ransom.

They operated websites like BlackmailHelpline.com, DigitalForensics.com and other sites that would routinely be advertised on Google, YouTube, X and other sites when users are searching for help with sextortion attacks.

The FTC alleges that despite taking in at least $60 million from customers, Belkin and his companies routinely failed to deliver most of the listed services meant to protect customers from ongoing scams, generated fake transcripts to fool customers into believing a sextortion threat had dissipated and routinely denied requests for refunds.

“Defendants falsely portray themselves as digital forensics experts, claiming they can track and identify sextortionists, prevent the spread of explicit material, and coordinate with law enforcement to bring criminals to justice,” the FTC said in its complaint. “Defendants further mislead victims by asserting that law enforcement will not help stop the sextortion attack” and that contacting the police is “the last thing you want to do.”

According to the complaint, Belkin’s businesses would first pitch a “Phase 1” package of services, between $1,499 and $20,000, that included “stopping” an ongoing attack, handling communications with the sextortionist, tracing their location, sending a legal cease-and-desist letter and reporting the evidence to law enforcement.

The FTC complaint alleges that in reality, the companies simply use the customer’s account to communicate with the scammer, before changing account settings to block them, fabricating chat transcripts and using pre-saved geolocation coordinates to fool customers.

After customers purchased Phase 1 services, Belkin’s companies would routinely pressure them for thousands of dollars in additional “Phase 2” services, which were advertised as monitoring services for victim accounts that could detect and prevent future attacks.

“Defendants do not perform any of these services either,” the FTC alleged.

The complaint alleges that Belkin drafted a script for employees at his companies to use during telemarketing calls, designed explicitly to exploit victims’ fears and anxieties around their nude images being made public. This included comments implying that a bad actor could alter a real photo of the victim to include sexual acts with minors, spurring concerns about legal liability. After each call, employees filled out a form confirming they had used certain keywords or phrases, such as “pedophile,” “devastating consequences,” “life altering” and “no coming back after this.”

“I’ve seen these situations ruin people’s retirement all from the accusation of being a child predator,” the script said at one point, according to the complaint. “We need to make sure nothing gets posted.”

Some customers were also asked seemingly unrelated questions about their personal lives, such as if their marriage was “on the rocks,” had cheated on their spouses, or had young children that could “mean a custody battle” if the images were released publicly.  

The companies received hundreds of requests for refunds but often denied them, also going to great lengths to prevent or drown out negative reviews online. Unhappy customers were directed to a fake version of the Better Business Bureau’s website, controlled by Belkin, to submit their complaints.

The actual Better Business Bureau page for one of the businesses, Digital Forensics Corp., still includes numerous complaints from customers alleging they were defrauded. One customer complaint, filed in August, states that they signed a contract in 2023 “out of sheer panic and fear” and were still making payments because “they had my personal information and would contact me if I didn’t pay.”

Another review from a customer in June said they were “pressured” into a contract with the company in 2024, were still making monthly payments and when they contacted the company to cancel, were told they “could not close the account and must continue making payments.”

In both cases, the company responded within days, offering “alternative” options to resolve the disputes, such as paying a reduced settlement for the remaining balance.

They also allegedly flooded their own websites with fake positive reviews, gave partial refunds paired with non-disparagement agreements to push some customers to take down their negative reviews, and even hired Uber drivers to post fake testimonials with staged photographs.

Requests for comment sent to Belkin’s attorney and his personal LinkedIn account were not returned.

The post FTC says ‘sextortion’ protection companies deceived customers about services  appeared first on CyberScoop.

SEC Consult has published technical details on vulnerabilities mentioned in a complaint filed by several US states.

The post TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws appeared first on SecurityWeek.

As AI agents escaping testing sandboxes and hacking organizations have gone from unprecedented to seemingly routine in a matter of weeks, policymakers, regulators and cybersecurity attorneys largely agree on one thing: Something must be done to hold AI companies accountable for the incidents.

Exactly what can be done under our current laws and regulations is much less clear.

The conversation has moved from policy and industry chatter to the floor where the future of liability will be determined. Speaking about the Hugging Face hack at a Senate hearing this week, Georgetown University law professor Paul Ohm summarized the argument.

“If you take any of the lengthy reports that have summarized what happened at OpenAI in July and August, and you simply search for the words ‘AI agent’ and you replace them with the words ‘OpenAI employee,’ the document you would be left with would read like a criminal indictment containing the defendant’s own confession of guilt,” said Ohm.

CyberScoop spoke with members of Congress, former federal law enforcement officials, cybersecurity attorneys and other experts about which laws, regulations or policies might apply to agentic hacks carried out by models at Anthropic, OpenAI, Meta, Google and other companies.

Their answers varied widely. Some endorsed using existing laws like the Computer Fraud and Abuse Act, while others said regulators such as the Federal Trade Commission could investigate and fine AI model developers by defining unauthorized agentic hacks as a form of unfair or deceptive trade practice. Still others pointed to civil lawsuits, new laws or state regulators as ways to hold AI companies or users accountable.

But, similar to a familiar technical cybersecurity idiom, there are no silver bullets in this debate.  Nearly every option has real complications or roadblocks that could limit its effectiveness. 

For once, the CFAA is too narrow

One of the first laws mentioned in discussions about agentic AI hacks is the Computer Fraud and Abuse Act, the federal government’s primary criminal hacking law. Historically, many in the cybersecurity community have criticized the statute as overly broad.

For agentic hacks, the problem is the opposite: The CFAA’s language does not clearly cover the activity involved in incidents like the Hugging Face hack.

“I would not be looking at a CFAA charge as the statute exists today” for these hacks, said Leonard Bailey, former head of the cybersecurity unit in the Computer Crime and Intellectual Property section at the Department of Justice.

Bailey helped develop policies that moved the DOJ away from prosecuting “good faith” third-party security research under the CFAA. He said that even if Congress changed the law to cover such hacks, it’s unclear whether that would help since laws like the CFAA are supposed to be “technology neutral.”

According to the Department of Justice’s website, CFAA prosecutions must prove that a defendant accessed a computer “without authorization” or in a way that “exceeds authorized access.”

Crucially, the law specifies that “as part of proving that the defendant acted knowingly or intentionally, the attorney for the government must be prepared to prove that the defendant was aware of the facts that made the defendant’s access unauthorized at the time of the defendant’s conduct.”

In other words, prosecutors must prove that the unauthorized access was intentional, not accidental.

Applied to incidents like the Hugging Face hack, the legal problem becomes clearer. If a human performed the same actions, they would almost certainly face CFAA charges. If a bot or software acted on behalf of a cybercriminal or group, the individuals or organizations intending to profit from the scheme could also face charges.

But no human at OpenAI, Anthropic or another frontier AI company directed, asked or even suggested that its agents hack victims or commit crimes. If charged, those companies would almost certainly argue that none of their actions demonstrated an overt attempt to commit a crime or authorize access to systems or data without permission.

However, others said there may be room to argue that AI companies are now fully aware that their products can engage in unauthorized agentic hacks.

“I’m of the opinion, because it has already happened [and] has happened several times, the argument that it happening again is not at a minimum knowing, for me it’s unlikely because we already have a situation where we know the capabilities,” said Elimu Kajunju, a privacy, cybersecurity, and AI governance attorney at Rimon Law. “The very first one where this happened, that’s the only organization that could say ‘You know what, we didn’t know it could do that or act like that.’ Once we’ve had a second or third or fourth, we can’t say that anymore.”

Kajunju acknowledged that applying statutes like the CFAA to agentic hacks could be complicated. But he said it would align with the spirit of American jurisprudence, in which businesses are often legally accountable for damage they cause, whether they intended it or not.

“I think this is one of those situations where, ‘Does it fit neatly into one of the buckets [we have]?’ No, but can you find one that will fit depending on what has happened? I think so.”

CyberScoop has reached out to OpenAI, Anthropic and Google for comment.

The FTC, states and civil lawsuits

Beyond criminal law, the hacks could also draw scrutiny from federal regulators, including the FTC.

Both Bailey and Kajunju pointed to the FTC as a possible regulator for agentic hacking incidents if the agency defines them as unfair and deceptive trade practices under Section 5 of the FTC Act. One benefit of relying on regulators such as the FTC is that they can often move faster on investigations and enforcement actions than the DOJ can on criminal prosecutions — an important consideration in the fast-moving AI space.

The FTC recently confirmed it was investigating OpenAI, Anthropic and other frontier AI companies, news first reported by The New York Post and confirmed by Axios. The FTC did not return a phone call from CyberScoop requesting comment. 

But Bailey warned that without a specific congressional mandate directing the FTC to regulate AI company hacks, any effort by the agency to redefine or expand its rules would almost certainly be challenged in court.

Civil lawsuits and state policymaking offer additional paths to investigating or regulating AI companies.

Currently, Florida is investigating OpenAI over the HuggingFace hack, while a nonprofit that sued OpenAI earlier this week has cited alleged violations of California law.

In his testimony, Ohm said that if Congress was serious about preventing agentic hacks, it should not pursue federal legislation preempting state AI laws. He called states “laboratories of democracy,” that can experiment with different forms of regulation and lawmaking.

Others agreed with that approach.

“Obviously this is a topic that the federal government doesn’t love, states getting involved in this space, but it just takes too long for action to come through Congress,” said Kajunju. “I think the quickest way to getting us to a better place will be a really good state law.”

New legislative remedies

On the Hill, members of Congress are working through the same questions as they consider legislative remedies.

At a Senate Homeland Security Committee hearing Wednesday, Sen. Josh Hawley, R-Mo., took a minute at the outset to describe the volume of agentic hacks affecting outside entities that frontier companies appeared to have missed for months. He named affected targets one by one, including major online code repositories like HuggingFace, Australian and U.S. government websites, obscure foreign-language wiki sites and other parts of the internet.

After weeks of investigations uncovered additional, previously unreported incidents in which models escaped testing environments and hacked victims, Hawley said it was “time to have a conversation about who bears responsibility” for the fallout. He added, “as soon as the AI executives say ‘we got a real problem here, our product is out of control,’ the very next words out of their mouths are, ‘but we’re not responsible for it.’”

Hawley said the committee invited OpenAI CEO Sam Altman to testify at the hearing, but he declined. Hawley then accused frontier AI companies of emphasizing their products’ danger while pushing for legal antitrust exemptions and only supporting government action if “they can write all the regulations.”

“I’d suggest that maybe we start with some federal legislation…and we can use existing statutes to do it, I propose using the Computer Fraud and Abuse Act,” said Hawley. “It’s already on the books, we can just update it to say that for developers – that’s the companies – if you develop these agents and train them in a reckless fashion and they go on to hack and destroy stuff, you’re liable.” 

Like other legal experts, Hawley said he believes a CFAA prosecution requires a human actor or organization that intended to commit a crime.

Another Senator, Ron Wyden, D-Ore., said he was also working on legislation related to the hacks. 

“The big AI companies should be held responsible if their agents hack other companies, government systems or foreign websites,” said Wyden in a statement to CyberScoop. “In my view there’s a question about whether the current CFAA would apply to the recent hacks. I’m working on a narrow update to the law to ensure Anthropic, OpenAI and other big AI companies can be punished when their agents run wild.”

Sens. Mark Warner, D-Va., Brian Schatz, D-Hawaii, and Andy Kim, D-N.J., introduced a bill that would create an AI Safety Board at the Department of Commerce. That board would evaluate emerging AI risks and establish safety and technical standards.

The Trump administration’s testing regime with AI companies is entirely voluntary, applies to only certain models, and requires testing no more than 30 days before release. Under the Democratic bill, frontier AI companies would be forced to submit models for testing 45 days before release. They would also be legally required to comply with government safeguards related to models discovering and exploiting software vulnerabilities without explicit human direction. Companies could face fines of up to $250,000 per violation, per day.

When asked whether the CFAA or other federal statutes could or should be used to prosecute companies when their AI systems hack, Warner said that companies’ claimed lack of intent to harm should not become a catchall legal excuse for avoiding responsibility. AI companies have said they never directly prompted or suggested that their models hack or commit crimes.

“AI models are tools and if I buy a power tool and deliberately misuse it, that’s my responsibility,” said Warner. “But if a defect causes that tool to behave in a dangerous way, we don’t absolve the manufacturer simply because someone else was using the tool when it malfunctioned. As AI systems become capable of acting autonomously, we need to ask what principles of responsibility should apply to the companies that design and deploy them.”

The post The legal questions raised by agentic AI hacks appeared first on CyberScoop.

The Supreme Court has rejected a petition by the Trump administration to implement changes to the way the U.S. Postal Service handles mail-in ballots for the upcoming 2026 midterm elections, calling it “arbitrary and capricious.”

The 7-2 decision was handed down Monday with little explanation by the court. Writing for the majority, Justice Kentaji Brown Jackson said the administration “is unlikely to succeed on the merits of its challenge to the District Court’s preliminary injunction” and had failed to articulate a valid reason for seeking emergency relief from the court.

However, in a concurring statement, Justice Brett Kavanaugh said he believed there was “a fair prospect” that the final USPS final regulation would be within their legal authority and appeared to cite unreasonably short timelines imposed on states and his primary reason for denying the stay.

“But applying the rule in the 2026 elections would be arbitrary and capricious and in violation of the Administrative Procedures Act because state and local election officials do not have sufficient time to reasonably implement the rule before the elections,” wrote Kavanaugh.

The executive order would have tasked the USPS with verifying  voter citizenship and the validating ballot materials. The order would have created a barcode tracking system for mail ballot envelopes and “State Citizenship Lists” compiled by the Department of Homeland Security.

The order was quickly challenged by states and voting rights organizations, who argued the executive branch had no constitutional authority to dictate how they maintained their voter rolls.

The White House has justified the order by claiming the federal government has “an unavoidable duty” under Article II of the Constitution to maintain confidence in election outcomes by preventing violations of criminal law, including noncitizen voting.

Lower courts disagreed, blocking the executive order from being put in place before November. The petition to the Supreme Court represented the administration’s best and final hope for judicial relief.

As the administration fought the matter in courts, it moved ahead finalizing the USPS rule. A whistleblower complaint alleged that a “rushed” effort by the White House and U.S. Postal Service to install three new restrictive IT systems meant to verify citizenship that could potentially deny thousands of mail-in ballots if the federal government disagrees with states on a voter or ballot’s eligibility.

While Jackson and Kavanaugh’s rationale took up less than half a page, a dissenting opinion written by Justice Samuel Alito and signed by Justice Clarence Thomas was more than 7 pages long.

Alito wrote that he would have granted the Trump administration their request for a stay, allowing the order to be implemented in time for the 2026 elections. He said states and organizations suing the government lacked standing, and dismissed their concerns that implementing the USPS order ahead of the 2026 elections would thwart their ability to educate voters about mail-in voting, calling them “abstract social interests.”

Ahead of the decision, David Becker, executive director of the nonprofit Center for Election Integrity and Research, told reporters that he doubted members of the Supreme Court majority “want to own the chaos that would ensure” as the USPS, states and voters attempt to navigate changes put in place just months before elections and after many states have begun sending out ballots that do not comply with the proposed rules.

He also said that it would be in line with previous Supreme Court decisions that have recognized state supremacy when it comes to specific election administration authorities, like where and how their citizens vote.

“When they consider issues related to the administration of elections, the casting and counting of ballots, they have sided with the states every time,” said Becker.

The post Supreme Court denies Trump request to allow USPS mail ballot changes appeared first on CyberScoop.

A newly released whistleblower complaint reveals details about the “rushed” effort by the Trump administration and U.S. Postal Service to install three new restrictive IT systems that would potentially deny thousands of mail-in ballots, if the federal government disagrees on their eligibility.

According to the complaint, written by attorneys at the nonprofit Whistleblower Aid and released by Sen. Richard Blumenthal, D-Conn., the individual is a federal employee with “direct knowledge of potentially catastrophic problems” related to USPS’ handling of mail-in ballots for the upcoming 2026 midterm elections.

The person claims that USPS is deploying entirely “new and untested” IT systems, including a new Federal Ballot Mail Portal that would potentially give USPS more control over whether and when voters receive federal mail ballots.

The disclosure describes the portal and other systems as “new IT systems and corresponding protocols [that] will govern the delivery of ballots to voters as soon as the 2026 mid-term federal elections and beyond.” It calls the development process “secretive, rushed, chaotic and fundamentally flawed,” and part of a larger effort by agency leaders to rush implementation of the system ahead of the 2026 elections.

That rush has forced USPS to forgo much of the pre-release testing of those systems to ensure they work as intended and can safely interoperate with other federal systems. As a result, the whistleblower says the portal is so restrictive it can potentially reject large batches of mail-in ballots based on a single identified ballot error.

According to the letter, there are three primary new IT systems USPS is rolling out this election cycle. The Federal Ballot Mail Portal stores both voter names and newly placed ballot barcodes, while a new verification system will compare ballot batch manifests with information in the portal. A third system is described as a new physical barcode sampling verification standard “with a zero percent failure rate.”

“The Whistleblower paints a dire picture of a slapdash software development process as the USPS attempted to create this complex IT system, with multiple points of ballot review, in a matter of weeks,” the letter said. “The very manner in which the project is being developed deviates dangerously from even the most basic software development best practices.”

In all three cases, the onus is explicitly placed on state election officials to resolve discrepancies between federal and state systems.

For example, when the federal government and election officials have different data on batch manifests, which can include tens of thousands of ballots, “election officials will be responsible for resolving any errors purportedly identified in the scan, and for resubmitting the batch manifest – USPS will refuse to accept the ballot batch until the errors are resolved.”

A similarly restrictive approach is described for verifying ballot bar codes.

“As presently designed, if even one bar code on one single ballot in a bulk-mailing of 10,000 ballots fails to properly scan during the verification process, the entire batch is rejected and sent back to the state – effectively stopping the ballots from being mailed to voters,” the letter stated.

But the whistleblower said those kinds of small errors are likely to happen in any process that relies on scanning barcodes. In this case, the rushed development and specific location of the barcodes on federal mail ballots means the portal “will almost certainly have significant operating problems.”

The letter says the whistleblower is aware of concerns “among those whose job it is to build this software” that the project is not subject to standard testing and debugging work, and that the systems were escalated to other testing environments before they were even finished. It also claims that the systems’ development was siloed across different teams, with no time to test different software components individually or the system as a whole.

The whistleblower also claims that the USPS rule changes,  which have been subject to multiple court injunctions, have continued throughout, in violation of federal court orders. Despite those orders, the agency is believed to have started work on the IT systems in June 2026.

In response, Democrats on the House Committee on Oversight and Reform led by Robert Garcia, D-Calif., wrote to Postmaster General David Steiner saying the disclosures indicate the new IT systems are “faulty” and demanding USPS “immediately cease implementation of this irresponsible and illegal scheme.”

“To be clear, any actions taken by the Postal Service that prevent any registered voter, let alone millions, from voting are unacceptable, a violation of Americans’ voting rights, and likely illegal,” the members wrote.

David Becker, executive director of the Center for Election Innovation and Research, said the disclosures could potentially lead to new lawsuits against USPS and the federal government.

“This seems to confirm that the USPS is totally unprepared and unqualified to take on this vast responsibility interjecting itself into state’s mail voting processes,” said Becker on Bluesky. “And could incur liability if USPS truly plans to reject thousands of ballots if there’s even one error.”

The post Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots appeared first on CyberScoop.

A class action lawsuit filed by victims of child sexual abuse material (CSAM) accuses xAI of training Grok’s synthetic deepfake “nudify” capabilities on real images and videos of child abuse.

The lawsuit, filed Wednesday in the U.S. District Court for the Northern District of California, names Jane Doe 1 and other anonymous individuals as plaintiffs, calling Doe “an identified victim of child pornography tracked by the Federal Bureau of Investigation’s Child Exploitation Notification Program.”

Doe was a pre-school aged child when her perpetrator’s abuse began and continued for years, for the explicit purpose of making CSAM material to distribute online. Media depicting the victim has circulated online since at least the early 2000’s, with, according to the lawsuit “hundreds of thousands of files” being included in law enforcement submissions to the National Center for Missing & Exploited Children (NCMEC).

As part of the FBI’s program, she still receives updates when images related to her abuse surface online, and the suit alleges her material has “well known hash-values” that have shown up in deepfakes created with Grok and spread on X.

“CSAM depicting Plaintiff has been found on xAI as part of investigative reporting, takedown request efforts, and criminal investigations, arrests, and convictions for violations of state and federal laws,” the lawsuit states. It also claims “xAI, using Grok, has generated images depicting Plaintiff and the child pornography series in which she is the victim.”

The lawsuit cites “Masha’s Law” as the basis for its allegations. That law, passed in 2018,  protects civil legal remedies to victims of child pornography and online exploitation.

According to an analysis by the Center for Countering Digital Hate, during an 11-day period between Dec. 2025 and Jan. 2026, Grok created more than 3 million sexualized images, at least 23,000 of which appeared to depict children.

On Jan. 14, after the period tracked by the center, Musk wrote on X that he was “not aware of any naked underage images of Grok. Literally zero.” Must also implied that users, not his technology, were primarily responsible for images created using Grok while simultaneously claiming the model “will refuse to produce anything illegal” if asked.

The suit claims that while other competitors enacted guardrails to prevent their AI models from generating “nudified” images of adults and children, xAI “did the opposite,” embedding Grok and it’s deepfake capabilities directly into X, effectively creating an instantaneous CSAM generation and distribution system for the internet.

While xAI said it built in guardrails to prevent Grok from creating deepfake sexualized images, the suit notes that they are “very weak,” diverge from standard industry best practice and can be easily circumvented.

The system rejects prompt prompts where the chatbot detects “clear intent by the user in the phrasing of their request,” the complaint stated. “Indirect or euphemistic prompts can easily slip past a text-based filter, so if the model retains the underlying capability to generate sexual or abusive content, some volume of CSAM becomes effectively inevitably generated by the system.”

The lawsuit also notes that Grok’s terms of service treat anything that gets posted on X as training material, meaning any CSAM material posted on the site over the past year was likely ingested by the model.

The alleged victims are asking for monetary damages along with injunctions to prevent Grok from creating additional harm through future sexualized deepfakes or CSAM. The suit lists “thousands” of members in the class, all with similar claims against xAI.

A request for comment on the lawsuit sent to xAI was not returned.

Grok’s nudification capabilities, and xAI owner Elon Musk’s dismissive public attitude around the fallout have led to international outrage, criminal investigations and a wave of private lawsuits against the company.

Another lawsuit against X filed earlier this year claims that a man used Grok to generate thousands of instances deepfake CSAM material of his stepdaughter. That lawsuit also claims xAI withheld information from law enforcement authorities that would have helped them identify the stepfather as the perpetrator. Days after authorities traced and seized the material on the wte, he committed suicide.

In July, Musk sued Minnesota Attorney General Keith Ellison over a new state law that bans nudification technology and impose a $500,000 fine for each instance where an AI tool is used to generate or alter an image in a sexually explicit way. Musk’s lawsuit claims the ban violates the First Amendment.

The post Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities appeared first on CyberScoop.