The Danish Air Force officially established Squadron 729 on Feb. 16, which will operate the four MQ-9B long-range unmanned aircraft out of Aalborg Air Base, located in northern Denmark, starting from 2028.

Earlier this month, Canada, which has acquired 11 of the same General Atomics-made drones that it will receive around the same time, signed a defense cooperation agreement with Denmark at the Munich Security Conference. The systems are planned to be based in different locations, including Nova Scotia on the east coast and British Columbia on the Canadian west coast.

The team-up brings together two Arctic nations that have repeatedly drawn the ire of Donald Trump since he assumed his second term as U.S. president in early 2025. Trump harbors a grudge against Canada for not wanting to be part of the United States, and against Denmark for having no interest in giving him the Danish autonomous territory of Greenland.

The defense-technical nexus around the MQ-9B drone holds promise in forging a closer connection between Ottawa and Copenhagen, as there is currently no formal maintenance-sharing or data-sharing arrangement between the two nations, according to issue experts.

“A joint logistics or maintenance hub would absolutely be strategically beneficial for them – maintaining equipment and operating bases in the region is very expensive – sharing facilities and having an integrated logistics system can make operations easier and more efficient for all parties involved,” Jens Marquard Sørensen, director of a Danish consulting company, said.

Still, both countries must first evaluate whether their operational plans match up.

For example, basing the Danish fleet at Aalborg Air Base would colocate the equipment with air force maintenance expertise there, but it’s a long way from strategic patrol points in Greenland, said Sørensen.

“The long distances [from Aalborg] to Greenland may pose operational challenges – flight times are long, increasing wear on drones before they arrive for a mission, and they would lose fuel going there. … It also means that any kind of rapid reaction using the MQ-9Bs is not possible, so having a forward operating station in the Arctic itself would be a notable advantage,” he said.

To put this into perspective, the straight-line distance between the Danish air base and Nuuk is approximately 3,324 kilometres (2,065 miles), and commercial jets covering the same route average flight times of about four to five hours.

Rune Raunow, a defense consultant at the Copenhagen-based Rethink Advisory, which advises the Danish Armed Forces, said a Denmark-Canada pact around the U.S.-made surveillance drones would be especially relevant for contingency plans, refueling or emergency landings.

Cooperation on sensors, too, could factor into the equation, Raunow said. While the Canadian government has opted for L3 Harris Wescam MX-20D sensor systems for intelligence and surveillance missions, Denmark has not publicly disclosed its preference.

“The drones are essentially just a platform; what will be more relevant is whether they will buy the same set of communication networks, sensors, optic detection systems, etc. … Being able to track threats in these very remote places would be extremely easier if they were using the same equipment,” Raunow said.

Canada’s MQ-9B purchase was driven by its need to bolster Arctic operations and provide continuous intelligence, surveillance, and reconnaissance, according to government statements.

While stationing its fleet in southern bases is consistent with existing airfields and maintenance infrastructure, these areas are still far from the high Arctic and other regional chokepoints, where the country has increased monitoring needs.

Sørensen suggests that if NATO was to re-open the Keflavík Air Base in Iceland, as a common allied base, even just for emergencies, it could also serve as a possible site for the countries’ MQ-9B fleets. He noted that this location is the easiest point for patrolling north, east, and south of Greenland.

Keflavík Air Base was closed in 2006 and was primarily operated by the U.S. Navy on behalf of NATO. Today, allies conduct routine and rotational fighter and bomber deployments from there, focused on air policing missions.

As a member of NATO, Iceland has no armed forces of its own.

Sørensen added that its position south of the Arctic Circle makes operations easier and less prone to weather-related disruptions, offering a closer alternative than flying from Nuuk or Canada.

“Shipping routes are also always open year-round, making it cheaper to maintain a station or base than anywhere else in the region – technicians, spare parts or even larger equipment can be transported relatively cheaply via regular civilian shipping routes versus shipping to Greenland, which can cost up to 20$ per kilogram in some areas,” Sørensen said.

Other locations to consider may include Northern Canada, which Hans Peter Michaelsen, a defense analyst and former member of the Royal Danish Air Force, highlights as geographically close to the Danish Arctic territory. However, he notes that many of these areas face significant infrastructure limitations that would obstruct the construction of year-round drone facilities.

Clive Higgins, the CEO of Leonardo UK, said that online bot activity promoting the independence of Scotland from the UK reduced as Iranian authorities violently suppressed civil protest this month.

The implication is that Iran has been pushing the cause of Scottish independence through malign cyber activity in a bid to weaken the UK, but slowed its activity as violent protests raged in Iran.

“What has been very interesting over the recent period, given the social unrest in Iran, is the drop off in social media activity and chat bot activity focused on Scotland, elections and independence,” Higgins told Defense News.

On Sunday, Scotland’s first minister John Swinney said he would call for a referendum on Scottish independence if his SNP party wins a majority in Scottish parliamentary elections in May. At a referendum on independence held in 2014, 55% of Scots voted to stay in the U.K.

A report produced by the British parliament’s intelligence and security committee last July said the U.K. was a priority target for Iranian cyber attacks, ranking just behind the U.S. and Saudi Arabia.

“Iran has a high appetite for risk when conducting offensive activity and its intelligence services are ferociously well-resourced,” said committee chairman Kevan Jones at the time. He added, “It supplements this with its use of proxy groups – including criminal networks, militant and terrorist organizations, and private cyber actors – to provide it with a deniable means of attacking its adversaries with minimal risk of retaliation.”

Leonardo has been raising its profile as a cyber security provider, and Higgins said, “We are very clearly aware of the increasing threat from a cyber perspective and our capabilities monitor very regularly state actors who are mobilizing chat bots and social media accounts to disrupt the normal way of life we all enjoy.”

He added, “We are able to see very clearly the actions of state actors where we can identify IP addresses and other elements that articulate to us where things are being done, what kind of messages they are trying to deliver and how they are trying to disrupt U.K. society.”

He said, “There are three or four main state actors. We see a lot from North Korea, Iran, Russia and China. I don’t want to say that is state sponsored activity. It is where the activity derives from.”

Recent assessments from the U.S.-China Economic and Security Review Commission’s 2025 annual report underscore the challenge ahead. According to the report, “China is aggressively positioning itself as a global leader in space technology and exploration, seeking to reshape international governance, influence standards, and displace the United States as the world’s premier space power.”

The report notes China’s operational satellite fleet exceeded 1,060 by mid-2025, with hundreds dedicated to intelligence, surveillance and reconnaissance.

Chief of Space Operations Gen. B. Chance Saltzman has signaled U.S. resolve on this front. During the opening keynote at the Air & Space Forces Association’s Warfare Symposium in March 2025, he made U.S. intentions clear to allies and adversaries alike, declaring, “The Space Force will do whatever it takes to achieve space superiority.”

The April 2025 release of “Space Warfighting: A Framework for Planners” codifies the service’s shift from primarily supportive roles to treating space as a contested warfighting domain, openly emphasizing offensive and defensive counter-space operations alongside traditional enabling capabilities.

In the document’s foreword, Saltzman writes that space superiority “unlocks superiority in other domains, fuels Coalition lethality, and fortifies troop survivability. It is therefore the basis from which the Joint Force projects power, deters aggression, and secures the homeland.”

‘Race to resilience’

Current core U.S. military space capabilities remain foundational but increasingly vulnerable.

Missile warning and tracking systems, such as the Space-Based Infrared System and emerging Next-Generation Overhead Persistent Infrared satellites, provide global detection of ballistic and hypersonic launches, often within seconds of ignition. This capability is supplemented by proliferated low-Earth orbit sensors, including the Space Development Agency’s Tranche 3 tracking layer, a $3.5 billion investment awarded in late 2025 for 72 new satellites planned for launch beginning in 2029.

Protected satellite communication and positioning, navigation and timing networks, including the jam-resistant Advanced Extremely High Frequency constellation and military GPS featuring enhanced anti-jam M-code, ensure resilient command and control in degraded environments.

Space domain awareness tools, such as the maneuverable Geosynchronous Space Situational Awareness Program satellites, operate in near-geosynchronous orbit to conduct close inspections of objects. Upgraded ground-based sensors, including the Ground-Based Optical Sensor System, track orbital objects and potential threats.

While robust, these systems are vulnerable to attacks such as signal jamming, sensor dazzling by directed-energy weapons and cyberattacks — reversible threats that U.S. officials report occur daily or near-daily. U.S. officials note that even temporary disruptions could significantly impair critical joint operations in wartime.

These challenges are driving the service’s “Race to Resilience” initiative, which aims to achieve battle-ready architectures by 2026. Several key milestones in the coming year will advance the Space Force’s readiness in these contested environments.

Boost-phase space-based interceptor prototypes, a proposed weapon system designed to destroy enemy ballistic missiles during the boost phase of their flight, were awarded under competitive contracts for the Golden Dome missile defense initiative in November 2025. Kinetic midcourse awards (hit-to-kill interceptors during the missile’s coasting phase) are expected in February 2026.

Speaking shortly after his appointment at the Space Foundation’s Innovate Space: Global Economic Summit in July 2025, program lead Gen. Michael Guetlein shared his optimism for the program, stating, “I firmly believe that the technology we need to deliver Golden Dome exists today,” highlighting the importance of integrated command and control.

The service will also finalize requirements for the Space Warfighter Operational Readiness Domain, a distributed digital training environment that builds on existing Space Flag exercises, enabling guardians across multiple locations to participate in virtual simulations of contested operations.

Four on-orbit servicing demonstrations are planned for 2026 to test satellite refueling, repair, inspection and maneuvering. These capabilities are essential for maintaining dynamic space operations, extending the lifespan of assets and enhancing resilience in these contested environments. These missions, funded by various DOD entities and commercial partners, mark a key step toward proving the viability of in-space logistics.

Additionally, the Commercial Augmentation Space Reserve will transition from pilot phase to full-scale operations in 2026, targeting 20 contracts by year-end to provide wartime access to commercial satcom networks. This resiliency measure is backed by record fiscal 2026 funding approaching $40 billion, reflecting priorities for hybrid military-commercial architectures.

With threats intensifying, including China’s rapid satellite expansion and Russia’s disruptive capabilities, 2026 positions the Space Force to deliver resilient architectures that ensure U.S. space superiority, enabling joint forces to maintain the edge in any conflict or contested environment.

The agreement announced by SAIC and HavocAI last month will see a link-up between HavocAI’s autonomous surface vessels and SAIC’s advanced joint range extension gateway. The JRE currently streamlines communications for U.S. and allied military forces worldwide and will extend the range of Link 16, a vast, all-domain global C2 infrastructure.

This new move puts nimble autonomous surface vessels able to sweep wide stretches of ocean at the click of a button at the immediate disposal of the Navy and other military forces linked to the JRE gateway. Leadership of both companies shared the details with Defense News in an exclusive interview.

“Being able to be interoperable with the existing network infrastructure with U.S., allied and partner navies is the biggest part,” Barbara Supplee, Executive Vice President, Navy Business Group at SAIC told Defense News. “We are piping the information on a much more expanded range. It’s taking the innovation that HavocAI is putting in the water and matching it with the existing networks.”

Unmanned teamwork

The small vessels made by HavocAI operate as teams using its Collaborative Autonomy Stack system. They can maneuver through harsh environments and perform various tasks independently with minimal human oversight, such as surveillance.

“The vessels communicate with each other. They’re always talking to each other to try to figure out how to execute something efficiently. The only kind of humans involved are in tasking,” Paul Lwin, co-founder and CEO of HavocAI, told Defense News.

Thanks to the new pairing with SAIC, the vessels will now feed information back to military command centers.

“They [the vessels] will connect to Link 16 and all C2 systems at the strategic level,” Lwin added.

Undersea experiments

The JRE has seen investments over the last two years to expand its cloud-based capabilities, but the communications infrastructure already offers robust opportunities for autonomous technology, Supplee told Defense News.

For example, both companies have already partnered to test technology using undersea vessels, which they believe they can potentially expand. “We’ve experimented with it. We believe it can be used prolifically. The communications can work today,” Supplee said.

Lwin said that HavocAI’s use of Starlink can expand the potential of the autonomous surface vessels to communicate with underwater systems. “We can put acoustic modems on our vessels and allow them to communicate with undersea vessels,” he said.

Potential areas of operations

The vessels’ new link-up to the military’s premier C2 infrastructure is hoped to strengthen the Navy’s hybrid fleet and project U.S. seapower in contested areas, such as near the Philippines.

“We believe that this partnership is going to help the Navy realize its vision of thousands of these small USV capable platforms of operating in tandem hybridity in these contested environments,” Supplee said.

“With autonomous systems, you want to remove humans from danger,” Lwin said. “You can send thousands of these out with their sensors, figure out what’s going on in these island chains and send that information back to the crews without putting humans at risk.”

The vessels could potentially be used in the Arctic as well, Lwin told Defense News.

Future uses

Both companies hope that being proactive in combining their strengths will not only expand their technology currently being used in the field but open up new possibilities, they said.

“We’re working to solve the problem at hand in advance of even the requirement so that we can help the Navy scale where it’s needed,” Supplee said.

HavocAI said that the vessels are easy to manufacture and could be produced en masse quickly over the next few years if needed.

“We want to be able to get the U.S. Navy the option right now to deploy thousands of these,” Lwin said. ”What we’re building right now is no longer science fiction. We’re showing with SAIC you can integrate them right now and start to use them as weapons systems right away.”

Veterans Affairs officials plan to rapidly accelerate the rollout of the department’s new electronic health record system this year, adding 13 new sites to the deployment schedule in 2026.

In December, department leaders had announced plans to resume deployment of the controversial Oracle Cerner system in mid-2026, with a few sites implementing training and software over the next 18 months.

But in an interview with Military Times this week, VA Secretary Doug Collins called that schedule too short-sighted and slow. He promised quicker delivery on the pledge of a revamped health records system for patients and employees.

“This has been a $10 billion project that’s not going anywhere,” Collins said. “So I’m pleased to announce right now that we’re moving forward on a new plan that is going to bring by next year double or almost triple the number of hospitals online.

“We’ve worked through standardization. We’ve got some plans now that, after almost two and a half years of nothing, we’re now moving forward to get this project done. There’s a lot going on here that I’m excited about.”

On Thursday eveing, VA officials said that four sites in Michigan would go live with the new records system next year, as had been previously planned. Another nine sites will be added to that list.

The health records overhaul project, launched by President Donald Trump in 2017, was designed to bring veterans’ health records in line with military files for the first time. The project was originally scheduled to take 10 years and cost $16 billion. But nearly eight years later, only six of VA’s 170-plus medical sites are using the software.

That’s because of repeated rollout challenges surrounding the software. Former VA Secretary Denis McDonough announced a full pause of the rollout in April 2023 after concerns from investigators and lawmakers over patient safety regarding lost or missing files from active patients.

Staffers also complained to federal investigators about poor training, frequent system outages and lackluster support programs.

The total cost of the program has already reached $16 billion, with outside advocates warning that figure could rise even higher.

Still, VA and Oracle officials testified to the House Veterans’ Affairs Committee two weeks ago that they were confident the program was back on track. They expressed optimism about the mid-2026 rollout plan.

Collins said since then, he has met with Oracle and VA leaders to push for a more aggressive schedule.

“They’re going to have to face me every week that they don’t get it done,” he said. “Our folks are going to understand that we have to do our part in the contract, and Oracle understands that they want to do the best job they can on their end of the contract.”

VA officials said they are “is pursuing a market-based approach to site selection for its deployments going forward” but did not same any specific locations beyond the Michigan sites.

Collins said he is confident that VA staffers will be able to get the right training and preparation ahead of any new sites being brought online.

“I think the problem was that we didn’t have enough leadership to say, ‘Let’s bring you two together and actually do it,’” he said. “I talk to people. I’m not management by email. I’m management by talking to you. I’m management by hearing from folks. And leadership is about setting a vision, saying this will get fixed.”

Collins’ pledge comes as VA is reviewing its entire workforce organization, with a goal of reducing staffing by roughly 80,000 employees this year. Lawmakers on Capitol Hill have warned that trying to install the new records system without sufficient support staff could result in employee frustration and patient safety issues.

The new rule is the result of a 2022 federal law that directed the U.S. Cybersecurity and Infrastructure Security Agency to develop regulations that require certain entities to report potential cybersecurity breaches or ransomware attacks to the agency. Election offices fall under the requirement because their systems are considered critical infrastructure, along with the nation’s banks, nuclear power plants and dams.

In a letter, the executive board of the National Association of Secretaries of State asked CISA to consider making the rule voluntary, limit the types of information requested and more clearly define what types of cyber incidents would trigger a report. The proposed rule says state and local election offices must report suspected breaches within 72 hours.

The association is holding its summer conference this week in Puerto Rico, and some state election officials have been discussing their concerns directly with CISA Director Jen Easterly, who is attending. Easterly said in an interview Wednesday that she has been reviewing the group’s letter along with comments submitted individually by state election officials. She said her agency would consider the feedback and adjust as necessary.

The rule is not expected to be finalized until sometime next year.

“CISA was stood up to largely be a voluntary agency, and it’s our magic. It is how we’ve been able to build success,” Easterly said, noting the agency held multiple sessions to gather feedback. “We’re taking all the comments on board. We will integrate them into the final rule.”

Utah Lt Gov. Deidre Henderson, who oversees elections in the state, said she was concerned about federal intrusion into state responsibilities. She said states must operate independently of the federal government in administering elections.

“It’s one thing to regulate. They’re regulators; we are operators,” she said. “We actually have to perform these functions. And that rule is an overreach.”

West Virginia Secretary of State Mac Warner agreed, saying CISA had gone too far in drafting the rule.

“Let’s work together in solving this, but don’t come out with edicts and say you must do this, you must report,” Warner said.

Federal overreach?

Minnesota Secretary of State Steve Simon said he would encourage agency officials to take a measured approach, saying he understood why it was important for CISA to collect the information.

“But I just think they need to be careful about the scope and extent of the request,” Simon said. “This can’t be too prescriptive, too granular, and it can’t impose too great a burden. Otherwise, they’re unlikely to get the compliance that they want.”

Kentucky Secretary of State Michael Adams said the proposal was too broad and would create a burden on local election offices that already are overworked and underfunded.

“If they really push this point, they will undo all the good they’ve done with their relationship building. And I think they’ll contribute to the argument that’s already out there that the federal government’s coming to take over our elections,” Adams said.

He said his relationship with CISA has been positive and expressed appreciation of the agency’s work to help local election officials in his state boost cybersecurity awareness and provide training.

“What I don’t want to see is for CISA to treat my staff, my office, like another federal agency where they expect us to report to them,” Adams said. “They’re at their best when they are responsive to us and what we need versus trying to be another top-down federal agency.”

Protecting the nation’s election systems has been a major focus since 2016, when Russia scanned state voter registration systems looking for vulnerabilities. That prompted the Obama administration in early 2017 to add election systems to the list of the nation’s critical infrastructure.

Experts continue to warn that Russia, China, Iran and others remain interested in seeking to undermine U.S. elections.

———————————————————–

Failing to ensure compliance with new requirements can magnify gaps and weaknesses for auditors, akin to writing the organization’s next audit findings and delivering them to its Inspector General with a neat bow on top.

Agencies often view the creation of policy, directives, guidance, and instructions as a self-contained task. Policy shops are established, and their measure of success often is the publication of a number of policy documents. Once a policy is published, the lines of business are left to interpret the policy and develop implementation solutions from the ground up. When looking at the federal government, policy shops can tend to take a hands-off approach to implementation, on the basis that it is best to provide the program with maximum flexibility to implement policy in a way that best suits their organization.

This approach very much emulates the relationship between the federal government and states, where the federal government sets a policy and program directive but allows the states wide latitude for implementation. This approach allows states to innovate and test approaches that suit their demography, culture, and particular needs, which can result in successful pilot programs being adopted and adapted by other states.

However, this process can take time and result in failed experiments. While this type of incubation can be beneficial for creating large scale social and economic programs, it’s not necessarily the most efficient way to implement enterprise data governance policy.

Most organizations are driven to revamp or create a new enterprise data governance policy because there has been an abundance of innovation, new solutions, and problem-solving at the “State” level within the organization, with the agency beginning to feel the pain of the proliferation of data-oriented solutions.

Ungoverned data

For example, one source of pain is that, at a certain point, the proliferation of ungoverned data and data solutions can actually hinder an agency’s maturation towards becoming data-driven.

Consider two different grant programs designing solutions to capture applicant information in an environment which lacks an effective data management policy and a compliance program to hold programs accountable.

The grant programs develop their solution to capture customer data separately in their own silo, and these two different solutions are unlikely to develop the same data standards, data naming conventions, or other aspects of data management that would allow the two programs to integrate easily.

As a consequence, analyzing grant data from the programs for insights on important factors that could make both programs more effective (such as identifying risk indicators that a grantee will fail to deliver) can become significantly more difficult and time consuming.

In this situation, most agencies wanting to adopt data-driven decision-making will turn to creating an analytical platform where data from both programs can be transformed, cleansed, standardized, and integrated. However, this means the development of another data solution with a cadre of data scientists required to curate and normalize the data, which in turn is likely to require a new budget item and new hiring.

Siloed technologies

A second source of pain in an organization with ungoverned data solutions is that the costs of maintaining and supporting these siloed technologies can increase exponentially over time.

Tighter budgets can hinder improvements, debugging, and sometimes basic maintenance, resulting in increasingly poor customer delivery. At this point, the agency may also have realized that while the subject matter of the programs is different, there are significant commonalities among the data services provided that could be streamlined—for example, multiple programs capturing customer data, managing cases, processing benefits applications, and accepting or delivering payments.

Under pressure to reduce costs and improve service, the agency begins looking for ways to centralize its data solutions, only to discover that doing so is expensive, complex, and few of their peer agencies have completed such projects on time and on budget.

Integrating data solutions is significantly more difficult when solutions develop in the absence of an overarching data governance policy and compliance program to help ensure that, as solutions emerge, they are growing in a manner that will be sustainable.

Establishing an enterprise data governance policy is a good first step to bring consistency, interoperability, and other benefits to a data ecosystem, but programs will need to effectively implement that policy in order to create a healthy and sustainable data environment.

Furthermore, if the governance program stops with policy and guidance that merely establishes high-level principles such as “new and existing data systems must adopt standards to ensure data interoperability,” then it is not likely that an actual change will occur in organizational processes or staff behavior.

Sticking with the grant example, for a data governance program to be more effective, it would need to take an active role in designing standards that could work for both grant programs, facilitating discussions and brokering an agreement on the standards for specific required data elements.

It would also need a compliance program with a deadline by which the standards must be adopted to help ensure that those standards were actually being implemented.

Effective compliance

Successful data governance policy programs integrate policy into implementation by using their compliance program as the bridge between policy principles and driving change in data management practice.

Compliance programs achieve this in part by painting a clear picture of what implementation looks like, and does this by establishing concrete expectations of what will be considered successful compliance with policy.

For example, if a data governance policy included a principle of strengthening data quality, the compliance document could articulate that lines of business must establish specific parameters for monitoring data quality aligned with the needs of the program they serve.

A data quality parameter that the compliance program establishes could be that grant recipient payee data will have less than 1 percent of missing values to help ensure timely and accurate delivery of payments.

An effective compliance program should be able to envision a path to evaluate successful compliance. If it cannot do that or needs to rely on a program official’s attestation of compliance, then it is not reasonable to expect the lines of business could comply with a policy directive on their own.

These expectations should be published as part of a compliance policy or procedure so that the lines of business have a yardstick by which to measure their efforts. Ideally, this should focus on the changes the lines of business would need to implement.

For example, a policy principle related to data quality as data is moved across an enterprise might state that data must be complete and maintain its integrity as it moves from one system to another or ingested from an outside source. The compliance program could set criteria that data must be monitored for completeness and integrity such as not incurring any unintended transformations.

The compliance program would further identify any technology performing data movement (including automated data quality monitoring) that would meet this compliance standard, as well as alternative processes a program could implement that would constitute appropriate monitoring of data movement.

This type of information not only paints a clear picture for the program of how they can comply, but also gives them enough information to assess how much effort the program will need to meet the compliance criteria.

‘Easy path’

It is worth noting that the technology and processes cited by a compliance program do not mean that other solutions a program may develop to demonstrate compliance are not to be considered. Rather, the cited technology and process can be examples of an “easy path” to compliance that programs can either adopt or know they already have in place.

In situations where a program develops an alternative approach, the compliance program could evaluate that approach against its criteria—in this case being able to demonstrate that data is moving completely and with integrity.

If the evaluation finds that the program has developed an effective approach, this approach can be added to the compliance program’s list of accepted technologies or processes and shared with other programs as a best practice or, if you will, an additional “easy path” to compliance.

When data governance policy is completed with the publication of a policy document, they can leave program and business leads without direction on prioritization, timelines, and the necessary level of effort and resources needed for implementation.

In many cases, the absence of this information can cause what was previously a willing coalition of business support for better data governance to get cold feet and hinder the passage of new data policies.

A compliance program can help program and business leads set priorities, determine timelines, and plan resources to ensure compliance by adopting and publishing clear criteria for what compliance looks like, as well as a risk-based schedule for its compliance reviews and setting.

Reducing uncertainty for programs regarding how they will be evaluated and what will constitute successful compliance will not only keep a coalition supporting data governance together, but will also drive implementation and change.

Joah Iannotta is Senior Data Governance Expert at ABSG Consulting Inc. Part 2 of this series will explore the practices that data governance compliance programs can adopt to help drive change management.

Initiatives like Executive Order 14028 and CISA’s Binding Operational Directive 23-1 have heightened scrutiny and accountability for security leaders tasked with ensuring network security and compliance. This guidance helps government entities and private sector organizations navigate the threat landscape and improve their security posture. However, diverse directives from the White House, the National Security Agency (NSA), the Department of Homeland Security (DHS), the Securities and Exchange Commission (SEC), and other government entities create confusion over which guidance to follow.

As we navigate the various federal guidelines, it’s important to remember that you’re not alone in this struggle. Security professionals across the board are grappling with legacy tools, siloed security applications, the time-consuming nature of data collection and analysis, and the scarcity of skilled security personnel. These are all factors that complicate efforts to gain comprehensive network insights and prove compliance.

So, where to begin?

Focus efforts on greatest benefit

Vulnerability management is complex and overwhelming for most agencies, often competing with a slew of information from various vendor sources. I like focusing on the basics. The National Vulnerability Database (NVD), the U.S. government’s repository of standards-based vulnerability management data, is one of the most important sources of truth worldwide and a good place to start.

Maintained by the National Institute of Standards and Technology and sponsored by DHS’s National Cybersecurity and Communications Integration Center, the NVD provides detailed analysis and scoring of Common Vulnerabilities and Exposures (CVEs) to help organizations prioritize their response to vulnerabilities. They also publish the Known Exploited Vulnerabilities Catalog which is a great supplement. In 2024 NIST has already issued nearly 35,000 alerts; agencies need to understand which CVEs are relevant to their network and their degree of exposure.

Private sector CISOs and federal agencies face the dilemma of complying with complex regulatory requirements within limited timeframes and budgets. Executive orders, for instance, are often issued without fiscal budget backing, forcing security leaders to assess their existing systems and contracts to determine if current infrastructure investments will support the new requirements and identify which legacy systems must be updated or removed from the network.

Additionally, security leaders must evaluate which contract terms may help or hinder the evolution of the network to meet new regulatory compliance standards.

The list of considerations goes on, but the point is that budgets are capped, and contracts can constrain the timing and degree of progress. It’s easy to get distracted by all the noise around new standards and guidelines but stay focused on the regulations that matter to your organization.

Adopt multifunctional technologies

While a private sector organization typically operates one network, the federal government operates multiple. Some examples include unclassified, secret, and top-secret networks, each with its own rules and network challenges. Users often have to contend with challenging military operating environments and low bandwidth connections. In addition, regardless of the challenges, each network must continue to comply with cybersecurity regulations.

The diverse nature of these environments means that security teams must possess expertise across multiple platforms. The scarcity of skilled security personnel exacerbates this challenge, as organizations struggle to find and retain professionals with the necessary knowledge and experience.

To expedite compliance efforts, utilize solutions that provide greater network visibility and are familiar to a broader community of security professionals. Also, adopt multifaceted, versatile technologies and rely less on bespoke solutions. This approach provides more flexibility and scalability to meet evolving guidelines. For example, consider the benefits of automated security and compliance tools. These tools can significantly reduce the time and effort required for data collection and analysis by automating routine tasks and providing centralized visibility into the network.

Additionally, agencies implementing a zero trust architecture require continuous verification of user and device identities. This approach minimizes the attack surface and enhances the overall security posture. By integrating zero trust principles with automated tools, organizations can achieve a more resilient and compliant security framework.

Efficient evidence collection

The shift toward hybrid and multi-cloud environments adds layers of complexity to cybersecurity and compliance efforts. These geographically dispersed systems make it difficult to gain a holistic view of the entire network. This forces security teams to manually aggregate and correlate data from various sources, which is time-consuming and prone to errors. It also hinders the ability to detect and respond to threats promptly, leaving networks vulnerable.

Evidence collection solves this challenge as it requires a comprehensive model of the entire network infrastructure. With end-to-end visibility of the network, even in multi-cloud environments, and capabilities for historical data analysis, path analysis, and compliance monitoring, organizations can more efficiently achieve and maintain a strong security posture and compliance, even with evolving standards.

Behavioral analysis and attack surface management are key components of an effective evidence collection strategy. These capabilities enable security professionals to proactively verify that network behavior aligns with intended configurations and identify anomalies. Additionally, security professionals can simulate the network environment and conduct detailed analysis without impacting live operations. In this controlled setting, security professionals can identify potential vulnerabilities and remediate issues faster.

Staff retention, collaboration

Evolving security guidelines are creating increased demand for cybersecurity professionals. However, the cybersecurity industry is concurrently grappling with a skills gap, where there are more job openings than qualified candidates available to fill them. To address this issue, organizations should prioritize investments in training and development programs. By enhancing the skills of existing staff and fostering a culture of continuous learning, organizations can cultivate a more adept and knowledgeable security team while retaining valuable talent.

Retaining security professionals is crucial for organizations to achieve compliance. These professionals develop deep expertise and knowledge of the organization’s systems and processes over time. This institutional knowledge is invaluable as experienced security staff can oversee the continuous implementation and management of security policies and practices necessary for ongoing compliance. Cross-functional software systems can improve collaboration by providing the entire organization access to accurate information about the hybrid multi-cloud environment.

Retaining staff also contributes to efficient audits and assessments. They are well-versed in the organization’s compliance history and processes, enabling them to prepare effectively for audits and respond promptly to assessment findings.

Additionally, collaboration plays a crucial role in navigating the complexities of achieving, maintaining, and proving compliance. Partnering with security professionals in other departments or across entities can break down silos and promote the sharing of resources and knowledge. A collaborative approach can facilitate the adoption of similar technologies and encourage transparency in sharing successful approaches and solutions. By avoiding redundant efforts and isolated strategies, departments and organizations can collectively navigate cybersecurity and compliance challenges.

The complexities of federal cybersecurity guidance necessitate a multifaceted approach to achieving compliance. Understanding what regulations are applicable and implementing multifaceted technologies and frameworks, such as automated tools and a zero trust architecture, enables organizations to adapt to evolving standards more easily. Additionally, prioritizing evidence collection helps organizations gain end-to-end visibility, compliance verification, and network monitoring for vulnerabilities. Amidst these changes, retaining security professionals is critical for developing effective strategies and leveraging institutional knowledge.

These four strategies empower federal and private sector entities to enhance their security posture swiftly, achieve compliance efficiently, and fortify their networks against emerging threats.

Matt Honea is Head of Security and Compliance for Forward Networks.

An FBI investigation revealed that Teixeira, a 22-year-old who ran a server on Discord called “Thug Shaker Central,” spent much of his life online, talking primarily with other young men via message, video calls and voice chats. He chatted about guns and military gear, threatened his school, made racist and antisemitic jokes, traded conspiracy theories, discussed antigovernment sentiments, and in a bid to show off, shared some of the military’s most closely guarded secrets about the Russia-Ukraine war and the Middle East.

By the time the young airman was arrested in 2023, media scholar PS Berge had been studying Discord and its users for three years and had created an online consortium of other academic researchers who were doing the same. That an intelligence leak occurred on the site, creating a national security incident, didn’t come as a shock to her.

“My response was, ‘Of course. Of course this would happen on Discord,’” Berge said. “Because on a platform like this, you share everything with your people. Everything about your life. So, why not share national security secrets?”

Teixeira pleaded guilty in March to six counts of willful retention and transmission of national defense information. His sentencing is scheduled for September, and prosecutors are asking that he serve between 11 and 17 years in prison.

The same month Teixeira agreed to a plea deal, the FBI revealed it had investigated another service member in 2022 for leaking information on Discord.

Former Air Force Staff Sgt. Jason Gray, who served as a cyber analyst at Joint Base Elmendorf-Richardson, Alaska, admitted to running a Facebook group for followers of Boogaloo, a loosely organized, antigovernment movement that advocates for a second Civil War. Gray was disgruntled with his military career, and he discussed his dissatisfaction with the U.S. government in several Discord channels created for the Boogaloo movement, according to a 2022 FBI affidavit that was unsealed in March.

Gray, who used the account name LazyAirmen#7460, was accused of posting a classified image in a private Discord channel that he “likely obtained” from his access to National Security Agency intelligence, the affidavit states.

Investigators said the image could’ve been shared “in furtherance of the Boogaloo ideology,” but didn’t elaborate on the image’s details. It’s uncertain whether the FBI is still investigating the potential leak. But while searching Gray’s electronic devices for evidence of an intelligence breach, authorities discovered hundreds of images of child pornography. Gray is currently serving five years in federal prison on multiple child pornography charges.

Oversharing is a hallmark of Discord, an online world where members of certain channels talk all day, every day, and even fall asleep together on voice calls, said Megan Squire, a computer scientist and deputy director for data analytics at the Southern Poverty Law Center.

People who study the platform agree that it’s not inherently bad — it’s used by millions of gamers, students, teachers, professionals, hobbyists and members of the military community to communicate and socialize. However, extremists have hijacked a part of the platform to radicalize and recruit others to their causes, said Jakob Guhl, senior manager for policy and research at the Institute for Strategic Dialogue.

Following the leak of national security secrets and other high-profile, nefarious uses of the platform in recent years, researchers are grappling with what to think of the platform’s small but headline-grabbing dark side, and many disagree on whether Discord as a company is doing enough to root out bad actors.

“It’s always a bit difficult to strike the right tone between not scaring people off the platform, because the majority of users are completely fine, but also highlighting that there is an actual issue of radicalization,” Guhl said. “It’s not the biggest or most offending platform, but it definitely plays a crucial role among this network.”

‘Not inherently evil’

The National Consortium for the Study of Terrorism and Responses to Terrorism, known as START, studied decades of violent extremist attacks and found a military background to be the most commonly shared characteristic among those who committed or plotted mass casualty attacks from 1990 through 2022, more so than criminal histories or mental health problems.

Researchers from START said the study revealed why extremist groups tend to focus recruitment efforts toward people with military service records: Even a small number of them can have an outsized impact inside extremist movements.

While such recruitment occurs on Discord, Guhl, Berge and Squire agreed that the mere presence of service members and veterans on the platform isn’t a cause for concern.

“It’s a popular platform and not inherently evil,” Squire said. “I’d be much more concerned about military folks on 4chan, Telegram, places like that. Nothing good is happening on those platforms, but Discord could be useful.”

In fact, Berge said, it can be a valuable forum for marginalized people to foster a sense of community. On its “about” page, Discord describes its mission as one that helps users find a sense of belonging.

“Discord is about giving people the power to create space to find belonging in their lives,” the company’s mission statement reads. “We want to make it easier for you to talk regularly with the people you care about. We want you to build genuine relationships with your friends and communities close to home or around the world.”

That’s what the veterans group Frost Call is doing on the platform. The nonprofit encourages veterans and service members to stay connected through gaming, one of its founders told Military Times last year. As of June, it boasted 390 members.

“When we founded Frost Call, we built an organization around this idea of bringing veterans together, helping to improve camaraderie that’s missing from military service,” Marine Corps veteran Wesley Sanders said last year. “It serves an enormous mental health need, but also … an existential need for a lot of veterans.”

Moreover, when new users join Discord, extremist elements of the platform are not easily visible.

Discord is made up of millions of servers centered on various topics. Users can join up to 100 servers, and each server has numerous text, voice and video channels. When a new user creates an account and searches servers to join, the platform will suggest “its most popular, most successful, public-facing communities,” rather than any disquieting, invite-only communities, Berge said.

“If you are a standard user, and if you’re signing in to Discord for your general interests — maybe you’re looking for fellow students or fellow veterans — 90% of the time, you’re not going to accidentally stumble upon an extremist group,” she said. “They actually go through a lot of effort to make these spaces insulated, to make them difficult to find.”

When using Disboard, a third-party search platform for Discord servers, prompts such as “Nazi” or “white supremacist” won’t elicit results like they used to, Berge said. In a 2021 study, she found thousands of Discord servers that marketed themselves on Disboard as hateful and Nazi-affiliated spaces.

“You used to be able to search for those terms and find communities. It was horrifying,” Berge said. “Those servers still exist, but they’ve changed the ways they’re identified, and in some cases, we know that high-profile, toxic communities have been shut down.”

Extremists find a foothold

Founders Jason Citron and Stan Vishnevskiy created Discord in 2015 as a way to allow friends around the world to communicate while playing video games online. Its popularity exploded during the Covid-19 pandemic, when lockdowns went into effect and many people became more isolated than ever before.

Just two years after it launched, Discord gained notoriety as the platform of choice for facilitators of the 2017 “Unite the Right” rally in Charlottesville, Virginia. Organizers, including some veterans, used Discord to share propaganda and coordinate the protest, which turned deadly. James Fields was convicted of killing Heather Heyer when he drove his car into a group of counterprotesters. Fields had joined the Army in 2015 but was separated quickly because of a cited lack of motivation and failure to train.

In 2022, Discord made headlines again after a mass shooting at an Independence Day parade in Highland Park, Illinois, where seven people were killed and dozens more injured. The suspected shooter ran his own Discord server called “SS,” where he complained about “commies,” short for “communists,” according to posts archived by the nonprofit website Unicorn Riot.

That same year, an 18-year-old white gunman killed 10 Black people at a supermarket in Buffalo, New York. The gunman, Payton Gendron, spent months writing plans for the attack in a diary he kept on a private Discord server, visible only to him. About 30 minutes before the attack, Gendron sent out invitations for others to view the diary, and 15 people accessed it, according to Discord.

The platform again faced scrutiny following Teixeira’s leak of national security secrets.

“It’s periodic. Every couple of years, it seems like there’s something,” Squire said. “There are other platforms that are worse, but Discord keeps coming up over and over again.”

Research institutions such as the Institute for Strategic Dialogue found that Discord serves as a hub for socializing and community-building across far-right groups, including Catholic extremists, the white supremacist Atomwaffen Division and the antigovernment Boogaloo movement.

Extremist groups value the platform’s layers of privacy and anonymity, as well as its chat and video functions and collaborative nature, Guhl said. Berge described it as a walled garden, or an online environment where user access to content can be controlled. Servers come with the capability to assign hierarchy to different members and allow some members to access information that others can’t, the researchers said.

“In, say, a Twitter direct-messaging thread or Facebook DM, you don’t really have levels and hierarchies,” Squire said. “Discord really allows you to have more fine-grained ranking structures.”

Another reason for the prevalence of extremists on the platform stems from its roots in gaming, Guhl surmised.

Rachel Kowert, a globally recognized researcher on gaming and mental health, has spent five years researching extremism in video game communities. Though gaming itself is a powerful tool for connection and growth, extreme and hateful ideologies are now commonplace in those spaces, Kowert said.

“If you’re spending a lot of time in the social or gaming spaces where misogyny is commonplace, that can in turn start to internalize in the way you see the world and interact in it,” Kowert said.

Fighting a dark legacy

The existence of far-right groups on Discord — and the high-profile instances of extremism on the platform in the past several years — has spawned its “extremist legacy,” one from which it’s now trying hard to distance itself, said Berge.

Discord said it removed more than 2,000 far-right-affiliated servers following the “Unite the Right” rally. After the Buffalo killings, it removed Gendron’s server and worked to prevent the spread of content related to the attack, the company said. At that point, Discord agreed it “must do more to remove hate and violent extremism.”

“We created Discord to be a place for people to find belonging, and hate and violence are in direct opposition to our mission,” the company said in a statement at the time. “We take our commitment to these principles seriously and will continue to invest in and deploy resources.”

Earlier this year, the company reported that 15% of its staff works on its user safety team, which cracks down on harassment, hateful conduct, inappropriate contact, violent and abusive imagery, violent extremism, misinformation, spam, fraud, scams and other illegal behavior.

During the investigations into Teixeira and Jason Gray, Discord officials immediately cooperated with law enforcement, a company spokesperson told Military Times. And in recent months, Discord has leaned on machine-learning technology to moderate content.

“We expressly prohibit using Discord for illegal activity, which includes the unauthorized disclosure of classified documents,” the spokesperson said.

The company publishes reports each quarter showing actions taken against various accounts and servers. The latest report, published in January, says Discord disabled 6,109 accounts and removed 627 servers that espoused violent extremism during the last few months of 2023.

Squire and Guhl agreed that Discord is “pretty good” at responding to extremist content. Guhl credited the company for including extremism and hate speech in its community guidelines, as well as for deleting servers on a regular basis that breach its terms of service. Discord also created a channel where Squire could flag questionable content on the platform, and the company has been receptive to the concerns she’s raised, she said.

“I credit where credit is due, and I have to give them credit for that,” Squire said. “I think it’s taken seriously, and there are other platforms that I could not say that about.”

Extremists are ‘absolutely still there’

Berge applauded Discord for ramping up the technology behind its moderation and for introducing IP bans, which restrict a device from accessing the platform, rather than just an account. Still, she sees room for improvement.

Discord should place more emphasis on educating moderators and users about how to recognize when someone is being radicalized and pulled into an extremist space, Berge said. She also criticized the platform for disbanding a program in 2023 that included hundreds of volunteer moderators.

“It wasn’t Discord’s automated flagging systems that caught national security secrets being leaked by Jack Teixeira. It took other users and community moderators digging into it and someone finally reporting it,” Berge said. “Elevating people and giving them tools to moderate is absolutely central to protecting the platform, and that’s one area where I think they’re taking a step back.”

Berge is still researching communities on Discord, four years after she first uncovered a network of white supremacists using the platform as a recruitment ground. Despite its community guidelines and efforts to remove offending servers and accounts, Discord still serves as a meeting place for pockets of extremism.

“They’re harder to find, but they are absolutely still here. We’re still finding them,” Berge said. “It is still one of the most popular spaces for people to congregate, share and be in community with each other, for better or for worse.”

Discord remains the “platform of choice” for some hate groups, noted Squire, who described the company’s fight against extremists as playing whack-a-mole: As soon as one is removed, another pops up. A lack of institutional knowledge among far-right extremist groups is partly to blame, she said.

“Everybody’s always fresh, and they don’t have any structure for teaching one another and learning from mistakes of the past,” Squire said. “That’s convenient for us, because as we keep amassing knowledge, they make the mistake of reusing the technology that’s most convenient, rather than being strategic.”

This story was produced in partnership with Military Veterans in Journalism. Please send tips to MVJ-Tips@militarytimes.com.

The Russian state-sponsored hacker infiltrated a Microsoft platform called Microsoft Azure Government, which provides storage, databases and other services to the VA and other government agencies.

VA press secretary Terrence Hayes told Military Times in an email that the server was breached “for just one second, presumably to see if the credentials worked” by a group called Midnight Blizzard, or Nobelium, which has ties to the Russian government, according to Microsoft.

“After investigating the matter, we determined that no patient data was compromised,” Hayes told Military Times. “VA found that Midnight Blizzard used a single set of stolen credentials to access a Microsoft Cloud test environment around January. … We are continuing to look into this matter with Microsoft to ensure that all veteran patient data remains protected and that we are not compromised in the future.”

Stars and Stripes previously reported the hack.

Microsoft said the attack originally targeted corporate email accounts within the company, including the company’s senior leadership, in an effort to find information related to the group Midnight Blizzard itself. The hacker used a spray attack, which involves using a variety of predictable, simple passwords to try and gain access to an account, according to Microsoft.

“The attack was not the result of a vulnerability in Microsoft products or services,” Microsoft officials said in a January statement. “To date, there is no evidence that the threat actor had any access to customer environments, production systems, source code or AI systems.”

Hayes told Stars and Stripes that the attack was unrelated to a Feb. 21 hack, which involved a private vendor, Change Healthcare, responsible for processing health care payments.

That attack included an expansive breach of the U.S. health care system, possibly including the VA. Fifteen million veterans were notified that their private health care information could have been compromised, Veterans Affairs Sec. Denis McDonough said in April.

The cybersecurity attack also included the Peace Corps and the U.S. Agency for Global Media, an independent news group of the federal government that produces Voice of America, Radio Free Europe and Free Asia, according to Stars and Stripes.