The White House Cyber Office Blacked Out Its Huawei, TikTok, and Kaspersky Slides. The Laws Behind Them Are Public.

What do the Office of the National Cyber Director’s FOIA releases show about its priorities and the government’s cyber authorities, and what do they leave out?

Two releases from the Office of the National Cyber Director (ONCD), the White House office Congress created in 2021, show it teaching its own staff the government’s supply-chain powers and tracking the cyber provisions of the fiscal 2023 omnibus spending law. Most of the substance is withheld. Twenty of the 24 slides in a November 2021 supply-chain briefing, including case studies on Huawei, TikTok, and Kaspersky, are blacked out under FOIA’s exemption for deliberative records, (b)(5). Neither release mentions NSPM-13, the classified 2018 memo that governs military cyber operations, or counterterrorism policy. Those frameworks can be described only from official remarks, news reporting, and a partly declassified Biden counterterrorism memo obtained by The New York Times.

Other FOIA releases published here include the DHS legal opinion on buying phone-location data and the Secret Service release on SharePoint, browser history, and Teams.

Editor’s note: Citations give each release’s PDF page and the Bates number stamped on it. Both releases are hosted with this article, with SHA-256 checksums in the docs folder index.

What Did the Cyber Director’s Office Release?

Congress created ONCD in the fiscal 2021 defense authorization act. The law says “There is established, within the Executive Office of the President, the Office of the National Cyber Director” and assigns the director to coordinate, among other things, “efforts to increase the security of information and communications technology and services and to promote national supply chain risk management and vendor security.” The Senate confirmed Chris Inglis as “the nation’s first-ever National Cyber Director” in June 2021.

The two releases carry the same Bates prefix, NCD008FY23023. The smaller one (80 pages) holds three copies of one training package from March 11, 2022, and an April 2022 email chain. The larger one (376 pages, in three parts: pp. 1–135, pp. 136–240 and pp. 241–376) runs from December 2022 to March 2023: a briefing book for the director and principal deputy director, Legislative Affairs agendas and trackers, an event memo, interagency meeting notes, an intelligence update for the Munich Security Conference, and emails arranging a French parliamentary delegation’s visit.

The training package began with an email from Lee Licata, ONCD’s director for supply chain and technology security: “For those joining the 11:30am policy seminar on supply chain, attached please find a slide deck and a cheat sheet of supply chain authorities.” (PDF p. 1, _000000678). Inglis replied that morning. “Thanks for setting this up and for the great background materials. I will start and finish with your other ‘students’ but have to step away from 1200-1230 for a session with USDA.” That afternoon he forwarded the package to a colleague: “Bringing the slides back to the top of your queue.” (PDF p. 53, _000001323).

Two exemptions account for nearly all of the blacked-out text. Exemption 5 covers “inter-agency or intra-agency memorandums or letters that would not be available by law to a party other than an agency in litigation with the agency,” which includes the deliberative-process privilege. Exemption 6 covers “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy”; ONCD used it on staff email addresses and phone numbers. The one-page “ICTS Supply Chain Security Authorities Cheat Sheet” is withheld in full under (b)(5) in all three copies (PDF pp. 2, 52, and 78).

Transcription Release B, PDF p. 3, NCD008FY23023_000000680

“Overview: Securing the U.S. Information and Communications Technology Supply Chain November 2021”

“Lee Licata” — [next line withheld, marked “(b)(6)”]

Full-size image

Which Slides Were Withheld?

The deck has 24 slides. ONCD released four: the title slide, a slide on “The ICTS Landscape,” a “Conclusion / Questions?” slide, and a contact slide. The other 20 show only their titles above a (b)(5) box. All three copies are redacted identically.

Slide titles from release B, PDF pp. 3–26 (_000000680). “ICTS” is information and communications technology and services.

The one content slide released is economic, not legal. “In 2020, the U.S. technology sector (which broadly includes telecom, ICTS, cybersecurity, etc.) represented roughly $2 trillion dollars or 10.5% of U.S. gross domestic product.” It ends with an example of the exposure: “Apple’s supply chain relies on over 200 equipment suppliers in over 800 production facilities located in more than 20 different countries.” (PDF p. 4)

Ex 1: What Covers Huawei and 5G Equipment?

ONCD withheld the body of the Huawei slide under (b)(5). What its staff were told about Huawei’s radio access network kits is not in the record. The authorities that applied to Huawei in November 2021 are.

Transcription Release B, PDF p. 6, NCD008FY23023_000000680

“Ex 1 - Huawei and 5G Radio Access Network Kits”

[Slide body withheld, marked “(b)(5)”]

Full-size image

The first is Section 889 of the fiscal 2019 defense authorization act, signed August 13, 2018, which bars executive agencies from buying equipment that uses “covered telecommunications equipment or services” and from contracting with companies that use it. The law defines the term first as “Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities).” The deck gave Section 889 a slide of its own, also withheld.

The second is the Federal Communications Commission’s Covered List, created under the Secure and Trusted Communications Networks Act of 2019, which became law on March 12, 2020. The FCC says the list covers equipment and services “deemed to pose an unacceptable risk to the national security of the United States or the security and safety of United States persons.” Huawei and ZTE equipment were added on March 12, 2021.

Huawei came back up in the larger release. On February 14, 2023, ONCD’s director for intelligence support sent the principal deputy director and others an unclassified update before the Munich Security Conference. Its first item: “Analysis from journalists at the Politico suggests that several locations in Munich, including the venue for the conference (Bayerischer Hof), host 4G/5G antenna masts with Huawei signals processing equipment.” (PDF p. 238, _000000390) The covering email read, “Starting a rhythm to provide unclassified “intelligence and analysis” updates that should sustain you in various MSC conversations.” (PDF p. 161, _000000387)

Ex 2: How Did TikTok Get Banned From Government Devices?

Transcription Release B, PDF p. 7, NCD008FY23023_000000680

“Ex 2 - Going Viral on TikTok”

[Slide body withheld, marked “(b)(5)”]

Full-size image

When ONCD wrote the deck, the federal government had already tried and abandoned one TikTok order. Executive Order 13942, signed August 6, 2020, said “TikTok automatically captures vast swaths of information from its users.” On June 9, 2021, Executive Order 14034 wiped it out: “The following orders are revoked: Executive Order 13942 of August 6, 2020.” The new order called for “rigorous, evidence-based analysis” of connected software tied to foreign adversaries. E.O. 14034 has its own withheld slide in the deck.

The ban that stuck came from Congress. Division R of the fiscal 2023 omnibus, the No TikTok on Government Devices Act, directed the White House budget office to “develop standards and guidelines for executive agencies requiring the removal of any covered application from information technology,” with exceptions for law enforcement, national security, and security research. On December 22, 2022, a week before President Biden signed the omnibus, ONCD’s Legislative Affairs agenda listed “TikTok on government devices ban” first among the bill’s “New Authorities.”

Then came implementation. Notes from a January 26, 2023, monthly meeting of the Office of Management and Budget, ONCD, and the Cybersecurity and Infrastructure Security Agency (CISA) record “TikTok prohibition and implications across government – Brief update provided on the status of the TikTock memo.” (PDF p. 160, _000000819) The memo, OMB’s M-23-13, came out February 27, 2023. It says “No later than 30 days following the issuance of this memorandum, agencies shall” identify the app and “Remove and disallow installations of a covered application.”

TikTok also appears on ONCD’s list of topics outsiders might raise. When a French parliamentary delegation asked for a meeting in late February 2023, Philip Stupak, ONCD’s director for federal cybersecurity, wrote back: “I can certainly cover the TikTok Ban.” (PDF p. 274, _000000430)

Ex 3: What Did the Kaspersky Directive Require?

Transcription Release B, PDF p. 33, NCD008FY23023_000001128

“Ex 3 – Kaspersky and the Binding Operational Directive”

[Slide body withheld, marked “(b)(5)”]

Full-size image

The directive in the slide’s title is DHS Binding Operational Directive 17-01, issued September 13, 2017. It told agencies, “Within 30 calendar days after issuance of this directive, identify the use or presence of Kaspersky-branded products on all Federal information systems,” to deliver a removal plan within 60 days, and to begin removal at 90 days. It had limits: “This directive does not apply to statutorily defined “National Security Systems”.”

Congress followed within three months. Section 1634 of the fiscal 2018 defense authorization act, signed December 12, 2017, says no federal agency may use “any hardware, software, or services developed or provided, in whole or in part, by” Kaspersky Lab or its affiliates, a ban that “shall take effect on October 1, 2018.”

The FCC later put Kaspersky on the Covered List, adding its information security products on March 25, 2022, and Kaspersky Lab, Inc.’s antivirus software on July 23, 2024, according to the list. The broadest action came from the Commerce Department under the supply-chain rules built on Executive Order 13873, the 2019 order in which President Trump found that “foreign adversaries are increasingly creating and exploiting vulnerabilities in information and communications technology and services” and wrote, “I hereby declare a national emergency with respect to this threat.” Commerce’s interim rule took effect March 22, 2021 (86 FR 4909). On June 24, 2024, its final determination said that from September 29, 2024, Kaspersky “shall be prohibited from engaging in the identified ICTS transactions in the United States or with U.S. persons.”

Dates are signing or issuance dates from the linked primary sources.

What New Authorities Did ONCD Track in the FY2023 Omnibus?

The Legislative Affairs agenda for December 22, 2022, recaps the omnibus in three lines: “ONCD funded at FY ’23 PBR of $21.9 M (~4% increase over IIJA amount),” followed by the three new authorities (PDF p. 25, _000000159). The enacted law gives ONCD “$21,926,000, of which not to exceed $5,000 shall be available for official reception and representation expenses.” The infrastructure law had provided “$21,000,000, to remain available until September 30, 2022.”

Transcription Release A, PDF p. 25, NCD008FY23023_000000159

“FY ’23 Omnibus Recap”

“New Authorities 1. TikTok on government devices ban 2. FDA cyber requirements for medical devices 3. EBT Card fraud security requirements”

“Sen. Wyden - VEP”

Full-size image

The medical-device authority is Section 3305 of the omnibus, which added Section 524B to the Food, Drug, and Cosmetic Act. Makers of a “cyber device” must “submit to the Secretary a plan to monitor, identify, and address, as appropriate, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits” and “provide to the Secretary a software bill of materials.” The EBT item is Section 501 of Division HH, which tells the Agriculture Department to issue guidance on security measures effective “in detecting and preventing theft of benefits, including through card skimming, card cloning, and other similar fraudulent methods.”

On January 9, 2023, Elliott Phaup, ONCD’s special advisor for legislative affairs, sent OMB staff a fuller tracker. “Sharing a tracker we put together on cyber auths and a sampling of reporting requirements from the FY ’23 omni. It doesn’t include funding levels and isn’t exhaustive, but we pulled out some interesting items, some of which you were likely already tracking.” He listed the themes: “Noteworthy trends identified include: Cloud Security; Critical Infrastructure & Small Business; Cyber Workforce & Education; Federal Cybersecurity Coordination & Improvement.” (PDF p. 107, _000000941) The eight-page tracker itself is withheld under (b)(5) below its header.

What Did ONCD List as Its Priorities?

The clearest statement of priorities in either release is in a memo preparing the principal deputy director for a U.S. Chamber of Commerce cyber dinner on February 8, 2023. Under “Discussion Points,” it reads: “ONCD’s Top Cyber Priorities: 1. National Cybersecurity Strategy 2. Cyber Investment 3. Regulation Harmonization 4. Workforce 5. EO 14028 Implementation and Zero Trust” (PDF p. 140, _000001068).

The same page carries the only reference in either release to the military’s cyber doctrine. Among the Chamber’s suggested topics, under “Risk and consequence operations,” is “Defend forward, persistent engagement, and law enforcement collaboration.” The memo’s list of other topics guests might raise ends with “Encryption/Going Dark” and “TikTok.” Most of the rest of the memo is withheld under (b)(5).

What Is NSPM-13?

Presidential directives change names with each administration. Under Obama they were “Presidential Policy Directives (PPDs),” plus at least one “Presidential Policy Guidance (PPG)”; Trump’s were National Security Presidential Memoranda (NSPMs); and Biden’s NSM-2 said his “National Security Memoranda that, along with National Security Study Memoranda, shall replace National Security Presidential Memoranda and Space Policy Directives.” Trump’s second-term directives “are also (somewhat confusingly) designated National Security Presidential Memoranda,” according to the Federation of American Scientists, so “NSPM-13” here means the 2018 memo.

That memo is listed by the Federation of American Scientists as “United States Cyber Operations Policy”, and its text has not been released. An Army article from June 2025 put it plainly: “NSPM-13 is a classified document, so the details are not public.” Paul C. Ney Jr., then the Pentagon’s general counsel, gave the official description in March 2020. He said the memo “allows for the delegation of well-defined authorities to the Secretary of Defense to conduct time-sensitive military operations in cyberspace.” Brig. Gen. Alexus Grynkewich, the Joint Staff’s deputy for global operations from June 2017 to April 2019, said it “provides a way, within certain policy constraints, for the president to delegate cyberspace authorities to the secretary of defense for a particular mission.”

Drawing on those accounts, this article treats NSPM-13 as the framework for cyber intelligence, surveillance, and reconnaissance (C-ISR) and preemptive action. The public sources do not use the C-ISR label. They describe delegated authority to act quickly and the preemptive posture it supports. The Army article says Cyber Command “must also be ready to preemptively take the proverbial fight to the adversary outside defended cyberspace” and that commanders “require the delegation of offensive cyber authorities to allow for faster and more agile decision-making.” In the article’s words, NSPM-13 works “by removing bureaucratic distractions from the approval process for executing offensive operations in cyberspace.”

The memo’s Obama-era predecessor, PPD-20, is listed by FAS as “U.S. Cyber Operations Policy,” dated October 16, 2012. Herb Lin of the Hoover Institution wrote in Lawfare that one public source described NSPM-13 as an “offensive step forward” from a policy that “required consensus in a U.S. government interagency process that included the departments of Defense and State, among others.”

The doctrine that rode alongside it is “defend forward.” Ney quoted the Defense Department’s 2018 cyber strategy: “We will defend forward to disrupt or halt malicious cyber activity at its source, including activity that falls below the level of armed conflict.” The operating concept, persistent engagement, means “continuously engaging and contesting adversaries and causing them uncertainty wherever they maneuver.” The best-known case: in 2018, Cyber Command “conducted an operation to block internet access to the Internet Research Agency, a Russian troll factory” ahead of the midterm elections. The Army article’s author argues the effect is cumulative: “If a nuclear attack is a gunshot and a cyber-attack is a paper cut, then death by a thousand paper cuts is the only way to coerce an opponent with cyber-attacks.”

How Did the Biden Administration Revise NSPM-13?

The revision is known only through reporting. On March 31, 2022, CyberScoop’s Suzanne Smalley reported that “The Biden administration is reviewing whether and how to change a Trump-era policy that gave unprecedented authority to the Department of Defense and U.S. Cyber Command to authorize cyber-operations without White House approval,” through an “interagency review process” led by the National Security Council.

By May 10, two sources told CyberScoop that the agencies had agreed on a policy giving the State Department “greater ability to monitor and weigh in on “third-party notifications,” defined as whether and how the U.S. government alerts countries if it plans to enter their cyberspace to interrupt adversaries’ cyber operations.” The outlet’s example: “if a Russian cyber operation relied on a server in France, the State Department would now have more of a window into the decision to conduct a cyber operation there and weigh in on whether and how to notify the French government.” Rep. Mike Gallagher, R-Wis., co-chair of the Cyberspace Solarium Commission, said “efforts by the Administration to pull back the delegation and provide additional oversight and interagency input in the midst of the execution phase risks undermining our national security.”

Ellen Nakashima of The Washington Post reported on May 13, 2022, that the administration was refining the order. As Lin summarized the Post’s account, before the change “the Pentagon could override the State Department’s objection to an [offensive cyber] operation without explanation and without the White House’s knowledge … [but] now, the Defense Department will have to keep both the White House and State Department apprised of Cyber Command’s rationale for proceeding.”

In November, CyberScoop reported that “The Defense Department has largely won out in a long-running bureaucratic battle with the State Department over retaining its broad powers to launch cyber operations.” A senior official said the final version would include “provisions requiring the White House to receive details of cyber operation plans from DOD well in advance of operations” and a “documented dispute resolution process.” The same report quoted former national security adviser John Bolton’s memoir description of the pre-2018 approval process as “frozen solid.” No public record found by OctoProbe confirms when, or whether, President Biden signed the revised memo.

What Is the Counterterrorism Memo the Times Obtained?

The counterterrorism document is a different memo with a similar number. It is “National Security Memorandum/NSM-13,” dated October 6, 2022, subject “Memorandum on U.S. International Counterterrorism Policy.” New York Times reporter Charlie Savage obtained it in “NYT/Savage v. DOD, No. 22-cv-10299 (S.D.N.Y.),” a FOIA suit that “Sought disclosure of two counterterrorism policy documents signed by President Biden and sent to the Defense Department, among other parts of the government, in October 2022.” The government released it on June 30, 2023, alongside the separate presidential policy memorandum on drone strikes and other direct action, according to Savage’s FOIA page and Lawfare.

The 18-page release is stamped “NSC Declassification Review [E.O. 13526] DECLASSIFY IN PART by John Powers 6/29/2023.” Passages withheld as classified are marked (B)(1) throughout. It is addressed to 15 officials, from the secretary of state to the FBI director, and says it “supersedes and revokes” the 2018 National Strategy to Counter Terrorism, among other documents whose names are redacted.

Transcription NSM-13, p. 1

“October 6, 2022 (U) NATIONAL SECURITY MEMORANDUM/NSM-13”

“SUBJECT: (U) Memorandum on U.S. International Counterterrorism Policy”

“This NSM supersedes and revokes” [redacted, (B)(1)] “the 2018 National Strategy to Counter Terrorism.”

Open the full 18-page PDF

Its interagency machinery is the Counterterrorism Security Group, or CSG. “The threat assessment underpinning this framework will be conducted by the IC semi-annually and will be used to inform policy guidance from the NSC-led Counterterrorism Security Group (CSG). The NSC staff will organize quarterly CSG meetings to assess and update, as necessary, prioritization guidance based on shifts in terrorism risk or other policy decisions.” (p. 8) The CSG also checks progress: “The Special Assistant to the President and Senior Director for Counterterrorism will host semi-annual CSG meetings to measure progress on execution of the SIP tasks,” with “bi-monthly sub-CSGs to oversee the SIP’s implementation” (p. 17). The SIP is a strategic implementation plan the memo orders drafted “within 90 days of the issuance of this NSM for consideration by the Deputies Committee.”

The memo’s top priority is external operations, the military’s term for terrorist attacks plotted against targets abroad. Gen. Michael Kurilla, then head of U.S. Central Command, told the House Armed Services Committee in June 2025 that no other region sees “a fraction of the scale of potential external operations (EXOPS) by violent extremists who remain intent on attacking their enemies abroad.” The State Department used the term in 2017 when it designated Oussama Atar, who it said “is a senior leader of ISIS’s external operations efforts and has established a network to carry out attacks in Europe.” NSM-13’s direct-action line of effort says, “We will focus these efforts first and foremost on disrupting and degrading their external operations capabilities, their ability to strike U.S. targets, and their development, acquisition, or use of WMD and other advanced weapons or technologies.” (p. 12)

Line of effort 6 is titled “Degrade Transnational Enablers of Terrorism.” “Many terrorist groups rely on the transnational movement of fighters, money, and materiel to acquire resources for their activities, and on the dissemination of propaganda and disinformation to spread their influence.” (p. 14) It ties those enablers to external operations: “Within this LOE, we will prioritize actions against those enablers that most directly contribute to terrorists’ external operations capabilities, including the travel of (especially Western) foreign terrorist fighters or operatives, the facilitation of weapons or explosives precursors, and the dissemination of terrorist media designed to enable or inspire independent attacks.” (pp. 14–15) One unredacted priority action targets finance, including “oversight of the informal financial sector and of digital assets” (p. 15).

It also sets a limit: “Our most vital CT interest has been and must remain the protection of the Homeland and U.S. persons and facilities overseas.” The memo adds, “we must avoid undertaking large-scale, U.S.-led nation-building efforts in the name of CT” (p. 3).

Where Do the Cyber and Counterterrorism Frameworks Meet?

NSPM-13 and NSM-13 are parallel frameworks, one for military operations in cyberspace and one for counterterrorism. Each has its own interagency process: delegation and, as reported, notification under the cyber memo, and the CSG under the counterterrorism memo. The word “cyber” appears once in NSM-13’s released text, in a list of other national security challenges: “the emergence of new cyber threats and disruptive technologies” (p. 3). The memo also calls for “expanded efforts to limit terrorist use of the internet” and says the government “will prioritize nonlethal and non-kinetic options whenever such approaches can provide effective solutions” (p. 5).

The two meet in law and in practice. In law, Section 1632 of the fiscal 2019 defense authorization act, codified at 10 U.S.C. 394, affirms that military cyber operations short of hostilities include those “for the purpose of preparation of the environment, information operations, force protection, and deterrence of hostilities, or counterterrorism operations involving the Armed Forces of the United States.”

In practice, the clearest public example predates both memos. Operation Glowing Symphony was authorized on November 10, 2016, according to the National Security Archive, which obtained Cyber Command’s assessments. “The mission assigned to JTF-ARES was to counter ISIS actions in cyberspace while Operation GLOWING SYMPHONY specifically targeted ISIS use of social media and internet propaganda.” The archive calls the documents “the first time the US Government has officially acknowledged offensive cyber operations,” and says they show challenges in “inter-agency coordination.” Terrorist media is the same enabler NSM-13’s line of effort 6 targets.

Can Companies Hack Back?

No. Delegated and preemptive authority belongs to the government. For everyone else, the Computer Fraud and Abuse Act makes it a crime when someone “knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer.” Breaking into an attacker’s server is no defense. The law’s carve-out is narrow: “This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States,” states, or intelligence agencies.

Ney said those exceptions “contain exceptions for lawfully authorized activities of law enforcement agencies and U.S. intelligence agencies but do not refer to U.S. military cyber operations.” The Pentagon’s view is that “it would be unreasonable and counterintuitive to interpret the CFAA as restricting properly authorized military cyber operations abroad against foreign actors.”

Congress has been asked to open a door for private defenders. The Active Cyber Defense Certainty Act, introduced by Rep. Tom Graves, R-Ga., in October 2017 and again in June 2019, would have added this to the law: “It is a defense to a criminal prosecution under this section that the conduct constituting the offense was an active cyber defense measure.” It defined such a measure as “accessing without authorization the computer of the attacker to the defender's own network to gather information” for attribution, disruption, or monitoring, and required notice to the FBI first. Neither version became law; the current text of the statute has no such defense.

The government’s own line runs between Title 10, the military, and Title 50, intelligence and covert action. The covert action statute excludes “traditional diplomatic or military activities or routine support to such activities.” Section 1632 put cyber on the military side: “A clandestine military activity or operation in cyberspace shall be considered a traditional military activity for the purposes of section 503(e)(2) of the National Security Act of 1947.” Ney said that means such operations “are to be considered traditional military activities and not covert action, for purposes of the covert action statute.”

The Records at a Glance

Bates numbers abbreviated; all carry the prefix NCD008FY23023_000.

Frequently Asked Questions

What is the Office of the National Cyber Director?

A White House office in the Executive Office of the President, created by Section 1752 of the fiscal 2021 defense authorization act (6 U.S.C. 1500). Its Senate-confirmed director coordinates national cyber policy, including supply-chain security. Chris Inglis was confirmed as the first director in June 2021.

Why did ONCD withhold the Huawei, TikTok, and Kaspersky slides?

It marked them (b)(5), the FOIA exemption for inter-agency and intra-agency memorandums that would be privileged in litigation, which includes deliberative material. The slide titles were released; the bodies were not.

Is NSPM-13 the same as NSM-13?

No. NSPM-13 is Trump’s 2018 “United States Cyber Operations Policy,” which remains classified. NSM-13 is Biden’s October 6, 2022, “Memorandum on U.S. International Counterterrorism Policy,” released in part to The New York Times in June 2023. The numbering overlaps because each administration names its directives differently.

What did the Biden administration change in NSPM-13?

According to CyberScoop and The Washington Post, the 2022 revision kept most of the Pentagon’s delegated authority but required the Defense Department to keep the White House and State Department informed, gave State more say over notifying third countries, and added a documented dispute resolution process. The revised text has not been released.

What is the Counterterrorism Security Group?

The NSC-led interagency group that NSM-13 uses to set and update counterterrorism priorities. The memo calls for quarterly CSG meetings on prioritization, semi-annual meetings to measure progress, and bi-monthly sub-group meetings.

Can a company legally hack back against an attacker?

No. The Computer Fraud and Abuse Act has no exception for private self-defense. The Active Cyber Defense Certainty Act would have created one, but it was not enacted.

When did TikTok get banned on federal devices?

The No TikTok on Government Devices Act became law on December 29, 2022, in the fiscal 2023 omnibus. OMB’s implementing memo, M-23-13, issued February 27, 2023, gave agencies 30 days to remove the app.

Colin Aamot is an investigative journalist and OSINT domain expert specializing in FOIA and public records. A technologist, U.S. Army veteran, and former Capitol Hill staffer, he has held director roles across the private and public sectors.Full bio