Category: Natural Disasters

  • MIL-OSI USA: Hawley, Schmitt Urge Trump to Approve Missouri Emergency Declaration & Unlock Disaster Funding Immediately

    US Senate News:

    Source: United States Senator Josh Hawley (R-Mo)
    Earlier this morning, U.S. Senators Josh Hawley (R-Mo.) and Eric Schmitt (R-Mo.) penned a letter to President Donald Trump, urging him to swiftly approve Missouri Governor Mike Kehoe’s May 19 emergency disaster declaration in light of recent devastating storms.
    “If approved, this declaration would immediately unlock critical funding to support state and local efforts to remove debris and take emergency protective measures,” the Senators wrote.
    “After touring the devastated neighborhoods, we can personally attest to the scale of the damage and the clear need for the governor’s request to unlock this first step of federal assistance to support first responder efforts,” they explained.
    This emergency designation would unlock resources for immediate needs such as debris removal while the damage is assessed for a more widespread disaster declaration. Senator Hawley spent Monday on the ground in St. Louis, Missouri, meeting with victims and surveying the damage inflicted by Friday’s tornadoes, and has set up a portal on his website to help constituents with insurance claims. 
    Read the full letter here or below.
    May 21, 2025
    The Honorable Donald J. TrumpPresident of the United StatesThe White House1600 Pennsylvania AvenueWashington, DC 20500
    Dear President Trump,
    We write to support Missouri Governor Mike Kehoe’s May 19 request for an emergency disaster declaration, pursuant to the Stafford Act, following devastating tornadoes and storms in the St. Louis region. If approved, this declaration would immediately unlock critical funding to support state and local efforts to remove debris and take emergency protective measures.
    As you may know, on May 16, 2025, severe storms and tornadoes struck the St. Louis region and areas of southeast Missouri, claiming at least seven lives and causing widespread damage and destruction. Preliminary damage assessments are slated to begin tomorrow in preparation for the Governor’s request for a major disaster declaration. Importantly, Governor Kehoe’s emergency declaration request would expedite funding to the State of Missouri in the interim and provide important reinforcement for recovery efforts currently underway.
    After touring the devastated neighborhoods, we can personally attest to the scale of the damage and the clear need for the governor’s request to unlock this first step of federal assistance to support first responder efforts. We respectfully urge your immediate consideration and approval of this emergency declaration request.
    Sincerely,
    Josh Hawley                                                                                                     United States Senator
    Eric S. Schmitt                                                        United States Senator

    MIL OSI USA News

  • MIL-Evening Report: Playing the crime card: do law and order campaigns win votes in Australia?

    Source: The Conversation (Au and NZ) – By Chloe Keel, Lecturer in Criminology and Criminal Justice, Griffith University

    Crime and public safety are usually the domain of state politics. But the Coalition tried to elevate them as key issues for voters in the recent federal election.

    Claiming crime had been “allowed to fester” under Labor, the opposition promised a A$750 million Operation Safer Communities plan, which included police strike teams targeting drugs, a national child sex offender register, and more money for Neighbourhood Watch.

    A Coalition government would also have given grants to community groups to install public lighting, bollards and CCTV cameras.

    But in the end, crime did not appear to be a deciding factor in the election, which was easily won by Labor.

    What does that tell us about leveraging public fear – either existing crime fears and general anxieties, or latent concerns that can be triggered – for political gain in Australia? Can it be a successful strategy?

    Stoking anxiety

    In culturally diverse countries, such as Australia and the United States, law and order rhetoric sometimes calls for supporting aggressive crime policies at the expense of racial and ethnic minorities, many of whom are immigrants.

    These policies can be effective in stoking public fear to win votes. US President Donald Trump’s exhortations on immigration and crime were a significant part of his election campaigns in 2016 and 2024.

    However, what experts call “protective factors”, such as strong communities and social cohesion, are important. They can reduce the influence of political narratives that try to define crime in narrowly punitive or racialised terms.

    Australia is not America

    Our peer-reviewed research, which will be published in the Journal of Criminology, investigated how public concerns about crime and safety in Australia and the US were associated with demographic factors that evolved over time. The study drew on data from the World Values Survey and indicated key differences in what makes Australians and Americans feel unsafe.

    We have found that in Australia in 2018, supporters of left-leaning parties (Labor/Green) reported feeling significantly safer than other voters. However, this gap disappeared when researchers took into account attitudes that blame crime problems on immigrants. This suggests immigrant-blaming in Australia can drive feelings of community fear and insecurity.

    The World Values Survey uncovered a different pattern in the US.

    Between 2011 and 2017, Republican voters reported feeling safer than other Americans – the opposite of Australia’s trend. The political divide in the US couldn’t be explained by immigrant-blaming attitudes. Rather, it was attributed to the “self-isolation” of American conservatives in more culturally homogeneous communities.

    Our study indicated that while immigration continued to influence safety perceptions in the US, it appeared to operate through different mechanisms than in Australia. Racial and ethnic minorities reported greater fear as the 2010s unfolded.

    Social connectedness also plays differently in each country. In Australia, trust in others and confidence in public institutions consistently influences safety perceptions. In the US, these factors have little impact.

    Social scientists have observed that in modern societies, responsibility for personal safety has increasingly shifted from the government to individuals. This trend is strong in the US, where market-focused, neoliberal economic and social policies dominate policies.

    By contrast, European research suggests stronger social welfare systems can reduce safety concerns by addressing underlying economic anxieties. Australia’s more robust social support appears to foster greater feelings of safety.

    Our research indicates social cohesion further helps reduce fear.

    Crime fears are not a vote winner

    Electoral strategies that seek to leverage public insecurities need to be understood in the context of these fear-mitigating factors. Media diversity can also counter fear-based messaging.

    In the 2018 Victorian election, crime became a prominent political issue through racialised commentary targeting “African gangs”. However, it failed to gain decisive political traction.

    Research found fear of crime was relatively rare in Victoria. Media reports of crime and comments by political leaders were distant from their own experiences

    With more diverse news sources and online platforms, political actors can no longer promote narratives unopposed. Fear-based messaging can backfire, especially when it overreaches.

    Outdated strategy

    Perceptions of crime are often shaped by a combination of actual crime rates and broader anxieties about social change, cultural difference, and uncertainty. This is frequently expressed as unease about the increasing presence of culturally diverse groups.

    While the coalition’s pivot to law-and-order rhetoric represented a familiar strategy, Labor positioned itself as the party of unity. This was underscored by Foreign Minister Penny Wong’s declaration after Labor won the election, in which she acknowledged

    […] the power in our 26 million people from more than 300 ancestries […] from the oldest continuing civilisation on the planet and I acknowledge the traditional owners. Friends, we love this country.

    Foreign Minister Penny Wong on election night.

    While harnessing fears of crime and cultural diversity was not effective in this election cycle, this is not the end of law and order politics. But the unique characteristics of this election appear to have rendered the formula less potent.

    Trump’s threat to democracy and the constitutional rule of law in the US may have fostered a sense of solidarity and social cohesion among Australian voters. Our research suggests this helped to mitigate fears about crime.

    The temptation to capitalise on law and order may continue to appeal to politicians. But in Australia, at least, there is no guarantee it will work.

    The authors do not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and have disclosed no relevant affiliations beyond their academic appointment.

    ref. Playing the crime card: do law and order campaigns win votes in Australia? – https://theconversation.com/playing-the-crime-card-do-law-and-order-campaigns-win-votes-in-australia-256780

    MIL OSI AnalysisEveningReport.nz

  • MIL-OSI: United Fire Group, Inc. declares quarterly cash dividend of $0.16 per share

    Source: GlobeNewswire (MIL-OSI)

    CEDAR RAPIDS, Iowa, May 21, 2025 (GLOBE NEWSWIRE) — Today, the board of directors of United Fire Group, Inc. (UFG) (Nasdaq: UFCS) declared a common stock quarterly cash dividend of $0.16 per share. This dividend will be payable June 20, 2025, to shareholders of record as of June 6, 2025.

    UFG has a long history of paying quarterly dividends, with the quarterly cash dividend declared today marking the 229th consecutive quarterly dividend paid, dating back to March 1968.

    About UFG

    Founded in 1946 as United Fire & Casualty Company, UFG, through its insurance company subsidiaries, is engaged in the business of writing property and casualty insurance. The company is licensed as a property and casualty insurer in 50 states and the District of Columbia, and is represented by approximately 1,000 independent agencies. AM Best assigns a rating of “A-” (Excellent) for members of the United Fire & Casualty Group. For more information about UFG, visit www.ufginsurance.com.

    Contact:

    Investor relations
    Email: ir@unitedfiregroup.com 

    Media inquiries
    Email: news@unitedfiregroup.com 

    Disclosure of forward-looking statements

    This release may contain forward-looking statements about our operations, anticipated performance and other similar matters. The Private Securities Litigation Reform Act of 1995 provides a safe harbor under the Securities Act of 1933 and the Securities Exchange Act of 1934 for forward-looking statements. The forward-looking statements are not historical facts and involve risks and uncertainties that could cause actual results to differ from those expected and/or projected. Such forward-looking statements are based on current expectations, estimates, forecasts and projections about the Company, the industry in which we operate, and beliefs and assumptions made by management. Words such as “expect(s),” “anticipate(s),” “intend(s),” “plan(s),” “believe(s),” “continue(s),” “seek(s),” “estimate(s),” “goal(s),” “remain(s) optimistic,” “target(s),” “forecast(s),” “project(s),” “predict(s),” “should,” “could,” “may,” “will,” “might,” “hope,” “can” and other words and terms of similar meaning or expression in connection with a discussion of future operations, financial performance or financial condition, are intended to identify forward-looking statements. These statements are not guarantees of future performance and involve risks, uncertainties and assumptions that are difficult to predict. Therefore, actual outcomes and results may differ materially from what is expressed in such forward-looking statements. Information concerning factors that could cause actual outcomes and results to differ materially from those expressed in the forward-looking statements is contained in Part I, Item 1A “Risk Factors” of our Annual Report on Form 10-K for the year ended December 31, 2024, filed with the Securities and Exchange Commission (“SEC”) on February 26, 2025. The risks identified in our Annual Report on Form 10-K and in our other SEC filings are representative of the risks, uncertainties, and assumptions that could cause actual outcomes and results to differ materially from what is expressed in the forward-looking statements. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of the date of this release or as of the date they are made. Except as required under the federal securities laws and the rules and regulations of the SEC, we do not have any intention or obligation to update publicly any forward-looking statements, whether as a result of new information, future events, or otherwise.

    The MIL Network

  • MIL-OSI USA: Rep. Weber Announces $138 Million in Army Corps Funding for Southeast Texas Projects

    Source: United States House of Representatives – Congressman Randy Weber (14th District of Texas)

    Rep. Weber Announces $138 Million in Army Corps Funding for Southeast Texas Projects

    Washington, May 16, 2025

    Washington, D.C. – Today, U.S Rep. Randy Weber (TX-14) announced that Southeast Texas waterway projects will receive $138,380,000 in funding in the U.S. Army Corps of Engineers FY 2025 Army Civil Work Plan.

    “This is great news for Southeast Texas, America’s energy capital,” said Rep. Weber. “Our ports and waterways are the lifeblood of our economy and keeping them well-maintained is critical to preserving our nation’s leadership in commerce and energy. I’m grateful the Trump administration recognizes the strategic importance of our region. I will continue fighting for the infrastructure investments our communities deserve.:

    Operation & Maintenance projects in Texas’ 14th District were awarded:

    • $900,000 for the Channel to Port Bolivar. The Channel to Port Bolivar shallow-draft navigation project consists of a 14-foot deep by 200-foot wide channel that is 950 feet long. It extends from the entrance to Galveston Bay (Bolivar Roads) northward to the west point of Bolivar Island. The channel is heavily utilized by the Texas Department of Transportation and the Galveston-to-Port Bolivar Ferry System.
    • $13,150,000 for Freeport Harbor. The Freeport Harbor deep-draft navigation project consists of a 45-foot deep by 400-foot wide channel that is 8.5 miles long, extending from the Gulf of America, through a jetty-protected inlet, to a turning basin at the Freeport port facilities. The project also includes two rock jetties, 1.46 and 1.64 miles in length.
    • $47,975,000 for Galveston Harbor and Channel. The Galveston Entrance Channel is the main entrance for Galveston, Texas City, and the Houston Ship Channel. This deep-draft project includes a 45-foot deep by 800-foot wide channel that is 23.9 miles long, stretching from the Gulf of America through a jetty-protected inlet into Galveston Bay, to the port facilities at Galveston Harbor.
    • $50,000 for Chocolate Bayou. The Chocolate Bayou navigation project is a shallow-draft waterway, 13 feet deep by 125 feet wide and approximately 8.2 miles long. It extends from the Gulf Intracoastal Waterway (GIWW) at Mile Marker 376 through Chocolate Bay and Chocolate Bayou to port facilities located between Galveston and Freeport in Brazoria County, Texas.
    • $40,550,000 for the Gulf Intracoastal Waterway. The Texas portion of the GIWW extends from the Sabine River to Port Isabel, Texas, and includes several tributary channels. It features a 12-foot deep by 125-foot wide, shallow-draft channel stretching 423 miles along the Texas Coast. The GIWW includes flood gates at the Brazos River and navigation locks at the Colorado River, along with mooring basins and buoys at 11 locations supporting heavy barge traffic.
    • $25,075,000 for the Sabine-Neches Waterway. The Sabine-Neches Waterway (SNWW) is a federally constructed deep-draft navigation project serving the Ports of Port Arthur, Beaumont, and Orange in Jefferson and Orange Counties, Texas, and Cameron and Calcasieu Parishes, Louisiana. The waterway includes 97 miles of navigation channels in three main segments: a jetty-protected entrance channel 42 feet deep and 500 to 800 feet wide; a 40-foot deep, 400-foot wide channel to Beaumont via the Neches River; and a 30-foot deep, 200-foot wide channel to Orange via the Sabine River.
    • $10,680,000 for the Texas City Ship Channel. The Texas City Ship Channel deep-draft navigation project includes a 45-foot deep by 400-foot wide and 9.4-mile-long channel, extending from the intersection of Galveston Harbor and the Houston Ship Channel to a turning basin and Industrial Canal at the Port of Texas City.

    Rep. Weber added: “This is not just about dredging or infrastructure—it’s about jobs, national security, and Texas leading the way. I will always stand up for the hardworking men and women who rely on these waterways to fuel our economy and keep America strong.”

    MIL OSI USA News

  • MIL-OSI USA: “We will never let that happen again” — Wyoming honors its veterans across the state 

    Source: US State of Wyoming

    Wyoming National Guard 

    By Joseph Coslett Jr. 

     CHEYENNE, Wyo. – On May 10, 2025, the State of Wyoming paid tribute to its Veterans in a series of ceremonies as part of the annual Veterans Welcome Home Day.  

    Gov. Mark Gordon, U.S. Senator John Barrasso and U.S. Representative Harriet Hageman joined leaders from the Wyoming Military Department and the Wyoming Veterans Commission, traveled across the state to thank those who served—especially Veterans from the Korean and Vietnam Wars who were never properly welcomed home. 

    The daylong journey began at sunrise in Cheyenne and included four official ceremonies in Afton, Riverton, Sheridan and concluded in Wheatland. At each stop, the Governor, First Lady Jennie Gordon, Maj. Gen. Greg Porter, Adjutant General of Wyoming, and other dignitaries met with Veterans and their families, delivering remarks and expressing gratitude for their service. 

    Speaking to a room filled with Veterans and their loved ones, Porter reflected on the significance of the moment by connecting it to the broader legacy of American service. He reminded attendees that just weeks earlier, on April 19, the nation had observed the 250th anniversary of the “shot heard ‘round the world” at Lexington and Concord—an event that began a long lineage of Americans willing to fight for freedom. 

    “Over that time, America’s done a pretty good job of bringing its [servicemembers] home—with two exceptions: the Korean War and the Vietnam War,” Porter said. “Our Vietnam Veterans faced a far different return. They probably wished for an apathetic return. They faced derision, sarcasm, and hate in some cases—certainly disrespect. The purpose of these Welcome Home ceremonies is to take a moment to pause and recommit that we will never let that happen again as a nation.” 

    Gordon echoed that message, “This day is about saying, ‘Thank you for your service—welcome home.’ That gratitude extends to the families, too. Our Veterans carry a legacy that began with citizens who marched barefoot through snow because they believed in what this country stood for. In the military, we never leave anyone behind. As a nation, we should never leave a Veteran behind.” 

    As part of the ceremony, the official proclamation was read declaring March 30, 2025, as Wyoming Veterans Welcome Home Day, recognizing the moment in history when U.S. troops completed their withdrawal from Vietnam in 1973. The proclamation recounts how many Veterans returned to a country divided by politics and conflict, and how they were met not with honor—but with silence, scorn or worse. 

    “Members of the United States armed forces who served bravely and faithfully for the United States were caught in the crossfire of public debate about the involvement of the United States in the Vietnam War, and many were met with such disrespect that military leaders recommended Soldiers not wear their military uniforms as they returned home.”

    The proclamation goes on to honor all Veterans, particularly those from the Korean and Vietnam Wars, and urges citizens to recognize their service “not just today but every day.” 

    After the speeches concluded, Governor Gordon took time to greet each Veteran in attendance, shaking hands and presenting a personalized challenge coin as a token of thanks.  

    Also present were Wyoming Veterans Commission Chairman Command Sgt. Maj. (Ret.) Ken Persson, Sr., and Director Col. (Ret.) Tim Sheppard, both of whom played key roles in organizing the day’s events and honoring those who once returned home without recognition. 

    As the day came to a close, the message that echoed from community to community was simple but profound: Wyoming remembers. Wyoming is grateful. And Wyoming will never forget. 

    For more information on Veterans Welcome Home Day or to learn about available resources for Veterans, contact the Wyoming Veterans Commission at (307) 777-8152. 

    MIL OSI USA News

  • MIL-OSI Security: Richmond felon sentenced to five years in prison for latest firearms conviction

    Source: United States Bureau of Alcohol Tobacco Firearms and Explosives (ATF)

    RICHMOND, Va. – A Richmond man was sentenced today to five years in prison for possession of a firearm by a convicted felon.

    According to court documents, on March 16, 2023, Richmond Police detectives performed a traffic stop on a vehicle with no front license plate. James Marvin Smith, 43, was driving the vehicle. While speaking with Smith and a passenger, the detectives observed a crumpled lottery ticket near the cupholders and noticed that the passenger had white powder on his nose. The detectives asked Smith and the passenger to get out of the car.

    While searching the vehicle for drug evidence, a detective found a firearm and a detached extended magazine. The firearm had one round of ammunition in the chamber and the magazine was loaded with 21 rounds of ammunition.

    Prior to his arrest, Smith had been convicted of, among other crimes, possession of heroin, obstruction of justice, resisting arrest with force, possession of cocaine, breaking and entering, using a firearm in the commission of a felony, robbery, unlawful wounding, illegal possession of a firearm, assault and battery, possession of a firearm by a convicted violent felon, and grand larceny. As a previously convicted felon, Smith cannot legally possess a firearm or ammunition.

    Erik S. Siebert, U.S. Attorney for the Eastern District of Virginia; Anthony A. Spotswood, Special Agent in Charge of the Bureau of Alcohol, Tobacco, Firearms and Explosives Washington Field Division; Rick Edwards, Chief of Richmond Police; and Colette Wallace McEachin, Commonwealth’s Attorney for the City of Richmond, made the announcement after sentencing by Senior U.S. District Judge John A. Gibney Jr.

    Special Assistant U.S. Attorney Katherine E. Groover, an Assistant Commonwealth’s Attorney with the Richmond Commonwealth’s Attorney Office, prosecuted the case.

    This case is part of Project Safe Neighborhoods (PSN), a program bringing together all levels of law enforcement and the communities they serve to reduce violent crime and gun violence, and to make our neighborhoods safer for everyone. On May 26, 2021, the Department launched a violent crime reduction strategy strengthening PSN based on these core principles: fostering trust and legitimacy in our communities, supporting community-based organizations that help prevent violence from occurring in the first place, setting focused and strategic enforcement priorities, and measuring the results.

    A copy of this press release is located on the website of the U.S. Attorney’s Office for the Eastern District of Virginia. Related court documents and information are located on the website of the District Court for the Eastern District of Virginia or on PACER by searching for Case No. 3:24-cr-23.

    MIL Security OSI

  • MIL-OSI Security: Convicted Felon Sentenced To Prison For Carjacking On College Campus Using A “Ghost Gun”

    Source: United States Bureau of Alcohol Tobacco Firearms and Explosives (ATF)

    CHARLOTTE, N.C. – A man who used a privately made and unregistered firearm, commonly known as a “ghost gun,” to carjack a vehicle on a college campus was sentenced yesterday to seven years in prison for a firearms offense, announced Russ Ferguson, U.S. Attorney for the Western District of North Carolina. Mark Jordan Williams, 37, was also ordered to serve three years of supervised release following the completion of his prison term.

    Alicia Jones, Special Agent in Charge of the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), Charlotte Field Division, joins U.S. Attorney Ferguson in making today’s announcement.

    According to court documents and court proceedings, on March 23, 2023, an individual identified as L.C. was sitting in a Jeep Wrangler, parked on the campus of the University of North Carolina-Charlotte. Court records show that Williams approached the vehicle, pointed a handgun at L.C. and ordered L.C. out of the car. Williams then took L.C.’s phone, got into the Jeep, and drove away. Williams was located and arrested later that evening while inside the Jeep. When Williams was arrested, a .40 caliber Polymer 80 handgun was recovered from inside the vehicle as well. During the investigation, law enforcement determined that Williams has multiple prior criminal convictions and he prohibited from possessing a firearm.

    On January 9, 2025, Williams pleaded guilty to possession and brandishing of a firearm in furtherance of a crime of violence. He is in federal custody and will be transferred to the custody of the Federal Bureau of Prisons upon designation of a federal facility. 

    The ATF investigated the case and the U.S. Attorney’s Office in Charlotte handled the prosecution.

     

    MIL Security OSI

  • MIL-OSI Security: St. Augustine Felon Sentenced To More Than Four Years For Illegally Possessing And Selling Firearms

    Source: United States Bureau of Alcohol Tobacco Firearms and Explosives (ATF)

    Jacksonville, Florida – U.S. District Judge Harvey Schlesinger has sentenced Alton Wayne Cope, III (64, St. Augustine) to four years and three months in federal prison for possessing a firearm as a convicted felon and conspiring to deal firearms without a license. Cope entered a guilty plea in October 2024.

    According to court documents, agents began investigating Cope and a co-conspirator when agents learned that Cope may have been illegally selling firearms. During the summer of 2024, agents conducted multiple controlled purchase operations during which they purchased 11 firearms from Cope and a co-conspirator. Throughout the investigation, agents learned that Braden Hobbs was the original purchaser of multiple firearms purchased from Cope and a co-conspirator. Cellphone records later showed that the co-conspirator regularly purchased firearms from Hobbs. Additionally, at least two of the firearms sold by Cope and a co-conspirator had previously been reported stolen. In August 2024, agents executed a federal search warrant at Cope’s residence. During the search, agents found an additional firearm in his bedroom.

    Although he engaged in the business of dealing firearms, Cope is not a federally licensed firearms dealer, as required by federal law. Additionally, Cope was previously convicted of multiple felonies, including two counts of possession of cocaine and possession of a firearm by a convicted felon. Therefore, he is prohibited from possessing firearms or ammunition under federal law.

    In related court proceedings, co-conspirator Braden Hobbs has been charged by indictment and is scheduled for trial later this year. If convicted, Hobbs faces a minimum sentence of 5 years, up to 95 years, in federal prison. An indictment is merely a formal charge that a defendant has committed one or more violations of federal criminal law, and every defendant is presumed innocent unless, and until, proven guilty.

    This case was investigated by the Bureau of Alcohol, Tobacco, Firearms and Explosives, the Internal Revenue Service – Criminal Investigation, the United States Secret Service, the North Florida HIDTA Tri-County Narcotics Task Force with the Florida Department of Law Enforcement, the St. Johns County Sheriff’s Office, and the Jacksonville Sheriff’s Office. It is being prosecuted by Assistant United States Attorney Elisibeth Adams.

    This case is part of Project Safe Neighborhoods (PSN), a program bringing together all levels of law enforcement and the communities they serve to reduce violent crime and gun violence, and to make our neighborhoods safer for everyone. On May 26, 2021, the Department launched a violent crime reduction strategy strengthening PSN based on these core principles: fostering trust and legitimacy in our communities, supporting community-based organizations that help prevent violence from occurring in the first place, setting focused and strategic enforcement priorities, and measuring the results.

    MIL Security OSI

  • MIL-OSI USA: Smoky Zabaykal’skiy

    Source: NASA

    As soon as snow melted from Russia’s Zabaykal’skiy Kray in mid-March 2025, satellites began detecting large numbers of wildland fires burning in the grasslands and forests surrounding Chita, the territory’s capital. Two months later, fires continued to rage around the city.
    The MODIS (Moderate Resolution Imaging Spectroradiometer) on NASA’s Aqua satellite captured this image of smoke streaming from multiple fires near Chita on May 19, 2025. The city, a stop along the Trans-Siberian Railway, has a population of about 350,000. News reports indicate that fires were active on the city’s outskirts on May 20 and were edging closer to the city center as firefighters worked amid dry, windy conditions.
    On May 20, 2025, Russia’s Aerial Protection Service reported 49 fires burning across nearly 700,000 hectares (2,700 square miles) in six regions of the country. Thirty-three fires were in Zabaykal’skiy (also called Transbaikal) and nine in Buryatiya, both of which border Mongolia. Russian officials reported deploying 2,700 personnel and 13 aircraft to fight the fires, including more than 1,000 paratroopers and airborne troops in Zabaykal’skiy.
    NASA Earth Observatory image by Michala Garrison, using MODIS data from NASA EOSDIS LANCE and GIBS/Worldview. Story by Adam Voiland.

    MIL OSI USA News

  • MIL-OSI USA: Disaster Recovery Centers to Permanently Close May 31; Resources Transitioning to New Locations

    Source: US Federal Emergency Management Agency 2

    strong>LOS ANGELES – The two Disaster Recovery Centers (DRCs) for the Los Angeles Wildfires are permanently closing Saturday, May 31, 2025, at 4 p.m. and federal resources will be transitioning to new locations.
    Current DRC Locations and Hours
    UCLA Research Park West 10850 West Pico Blvd. Los Angeles, CA 90064 Monday-Friday: 9 a.m. – 6 p.m. and Saturday: 9 a.m. – 4 p.m.
    Altadena Disaster Recovery Center540 West Woodbury Rd. Altadena, CA 91001 Monday-Friday: 9 a.m. – 6 p.m. and Saturday: 9 a.m. – 4 p.m. 
    The Federal Emergency Management Agency (FEMA) and Small Business Administration (SBA) will be transitioning from the current DRC locations to county and city run facilities. Federal resources will be available at their new locations beginning Monday, June 2, 2025.
    Services Will Continue at:
    One Stop Rebuilding Center1828 Sawtelle Blvd.Los Angeles, CA 90025 Monday-Friday: 9 a.m. – 5 p.m. Closed weekends.
    Altadena Community Center730 E. Altadena Dr.Altadena, CA 91001Monday-Friday: 9 a.m. – 5 p.m. Closed weekends.
    If you applied for FEMA assistance, it’s important to stay in touch with FEMA to track and update your application should you receive an insurance settlement or denial and as your situation changes to work through any approval processes. FEMA representatives can explain available assistance programs and help you with resources for your recovery needs.
    Rental Assistance is available for eligible individuals and families who were displaced by the wildfires. If you were displaced and need assistance covering housing costs, you should contact FEMA to determine your eligibility for this program. 
    SBA’s Customer Service Representatives are available at the Centers to answer questions, help applicants complete their disaster loan application, accept documents, and provide updates on an application’s status.
    Additional Resources

    California Governor’s Office of Emergency Services (CalOES)Resources offered by State agencies are available online and at some existing field offices. Survivors can find a complete list of recovery related services on the CA.gov/LAfires Recovery Services Finder page, including how to contact each agency and their office locations.
    U.S. Army Corps of Engineers (USACE)For help answering questions regarding debris removal, please call: 213-308-8305. The call center is available daily from 6 a.m. to 6:30 p.m. For more information, you can also visit the USACE Los Angeles County Wildfire Debris Removal Mission.
    One-Stop Permitting CentersFor unincorporated LA County communities, One-Stop Permit Centers are also available in Calabasas and Altadena for residents impacted by the Palisades and Eaton fires. LA County permitting agencies, including Fire Department, Regional Planning, Public Health, Public Works Geotechnical and Materials Engineering Division and Public Works Building and Safety, are available to guide owners and their representatives through the rebuild process and answer any questions they may have. Walk-ins are welcome and consultation appointments can be scheduled. More information including days and hours of operation, can be found here: recovery.lacounty.gov/rebuilding/one-stop-permit-centers. 

    Follow FEMA online, on X @FEMA or @FEMAEspanol, on FEMA’s Facebook page or Espanol page and at FEMA’s YouTube account. For preparedness information follow the Ready Campaign on X at @Ready.gov, on Instagram @Ready.gov or on the Ready Facebook page.

    California is committed to supporting residents impacted by the Los Angeles Hurricane-Force Firestorm as they navigate the recovery process. Visit CA.gov/LAFires for up-to-date information on disaster recovery programs, important deadlines, and how to apply for assistance.

    MIL OSI USA News

  • MIL-OSI USA: NASA-French Satellite Spots Large-Scale River Waves for First Time

    Source: NASA

    In a first, researchers from NASA and Virginia Tech used satellite data to measure the height and speed of potentially hazardous flood waves traveling down U.S. rivers. The three waves they tracked were likely caused by extreme rainfall and by a loosened ice jam. While there is currently no database that compiles satellite data on river flood waves, the new study highlights the potential of space-based observations to aid hydrologists and engineers, especially those working in communities along river networks with limited flood control structures such as levees and flood gates.
    Unlike ocean waves, which are ordinarily driven by wind and tides, and roll to shore at a steady clip, river waves (also called flood or flow waves) are temporary surges stretching tens to hundreds of miles. Typically caused by rainfall or seasonal snowmelt, they are essential to shuttling nutrients and organisms down a river. But they can also pose hazards: Extreme river waves triggered by a prolonged downpour or dam break can produce floods.
    “Ocean waves are well known from surfing and sailing, but rivers are the arteries of the planet. We want to understand their dynamics,” said Cedric David, a hydrologist at NASA’s Jet Propulsion Laboratory in Southern California and a coauthor of a new study published May 14 in Geophysical Research Letters.

    Measuring Speed and Size
    To search for river waves for her doctoral research, lead author Hana Thurman of Virginia Tech turned to a spacecraft launched in 2022. The SWOT (Surface Water and Ocean Topography) satellite is a collaboration between NASA and the French space agency CNES (Centre National d’Études Spatiales). It is surveying the height of nearly all of Earth’s surface waters, both fresh and salty, using its sensitive Ka-band Radar Interferometer (KaRIn). The instrument maps the elevation and width of water bodies by bouncing microwaves off the surface and timing how long the signal takes to return.
    “In addition to monitoring total storage of waters in lakes and rivers, we zoom in on dynamics and impacts of water movement and change,” said Nadya Vinogradova Shiffer, SWOT program scientist at NASA Headquarters in Washington.
    Thurman knew that SWOT has helped scientists track rising sea levels near the coast, spot tsunami slosh, and map the seafloor, but could she identify river height anomalies in the data indicating a wave on the move?
    She found that the mission had caught three clear examples of river waves, including one that arose abruptly on the Yellowstone River in Montana in April 2023. As the satellite passed overhead, it observed a 9.1-foot-tall (2.8-meter-tall) crest flowing toward the Missouri River in North Dakota. It was divided into a dramatic 6.8-mile-long (11-kilometer-long) peak followed by a more drawn‐out tail. These details are exciting to see from orbit and illustrate the KaRIn instrument’s uniquely high spatial resolution, Thurman said.
    Sleuthing through optical Sentinel-2 imagery of the area, she determined that the wave likely resulted from an ice jam breaking apart upstream and releasing pent-up water.
    The other two river waves that Thurman and the team found were triggered by rainfall runoff. One, spotted by SWOT starting on Jan. 25, 2024, on the Colorado River south of Austin, Texas, was associated with the largest flood of the year on that section of river. Measuring over 30 feet (9 meters) tall and 166 miles (267 kilometers) long, it traveled around 3.5 feet (1.07 meters) per second for over 250 miles (400 kilometers) before discharging into Matagorda Bay.
    The other wave originated on the Ocmulgee River near Macon, Georgia, in March 2024. Measuring over 20 feet (6 meters) tall and extending more than 100 miles (165 kilometers), it traveled about a foot (0.33 meters) per second for more than 124 miles (200 kilometers).
    “We’re learning more about the shape and speed of flow waves, and how they change along long stretches of river,” Thurman said. “That could help us answer questions like, how fast could a flood get here and is infrastructure at risk?”
    Complementary Observations
    Engineers and water managers measuring river waves have long relied on stream gauges, which record water height and estimate discharge at fixed points along a river. In the United States, stream gauge networks are maintained by agencies including the U.S. Geological Survey. They are sparser in other parts of the world.
    “Satellite data is complementary because it can help fill in the gaps,” said study supervisor George Allen, a hydrologist and remote sensing expert at Virginia Tech.
    If stream gauges are like toll booths clocking cars as they pass, SWOT is like a traffic helicopter taking snapshots of the highway.
    The wave speeds that SWOT helped determine were similar to those calculated using gauge data alone, Allen said, showing how the satellite could help monitor waves in river basins without gauges. Knowing where and why river waves develop can help scientists tracking changing flood patterns around the world.
    Orbiting Earth multiple times each day, SWOT is expected to observe some 55% of large-scale floods at some stage in their life cycle. “If we see something in the data, we can say something,” David said of SWOT’s potential to flag dangerous floods in the making. “For a long time, we’ve stood on the banks of our rivers, but we’ve never seen them like we are now.”
    More About SWOT
    The SWOT satellite was jointly developed by NASA and CNES, with contributions from the Canadian Space Agency (CSA) and the UK Space Agency. NASA’s Jet Propulsion Laboratory, managed for the agency by Caltech in Pasadena, California, leads the U.S. component of the project. For the flight system payload, NASA provided the Ka-band radar interferometer (KaRIn) instrument, a GPS science receiver, a laser retroreflector, a two-beam microwave radiometer, and NASA instrument operations. The Doppler Orbitography and Radioposition Integrated by Satellite system, the dual frequency Poseidon altimeter (developed by Thales Alenia Space), the KaRIn radio-frequency subsystem (together with Thales Alenia Space and with support from the UK Space Agency), the satellite platform, and ground operations were provided by CNES. The KaRIn high-power transmitter assembly was provided by CSA.
    News Media Contacts
    Jane J. Lee / Andrew WangJet Propulsion Laboratory, Pasadena, Calif.818-354-0307 / 626-379-6874Written by Sally Younger2025-074

    MIL OSI USA News

  • MIL-OSI USA: Russian GRU Targeting Western Logistics Entities and Technology Companies

    News In Brief – Source: US Computer Emergency Readiness Team

    Executive Summary

    This joint cybersecurity advisory (CSA) highlights a Russian state-sponsored cyber campaign targeting Western logistics entities and technology companies. This includes those involved in the coordination, transport, and delivery of foreign assistance to Ukraine. Since 2022, Western logistics entities and IT companies have faced an elevated risk of targeting by the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (85th GTsSS), military unit 26165—tracked in the cybersecurity community under several names (see “Cybersecurity Industry Tracking”). The actors’ cyber espionage-oriented campaign, targeting technology companies and logistics entities, uses a mix of previously disclosed tactics, techniques, and procedures (TTPs). The authoring agencies expect similar targeting and TTP use to continue.

    Executives and network defenders at logistics entities and technology companies should recognize the elevated threat of unit 26165 targeting, increase monitoring and threat hunting for known TTPs and indicators of compromise (IOCs), and posture network defenses with a presumption of targeting.

    This cyber espionage-oriented campaign targeting logistics entities and technology companies uses a mix of previously disclosed TTPs and is likely connected to these actors’ wide scale targeting of IP cameras in Ukraine and bordering NATO nations.

    The following authors and co-sealers are releasing this CSA:

    • United States National Security Agency (NSA)
    • United States Federal Bureau of Investigation (FBI)
    • United Kingdom National Cyber Security Centre (NCSC-UK)
    • Germany Federal Intelligence Service (BND) Bundesnachrichtendienst
    • Germany Federal Office for Information Security (BSI) Bundesamt für Sicherheit in der Informationstechnik
    • Germany Federal Office for the Protection of the Constitution (BfV) Bundesamt für Verfassungsschutz
    • Czech Republic Military Intelligence (VZ)  Vojenské zpravodajství
    • Czech Republic National Cyber and Information Security Agency (NÚKIB) Národní úřad pro kybernetickou a informační bezpečnost
    • Czech Republic Security Information Service (BIS) Bezpečnostní informační služba
    • Poland Internal Security Agency (ABW) Agencja Bezpieczeństwa Wewnętrznego
    • Poland Military Counterintelligence Service (SKW) Służba Kontrwywiadu Wojskowego
    • United States Cybersecurity and Infrastructure Security Agency (CISA)
    • United States Department of Defense Cyber Crime Center (DC3)
    • United States Cyber Command (USCYBERCOM)
    • Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
    • Canadian Centre for Cyber Security (CCCS)
    • Danish Defence Intelligence Service (DDIS) Forsvarets Efterretningstjeneste
    • Estonian Foreign Intelligence Service (EFIS) Välisluureamet
    • Estonian National Cyber Security Centre (NCSC-EE) Küberturvalisuse keskus
    • French Cybersecurity Agency (ANSSI) Agence nationale de la sécurité des systèmes d’information
    • Netherlands Defence Intelligence and Security Service (MIVD) Militaire Inlichtingen- en Veiligheidsdienst
       

    Download the PDF version of this report:

    Russian GRU Targeting Western Logistics Entities and Technology Companies (PDF, 1,081KB)

    For a downloadable list of IOCs, visit:

    Introduction

    For over two years, the Russian GRU 85th GTsSS, military unit 26165—commonly known in the cybersecurity community as APT28, Fancy Bear, Forest Blizzard, BlueDelta, and a variety of other identifiers—has conducted this campaign using a mix of known tactics, techniques, and procedures (TTPs), including reconstituted password spraying capabilities, spearphishing, and modification of Microsoft Exchange mailbox permissions.
    In late February 2022, multiple Russian state-sponsored cyber actors increased the variety of cyber operations for purposes of espionage, destruction, and influence—with unit 26165 predominately involved in espionage. [1] As Russian military forces failed to meet their military objectives and Western countries provided aid to support Ukraine’s territorial defense, unit 26165 expanded its targeting of logistics entities and technology companies involved in the delivery of aid. These actors have also targeted Internet-connected cameras at Ukrainian border crossings to monitor and track aid shipments.
    Note: This advisory uses the MITRE ATT&CK® for Enterprise framework, version 17. See Appendix A: MITRE ATT&CK tactics and techniques for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques. This advisory uses the MITRE D3FEND® framework, version 1.0.

    Description of Targets

    The GRU unit 26165 cyber campaign against Western logistics providers and technology companies has targeted dozens of entities, including government organizations and private/commercial entities across virtually all transportation modes: air, sea, and rail. These actors have targeted entities associated with the following verticals within NATO member states, Ukraine, and at international organizations: 

    •  Defense Industry
    • Transportation and Transportation Hubs (ports, airports, etc.)
    • Maritime
    • Air Traffic Management
    • IT Services

    In the course of the targeting lifecycle, unit 26165 actors identified and conducted follow-on targeting of additional entities in the transportation sector that had business ties to the primary target, exploiting trust relationships to attempt to gain additional access [T1199].

    The actors also conducted reconnaissance on at least one entity involved in the production of industrial control system (ICS) components for railway management, though a successful compromise was not confirmed [TA0043].

    The countries with targeted entities include the following, as illustrated in Figure 1:

    • Bulgaria
    • Czech Republic
    • France
    • Germany
    • Greece
    • Italy
    • Moldova
    • Netherlands
    • Poland
    • Romania
    • Slovakia
    • Ukraine
    • United States
       
    Figure 1: Countries with Targeted Entities

    Initial Access TTPs

    To gain initial access to targeted entities, unit 26165 actors used several techniques to gain initial access to targeted entities, including (but not limited to):

    The actors abused vulnerabilities associated with a range of brands and models of small office/home office (SOHO) devices to facilitate covert cyber operations, as well as proxy malicious activity via devices with geolocation in proximity to the target [T1665]. [2]

    Credential Guessing/Brute Force

    Unit 26165 actors’ credential guessing [T1110.001] operations in this campaign exhibit some similar characteristics to those disclosed in the previous CSA “Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments.” [3] Based on victim network investigations, the current iteration of this TTP employs a similar blend of anonymization infrastructure, including the use of Tor and commercial VPNs [T1090.003]. The actors frequently rotated the IP addresses used to further hamper detection. All observed connections were made via encrypted TLS [T1573]. 

    Spearphishing

    GRU unit 26165 actors’ spearphishing emails included links [T1566.002] leading to fake login pages impersonating a variety of government entities and Western cloud email providers’ webpages. These webpages were typically hosted on free third-party services or compromised SOHO devices and often used legitimate documents associated with thematically similar entities as lures. The subjects of spearphishing emails were diverse and ranged from professional topics to adult themes. Phishing emails were frequently sent via compromised accounts or free webmail accounts [T1586.002, T1586.003]. The emails were typically written in the target’s native language and sent to a single targeted recipient. 

    Some campaigns employed multi-stage redirectors [T1104] verifying IP-geolocation [T1627.001] and browser fingerprints [T1627] to protect credential harvesting infrastructure or provide multifactor authentication (MFA) [T1111] and CAPTCHA relaying capabilities [T1056]. Connecting endpoints failing the location checks were redirected to a benign URL [T1627], such as msn.com. Redirector services used include:

    • Webhook[.]site
    • FrgeIO
    • InfinityFree
    • Dynu
    • Mocky
    • Pipedream
    • Mockbin[.]org

    The actors also used spearphishing to deliver malware (including HEADLACE and MASEPIE) executables [T1204.002] delivered via third-party services and redirectors [T1566.002], scripts in a mix of languages [T1059] (including BAT [T1059.003] and VBScript [T1059.005]) and links to hosted shortcuts [T1204.001].

    CVE Usage

    Throughout this campaign, GRU unit 26165 weaponized an Outlook NTLM vulnerability (CVE-2023-23397) to collect NTLM hashes and credentials via specially crafted Outlook calendar appointment invitations [T1187]. [4],[5] These actors also used a series of Roundcube CVEs (CVE-2020-12641, CVE-2020-35730, and CVE-2021-44026) to execute arbitrary shell commands [T1059], gain access to victim email accounts, and retrieve sensitive data from email servers [T1114].

    Since at least fall 2023, the actors leveraged a WinRAR vulnerability (CVE-2023-38831) allowing for the execution of arbitrary code embedded in an archive as a means of initial access [T1659]. The actors sent emails with malicious attachments [T1566.001] or embedded hyperlinks [T1566.002] that downloaded a malicious archive prepared using this CVE. 

    Post-Compromise TTPs

    After an initial compromise using one of the above techniques, unit 26165 actors conducted contact information reconnaissance to identify additional targets in key positions [T1589.002]. The actors also conducted reconnaissance of the cybersecurity department [T1591], individuals responsible for coordinating transport [T1591.004], and other companies cooperating with the victim entity [T1591.002].

    The actors used native commands and open source tools, such as Impacket and PsExec, to move laterally within the environment [TA0008]. Multiple Impacket scripts were used as .exe files, in addition to the python versions, depending on the victim environment. The actors also moved laterally within the network using Remote Desktop Protocol (RDP) [T1021.001] to access additional hosts and attempt to dump Active Directory NTDS.dit domain databases [T1003.003] using native Active Directory Domain Services commands, such as in Figure 2: Example Active Directory Domain Services command:

    C:Windowssystem32ntdsutil.exe "activate instance ntds" ifm "create full C:temp[a-z]{3}" quit quit

    Figure 2: Example Active Directory Domain Services command

    Additionally, GRU unit 26165 actors used the tools Certipy and ADExplorer.exe to exfiltrate information from the Active Directory. The actors installed python [T1059.006] on infected machines to enable the execution of Certipy. Accessed files were archived in .zip files prior to exfiltration [T1560]. The actors attempted to exfiltrate archived data via a previously dropped OpenSSH binary [T1048].

    Incident response investigations revealed that the actors would take steps to locate and exfiltrate lists of Office 365 users and set up sustained email collection. The actors used manipulation of mailbox permissions [T1098.002] to establish sustained email collection at compromised logistics entities, as detailed in a Polish Cybercommand blog. [6]

    After initial authentication, unit 26165 actors would change accounts’ folder permissions and enroll compromised accounts in MFA mechanisms to increase the trust-level of compromised accounts and enable sustained access [T1556.006]. The actors leveraged python scripts to retrieve plaintext passwords via Group Policy Preferences [T1552.006] using Get-GPPPassword.py and a modified ldap-dump.py to enumerate the Windows environment [T1087.002] and conduct a brute force password spray [T1110.003] via Lightweight Directory Access Protocol (LDAP). The actors would additionally delete event logs through the wevtutil utility [T1070.001].

    After gaining initial access to the network, the actors pursued further access to accounts with access to sensitive information on shipments, such as train schedules and shipping manifests. These accounts contained information on aid shipments to Ukraine, including: 

    • sender,
    • recipient,
    • train/plane/ship numbers,
    • point of departure,
    • destination,
    • container registration numbers,
    • travel route, and
    • cargo contents. 

    In at least one instance, the actors attempted to use voice phishing [T1566.004] to gain access to privileged accounts by impersonating IT staff.

    Malware

    Unit 26165’s use of malware in this campaign ranged from gaining initial access to establishing persistence and exfiltrating data. In some cases, the attack chain resulted in multiple pieces of malware being deployed in succession. The actors used dynamic link library (DLL) search order hijacking [T1574.001] to facilitate malware execution. There were a number of known malware variants tied to this campaign against logistics sector victims, including:

    • HEADLACE [7]
    • MASEPIE [8]

    While other malware variants, such as OCEANMAP and STEELHOOK, [8] were not directly observed targeting logistics or IT entities, their deployment against victims in other sectors in Ukraine and other Western countries suggest that they could be deployed against logistics and IT entities should the need arise. 

    Persistence

    In addition to the abovementioned mailbox permissions abuse, unit 26165 actors also used scheduled tasks [T1053.005], run keys [T1547.001], and placed malicious shortcuts [T1547.009] in the startup folder to establish persistence. 

    Exfiltration

    GRU unit 26165 actors used a variety of methods for data exfiltration that varied based on the victim environment, including both malware and living off the land binaries. PowerShell commands [T1059.001] were often used to prepare data for exfiltration; for example, the actors prepared zip archives [T1560.001] for upload to their own infrastructure. 

    The actors also used server data exchange protocols and Application Programming Interfaces (APIs) such as Exchange Web Services (EWS) and Internet Message Access Protocol (IMAP) [T1114.002] to exfiltrate data from email servers. In multiple instances, the actors used periodic EWS queries [T1119] to collect new emails sent and received since the last data exfiltration [T1029]. The actors typically used infrastructure in close geographic proximity to the victim. Long gaps between exfiltration, the use of trusted and legitimate protocols, and the use of local infrastructure allowed for long-term collection of sensitive data to go undetected. 

    Connections to Targeting of IP Cameras

    In addition to targeting logistics entities, unit 26165 actors likely used access to private cameras at key locations, such as near border crossings, military installations, and rail stations, to track the movement of materials into Ukraine. The actors also used legitimate municipal services, such as traffic cams. 

    The actors targeted Real Time Streaming Protocol (RTSP) servers hosting IP cameras primarily located in Ukraine as early as March 2022 in a large-scale campaign, which included attempts to enumerate devices [T1592] and gain access to the cameras’ feeds [T1125]. Actor-controlled servers sent RTSP DESCRIBE requests destined for RTSP servers, primarily hosting IP cameras [T1090.002]. The DESCRIBE requests were crafted to obtain access to IP cameras located on logically distinct networks from that of the routers that received the request. The requests included Base64-encoded credentials for the RTSP server, which included publicly documented default credentials and likely generic attempts to brute force access to the devices [T1110]. An example of an RTSP request is shown in Figure 3.

    DESCRIBE rtsp://[IP ADDRESS] RTSP/1.0

    CSeq: 1

    Authorization: Basic

    User-Agent: WebClient

    Accept: application/sdp

    DESCRIBE rtsp://[IP ADDRESS] RTSP/1.0

    CSeq: 2

    Authorization: Digest username="admin", realm="[a-f0-9]{12}", algorithm="MD5", nonce="[a-f0-9]{32}", uri="", response="[a-f0-9]{32}"

    User-Agent: WebClient

    Accept: application/sdp

    Figure 3: Example RTSP request

    Successful RTSP 200 OK responses contained a snapshot of the IP camera’s image and IP camera metadata such as video codec, resolution, and other properties depending on the IP camera’s configuration. 

    From a sample available to the authoring agencies of over 10,000 cameras targeted via this effort, the geographic distribution of victims showed a strong focus on cameras in Ukraine and border countries, as shown in Table 1:

    Table 1: Geographic distribution of targeted IP cameras
    Country Percentage of Total Attempts
    Ukraine 81.0%
    Romania 9.9%
    Poland 4.0%
    Hungary 2.8%
    Slovakia 1.7%
    Others 0.6%

    Mitigation Actions

    General Security Mitigations

    Architecture and Configuration

    • Employ appropriate network segmentation [D3-NI] and restrictions to limit access and utilize additional attributes (such as device information, environment, and access path) when making access decisions [D3-AMED].
      • Consider Zero Trust principles when designing systems. Base product choices on how those products can solve specific risks identified as part of the end-to-end design. [9]
    • Ensure that host firewalls and network security appliances (e.g., firewalls) are configured to only allow legitimately needed data flows between devices and servers to prevent lateral movement [D3-ITF]. Alert on attempts to connect laterally between host devices or other unusual data flows.
    • Use automated tools to audit access logs for security concerns and identify anomalous access requests [D3-RAPA].
    • For organizations using on-premises authentication and email services, block and alert on NTLM/SMB requests to external infrastructure [D3-OTF].
    • Utilize endpoint, detection, and response (EDR) and other cybersecurity solutions on all systems, prioritizing high value systems with large amounts of sensitive data such as mail servers and domain controllers [D3-PM] first.
      • Perform threat and attack modeling to understand how sensitive systems may be compromised within an organization’s specific architecture and security controls. Use this to develop a monitoring strategy to detect compromise attempts and select appropriate products to enact this strategy.
    • Collect and monitor Windows logs for certain events, especially for events that indicate that a log was cleared unexpectedly [D3-SFA].
    • Enable optional security features in Windows to harden endpoints and mitigate initial access techniques [D3-AH]:
      • Enable attack surface reduction rules to prevent executable content from email [D3-ABPI].
      • Enable attack surface reduction rules to prevent execution of files from globally writeable directories, such as Downloads or %APPDATA% [D3-EAL].
      • Unless users are involved in the development of scripts, limit the local execution of scripts (such as batch scripts, VBScript, JScript/JavaScript, and PowerShell [10]) to known scripts [D3-EI], and audit execution attempts.
      • Disable Windows Host Scripting functionality and configure PowerShell to run in Constrained mode [D3-ACH].
    • Where feasible, implement allowlisting for applications and scripts to limit execution to only those needed for authorized activities, blocking all others by default [D3-EAL].
    • Consider using open source SIGMA rules as a baseline for detecting and alerting on suspicious file execution or command parameters [D3-PSA].
    • Use services that provide enhanced browsing services and safe link checking [D3-URA]. Significant reductions in successful spearphishing attempts were noted when email providers began offering link checking and automatic file detonation to block malicious content.
    • Where possible, block logins from public VPNs, including exit nodes in the same country as target systems, or, if they need to be allowed, alert on them for further investigation. Most organizations should not need to allow incoming traffic, especially logins to systems, from VPN services [D3-NAM].
    • Educate users to only use approved corporate systems for relevant government and military business and avoid the use of personal accounts on cloud email providers to conduct official business. Network administrators should also audit both email and web request logs to detect such activity.

    Many organizations may not need to allow outgoing traffic to hosting and API mocking services, which are frequently used by GRU unit 26165. Organizations should consider alerting on or blocking the following services, with exceptions allowlisted for legitimate activity [D3-DNSDL].

    • *.000[.]pe
    • *.1cooldns[.]com
    • *.42web[.]io
    • *.4cloud[.]click
    • *.accesscan[.]org
    • *.bumbleshrimp[.]com
    • *.camdvr[.]org
    • *.casacam[.]net
    • *.ddnsfree[.]com
    • *.ddnsgeek[.]com
    • *.ddnsguru[.]com
    • *.dynuddns[.]com
    • *.dynuddns[.]net
    • *.free[.]nf
    • *.freeddns[.]org
    • *.frge[.]io
    • *.glize[.]com
    • *.great-site[.]net
    • *.infinityfreeapp[.]com
    • *.kesug[.]com
    • *.loseyourip[.]com
    • *.lovestoblog[.]com
    • *.mockbin[.]io
    • *.mockbin[.]org
    • *.mocky[.]io
    • *.mybiolink[.]io
    • *.mysynology[.]net
    • *.mywire[.]org
    • *.ngrok[.]io
    • *.ooguy[.]com
    • *.pipedream[.]net
    • *.rf[.]gd
    • *.urlbae[.]com
    • *.webhook[.]site
    • *.webhookapp[.]com
    • *.webredirect[.]org
    • *.wuaze[.]com

    Heuristic detections for web requests to new subdomains, including of the above providers, may uncover malicious phishing activity [D3-DNRA]. Logging the requests for each sub-domain requested by users on a network, such as in DNS or firewall logs, may enable system administrators to identify new targeting and victims.

    Identity and Access Management

    Organizations should take measures to ensure strong access controls and mitigate against common credential theft techniques: 

    • Use MFA with strong factors, such as passkeys or PKI smartcards, and require regular re-authentication [D3-MFA]. [11], [12] Strong authentication factors are not guessable using dictionary techniques, so they resist brute force attempts.
    • Implement other mitigations for privileged accounts: including limiting the number of admin accounts, considering using hardware MFA tokens, and regularly reviewing all privileged user accounts [D3-JFAPA].
    • Separate privileged accounts by role and alert on misuse of privileged accounts [D3-UAP]. For example, email administrator accounts should be different from domain administrator accounts.
    • Reduce reliance on passwords; instead, consider using services like single sign-on [D3-TBA].
      • For organizations using on-premises authentication and email services, plan to disable NTLM entirely and migrate to more robust authentication processes such as PKI certificate authentication.
    • Do not store passwords in Group Policy Preferences (GPP). Remove all passwords previously included in GPP and change all passwords on the corresponding accounts [D3-CH]. [13]
    • Use account throttling or account lockout [D3-ANET]:
      • Throttling is preferred to lockout. Throttling progressively increases time delay between successive login attempts.
      • Account lockout can leave legitimate users unable to access their accounts and requires access to an account recovery process.
      • Account lockout can provide a malicious actor with an easy way to launch a Denial of Service (DoS).
      • If using lockout, then allowing 5 to 10 attempts before lockout is recommended.
    • Use a service to check for compromised passwords before using them [D3-SPP]. For example, “Have I Been Pwned” can be used to check whether a password has been previously compromised without disclosing the potential password.
    • Change all default credentials [D3-CRO] and disable protocols that use weak authentication (e.g., clear-text passwords or outdated and vulnerable authentication or encryption protocols) or do not support multi-factor authentication [D3-ACH] [D3-ET]. Always configure access controls carefully to ensure that only well-maintained and well-authenticated accounts have access. [13]

    IP Camera Mitigations

    The following mitigation techniques for IP cameras can be used to defend against this type of malicious activity:

    • Ensure IP cameras are currently supported. Replace devices that are out of support.
    • Apply security patches and firmware updates to all IP cameras [D3-SU].
    • Disable remote access to the IP camera, if unnecessary [D3-ITF].
    • Ensure cameras are protected by a security appliance, if possible, such as by using a firewall to prevent communication with the camera from IP addresses not on an allowlist [D3-NAM].
    • If remote access to IP camera feeds is required, ensure authentication is enabled [D3-AA] and use a VPN to connect remotely [D3-ET]. Use MFA for management accounts if supported [D3-MFA].
    • Disable Universal Plug and Play (UPnP), Peer-to-Peer (P2P), and Anonymous Visit features on IP cameras and routers [D3-NI].
    • Turn off other ports/services not in use (e.g., FTP, web interface, etc.) [D3-ACH].
    • If supported, enable authenticated RTSP access only [D3-AA].
    • Review all authentication activity for remote access to make sure it is valid and expected [D3-UBA]. Investigate any unexpected or unusual activity.
    • Audit IP camera user accounts to ensure they are an accurate reflection of your organization and that they are being used as expected [D3-UAP].
    • Configure, tune, and monitor logging—if available—on the IP camera.

    Indicators of Compromise (IOCs)

    Note: Specific IoCs may no longer be actor controlled, may themselves be compromised infrastructure or email accounts, or may be shared infrastructure such as public VPN or Tor exit nodes. Care should be taken when basing triaging logs or developing detection rules on these indicators. GRU unit 26165 almost certainly uses extensive further infrastructure and TTPs not specifically listed in this report.

    Utilities and scripts

    Legitimate utilities

    Unauthorized or unusual use of the following legitimate utilities can be an indication of a potential compromise:

    • ntdsutil – A legitimate Windows executable used by threat actors to export contents of Active Directory
    • wevtutil – A legitimate Windows executable used by threat actors to delete event logs
    • vssadmin – A legitimate Windows executable possibly used by threat actors to make a copy of the server’s C: drive
    • ADexplorer – A legitimate window executable to view, edit, and backup Active Directory Certificate Services
    • OpenSSH – The Windows version of a legitimate open source SSH client
    • schtasks – A legitimate Windows executable used to create persistence using scheduled tasks
    • whoami – A legitimate Windows executable used to retrieve the name of the current user
    • tasklist – A legitimate Windows executable used to retrieve the list of running processes
    • hostname – A legitimate Windows executable used to retrieve the device name
    • arp – A legitimate Windows executable used to retrieve the ARP table for mapping the network environment
    • systeminfo – A legitimate Windows executable used to retrieve a comprehensive summary of device and operating system information
    • net – A legitimate Windows executable used to retrieve detailed user information
    • wmic – A legitimate Windows executable used to interact with Windows Management Instrumentation (WMI), such as to retrieve letters assigned to logical partitions on storage drives
    • cacls – A legitimate Windows executable used to modify permissions on files
    • icacls – A legitimate Windows executable used to modify permissions to files and handle integrity levels and ownership
    • ssh – A legitimate Windows executable used to establish network shell connections
    • reg – A legitimate Windows executable used to add to or modify the system registry 

    Note: Additional heuristics are needed for effective hunting for these and other living off the land (LOTL) binaries to avoid being overwhelmed by false positives if these legitimate management tools are used regularly. See the joint guide, Identifying and Mitigating Living Off the Land Techniques, for guidance on developing a multifaceted cybersecurity strategy that enables behavior analytics, anomaly detection, and proactive hunting, which are part of a comprehensive approach to mitigating cyber threats that employ LOTL techniques.

    Malicious scripts

    • Certipy – An open source python tool for enumerating and abusing Active Directory Certificate Services
    • Get-GPPPassword.py – An open source python script for finding insecure passwords stored in Group Policy Preferences
    • ldap-dump.py – A script for enumerating user accounts and other information in Active Directory
    • Hikvision backdoor string: “YWRtaW46MTEK”

    Suspicious command lines

    While the following utilities are legitimate, and using them with the command lines shown may also be legitimate, these command lines are often used during malicious activities and could be an indication of a compromise:

    • edge.exe “-headless-new -disable-gpu”
    • ntdsutil.exe “activate instance ntds” ifm “create full C:temp[a-z]{3}” quit quit
    • ssh -Nf
    • schtasks /create /xml

    Outlook CVE Exploitation IOCs

    • md-shoeb@alfathdoor[.]com[.]sa
    • jayam@wizzsolutions[.]com
    • accounts@regencyservice[.]in
    • m.salim@tsc-me[.]com
    • vikram.anand@4ginfosource[.]com
    • mdelafuente@ukwwfze[.]com
    • sarah@cosmicgold469[.]co[.]za
    • franch1.lanka@bplanka[.]com
    • commerical@vanadrink[.]com
    • maint@goldenloaduae[.]com
    • karina@bhpcapital[.]com
    • tv@coastalareabank[.]com
    • ashoke.kumar@hbclife[.]in
    • 213[.]32[.]252[.]221
    • 124[.]168[.]91[.]178
    • 194[.]126[.]178[.]8
    • 159[.]196[.]128[.]120

    Commonly Used Webmail Providers

    • portugalmail[.]pt
    • mail-online[.]dk
    • email[.]cz
    • seznam[.]cz

    Malicious Archive Filenames Involving CVE-2023-38831

    • calc.war.zip
    • news_week_6.zip
    • Roadmap.zip
    • SEDE-PV-2023-10-09-1_EN.zip
    • war.zip
    • Zeyilname.zip

    Brute Forcing IP Addresses

    Disclaimer: These IP addresses date June 2024 through August 2024. The authoring agencies recommend organizations investigate or vet these IP addresses prior to taking action, such as blocking.

    June 2024 July 2024 August 2024
    192[.]162[.]174[.]94 207[.]244[.]71[.]84 31[.]135[.]199[.]145 79[.]184[.]25[.]198 91[.]149[.]253[.]204  
    103[.]97[.]203[.]29 162[.]210[.]194[.]2 31[.]42[.]4[.]138 79[.]185[.]5[.]142 91[.]149[.]254[.]75  
    209[.]14[.]71[.]127   46[.]112[.]70[.]252 83[.]10[.]46[.]174 91[.]149[.]255[.]122  
    109[.]95[.]151[.]207   46[.]248[.]185[.]236 83[.]168[.]66[.]145 91[.]149[.]255[.]19  
        64[.]176[.]67[.]117 83[.]168[.]78[.]27 91[.]149[.]255[.]195  
        64[.]176[.]69[.]196 83[.]168[.]78[.]31   91[.]221[.]88[.]76  
        64[.]176[.]70[.]18 83[.]168[.]78[.]55   93[.]105[.]185[.]139  
        64[.]176[.]70[.]238 83[.]23[.]130[.]49   95[.]215[.]76[.]209  
        64[.]176[.]71[.]201 83[.]29[.]138[.]115   138[.]199[.]59[.]43  
        70[.]34[.]242[.]220 89[.]64[.]70[.]69   147[.]135[.]209[.]245  
        70[.]34[.]243[.]226 90[.]156[.]4[.]204   178[.]235[.]191[.]182  
        70[.]34[.]244[.]100 91[.]149[.]202[.]215   178[.]37[.]97[.]243  
        70[.]34[.]245[.]215 91[.]149[.]203[.]73   185[.]234[.]235[.]69  
        70[.]34[.]252[.]168 91[.]149[.]219[.]158 192[.]162[.]174[.]67  
        70[.]34[.]252[.]186 91[.]149[.]219[.]23   194[.]187[.]180[.]20  
        70[.]34[.]252[.]222 91[.]149[.]223[.]130   212[.]127[.]78[.]170  
        70[.]34[.]253[.]13 91[.]149[.]253[.]118 213[.]134[.]184[.]167
        70[.]34[.]253[.]247   91[.]149[.]253[.]198    
        70[.]34[.]254[.]245 91[.]149[.]253[.]20    

    Detections

    Customized NTLM listener

    rule APT28_NTLM_LISTENER {

           meta:

                  description = "Detects NTLM listeners including APT28's custom one"

           strings:

                  $command_1 = "start-process powershell.exe -WindowStyle hidden"

                  $command_2 = "New-Object System.Net.HttpListener"

                  $command_3 = "Prefixes.Add('http://localhost:8080/')"

                  $command_4 = "-match 'Authorization'"

                  $command_5 = "GetValues('Authorization')"

                  $command_6 = "Request.RemoteEndPoint.Address.IPAddressToString"

                  $command_7 = "@(0x4e,0x54,0x4c,0x4d, 0x53,0x53,0x50,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x28,0x00,0x00,0x01,0x82,0x00,0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00)"

                  $command_8 = ".AllKeys"

                  

                  $variable_1 = "$NTLMAuthentication" nocase

                  $variable_2 = "$NTLMType2" nocase

                  $variable_3 = "$listener" nocase

                  $variable_4 = "$hostip" nocase

                  $variable_5 = "$request" nocase

                  $variable_6 = "$ntlmt2" nocase

                  $variable_7 = "$NTLMType2Response" nocase

                  $variable_8 = "$buffer" nocase

           condition:

                  5 of ($command_*) 

                  or

                  all of ($variable_*)

    }

    HEADLACE shortcut

    rule APT28_HEADLACE_SHORTCUT {

           meta:

                  description = "Detects the HEADLACE backdoor shortcut dropper. Rule is meant for threat hunting."

           strings:

                  $type = "[InternetShortcut]" ascii nocase

                  $url  = "file://"

                  $edge = "msedge.exe"

                  $icon = "IconFile"

           condition:

                  all of them

    }

    HEADLACE credential dialogbox phishing 

    rule APT28_HEADLACE_CREDENTIALDIALOG {

           meta:

                  description = "Detects scripts used by APT28 to lure user into entering credentials"

           strings:

                  $command_1 = "while($true)"

                  $command_2 = "Get-Credential $(whoami)"

                  $command_3 = "Add-Content"

                  $command_4 = ".UserName"

                  $command_5 = ".GetNetworkCredential().Password"

                  $command_6 = "GetNetworkCredential().Password.Length -ne 0"

           condition:

                  5 of them

    }

    HEADLACE core script

    rule APT28_HEADLACE_CORE {

           meta:

                  description = "Detects HEADLACE core batch scripts"

           strings:

                  $chcp = "chcp 65001" ascii

                  $headless = "start "" msedge --headless=new --disable-gpu" ascii

                  

                  $command_1 = "taskkill /im msedge.exe /f" ascii

                  $command_2 = "whoami>"%programdata%" ascii

                  $command_3 = "timeout" ascii

                  $command_4 = "copy "%programdata%" ascii

                  $non_generic_del_1 = "del /q /f "%programdata%" ascii

                  $non_generic_del_3 = "del /q /f "%userprofile%Downloads" ascii

     

                  $generic_del = "del /q /f" ascii

           condition:

                  (

                          $chcp 

                          and 

                          $headless

                  )

                  and

                  (

                          1 of ($non_generic_del_*)

                          or

                          ($generic_del)

                          or

                          3 of ($command_*)

                  )

    }

    MASEPIE

    rule APT28_MASEPIE {

           meta:

                  description = "Detects MASEPIE python script"

           strings:

                  $masepie_unique_1 = "os.popen('whoami').read()"

                  $masepie_unique_2 = "elif message == 'check'"

                  $masepie_unique_3 = "elif message == 'send_file':"

                  $masepie_unique_4 = "elif message == 'get_file'"

                  $masepie_unique_5 = "enc_mes('ok'"

                  $masepie_unique_6 = "Bad command!'.encode('ascii'"

                  $masepie_unique_7 = "{user}{SEPARATOR}{k}"

                  $masepie_unique_8 = "raise Exception("Reconnect"

           condition:

                  3 of ($masepie_unique_*)

    }

    STEELHOOK

    rule APT28_STEELHOOK {

           meta:

                  description = "Detects APT28's STEELHOOK powershell script"

           strings:

                  $s_1 = "$($env:LOCALAPPDATAGoogleChromeUser DataLocal State)"

                  $s_2 = "$($env:LOCALAPPDATAGoogleChromeUser DataDefaultLogin Data)"

                  $s_3 = "$($env:LOCALAPPDATAMicrosoftEdgeUser DataLocal State)"

                  $s_4 = "$($env:LOCALAPPDATAMicrosoftEdgeUser DataDefaultLogin Data)"

                  $s_5 = "os_crypt.encrypted_key"

                  $s_6 = "System.Security.Cryptography.DataProtectionScope"

                  $s_7 = "[system.security.cryptography.protectdata]::Unprotect"

                  $s_8 = "Invoke-RestMethod"

           condition:

                  all of them

    }

    PSEXEC

    rule GENERIC_PSEXEC {

           meta:

                  description = "Detects SysInternals PSEXEC executable"

           strings:

                  $sysinternals_1 = "SYSINTERNALS SOFTWARE LICENCE TERMS"

                  $sysinternals_2 = "/accepteula"

                  $sysinternals_3 = "SoftwareSysinternals"

                  $network_1 = "%sIPC$"

                  $network_2 = "%sADMIN$%s"

                  $network_3 = "DeviceLanmanRedirector%sipc$"

                  $psexec_1 = "PSEXESVC"

                  $psexec_2 = "PSEXEC-{}-"

                  $psexec_3 = "Copying %s to %s..."

                  $psexec_4 = "gPSINFSVC"

           condition:

                  (

                          ( uint16( 0x0 ) ==0x5a4d )

                          and

                          ( uint16( uint32( 0x3c )) == 0x4550 )

                  )

                  and 

                          filesize < 1024KB

                  and

                  (

                          ( any of ($sysinternals_*) and any of ($psexec_*) )

                          or

                          ( 2 of ($network_*) and 2 of ($psexec_*))

                  )

    }

    The cybersecurity industry provides overlapping cyber threat intelligence, IOCs, and mitigation recommendations related to GRU unit 26165 cyber actors. While not all encompassing, the following are the most notable threat group names related under MITRE ATT&CK G0007 and commonly used within the cybersecurity community: 

    • APT28 [14]
    • Fancy Bear [14]
    • Forest Blizzard [14]
    • Blue Delta [15]

    Note: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. government’s understanding for all activity related to these groupings.

    Further Reference

    To search for the presence of malicious email messages targeting CVE-2023-23397, network defenders may consider using the script published by Microsoft: https://aka.ms/CVE-2023-23397ScriptDoc. 

    For the Impacket TTP, network defenders may consider using the following publicly available Impacket YARA detection rule:
    https://github.com/Neo23x0/signature-base/blob/master/yara/gen_impacket_tools.yar

    Works Cited

    [1] Microsoft. Defending Ukraine: Early Lessons from the Cyber War. 2022. https://blogs.microsoft.com/on-the-issues/2022/06/22/defending-ukraine-early-lessons-from-the-cyber-war/  
    [2] FBI et al. Russian Cyber Actors Use Compromised Routers to Facilitate Cyber Operations. 2024. https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-Russian-Actors-Use-Routers-Facilitate-Cyber_Operations.PDF   
    [3] NSA et al. Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. 2021. https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/0/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF 
    [4] ANSSI. Campagnes d'attaques du mode opératoire APT28 depuis 2021. 2023. https://cert.ssi.gouv.fr/cti/CERTFR-2023-CTI-009/  
    [5] ANSSI. Targeting and compromise of french entities using the APT28 intrusion set. 2025. https://cert.ssi.gouv.fr/cti/CERTFR-2025-CTI-007/   
    [6] Polish Cyber Command. Detecting Malicious Activity Against Microsoft Exchange Servers. 2023. https://www.wojsko-polskie.pl/woc/articles/aktualnosci-w/detecting-malicious-activity-against-microsoft-exchange-servers/ 
    [7] IBM. Israel-Hamas Conflict Lures to Deliver Headlace Malware. 2023. https://securityintelligence.com/x-force/itg05-ops-leverage-israel-hamas-conflict-lures-to-deliver-headlace-malware/ 
    [8] CERT-UA. APT28: From Initial Attack to Creating Domain Controller Threats in an Hour. 2023. https://cert.gov.ua/article/6276894 
    [9] NSA. Embracing a Zero Trust Security Model. 2021. https://media.defense.gov/2021/Feb/25/2002588479/-1/-1/0/CSI_EMBRACING_ZT_SECURITY_MODEL_UOO115131-21.PDF  
    [10] NSA et al. Keeping PowerShell: Security Measures to Use and Embrace. 2022. https://media.defense.gov/2022/Jun/22/2003021689/-1/-1/0/CSI_KEEPING_POWERSHELL_SECURITY_MEASURES_TO_USE_AND_EMBRACE_20220622.PDF 
    [11] National Institute of Standards and Technology (NIST). Special Publication 800-63B: Digital Identity Guidelines – Authentication and Lifecycle Management. 2020. https://pages.nist.gov/800-63-3/sp800-63b.html 
    [12] NSA. Selecting Secure Multi-factor Authentication Solutions. October 16, 2020. https://media.defense.gov/2024/Jul/31/2003515137/-1/-1/0/MULTIFACTOR_AUTHENTICATION_SOLUTIONS_UOO17091520.PDF  
    [13] NSA and CSA. NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations. 2023. https://media.defense.gov/2023/Oct/05/2003314578/-1/-1/0/JOINT_CSA_TOP_TEN_MISCONFIGURATIONS_TLP-CLEAR.PDF 

    [14] Department of Justice. Justice Department Conducts Court-Authorized Disruption of Botnet Controlled by the Russian Federation’s Main Intelligence Directorate of the General Staff (GRU). 2024. https://www.justice.gov/archives/opa/pr/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian  
    [15] Recorded Future. GRU’s BlueDelta Targets Key Networks in Europe with Multi-Phase Espionage Campaigns. 2024. https://go.recordedfuture.com/hubfs/reports/CTA-RU-2024-0530.pdf  
     

    Disclaimer of endorsement

    The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

    Purpose

    This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

    Contact

    United States organizations

    • National Security Agency (NSA)
    • Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI)
      • U.S. organizations are encouraged to reporting suspicious or criminal activity related to information in this advisory to CISA via the agency’s Incident Reporting System, its 24/7 Operations Center (report@cisa.gov or 888-282-0870), or your local FBI field office. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment user for the activity; the name of the submitting company or organization; and a designated point of contact.
    • Department of Defense Cyber Crime Center (DC3)

    United Kingdom organizations

    Germany organizations

    Czech Republic organizations

    Poland organizations

    Australian organizations

    • Visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.

    Canadian organizations

    Estonia organizations

    French organizations

    • French organizations are encouraged to report suspicious activity or incident related to information found in this advisory by contacting ANSSI/CERT-FR by email at cert-fr@ssi.gouv.fr or by phone at: 3218 or +33 9 70 83 32 18. 

    See Table 2 through Table 14 for all the threat actor tactics and techniques referenced in this advisory.

    Table 2: Reconnaissance
    Tactic/Technique Title ID Use
    Reconnaissance TA0043 Conducted reconnaissance on at least one entity involved in the production of ICS components for railway management.
    Gather Victim Identity Information: Email Addresses T1589.002 Conducted contact information reconnaissance to identify additional targets in key positions.
    Gather Victim Org Information T1591 Conducted reconnaissance of the cybersecurity department.
    Gather Victim Org Information: Identify Roles T1591.004 Conducted reconnaissance of individuals responsible for coordinating transport.
    Gather Victim Org Information: Business Relationships T1591.002 Conducted reconnaissance of other companies cooperating with the victim entity.
    Gather Victim Host Information T1592 Attempted to enumerate Real Time Streaming Protocol (RTSP) servers hosting IP cameras.
    Table 3: Resource development
    Tactic/Technique Title ID Use
    Compromise Accounts: Email Accounts T1586.002 Sent phishing emails using compromised accounts.
    Compromise Accounts: Cloud Accounts T1586.003 Sent phishing emails using compromised accounts.
    Table 4: Initial Access
    Tactic/Technique Title ID Use
    Trusted Relationship T1199 Conducted follow-on targeting of additional entities in the transportation sector that had business ties to the primary target, exploiting trust relationships to attempt to gain additional access.
    Phishing T1566 Used spearphishing for credentials and delivering malware to gain initial access to targeted entities.
    Phishing: Spearphishing Attachment T1566.001 Sent emails with malicious attachments.
    Phishing: Spearphishing Link T1566.002 Used spearphishing with included links to fake login pages. Sent emails with embedded hyperlinks that downloaded a malicious archive.
    Phishing: Spearphishing Voice T1566.004 Attempted to use voice phishing to gain access to privileged accounts by impersonating IT staff.
    External Remote Services T1133 Exploited Internet-facing infrastructure, including corporate VPNs, to gain initial access to targeted entities.
    Exploit Public-Facing Application T1190 Exploited public vulnerabilities and SQL injection to gain initial access to targeted entities.
    Content Injection T1659 Leveraged a WinRAR vulnerability allowing for the execution of arbitrary code embedded in an archive.
    Table 5: Execution
    Tactic/Technique Title ID Use
    User Execution: Malicious Link T1204.001 Used malicious links to hosted shortcuts in spearphishing.
    User Execution: Malicious File T1204.002 Delivered malware executables via spearphishing.
    Scheduled Task/Job: Scheduled Task T1053.005 Used scheduled tasks to establish persistence.
    Command and Scripting Interpreter T1059 Delivered scripts in spearphishing. Executed arbitrary shell commands.
    Command and Scripting Interpreter: PowerShell T1059.001 PowerShell commands were often used to prepare data for exfiltration.
    Command and Scripting Interpreter: Windows Command Shell T1059.003 Used BAT script in spearphishing.
    Command and Scripting Interpreter: Visual Basic T1059.005 Used VBScript in spearphishing.
    Command and Scripting Interpreter: Python T1059.006 Installed python on infected machines to enable the execution of Certipy.
    Table 6: Persistence
    Tactic/Technique Title ID Use
    Account Manipulation: 
    Additional Email Delegate 
    Permissions

    T1098.002 

    Used manipulation of mailbox permissions to establish sustained email collection. 
    Modify Authentication Process: 
    Multi-Factor Authentication

    T1556.006 

    Enrolled compromised accounts in MFA mechanisms to increase the trust-level of compromised accounts and enable sustained access. 
    Hijack Execution Flow: DLL 
    Search Order Hijacking 
    T1574.001  Used DLL search order hijacking to facilitate malware execution. 
    Boot or Logon Autostart 
    Execution: Registry Run Keys / 
    Startup Folder

    T1547.001 

    Used run keys to establish persistence. 
    Boot or Logon Autostart 
    Execution: Shortcut 
    Modification

    T1547.009 

    Placed malicious shortcuts in the startup folder to establish persistence. 
    Table 7: Defense Evasion
    Tactic/Technique Title ID Use
    Indicator Removal: Clear 
    Windows Event Logs
    T1070.001  Deleted event logs through the wevtutil utility.
    Table 8: Credential access 
    Tactic/Technique Title ID Use

    Brute Force 

    Sent requests with Base64-encoded credentials for the RTSP server, which included publicly documented default credentials, and likely were generic attempts to brute force access to the devices. 

    Brute Force: Password Guessing 

    T1110.001 

    Used credential guessing to gain initial access to targeted entities. 

    Brute Force: Password Spraying 

    T1110.003 

    Used brute force to gain initial access to targeted entities. Conducted a brute force password spray via LDAP. 

    Multi-Factor Authentication Interception 

    Used multi-stage redirectors to provide MFA relaying capabilities in some campaigns. 

    Input Capture 

    Used multi-stage redirectors to provide CAPTCHA relaying capabilities in some campaigns. 

    Forced Authentication 

    Used an Outlook NTLM vulnerability to collect NTLM hashes and credentials via specially crafted Outlook calendar appointment invitations. 

    OS Credential Dumping: NTDS 

    T1003.003 

    Attempted to dump Active Directory NTDS.dit domain databases. 

    Unsecured Credentials: Group Policy Preferences 

    T1552.006 

    Retrieved plaintext passwords via Group Policy Preferences using Get-GPPPassword.py. 

    Table 9: Discovery
    Tactic/Technique Title ID Use

    Account Discovery: Domain Account

    T1087.002

    Used a modified ldap-dump.py to enumerate the Windows environment.

    Table 10: Command and Control
    Tactic/Technique Title ID Use

    Hide Infrastructure 

    T1665 

    Abused SOHO devices to facilitate covert cyber operations, as well as proxy malicious activity, via devices with geolocation in proximity to the target. 

    Proxy: External Proxy 

    T1090.002 

    Actor-controlled servers sent RTSP DESCRIBE requests destined for RTSP servers. 

    Proxy: Multi-hop Proxy 

    T1090.003 

    Used Tor and commercial VPNs as part of their anonymization infrastructure 

    Encrypted Channel 

    T1573 

    Connected to victim infrastructure using encrypted TLS. 

    Multi-Stage Channels 

    T1104 

    Used multi-stage redirectors for campaigns. 

    Table 11: Defense evasion (mobile framework)
    Tactic/Technique Title ID Use

    Execution Guardrails 

    Used multi-stage redirectors to verify browser fingerprints in some campaigns. 

    Execution Guardrails: Geofencing 

    T1627.001 

    Used multi-stage redirectors to verify IP-geolocation in some campaigns. 

    Table 12: Lateral movement
    Tactic/Technique Title ID Use

    Lateral Movement 

    Used native commands and open source tools, such as Impacket and PsExec, to move laterally within the environment. 

    Remote Services: Remote Desktop Protocol 

    T1021.001 

    Moved laterally within the network using RDP. 

    Table 13: Collection
    Tactic/Technique Title ID Use

    Email Collection 

    Retrieved sensitive data from email servers. 

    Email Collection: Remote Email Collection 

    T1114.002 

    Used server data exchange protocols and APIs such as Exchange Web Services (EWS) and IMAP to exfiltrate data from email servers. 

    Automated Collection 

    Used periodic EWS queries to collect new emails. 

    Video Capture 

    Attempted to gain access to the cameras’ feeds. 

    Archive Collected Data 

    Accessed files were archived in .zip files prior to exfiltration. 

    Archive Collected Data: Archive via Utility 

    T1560.001 

    Prepared zip archives for upload to the actors’ infrastructure. 

    Table 14: Exfiltration
    Tactic/Technique Title ID Use

    Exfiltration Over Alternative Protocol 

    Attempted to exfiltrate archived data via a previously dropped OpenSSH binary. 

    Scheduled Transfer 

    Used periodic EWS queries to collect new emails sent and received since the last data exfiltration. 

    Appendix B: CVEs exploited

    Table 15: Exploited CVE information
    CVE  Vendor/Product  Details

    CVE-2023-38831 

    RARLAB WinRAR 

    Allows execution of arbitrary code when a user attempts to view a benign file within a ZIP archive. 

    CVE-2023-23397 

    Microsoft Outlook 

    External actors could send specially crafted emails that cause a connection from the victim to an untrusted location of the actor’s control, leaking the Net-NTLMv2 hash of the victim that the actor could then relay to another service to authenticate as the victim. 

    CVE-2021-44026 

    Roundcube Webmail 

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search params. 

    CVE-2020-35730 

    Roundcube Webmail 

    An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16 and 1.4.x before 1.4.10, where a plaintext email message with JavaScript in a link reference element is mishandled by linkref_addindex in rcube_string_replacer.php. 

    CVE-2020-12641 

    Roundcube Webmail 

    Roundcube Webmail before 1.4.4 allows arbitrary code execution via shell metacharacters in a configuration setting for im_convert_path or im_identify_path in rcube_image.php. 

    Appendix C: MITRE D3FEND Countermeasures

    Table 16: MITRE D3FEND countermeasures
    Countermeasure Title  ID  Details 

    Network Isolation 

    Employ appropriate network segmentation. Disable Universal Plug and Play (UPnP), Peer-to-Peer (P2P), and Anonymous Visit features on IP cameras and routers. 

    Access Mediation 

    Limit access and utilize additional attributes (such as device information, environment, and access path) when making access decisions. Configure access controls carefully to ensure that only well-maintained and well-authenticated accounts have access. 

    Inbound Traffic Filtering 

    Implement host firewall rules to block connections from other devices on the network, other than from authorized management devices and servers, to prevent lateral movement. 

    Resource Access Pattern Analysis 

    Use automated tools to audit access logs for security concerns and identify anomalous access requests. 

    Outbound Traffic Filtering 

    Block NTLM/SMB requests to external infrastructure. 

    Platform Monitoring 

    Install EDR/logging/cybersecurity solutions onto high value systems with large amounts of sensitive data such as mail servers and domain controllers. 

    System File Analysis 

    Collect and monitor Windows logs for certain events, especially for events that indicate that a log was cleared unexpectedly. 

    Application Hardening 

    Enable optional security features in Windows to harden endpoints and mitigate initial access techniques. 

    Application-based Process Isolation 

    Enable attack surface reduction rules to prevent executable content from email. 

    Executable Allowlisting 

    Enable attack surface reduction rules to prevent execution of files from globally writeable directories, such as Downloads or %APPDATA%. 

    Execution Isolation 

    Unless users are involved in the development of scripts, limit the execution of scripts (such as batch, JavaScript, and PowerShell) to known scripts. 

    Application Configuration Hardening 

    Disable Windows Host Scripting functionality and configure PowerShell to run in Constrained mode. Disable protocols that use weak authentication (e.g., clear-text passwords, or outdated and vulnerable authentication or encryption protocols) or do not support multi-factor authentication. Turn off other ports/services not in use (e.g., FTP, web interface, etc.). 

    Process Spawn Analysis 

    Use open source SIGMA rules as a baseline for detecting and alerting on suspicious file execution or command parameters. 

    URL Reputation Analysis 

    Use services that provide enhanced browsing services and safe link checking. 

    Network Access Mediation 

    Do not allow incoming traffic, especially logins to systems, from public VPN services. Where possible, logins from public VPNs, including exit nodes in the same country as target systems, should be blocked or, if allowed, alerted on for further investigation. Ensure cameras and other Internet of Things devices are protected by a security appliance, if possible. 

    DNS Denylisting 

    D3-DNSDL 

    Do not allow outgoing traffic to hosting and API mocking services frequently used by malicious actors. 

    Domain Name Reputation Analysis 

    Heuristic detections for web requests to new subdomains may uncover malicious phishing activity. Logging the requests for each sub-domain requested by users on a network, such as in DNS or firewall logs, may enable system administrators to identify new targeting and victims. 

    Multi-factor Authentication 

    Use MFA with strong factors and require regular re-authentication, especially for management accounts. 

    Job Function Access Pattern Analysis 

    D3-JFAPA 

    Implement other mitigations for privileged accounts: including limiting the number of admin accounts, considering using hardware MFA tokens, and regularly reviewing all privileged user accounts. 

    User Account Permissions 

    Separate privileged accounts by role and alert on misuse of privileged accounts. Audit user accounts on all devices to ensure they are an accurate reflection of your organization and that they are being used as expected. 

    Token-based Authentication 

    Reduce reliance on passwords; instead, consider using services like single sign-on. 

    Credential Hardening 

    Do not store passwords in Group Policy Preferences (GPP). Remove all passwords previously included in GPP and change all passwords on the corresponding accounts. 

    Authentication Event Threshholding 

    Use account throttling or account lockout. Throttling progressively increases time delay between successive login attempts. If using account lockout, allow between 5 to 10 attempts before lockout. 

    Strong Password Policy 

    Use a service to check for compromised passwords before using them. 

    Credential Rotation 

    Change all default credentials. 

    Encrypted Tunnels 

    Disable protocols that use weak authentication (e.g., clear-text passwords, or outdated and vulnerable authentication or encryption protocols). Use a VPN for remote connections to devices. 

    Software Update 

    Apply security patches and firmware updates to all devices. Ensure devices are currently supported. Replace devices that are end-of-life. 

    Agent Authentication 

    Ensure authentication is enabled for remote access to devices. If supported on IP cameras, enable authenticated RTSP access only. 

    User Behavior Analysis 

    Review all authentication activity for remote access to make sure it is valid and expected. Investigate any unexpected or unusual activity. 

    MIL OSI USA News -

  • MIL-OSI Europe: Answer to a written question – Increasing frequency of climate whiplash events affecting European cities – E-001260/2025(ASW)

    Source: European Parliament

    1. The Water Resilience Strategy will offer a comprehensive vision for water-related policies. It will build on the solid existing acquis and focus on how to better implement rules for sustainable freshwater management, including the Floods Directive[1] and marine protection. It aims to improve source-to-sea water governance and awareness, enhance prevention and preparedness across economic sectors and society, enhance access to information and funding, and boost innovation. This will increase the EU’s preparedness against rapid swings between weather extremes.

    The Drinking Water Directive[2] mainly regulates the quality of drinking water by setting standards for certain pollutants and requires Member States to comply with them . The directive includes provisions on risk assessment and management, meaning that local authorities must monitor changes in source water quantity and quality due to drought or floods, and adjust treatment processes accordingly. The directive’s provisions on reducing water leakage levels, restrictions of use, derogations, access to water and information to the public could also prove relevant in case of ‘climate whiplashes’. Cities vulnerable to these phenomena may need to adapt local regulations[3] or introduce temporary measures[4] to maintain water quality.

    The Commission has published guidance[5] and helps Member States through the EU Biodiversity Platform[6] and its sub-groups on the Nature Restoration Regulation[7] and on Green Infrastructure[8]. Moreover, nature-based solutions are being supported through the Water Sensitive City[9] thematic partnership under the European Urban Initiative[10], the Green Cities Accord[11] and the European Green Capital and Leaf Awards[12].

    • [1] Directive 2007/60/EC of the European Parliament and of the Council of 23 October 2007 on the assessment and management of flood, OJ L 288, 6.11.2007, p. 27-34.
    • [2] Directive (EU) 2020/2184 of the European Parliament and of the Council of 16 December 2020 on the quality of water intended for human consumption (recast), OJ L435, 23.12.2020, p.1-62.
    • [3] e.g. encouraging citizens to save water.
    • [4] Such as restricting water use.
    • [5] https://environment.ec.europa.eu/topics/urban-environment/urban-nature-platform_en.
    • [6] https://green-forum.ec.europa.eu/business-and-biodiversity_en .
    • [7] https://environment.ec.europa.eu/topics/nature-and-biodiversity/nature-restoration-regulation_en .
    • [8] https://environment.ec.europa.eu/topics/nature-and-biodiversity/green-infrastructure_en .
    • [9] https://www.urbanagenda.urban-initiative.eu/partnerships/water-sensitive-city .
    • [10] https://www.urban-initiative.eu/ .
    • [11] https://environment.ec.europa.eu/topics/urban-environment/green-city-accord_en .
    • [12] https://environment.ec.europa.eu/topics/urban-environment/european-green-capital-award_en .
    Last updated: 21 May 2025

    MIL OSI Europe News

  • MIL-OSI: United Fire Group, Inc. reports on annual meeting of shareholders

    Source: GlobeNewswire (MIL-OSI)

    Director elections to the board of directors announced

    Director elections to the board of directors

    CEDAR RAPIDS, Iowa, May 21, 2025 (GLOBE NEWSWIRE) — United Fire Group, Inc. (UFG) (Nasdaq: UFCS) announced today that its shareholders elected three Class B directors to its 11-member board of directors at the 2025 annual meeting of shareholders held on May 21, 2025.

    The following individuals were each elected as Class B directors to serve three-year terms expiring in 2028:

    • John-Paul Besong, retired chief information officer executive.
    • Matthew R. Foran, co-founder and president of Stoic Lane, Inc.
    • James W. Noyce, retired insurance and financial services executive.

    In other official business, shareholders:

    • Ratified the appointment of Ernst & Young LLP as the company’s independent registered public accounting firm for 2025.
    • Approved, on an advisory basis, the compensation of the company’s named executive officers.

    About UFG

    Founded in 1946 as United Fire & Casualty Company, UFG, through its insurance company subsidiaries, is engaged in the business of writing property and casualty insurance. The company is licensed as a property and casualty insurer in 50 states and the District of Columbia, and is represented by approximately 1,000 independent agencies. AM Best assigns a rating of “A-” (Excellent) for members of the United Fire & Casualty Group. For more information about UFG, visit www.ufginsurance.com.

    Contact:

    Investor relations
    Email: ir@unitedfiregroup.com

    Media inquiries
    Email: news@unitedfiregroup.com

    The MIL Network

  • MIL-OSI United Nations: Experts of the Committee on the Rights of the Child Commend Romania on Deinstitutionalisation Process, Raise Questions on Corporal Punishment and Segregation in Education

    Source: United Nations – Geneva

    The Committee on the Rights of the Child today concluded its review of the combined sixth and seventh periodic reports of Romania, with Committee Experts commending the State on the deinstitutionalisation process of alternative care centres, while raising questions on the prevalence of corporal punishment and measures taken to combat segregation in education. 

    A Committee Expert said she was happy to hear about the programme for the deinstitutionalisation of alternative care centres; this was something Romania should be proud of, as well as all the foster arrangements being made, especially for children with disabilities. 

    Juliana Scerri Ferrante, Committee Expert and Country Taskforce Member, said there seemed to be a lack of parental education programmes around corporal punishment. How could the views of the child be respected if violence was accepted as a disciplinary measure?  Could the Romanian Government take clear steps to train staff and promote child education?  Philip Jaffe, Committee Vice-Chair and Country Taskforce Member, also noted that corporal punishment appeared to remain quite widespread despite being banned in 2004.  What efforts were being made to lower the prevalence and change attitudes among parents and adults? 

    Mr. Jaffe asked what was being done to combat school segregation based on disability, special education needs, and family economic status?  What improvements were being made to increase the improvement of vocational training for older children who may be leaving the school system?  Were there any programmes which specifically targeted economically disadvantaged children?

    The delegation said Romanian legislation completely prohibited violence against children, regardless of the environment.  However, despite the legislation, which was fully aligned with United Nations Conventions, the State needed to fight against mentalities and traditions and to practically change the minds of parents and caregivers, who believed corporal punishment would discipline children better.  Awareness-raising campaigns were being conducted for parents, and mechanisms including hotlines had been developed to support children, including the helpline 119.  Authorities were obligated to launch investigations immediately concerning any allegations of violence against children. 

    The delegation said the Ministry of Education had taken steps to assist children with special educational needs, with the creation of frameworks offering them different kinds of support, based on the type of disability.  Adaptive measures had been taken for Roma children, including stimulating their participation in early education and in summer kindergartens, supporting education in their current language, and translating schoolbooks in their mother tongue, among others.  An increasing number of contracts between schools and the business sector had been recorded, including around 6,000 contracts in the school year 2023/2024. 

    Introducing the report, Helena Omna-Raicu, President of the National Authority for the Protection of Child Rights and Adoption of Romania and head of the delegation, said Romania’s path in recent years had been shaped by profound changes and emerging pressures, including the war in Ukraine and the arrival of thousands of children and families fleeing conflict.  As a neighbouring country, Romania had mobilised rapidly to provide emergency care, protection, psychosocial support, and schooling to children regardless of their nationality. 

    Ms. Omna-Raicu said Romania had made significant progress in certain areas, including in the deinstitutionalisation process.  Of the 167 residential placement centres operating in 2017, 149 had already been closed by the end of March 2025 and over 6,000 children were now benefiting from family-type alternative care.  The remaining 18 placement centres would be closed soon. 

    In closing remarks, Rinchen Chophel, Committee Expert and Country Taskforce Coordinator, reiterated the Committee’s appreciation for the Government of Romania’s support to Ukrainian refugees, particularly children.  Significant progress had been made from the last reporting period to the current one, with many looking forward beyond the dialogue. 

    In her closing remarks, Ms. Omna-Raicu, expressed deep gratitude for the dialogue.  The Committee’s concerns regarding urban disparities were noted.  Romania would treat the Committee’s recommendations as an opportunity for deeper transformation. 

     

    The delegation of Romania was comprised of representatives from the National Authority for the Protection of Child Rights and Adoption; the Ministry of Education and Research; the Ministry of Justice; the Ministry of Health; the Ministry of Labour, Family, Youth and Social Security; the Ministry of Foreign Affairs; the General Inspectorate of the Romanian Police; the General Inspectorate for Immigration; the National Administration of Penitentiaries; the Prosecutor’s Office; the National Health Insurance Authority; and the Permanent Mission of Romania to the United Nations Office at Geneva. 

    Summaries of the public meetings of the Committee can be found here, while webcasts of the public meetings can be found here. The programme of work of the Committee’s ninety-ninth session and other documents related to the session can be found here.

    The Committee will next meet in public at 3 p.m. on Wednesday, 21 May to begin its consideration of the combined fifth and sixth periodic reports of Qatar (CRC/C/QAT/5-6).

    Report

    The Committee has before it the combined sixth and seventh periodic reports of Romania (CRC/C/ROU/6-7).

    Presentation of Report

    HELENA OMNA-RAICU, President of the National Authority for the Protection of Child Rights and Adoption of Romania and head of the delegation, said Romania’s path in recent years had been shaped by profound changes and emerging pressures, including the war in Ukraine and the arrival of thousands of children and families fleeing conflict.  As a neighbouring country, Romania had mobilised rapidly to provide emergency care, protection, psychosocial support, and schooling to children regardless of their nationality.  The State was proud to have established the first Blue Dot in the region at the border crossing with Ukraine and launched the use of the Child Protection Information Management System Primero in only a couple of months after the onset of the refugee crisis, ensuring registration and case management for almost 40,000 refugee children.

    Several new national strategies had been developed for 2021-2027 which aimed to address child poverty and wellbeing, including the national strategy for the protection and promotion of children’s rights “protected children, safe Romania” 2023-2027, and the national strategy on social inclusion and poverty reduction 2022-2027, among others.   Romania had also adopted and begun the implementation of the child guarantee national action plan 2023-2030, which aimed to reduce the number of children at risk of poverty or social exclusion by at least 500,000 by 2030. Romania had seen a measurable decline in the proportion of children at risk of poverty and social exclusion from 41.5 per cent in 2022 to 33.8 per cent in 2024. 

    In April 2024, law 100/2024 was approved which included specific amendments to several laws relevant for social assistance.  The new emergency ordinance no. 96/2024, approved in June 2024 regarding the provision of humanitarian support and assistance by the Romanian State to foreign citizens or stateless persons in special situations coming from the area of the armed conflict in Ukraine, established the legal framework providing refugees with access to a wide range of key national statutory services. Another significant legislative change was enacted by amending law 272/2004 in December 2024, which now mandated the participation of children in public decision-making processes. 

    There had also been several significant programmes launched, including modernising the unique national number 119 for reporting cases of abuse, neglect, exploitation and any other form of violence against children; the development of community services for children and families to prevent separation and support the family reintegration of children from the special protection system; and the development of 200 integrated community centres and 150 daycare centres for children, among others.  Despite these advances, challenges remained, including disparities between rural and urban areas. 

    However, Romania had made significant progress in certain areas, including in the deinstitutionalisation process.  Of the 167 residential placement centres operating in 2017, 149 had already been closed by the end of March 2025 and over 6,000 children were now benefiting from family-type alternative care.  The remaining 18 placement centres would be closed soon.  The use of European Union structural funds had also supported the training of over 11,000 foster carers.  A new programme had also been introduced, aimed to scale-up integrated community-services in 2,000 marginalised rural communities, combining social assistance, health, education, and other types of social support.  Over 800 million euros of European Social Funds were planned for enhancing access to social services for the most vulnerable, including children and their families.

    The State had also expanded support for children at risk of early school leaving by using the early warning mechanism in education, of which around 50,000 participants from 6,950 institutions had completed the training programme.  Targeted policies had been developed that supported the reintegration of children who dropped out during the pandemic, and more resources were reaching schools in deprived communities.  In health, the role of community nurses and Roma health mediators had grown, and work continued to improve access to services for vulnerable groups. 

    Pilot projects on mental health for children had laid the groundwork for more systemic change, with mental health services for children and adolescents being expanded. However, challenges remained in ensuring equitable access to quality services in rural and marginalised areas, addressing shortages of specialised personnel, and improving early identification and intervention for children with developmental delays or disabilities.

    Romania was committed to reducing the number of children affected by poverty and social exclusion by at least 500,000.  The State would also pursue the complete closure of old-type residential centres, with every child in alternative care placed in family-based or community settings. Romania was committed to translating the pledges made during the first-ever global ministerial conference on ending violence against children held at the end of 2024 in Bogota, Columbia, into realities for children. 

    In education, the State aimed to increase the early childhood education enrolment rate by at least 22 per cent for children aged zero to three and at least 95 per cent for children aged four to six.  There would be a focus on improving mental health services for children and linking schools, families, and health providers more effectively, aiming to reduce preventable mortality by 20 per cent compared to 2021 levels for children of all ages.   Finally, Romania would ensure that children had a role in shaping systems through participatory budgeting, monitoring, and children and youth-led policy platforms. Romania remained committed to fully implementing the Convention and to contributing to the global effort to advance child rights everywhere.

    Questions by Committee Experts

    RINCHEN CHOPHEL, Committee Expert and Country Taskforce Coordinator, said Romania had achieved a lot since the last report, which the Committee was happy about. Romania’s assistance to the Ukrainian refugees and children should be noted.  There had been significant legislative achievements, particularly the amendments to law 272.  What measures were in place to ensure effective implementation of the law?  The national strategy on social inclusion and poverty reduction 2022-2027, and the child guarantee national action plan 2023-2030 were very welcome developments.  How had these impacted on measures to promote and protect children? Had an assessment been undertaken to evaluate the impact of the national strategy. 

    While welcoming increased allocations to certain sectors, the Coordinator asked what measures were in place to develop a child-friendly budgeting process?  What was the current status of the complaints mechanism in the country for reporting all forms of abuse and violence for children? What had been done to inform children of their right to file a complaint?  Had professionals working with children been trained on receiving complaints concerning children and the Convention? 

    The establishment of the child Ombudsman in 2018 was a crucial step in the right direction, and the Government should be congratulated for that.  What was the current status of the institution?  How did it connect with children?  The Committee noted the State party’s awareness raising activities on the Convention with appreciation, including the translation of the Committee’s general comments into Romanian.  How did these efforts extend to rural children? 

    JULIANA SCERRI FERRANTE, Committee Expert and Country Taskforce Member, asked if the national strategy for school de-segregation been adopted?  If not, then when would this occur?  What measures had been taken to address hate speech? Did the permanent committee set up in every education unit offer a complaints mechanism to children?  If not, how could children complain in schools? 

    What had been done to decrease discrimination against the Roma population?  What efforts had been made to promote the inclusion of Roma in mainstream schooling?  How was discrimination against children with disabilities tackled in education?  There was concern that Romanian law did not define valid reasons on which minor marriages could be authorised and this was left to the discretion of the authorities.  What training was provided to apply the best interests of the child? What approaches had been taken to reduce the preventable mortality of children under five years old?  What was the position of the Romanian Government on the proposed amendment to law 272 regarding lesbian, gay, bisexual, transgender and intersex children?

    There seemed to be a lack of parental education programmes around corporal punishment. How could the views of the child be respected if violence was accepted as a disciplinary measure?  Could the Romanian Government take clear steps to train staff and promote child education?  How were child labour laws enforced?  How would the Romanian Government establish a child participation mechanism?  Were refugee and asylum-seeking children involved in decisions which affected them? Were children provided information on their rights? 

    What measures were being taken to strengthen the capacity of the social welfare services? How were children with disabilities prioritised in reform measures?  What was being done to combat the illicit transfer of children abroad?  Had bilateral agreements been conducted in this regard?  Was the Romanian Government carrying out measures to understand the impact of prison on children?  How were they supported when their parents were incarcerated?  What support was available for young people leaving institutional care? 

    SOPHIE KILADZE, Committee Chair and Country Taskforce Member, said the adoption of law 105/22 providing for automatic birth registration should be considered as positive.  Could more information be provided about how the law worked in practice?  Were there any plans to introduce a statelessness determination procedure?  Was data on statelessness which concerned children disaggregated?  What measures were in place to protect children from excessive screen use?  How did Romania deal with artificial intelligence as a European Union member? Romania had one of the lowest levels of digital skills in the European Union; what measures were being undertaken to promote digital literacy among children, as well as parents? 

    PHILIP JAFFE, Committee Vice-Chair and Country Taskforce Member, said it was wonderful that strong pledges had been made at the global ministerial conference on ending violence against children in Bogota.  How was Romania implementing its mission as a pathfinding global alliance country?  It seemed Romanian children were in need of protection against high levels of physical and sexual violence.  One of the pledges made in Bogota was to conduct a prevalence study on sexual abuse; had the State moved forward with this study?  Were there dedicated teams drawing up the comprehensive framework and strategy which had been promised?  One pledge had been to enhance children’s participation regarding issues of violence.  What efforts had the Government made to ensure that there was a clear public understanding that all forms of violence against children needed to be reported? 

    Corporal punishment appeared to remain quite widespread despite being banned in 2004. What efforts were made to lower the prevalence and change attitudes among parents and adults?  It was encouraging that Romania had been one of 40 countries to recently join a statement of the Human Rights Council, expressing children’s right to protection from corporal punishment.  How was bullying and cyber bullying being addressed at all levels of legislative policy?  Could more information about the child helplines be provided? 

    Was it true that around seven to eight per cent of girls in Romania were married before the age of 18, with that percentage rising to around 20 per cent in the Roma community? What was being done in response to this? Was it true that charges had been dropped against a 17-year-old boy who entered into a non-formal marriage with an 11-year-old girl?  What policy was in practice in the health sector regarding surgical interventions and intersex children?  What were the guidelines to protect their bodily integrity until these children were capable of providing consent? 

    Responses by the Delegation

    The delegation said the law on child protection now included clear provisions which made it compulsory for public administrative bodies to involve children in consultations regarding issues which concerned them.  The national strategy on children’s rights was recently adopted and another national action plan was elaborated; these plans were complimentary. This was a comprehensive package which would help the Government to better implement all necessary measures. An assessment of the national strategy had been undertaken.  The State was now piloting a system which would indicate how to establish a model of financing where children would be considered as a different group that would benefit from a different budget. 

    The national programme for schooling in Romania ensured children received food support at schools to increase the enrolment rate and participation.  School supplies were also provided for all school grades. Two hundred euros were provided for the purchase of technology, and remedial lessons were provided to students coming from disadvantaged communities.  Recently, the scholarship system had been extended to encompass more disadvantaged groups. 

    Funds allocated to primary medical care had registered a continuous annual increase.  Just last year, the fund allocated to primary care increased by 24 per cent.  The national observatory was a big achievement for Romania and aimed to identify the children most at risk of being separated from their families, based on indicators.  Training was being conducted on the use of the observatory to ensure the data provided was reliable.   

    The hearing of minors in justice proceedings took place in special rooms, and a psychologist was always required to be present.  The new national strategy for the development of the judicial system provided for another 10 hearing rooms across the country.  There were specially designated prosecutors to handle cases involving minors.  The child Ombudsman was fully operational and cooperated with all institutions.  It had a functioning complaints mechanism.  If an incident was notified to the Ombudsman, an investigation started, which concluded with a set of recommendations sent to the institution responsible to correct the situation.  

    Civil society representatives were part of the consultative groups established at the national level.  A methodology had been issued and piloted regarding identifying and banning segregation within the educational sector.  The measures focused on ensuring an inclusive education.  Any kind of discrimination on criteria such as ethnicity, religion or sex was completely forbidden within the educational system.  Specific places in high schools were allocated for Roma students and students with disabilities.  To ensure access to high quality education, educational services had been developed starting from early education to prevent early dropout and absenteeism.     

    A set of programmes had been introduced, including a monthly allowance for children up to the age of 18, as well as parental leave.  There was also a minimum income support which supported families with children. Emergency ordinance no.96 was developed specifically for children from Ukraine and their families. 

    There was a dedicated intergovernmental group which addressed the subject of forced marriage, with the aim of drafting legislative projects in this regard.  Concerning infant mortality and the number of deaths under one year of age, a regionalised system of care had been introduced to ensure each neonate was born in a medical unit which could provide the services necessary for their care, thereby reducing infant mortality.  An important national programme was in place which contained around 15 interventions, established in partnership with the United Nations Children’s Fund.  Another programme provided 900 neonatal incubators around the country. 

    A significant number of services had been established to help families in vulnerable situations. A special programme was launched last year on the minimum inclusion income, which focused on how to assist parents within the labour market.  The State was aware of a lack of social assistance in rural areas, which was where the most vulnerable communities lived.  Interventions were directed, including food packages, and local administrative capacities would be developed. 

    A programme had been developed which aimed to establish hearing rooms for children in courts, and 29 hearing rooms were completed in April 2024.  The rooms were used by the Prosecutors and police officers when they had victims who were minors.  The rooms were child-friendly and specially designed with toys.  The child did not see the other people participating in the hearing.  A new strategy adopted in 2025 provided for the need for an additional 10 hearing rooms in the near future. 

    All social services were functioning based on a set of minimum quality standards, which were verified by the national agency for social inspection.   With the United Nations Children’s Fund, Romania was piloting a project which would identify and train foster families to care specifically for children with disabilities.  A child entering the special protection system was prioritised to be reintegrated in a family environment.  Adoption was considered the best solution in this regard, and this could only be decided by a court.  Priority was offered to domestic adoption, but international adoption could be considered after one year. 

    Amendments had been made to allow special spaces for visits in prison with children.  Such spaces were now available in all prison facilities within the Romanian penitentiary system.  There were cooperation protocols in place with the United Nations Children’s Fund and Save the Children which supported parents to develop their parental skills and improve their relationship with their children. The State was aware of the need to develop programmes which addressed the needs of children and adults and improved the relationship within the family.

    The Ministry of Education aimed to develop digital competencies among students and parents. During the pandemic, all students were provided with laptops and digital devices to keep up with the educational process.  In a new initiative launched in partnership with Microsoft, the Ministry of Education had announced the development of a project concerning artificial intelligence for increasing the school performance of students.  A project was also being implemented aimed at improving the digital skills of civil servants. 

    Romania had a dedicated national child help line.  It was toll-free and operational 24/7.  Those operating the calls were specialised counsellors who could refer the cases to the relevant authorities.  Another helpline just referred cases to social services.  The 119 helpline was a recent development, operational from any place in Romania and accessible to children and adults.  After the first year, it had been well received and was being regularly used to inform on any situation concerning a child. 

    Rape of a minor and sexual assault against a minor had been introduced as acts within the Criminal Code.  Rape committed by an adult against a minor under the age of 18 was punished by a prison sentence of between seven to 12 years.

    Questions by Committee Experts

    PHILIP JAFFE, Committee Vice-Chair and Country Taskforce Member, said one in 20 people in Romania held a disability certificate, with around 80,000 being children. What were the difficulties faced by certain groups of children to receive this certificate, including rural children?  Were there any awareness-raising campaigns for rural minorities and poor families regarding their entitlement to services?  Could more information be provided about Romania’s strategy for persons with disabilities?  How were the number and expertise of professionals being scaled up?  To what degree had the State embraced a human-rights approach to disability, as opposed to a medical model of disability?  How many children were still left in institutions? When would such institutions all be closed? 

    There were two recent laws on pre-university education and higher education; could more information be provided about the implementation of these laws?  What was the level of gross domestic product dedicated to education in Romania?  Was there a direct pipeline to hear about the concerns of children within the education system and were these concerns taken seriously?  What was being done to combat school segregation based on disability, special education needs, and family economic status?  Figures suggested that 40 per cent of children with disabilities had limited access to education.  What steps were being made to improve education for children under the age of three? What improvements were being made to increase the improvement of vocational training for older children who may be leaving the school system?  Were there any programmes which specifically targeted economically disadvantaged children?  What was the mission of the Ministry of Youth? 

    SOPHIE KILADZE, Committee Chair and Country Taskforce Member, asked if sufficient resources were dedicated to the capacity building of medical personnel? Did all children have access to health care, including health insurance?  How were vaccinations promoted in the country?  How was breast feeding promoted?  Child obesity was an issue of concern; how was this combatted? Was there a hot meals programme? 

    Mental health was a very important issue.  Was data on mental health being disaggregated, including on suicide?  Was there a comprehensive strategy and action plan regarding the issue of mental health?  Were quality mental health services available in rural and remote areas? According to alarming information, the country had the highest number of adolescent mothers across the European Union. What steps would the State undertake to prevent adolescent pregnancies and subsequent abortions?  Would Romania make reproductive education part of the curriculum? 

    What measures were in place to address drugs or substance abuse?  Were there treatments available for children?  Romania had made substantial efforts for Ukrainian children and other groups of refugees.  How would the State integrate these children long-term?  Were there delays in the enrolment of refugee children and their families into the social services system?  Would amendments be considered in the asylum law to end the detention of families at the legislative level?  Did unaccompanied migrant children have access to services, including psychosocial support and disability services?  Were there any barriers which could hinder access to education? 

    What measures were being undertaken to end child labour, including begging?  What was being done to assist children in street situations?  How were perpetrators investigated and brought to justice?  Were there quality services for child victims of trafficking in place? Was the system of child justice established across the country?  Were adequate financial resources allocated to it?  Was free legal aid available to children in conflict with the law?  Was the detention of children used only as a last resort?  If yes, did it comply with international standards? 

    RINCHEN CHOPHEL, Committee Expert and Country Taskforce Coordinator, said one in five children were affected by severe material and social deprivation, which was concerning.  What was the reality on the ground?  The minimum social assistance package had been introduced; could more information be provided on it?  Romania was increasingly vulnerable to droughts, heatwaves, floods and landslides, and it was also grappling with water pollution.  How had the national strategies pertaining to climate change helped to address the challenges of the environment and climate change in the country? What measures were being adopted to take into account children’s needs and views in the development of specific policies, including disaster-preparedness plans?  Were child rights impact assessments carried out when dealing with the business sector? 

    A Committee Expert asked what the national coverage of vaccinations was in the country?  Romania had an epidemic of measles; how did the population react to vaccinations?  How was confidence being built in vaccines?  Were people familiar with the law on rape?  What happened once the 30-day limit for registering births had elapsed? 

    Responses by the Delegation

    Romanian legislation completely prohibited violence against children, regardless of the environment.  However, despite the legislation, which was fully aligned with United Nations Conventions, the State needed to fight against mentalities and traditions and to practically change the minds of parents and caregivers, who believed corporal punishment would discipline children better.  Awareness-raising campaigns were being conducted for parents, and mechanisms including hotlines had been developed to support children, including the helpline 119. 

    Authorities were obligated to launch investigations immediately concerning any allegations of violence against children.  Romania was committed to continuing these efforts and to changing social norms and mentalities.  The numbers of cases of violence against children was increasing, which meant people were becoming more aware of the issue and reporting it. 

    Since 2016, the methodology applied in Romania clearly distinguished between the concept of disability and special education needs.  In Romania, the deinstitutionalisation process was one of the most important commitments of the Government, and the process was now concluding. Currently, out of the 167 residential centres operating in 2017, 149 had already been closed, and more than 6,000 children were benefiting from alternative care.  The legal framework stated that no placement centre could operate without the approved closure plan.  The deinstitutionalisation process also involved finding better alternative and family-based care for children.   Only 18 placement centres remained in the process of being closed, and by 2026 no such centre would be operating in Romania.  The State was still aiming to find family-style solutions for children with disabilities, and a project was being developed with the United Nations Children’s Fund to this end.

    If a birth was declared after the 30-day deadline but less than one year after the birth, the birth certificate could be issued based on approval from the mayor.  If the birth declaration was made more than one year after the birth, the certificate needed to be approved by the mayor and other administrative bodies. 

    More than 2.8 million students were enrolled in the 2023/2024 school year in Romania.  For high school, there had been a significant decrease in dropouts from 2.5 per cent in 2017 to 0.8 per cent in 2024. Around 4.5 per cent of the budget was allocated to education.  The Ministry of Education had taken steps to assist children with special educational needs, with the creation of frameworks offering them different kinds of support, based on the type of disability.  For students with temporary special needs, the law of education presented special measures, including the implementation of schooling hospitals, or schooling at home for those who were required to be in hospital or at home for medical reasons. 

    Adaptive measures had been taken for Roma children, including stimulating their participation in early education and in summer kindergartens, supporting education in their current language, and translating schoolbooks in their mother tongue, among others.  More than 66,000 teachers had been trained in digital and multimedia use.  An increasing number of contracts between schools and the business sector had been recorded, around 6,000 contracts in the school year 2023/2024.  Most teachers had been trained to create open educational resources.  Significant funds had been allocated to modernising rest room facilities in schools. 

    Any student could submit complaints of discrimination via an established framework.  Students benefitted from representation in the school system through several platforms.  The national strategy for sustainable development issued the methodology of the “green week programme”, which contributed to preschoolers and students’ competence in understanding basic concepts of climate change, to initiate individual and protective action to protect the environment.  Teachers were obliged to obtain 90 transferrable professional credits every five years, through attending courses offered by Romanian training houses.

    In recent years, infant mortality had remained relatively stable in Romania.  From 2023 to 2024, the number of doctors treating children increased by five per cent.  Regarding children’s access to medical services, all children were insured in Romania and benefitted from basic medical services across all sectors of health care.  The national health insurance fund also reimbursed certain services.  The Ministry of Health had launched a vaccination campaign in partnership with the Red Cross, to raise awareness of parents; this had been accompanied by a “catch-up” vaccination schedule, resulting in 1,500 children being vaccinated.  A protocol had been signed with the Orthodox Church to establish an active partnership to create a framework for anyone facing a possible cancer diagnosis, offering support.   

    World Breastfeeding Week was celebrated in August each year, as breastfeeding remained one of the most effective ways to provide children with the best start in life. Breast feeding recommendations had been developed with partners, including the World Health Organization, and were relayed to medical practitioners at the local level.  Around 200 integrated community centres would be restructured, elevated and equipped.  A television broadcast had been created to promote the importance of breastfeeding in the first six months of a child’s life.   

    Information and education campaigns had been carried out for children, parents and teachers about the benefits of a healthy diet and the consequences of unhealthy eating. Around 1,000 people had benefited from the campaign.  Substance abuse could be detected by family doctors and psychological services could be recommended.  The national health insurance house implemented the national mental health programme, providing treatment for persons with substance abuses, and ensuring specific treatment for patients with depressive disorders. 

    Questions by Committee Experts 

    RINCHEN CHOPHEL, Committee Expert and Country Taskforce Coordinator, said the Government had approved a social assistance programme in 2011 which targeted all communes, but was underfinanced; could more information be provided?  The Environment Week presented was an excellent initiative; how was it being utilised? 

    JULIANA SCERRI FERRANTE, Committee Expert and Country Taskforce Member, asked if there were any supervision orders, where children remained with their family but were supervised?  Were there age assessment procedures during the asylum procedure?  What rights did children applying for asylum have?  Could they appeal any decisions? 

    PHILIP JAFFE, Committee Vice-Chair and Country Taskforce Member, said according to research by the United Nations Children’s Fund, Romanian girls felt much lonelier than Romanian boys.  Was there a reason for this gap? 

    SOPHIE KILADZE, Committee Chair and Country Taskforce Member, asked for clarification on case management coordination? 

    A Committee Expert noted the prevalence of women among the large delegation and asked if women generally had an important and high-profile position in Romania, or if this only occurred when discussing children?  Had there been any programmes to prevent violence?  Had the concept of gender been fully institutionalised? Were teachers trained in detecting signs of violence?  What was the prevalence of child marriage in the country?  What about figures for marriages which were not officially recorded? Had there been any programmes to prevent the phenomenon or sanctions? 

    Was there any mapping of the at-risk populations in the country of female genital mutilation? Was female genital mutilation prohibited in law?  What was the most updated action on sexual exploitation?  Was there any cross-border cooperation between Romania and neighbouring countries?  Did Ukrainian children born in Romania have access to Romanian citizenship?  Did rape victims have access to emergency contraception?

    Another Expert asked about vaccinations from children aged zero to 12; was there distrust in the population when it came to vaccines?  It seemed that tuberculosis was a public health issue.  What was being done in the field of treatment? Were there children whose births had not been declared, particularly among refugees, Roma and migrants?

    A Committee Expert asked about the new concept introduced by the Parliament on parental alienation.  How had this concept been consulted on, particularly with children?  How would the best interests of the child be ensured? What specific measures were being taken to reduce school dropout and improve access to quality education for Roma children?  What mechanisms were in place to monitor and support Roma children who were at risk of dropping out? 

    Another Committee Expert said she was happy to hear about the programme for the deinstitutionalisation of alternative care centres; this was something Romania should be proud of, as well as all the foster arrangements being made, especially for children with disabilities.  What was the State doing to support the families of children with disabilities, particularly those with severe disabilities? 

    Responses by the Delegation 

    The delegation said emergency contraception was available to those who had experienced sexual assault and could be obtained without a prescription.  Adolescent pregnancies were a major concern for the Romanian public health system.  Contraceptives and medical devices were provided free of charge through family centres and through gynaecological departments, where abortions were performed upon request.  Romania was one of the first European countries to offer non-discriminatory HIV/AIDS treatment. 

    Refugees were granted a monthly allowance, one-month’s accommodation, and access to education for minors.  Legislation in the field of asylum provided for beneficiaries to apply for family reunification when family members were not in Romania.  Identity documents needed to be provided to prove family links. Family reunification of unaccompanied minors was carried out with the best interest of the child in mind. Minors from immigrant backgrounds benefitted from the same rights as minors who were Romanian citizens. Romanian language courses provided teaching support, textbooks and workbooks developed on linguistic levels according to the European Union framework.  Priority for asylum applications was given to unaccompanied minors. 

    Medical forensic expertise was used when an asylum applicant could not prove their age and there were serious doubts about their ethnicity.  The declared age of the asylum applicant was accepted if their refusal to undergo the medical expertise was based on compelling reasons.  The assessment was performed with full respect for the minor’s dignity and in as least invasive way as possible. 

    Investigations in child and human trafficking were undertaken by specialists with supervision from specialised prosecutors.  Through law 229/2024, the Romanian Parliament aimed to discourage sex tourism and the pimping of minors.  More than 1,200 criminal cases had been identified regarding child trafficking. The General Inspectorate of Romanian Police organised regular sessions for border police and 

    non-governmental organizations, with the purpose of identifying victims.  More than 125 trainings had been carried out to over 4,000 workers who may encounter trafficking victims through their work. The National Agency against Trafficking in Persons and the Directorate for Investigating Organised Crime had implemented a national action plan in the fight against human trafficking to improve the awareness of at-risk groups. 

    In 2024, prosecutors from the Directorate for Investigating Organised Crime took part in 35 seminars regarding identifying child victims, compensation for victims, international cooperation, and online sexual exploitation of children, among other topics.  A public awareness campaign had been launched relating to sexual acts between adults and minors.  The message stated that a sexual act committed against a minor of 16 years or under constituted rape, if the age gap was more than five years, and punishments applied. 

    According to Romanian legislation, minors benefited from free legal aid, whether they committed a crime, or if they were victims of a crime.  The Romanian penal system limited sanctions in regard to minors, and measures for deprivation of liberty were only given as a last resort and could only be ordered by a court. 

    The integrated social services project aimed to develop the academic knowledge of professionals working in the social assistance field, and to develop concrete measures for vulnerable groups of people. 

    During “green week”, schools organised activities around several topics relating to the environment.  These were uploaded on a specialised platform dedicated to education on climate change and varied from one educational cycle to another.  The Ministry of Education had developed a programme, the mechanism of early-living alert, which focused on early education for Roma children. 

    In Romania, social services were obligated to identify children in a risk situation.  Children could remain within families and be monitored by social services until the risks were removed.  The parental alienation provision was introduced in all cases relating to violence and neglect.  It was recommended that this provision be removed, as these measures should only be applied by the courts.  There were many trainings offered to judges on methods relating to children’s rights.  Social workers were also trained to provide necessary assistance to visiting parents. Social services could only assist; they could not intervene and solve disputes between parents. 

    Closing Remarks

    RINCHEN CHOPHEL, Committee Expert and Country Taskforce Coordinator, reiterated the Committee’s appreciation for the Government of Romania’s support to Ukrainian refugees, particularly children.  The State was encouraged to continue to undertake these activities which were important for solidarity for children.  Significant progress had been made from the last reporting period to the current one, with many looking forward beyond the dialogue.  This was an indication of the Government’s commitment towards children.  As the country moved forward, it was important to put emphasis on implementation and ensure vulnerable children did not miss out. 

    HELENA OMNA-RAICU, President of the National Authority for the Protection of Child Rights and Adoption of Romania and head of the delegation, expressed deep gratitude for the dialogue.  The delegation welcomed the Committee’s emphasis on equality, accountability and sustainability, and would underpin the next stage of the State’s deinstitutionalisation journey.  The Committee’s concerns regarding urban disparities were noted.  It was recognised that rights delayed were rights denied, and the State was committed to accelerating affirmative action. Romania would treat the Committee’s recommendations as an opportunity for deeper transformation. 

    SOPHIE KILADZE, Committee Chair, thanked the delegation for the fruitful dialogue and commended its members for their clear and comprehensive answers.  Ms. Kiladze extended her best regards to the children of Romania. 

    ___________

    Produced by the United Nations Information Service in Geneva for use of the media; 
    not an official record. English and French versions of our releases are different as they are the product of two separate coverage teams that work independently.

     

     

    CRC25.013E

    MIL OSI United Nations News

  • MIL-OSI USA: Graham-Blumenthal Hard-Hitting Russia Sanctions Bill Has Over 80 Cosponsors

    US Senate News:

    Source: United States Senator for South Carolina Lindsey Graham
    WASHINGTON – U.S. Senators Lindsey Graham (R-South Carolina) and Richard Blumenthal (D-Connecticut) today made this joint statement after their legislation to impose primary and secondary sanctions against Russia and actors supporting Russia’s aggression in Ukraine reached 81 cosponsors in the U.S. Senate.
    These sanctions would be imposed if Russia refuses to engage in good faith negotiations for a lasting peace with Ukraine or initiates another effort, including military invasion, that undermines the sovereignty of Ukraine after peace is negotiated. The legislation also imposes a 500 percent tariff on imported goods from countries that buy Russian oil, gas, uranium and other products.
    “As Secretary Rubio indicated yesterday to the Senate Appropriations Subcommittee on State and Foreign Operations, Russia has agreed to provide its term sheet for a ceasefire in the next few days. Its contents will speak volumes as to whether or not Russia is serious about peace. We suspect it will be more of the same.
    “If it is more of the same, Russia can expect decisive action from the United States Senate. To that end, we are beyond pleased that we now have 81 cosponsors for legislation to sanction Russia for its barbaric invasion of Ukraine. Our legislation will isolate Russia – putting it on a trade island by imposing stiff tariffs on other countries that support these atrocities. One of the main priorities of our legislation is to hold China accountable for propping up Putin’s war machine by buying cheap Russian oil from the shadow fleet. Without China’s economic support, Putin’s war machine would come to a grinding halt.
    “While we yearn for peace, it is increasingly clear to us – and a supermajority of the Senate – that Putin is playing games. The United States Senate stands ready to act if these games continue.”
    Background on the Sanctioning Russia Act of 2025 is available HERE.
    Bill text is available HERE.

    MIL OSI USA News

  • MIL-OSI Europe: Press release – Opening: 21-22 May 2025 plenary session

    Source: European Parliament

    MEPs added a debate on “the Hungarian government’s drift towards Russia-style repression” to today’s agenda.

    Changes to the agenda

    Wednesday

    Council and Commission statements on the Hungarian government’s drift towards Russia-style repression and legislative threats to freedom of expression and democratic participation are added to the agenda later on Wednesday, following the debate on the EU’s response to the Israeli government’s plan to seize the Gaza Strip. As a result of this addition, the sitting is extended to 23:00.

    Thursday

    The President announced a request from the Committee on Agriculture and Rural Development to fast-track a file under Rule 170(6) of the EP’s Rules of Procedure for the Commission proposal on additional assistance and further flexibility to outermost regions affected by severe natural disasters and in the context of cyclone Chido devastating Mayotte.

    The vote on this request will take place on Thursday. If approved, the file will be added to the June plenary agenda.

    Interinstitutional negotiations

    The Committee on Economic and Monetary Affairs has decided to enter into interinstitutional negotiations, in accordance with Rule 72(1) of Parliament’s Rules of Procedure, on the basis of the report available on the plenary website.

    MIL OSI Europe News

  • MIL-OSI United Kingdom: Partnership working to tackle climate adaptation strengthened through Highland Adapts initiative

    Source: Scotland – Highland Council

    Highland Council’s Climate Change Committee has today reaffirmed its commitment to climate adaptation by supporting the continued work of Highland Adapts – a regional initiative focused on building climate resilience through partnership and community-led action.

    Chair of the Climate Change Committee, Councillor Sarah Fanet, said: “The Highland region is already experiencing the effects of climate change from increased flooding to changes in biodiversity and these impacts are only expected to intensify. Highland Adapts ensures that our response is not only evidence-based but routed in the experiences and needs of the local community.”

    Highland Adapts will deliver a programme of activity throughout 2025-26 to further develop the partnership, explore circular economy opportunities and support locally driven resilience projects. The initiative continues to build strong relationships across the public, private and community sectors ensuring local voices shape the region’s approach to climate risk and resilience.

    Cllr Fanet continued: “By working together we can identify shared risks, develop the right actions and support investment in projects that help protect people, infrastructure and the environment. Community needs to be at the heart of our response to the climate emergency and Highland Adapts creates the space for shared learning, innovation and practical action.”

    Highland Adapts is governed by nine partner organisations: The Highland Council, Highlands and Islands Climate Hub, NHS Highland, Highlands and Islands Enterprise, NatureScot, Forestry and Land Scotland, Zero Waste Scotland, Changeworks, and Verture. These partners are working together to codevelop risk assessments, identify priority areas for adaptation and ensure the Highland region is prepared for the challenges ahead.

    21 May 2025

    MIL OSI United Kingdom

  • MIL-OSI USA: Congresswoman Torres Proposes Key Amendments to Republican Budget Reconciliation to Protect Working Families and Strengthen Public Services

    Source: United States House of Representatives – Congresswoman Norma Torres (35th District of California)

    May 21, 2025

    Amendments Address Critical Issues facing Californians, including higher taxes, Cuts to Healthcare and food assistance, and dangerous Trump Administration changes to Air Safety Systems

    WASHINGTON, D.C. — Congresswoman Norma Torres introduced targeted amendments to the Republican Budget Reconciliation aimed at protecting working families’ access to healthcare, food assistance, fairness in tax policy, and protecting essential public services. These amendments address critical areas, including healthcare, SNAP, transportation, and infrastructure, ensuring that policies serve the best interests of American workers and communities.

    “Republican budget proposals threaten essential programs that millions of Americans depend on,” said Congresswoman Torres. “These amendments are a necessary step to ensure that our tax policies, public services, and infrastructure investments are fair and effective in supporting the American people.”

    The proposed amendments aim to address the issues in the Republican Budget Reconciliation bill, which includes cutting healthcare coverage for nearly 14 million people, reducing SNAP benefits by $300 billion, and leaving 42 million Americans facing cuts to their benefits:

    • Protect Healthcare and Prevent Medicaid Cuts: Torres is pushing to strike provisions to cut hundreds of billions of dollars from Medi-Cal, California’s Medicaid. This amendment would protect the healthcare of millions of Americans who rely on Medicaid for essential health services, including the nearly 340,000 adults and children in the Inland Empire who rely on Medi-Cal (California’s Medicaid program). Cuts to Medicaid disproportionately harm children, seniors, and people with disabilities. A cut to Medicaid is also a cut to Medicare, as 30% of Medicaid dollars support Medicare enrollees. 

    • Prevent Harmful SNAP Cuts: Torres is proposing an amendment to prevent $300 billion in cuts to the Supplemental Nutrition Assistance Program (SNAP), which would endanger the food security of millions of American families, including 112,000 Americans in the Inland Empire. By striking these harmful provisions, nearly 90% of households that participate in SNAP have either a child, a senior, or an individual with disability. Rep. Torres seeks to protect vulnerable working families from losing access to the resources they need to stay healthy and nourished.

    • Lift the SALT Deduction Cap: Torres is advocating for the removal of the $10,000 cap on State and Local Tax (SALT) deductions that Trump signed into law in 2017. By limiting the SALT deduction to $10,000, the Trump 2017 Tax bill effectively raised taxes on Californians by eliminating their ability to deduct their state and local tax payments (including state income taxes and local property taxes) from their income for federal taxes. As residents of a state with a high cost of living and high housing costs, hardworking Californians are hit particularly hard by Trump’s cap on the SALT deduction. Californians pay more than their fair share of taxes, contributing $83 billion more in federal taxes than they received in return. Lifting the cap is about fairness and provides Californians with deserved tax relief in Trump’s high-priced economy.

    • Protect Aviation Safety and Ensure Fair FAA Staffing Practices: Torres introduced an amendment to keep the flying public safe, protecting Federal Aviation Administration (FAA) employees from unlawful firings. The FAA has fired at least 400 individuals responsible for maintaining air traffic control systems. This amendment will ensure that no funds made available by this Act may be used to terminate a probationary or non-probationary employee unless an individual performance assessment is conducted. This amendment aims to prevent unlawful terminations, ensuring that FAA staff are treated fairly and that safety standards are upheld for the traveling public. This amendment protects local jobs while maintaining air travel safety standards at Ontario International and regional airports.

    • Support California’s Critical Infrastructure Needs: Torres is fighting back against the indefensible corruption of this Administration, specifically the newly released U.S. Army Corps of Engineers plan to help only Republican leaning states, not all Americans equally. Torres is advocating for the U.S. Army Corps of Engineers (USACE) to allocate resources for California’s water infrastructure, environmental restoration, and flood management projects. Given California’s challenges with drought, wildfires, and floods, this amendment is designed to strengthen the state’s infrastructure and ensure communities are better protected from environmental and flood-related disasters.

    • Remove harmful tax on remittances: Torres is fighting back against this bill’s unjust 5% federal tax on remittance transfers that targets immigrant communities. With Americans sending over $93 billion in 2023 to help families abroad with basic necessities, this tax would devastate economies in countries like Honduras, Haiti, and El Salvador, where remittances comprise up to 30% of GDP. This amendment would prevent harmful policies that destabilize regional allies, contradict migration management efforts, and punish those playing by the rules—ensuring our policies support rather than harm immigrant communities and diplomatic partnerships.

    “These amendments are designed to protect the well-being of American families, ensure the long-term viability of essential public programs, and support fair policies that address the unique needs of communities across the country,” Congresswoman Torres added. “We cannot afford to let partisan politics undermine the services and resources that our citizens rely on every day.”

    ###

    MIL OSI USA News

  • MIL-OSI USA: Rep. Peters Thanks EPA Administrator Zeldin for Commitment to Stop Cross-Border Sewage Pollution

    Source: United States House of Representatives – Congressman Scott Peters (52nd District of California)

    Washington D.C. – Today, at an Energy and Commerce Committee hearing, Representative Scott Peters (CA-50) thanked Environmental Protection Agency (EPA) Administrator Lee Zeldin for touring the U.S.-Mexico border in southern San Diego and for his commitment to address the scourge of cross-border wastewater pollution. This follows a joint announcement from the EPA and U.S. International Border and Water Commission (IBWC) this morning, that both agencies will speed up the first phase of the incremental expansion of the South Bay International Wastewater Treatment Plant (SBIWTP) from two years to 100 days. This phase will increase the plant’s capacity to treat wastewater from 25 to 35 million gallons per day (mgd). The full project to repair and expand the dilapidated plant, for which Representative Peters and the San Diego delegation have secured $360 million in the last 18 months, will double treatment capacity to 50 mgd. 

    During the hearing, Rep. Peters stated, “I want to thank you for your recent visit to the South Bay and your tour of the Tijuana River Valley. This contamination issue remains, what I believe is one of the worst environmental catastrophes of the hemisphere and we are so encouraged by your commitment to working on a 100% solution… We’ve all worked really hard to get resources here — Republicans and Democrats. You have a partner here, and we’re happy to partner with you.”  

    During his opening remarks, EPA Administrator Zeldin stated, “[We] have issued immediate action items for Mexico to permanently and urgently end the Tijuana River sewage crisis that has plagued Southern California for decades.”  

    Last month, EPA Administrator Zeldin toured the South Bay at Rep. Peters’ invitation to see firsthand the ecological, economic, and health harms caused by this crisis.  

    Further Background: 

    Representative Peters has, for years, worked to address the cross-border pollution fouling San Diego’s coastal waters, including pushing for additional funding to fix and expand the dilapidated SBIWTP. The following are some recent actions: 

    2025 

    1. In March, Rep. Peters introduced legislation to authorize the International Boundary and Water Commission (IBWC) to accept funding from federal and non-federal entities for wastewater treatment, flood control projects, or other water conservation efforts. 

    2024 

    1. In January, Rep. Peters took to the House floor to demand that the President’s requested $310 million to fix and expand the dilapidated SBIWTP be included in any upcoming spending deal. 
    1. In February, Rep. Peters joined members of San Diego’s Congressional delegation to ask U.S. Navy Secretary Carlos Del Toro about the effects of cross-border pollution on Navy operations. 
    1. In March, Rep. Peters celebrated the inclusion of $156 million, at his request, for the International Boundary and Water Commission’s (IBWC) construction budget in the Fiscal Year 2024 Appropriations bill. The IBWC is the federal agency tasked with operating and maintaining the SBIWTP. 
    1. In May, Rep. Peters joined Rep. Veronica Escobar (TX-16) in a bipartisan request for $278 million for the IBWC’s construction budget in the Fiscal Year 2025 Appropriations bill. 
    1. In August, Rep. Peters hosted Deputy Secretary of State Richard Verma on a tour of the broken wastewater treatment plant. 
    1. In September, Rep. Peters joined members of San Diego’s Congressional delegation to reiterate their call for a federal state of emergency declaration amid high levels of toxic gases. 
    1. In December, Rep. Peters and the Congressional delegation successfully fought to include an additional $250 million to fully repair and expand the capacity of the SBIWTP in the government funding bill. This brought the total amount of funds secured to $650 million. 

    2023 

    1. In June, Rep. Peters led a letter with other members of the San Diego Congressional delegation to the governor of Baja California urging accountability for the Mexican government’s commitments to build wastewater treatment infrastructure. 
    1. In July, members of the San Diego congressional delegation requested that the Environmental Protection Agency assist with directing environmental justice funds from the Infrastructure Investment and Jobs Act and the Inflation Reduction Act to help stop the flow of pollutants and urged Secretary of State Antony Blinken to tour the broken plant. 
    1. Also in July, they sent a letter to President Biden and submitted an amendment to the National Defense Authorization Act for Fiscal Year 2024, calling on the administration to declare this crisis a federal emergency. 
    1. In August, he led two letters to the Office of Management and Budget and to OMB and the State Department, calling for urgent additional funding to confront this crisis.  
    1. In September, he proposed an amendment to the Fiscal Year 2024 Interior, Environment, and Related Programs Appropriations Bill to boost U.S.- Mexico Border Water Infrastructure Grant Program funding. Additionally, he proposed two amendments to the Fiscal Year 2024 State, Foreign Operations, and Related Programs Appropriations Bill to boost annual construction funding to the USIBWC to $100 million. 
    1. In October, Rep. Peters led a bipartisan letter to the Department of State demanding a complete account of how the SBIWTP fell into such a severe state of disrepair. 
    1. In December, he led a letter urging leaders of the U.S. House of Representatives and U.S. Senate to include President Biden’s $310 million supplemental budget request to repair the SBIWTP in any upcoming funding package. 

    In previous years, Peters and colleagues have secured funding, introduced legislation, called for investigations, and arranged a visit by EPA Administrator Regan in response to the wastewater contamination crisis.  

    ###

    MIL OSI USA News

  • MIL-OSI Europe: Joint statement by the leaders of France, the United Kingdom and Canada on the situation in Gaza and the West Bank

    Source: France-Diplomatie – Ministry of Foreign Affairs and International Development

    Published on May 21, 2025

    Lire la version

    We strongly oppose the expansion of Israel’s military operations in Gaza. The level of human suffering in Gaza is intolerable. Yesterday’s announcement that Israel will allow a basic quantity of food into Gaza is wholly inadequate. We call on the Israeli Government to stop its military operations in Gaza and immediately allow humanitarian aid to enter Gaza. This must include engaging with the UN to ensure a return to delivery of aid in line with humanitarian principles. We call on Hamas to release immediately the remaining hostages they have so cruelly held since 7 October 2023.

    The Israeli Government’s denial of essential humanitarian assistance to the civilian population is unacceptable and risks breaching international humanitarian law. We condemn the abhorrent language used recently by members of the Israeli Government, threatening that, in their despair at the destruction of Gaza, civilians will start to relocate. Permanent forced displacement is a breach of international humanitarian law.

    Israel suffered a heinous attack on 7 October. We have always supported Israel’s right to defend Israelis against terrorism. But this escalation is wholly disproportionate.

    We will not stand by while the Netanyahu Government pursues these egregious actions. If Israel does not cease the renewed military offensive and lift its restrictions on humanitarian aid, we will take further concrete actions in response.

    We oppose any attempt to expand settlements in the West Bank. Israel must halt settlements which are illegal and undermine the viability of a Palestinian state and the security of both Israelis and Palestinians.  We will not hesitate to take further action, including targeted sanctions.

    We strongly support the efforts led by the United States, Qatar and Egypt to secure an immediate ceasefire in Gaza. It is a ceasefire, the release of all remaining hostages and a long-term political solution that offer the best hope of ending the agony of the hostages and their families, alleviating the suffering of civilians in Gaza, ending Hamas’ control of Gaza and achieving a pathway to a two-state solution, consistent with the goals of the 18 June conference in New York co-chaired by Saudi Arabia and France. These negotiations need to succeed, and we must all work towards the implementation of a two-state solution, which is the only way to bring long-lasting peace and security that both Israelis and Palestinians deserve, and ensure long-term stability in the region.

    We will continue to work with the Palestinian Authority, regional partners, Israel and the United States to finalize consensus on arrangements for Gaza’s future, building on the Arab plan. We affirm the important role of the High-level Two-State Solution Conference at the UN in June in building international consensus around this aim. And we are committed to recognising a Palestinian State as a contribution to achieving a two-state solution and are prepared to work with others to this end./.

    MIL OSI Europe News

  • MIL-OSI USA: SPC May 21, 2025 1730 UTC Day 2 Convective Outlook

    Source: US National Oceanic and Atmospheric Administration

    SPC AC 211727

    Day 2 Convective Outlook
    NWS Storm Prediction Center Norman OK
    1227 PM CDT Wed May 21 2025

    Valid 221200Z – 231200Z

    …THERE IS A SLIGHT RISK OF SEVERE THUNDERSTORMS FOR PORTIONS OF
    THE SOUTHERN PLAINS…

    …SUMMARY…
    Severe storms are possible across parts of the southern Plains
    tomorrow/Thursday, with large hail the main threat. A few instances
    of 2+ inch diameter hail are possible.

    …Synopsis…
    Broad northwesterly flow will prevail across much of the eastern
    U.S. as a mid-level trough ejects into the Atlantic, an upper ridge
    builds over the central CONUS, and a pronounced mid-level impulse
    traverses the northern Rockies tomorrow (Thursday). A surface low
    will track along the Mid-Atlantic Coastline while surface high
    pressure overspreads much of the Midwest into the Southeast, and lee
    troughing prevails across the southern Plains. Thunderstorms are
    likely along the East Coast and the FL Peninsula, in association
    with the departing upper trough. Storms developing ahead of a
    southward-sagging cold front in FL have the best potential for
    becoming strong to locally severe over the East Coast. At least
    scattered thunderstorms are also likely across the Southern Plains,
    northwestward into the northern Rockies, given lee troughing and
    low-level upslope flow. Thunderstorms developing along a baroclinic
    zone along the Red River will benefit from strong instability and
    adequate wind shear, and will have the potential to become severe.

    …Southern Plains…
    Elevated thunderstorms are expected to develop in central OK within
    a warm-air advection regime, to the north of a west-to-east oriented
    baroclinic boundary, which is expected to be situated along the Red
    River during the morning/early afternoon hours. Through the day,
    storms are expected to propagate southward toward a surface-based
    airmass over northern TX, where upper 60s/low 70s F surface
    dewpoints beneath 8 C/km mid-level lapse rates will contribute to
    2500-4000 J/kg MLCAPE. Low-level southerly flow, quickly veering to
    northwesterly and strengthening with height, will result in
    elongated hodographs with some low-level curvature near the
    baroclinic boundary. As such, the overall CAPE/shear parameter space
    will support supercells with large to very large hail potential. If
    a supercell can anchor along the baroclinic boundary, a tornado will
    also be possible.

    …East Florida Peninsula…
    A southward-sagging cold front will begin to stall across the FL
    Peninsula during the afternoon hours, preceded by rich low-level
    moisture beneath 6.5-7.5 C/km mid-level lapse rates, which will
    boost MLCAPE over 2500 J/kg. Modest northwesterly mid-level flow
    impinging on the peninsula will encourage deep-layer speed shear
    over 40 kts, that in tandem with moderate to strong instability,
    will support multicells and transient supercells by afternoon. Large
    hail and strong, damaging wind gusts are the primary threats with
    the most intense storms.

    …Northern Rockies…
    Scattered thunderstorm development is expected across central and
    northern ID into southwestern MT as strong forcing for ascent with
    the passing mid-level trough overspreads a deep, mixed boundary
    layer during the afternoon. Forecast soundings show inverted-v
    profiles extending up to 500 mb. As such, some downward momentum
    transport via evaporative cooling should encourage stronger wind
    gusts with the deeper storm cores. However, confidence is not high
    enough for severe gusts to introduce Category 1/Marginal risk
    probabilities at this time.

    ..Squitieri.. 05/21/2025

    CLICK TO GET WUUS02 PTSDY2 PRODUCT

    NOTE: THE NEXT DAY 2 OUTLOOK IS SCHEDULED BY 0600Z

    MIL OSI USA News

  • MIL-OSI USA: SPC May 21, 2025 1630 UTC Day 1 Convective Outlook

    Source: US National Oceanic and Atmospheric Administration

    SPC AC 211631

    Day 1 Convective Outlook
    NWS Storm Prediction Center Norman OK
    1131 AM CDT Wed May 21 2025

    Valid 211630Z – 221200Z

    …THERE IS A SLIGHT RISK OF SEVERE THUNDERSTORMS ACROSS EASTERN
    NORTH CAROLINA…SOUTHERN GEORGIA/NORTHERN FLORIDA…AND THE
    OZARKS…

    …SUMMARY…
    The most likely areas for severe storms are across parts of far
    eastern North Carolina, the upper Ohio River Valley and parts of the
    Southeast this afternoon, in addition to the Ozarks this evening.

    …Eastern North Carolina/southern Virginia…
    In the wake of early morning convection, air mass
    recovery/destabilization will occur today in vicinity of the
    eastward-transitioning surface wave and in vicinity of the roughly
    west/east-oriented surface boundary located near/south of the
    Virginia/North Carolina border. Drying westerly low-level
    trajectories will exist to the south of the front and behind the
    surface wave, with severe-storm favorable ingredients/potential
    development tending to focus across far northeast North Carolina
    where moderate buoyancy will be maximized with strong westerlies
    aloft (40+ kt effective shear). While severe storm
    coverage/likelihood may not be as high as previously thought, some
    potential for large hail, damaging wind gusts and possibly a tornado
    will still exist on an isolated basis.

    …Ozarks/Mid-South…
    While rich boundary-layer moisture will remain confined across south
    Texas and Louisiana, a strengthening low-level baroclinic zone will
    focus near the Kansas/Oklahoma border east-southeast into the
    Mid-South. Guidance is rather consistent in developing at least
    elevated convection to the cool side of this zone by evening. This
    will be coincident with an intensifying mid-level speed max.
    Forecast soundings depict potentially very strong mid to upper-level
    speed shear within the slightly north of west flow regime. Coupled
    with steep mid-level lapse rates, this setup could yield a few
    elevated supercells capable of large hail and perhaps locally
    damaging winds.

    …Central Plains…
    A mid-level vorticity lobe initially over Wyoming this morning will
    dig east-southeastward into the lower Missouri Valley by early
    evening amidst west-northwesterly flow aloft. Heating will result in
    very steep 0-3 km lapse rates by mid afternoon with several hundred
    J/kg SBCAPE. Elongated hodographs will support quick-moving cells
    capable of an isolated risk for severe wind gusts during the late
    afternoon through around sunset (roughly 20-01z).

    …Upper Ohio Valley including PA/OH/WV border region…
    A corridor of modest boundary-layer heating is expected ahead of the
    primary surface cyclone drifting across northern Ohio toward Lake
    Erie. Coupled with cooling mid-level temperatures, weak
    surface-based buoyancy is expected by midday into the afternoon.
    Deep-layer shear will not be strong given proximity to the mid-level
    trough, but should be adequate for weak/transient mid-level
    rotation. With numerous thunderstorms expected, small to marginally
    severe hail and isolated damaging winds are anticipated. A brief
    tornado or two is also possible with storms near the warm front,
    before convection weakens as it moves east-northeastward into
    less-buoyant surface conditions.

    …North Florida and southern Georgia…
    Along the southeastward-moving cold front, moderate buoyancy is
    expected ahead of the front. A veered low-level wind profile will
    limit effective bulk shear, but scattered thunderstorms could yield
    multicells and perhaps a transient supercell. Isolated damaging
    winds and marginally severe hail are possible with the stronger
    storms. For additional short-term details, see Mesoscale Discussion
    920.

    …Far southern Louisiana/far southern Mississippi…
    Sufficient residual elevated buoyancy in the immediate post-frontal
    environment may allow for some storms to produce hail to near severe
    levels, mostly over just the next few hours this afternoon and on a
    very isolated basis.

    …Deep South Texas…
    A very moist and unstable air mass (2000-4000 J/kg MLCAPE later
    today) exists across the region, aside from some higher cloud cover
    spreading into the region via a slowly approaching and weakening
    convective complex south of the international border. Additional
    convection will likely develop in adjacent Mexico over the higher
    terrain this afternoon, and some of these storms may spread east
    across the lower Rio Grande Valley this evening. Isolated large hail
    and severe-caliber wind gusts may accompany these storms.

    ..Guyer/Jewell.. 05/21/2025

    CLICK TO GET WUUS01 PTSDY1 PRODUCT

    NOTE: THE NEXT DAY 1 OUTLOOK IS SCHEDULED BY 2000Z

    MIL OSI USA News

  • MIL-OSI USA: SPC MD 921

    Source: US National Oceanic and Atmospheric Administration

    Mesoscale Discussion 921

    Mesoscale Discussion 0921
    NWS Storm Prediction Center Norman OK
    1148 AM CDT Wed May 21 2025

    Areas affected…far eastern North Carolina

    Concerning…Severe potential…Watch unlikely

    Valid 211648Z – 211915Z

    Probability of Watch Issuance…20 percent

    SUMMARY…Isolated strong storms may develop this afternoon over far
    eastern North Carolina. Localized hail or wind may occur.

    DISCUSSION…Surface analysis shows a low over northeast
    NC/southeast VA, with a cold front extending westward across
    northern NC. South of this front, westerly winds and strong heating
    are steepening boundary layer lapse rates, and removing convective
    inhibition. Meanwhile, a narrow zone of mid 70s F dewpoints remains
    in place over far eastern NC. Continued heating will yield over 2000
    J/kg MLCAPE, beneath moderate westerlies aloft with around 50 kt
    deep layer shear.

    Although the westerly flow regime will eventually result in a drying
    air mass, a window may exist in the near term for a few strong to
    severe storms. Isolated marginal hail or a strong downburst cannot
    be ruled out.

    ..Jewell/Guyer.. 05/21/2025

    …Please see www.spc.noaa.gov for graphic product…

    ATTN…WFO…AKQ…MHX…

    LAT…LON 36217671 36417640 36457580 36337571 36037553 35587539
    35237548 35037602 34697635 34577651 34627665 34937691
    35447704 35837695 36217671

    MOST PROBABLE PEAK TORNADO INTENSITY…UP TO 95 MPH
    MOST PROBABLE PEAK WIND GUST…UP TO 60 MPH
    MOST PROBABLE PEAK HAIL SIZE…UP TO 1.25 IN

    Top/All Mesoscale Discussions/Forecast Products/Home

    MIL OSI USA News

  • MIL-OSI USA: SPC MD 922

    Source: US National Oceanic and Atmospheric Administration

    Mesoscale Discussion 0922
    NWS Storm Prediction Center Norman OK
    1246 PM CDT Wed May 21 2025

    Areas affected…parts of eastern Ohio…western
    Pennsylvania…northern West Virginia and adjacent western Maryland

    Concerning…Severe potential…Watch unlikely

    Valid 211746Z – 212015Z

    Probability of Watch Issuance…20 percent

    SUMMARY…A couple of intensifying storms are possible by 3-5 PM
    EDT, perhaps including a supercell or two accompanied by a risk for
    severe hail, locally damaging wind gusts, and some potential for a
    brief tornado. It is not clear that a severe weather watch is
    needed, but trends are being monitored.

    DISCUSSION…Ascent and cooling, within the left exit region of a
    strong cyclonic mid/upper jet (70+ kt around 500 mb) nosing through
    the Ohio Valley, have been contributing to a sustained, broken band
    of convection. This has become focused within surface troughing to
    the southeast of a modest remnant occluded low now centered over
    northwestern Ohio, where the eastward progression of the convection,
    to this point, has been outpacing appreciable boundary-layer
    destabilization ahead of it.

    However, a corridor of relatively stronger surface heating and
    destabilization is ongoing where modest boundary layer moisture
    lingers across the Allegheny Plateau, across the Pittsburgh PA,
    Morgantown and Wheeling WV areas, as far north as the Youngstown OH
    vicinity. Latest Rapid Refresh suggests that mixed-layer CAPE may
    be in the process of increasing up to around 1000 J/kg within this
    corridor, prior to the arrival of the mid-level forcing within the
    next hour or two. As this occurs, a couple of developing storms may
    undergo substantive intensification, perhaps evolving into
    low-topped supercells. This may be accompanied by marginally severe
    hail, locally strong surface, and perhaps some risk for a brief
    tornado.

    ..Kerr/Guyer.. 05/21/2025

    …Please see www.spc.noaa.gov for graphic product…

    ATTN…WFO…CTP…LWX…PBZ…RLX…CLE…

    LAT…LON 40998024 40217953 39327930 39248073 39688093 40518122
    41228104 40998024

    MOST PROBABLE PEAK TORNADO INTENSITY…UP TO 95 MPH
    MOST PROBABLE PEAK WIND GUST…UP TO 60 MPH
    MOST PROBABLE PEAK HAIL SIZE…1.00-1.75 IN

    MIL OSI USA News

  • MIL-OSI USA: SPC Tornado Watch 310

    Source: US National Oceanic and Atmospheric Administration

    Note:  The expiration time in the watch graphic is amended if the watch is replaced, cancelled or extended.Note: Click for Watch Status Reports.
    SEL0

    URGENT – IMMEDIATE BROADCAST REQUESTED
    Tornado Watch Number 310
    NWS Storm Prediction Center Norman OK
    240 PM EDT Wed May 21 2025

    The NWS Storm Prediction Center has issued a

    * Tornado Watch for portions of
    Eastern Ohio
    Western Pennsylvania
    Far Northern West Virginia

    * Effective this Wednesday afternoon and evening from 240 PM
    until 800 PM EDT.

    * Primary threats include…
    A couple tornadoes possible
    Scattered damaging wind gusts to 65 mph possible
    Isolated large hail events to 1.5 inches in diameter possible

    SUMMARY…Low-topped supercell and related hail/wind and tornado
    potential should focus in a narrow zone regionally near a warm front
    this afternoon until around sunset.

    The tornado watch area is approximately along and 50 statute miles
    east and west of a line from 35 miles north northwest of Pittsburgh
    PA to 30 miles west southwest of Morgantown WV. For a complete
    depiction of the watch see the associated watch outline update
    (WOUS64 KWNS WOU0).

    PRECAUTIONARY/PREPAREDNESS ACTIONS…

    REMEMBER…A Tornado Watch means conditions are favorable for
    tornadoes and severe thunderstorms in and close to the watch
    area. Persons in these areas should be on the lookout for
    threatening weather conditions and listen for later statements
    and possible warnings.

    &&

    AVIATION…Tornadoes and a few severe thunderstorms with hail
    surface and aloft to 1.5 inches. Extreme turbulence and surface wind
    gusts to 55 knots. A few cumulonimbi with maximum tops to 500. Mean
    storm motion vector 23025.

    …Guyer

    Note: The Aviation Watch (SAW) product is an approximation to the watch area. The actual watch is depicted by the shaded areas.
    SAW0
    WW 310 TORNADO OH PA WV 211840Z – 220000Z
    AXIS..50 STATUTE MILES EAST AND WEST OF LINE..
    35NNW PIT/PITTSBURGH PA/ – 30WSW MGW/MORGANTOWN WV/
    ..AVIATION COORDS.. 45NM E/W /15WNW EWC – 37SSE AIR/
    HAIL SURFACE AND ALOFT..1.5 INCHES. WIND GUSTS..55 KNOTS.
    MAX TOPS TO 500. MEAN STORM MOTION VECTOR 23025.

    LAT…LON 40967953 39487950 39488137 40968144

    THIS IS AN APPROXIMATION TO THE WATCH AREA. FOR A
    COMPLETE DEPICTION OF THE WATCH SEE WOUS64 KWNS
    FOR WOU0.

    Watch 310 Status Report Message has not been issued yet.

    Note:  Click for Complete Product Text.Tornadoes

    Probability of 2 or more tornadoes

    Mod (30%)

    Probability of 1 or more strong (EF2-EF5) tornadoes

    Low (10%)

    Wind

    Probability of 10 or more severe wind events

    Mod (40%)

    Probability of 1 or more wind events > 65 knots

    Low (10%)

    Hail

    Probability of 10 or more severe hail events

    Low (20%)

    Probability of 1 or more hailstones > 2 inches

    Low (

    MIL OSI USA News

  • MIL-OSI USA: TRANSCRIPT: Governor Phil Scott Highlights Housing Legislation at Weekly Press Conference

    Source: US State of Vermont

    Montpelier, Vt. – At his weekly press conference Wednesday, Governor Phil Scott and Housing and Community Development Commissioner Alex Farrell emphasized the importance of passing legislation this session to address Vermont’s housing crisis.

    Governor Phil Scott: Good afternoon, thanks for being here today.

    Since I’ve been Governor, I’ve been sounding the alarm about our housing crisis. And I thought almost everyone in the building agreed that housing should be a top priority.

    That’s why in January; we presented a proposal to the legislature to help move the needle on the housing we desperately need which included important tools and regulatory changes.

    As a reminder, over the past several years we’ve invested hundreds of millions in housing. But it’s still too expensive and takes too long to build.

    That’s why regulatory reform is so important.

    Our proposals also included common sense solutions like expanding the Tax Increment Financing program to bring infrastructure funding to smaller communities who have fewer resources.

    We’ve also seen how costly permitting is because it’s difficult to navigate and time consuming, leading to project costs that skyrocket.

    The complicated process prevents many smaller developers from moving forward with projects  because it takes too long and doesn’t make financial sense.

    In last year’s “so called” housing bill, which was actually a conservation bill, one of the few helpful provisions were the interim Act 250 exemptions.

    But as helpful as they are, they’re going to expire next year. We’ve asked the legislature to extend those so communities have an opportunity to thrive and grow.

    Unfortunately, we’re seeing very little traction in our proposal to extend these.

    And finally, we asked the legislature to reform wetland permitting and appeals process which will help projects across the state, especially in Barre, Montpelier, and Plainfield, which all need our help as they continue to recover from recent flooding.

    Last session, despite many legislators campaigning on the need for more housing and regulatory reform, they didn’t follow through.

    So here we are, one year later and close to adjournment, and I’m concerned we once again aren’t going far enough to meet the moment.

    If housing is truly the priority we say it is, we need to follow through, and make sure all communities have the tools they need to grow.

    We can’t afford to nibble around the edges, especially when we need 41,000 more homes in 5 years – just to catch up.

    We need to address it now, because if we don’t, Vermont will fall further behind.

    Commissioner Alex Farrell: Thank you, Governor.  

    Today I am speaking not only as the Commissioner of Housing and Community Development, but also as a housing advocate. As the Governor said, we need to ask ourselves if we’re truly meeting the moment on housing.

    In January, the Governor and I shared his PATH for Vermont proposal – a robust housing package that paired the most efficient investments with various regulatory reforms and systems improvements.

    Now, I’d like to show how few of these proposals have made it into the primary housing bills. The red “Xs” signify proposals that did not move forward in either housing bill, orange labels indicate proposals that were reduced.

    As we enter the final weeks of the session, it is clear that none of the regulatory or appeals reform proposals will be included in housing legislation, and the proposed investments have been dramatically diminished.

    Regarding the proposed investments, I want to acknowledge the budgetary constraints that we faced this year, though it is important to recognize that the Governor presented a budget that kept us living within our means while still prioritizing strategic housing investments. As we enter a new era in which the massive influx of federal investment has not only dried up, but we enter a new phase of uncertainty, we are reminded that funding alone will not be enough to meet the moment on housing.

    We need to reform our regulatory systems and provide new tools. We need to provide communities, developers, and homebuilders with predictability. And we need to make sure that our zoning and land use laws enable housing of all types to be built in every community in the state.

    I am concerned by how often I heard the following phrase in legislative committees this year: “I know we have a housing crisis, BUT…” The words that follow “but” are almost always disappointing. Here are some examples:

    • “This committee doesn’t have jurisdiction over that issue”
    • “We would prefer to take that up next session”
    • “We didn’t realize that’s a priority”
    • “We don’t have enough time to resolve that this year”

    I’ll repeat that we presented this package in January, two months after voters spoke loud and clear that Vermont is becoming too expensive to afford. Adding more homes will increase the tax base, reducing pressure on those who are already paying property taxes.

    There is, however, a real opportunity in the Project-based TIF discussion. We presented this in January as a proposal to help rural communities invest in infrastructure to support housing development. Since then, the proposal has gone through many shifts and changes, including changing the name from SPARC, as proposed in our package, to CHIP – the Community & Housing Infrastructure Program. Name aside, this program presents a tremendous opportunity to support the creation of thousands of housing units.

    CHIP moved through the Senate and passed through that chamber productively and in a form that the administration and housing advocates supported and were excited about. CHIP then went through productive and nuanced conversations through the housing and commerce committees in the House. However, things went very wrong when this program moved to the House Committee on Ways and Means – supposedly one of its final legislative stops. This committee proposed an amendment which makes drastic changes to the program which drew concerns from the administration, builders, municipalities, housing advocates, and many legislators. The proposed changes would narrow the applicability of the program to such an extent that very few communities could use it. Recent efforts to modify the Ways & Means amendment have not made meaningful improvements.

    It is imperative that CHIP passes in a form that rural communities can benefit from. We cannot overcomplicate this tool – this housing infrastructure financing tool – out of a desire to layer on many other complex policy priorities. Our priority needs to remain housing.

    In justifying the proposed amendments, here are some things I heard which are deeply concerning to me:

    • “We are already building more housing than we have since the 1980s” – that’s not true. In the late 80s we were building about 4,800 homes a year. Now it’s about 2,300.
    • “Vermont’s housing is the envy of the nation” – all evidence suggests otherwise. In fact, a new study by the U.S. Chamber of Commerce finds Vermont’s housing crisis is resulting in more than $700 million in lost economic output, $422 million less in personal income, and 6,800 jobs that would have been created if we had a place for those workers to live.
    • “We shouldn’t push to build 30,000 homes as fast as possible” – why shouldn’t we? We have decades of underbuilding to make up for.
    • “Let’s just wait for population decline to hit in the 2040s.” This is particularly galling since our housing crisis is contributing to our population decline and workforce challenges. Young Vermonters are leaving partly because they think they will never be able to own a home here.

    These comments make me worry that we are taking a step back in the conversation around housing in the state house. Just ask Vermonters if they feel we can declare our mission accomplished on housing.

    • Do Vermonters feel like they can buy a new home at an affordable price?
    • Do Vermont renters feel like they have options for quality rental housing at a price they can afford?

    The answer is a resounding “no”.

    Vermonters are asking us for bold action on housing, and I fear we are not meeting the moment. We stand ready to help – our proposals are drafted and would represent meaningful change. We are eager to be partners in this.

    ###

    MIL OSI USA News

  • MIL-OSI Security: Missouri Man Sentenced to Over Nine Years in Prison for Church Arson

    Source: United States Attorneys General 1

    A Missouri man was sentenced yesterday to 111 months in prison by U.S. District Judge Matthew T. Schelp for the Eastern District of Missouri for burning down a Cape Girardeau, Missouri house of worship in 2021. He was also ordered to pay $6,968,223.36 in restitution for damages incurred by the church.

    Christopher Scott Pritchard, 49, pleaded guilty in U.S. District Court for the Eastern District of Missouri in Cape Girardeau, on Dec. 19, 2024, to one count of arson and one count of violating the Church Arson Prevention Act. Pritchard admitted setting fire to the house of worship owned and used by the Church of Jesus Christ of Latter-Day Saints (LDS) in Cape Girardeau, Missouri, during the evening of April 28, 2021. Pritchard was spotted watching the fire and was arrested about 1.5 miles away by the Cape Girardeau County Sheriff’s Office. Pritchard smelled like smoke and had a backpack containing a laptop computer, a projector, speakers and 21 apples that he’d stolen from the church. Pritchard told deputies that he’d gotten into a verbal altercation with the Bishop of the church a few days before the fire and had threatened to assault the Bishop and burn the church down.

    The fire destroyed the building and prevented the congregants in the free exercise of their religious beliefs. No one was injured.

    “There is no place in America for criminal acts against houses of worship,” said Assistant Attorney General Harmeet K. Dhillon of the Justice Department’s Civil Rights Division. “The Civil Rights Division thanks its law enforcement partners for prosecuting this matter.”

    Assistant Attorney General Harmeet K. Dhillon and U.S. Attorney Sayler A. Fleming for the Eastern District of Missouri made the announcement.

    The FBI St. Louis Field Office, the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), the Cape Girardeau County Sheriff’s Office and the Missouri State Fire Marshal’s Office investigated the case. Assistant U.S. Attorney Paul Hahn for the Eastern District of Missouri prosecuted the case, with assistance from the Civil Rights Division’s Criminal Section.

    MIL Security OSI

  • MIL-OSI USA: ICE Boston arrests Dominican fugitive charged with firearms, drug crimes in Massachusetts

    Source: US Immigration and Customs Enforcement

    May 21, 2025Boston, MA, United StatesEnforcement and Removal

    BOSTON — U.S. Immigration and Customs Enforcement, in partnership with U.S. Customs and Border Protection, arrested a 44-year-old Dominican national charged in Boston with fentanyl trafficking and possession of a firearm. Officers with ICE Boston and CBP Boston arrested Julio Soto-Heredia in Boston May 18.

    Additionally, Soto-Heredia has been charged by Dominican authorities for firearms trafficking crimes in the Dominican Republic.

    “Julio Soto-Heredia attempted to flee justice in the Dominican Republic by hiding out in Boston,” said ICE Enforcement and Removal Operations Boston acting Field Office Director Patricia H. Hyde. “If that weren’t bad enough, Soto-Heredia apparently illegally armed himself and attempted to peddle poison in our Massachusetts neighborhoods. ICE Boston will not stand idly by while illegal alien offenders victimize the residents of our New England communities. We will continue to prioritize public safety by arresting and removing criminal alien offenders.”

    Soto-Heredia remains in ICE custody.

    Members of the public with information about suspected immigration violations or related criminal activity are encouraged to contact the ICE Tip Line at 866-DHS-2-ICE (866-347-2423) or submit information online via the ICE Tip Form.

    Learn more about ICE’s mission to increase public safety in our communities on X at @EROBoston.

    MIL OSI USA News

  • MIL-OSI USA: Statement of Commissioner Kristin N. Johnson on Her Departure from the CFTC

    Source: US Commodity Futures Trading Commission

    It has been an honor and privilege to serve as a Commissioner at the Commodity Futures Trading Commission (CFTC). Having completed my full term, I have notified the President of my intent to step down as a CFTC Commissioner later this year. Although this is a difficult decision, I am proud of the work that I have accomplished and am deeply grateful for the chance to develop meaningful relationships with staff and current and former Commissioners during my tenure at the CFTC.
    I am exceptionally fortunate to have had the opportunity to serve our great nation and am honored that President Joseph R. Biden nominated me to serve in two critical roles as a financial market regulator. In addition to nominating me to serve a three-year term as a CFTC Commissioner in the fall of 2021, last summer, President Biden nominated me to serve as Assistant Secretary for Financial Institutions at the United States Department of the Treasury. 
    As a graduate of Georgetown University’s Walsh School of Foreign Service, the invitation to return to Washington, D.C. as a CFTC Commissioner resonated with my life-long commitment to be “in service of others.” When I accepted the nomination to serve as a CFTC Commissioner, I requested a three-year leave of absence from Emory University School of Law where I serve as Asa Griggs Candler Professor of Law. On March 28, 2022, I was unanimously confirmed by the United States Senate. On March 30, 2022, not long after teaching my last class for the semester at Emory Law School, I was sworn in to serve as a CFTC Commissioner.
    This year marks the 50th Anniversary of the CFTC, a small-but-mighty agency that works daily to advance effective supervision and oversight in derivatives markets. In 1974, Congress passed and Former President Gerald Ford[1] signed into law the Commodity Futures Trading Commission Act creating the CFTC. A few months later, on April 15, 1975, four of the first five Commissioners, including the first Chairman of the Commission, were sworn in to service.
    As the Commission celebrates this important milestone, I celebrated my third anniversary at the Commission. A few days after my third anniversary, my term expired.
    Our derivatives markets operate as a critical resource for price discovery, risk management, and hedging functions for many sectors in our economy but, most notably, the agriculture, energy, and financial services sectors. One of the greatest strengths of our federal government and, more specifically, the federal agencies that supervise many of the largest global financial market participants in the world, is the intellectual leadership of our regulators.[2] Over the last several decades significant events have tested the resilience of our markets. In each instance, the Commission and its regulations developed through robust engagement among the Commissioners—with the support of the Commission staff—have served to address liquidity and default risk management concerns and to enhance the integrity and stability of our derivatives markets.
    I have endeavored to support the Commission’s work through constructive, substantive engagement with my fellow Commissioners, Commission staff, and the diverse businesses that we supervise. I am deeply committed to encouraging the Commission to develop well-informed, research-based, data-driven regulatory solutions that are well-tailored and fit-for-purpose. Thoughtful, effective regulation ensures that our markets are resilient even during periods of significant or persistent challenges.
    It has been a privilege to serve alongside my fellow Commissioners and to have had the opportunity to work with the exceptional and indefatigable staff at the Commission. The Commission staff works tirelessly to support the Commission in tackling complex and consequential issues through careful and thoughtful deliberative processes. I am confident that the Commission will continue to do important work protecting investors and customers, combatting fraud and market manipulation, and ensuring market integrity and stability.
    A Survey of Service
    Serving in leadership at the Commission, I have enjoyed driving intellectual and policy developments on several critical issues facing our markets. I led the Commission by advancing proposed and final rules that enhance risk management for derivatives clearing organizations (DCOs), cyber-resilience, and effective recovery, resilience, and wind-down regulations.
    I have strongly advocated for careful reflection regarding the integration of artificial intelligence (AI) in financial markets and advocated for a number of policies and strategies to enhance the Commission’s ability to better understand industry integration of AI, including information gathering; the creation of an inter-agency task force encouraging domestic and international harmonization and collaboration on guidance or policies addressing the adoption of AI; the creation of a CFTC AI Fraud and Market Manipulation Task Force; and efforts to ensure sufficient human capital and financial resources to enable the Commission staff to keep pace with rapidly-evolving AI technologies.
    In the wake of a crypto-crisis in the fall of 2022, I delivered a keynote address at the inaugural Digital Assets @Duke conference, where I called for the Commission to organize roundtables and convene discussions to better understand the type of regulatory interventions that may lead to effective supervision of rapidly developing and evolving decentralized finance markets.[3] I encouraged the Commission to begin a multi-stakeholder dialogue on digital asset markets that would help to prepare the Commission staff to create regulation to carry out a Congressional mandate and, at the same time, offer educational workshops on foundational issues such as corporate governance, resolution planning, and customer protection features of CFTC regulation.[4] These regulatory pillars are hardwired in our supervision and should be part of the regulatory architecture for any novel assets or markets that come under Commission supervision. Same risks, same rules. Moreover, these governance and operational guardrails have historically served to ensure that firms are able to withstand anticipated shocks (for example, by promoting enterprise risk management) and that markets remain resilient—even in times of significant distress. 
    I am proud to have served as Sponsor of the Market Risk Advisory Committee (MRAC). I am grateful for the hard work of Alicia Crighton (Chair of the MRAC), the members of the MRAC, and the members of the MRAC Subcommittees—the Market Structure, Central Counterparty Risk & Governance, Interest Rate Benchmark Reform, Climate-Related Market Risk, and Future of Finance Subcommittees.
    As Sponsor of the MRAC, I led the Commission in taking on, in real-time, emerging cyber defense and cyber resilience concerns. In March of 2023, the MRAC hosted a first-of-its-kind hearing to examine cyber threats and potential solutions in derivatives markets. Over the last three years, the MRAC has submitted three sets of recommendations and a cutting-edge report to the Commission. The recommendations and report address system safeguards, critical third-party service providers and cyber resilience for institutions at the center of our market infrastructure; the efficacy of recovery, resilience, and wind-down policies for intermediaries in our markets; risk management related to the cash-futures basis trade; and a report on the state of the futures commission merchant market.
    The central tenants of the Commodity Exchange Act inform the CFTC’s mandate—to prevent fraud and market manipulation, protect investors and customers, and ensure the stability and integrity of our markets. In order to deter escalating or future misconduct, I have strongly supported efforts to ensure that the Commission upholds this mandate, enhances customer protection, and holds bad actors accountable.
    Artificial Intelligence in Financial Markets 
    While derivatives transactions in financial markets date back to ancient Greece, none of the Greek philosophers who lived two thousand years ago had the ability to generate a philosophical tome or literary masterpiece by simply typing a few questions into ChatGPT.[5]  Simply stated, today’s financial markets are evolving at an unprecedented and accelerated pace. I arrived at the Commission deeply committed to advancing the Commission’s understanding of AI and AI use cases relevant to our markets. During my tenure at the Commission, I partnered with leadership across the industry, government regulators, public interest advocates, academics, and Commission staff to initiate a dialogue on the increasing adoption of AI by our market participants as well as the incorporation of AI in regulatory oversight and supervision.
    Information-Gathering
    In January 2024, I rolled up my sleeves during a winter storm and worked in collaboration with talented CFTC senior staff to develop the Commission’s first request for comment on AI in CFTC-regulated markets.[6] Later in the year, I represented the Commission in the development of the U.S. Department of the Treasury’s request for information on AI.[7] I also represented the Commission by serving in an association of federal regulators across government agencies engaged in understanding the implications of integrating AI in government supervision and regulation.
    In June of 2023, I joined a group of market regulators reflecting on the integration of AI in supervisory technology (SupTech) at the International Organization of Securities Commissions’ (IOSCO) Annual Meeting in Bangkok, Thailand. Days after IOSCO’s Annual Meeting in June 2023, I launched an annual international roundtable to explore AI and other novel technologies and the impact of these technologies on market structures with the former U.S. Ambassador to Spain and Andorra, Julissa Reynoso Pantaleón.[8] I have served as a keynote speaker at dozens of industry and trade association conferences as well as academic institutions including Yale, Stanford, Duke, New York University, the University of Pennsylvania, Georgetown, the University of Chicago, and Cornell Law Schools, as well as Rice University’s Baker Institute, among other institutions where I have been fortunate to engage in thoughtful conversations with leading experts representing diverse viewpoints.
    My engagement with market participants, U.S. market and prudential regulators, and global market regulators around the world has left me with the impression that we are still in a learning phase and are continuing to develop more precise understandings of the power, potential, and limits of developed and developing applications of AI, including generative and agentic AI.    I have, however, advocated for a few accessible policy initiatives that the Commission should begin to take steps to introduce.
    An Inter-Agency Task Force – Collaboration and Coordination
    Over the last three years, I have advocated for AI policy priorities that must be at the center of the CFTC and other regulators’ policy agenda.[9] I have called for coordination among regulators to ensure that regulators are informed and have the depth of expertise to respond effectively to emerging technologies. I have asked the Commission and other financial market regulators to create an Inter-Agency AI Task Force to establish a pathway for open dialogue through deep dive, public and closed-door roundtables among the Commission, market participants, other market and prudential regulators, and public interest advocates.[10] Shortly after the announcement of my proposal, the Commission named its first Chief AI Officer.
    CFTC AI Fraud and Market Manipulation Task Force
    Our markets are faced with increasingly sophisticated forms of AI driven fraud. Evidence suggests that hackers are repurposing AI-based tools previously used in cyber defense tactics to identify weaknesses in networks and cybersecurity applications. These weaknesses open back doors for cyber-attacks. Generative AI may enable sophisticated actors to execute more convincing phishing campaigns. Deep fakes and similar campaigns may be more difficult to detect, especially for less sophisticated consumers and retail participants.
    I have encouraged the Commission to create an internal AI task force within the Division of Enforcement and introduce heightened civil monetary penalties in instances where bad actors use AI to engage in fraud or market manipulation. In conversations with regulators in jurisdictions around the world, I have advocated for regulators to better understand AI as a SupTech resource that may enhance our ability to more precisely target AI fueled cyber and fraud attacks that threaten to upend the integrity and stability of domestic and global financial markets causing severe market disruption.
    Human Capital and Financial Resources
    The CFTC continues to punch above its weight. The agency, however, must have both financial and human resources to keep pace as industry participants integrate increasingly complex iterations of AI. As our markets become more complex and reflect the incorporation of and reliance on novel technologies, the Commission must have the resources to effectively supervise more sophisticated markets. I believe that the Commission would benefit from increased resources dedicated to enabling several of the Divisions within the Commission to prepare for and meet the challenges of regulating innovative trading, clearing, and settlement technologies.[11]
    The Market Risk Advisory Committee
    In my role as Sponsor of the MRAC, I have convened stakeholders with diverse perspectives to address critical, complex issues facing our markets. Under my leadership and working in collaboration with industry executives representing exchanges, clearinghouses, futures commission merchants, as well as public interest advocates, academics, and many others, the MRAC examined many of the most pressing risks across our financial markets, including systemic issues that could threaten the stability of derivatives markets.
    During my time as Sponsor, the MRAC has focused on increasing concerns presented by cyber threats; the significance of critical third-party service providers such as cloud-based service providers; the introduction of artificial intelligence in market infrastructure and commercial and retail transactions; and novel and nascent issues that arise with the introduction of decentralized financial products such as digital assets or cryptocurrency and other emerging markets.
    In March of 2023, the MRAC hosted a first-of-its-kind post-mortem on the implications for markets following the cyberattack on back-office service provider ION. The hearing included presentations by Matthew Cronin of the White House’s Office of the National Cyber Director; Tom Sexton, President and Chief Executive Officer of the National Futures Association; Walt Lukken, President and Chief Executive Officer of the Futures Industry Association; Julie Holzrichter of CME Group; Amanda Olear, Former Director of the Market Participants Division of the CFTC; Greg Ruppert, Executive Vice President of FINRA; Ashwini Panse of Intercontinental Exchange; Suyash Paliwal, Former Director of the CFTC Office of International Affairs (OIA); and Senior Special Counsel Kirsten Robbins of the CFTC OIA, among others.[12]
    At the MRAC’s most recent meeting, the Committee voted to submit recommendations on many issues—a report and recommendation on the need to evaluate our regulations governing critical third party service providers (particularly in areas marked by concentration risks due to a limited number of competitive service providers); cyber resilience for derivatives clearing organizations; and best practices for managing market, liquidity, counterparty credit, and other risks related to the cash futures basis trade.[13] In addition to these significant contributions, the MRAC advanced important recovery and resolution proposals and published a cutting-edge report on concentration risk engendered by a decline in the market for futures commission merchant services over the last two decades.[14]
    The MRAC’s work on each of these critical questions will help the Commission to address emerging issues and enhance the Commission’s ability to promote the stability and integrity of derivatives markets.
    The Importance of Public Service
    I began my legal career as a law clerk for the Honorable Judge Joseph A. Greenaway Jr. I am thankful that the Judge was willing to take a chance on me; the Judge hired me as a second-year law student to serve as his law clerk upon my graduation from law school. Having spent the better part of his career as a federal prosecutor and later a federal judge, Judge Greenaway taught me to value public service and the importance of building relationships in the communities in which we serve. 
    I am grateful that I have had the opportunity to serve the CFTC community. Every well-developed proposed or final rule review, open or closed meeting briefing and engagement, advisory committee meeting agenda, and policy initiative advanced by my office benefited tremendously from the tireless work and commitment of my current and former staff. I would like to extend my sincere thanks to everyone who served my office in any counsel, policy advisor or law student intern role. I am also grateful to the incomparable executive assistants who supported the administrative functions of the office.
    About Commissioner Johnson
    Immediately prior to joining the Commission, Commissioner Johnson served as a tenured professor with an endowed professorship (Asa Griggs Candler Professor of Law) and Associate Dean for Faculty Research at Emory University School of Law. Commissioner Johnson also held a named professorship and served as Associate Dean for Faculty Research at Tulane University School of Law. Prior to law teaching, Commissioner Johnson served as a lawyer in private practice at Simpson Thacher & Bartlett LLC’s New York and London offices supporting the mergers and acquisitions, private credit and public and private capital markets practices. Upon leaving private practice, Commissioner Johnson joined J.P. Morgan Chase as Vice President and Assistant General Counsel in the Treasury Services Division supporting private funds. Before attending law school, Commissioner Johnson served as an analyst at Goldman Sachs in the Asset Management Division.
    Commissioner Johnson is the co-author of two forthcoming books—The Cambridge University Press Handbook on Artificial Intelligence & The Law and Artificial Intelligence & The Law: Cases and Materials.  Her recent work examines the implications of emerging innovative technologies including distributed digital ledger technologies that enable the creation of digital assets or cryptocurrency as well as networked, centralized and decentralized transaction-enabling infrastructure. Her early scholarship focuses on financial market disruptions that may create systemic risk concerns, with particular emphasis on the origination of derivatives and other complex financial products as well as secondary market trading, clearing, and settlement. She has testified before Congress on the benefits and risks of integrating emerging technologies such as blockchain or distributed digital ledger technologies and AI in financial markets.[15]

    [3] Keynote Address of Commissioner Kristin Johnson at Digital Assets @ Duke Conference, Duke’s Pratt School of Engineering and Duke Financial Economics Center, Mitigating Crypto-Crises: Applying Lessons Learned in Governance, Risk Management, and Compliance (January 26, 2023), https://www.cftc.gov/PressRoom/SpeechesTestimony/opajohnson2.

    [4] See Kristin N. Johnson, Commissioner, CFTC, Federal Reserve of Chicago Financial Markets Group Fall Conference, Investing in Investor Protection (Nov. 16, 2022), available on file with the Federal Reserve Bank of Chicago; see also Nahiomy Alvarez, Nomaan Chandiwalla, Alessandro Cocco, 2022 Financial Markets Group Fall Conference–Recap, https://www.chicagofed.org/publications/blogs/ chicago-fed-insights/2023/2022-fmg-fall-conference-recap (Feb. 6, 2023).

    [5] Kristin N. Johnson, Regulating Cryptocurrency Secondary Market Trading Platforms, 1/8/2020 U. Chi. L. Rev. Online 1 (2020).

    [7] See U.S. Department of the Treasury, Artificial Intelligence in Financial Services (Dec. 2024), https://home.treasury.gov/system/files/136/Artificial-Intelligence-in-Financial-Services.pdf (Treasury December Report).

    [15] In April of 2021, Commissioner Johnson testified before the United States House of Representatives Subcommittee on Consumer Protection and Financial Institutions. In July of 2019, she testified before the House Financial Services Committee Artificial Intelligence Task Force on the implications of integrating artificial intelligence in financial technology (fintech) platforms. 

    MIL OSI USA News