Clive Higgins, the CEO of Leonardo UK, said that online bot activity promoting the independence of Scotland from the UK reduced as Iranian authorities violently suppressed civil protest this month.

The implication is that Iran has been pushing the cause of Scottish independence through malign cyber activity in a bid to weaken the UK, but slowed its activity as violent protests raged in Iran.

“What has been very interesting over the recent period, given the social unrest in Iran, is the drop off in social media activity and chat bot activity focused on Scotland, elections and independence,” Higgins told Defense News.

On Sunday, Scotland’s first minister John Swinney said he would call for a referendum on Scottish independence if his SNP party wins a majority in Scottish parliamentary elections in May. At a referendum on independence held in 2014, 55% of Scots voted to stay in the U.K.

A report produced by the British parliament’s intelligence and security committee last July said the U.K. was a priority target for Iranian cyber attacks, ranking just behind the U.S. and Saudi Arabia.

“Iran has a high appetite for risk when conducting offensive activity and its intelligence services are ferociously well-resourced,” said committee chairman Kevan Jones at the time. He added, “It supplements this with its use of proxy groups – including criminal networks, militant and terrorist organizations, and private cyber actors – to provide it with a deniable means of attacking its adversaries with minimal risk of retaliation.”

Leonardo has been raising its profile as a cyber security provider, and Higgins said, “We are very clearly aware of the increasing threat from a cyber perspective and our capabilities monitor very regularly state actors who are mobilizing chat bots and social media accounts to disrupt the normal way of life we all enjoy.”

He added, “We are able to see very clearly the actions of state actors where we can identify IP addresses and other elements that articulate to us where things are being done, what kind of messages they are trying to deliver and how they are trying to disrupt U.K. society.”

He said, “There are three or four main state actors. We see a lot from North Korea, Iran, Russia and China. I don’t want to say that is state sponsored activity. It is where the activity derives from.”

Recent assessments from the U.S.-China Economic and Security Review Commission’s 2025 annual report underscore the challenge ahead. According to the report, “China is aggressively positioning itself as a global leader in space technology and exploration, seeking to reshape international governance, influence standards, and displace the United States as the world’s premier space power.”

The report notes China’s operational satellite fleet exceeded 1,060 by mid-2025, with hundreds dedicated to intelligence, surveillance and reconnaissance.

Chief of Space Operations Gen. B. Chance Saltzman has signaled U.S. resolve on this front. During the opening keynote at the Air & Space Forces Association’s Warfare Symposium in March 2025, he made U.S. intentions clear to allies and adversaries alike, declaring, “The Space Force will do whatever it takes to achieve space superiority.”

The April 2025 release of “Space Warfighting: A Framework for Planners” codifies the service’s shift from primarily supportive roles to treating space as a contested warfighting domain, openly emphasizing offensive and defensive counter-space operations alongside traditional enabling capabilities.

In the document’s foreword, Saltzman writes that space superiority “unlocks superiority in other domains, fuels Coalition lethality, and fortifies troop survivability. It is therefore the basis from which the Joint Force projects power, deters aggression, and secures the homeland.”

‘Race to resilience’

Current core U.S. military space capabilities remain foundational but increasingly vulnerable.

Missile warning and tracking systems, such as the Space-Based Infrared System and emerging Next-Generation Overhead Persistent Infrared satellites, provide global detection of ballistic and hypersonic launches, often within seconds of ignition. This capability is supplemented by proliferated low-Earth orbit sensors, including the Space Development Agency’s Tranche 3 tracking layer, a $3.5 billion investment awarded in late 2025 for 72 new satellites planned for launch beginning in 2029.

Protected satellite communication and positioning, navigation and timing networks, including the jam-resistant Advanced Extremely High Frequency constellation and military GPS featuring enhanced anti-jam M-code, ensure resilient command and control in degraded environments.

Space domain awareness tools, such as the maneuverable Geosynchronous Space Situational Awareness Program satellites, operate in near-geosynchronous orbit to conduct close inspections of objects. Upgraded ground-based sensors, including the Ground-Based Optical Sensor System, track orbital objects and potential threats.

While robust, these systems are vulnerable to attacks such as signal jamming, sensor dazzling by directed-energy weapons and cyberattacks — reversible threats that U.S. officials report occur daily or near-daily. U.S. officials note that even temporary disruptions could significantly impair critical joint operations in wartime.

These challenges are driving the service’s “Race to Resilience” initiative, which aims to achieve battle-ready architectures by 2026. Several key milestones in the coming year will advance the Space Force’s readiness in these contested environments.

Boost-phase space-based interceptor prototypes, a proposed weapon system designed to destroy enemy ballistic missiles during the boost phase of their flight, were awarded under competitive contracts for the Golden Dome missile defense initiative in November 2025. Kinetic midcourse awards (hit-to-kill interceptors during the missile’s coasting phase) are expected in February 2026.

Speaking shortly after his appointment at the Space Foundation’s Innovate Space: Global Economic Summit in July 2025, program lead Gen. Michael Guetlein shared his optimism for the program, stating, “I firmly believe that the technology we need to deliver Golden Dome exists today,” highlighting the importance of integrated command and control.

The service will also finalize requirements for the Space Warfighter Operational Readiness Domain, a distributed digital training environment that builds on existing Space Flag exercises, enabling guardians across multiple locations to participate in virtual simulations of contested operations.

Four on-orbit servicing demonstrations are planned for 2026 to test satellite refueling, repair, inspection and maneuvering. These capabilities are essential for maintaining dynamic space operations, extending the lifespan of assets and enhancing resilience in these contested environments. These missions, funded by various DOD entities and commercial partners, mark a key step toward proving the viability of in-space logistics.

Additionally, the Commercial Augmentation Space Reserve will transition from pilot phase to full-scale operations in 2026, targeting 20 contracts by year-end to provide wartime access to commercial satcom networks. This resiliency measure is backed by record fiscal 2026 funding approaching $40 billion, reflecting priorities for hybrid military-commercial architectures.

With threats intensifying, including China’s rapid satellite expansion and Russia’s disruptive capabilities, 2026 positions the Space Force to deliver resilient architectures that ensure U.S. space superiority, enabling joint forces to maintain the edge in any conflict or contested environment.

The new rule is the result of a 2022 federal law that directed the U.S. Cybersecurity and Infrastructure Security Agency to develop regulations that require certain entities to report potential cybersecurity breaches or ransomware attacks to the agency. Election offices fall under the requirement because their systems are considered critical infrastructure, along with the nation’s banks, nuclear power plants and dams.

In a letter, the executive board of the National Association of Secretaries of State asked CISA to consider making the rule voluntary, limit the types of information requested and more clearly define what types of cyber incidents would trigger a report. The proposed rule says state and local election offices must report suspected breaches within 72 hours.

The association is holding its summer conference this week in Puerto Rico, and some state election officials have been discussing their concerns directly with CISA Director Jen Easterly, who is attending. Easterly said in an interview Wednesday that she has been reviewing the group’s letter along with comments submitted individually by state election officials. She said her agency would consider the feedback and adjust as necessary.

The rule is not expected to be finalized until sometime next year.

“CISA was stood up to largely be a voluntary agency, and it’s our magic. It is how we’ve been able to build success,” Easterly said, noting the agency held multiple sessions to gather feedback. “We’re taking all the comments on board. We will integrate them into the final rule.”

Utah Lt Gov. Deidre Henderson, who oversees elections in the state, said she was concerned about federal intrusion into state responsibilities. She said states must operate independently of the federal government in administering elections.

“It’s one thing to regulate. They’re regulators; we are operators,” she said. “We actually have to perform these functions. And that rule is an overreach.”

West Virginia Secretary of State Mac Warner agreed, saying CISA had gone too far in drafting the rule.

“Let’s work together in solving this, but don’t come out with edicts and say you must do this, you must report,” Warner said.

Federal overreach?

Minnesota Secretary of State Steve Simon said he would encourage agency officials to take a measured approach, saying he understood why it was important for CISA to collect the information.

“But I just think they need to be careful about the scope and extent of the request,” Simon said. “This can’t be too prescriptive, too granular, and it can’t impose too great a burden. Otherwise, they’re unlikely to get the compliance that they want.”

Kentucky Secretary of State Michael Adams said the proposal was too broad and would create a burden on local election offices that already are overworked and underfunded.

“If they really push this point, they will undo all the good they’ve done with their relationship building. And I think they’ll contribute to the argument that’s already out there that the federal government’s coming to take over our elections,” Adams said.

He said his relationship with CISA has been positive and expressed appreciation of the agency’s work to help local election officials in his state boost cybersecurity awareness and provide training.

“What I don’t want to see is for CISA to treat my staff, my office, like another federal agency where they expect us to report to them,” Adams said. “They’re at their best when they are responsive to us and what we need versus trying to be another top-down federal agency.”

Protecting the nation’s election systems has been a major focus since 2016, when Russia scanned state voter registration systems looking for vulnerabilities. That prompted the Obama administration in early 2017 to add election systems to the list of the nation’s critical infrastructure.

Experts continue to warn that Russia, China, Iran and others remain interested in seeking to undermine U.S. elections.

Initiatives like Executive Order 14028 and CISA’s Binding Operational Directive 23-1 have heightened scrutiny and accountability for security leaders tasked with ensuring network security and compliance. This guidance helps government entities and private sector organizations navigate the threat landscape and improve their security posture. However, diverse directives from the White House, the National Security Agency (NSA), the Department of Homeland Security (DHS), the Securities and Exchange Commission (SEC), and other government entities create confusion over which guidance to follow.

As we navigate the various federal guidelines, it’s important to remember that you’re not alone in this struggle. Security professionals across the board are grappling with legacy tools, siloed security applications, the time-consuming nature of data collection and analysis, and the scarcity of skilled security personnel. These are all factors that complicate efforts to gain comprehensive network insights and prove compliance.

So, where to begin?

Focus efforts on greatest benefit

Vulnerability management is complex and overwhelming for most agencies, often competing with a slew of information from various vendor sources. I like focusing on the basics. The National Vulnerability Database (NVD), the U.S. government’s repository of standards-based vulnerability management data, is one of the most important sources of truth worldwide and a good place to start.

Maintained by the National Institute of Standards and Technology and sponsored by DHS’s National Cybersecurity and Communications Integration Center, the NVD provides detailed analysis and scoring of Common Vulnerabilities and Exposures (CVEs) to help organizations prioritize their response to vulnerabilities. They also publish the Known Exploited Vulnerabilities Catalog which is a great supplement. In 2024 NIST has already issued nearly 35,000 alerts; agencies need to understand which CVEs are relevant to their network and their degree of exposure.

Private sector CISOs and federal agencies face the dilemma of complying with complex regulatory requirements within limited timeframes and budgets. Executive orders, for instance, are often issued without fiscal budget backing, forcing security leaders to assess their existing systems and contracts to determine if current infrastructure investments will support the new requirements and identify which legacy systems must be updated or removed from the network.

Additionally, security leaders must evaluate which contract terms may help or hinder the evolution of the network to meet new regulatory compliance standards.

The list of considerations goes on, but the point is that budgets are capped, and contracts can constrain the timing and degree of progress. It’s easy to get distracted by all the noise around new standards and guidelines but stay focused on the regulations that matter to your organization.

Adopt multifunctional technologies

While a private sector organization typically operates one network, the federal government operates multiple. Some examples include unclassified, secret, and top-secret networks, each with its own rules and network challenges. Users often have to contend with challenging military operating environments and low bandwidth connections. In addition, regardless of the challenges, each network must continue to comply with cybersecurity regulations.

The diverse nature of these environments means that security teams must possess expertise across multiple platforms. The scarcity of skilled security personnel exacerbates this challenge, as organizations struggle to find and retain professionals with the necessary knowledge and experience.

To expedite compliance efforts, utilize solutions that provide greater network visibility and are familiar to a broader community of security professionals. Also, adopt multifaceted, versatile technologies and rely less on bespoke solutions. This approach provides more flexibility and scalability to meet evolving guidelines. For example, consider the benefits of automated security and compliance tools. These tools can significantly reduce the time and effort required for data collection and analysis by automating routine tasks and providing centralized visibility into the network.

Additionally, agencies implementing a zero trust architecture require continuous verification of user and device identities. This approach minimizes the attack surface and enhances the overall security posture. By integrating zero trust principles with automated tools, organizations can achieve a more resilient and compliant security framework.

Efficient evidence collection

The shift toward hybrid and multi-cloud environments adds layers of complexity to cybersecurity and compliance efforts. These geographically dispersed systems make it difficult to gain a holistic view of the entire network. This forces security teams to manually aggregate and correlate data from various sources, which is time-consuming and prone to errors. It also hinders the ability to detect and respond to threats promptly, leaving networks vulnerable.

Evidence collection solves this challenge as it requires a comprehensive model of the entire network infrastructure. With end-to-end visibility of the network, even in multi-cloud environments, and capabilities for historical data analysis, path analysis, and compliance monitoring, organizations can more efficiently achieve and maintain a strong security posture and compliance, even with evolving standards.

Behavioral analysis and attack surface management are key components of an effective evidence collection strategy. These capabilities enable security professionals to proactively verify that network behavior aligns with intended configurations and identify anomalies. Additionally, security professionals can simulate the network environment and conduct detailed analysis without impacting live operations. In this controlled setting, security professionals can identify potential vulnerabilities and remediate issues faster.

Staff retention, collaboration

Evolving security guidelines are creating increased demand for cybersecurity professionals. However, the cybersecurity industry is concurrently grappling with a skills gap, where there are more job openings than qualified candidates available to fill them. To address this issue, organizations should prioritize investments in training and development programs. By enhancing the skills of existing staff and fostering a culture of continuous learning, organizations can cultivate a more adept and knowledgeable security team while retaining valuable talent.

Retaining security professionals is crucial for organizations to achieve compliance. These professionals develop deep expertise and knowledge of the organization’s systems and processes over time. This institutional knowledge is invaluable as experienced security staff can oversee the continuous implementation and management of security policies and practices necessary for ongoing compliance. Cross-functional software systems can improve collaboration by providing the entire organization access to accurate information about the hybrid multi-cloud environment.

Retaining staff also contributes to efficient audits and assessments. They are well-versed in the organization’s compliance history and processes, enabling them to prepare effectively for audits and respond promptly to assessment findings.

Additionally, collaboration plays a crucial role in navigating the complexities of achieving, maintaining, and proving compliance. Partnering with security professionals in other departments or across entities can break down silos and promote the sharing of resources and knowledge. A collaborative approach can facilitate the adoption of similar technologies and encourage transparency in sharing successful approaches and solutions. By avoiding redundant efforts and isolated strategies, departments and organizations can collectively navigate cybersecurity and compliance challenges.

The complexities of federal cybersecurity guidance necessitate a multifaceted approach to achieving compliance. Understanding what regulations are applicable and implementing multifaceted technologies and frameworks, such as automated tools and a zero trust architecture, enables organizations to adapt to evolving standards more easily. Additionally, prioritizing evidence collection helps organizations gain end-to-end visibility, compliance verification, and network monitoring for vulnerabilities. Amidst these changes, retaining security professionals is critical for developing effective strategies and leveraging institutional knowledge.

These four strategies empower federal and private sector entities to enhance their security posture swiftly, achieve compliance efficiently, and fortify their networks against emerging threats.

Matt Honea is Head of Security and Compliance for Forward Networks.

An FBI investigation revealed that Teixeira, a 22-year-old who ran a server on Discord called “Thug Shaker Central,” spent much of his life online, talking primarily with other young men via message, video calls and voice chats. He chatted about guns and military gear, threatened his school, made racist and antisemitic jokes, traded conspiracy theories, discussed antigovernment sentiments, and in a bid to show off, shared some of the military’s most closely guarded secrets about the Russia-Ukraine war and the Middle East.

By the time the young airman was arrested in 2023, media scholar PS Berge had been studying Discord and its users for three years and had created an online consortium of other academic researchers who were doing the same. That an intelligence leak occurred on the site, creating a national security incident, didn’t come as a shock to her.

“My response was, ‘Of course. Of course this would happen on Discord,’” Berge said. “Because on a platform like this, you share everything with your people. Everything about your life. So, why not share national security secrets?”

Teixeira pleaded guilty in March to six counts of willful retention and transmission of national defense information. His sentencing is scheduled for September, and prosecutors are asking that he serve between 11 and 17 years in prison.

The same month Teixeira agreed to a plea deal, the FBI revealed it had investigated another service member in 2022 for leaking information on Discord.

Former Air Force Staff Sgt. Jason Gray, who served as a cyber analyst at Joint Base Elmendorf-Richardson, Alaska, admitted to running a Facebook group for followers of Boogaloo, a loosely organized, antigovernment movement that advocates for a second Civil War. Gray was disgruntled with his military career, and he discussed his dissatisfaction with the U.S. government in several Discord channels created for the Boogaloo movement, according to a 2022 FBI affidavit that was unsealed in March.

Gray, who used the account name LazyAirmen#7460, was accused of posting a classified image in a private Discord channel that he “likely obtained” from his access to National Security Agency intelligence, the affidavit states.

Investigators said the image could’ve been shared “in furtherance of the Boogaloo ideology,” but didn’t elaborate on the image’s details. It’s uncertain whether the FBI is still investigating the potential leak. But while searching Gray’s electronic devices for evidence of an intelligence breach, authorities discovered hundreds of images of child pornography. Gray is currently serving five years in federal prison on multiple child pornography charges.

Oversharing is a hallmark of Discord, an online world where members of certain channels talk all day, every day, and even fall asleep together on voice calls, said Megan Squire, a computer scientist and deputy director for data analytics at the Southern Poverty Law Center.

People who study the platform agree that it’s not inherently bad — it’s used by millions of gamers, students, teachers, professionals, hobbyists and members of the military community to communicate and socialize. However, extremists have hijacked a part of the platform to radicalize and recruit others to their causes, said Jakob Guhl, senior manager for policy and research at the Institute for Strategic Dialogue.

Following the leak of national security secrets and other high-profile, nefarious uses of the platform in recent years, researchers are grappling with what to think of the platform’s small but headline-grabbing dark side, and many disagree on whether Discord as a company is doing enough to root out bad actors.

“It’s always a bit difficult to strike the right tone between not scaring people off the platform, because the majority of users are completely fine, but also highlighting that there is an actual issue of radicalization,” Guhl said. “It’s not the biggest or most offending platform, but it definitely plays a crucial role among this network.”

‘Not inherently evil’

The National Consortium for the Study of Terrorism and Responses to Terrorism, known as START, studied decades of violent extremist attacks and found a military background to be the most commonly shared characteristic among those who committed or plotted mass casualty attacks from 1990 through 2022, more so than criminal histories or mental health problems.

Researchers from START said the study revealed why extremist groups tend to focus recruitment efforts toward people with military service records: Even a small number of them can have an outsized impact inside extremist movements.

While such recruitment occurs on Discord, Guhl, Berge and Squire agreed that the mere presence of service members and veterans on the platform isn’t a cause for concern.

“It’s a popular platform and not inherently evil,” Squire said. “I’d be much more concerned about military folks on 4chan, Telegram, places like that. Nothing good is happening on those platforms, but Discord could be useful.”

In fact, Berge said, it can be a valuable forum for marginalized people to foster a sense of community. On its “about” page, Discord describes its mission as one that helps users find a sense of belonging.

“Discord is about giving people the power to create space to find belonging in their lives,” the company’s mission statement reads. “We want to make it easier for you to talk regularly with the people you care about. We want you to build genuine relationships with your friends and communities close to home or around the world.”

That’s what the veterans group Frost Call is doing on the platform. The nonprofit encourages veterans and service members to stay connected through gaming, one of its founders told Military Times last year. As of June, it boasted 390 members.

“When we founded Frost Call, we built an organization around this idea of bringing veterans together, helping to improve camaraderie that’s missing from military service,” Marine Corps veteran Wesley Sanders said last year. “It serves an enormous mental health need, but also … an existential need for a lot of veterans.”

Moreover, when new users join Discord, extremist elements of the platform are not easily visible.

Discord is made up of millions of servers centered on various topics. Users can join up to 100 servers, and each server has numerous text, voice and video channels. When a new user creates an account and searches servers to join, the platform will suggest “its most popular, most successful, public-facing communities,” rather than any disquieting, invite-only communities, Berge said.

“If you are a standard user, and if you’re signing in to Discord for your general interests — maybe you’re looking for fellow students or fellow veterans — 90% of the time, you’re not going to accidentally stumble upon an extremist group,” she said. “They actually go through a lot of effort to make these spaces insulated, to make them difficult to find.”

When using Disboard, a third-party search platform for Discord servers, prompts such as “Nazi” or “white supremacist” won’t elicit results like they used to, Berge said. In a 2021 study, she found thousands of Discord servers that marketed themselves on Disboard as hateful and Nazi-affiliated spaces.

“You used to be able to search for those terms and find communities. It was horrifying,” Berge said. “Those servers still exist, but they’ve changed the ways they’re identified, and in some cases, we know that high-profile, toxic communities have been shut down.”

Extremists find a foothold

Founders Jason Citron and Stan Vishnevskiy created Discord in 2015 as a way to allow friends around the world to communicate while playing video games online. Its popularity exploded during the Covid-19 pandemic, when lockdowns went into effect and many people became more isolated than ever before.

Just two years after it launched, Discord gained notoriety as the platform of choice for facilitators of the 2017 “Unite the Right” rally in Charlottesville, Virginia. Organizers, including some veterans, used Discord to share propaganda and coordinate the protest, which turned deadly. James Fields was convicted of killing Heather Heyer when he drove his car into a group of counterprotesters. Fields had joined the Army in 2015 but was separated quickly because of a cited lack of motivation and failure to train.

In 2022, Discord made headlines again after a mass shooting at an Independence Day parade in Highland Park, Illinois, where seven people were killed and dozens more injured. The suspected shooter ran his own Discord server called “SS,” where he complained about “commies,” short for “communists,” according to posts archived by the nonprofit website Unicorn Riot.

That same year, an 18-year-old white gunman killed 10 Black people at a supermarket in Buffalo, New York. The gunman, Payton Gendron, spent months writing plans for the attack in a diary he kept on a private Discord server, visible only to him. About 30 minutes before the attack, Gendron sent out invitations for others to view the diary, and 15 people accessed it, according to Discord.

The platform again faced scrutiny following Teixeira’s leak of national security secrets.

“It’s periodic. Every couple of years, it seems like there’s something,” Squire said. “There are other platforms that are worse, but Discord keeps coming up over and over again.”

Research institutions such as the Institute for Strategic Dialogue found that Discord serves as a hub for socializing and community-building across far-right groups, including Catholic extremists, the white supremacist Atomwaffen Division and the antigovernment Boogaloo movement.

Extremist groups value the platform’s layers of privacy and anonymity, as well as its chat and video functions and collaborative nature, Guhl said. Berge described it as a walled garden, or an online environment where user access to content can be controlled. Servers come with the capability to assign hierarchy to different members and allow some members to access information that others can’t, the researchers said.

“In, say, a Twitter direct-messaging thread or Facebook DM, you don’t really have levels and hierarchies,” Squire said. “Discord really allows you to have more fine-grained ranking structures.”

Another reason for the prevalence of extremists on the platform stems from its roots in gaming, Guhl surmised.

Rachel Kowert, a globally recognized researcher on gaming and mental health, has spent five years researching extremism in video game communities. Though gaming itself is a powerful tool for connection and growth, extreme and hateful ideologies are now commonplace in those spaces, Kowert said.

“If you’re spending a lot of time in the social or gaming spaces where misogyny is commonplace, that can in turn start to internalize in the way you see the world and interact in it,” Kowert said.

Fighting a dark legacy

The existence of far-right groups on Discord — and the high-profile instances of extremism on the platform in the past several years — has spawned its “extremist legacy,” one from which it’s now trying hard to distance itself, said Berge.

Discord said it removed more than 2,000 far-right-affiliated servers following the “Unite the Right” rally. After the Buffalo killings, it removed Gendron’s server and worked to prevent the spread of content related to the attack, the company said. At that point, Discord agreed it “must do more to remove hate and violent extremism.”

“We created Discord to be a place for people to find belonging, and hate and violence are in direct opposition to our mission,” the company said in a statement at the time. “We take our commitment to these principles seriously and will continue to invest in and deploy resources.”

Earlier this year, the company reported that 15% of its staff works on its user safety team, which cracks down on harassment, hateful conduct, inappropriate contact, violent and abusive imagery, violent extremism, misinformation, spam, fraud, scams and other illegal behavior.

During the investigations into Teixeira and Jason Gray, Discord officials immediately cooperated with law enforcement, a company spokesperson told Military Times. And in recent months, Discord has leaned on machine-learning technology to moderate content.

“We expressly prohibit using Discord for illegal activity, which includes the unauthorized disclosure of classified documents,” the spokesperson said.

The company publishes reports each quarter showing actions taken against various accounts and servers. The latest report, published in January, says Discord disabled 6,109 accounts and removed 627 servers that espoused violent extremism during the last few months of 2023.

Squire and Guhl agreed that Discord is “pretty good” at responding to extremist content. Guhl credited the company for including extremism and hate speech in its community guidelines, as well as for deleting servers on a regular basis that breach its terms of service. Discord also created a channel where Squire could flag questionable content on the platform, and the company has been receptive to the concerns she’s raised, she said.

“I credit where credit is due, and I have to give them credit for that,” Squire said. “I think it’s taken seriously, and there are other platforms that I could not say that about.”

Extremists are ‘absolutely still there’

Berge applauded Discord for ramping up the technology behind its moderation and for introducing IP bans, which restrict a device from accessing the platform, rather than just an account. Still, she sees room for improvement.

Discord should place more emphasis on educating moderators and users about how to recognize when someone is being radicalized and pulled into an extremist space, Berge said. She also criticized the platform for disbanding a program in 2023 that included hundreds of volunteer moderators.

“It wasn’t Discord’s automated flagging systems that caught national security secrets being leaked by Jack Teixeira. It took other users and community moderators digging into it and someone finally reporting it,” Berge said. “Elevating people and giving them tools to moderate is absolutely central to protecting the platform, and that’s one area where I think they’re taking a step back.”

Berge is still researching communities on Discord, four years after she first uncovered a network of white supremacists using the platform as a recruitment ground. Despite its community guidelines and efforts to remove offending servers and accounts, Discord still serves as a meeting place for pockets of extremism.

“They’re harder to find, but they are absolutely still here. We’re still finding them,” Berge said. “It is still one of the most popular spaces for people to congregate, share and be in community with each other, for better or for worse.”

Discord remains the “platform of choice” for some hate groups, noted Squire, who described the company’s fight against extremists as playing whack-a-mole: As soon as one is removed, another pops up. A lack of institutional knowledge among far-right extremist groups is partly to blame, she said.

“Everybody’s always fresh, and they don’t have any structure for teaching one another and learning from mistakes of the past,” Squire said. “That’s convenient for us, because as we keep amassing knowledge, they make the mistake of reusing the technology that’s most convenient, rather than being strategic.”

This story was produced in partnership with Military Veterans in Journalism. Please send tips to MVJ-Tips@militarytimes.com.

The Russian state-sponsored hacker infiltrated a Microsoft platform called Microsoft Azure Government, which provides storage, databases and other services to the VA and other government agencies.

VA press secretary Terrence Hayes told Military Times in an email that the server was breached “for just one second, presumably to see if the credentials worked” by a group called Midnight Blizzard, or Nobelium, which has ties to the Russian government, according to Microsoft.

“After investigating the matter, we determined that no patient data was compromised,” Hayes told Military Times. “VA found that Midnight Blizzard used a single set of stolen credentials to access a Microsoft Cloud test environment around January. … We are continuing to look into this matter with Microsoft to ensure that all veteran patient data remains protected and that we are not compromised in the future.”

Stars and Stripes previously reported the hack.

Microsoft said the attack originally targeted corporate email accounts within the company, including the company’s senior leadership, in an effort to find information related to the group Midnight Blizzard itself. The hacker used a spray attack, which involves using a variety of predictable, simple passwords to try and gain access to an account, according to Microsoft.

“The attack was not the result of a vulnerability in Microsoft products or services,” Microsoft officials said in a January statement. “To date, there is no evidence that the threat actor had any access to customer environments, production systems, source code or AI systems.”

Hayes told Stars and Stripes that the attack was unrelated to a Feb. 21 hack, which involved a private vendor, Change Healthcare, responsible for processing health care payments.

That attack included an expansive breach of the U.S. health care system, possibly including the VA. Fifteen million veterans were notified that their private health care information could have been compromised, Veterans Affairs Sec. Denis McDonough said in April.

The cybersecurity attack also included the Peace Corps and the U.S. Agency for Global Media, an independent news group of the federal government that produces Voice of America, Radio Free Europe and Free Asia, according to Stars and Stripes.

Airmen and guardians will soon be able to take advantage of the Hypori Halo Workspace Anywhere program that grants access to government apps, email, NIPRNet, sensitive data, and CAC-enabled websites via personal devices, including a phone or tablet, whether they’re in the office or not.

A spokesperson for Hypori did not give an exact date for enrollment, but told C4ISRNET it’s still on track to begin this summer.

“The Air Force and Space Force are actually already using our platform,” said Jared Shepard, CEO and president of Hypori, at the TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International late last month in Baltimore. “Now, they’re going to scale.”

Capitalizing on the need for integrated communications and the pandemic-fueled remote work environment, the Army, including its Reserve and Guard components, already began transitioning service members toward Halo, which as of June 11 became the only way Army.mil users can access Army 365 services from a personal device. Shepard said at the conference that 50,000 Army enrollees are using the service since that BYOD effort began as a pilot in 2022. Hypori was also awarded a contract by the National Geospatial-Intelligence Agency on June 6 to give a third of its workforce remote access to secure networks.

“[BYOD] is a top priority for us, and it is a game changer because when our soldiers and airmen are not at the armory, they have to be connected in a secure way,” said Kenneth McNeill, chief information officer of the National Guard Bureau, in a statement February.

Reservists and part-time members of the services especially have limited access to base networks, so giving them the flexibility to complete work from wherever they are will be a boon to the organization, leaders have said.

“In our dynamic environment, the Department of the Air Force is committed to providing user-friendly enterprise solutions which empower the force to work securely in a wide range of operational contexts,” said Air Force Chief Information Officer Venice Goodwine in a statement in March.

The technology also eliminates the need to carry two devices while ensuring their government and personal data are kept separate to minimize liability. The idea of “no data at rest” means there is no risk of compromise if the enrolled devices are stolen or lost, and it ensures that personal information stored on that device is not accessible by the government.

The technology, which also vets users, is also compliant with White House orders that ban TikTok on government devices due to concerns that the social media platform’s Chinese-based parent company, ByteDance, would get access to sensitive data.

“Industry has a responsibility that if it’s doing work for the Department of Defense, that it protects that data,” Shepard said.

As these advanced systems begin to permeate various industry sectors, including U.S. government agencies, they necessitate a reevaluation of conventional security and auditing frameworks. The term “production ready” will need to be redefined, considering the unique requirements for scalability, interoperability, robustness, resource management, and coordination inherent in these systems. Additionally, addressing ethical and legal considerations, standardizing protocols, ensuring usability and maintainability, and establishing robust performance metrics are essential for successful deployments.

MAS offers the U.S. government enhanced capability in multiple areas, including:

Policy Analysis and Simulation: MAS can simulate complex socio-economic systems to analyze policy impacts. For instance, it can simulate the behavior of citizens, businesses, and governmental organizations to understand the effects of different policies or regulations.

Security and Defense: In defense and security applications, MAS can be utilized for tasks like surveillance, reconnaissance, and threat detection. Agents can work together to gather intelligence, analyze data, and respond to emerging threats in real-time.

Policy Enforcement: MAS can assist in enforcing regulations and policies by monitoring compliance and detecting violations. For example, in tax enforcement, agents can analyze financial data to identify potential cases of tax evasion.

Knowledge Transfer: As employees leave or retire from agencies/companies, their body of knowledge is often lost. With MAS, we can implement a “knowledge gathering agent” who along with a “knowledge deficit agent” can work together to identify knowledge deficits (think of code coverage deficits in software development) and interact with the subject matter experts to capture knowledge through interactive chat sessions.

Smart Infrastructure Management: MAS can be employed to manage and optimize various aspects of infrastructure, such as transportation systems, energy grids, and water distribution networks. Agents representing different components of the infrastructure can collaborate to improve efficiency, reduce costs, and enhance resilience.

Potential pitfalls

In the evolving landscape of system architectures, where traditional setups featuring web applications, REST or GraphQL APIs, gateways, and data meshes starkly contrast with the decentralized, message-driven communication models of MAS, a critical challenge emerges – ensuring robust security within these decentralized networks. This challenge necessitates security measures that not only integrate smoothly with existing security frameworks but also adapt to the unique dynamics of MAS.

Addressing the security conundrum in MAS, especially as they begin to play a significant role in the infrastructure of the U.S. government, demands innovative solutions. Our research and development initiatives are deeply engaged in tackling this and other related challenges, aiming for a seamless adoption of MAS.

A promising move in the right direction is the deployment of specialized agents within the MAS architecture, tasked with the critical role of safeguarding data integrity and access. Such specialized agents epitomize the adaptation of traditional security measures to fit the decentralized, message-driven nature of MAS, ensuring that security does not become an afterthought but a seamlessly integrated component of the system’s architecture.

This specialized security agent example exemplifies the potential of multi-agent systems to not only mimic but also enhance the capabilities of human counterparts in critical areas such as cybersecurity. By maintaining a focus on continuous learning and adaptation (like the professional development of human employees), such agents can offer invaluable assistance in generating secure code and configurations.

Another specific concern is poisoning attacks, which involve introducing malicious data to disrupt agents’ learning and decision-making processes. Effective mitigation strategies include data validation, robust learning algorithms, redundancy, continuous monitoring, secure communication channels, strong authentication, adaptive defense mechanisms, and collaboration with cybersecurity experts. While these challenges are significant, the concerted efforts of researchers and developers in the field ensure that solutions will be found, paving the way for the widespread adoption of MAS and generative AI in the future.

As we continue to explore the frontiers of generative AI and MAS, the journey towards integrating MAS into our technological infrastructure is both challenging and exciting. We believe MAS is the only viable approach to bringing generative AI into the U.S. government in a managed manner due to its ability to leverage existing tools, enable robotic process automation, and ensure comprehensive auditing and tracking

MAS offers a flexible and adaptable approach to modeling and solving complex problems in the federal government, enabling efficient collaboration, decision-making, and resource management across different agencies and domains.

John Mark Suhy is CTO of Greystones Group. He more than 20 years of enterprise architecture and software development experience with agencies including FBI, Sandia Labs, Department of State, U.S. Treasury and the Intel community.

At the TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore last month, Randy Resnick, director of the Zero Trust Portfolio Management Office, said tagging and labeling, the practice of assigning metadata and identifiers to pieces of data, has been a long-term challenge for the department.

“They’ve been apparently working on this for 12 or more years —15 years — and I think it’s time enough to do something,” he said.

By way of an update on these efforts, Resnick said he approved three pilot programs in conjunction with the U.S. Department of Defense Chief Data and Artificial Intelligence Office and the Department of Homeland Security to develop a plan that would allow for all the necessary conversions and interpretations to process any data tagging and labeling standard in an understandable,repeatable way.

The goal is to have a successful demo of a schema by the end of the calendar year. Resnick also set a deadline of October for an internal working group to brief his office on a solution, even a partial one.

“We’re not looking for perfection,” he said at TechNet. “We have to start implementing something, and then it’ll grow over time as people agree to more tags and more labels. It’s got to be flexible enough to allow for growth.”

In a January study by Defense Innovation Board, researchers found “data access remains the central enterprise-level obstacle to the sharing and use of data for the warfighter.” Part of that is because military departments are “haphazardly” placing data leaders throughout the organization while top-level tech leaders are struggling to enforce their position as a unifier. Other persistent issues like a lack of uniform guidance, sustained funding, workforce gaps and technical silos also make progress on broader zero-trust difficult.

For now, there remain roadblocks that separate the DoD from the data economy it wants, but Resnick is realistic about these challenges and said a solution in development is better than nothing at all.

“That’s the type of solution that I personally am looking for, because that’s what the department needs,” he said.

Well known examples include the Human Genome Project, space exploration, Silicon Valley, and biomedical research. Further, in the ever-evolving landscape of science and innovation, the U.S. stands as a beacon for global talent, attracting brilliant minds to its research institutions and universities. This influx of international scientists and engineers has undeniably enriched the nation’s scientific endeavors, leading to countless breakthrough discoveries, transformative innovations, and advancements.

However, amidst the celebration of diversity and collaboration lies a growing concern – the need to balance the openness of the U.S. research enterprise and maintain the nation’s competitive edge on the global stage with the imperative to safeguard national security interests.

Revelations and discussions from this year, as articulated in a GAO Report on Research Security released in January 2024; in remarks made by the Director of National Intelligence, Avril Haines, in her March 2024 testimony before the Senate Select Committee on Intelligence; and in widely reported revelations by the FBI, have highlighted the potential risks associated with foreign researchers working on sensitive projects.

Now, especially as we approach the election, the conversation has turned to how best to protect intellectual property and prevent the unwanted compromise and nefarious exploitation of critical technology by foreign adversaries and other bad actors, including terrorist groups and those that mean to do harm to our national well being. While this is not an easy tension to navigate, it is one we can indeed manage consistent with our national values as we continue to forge ahead with advanced scientific research and technology development to the benefit of all people, everywhere.

At the heart of the matter lies the challenge of finding a solution that does not stifle the flow of talent while ensuring that the nation’s interests are protected. This delicate balance requires a departure from conventional approaches to risk assessment, which often rely on simplistic country-based criteria or blanket restrictions that paint various foreign researchers with the same brush of suspicion.

Instead, what is needed is a nuanced and agile approach – one that leverages technology to identify and mitigate potential risks swiftly and effectively and supplements the work that teams focused on innovation and national security are already doing. Enter the concept of a triage tool – a sophisticated mechanism that incorporates AI capabilities designed to assess the risk posed by international scientists and engineers while expediting the entry of low-risk individuals into the U.S. research ecosystem.

The ideal triage tool, tied to policy that favors the fast tracking of the many scientists who will provide valuable contributions without jeopardizing national security, would possess several key attributes: it must operate without bias, respecting the diversity of backgrounds and nationalities among applicants; it should be automated, ensuring swift processing and scalability without compromising accuracy; and it must prioritize privacy, abstaining from intrusive data collection methods such as biometrics or personally identifiable information.

Furthermore, the tool should complement existing vetting processes, seamlessly integrating into the fabric of U.S. research institutions and agencies. It should be cost-effective, offering significant savings in both time and resources while delivering reliable results with minimal false positives or negatives.

By implementing such a tool, the U.S. can achieve a delicate balance between fostering international collaboration and protecting its national security interests and by establishing robust mechanisms for protecting sensitive information, the U.S. can bolster trust and encourage fruitful collaboration between domestic and international partners. This would not only enhance the experience of foreign researchers seeking opportunities in the U.S. but also provide reassurance to domestic institutions and agencies tasked with safeguarding sensitive information.

The U.S. stands at a crossroads, where the nurturing of global talent is not merely an option but a strategic imperative. Embracing international scientists and engineers is not only a testament to our commitment to excellence but also a catalyst for driving forward the frontiers of human knowledge and ingenuity. In the end, it is not about erecting barriers or shutting the door to international talent – it is about striking a harmonious chord between openness and vigilance, rather than a forced tradeoff between the two.

By embracing innovation in risk assessment and vetting processes, and thereby welcoming the contributions of international talent, the U.S. can continue to lead the world in scientific discovery, address the existing skill gaps, foster global collaboration and culture exchanges, while safeguarding its technological edge for generations to come and fortifying the country’s position as a leader in innovation.

Donald (Don) J. Blersch is Clearspeed’s SVP of Government Innovation. With multi-agency experience, including NASA, the National Oceanic and Atmospheric Administration (NOAA), Central Intelligence Agency (CIA), the Office of the Director of National Intelligence (ODNI), the National Reconnaissance Office (NRO), the Missile Defense Agency (MDA), and the U.S. Department of State’s Bureau of Diplomatic Security, Blersch led the implementation of technology innovation while advising the executive leadership bench on a wide range of security disciplines, enabling the department to meet vital national security responsibilities with a well-vetted and trusted workforce, hyperfocused on the protection of sensitive, classified information.