Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

Show NLP summaries collection recirc on article pages

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Carolyn Hax: Keep scrolling seven hours per day, or give therapy a try?

Ask Amy: Mother isn’t accepting of her gay son

Ask Amy: What do I say about my former walking buddy who yelled at me?

Fooled by AI? These firms sell deepfake detection that’s ‘REAL 100%.’ 

Apple apologizes for iPad ad after blowback 

Google’s new ‘Find My’ device network is useful but a stalking risk

Kristi Noem’s dog killing is pure Southern gothic

Claire Messud turns her family’s history into a masterpiece

Joseph Epstein, conservative provocateur, tells his life story in full

5 big travel lessons from an accomplished conservationist

Cruise ship drags dead whale into New York, prompting investigation

The case for eating at Italian gas stations

The urgent air defense lessons of April 16 

Are smartphones destroying childhood? It’s complicated.

In the campaign against Donald Trump, do the ends justify the means?

Bishop vanished. His species can still be saved.

VCU grads walk out during Gov. Youngkin’s speech

Northern lights glow worldwide

An unexpected sight to behold: Ted Cruz working bipartisan deals

Narrative of Trump snoozing in court takes hold — much to his annoyance

Manafort will no longer take on Republican convention role

I used to dismiss my mom’s advice. Then I found a note she wrote before she died.  

Photos of his mom at lunch are a balm people didn’t know they needed

Dog hit by car loses leg, is adopted by firefighter who helped her

‘Bunker mentality’ at Columbia lit protest spark that spread nationwide

A mystery illness stole their kids’ personalities. These moms fought for answers.

The greatness — yes, greatness — of the Planet of the Apes

Tens of thousands in Georgia protest Russian-style ‘foreign agents’ law

Israeli operations in north and south Gaza force displaced to flee again

‘Nothing left’: At least 300 dead as flash floods devastate Afghanistan

Eighth-inning decision burns the Nats in a 4-2 loss to the Red Sox

Nats win opener at Fenway behind Patrick Corbin and a lockdown bullpen

Commanders rookie DT Johnny Newton needs a second foot surgery

Courtroom photo ban adds to hurdles for Trump trial journalists

Israel’s shameful ban on Al Jazeera

Checks, not sex, and other takeaways from Trump’s New York hush money trial

US-POLITICS-BIDEN

See more coverage in your recommendations

Get the weekly Campaign Moment newsletter

Set alerts for major election developments

Election 2024

The Campaign Moment newsletter

Politics alerts

Welcome to The Cybersecurity 202! One day I might figure out the whole subject of “people,” but for now, they remain a completely baffling mystery.

Reading this online? <a href="https://www.washingtonpost.com/newsletters/the-cybersecurity-202/" target=_blank>Sign up for The Cybersecurity 202 to get scoops and sharp analysis in your inbox each morning.</a>

Below: Microsoft highlights a service that lets hackers use residential IP addresses, and the FTC aims to heighten scrutiny of digital health app data sharing. First:

Transit agencies are particularly vulnerable to cyberattacks, as D.C.’s apparent breach shows

Bill O'Leary

A computer in Russia was used to breach the networks of D.C.’s transit agency this year, according to a watchdog report released this week which also found the agency had significant cybersecurity vulnerabilities left unaddressed.

The breach of the Washington Metropolitan Area Transit Authority (WMATA) was the latest cyber incident for transit in major cities, and showcased the potential for hackers to create havoc in the public transportation sector.

In the case of the D.C. agency also known as Metro, a former contractor “was able to remotely access his personal computer in Russia to log into WMATA systems containing critical and sensitive WMATA data,” according to Wednesday’s inspector general report. But investigators said the cybersecurity deficiencies at the agency could threaten train safety.

“At risk is the nation’s third-largest transit system, responsible for transporting more than 600,000 people a day around the nation’s capital,” <a href="https://www.washingtonpost.com/transportation/2023/05/17/dc-metro-russia-breach-cyber/">my colleagues Justin George and Ian Duncan wrote</a>. “As Metro increasingly relies on technology — launching a mobile fare card and app during the pandemic while aiming to switch to self-piloting trains this year — investigators said the need for strengthened cybersecurity protections will only rise.”

Dating back to 2019, WMATA has not taken action on more than 50 cybersecurity recommendations from oversight agencies, the report said.

Among the cybersecurity issues were vulnerabilities to some of the trains themselves, with an outside contractor in 2019 concluding that the risk was “critical.”

Another cybersecurity issue, according to the inspector general, is that WMATA has had Russia-based contract workers. One of them accessed systems after being barred from working with WMATA.

As for WMATA’s response, “Metro confirmed the inspector general’s account but disputed its description of the incident as a breach, saying in a statement that documents accessed were related to the former contractor’s work,” Justin and Ian wrote.

Metro General Manager Randy Clarke said Metro reported the unauthorized login to the Cybersecurity and Infrastructure Security Agency (CISA), which he said “closed the case without comment.” Officials said that CISA and Microsoft, which makes products that Metro relies on, “did not alert Metro of major cybersecurity problems after reviews.”

“Safety and security is our core value, and we will continue to prioritize improvements in this area,” Clarke said in a statement. He also acknowledged that the agency is remediating deficiencies.

Metro isn’t alone among major-city transit agencies suffering cyber incidents.

A ransomware gang said this year that it exposed stolen data from <a href="https://www.scmagazine.com/brief/ransomware/alleged-vice-society-ransomware-attack-against-san-francisco-bart-probed">San Francisco’s Bay Area Rapid Transit</a>.

Two years ago, hackers hit both New York’s Metropolitan Transit Authority and the Toronto Transit Commission. Chinese government-connected hackers were the suspected culprits <a href="https://www.nytimes.com/2021/06/02/nyregion/mta-cyber-attack.html">in New York’s case</a>, and they didn’t seem to do much harm. <a href="https://cyberscoop.com/toronto-transit-commission-ann-arbor-theride-ransomware/">In Toronto’s case</a>, ransomware attackers did cause trouble, affecting trip-planning apps, the commission’s website and more. (North Korean hackers also <a href="https://www.thestar.com/news/gta/2018/01/23/metrolinx-targeted-by-north-korean-cyberattack.html">came for Toronto’s Metrolinx in 2018</a>, but didn’t appear to have any real impact.)

The year before, in 2020, ransomware <a href="https://bc.ctvnews.ca/printed-ransom-note-asked-translink-for-7-5-million-in-december-cyberattack-1.5389170">struck Vancouver’s TransLink</a>, leading to the disabling of its payment systems. That caused issues for some riders. The hackers also accessed employees’ sensitive personal information, and TransLink lost its communications systems.

Also in 2020, <a href="https://www.inquirer.com/transportation/septa-malware-attack-ransomware-fbi-employees-cybersecurity-20201007.html">hackers hit</a> the Southeastern Pennsylvania Transportation Authority with a ransomware attack. That authority operates the transit network in Philadelphia.

Riders in San Francisco were able to snag free rides after <a href="https://www.forbes.com/sites/thomasbrewster/2016/11/28/san-francisco-muni-hacked-ransomware/?sh=1d1b2f044706">ransomware disrupted the San Francisco Municipal Transportation Agency</a> in 2016.

Transit systems are particularly vulnerable to cyberattacks, Chester Wisniewski, Field Chief Technology Officer at Sophos, told Matt Kapko of Cybersecurity Dive this year.

“They have the worst security by far generally,” <a href="https://www.cybersecuritydive.com/news/ransomware-attack-exposes-california-transit-giants-sensitive-data/640121/">Wisniewski said</a>. “It’s run on tax money and it’s run as a bureaucracy, and their mission is to deliver transit.”

Under the Biden administration, the Transportation Security Agency has imposed cybersecurity mandates on high-risk railroads and rail transit systems. When officials first announced that they were planning rules, they said that rules such as requiring reporting of cyber incidents to CISA would affect Amtrak “as well as large subway systems including New York’s and Washington’s,” as <a href="https://www.washingtonpost.com/national-security/rail-cybersecurity-dhs-regulations/2021/10/06/b3db07da-2620-11ec-8831-a31e7b3de188_story.html">my colleague Ellen Nakashima reported</a>.

“There is no better example of how the cybersecurity threat can impact our lives than in the transportation sector and how people commute, see one another, engage with one another,” Homeland Security Secretary Alejandro Mayorkas said at a cybersecurity conference in 2021.

Justin and Ian also spoke to the offices of lawmakers who said they’d be paying close attention to what WMATA does next.

“We are alarmed by the Inspector General’s findings and will be further examining this issue to ensure any vulnerabilities in [Metro’s] cybersecurity operations are addressed in order to protect sensitive data and networks,” Jessica Collins, a spokeswoman for the Republican-led House Oversight Committee, said in a statement.

Correction: An earlier version of this newsletter misidentified Chester Wisniewski as principal research scientist at Sophos. He is now Sophos’s Field Chief Technology Officer.

Microsoft highlights service that lets people use residential IP addresses to mask hacks

Sean Gallup

Hackers are increasingly using platforms like BulletProftLink to send to help them create malicious email campaigns and mask their location by purchasing IP addresses that match victims’ locations, according to a <a href="https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RW14o4H">new report</a> out this morning from Microsoft Threat Intelligence. That enables them to more easily carry out business email compromise (BEC) attacks, which trick company employees into paying fake invoices.

Using the residential IP addresses “is helping criminals further monetize Cybercrime-as-a-Service (CaaS) and has caught federal law enforcement’s attention because it allows cybercriminals to evade ‘impossible travel’ alerts used to identify and block anomalous login attempts and other suspicious activity,” the analysis says.

A snapshot of BEC phishing emails between January and April of this year shows that about 62 percent of the attacks were attempts to lure victims into doing things, while nearly 15 percent were related to payroll systems, according to the report.

Antiabortion group used mobile phone data for targeted ads to Planned Parenthood visitors

Antiabortion group Veritas Society used cellphone location data to deliver antiabortion ads to some Planned Parenthood clinic visitors, <a href="https://www.wsj.com/articles/antiabortion-group-used-cellphone-data-to-target-ads-to-planned-parenthood-visitors-446c1212">Byron Tau and Patience Haggin report for the Wall Street Journal</a>.

The nonprofit established by Wisconsin Right to Life “was using precise geolocation data to target those ads from as early as November 2019 through late last year, according to a Veritas Society website, several former employees of an advertising-technology company it used to target the ads, and other people familiar with the matter,” they write.

The group used geofencing, virtual perimeters used to sweep up cellphone data within a given location, to gain the IDs from devices of people entering the clinics and used that info to target those devices with antiabortion ads on social media, including Facebook, Instagram and Snapchat.

“All three social networks said the ads violated their policies and said future such campaigns would be rejected,” Tau and Haggin write.

Officers of Veritas Society and Wisconsin Right to Life didn’t respond to the Wall Street Journal’s requests for comment.

Some states have taken notice of the potential privacy implications associated with the issue. Washington Gov. Jay Inslee (D) last month <a href="https://www.washingtonpost.com/technology/2023/04/27/washington-reproductive-health-law/">signed a bill</a> to create new protections for reproductive health data. It bars the use of geofences to send unsolicited messaging to people in health facilities.

FTC proposes rules to heighten scrutiny against digital health app data sharing

Alex Brandon

The Federal Trade Commission on Thursday issued <a href="https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-proposes-amendments-strengthen-modernize-health-breach-notification-rule">proposed changes</a> to its Health Breach Notification Rule (HBNR) to clarify the rule’s scope, <a href="https://www.fiercehealthcare.com/digital-health/ftc-steps-scrutiny-digital-health-apps-proposed-changes-data-privacy-rule">Heather Landi reports for Fierce Healthcare</a>.

“The proposed rule makes it clear that health-related apps and trackers will face enforcement action and potential penalties if they do not alert consumers when their health data is disclosed without their permission,” Landi writes.

The agency’s HBNR dates back to 2009. “Since the rule’s issuance, health apps and other direct-to-consumer health technologies, such as fitness trackers, have become commonplace,” an agency release said.

The proposals would expand the rule’s definition to include health apps and others not covered by the Health Insurance Portability and Accountability Act (HIPAA).

It would also clarify the definition of a “breach of security” to include “an unauthorized acquisition of identifiable health information” that occurs from a data breach.

Easy Healthcare, which owns fertility app Premom, settled with the FTC and three attorneys general for $200,000 over allegations that it shared sensitive user data with two China-based companies without consent, our colleague Tatum Hunter <a href="https://www.washingtonpost.com/politics/2023/05/18/fda-shores-up-cybersecurity-requirements-medical-devices/">reported this week</a>.

<a href="https://techcrunch.com/2023/05/18/consulting-firm-krebs-stamos-group-lays-off-six-employees/" target="_blank">Consulting firm Krebs Stamos Group lays off six employees (TechCrunch)</a>

<a href="https://www.nytimes.com/2023/05/18/technology/twitter-microsoft-misusing-data.html" target="_blank">Twitter accuses Microsoft of improperly using its data (New York Times)</a>

<a href="https://www.wsj.com/articles/radiology-group-sues-broker-over-lapsed-cyber-insurance-policy-c3dee8b5?tpl=cs" target=_blank>Radiology group sues broker over lapsed cyber insurance policy (Wall Street Journal)</a>

<a href="https://thehill.com/policy/4010614-irs-deploys-cyber-attaches-to-fight-cybercrime-abroad/" target=_blank>IRS deploys cyber attachés to fight cybercrime abroad (The Hill)</a>

<a href="https://www.forbes.com/sites/thomasbrewster/2023/05/18/rich-russian-cybercriminals-have-their-malware-dealer-unmasked/?sh=49b5bce13c2c" target=_blank>Some of Russia’s most dangerous cybercriminals just had their malware dealer unmasked (Forbes)</a>

<a href="https://www.ft.com/content/ff150b65-8dc6-48c8-b2e4-6b8fbee4ea03" target=_blank>M&amp;S and Diageo pension plans hit by Capita cyber attack (Financial Times)</a>

<a href="https://therecord.media/russian-it-worker-jailed-for-ddos-attacks" target=_blank>Russian IT worker jailed for participating in pro-Ukraine DDoS attacks (The Record)</a>

<a href="https://cyberscoop.com/ransomware-charity-malaslocker/" target=_blank>A different kind of ransomware demand: Donate to charity to get your data back (CyberScoop)</a>

<a href="https://www.cbsnews.com/news/wisconsin-man-charged-with-hacking-fantasy-sports-betting-accounts/" target="_blank">"Fraud is fun:" Wisconsin man charged with hacking thousands of sports betting accounts (CBS News)</a>

<a href="https://insidecybersecurity.com/daily-news/house-appropriators-propose-192-million-increase-cisa-fiscal-2024-spending" target=_blank>House appropriators propose $19.2 million increase for CISA in fiscal 2024 spending (Inside Cybersecurity)</a>

<a href="https://fcw.com/it-modernization/2023/05/four-federal-departments-have-not-fully-implemented-cloud-security-practices-gao-says/386560/" target=_blank>Four federal departments have not fully implemented cloud security practices, GAO says (Federal Computer Week)</a>

<a href="https://www.politico.eu/article/eu-regulators-set-to-scrutinize-tiktok-case-on-kids-privacy-violations/" target=_blank>TikTok faces EU scrutiny on kids’ privacy (Politico Europe)</a>

2022 American Society of Business Publication Editors, Bronze National Award, Government Coverage

2022 American Society of Business Publication Editors, Silver Regional Award, Government Coverage

2022 American Society of Business Publication Editors, Bronze Regional Award, Single Topic Coverage by a Team

2022 Society of Professional Journalists Washington, D.C., Chapter, Finalist, Staff

2021 Best in Business Awards, Honorable Mention, Technology, Small Division (for editing role)

2009 National Press Club Sandy Hume Memorial Ward for Excellence in Political Journalism

2001 Indiana Associated Press Managing Editors, 1st Place, Non-Deadline News Reporting (with another reporter)

2001 Hoosier State Press Association, 3rd Place, Business Writing (team project)

University of Southern Indiana, BA in Print Journalism

Tim Starks is the author of the Cybersecurity 202 newsletter at The Washington Post. He previously served as senior editor at CyberScoop and ran Politico's cybersecurity newsletter. The Evansville, Ind., native also has held reporting roles for CQ Roll Call, the New York Sun and the Evansville Courier & Press.

Tim Starks

George Washington University, BBA in business analytics

Georgetown University, MS in business analytics

David DiMolfetta researches The Cybersecurity 202 and The Technology 202, the morning newsletters at The Washington Post keeping readers up to date on cybersecurity and technology policy.