Category: Security

  • MIL-OSI Security: D.C. Guard Tests Skills With Jamaican, Barbadian Forces

    Source: United States SOUTHERN COMMAND

    Soldiers from the District of Columbia National Guard; Jamaica Defence Force, or JDF; Jamaica National Reserve; and Barbados Defence Force Reserves recently participated in the Caribbean Regional Training Camp 2025, a joint exercise aimed at bolstering regional security, enhancing disaster response capabilities and strengthening interoperability among the participating nations.

    MIL Security OSI

  • MIL-OSI Security: U.S. Marshals Arrest Fugitive Charged with Killing 3 During 2024 Block Party

    Source: US Marshals Service

    Philadelphia, PA – Members of the U.S. Marshals Eastern Pennsylvania Violent Crimes Fugitive Task Force arrested Amir Jones, 32, in the 4900 block of Kershaw Street in Philadelphia. Jones was wanted by the Philadelphia Police Department for 3 counts of homicide in relation to a July 21, 2024, mass shooting in the 1200 block of N. Alden Street. Three people were killed and six injured during a gun battle between two group of males that occurred during a neighborhood block party. On July 23rd, a warrant was issued for Amir Jones, and the case was delegated to the Marshal’s Fugitive Task Force. 

    At 6:00 a.m., investigators from the Marshals Fugitive Task Force in Philadelphia executed a search warrant at an apartment in the 4900 block of Kershaw Street where investigators believed Jones was hiding. Jones initially refused to comply with commands but after 30 minutes of negotiating, Jones surrendered without incident. 

    “High profile shootings will always garner U.S. Marshals Service attention. Be assured, our relentless pursuit of those involved never ceases until the perpetrators of these crimes are captured” said Eric Gartner, United States Marshal for the Eastern District of Pennsylvania.

    The Eastern Pennsylvania Violent Crimes Fugitive Task Force is a team of law enforcement officers led by U.S. Marshals in Philadelphia and the surrounding counties. The task force’s objective is to seek out and arrest violent crime fugitives. Membership agencies include the Philadelphia Police Department, Pennsylvania State Parole Officers, Pennsylvania State Police, Pennsylvania Attorney General Agents, Immigration Customs Enforcement, Chester Police Department, Bucks County Sheriff’s Office, and Delaware County Sheriff’s Office.

    MIL Security OSI

  • MIL-OSI Security: CISA and USCG Identify Areas for Cyber Hygiene Improvement After Conducting Proactive Threat Hunt at US Critical Infrastructure Organization

    Source: US Department of Homeland Security

    Summary

    The Cybersecurity and Infrastructure Security Agency (CISA) and U.S. Coast Guard (USCG) are issuing this Cybersecurity Advisory to present findings from a recent CISA and USCG hunt engagement. The purpose of this advisory is to highlight identified cybersecurity issues, thereby informing security defenders in other organizations of potential similar issues and encouraging them to take proactive measures to enhance their cybersecurity posture. This advisory has been coordinated with the organization involved in the hunt engagement.

    In 2024, CISA led a proactive hunt engagement at a U.S. critical infrastructure organization with the support of USCG analysts. During hunts, CISA proactively searches for evidence of malicious activity or malicious cyber actor presence on customer networks. The organization invited CISA to conduct a proactive hunt to determine if an actor had been present in the organization’s environment. (Note: Henceforth, unless otherwise defined, “CISA” is used in this advisory to refer to the hunt team as an umbrella for both CISA and USCG analysts).

    During this engagement, CISA did not identify evidence of malicious cyber activity or actor presence on the organization’s network, but did identify cybersecurity risks, including:

    • Insufficient logging;
    • Insecurely stored credentials;
    • Shared local administrator (admin) credentials across many workstations;
    • Unrestricted remote access for local admin accounts;
    • Insufficient network segmentation configuration between IT and operational technology (OT) assets; and
    • Several device misconfigurations.

    In coordination with the organization where the hunt was conducted, CISA and USCG are sharing cybersecurity risk findings and associated mitigations to assist other critical infrastructure organizations with improving their cybersecurity posture. Recommendations are listed for each of CISA’s findings, as well as general practices to strengthen cybersecurity for OT environments. These mitigations align with CISA and the National Institute for Standards and Technology’s (NIST) Cross-Sector Cybersecurity Performance Goals (CPGs), and with mitigations provided in the USCG Cyber Command’s (CGCYBER) 2024 Cyber Trends and Insights in the Marine Environment (CTIME) Report.

    Although no malicious activity was identified during this engagement, critical infrastructure organizations are advised to review and implement the mitigations listed in this advisory to prevent potential compromises and better protect our national infrastructure. These mitigations include the following (listed in order of importance):

    • Do not store passwords or credentials in plaintext. Instead, use secure password and credential management solutions such as encrypted password vaults, managed service accounts, or built-in secure features of deployment tools.
      • Ensure that all credentials are encrypted both at rest and in transit. Implement strict access controls and regular audits to securely manage scripts or tools accessing credentials.
      • Use code reviews and automated scanning tools to detect and eliminate any instances of plaintext credentials on hosts or workstations.
      • Enforce the principle of least privilege, only granting users and processes the access necessary to perform their functions.
    • Avoid sharing local administrator account credentials. Instead, provision unique, complex passwords for each account using tools like Microsoft’s Local Administrator Password Solution (LAPS) that automate password management and rotation.
    • Enforce multifactor authentication (MFA) for all administrative access, including local and domain accounts, and for remote access methods such as Remote Desktop Protocol (RDP) and virtual private network (VPN) connections.
    • Implement and enforce strict policies to only use hardened bastion hosts isolated from IT networks equipped with phishing-resistant MFA to access industrial control systems (ICS)/OT networks, and ensure regular workstations (i.e., workstations used for accessing IT networks and applications) cannot be used to access ICS/OT networks.
    • Implement comprehensive (i.e., large coverage) and detailed logging across all systems, including workstations, servers, network devices, and security appliances.
      • Ensure logs capture information such as authentication attempts, command-line executions with arguments, and network connections.
      • Retain logs for an appropriate period to enable thorough historical analysis (adhering to organizational policies and compliance requirements) and aggregate logs in an out-of-band, centralized location, such as a security information event management (SIEM) tool, to protect them from tampering and facilitate efficient analysis.

    For more detailed mitigations addressing the identified cybersecurity risks, see the Mitigations section of this advisory.

    Technical Details

    Note: This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 17. See Appendix: MITRE ATT&CK Tactics and Techniques for a table of potential activity mapped to MITRE ATT&CK tactics and techniques.

    Overview

    Cybersecurity and Infrastructure Security Agency (CISA) and United States Coast Guard (USCG) analysts (collectively referred to as CISA in this report) conducted a threat hunt engagement at a critical infrastructure organization in 2024. During this hunt, CISA proactively searched for evidence of malicious activity or the presence of a malicious cyber actor on the customer’s network using host, network, industrial control system (ICS), and commercial cloud and open-source analysis tools. CISA searched for evidence of activity by looking for specific exploitation tactics, techniques, and procedures (TTPs) and associated artifacts.

    While CISA did not find evidence of threat actor presence on the organization’s network, the team did identify several cybersecurity risks. These findings are listed below in order of risk. Technical details of each identified cyber risk are included, along with the potential impact from threat actor exploitation of each risk (recommendations for mitigating each risk are listed in the Mitigations section below).

    Several of these findings align with those observed during similar engagements conducted by US Coast Guard Cyber Command (CGCYBER), which are documented in their 2024 Cyber Trends and Insights in the Marine Environment (CTIME) report. The authoring agencies encourage critical infrastructure organizations to review the CTIME report to understand trends in the techniques/attack paths threat actors are using to compromise at-risk organizations, and what mitigations organizations should implement to prevent a successful attack.

    Key Findings

    Shared Local Admin Accounts with Non-Unique Passwords Stored as Plaintext

    Details: CISA identified a few local admin accounts with non-unique passwords; these accounts were shared across many hosts. The credentials for each account were stored plaintext in batch scripts. CISA discovered these authorized scripts were configured to create user accounts with local admin privileges and then set identical, non-expiring passwords—these passwords were stored in plaintext in the script. One script was configured to create an admin account (set with a password stored in the script in plaintext) and automatically add to the admin group. The account was set as the local admin account on many other hosts.

    Potential Impact: The storage of local admin credentials in plaintext scripts across numerous hosts increases the risk of widespread unauthorized access, and the usage of non-unique passwords facilitates lateral movement throughout the network. Malicious actors with access to workstations with either of these batch scripts could obtain the passwords for these local admin accounts by searching the filesystem for strings like net user /add, identifying scripts containing usernames and passwords [T1552.001], and accessing these accounts to move laterally.

    For example, during a controlled security validation exercise (with explicit permission from the customer), CISA used the credentials found in one of the scripts to log into its associated admin account locally on a workstation [T1078.003], and then establish a Remote Desktop Protocol (RDP) connection to another workstation [T1021.001]. This demonstrated that the credentials allowed local login to an admin account and enabled lateral movement to any workstation with the account. While using this account, the user had local admin privileges on many workstations. Upon initiating the RDP session, the system issued out a notification that another user was currently logged in and that continuing the session would disconnect the existing user, confirming that the account can be accessed remotely via RDP.

    The uniform use of local admin accounts with identical, non-expiring passwords across numerous hosts, coupled with the storage of these credentials in plaintext within accessible scripts, elevates the risk of unauthorized access and lateral movement throughout the network.

    With local admin access, malicious cyber actors can:

    • Modify existing accounts or create new accounts [T1098], potentially escalating privileges or maintaining persistent access.
    • Install malicious browser extensions on compromised systems [T1112].
    • Communicate with compromised systems using standard application layer protocols [T1071], which may bypass certain security monitoring tools.
    • Modify local policies to escalate privileges or disable security features [T1484].
    • Alter system configurations or install software that executes at startup [T1547], ensuring continued access and persistence.
    • Hijack the execution flow of applications to inject malicious code [T1574].

    The widespread distribution of plaintext credentials and the use of identical passwords across hosts increases the risk of unauthorized access throughout the network. This vulnerability heightens the potential for attackers to conduct unauthorized activities, which may impact the confidentiality, integrity, and availability of the organization’s assets.

    Note: This finding was associated with workstations only; servers and other devices were not affected.

    Insufficient Network Segmentation Configuration Between IT and Operational Technology Environments

    Details: While assessing interconnectivity between the customer’s IT and operational technology (OT) environments, CISA identified that the OT environment was not properly configured. Specifically, standard user accounts could directly access the supervisory control and data acquisition (SCADA) virtual local area network (VLAN) directly from IT hosts.

    First, CISA determined it was possible to establish a connection via port 21 from a user workstation in the IT network to a system within the SCADA VLAN. The test established that a network path was available, the remote host was reachable, the port was open and listening for connections, and that the port was directly accessible between the IT and SCADA VLANs, with misconfigured network-level restrictions—for example, firewalls or access control lists (ACLs)—blocking the Transmission Control Protocol (TCP) connection on the port. This test was conducted using a standard user account on a regular IT workstation without administrative privileges [T1078].

    Second, CISA discovered that the customer did not have sufficient secured bastion hosts dedicated for accessing SCADA and heating, ventilation, and air conditioning (HVAC) systems. A bastion host­—sometimes referred to as a jump box or jump server—is a specialized, highly secured system (often a server or dedicated workstation) that serves as the sole access point between a network segment (such as an internal IT network) and a protected internal network (like an OT or ICS environment). By inspecting and filtering all inbound and outbound traffic, a bastion host is designed to prevent unauthorized access and lateral movement, ensuring that only authenticated and authorized users can interact with internal systems. Though several hosts were designated as bastion hosts for remote access to SCADA and HVAC systems, they lacked the enhanced security configuration, dedicated monitoring, and specialized scrutiny expected of bastion hosts.

    Potential Impact: Insufficient OT network segmentation configuration, network access control (NAC), and the ability of a non-privileged user within the IT network to use their credentials to access the critical SCADA VLAN [T1078] presents a security and safety risk. Given that SCADA and HVAC systems control physical processes, compromises of these systems can have real-world consequences, including risks to personnel safety, infrastructure integrity, and equipment functionality.

    Malicious actors could further exploit potentially unsecured workstations with access to OT systems, and insufficient network segmentation configuration between IT and OT systems, in the following ways:

    • Use RDP or Secure Shell (SSH) protocols to move laterally from compromised IT workstations to OT systems [T1021.001] [T1021.004].
    • Execute commands and scripts using scripting languages like PowerShell to attack OT systems [T1059].
    • Map network connections to identify paths to OT systems [T1049].
    • Gather information about network configurations to plan attacks on OT systems [T1016].

    By exploiting these weaknesses, attackers can potentially gain unauthorized access to critical OT systems, manipulate physical processes, disrupt operations, and cause harm.

    Insufficient Log Retention and Implementation

    Details: CISA was unable to hunt for every MITRE ATT&CK® procedure in the scoped hunt plan partly because the organization’s event logging system was insufficient for this analysis. For example, Windows event logs from workstations were not being forwarded to the organization’s security information event management (SIEM), verbose command line auditing was not enabled (meaning command line arguments were not being captured in Event ID 4688), logging in the SIEM was not as comprehensive as required for the analysis, and log retention did not allow for a thorough analysis of historical activity.

    Potential Impact: The absence of comprehensive and detailed logs, along with a lack of an established baseline for normal network behavior, prevented CISA from performing thorough behavior and anomaly-based detection. This limitation hindered the ability to hunt for certain TTPs, such as living-off-the-land techniques, the use of valid accounts [T1078], and other TTPs used by sophisticated threat actors. Such techniques often do not produce discrete indicators of compromise or trigger alerts from antivirus software, intrusion detection systems (IDS), or endpoint detection and response (EDR) solutions. Further, the lack of workstation logs in the organization’s SIEM meant CISA could not analyze authentication events to identify anomalous activities, such as unauthorized access using local administrator credentials. This gap exposes networks to undetected lateral movement and unauthorized access.

    Insufficient logging can prevent the detection of malicious activity by hindering investigations, which makes detection of threat actors more challenging and leaves the network susceptible to undetected threats.

    Additional Findings

    Misconfigured sslFlags on a Production Server

    Details: CISA used PowerShell to examine the ApplicationHost.config file[1]—a central configuration file for Internet Information Services (IIS) that governs the behavior of the web server and its applications and websites—on a production IIS server. CISA observed an HTTPS binding configured with sslFlags==“0”, which keeps IIS in its legacy “one-certificate-per-IP” mode. This mode disables modern certificate-management features, and because mutual Transport Layer Security (TLS) (client-certificate authentication) must be enabled separately in “SSL Settings” or by adding , the binding leaves the client-certificate enforcement off by default, allowing any TLS client to complete the handshake anonymously. Moreover, sslFlags does not control protocol or cipher selection, so outdated protocols or weak cipher suites (e.g., SSL 3.0, TLS 1.0/1.1) may still be accepted unless Secure Channel (Schannel)[2] has been explicitly hardened.

    Potential Impact: The misconfigured sslFlags could enable threat actors to attempt an adversary-in-the-middle attack [T1557] to intercept credentials and data transmitted between clients and the IIS server. Malicious actors could also exploit vulnerabilities in older Secure Sockets Layer (SSL)/TLS protocols, as well as weak cipher suites, increasing the risk for protocol downgrade attacks in which an attacker forces the server and client to negotiate the use of weaker encryption standards [T1562.010]. This compromises the confidentiality and integrity of data transmitted over this channel. Furthermore, the absence of client certificate enforcement meant the server did not validate the identity of the connecting clients beyond the basic SSL/TLS handshake. This deficiency exposed the server to risks where unauthorized or malicious clients could impersonate legitimate users, potentially gaining access to sensitive resources without proper verification.

    Misconfigured Structured Query Language Connections on a Production Server

    Details: CISA reviewed machine.config file on a production server and identified that it was configured with a centralized database connection string, LocalSqlServer, for both profile and role providers. This configuration implies that, unless overridden in each application’s web.config files, every ASP.NET site on the server connects to the same Structured Query Language (SQL) Express or aspnetdb database and shares the same credentials context.

    Additionally, CISA identified that the machine.config file set the minRequiredPasswordLength to be less than 15 characters, which is CISA’s recommended password length.

    Potential Impact: Using a centralized database approach increases risk, as a single breach or misconfiguration in this central SQL database server can compromise all applications dependent on the server. This creates a single point of failure and could be exploited by attackers aiming to gain broad access to the system.

    Additionally, setting the minimum password length to any password under 15 characters is more vulnerable to various forms of brute-force attacks, such as password guessing [T1110.001], cracking [T1110.002], spraying [T1110.003], and credential stuffing [T1110.004]. If a threat actor successfully cracked these weak passwords, they could gain unauthorized access to user or application accounts and leverage vulnerabilities within applications to further escalate privileges, potentially leading to unauthorized access to the backend SQL Server databases. This could result in data breaches, data manipulation, or a loss of database integrity.

    Mitigations

    CISA and USCG recommend that critical infrastructure organizations implement the mitigations below to improve their organization’s cybersecurity posture. Recommendations to reduce cyber risk are listed for each of CISA’s findings during this engagement and are ordered starting from the highest to lowest importance for organizations to implement. CISA and USCG also include general practices to strengthen cybersecurity for OT environments that are not tied to specific findings.

    These mitigations align with the Cross-Sector Cybersecurity Performance Goals jointly developed by CISA and the National Institute for Standards and Technology (NIST). The Cybersecurity Performance Goals (CPGs) provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful TTPs. Visit CISA’s CPGs webpage for more information.

    Many of these mitigations also align with recommendations made by CGCYBER in their 2024 CTIME report. The report provides relevant information and lessons learned about cybersecurity risks gathered through operations similar to this threat hunt engagement, and best practices to mitigate these risks. Please see the 2024 CTIME report for additional recommendations for critical infrastructure organizations to implement to harden their environments against malicious activity.

    Implement Unique Credentials and Access Control Measures for Administrator Accounts

    • Provision unique and complex credentials for local administrator accounts [CPG 2.C] on all systems. Do not use shared or identical administrative credentials across systems. Ensure service accounts/machine accounts have passwords unique from all member user accounts.
      • For example, organizations can deploy Microsoft LAPS (see Microsoft Learn’s Windows LAPS Overview for more information) to ensure each machine has a unique, complex local administrator password; passwords are rotated automatically within Microsoft Active Directory, reducing the window of vulnerability; and that password retrieval is limited to authorized personnel only.
    • Require phishing-resistant multifactor authentication (MFA) [CPG 2.H] in addition to unique passwords for all administrative access, including local- and domain-level administrator accounts, RDP sessions, and VPN connections.
    • Use privileged access workstations (PAWs) dedicated solely for administrative tasks and isolate them from the internet and general network to reduce exposure to threats and lateral movement.
      • Harden PAWs by applying CIS Benchmarks: limit software to essential administrative functions, disable unnecessary services and ports, and ensure regular updates and patches.
      • Enforce strict access controls to restrict PAW access to authorized administrators only.
    • Conduct continuous auditing of privileged accounts by regularly collecting and analyzing logs of administrative activities, such as login attempts, command executions, and configuration changes [CPG 2.T].
      • Configure automated alerts for anomalous behaviors, including logins outside standard hours, access from unauthorized locations, and repeated failed logins.
      • Periodically review all administrator accounts to confirm the necessity and appropriateness of access levels; align these auditing practices with NIST SP 800-53 Rev. 5 Controls AU-2 (Auditable Events) and AU-12 (Audit Record Generation).
    • Apply the principle of least privilege by limiting administrative privileges to the minimum required for users to perform their roles [CPG 2.E].
      • Create individual administrative accounts with unique credentials and role-specific permissions and disable or rename built-in local administrator accounts to reduce common attack vectors.
      • Avoid using shared administrator accounts to improve accountability and auditability, and ensure administrators use standard accounts for non-administrative tasks to minimize credential exposure.
      • Implement Role-Based Access Control (RBAC) to assign permissions based on job functions, as aligned with NIST SP 800-53 Rev. 5 Control AC-5 (Separation of Duties).
    • Identify and remove unauthorized or unnecessary local administrator accounts, maintain oversight by documenting and tracking all authorized accounts, and enforce strict account management policies by restricting account creation privileges and implementing approval workflows for new administrator accounts.

    Securely Store and Manage Credentials

    • Purge credentials from the System Center Configuration Manager (SCCM). Review SCCM packages, task sequences, and scripts to ensure that no plaintext credentials are embedded, and update or remove any configurations that deploy scripts with plaintext credentials.
    • Do not store plaintext credentials in scripts. Instead, store credentials in a secure manner, such as with a credential/password manager or vault, or other privileged account management solution [CPG 2.L].
    • Use encrypted communication. If scripts must retrieve credentials at runtime, use encrypted channels and protocols (e.g., TLS 1.3) to communicate with secure credential stores. Ensure that credentials are not written to disk or exposed in logs.
    • Use unique local administrator passwords, such as by deploying Microsoft LAPS. Set appropriate permissions on Active Directory attributes used by LAPS (ms-MCS-AdmPwd and ms-MCS-AdmPwdExpirationTime) per Microsoft’s security recommendations.

    Establish Network Segmentation Between IT and OT Environments

    • Assess the existing network architecture to ensure effective segmentation between the IT and OT networks [CPG 2.F]—this process should evaluate both logical and physical segmentation, ensuring clear boundaries between IT and OT assets.
      • Use NIST SP 800-82 Rev. 3 (Guide to OT Security) and International Electrotechnical Commission (IEC) 62443 standards as guides for network segmentation best practices.
      • Network segmentation is essential for containing breaches within isolated segments and preventing them from spreading across networks. Depending on your environment, consider implementing the following segmentation:
        • Implement VLAN segmentation with inter-VLAN access controls.
        • Create separate VLANs for IT and OT systems, specifically isolating OT components such as SCADA systems from IT network VLANs.
        • Configure inter-VLAN access controls, including Layer 3 ACLs, to restrict traffic between IT and SCADA VLANs.
        • Deploy firewalls with application-layer filtering capabilities to monitor and control data flow between the VLANs, ensuring that only authorized protocols and devices can communicate across segments.
    • Implement a demilitarized zone (DMZ) between IT and OT environments to provide an additional security layer.
      • Position firewalls at both the IT-DMZ and OT-DMZ boundaries to filter traffic and enforce strict communication policies.
      • Configure the DMZ to act as an intermediary, with only essential communications permitted between IT and OT networks.
      • Ensure the DMZ hosts shared services (e.g., bastion hosts, jump servers, or data historians) that require limited interaction with both environments, with access controls and monitoring in place.
    • Consider a full network re-architecture if current segmentation methods cannot effectively separate IT and OT networks.
      • Collaborate with cybersecurity and network experts to design an architecture that meets ICS-specific security requirements—this redesign may involve transitioning to a micro-segmented or zero trust architecture, which includes strict identity verification for all users and devices attempting to access OT assets.[3]
    • Implement unidirectional gateways (data diodes) where appropriate to prevent bidirectional communication.
    • Keep network diagrams, configuration files, and asset inventories up to date.
    • Regularly test segmentation controls to validate their effectiveness in restricting unauthorized access by conducting penetration testing and security assessments.
      • Include simulated breach scenarios to confirm that segmentation contains threats within isolated zones.
      • Ensure compliance with NIST SP 800-53 Rev. 5 Control AC-4 (Information Flow Enforcement) to align segmentation measures with best practices for controlled information flow.

    Prevent Unauthorized Access via Port 21

    • Disable File Transfer Protocol (FTP) services on SCADA devices and servers if they are not required. Replace FTP with secure alternatives, such as SSH FTP (SFTP) or FTP over TLS/SSL (FTPS).
    • Block inbound and outbound FTP traffic on port 21 using firewalls and ACLs.
      • Implement restrictive ACL policies at network boundaries to control FTP access across all network layers.
      • As outlined in CIS Control 9.2 (Limit Unnecessary Ports, Protocols, and Services), close any unused ports to strengthen network defenses.
    • Implement IDS/Intrusion Prevention System (IPS) technologies to monitor traffic between the IT network and SCADA VLAN, use signature and anomaly detection, and integrate IDS/IPS with a SIEM system for centralized monitoring.
    • Enhance authentication and encryption mechanisms. Require MFA for SCADA access, use secure remote access technologies when necessary, securely encrypt communications (using protocols such as TLS 1.2 or higher, preferably TLS 1.3), and establish VPN tunnels to communicate between IT networks and SCADA systems.
    • Perform network traffic filtering and deep packet inspection.
      • Use SCADA-aware firewalls capable of understanding SCADA protocols and inspecting and filtering traffic at the application layer.
      • Only allowlist authorized protocols and command structures to SCADA operations. Use one-way communication devices to prevent data from flowing back into the SCADA network.

    Establish Secure Bastion Hosts for OT Network Access

    • Ensure bastion hosts are dedicated secure access points exclusively used to access the OT network and deployed as exclusive management gateways for all devices within a network.
      • Make bastion hosts the single access points for conducting all administrative tasks, system management, and configuration changes; this centralizes access control and ensures any interaction with the OT system passes through a rigorously monitored and secure environment, minimizing the potential for unauthorized access.
    • Do not allow staff to use bastion hosts as regular workstations.
      • Provide staff with separate workstations for accessing email, internet browsing, etc., on the IT network.
      • Establish and enforce policies that prohibit non-administrative activities on bastion hosts, ensuring they remain dedicated to OT network access.
    • Regularly audit and monitor bastion hosts to maintain security integrity, prevent unauthorized use, and quickly address any vulnerabilities or policy non-compliance.
    • Configure comprehensive logging of all activities on bastion hosts, including authentication attempts, command executions, configuration changes, and file transfers. Aggregate logs into a SIEM.
    • Isolate bastion hosts from the IT network; bastion hosts should reside in a separate security zone with restricted communication pathways (see CISA’s infographic on Layering Network Security Through Segmentation).
      • Deploy bastion hosts in a DMZ, imposing physical and logical isolation from other networks.
      • Configure firewalls between the IT network, bastion hosts, and the OT network, enforcing strict access control policies to allow only necessary traffic.
    • Ensure secure configuration and hardening of bastion hosts: Comply with NIST SP 800-123 and CIS Benchmarks and CNSSI 4009-2015, remove nonessential applications and services to reduce the attack surface, configure system settings to be secure, conduct effective patch management, enforce the principle of least functionality, and disable unused ports and protocols.
    • Implement access control policies: remove any access permissions to the OT network from IT workstations and ensure only bastion hosts have access to the OT network.
      • Implement NAC solutions to enforce policy-driven access control decisions based on device compliance and user authentication to provide dynamic access control and real-time visibility into the devices on the network.
    • Equip each bastion host with robust authentication mechanisms, including phishing resistant MFA [CPG 2.H], to verify the identity of users accessing the network.
      • Align with AAL3 as defined in NIST SP 800-63B. AAL3 requires hardware-based authenticators and proof of possession of cryptographic keys through secure authentication protocols.
    • Implement stringent access controls that restrict access to authorized personnel only using RBAC principles, ensuring that personnel can only access information and perform tasks pertinent to their roles and duties. This reduces the risk of internal threats or lateral movement and prevents unauthorized access.
    • Securely configure remote access tools, including by using secure protocols and disabling remote access tools on IT workstations to the OT network, enforcing that all remote access occurs through bastion hosts.
      • Disable insecure protocols like Telnet and unencrypted VNC to prevent interception and unauthorized access.
      • Log all remote access sessions and monitor for unauthorized or anomalous activities.

    Implement Comprehensive Logging, Log Retention, and Analysis

    • Implement comprehensive and verbose (i.e., detailed) logging across all systems, including workstations, servers, network devices, and security appliances [CPG 2.T].
      • Enable logging of critical events such as authentication attempts, command-line executions with command arguments (Event ID 4688), and network connections.
    • Aggregate logs in an out-of-band, centralized location [CPG 2.U] where adversaries cannot tamper with them, such as a dedicated SIEM, in order to facilitate behavior analytics, anomaly detection, and proactive threat hunting [CPG 2.T, 2.U]. For more information on behavior- and anomaly-based detection techniques, see joint guidance Identifying and Mitigating Living off the Land.
    • Ensure comprehensive logging on bastion hosts for all activities. Capture detailed records of login attempts [CPG 2.G], commands executed (with command arguments enabled), configurations changed, and files transferred.
    • Continuously monitor logs for early detection of anomalous activities. Configure the SIEM to generate automatic alerts for suspicious activity and implement behavior analysis techniques to detect anomalies.
    • Securely store log backups and use tamper resistant storage [CPG 2.U] to prevent a threat actor from altering or purging logs to conceal malicious activity.

    For additional guidance on logging, see joint guidance Best Practices for Event Logging and Threat Detection.

    Securely Configure HTTPS Bindings and LocalSqlServer Connection String

    • Enforce both client certificate verification and secure renegotiation in IIS by configuring the sslFlags setting to “3” in the ApplicationHost.config file. Setting sslFlags=“3” requires clients to present valid X.509 certificates for authentication and implements the TLS Renegotiation Indication Extension (RFC 5746). To implement this, perform the following steps:
      • Locate the element for the HTTPS site within ApplicationHost.config.
      • Set the sslFlags attribute to “3”: .
      • Restart IIS to apply the changes: iisreset.
    • Restrict the server to use only secure and up-to-date SSL/TLS protocols and cipher suites.
      • Disable deprecated protocols like SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 to prevent protocol downgrade attacks that compromise the confidentiality and integrity of data.
    • Override the global settings in machine.config by modifying each application’s web.config file to define its own connection strings and providers. This isolates applications at the database level and allows for tailored security configurations for each application.
    • Create dedicated SQL Server database accounts for each application with permissions limited to necessary operations (e.g., SELECT, INSERT, UPDATE), and avoid granting excessive privileges.
      • Do not assign roles like db_owner or sysadmin to application accounts. This reduces the risk of privilege escalation and enhances accountability through segregated access logs.
    • Use machine.config only for configurations that must be applied globally across all applications on the server.
      • Audit the machine.config file to ensure no application-specific settings are present.

    Enforce Strong Password Policies

    • Implement a system-enforced policy that requires a minimum password length of 15 or more characters for all password-protected IT assets and all OT assets, when technically feasible [CPG 2.B].
      • Consider leveraging passphrases and password managers to make it easier for users to maintain sufficiently long passwords.
    • In instances where minimum password lengths are not technically feasible, apply and record compensating controls, such as rate-limiting login attempts, account lockout thresholds, and strong network segmentation. Prioritize these systems for upgrade or replacement.
    • Implement MFA [CPG 2.H] in addition to strong passwords (i.e., passwords 15 characters or longer).

    Additional Mitigation Recommendations to Strengthen Cybersecurity

    CISA and USCG recommend critical infrastructure organizations implement the following additional mitigations (not tied to specific findings from the engagement) to improve the cybersecurity of their IT and OT environments:

    • Secure RDP from the IT to OT environments by deploying dedicated VPNs for all remote interactions with the OT network. Using RDP without strong authentication practices can lead to credential theft. Additionally, RDP does not inherently segregate or closely monitor user sessions, which can allow a compromised session to affect other parts of the network.
      • Deploy VPNs with strong encryption protocols such as SSL/TLS or Internet Protocol Security (IPsec) [CPG 2.K] to safeguard data integrity and confidentiality; use MFA [CPG 2.H] at all VPN access points to ensure only authorized personnel can gain access.
      • Configure VPN gateways to perform rigorous security checks and manage traffic destined for the OT network, ensuring comprehensive validation of all communications through pre-defined security policies.
        • VPN gateways should function as the primary enforcement points for access controls, scrutinizing every data packet to detect and block unauthorized access attempts.
      • Align the VPN traffic monitoring with the DMZ’s capabilities to regulate and inspect the data flow between IT and OT environments.
      • As part of the broader network architecture review, ensure the VPN infrastructure is correctly segmented from other network resources [CPG 2.F] to prevent any spillover effects from the IT environment to the OT network, containing potential breaches within isolated network zones.
      • Within the VPN configuration, enforce strict routing rules that require all remote access requests to pass through the DMZ and be authenticated by bastion hosts. This minimizes the risk of unauthorized access and ensures that all remote interactions with the OT network are monitored and controlled.
    • If wireless technology is employed within the OT environment, implement Wi-fi Protected Access 3 (WPA3)-Enterprise encryption with strong authentication protocols like Extensible Authentication Protocol (EAP)-TLS to ensure data confidentiality and integrity.
      • Deploy and continuously monitor Wireless Intrusion Prevention Systems (WIPS) to detect, prevent, and respond to unauthorized access attempts and anomalous activities within the wireless network infrastructure.
      • Disable unnecessary features like Service Set Identifier (SSID) broadcasting and peer-to-peer networking, enable Media Access Control (MAC) filtering as an additional layer, and keep wireless firmware updated.

    Validate Security Controls

    In addition to applying mitigations, CISA and USCG recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. CISA and USCG recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.

    To get started:

    1. Select an ATT&CK technique described in this advisory (see Table 1 to Table 9).
    2. Align your security technologies against the technique.
    3. Test your technologies against the technique.
    4. Analyze your detection and prevention technologies’ performance.
    5. Repeat the process for all security technologies to obtain a set of comprehensive performance data.
    6. Tune your security program—including people, processes, and technologies—based on the data generated by this process.

    CISA and USCG recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

    Contact Information

    Critical infrastructure organizations are encouraged to report suspicious or criminal activity related to information in this advisory to:

    Additional Resources

    For more information on improving cyber hygiene for critical infrastructure IT and OT environments, please see the following additional resources authored by CISA, CGCYBER, and international partners:

    Disclaimer

    The information in this report is being provided “as is” for informational purposes only. CISA and USCG do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA and USCG.

    Version History

    July 31, 2025: Initial version.

    Appendix: MITRE ATT&CK Tactics and Techniques

    See Table 1 to Table 9 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

    Table 1: Initial Access
    Technique Title ID Use
    Valid Accounts T1078 Malicious actors could use access to valid accounts for access to IT and OT networks.
    Valid Accounts: Local Accounts T1078.003 Threat actors could use credentials obtained for local administrator accounts to gain administrator access to workstations or services that use the account.
    Account Manipulation T1098 Malicious actors could modify existing accounts or create new accounts to maintain access or escalate privileges. 
    Table 2: Execution
    Technique Title ID Use
    Command and Scripting Interpreter  T1059 Malicious actors could use script interpreters like PowerShell to execute commands and scripts. 
    Table 3: Persistence
    Technique Title ID Use
    Boot or Autostart Execution T1547 Malicious actors could configure autostart execution paths to ensure persistence.
    Hijack Execution Flow T1574 Malicious actors could hijack the execution flow of applications and inject malicious code.
    Table 4: Privilege Escalation
    Technique Title ID Use
    Domain or Tenant Policy Modification T1484 Malicious actors could modify domain policies to escalate privileges or evade defenses.
    Table 5: Defense Evasion
    Technique Title ID Use
    Modify Registry T1112 Malicious actors could install malicious browser extensions on compromised systems.
    Impair Defenses: Downgrade Attack T1562.010 Malicious actors could exploit vulnerabilities in older systems to force a downgrade to a less secure mode of operation.
    Table 6: Credential Access
    Technique Title ID Use
    Unsecured Credentials: Credentials in Files T1552.001 Malicious actors could search for and exploit credentials stored in unsecured files. 
    OS Credential Dumping T1003 Malicious actors could extract credentials from memory or storage from unsecured workstations.
    Adversary-in-the-Middle T1557 Malicious actors could position themselves between networked devices to intercept credentials and other data. 
    Brute Force: Password Guessing T1110.001 Malicious actors could systematically guess possible passwords.
    Brute Force: Password Cracking T1110.002 Malicious actors could recover plaintext credentials after obtaining password hashes or other similar credential material.
    Brute Force: Password Spraying T1110.003 Malicious actors could attempt to use a common password against different accounts to try to obtain account access. 
    Brute Force: Credential Stuffing T1110.004 Malicious actors could try to use credentials gained from an unrelated account to gain access to a desired account in the victim’s environment. 
    Table 7: Discovery
    Technique Title ID Use
    System Network Connections Discovery T1049 Malicious actors could map network connections to identify paths to OT systems from an unsecured IT workstation with access to the OT network. 
    System Network Configuration Discovery T1016 Malicious actors could use an unsecured workstation to discover network configurations.
    Table 8: Lateral Movement
    Technique Title ID Use
    Remote Services: Remote Desktop Protocol T1021.001 Malicious actors could use valid credentials to establish an RDP connection to access a workstation. 
    Remote Services: SSH T1021.004 Malicious actors could use valid accounts to establish an SSH connection to a workstation.
    Table 9: Command and Control
    Technique Title ID Use
    Application Layer Protocol T1071 Malicious actors could use application layer protocols to communicate with systems they compromised while blending in with existing network traffic. 

    MIL Security OSI

  • MIL-OSI Africa: Justice Mlambo appointed Deputy Chief Justice of SA

    Source: Government of South Africa

    Thursday, July 31, 2025

    President Cyril Ramaphosa has appointed Justice Dunstan Mlambo as Deputy Chief Justice of the Republic of South Africa, with effect from Friday, 1 August 2025.

    The appointment is with accordance with section 174(3) of the Constitution.

    “Judge Mlambo has since November 2012 served as Judge President of the Gauteng Division of the High Court of South Africa. 
    “President Ramaphosa has in writing informed Chief Justice Mandisa Maya that in appointing Justice Mlambo, the President has considered the views of the Judicial Service Commission (JSC) and the views of political parties represented in the National Assembly,” the Presidency said in statement on Thursday night.

    The President also expressed to the Chief Justice his appreciation for the transparent, inclusive and robust process undertaken by the JSC. 

    “This process exemplified the Commission’s commitment to upholding the nation’s constitutional values,” said the Presidency.

    The Presidency added that the Commission had enhanced the nation’s confidence that the appointment of the Deputy Chief Justice was firmly grounded on merit, fidelity to the Constitution and a vision for the continued transformation and strengthening of the Judiciary.

    “President Ramaphosa similarly thanks the incoming Deputy Chief Justice Mlambo for stepping forward to assume a new responsibility of critical national importance, and wishes Justice Mlambo well in strengthening the rule of law, enriching jurisprudence and asserting the rights of all citizens.”

    The position of Deputy Chief Justice had been vacant since then Deputy Chief Justice, Mandisa Maya, became Chief Justice following the retirement of Chief Justice Raymond Zondo last year.

    Earlier this month, the JSC announced that it would recommend Justice Mlambo for the position of Deputy Chief Justice.

    READ | Judge President Mlambo recommended for Deputy Chief Justice

    This as interviews for the position were held.

    In April this year, President Ramaphosa nominated four candidates for the position including Justice Mlambo. –SAnews.gov.za

    MIL OSI Africa

  • MIL-OSI Asia-Pac: Hong Kong Science Museum’s new exhibition to showcase country’s achievements in aerospace, aviation and navigation (with photos)

    Source: Hong Kong Government special administrative region – 4

         Jointly presented by the Hong Kong Special Administrative Region Government and the China National Space Administration (CNSA), the “Bank of China (Hong Kong) Presents: National Development and Achievements Series – Endless Exploration: The Journey of Chinese Aerospace, Aviation and Navigation” exhibition will be launched at the Hong Kong Science Museum (HKScM) from tomorrow (August 1) to September 7. This is the first time for Hong Kong to showcase the country’s achievements in these three major arenas in the same exhibition. Featuring a rich array of artefacts, models, graphics, videos and interactive exhibits, the exhibition not only presents important developments in relevant fields, but also aims to inspire the public, especially youngsters, with a passion for technological innovation while enhancing national confidence in science and technology.
     
         Addressing the opening ceremony today (July 31), the Chief Secretary for Administration, Mr Chan Kwok-ki, said that the Chang’e-6’s successful return to earth bringing lunar soil samples from the far side of the Moon last year represents a global first, underscoring China’s leading position in lunar exploration. Hong Kong is proactively integrating into national development matters and making significant contributions, with local scientists having the opportunity to participate in major national scientific research projects. These achievements affirm Hong Kong’s unique advantages in contributing to national development with an international vision. He further said that this exhibition showcases the remarkable achievements of the Chang’e lunar exploration programme as well as the country’s remarkable accomplishments in aerospace, aviation and navigation. It also highlights Hong Kong’s role as a cultural hub connecting China with the world, telling the good story of China and promoting patriotism to the public.

         Other officiating guests today included the Chief Engineer of the CNSA, Dr Li Guoping; the First-level Inspector of the Department of Educational, Scientific and Technological Affairs of the Liaison Office of the Central People’s Government in the Hong Kong Special Administrative Region, Mr Liu Maozhou; the Vice Chairman and Chief Executive of Bank of China (Hong Kong) Limited, Mr Sun Yu; the Under Secretary for Culture, Sports and Tourism, Mr Raistlin Lau; the Convenor of the Working Group on Patriotic Education under the Constitution and Basic Law Promotion Steering Committee, Legislative Council Member, Dr Starry Lee; the Chairperson of the Science Sub-committee of the Museum Advisory Committee, Professor Alexander Wai; the Director of Leisure and Cultural Services, Ms Manda Chan; and the Museum Director of the HKScM, Mr Patrick Lau.
     
         This exhibition achieves several “firsts”, including the first concurrent display in Hong Kong of lunar soil samples collected from the far side and near side of the Moon by the Chang’e-6 and the Chang’e-5 respectively. Other exhibits debuting in Hong Kong include the Chang’e-6 returner and parachute, seawater samples collected from 10,000 metres under the sea, as well as models of the “three pearls” of the shipbuilding industry, namely an aircraft carrier, a luxury cruise ship and a liquefied natural gas carrier.
     
    Moreover, the HKScM will display large-scale aerospace, aviation and maritime models concurrently, including an approximately 12m-tall 1:5 Long March-5 launch vehicle and a full-size Fendouzhe full-ocean-depth manned submersible with a length of approximately 10m displayed outdoors, as well as a 1:8 model of a Y-20 heavy lifter with a wingspan of approximately 6m displayed indoors for the first time.
     
         Apart from the exhibits from the Mainland, the exhibition also presents Hong Kong’s significant contributions to the space and deep-sea exploration projects of the country. There are also interactive exhibits, namely the “Lunar Base”, the “Zhurong Rover Expedition” and more, for visitors to experience the challenges of building a lunar base and exploring Mars.
     
    Fixed-point guided tours will be provided on Saturdays and Sundays from August 9 to September 7. A series of lectures will be conducted on August 1 and August 4 by experts invited from the Mainland, who will share their knowledge of aviation, aerospace and navigation, as well as the achievements and future plans of the country in related fields. Members of the public are welcome to participate in the tours and lectures on-site. Other activities include experiment classes, workshops and demonstrations for the public to explore the scientific principles behind aviation and deep-sea navigation.
       
         The exhibition is jointly organised by the Leisure and Cultural Services Department and the News Center of the CNSA, as solely sponsored by the Bank of China (Hong Kong) Limited. It is one of the activities of the Chinese Culture Promotion Series. For details of the exhibition and activities, please visit the HKScM website at hk.science.museum/en/web/scm/exhibition/exploration2025.html.

    MIL OSI Asia Pacific News

  • MIL-OSI Security: Drug Trafficker Sentenced to More Than 15 Years for Trafficking Methamphetamine

    Source: US FBI

    Jacksonville, Florida – U.S. District Judge Wendy W. Berger has sentenced Kevin Ray Marcano (37, Cambridge, MA) to 15 years and 8 months in federal prison for conspiracy to distribute controlled substances, specifically 500 grams or more of a mixture and substance containing methamphetamine. Marcano pleaded guilty on April 22, 2025. 

    According to court documents, in March 2022, Marcano began supplying methamphetamine across the country by shipping multi-pound packages to known customers, including an individual in Jacksonville. From March 2022 to July 2023, Marcano sent approximately 5 packages each containing about 10 pounds of methamphetamine to the Jacksonville customer. In September 2023, the same individual called Marcano and ordered another shipment of four pounds of methamphetamine in exchange for $4,900. Within five days of placing the order from Marcano, the four-pound shipment of methamphetamine arrived.

    “This criminal was responsible to shipping large quantities of methamphetamine across the country, fueling addiction and poisoning communities far beyond his own,” said Homeland Security Investigations Jacksonville Assistant Special Agent in Charge Tim Hemker. “Thanks to the dedicated efforts of HSI and FBI special agents, this individual’s nationwide narcotics distribution network has been dismantled.”

    This case was investigated by the Federal Bureau of Investigation and Homeland Security Investigations. It was prosecuted by Assistant United States Attorney Kelly S. Milliron. 

    MIL Security OSI

  • MIL-OSI Security: Convicted Felon Pleads Guilty to Gun and Drug Charges

    Source: US FBI

    BUFFALO, N.Y.-U.S. Attorney Michael DiGiacomo announced today that Jeremy Hodge, 39, of Buffalo, NY, pleaded guilty before U.S. District Judge Lawrence J. Vilardo to possession with intent to distribute 40 grams or more of fentanyl and being a felon in possession of a firearm, which carry a mandatory minimum penalty of five years in prison, a maximum of 40 years, and a $5,000,000 fine.

    Assistant U.S. Attorney Jeffrey E. Intravatola, who is handling the case, stated that on April 4, 2025, the FBI executed a search warrant at Hodge’s Ernst Avenue residence, on his vehicle, and person. Law enforcement seized a semi-automatic handgun, ammunition, and drug paraphernalia. Hodge was arrested at the scene. He was previously convicted of felony charges in April 2008 and March 2009, and is legally prohibited from possessing a firearm.

    This case is part of Operation Take Back America, a nationwide initiative that marshals the full resources of the Department of Justice to repel the invasion of illegal immigration, achieve the total elimination of cartels and transnational criminal organizations (TCOs), and protect our communities from the perpetrators of violent crime. Operation Take Back America streamlines efforts and resources from the Department’s Organized Crime Drug Enforcement Task Forces (OCDETFs) and Project Safe Neighborhood (PSN).

    The plea is the result of an investigation by the Federal Bureau of Investigation Safe Streets Task Force, under the direction of Acting Special Agent-in-Charge Mark Grimm.

    Sentencing is scheduled for December 8, 2025, before Judge Vilardo.

    # # # #

     

    MIL Security OSI

  • MIL-OSI Security: FBI Detroit Marks 50th Anniversary of James ‘Jimmy’ Hoffa’s Disappearance with Continued Commitment to Missing Persons Investigations

    Source: US FBI

    DETROIT, MI—Today marks 50 years since the disappearance of James “Jimmy” Hoffa, a case which remains one of the most well-known missing person investigations in FBI history. Regardless of the age of the case, the FBI Detroit Field Office remains committed to following all credible leads and is seeking information to assist in moving this case forward.

    The Hoffa investigation remains active, and our office continues to urge anyone with information to come forward. The FBI investigates missing persons cases where there may be potential federal violations, including kidnapping, organized crime, or other criminal acts.

    “As the 50th anniversary of Mr. Hoffa’s disappearance approaches, the FBI Detroit Field Office remains steadfast in its commitment to pursuing all credible leads,” said Cheyvoryea Gibson, special agent in charge of the FBI Detroit Field Office.

    The FBI routinely provides support to local, state, and federal law enforcement partners who handle missing persons cases. We provide forensic analysis, investigative coordination, intelligence sharing, and victim services support.

    The FBI Detroit Field Office extends its appreciation to the community and other partners across the nation for their ongoing cooperation and shared commitment to this investigation, as well as the equally important missing person cases, in locating missing individuals and supporting families affected.

    Anyone with information related to the Jimmy Hoffa case, or any other missing persons investigation is encouraged to contact the FBI at 1-800-CALL-FBI or submit a tip online at tips.fbi.gov.

    MIL Security OSI

  • MIL-OSI USA: Rep. Dan Goldman’s Bipartisan Legislation Supporting Families of Fallen Law Enforcement Officers Passes Senate

    Source: US Congressman Dan Goldman (NY-10)

    Senate Adoption Tees Up Final Passage by the House in the Fall 

    ‘Chief Herbert D. Proffitt Act’ Ensures Those Who Give the Ultimate Sacrifice Are Not Unjustly Denied Benefits 

    Read the Bill Here 

    Washington, D.C. – Congressman Dan Goldman (NY-10) today celebrated the Senate’s passage of his bipartisan ‘Chief Herbert D. Proffitt Act,’ which would ensure the families of law enforcement officers who are killed as a result of their work on behalf of their communities are not unjustly denied benefits due to arbitrary retirement status restrictions. Under current law, families of officers who have retired but are later targeted and killed because of their past service are denied death benefits under the Public Safety Officers’ (PSOB) program. The unanimous Senate vote sets the legislation on a glide path to final passage by the House when members come back in session in September. Congressman Goldman introduced the legislation with Congressman Barr (KY-06) in February.  

    “We have an obligation to care for those who pay the ultimate price while serving in the line of duty, even after they have retired,” Congressman Dan Goldman said. “At a time when partisan gridlock is grinding Congress to a halt, I’m encouraged that both parties came together to pass this commonsense legislation honoring our fallen heroes. I urge Republican leadership to bring this bill to the House Floor in September and ensure that any law enforcement officers killed or injured in the line of duty receive the benefits they deserve—regardless of retirement status.” 

    Chief Herbert D. Proffitt dedicated his life to serving others, first as a U.S. Army veteran of the Korean War and then as a law enforcement officer for 55 years before retiring in 2009 as Chief of the Tompkinsville, Kentucky Police Department. On August 28, 2012, Chief Proffitt was tragically shot and killed in his driveway by an individual he had arrested a decade earlier. Although his murder was a direct retaliation for his service in uniform, his family was denied benefits under the PSOB program simply because he had retired. 

    Congressman Dan Goldman has made safeguarding public safety officers and first responders a key priority of his time in office.   

    In the Winter of 2024, Goldman publicly condemned the House Republican’s rejection of the bipartisan budget bill, which would have fully funded the World Trade Center Health Program (WTCHP).  
    In the Summer of 2024, Goldman, alongside other New York lawmakers, introduced a bipartisan, bicameral bill to address any funding gap or shortfall for World Trade Center Health Program. The ‘9/11 Responder and Survivor Health Funding Correction Act of 2024’ intended to secure permanent and mandatory funding for the WTCHP, to prevent any future funding shortfall.   
    In the Fall of 2023, Goldman joined Congressman Bill Pascrell (NJ-09), Senator Amy Klobuchar (D-MN), and Senator Kevin Cramer (R-ND) in introducing the ‘Honoring Our Fallen Heroes Act’ (Honor Act). This legislation would recognize occupational cancer deaths as line-of-duty deaths, and ensure fire fighters, police, and EMS personnel receive benefits under the Public Safety Officers’ Benefits (PSOB) program. 

    ### 

    MIL OSI USA News

  • MIL-OSI USA: VIDEO: Capito Remarks at Markup for FY26 Labor-HHS Funding Bill

    US Senate News:

    Source: United States Senator for West Virginia Shelley Moore Capito

    [embedded content]

    Click here or on the image above to watch Senator Capito’s remarks. 

    WASHINGTON, D.C. — Today, U.S. Senator Shelley Moore Capito (R-W.Va.), Chairman of the Labor, Health and Human Services, and Education Appropriations Subcommittee, delivered remarks at a full Appropriations Committee markup on the FY26 Labor-HHS funding bill.

    Below is the opening statement of Chairman Capito as prepared for delivery:

    “Thank you, Chair Collins and Vice Chair Murray.

    “I applaud your steadfast commitment to returning to regular order, and I hope that our work continues to the Senate floor.

    “As we near the end of these subcommittee markups, I’d like to thank all my fellow committee members for their input.

    “We received 12,548 total member requests for the Labor-H appropriations bill. This bill is always one of the most difficult appropriations bills to negotiate.

    “This is the third year Senator Baldwin and I have been at the helm of the Labor-H Subcommittee, and I’m pleased to once again present a bipartisan bill to the Full Committee.

    “The Labor-H bill allocates limited taxpayer resources to key bipartisan priorities at a lower level than fiscal year 2025.

    “The bill includes a number of bipartisan member priorities such as greater investments in America’s biomedical research, child care, education, mental and rural health, and continued efforts to combat the opioid epidemic.

    “As we work to right-size the federal government, the bill also includes careful, targeted decreases, while ensuring that agencies have appropriate staffing levels to carry out their statutory responsibilities.

    “The bill also maintains long-standing riders and excludes any new controversial riders.

    “I have heard from many West Virginians throughout this process about questions they have regarding funding for programs throughout the state. I am proud that this bill provides critical funding for those worthy initiatives.

    “Our legislation seeks to provide more certainty and support for the work being done in my home state that help improve the lives of so many West Virginians.

    “Our bill provides an increase for the National Institutes of Health to continue prioritizing biomedical research in the United States.

    “This investment includes targeted increases for research in specific areas such as Alzheimer’s, Diabetes, Parkinson’s, women’s health, maternal health, rare diseases, and cancer.

    “We have also maintained funding for NIH’s IDeA program, that provides funding to 23 states that historically had lower levels of NIH funding, including my state of West Virginia.

    “The IDeA state program has been so important for research at West Virginia institutions like WVU and Marshall University.

    “Today’s bill also builds on our efforts to combat substance abuse, which remains a serious problem in West Virginia, by providing funding for addiction treatment, prevention, research, and recovery programs. 

    “This bill also provides resources to support our health workforce, including nurses, geriatric providers, and professionals to respond to the addiction crisis, which will help providers in West Virginia. 

    “The Labor-HHS bill again prioritizes our children starting with early childhood all the way through postsecondary education to make sure our students are prepared for jobs today and in the future.

    “The bill also makes critical investments in our workforce to improve outcomes for workers looking to upskill and advance in their careers.

    “The bill includes funding for apprenticeship grants, including those designed to boost the utility sector workforce, to support the administration’s goal of creating 1 million active apprenticeships.

    “The bill maintains important funding to support workers’ rights and ensure the safety of our workplaces.

    “I’ve just described several bipartisan programs we have included to improve the lives of Americans, and I encourage my colleagues to support this Labor-H bill.

    “I want to briefly thank all the staff that worked to put this product together.

    “On Senator Baldwin’s staff: Mike Gentile, Mark Laisch, Meghan Mott, Kathryn Toomajian, Erin Dugan, Amanda Beaumont, and Janie Dulaney.

    “On my Labor-HHS staff: Emily Slack, Catherine Knowles, Elizabeth Joseph, Heather Wadyka, and Jordan Lawlor.

    “And, I’d like to thank those on the Full Committee staff that help all of our subcommittees: Clint Trocchio, Ben Hammond, and the wonderful GPO team led by Valerie Hutton.

    “Thank you again Chair Collins and Vice Chair Murray.”

    MIL OSI USA News

  • US appeals court scrutinizes Trump’s use of tariffs as trade deadline looms

    Source: Government of India

    Source: Government of India (4)

    U.S. appeals court judges sharply questioned on Thursday whether President Donald Trump’s tariffs were justified by the president’s emergency powers, as lawyers for states and businesses challenging the measures argued he exceeded his authority.

    The U.S. Court of Appeals for the Federal Circuit in Washington, D.C., is considering the legality of “reciprocal” tariffs that Trump imposed on a broad range of U.S. trading partners in April, as well as tariffs imposed in February against China, Canada and Mexico.

    In hearing arguments in two cases brought by five small U.S. businesses and 12 Democratic-led U.S. states, judges pressed government lawyer Brett Shumate to explain how the International Emergency Economic Powers Act (IEEPA), a 1977 law historically used for sanctioning enemies or freezing their assets, gave Trump the power to impose tariffs.

    Shumate said that the law allows the president to have “extraordinary” authority in an emergency, including the ability to stop imports completely. He said IEEPA authorizes tariffs because it allows a president to “regulate” imports in a crisis.

    The judges seemed dubious of this sweeping argument.

    “IEEPA doesn’t even say tariffs, doesn’t even mention them,” Judge Jimmie Reyna said.

    The arguments – one day before Trump plans to increase tariff rates on imported goods from nearly all U.S. trading partners – mark the first test before a U.S. appeals court of the scope of his tariff authority. The president has made tariffs a central instrument of his foreign policy, wielding them aggressively in his second term as leverage in trade negotiations and to push back against what he has called unfair practices.

    The court adjourned after about an hour-and-a-half of oral arguments. The judges did not say when they would rule, and the losing side will almost certainly appeal quickly to the U.S. Supreme Court.

    Trump, the first president to use IEEPA to impose tariffs, has said the April tariffs were a response to persistent U.S. trade imbalances and declining U.S. manufacturing power.

    He said the tariffs against China, Canada and Mexico were appropriate because those countries were not doing enough to stop illegal fentanyl from crossing U.S. borders, a claim the countries have denied.

    The states and businesses challenging the tariffs argued that they are not permissible under IEEPA and that the U.S. Constitution grants Congress, and not the president, authority over tariffs and other taxes.

    “No trade law in 200 years has been interpreted to give the president this power,” Neal Katyal, a lawyer for the businesses, said.

    Judge Kimberly Moore challenged Benjamin Gutman, representing the state of Oregon, on his argument that the U.S. trade deficit is not an “unusual and extraordinary” threat that would trigger IEEPA’s emergency powers, noting that Trump said the trade deficit contributed to compromised military readiness.

    “That bothers me – I’m a little concerned about compromised military readiness,” Moore said. “How about you?”

    The case is being heard by a panel of all of the court’s active judges, eight appointed by Democratic presidents and three appointed by former Republican presidents.

    TRADE NEGOTIATIONS

    Tariffs are starting to build into a significant revenue source for the federal government, with customs duties in June quadrupling to about $27 billion, a record, and through June have topped $100 billion for the current fiscal year. That income could be crucial to offset lost revenue from Trump’s tax bill passed into law earlier this month.

    But economists say the duties threaten to raise prices for U.S. consumers and reduce corporate profits. Trump’s on-again, off-again tariff threats have roiled financial markets and disrupted U.S. companies’ ability to manage supply chains, production, staffing and prices.

    On May 28, a three-judge panel of the U.S. Court of International Trade said IEEPA did not authorize tariffs related to longstanding trade deficits.

    The Federal Circuit has allowed the tariffs to remain in place while the litigation continues.

    The case will have no impact on tariffs levied under more traditional legal authority, such as duties on steel and aluminum imports.

    Trump’s Department of Justice has argued that limiting the president’s tariff authority could undermine ongoing trade negotiations, while other Trump officials have said that negotiations have continued with little change after the initial setback in court.

    The president recently announced trade deals that set tariff rates on goods from the European Union and Japan, following smaller trade agreements with Britain, Indonesia and Vietnam.

    Trump has set an August 1 date for higher tariffs on countries that don’t negotiate new trade deals.

    Mexican President Claudia Sheinbaum said on Thursday that Trump would pause new tariffs set to go into effect on the U.S.’s southern neighbor and a 90-day period to work on a trade deal.

    (Reuters)

  • MIL-OSI Europe: Written question – Closure of State aid proceedings relating to Hamburger Hafen und Logistik AG (HHLA) and the Mediterranean Shipping Company (MSC) in light of the judgment in Case C-40/23 P – E-002993/2025

    Source: European Parliament

    Question for written answer  E-002993/2025
    to the Commission
    Rule 144
    Fabio De Masi (NI)

    In light of the Court of Justice’s judgment in Case C-40/23 P[1], according to which the Commission is required to definitively determine the existence of aid as part of its decisional practice, how does the Commission justify the non-conclusion and closure of the State aid proceedings relating to the HHLA-MSC case (see written request to the Commission under reference EASE 2025/2487)?

    Submitted: 17.7.2025

    • [1] https://curia.europa.eu/juris/document/document.jsf;jsessionid=5658369B2D133B24CE434EA79641CF71?text=&docid=287069&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=4147156
    Last updated: 31 July 2025

    MIL OSI Europe News

  • MIL-OSI USA: Welch, Van Hollen, Castro, Jacobs Demand U.S. Security Companies Answer for Deadly Actions in Gaza 

    US Senate News:

    Source: United States Senator Peter Welch (D-Vermont)

    Bicameral lawmakers warn Safe Reach Solutions (SRS) and UG Solutions (UG) that they have put American veterans at risk of criminal and civil liability for de facto “military operations” in Gaza  
    WASHINGTON, D.C. – Today, U.S. Senators Peter Welch (D-Vt.) and Chris Van Hollen (D-Md.) joined U.S. Representatives Joaquin Castro (D-TX-20) and Sara Jacobs (D-CA-51) in leading an effort to demand answers from U.S.-based security companies, Safe Reach Solutions, LLC (SRS) and UG Solutions, LLC (UG) about their activities in Gaza, which according to press reports, include using lethal force against unarmed and starving Palestinian civilians at aid distribution sites.  
    The lawmakers warned SRS and UG that the companies and personnel—many of them American military veterans hired as private security contractors—may be subject to future criminal and civil liability under U.S. laws prohibiting torture, war crimes, and forced deportation. The lawmakers also requested the preservation of all documents and communication related to the security companies’ contracts and work with the Gaza Humanitarian Foundation (GHF). 
    “We were horrified by reporting this week on your companies’ deadly security operations in Gaza. Your operations have exposed hundreds of brave American veterans to future criminal and civil liability under U.S. laws criminalizing war crimes, torture, and forced deportation,” wrote the lawmakers. “Reports and firsthand witnesses have indicated to us that your personnel —American veterans hired as private security contractors—were brought into Israel on tourist visas inappropriate for the intended purpose of their travel, sent to Gaza armed for combat, and ordered by Israeli officials to use lethal force against unarmed and starving Palestinian civilians. We have also learned that under Israeli orders, your personnel are conducting crowd control at food distribution sites by firing live rounds over the heads of civilians and using stun grenades and pepper spray—all in an active military zone under direct supervision by Israeli military officers.” 
    The lawmakers continued: “As a result, we are deeply concerned that you may have failed to alert your personnel —or investors—of the immense legal risks they face for conducting what amounts to military operations on behalf of the Israeli government on land outside of the State of Israel.” 
    Read and download the letter here and below:  
    Mr. Govoni, Mr. Reilly,  
    We were horrified by reporting this week on your companies’ deadly security operations in Gaza. Your operations have exposed hundreds of brave American veterans to future criminal and civil liability under U.S. laws criminalizing war crimes, torture, and forced deportation.  
    Reports and firsthand witnesses have indicated to us that your personnel —American veterans hired as private security contractors—were brought into Israel on tourist visas inappropriate for the intended purpose of their travel, sent to Gaza armed for combat, and ordered by Israeli officials to use lethal force against unarmed and starving Palestinian civilians. We have also learned that under Israeli orders, your personnel are conducting crowd control at food distribution sites by firing live rounds over the heads of civilians and using stun grenades and pepper spray—all in an active military zone under direct supervision by Israeli military officers.  
    As a result, we are deeply concerned that you may have failed to alert your personnel —or investors—of the immense legal risks they face for conducting what amounts to military operations on behalf of the Israeli government on land outside of the State of Israel.   
    Even before the latest revelations, press had reported on Israeli military actions that include the wanton destruction of civilian homes, the use of human shields, rules of engagement resulting in disproportionate civilian casualties, and blockage of medicine and food. More than 50,000 children have already been killed or injured in Gaza, and as we write, infant boys and girls are starving to death. Prime Minister Netanyahu, in response to a question concerning remaining legitimate targets to strike, is reported to have said “I don’t care about the targets” and ordered military officials to “destroy the homes, bomb everything in Gaza. Finance Minister Bezalel Smotrich is reported to have said, “Gaza will be totally destroyed… They will be totally despairing… and will be looking for relocation to begin a new life in other places.” As a result of these actions, U.S. allies have already cut off the supply of offensive weapons to Israel. 
    We, therefore, ask that you urgently respond to the following questions: 

    What are the Rules of Engagement currently in effect for your staff in Gaza and what is the nature of their command-and-control relationship with Israeli military officers and government officials? 

    Did you inform your investors and staff prior to their departure from the United States that they are subject to U.S. criminal law prohibiting torture, war crimes, and forced deportation, including under the War Crimes Act? And further, that they could be held legally responsible for crimes by Israeli forces when those actions were enabled or facilitated by your operations? 

    Did you inform prospective staff and investors that they could face civil suits upon return to the United States under the Torture Prevention Act by Americans and the families of Americans harmed in Gaza? 

    Did you inform your staff that the International Criminal Court and third states may exercise jurisdiction over war crimes in Gaza and that they could consider your American staff as combatants for purposes of liability, potentially limiting future freedom of travel to other countries?  

    How is your organization documenting activities in Gaza and what happens to that data? We request that you preserve all documents and communications related to your contracts and work with the Gaza Humanitarian Foundation. 

    We respectfully request a response withing two weeks.  
    Sincerely, 
     CC: 

    Charles J. Africano (“Chuck”/“Joe”), Safe Reach Solutions (SRS) 

    Kevin Sullivan, UG Solutions 

    Jennifer C, UG Solutions 

    Lou Rassey, Chief Executive Officer, McNally Capital, Chicago IL 

    Ward McNally, Founder, Co-CEO, and Managing Partner, McNally Capital, Chicago IL 

    Brian Grogan, Chief Financial Officer & Chief Compliance Officer, McNally Capital, Chicago IL 

    Ravi Shah, Partner, McNally Capital, Chicago IL 

    Joel Revill, Chief Executive Officer, Two Ocean Trust, Jackson Hole WY  

    Albert Forkner, Chief Risk and Compliance Officer, Two Ocean Trust, Jackson Hole WY 

    Dustin Sventy, Chief Investment Officer, Two Ocean Trust, Jackson Hole WY  

    MIL OSI USA News

  • MIL-OSI USA: Nearly all National Guard soldiers in Los Angeles are demobilizing, Governor Newsom demands those remaining be released

    Source: US State of California 2

    Jul 31, 2025

    What you need to know: With nearly all National Guard soldiers demobilizing, Governor Gavin Newsom is calling on the President to allow the 300 remaining National Guard soldiers to go home now. 

    Los Angeles, CaliforniaNearly two months after the unlawful federalization of units of the California National Guard, and deployment of almost 5,000 soldiers in the Los Angeles area, all but 300 National Guard members are able to go home. So far, 4,700 soldiers have begun demobilizing. The President should allow the remaining soldiers to go back to their families, communities, and civilian professions as doctors, law enforcement and teachers.

    President Trump is realizing that his political theater backfired. This militarization was always unnecessary and deeply unpopular. The President must do the right thing to end this illegal militarization now because the economic and societal impacts are dire. The women and men of our military deserve more than to be used as props in the federal government’s propaganda machine.

    Governor Gavin Newsom

    Although it is unclear whether the National Guard has received formalized orders to begin additional demobilizations, an estimated 300 guardsmembers will continue to be stationed at Joint Forces Training Base, Los Alamitos without a clear mission, direction, or a timeline for returning to their communities. California urges Trump and the Department of Defense to end this theatrical deployment and send all remaining guardsmembers home immediately.

    Earlier this month, 2,000 federalized National Guard members and 700 Marines were called off their mission in Los Angeles. However, nearly 2,000 soldiers remained at Los Alamitos. 

    Economic impact of this political theater 

    After the federal government deployed the military unlawfully and began ramping up immigration raids statewide, the number of people reporting to work in the private sector in California decreased by 3.1% — a downturn only recently matched by the period when people stayed home from work during the COVID-19 lockdown.

    Governor Newsom recently met with local restaurant owners in the City of Bell and faith leaders in Downey to discuss the economic impact these indiscriminate immigration actions have had on their small business.

    Trump’s actions have a ripple effect – the state’s economy is likely to contract later this year due to fallout from global tariffs and immigration raids in Los Angeles and other cities that have rattled key sectors, including construction, hospitality, and agriculture, according to a UCLA Anderson forecast. 

    Mass arrests, detentions and deportations in California could slash $275 billion from the state’s economy and eliminate $23 billion in annual tax revenue. The loss of immigrant workers, undocumented and those losing lawful status under the Trump administration, would delay projects (including rebuilding Los Angeles after the wildfires), reduce food supply, and drive up costs. Undocumented immigrants contributed $8.5 billion in state and local taxes in 2022 — a number that would rise to $10.3 billion if these taxpayers could apply to work lawfully.

    Drugs arriving at the border, fewer soldiers to stop them

    Typically, under the Governor’s command, nearly 450 servicemembers are deployed statewide, including at ports of entry, to combat transnational criminal organizations and seize illegal narcotics. CalGuard’s servicemembers dedicated to the state’s Counterdrug Task Force have been reassigned by President Trump to militarize Los Angeles. The consequences are dire – CalGuard’s efforts help ensure the public safety of communities statewide.

    Police off the streets, teachers out of classrooms

    Of the 4,000 National Guard members sent to Los Angeles under Trump’s order, their servicemembers have been pulled from essential civilian duties such as medical and first responders, service workers, building trades contractors, law enforcement personnel, corrections officers, civil service and government workers, technology specialists, educators and teachers, and agriculture workers.

    End the power grab now

    Community leaders, public officials, veterans and others agree – the federal government’s actions in California not only have a chilling effect on the state’s society and economy, but also continue to undermine the valuable contributions from members of the military while in and out of uniform. 

    Republican and Democratic former governors agree—Trump’s federalization violates the critical balance between state and federal government. Recently, a bipartisan group of 25 former governors filed a brief in support of Newsom v. Trump, urging the court to enforce state sovereignty and block the unprecedented federalization of the National Guard. 

    Retired four-star admirals and generals and former secretaries of the Army and Navy filed another amicus brief outlining the grave risks of Trump’s illegal takeover of the CalGuard. Several veterans and veteran rights’ groups came together to decry Trump’s militarization of California.

    Recent news

    News What you need to know: In response to concerns from local elected leaders and community members about the potential for widespread SB 9 development concentrated in areas rebuilding from destructive fires and crowding evacuation routes, the Governor today issued…

    News SACRAMENTO – Governor Gavin Newsom today announced that he has signed the following bills:AB 17 by Assemblymember Juan Alanis (R-Modesto) – Elections: precinct maps.AB 377 by Assemblymember David Tangipa (R-Clovis) – High-Speed Rail Authority: business plan:…

    News What you need to know: California is standing up for all Americans by challenging Trump’s unlawful tariff policy, which is slowing the national economy and raising prices for consumers.  SACRAMENTO – Governor Gavin Newsom today filed an amicus brief in support of…

    MIL OSI USA News

  • MIL-OSI Security: Gunrunner Who Illegally Trafficked More than 200 Firearms to DC Area Sentenced to 84 Months in Prison

    Source: Office of United States Attorneys

                WASHINGTON – Michael Pittman, 30, of the District of Columbia, was sentenced today to 84 months in federal prison in connection with trafficking more than 200 illegal firearms from Georgia and North Carolina to the Washington D.C. area where he sold many of them to convicted felons, announced U.S. Attorney Jeanine Ferris Pirro.

                Pittman pleaded guilty on April 14, 2025, to conspiracy to commit firearms trafficking.

                In addition to the 84-month prison term, U.S. District Court Judge Tanya S. Chutkan ordered Pittman to serve three years of supervised release.

                Joining in the announcement was Special Agent in Charge Anthony Spotswood of the Washington Field Division of the Bureau of Alcohol, Tobacco, Firearms, and Explosives, and Chief Pamela A. Smith of the Metropolitan Police Department.

                According to court documents, from at least April 2023 through May 2024, Pittman rented cars and drove to Georgia and North Carolina where he purchased guns from illegal firearm suppliers. Pittman re-sold the firearms in the D.C. area, advertising them through different means. He took photos of the firearms displayed on his bed with prices.

                Between April 2023 through May 2024, Pittman obtained, advertised, or sold 200 or more firearms.

                On May 30, 2024, Virginia State Police arrested Pittman in Mecklenburg County, Virginia, as he was returning to D.C. from a buying trip. Pittman fled from a traffic stop before he crashed and ran into the nearby woods. Police recovered Pittman’s backpack which contained 16 firearms, an additional firearm he had dropped, and two firearms he had left in his vehicle.

                Law enforcement subsequently obtained a warrant and searched Pittman’s residence. In Pittman’s home, law enforcement recovered hundreds of rounds of ammunition, firearm cleaning and repair tools, firearm magazines, and three additional firearms. Law enforcement also observed the same red-and-black patterned bed spread observed in the images from Pittman’s phone.

                Pittman has one prior felony conviction for second degree assault in Prince George’s County, Maryland, for which he was sentenced to two years in prison suspended as to all but 30 days.

                This case was investigated by the Bureau of Alcohol, Tobacco, Firearms and Explosives Washington Field Division with valuable assistance from the Virginia State Police. It was prosecuted by Assistant U.S. Attorneys Cameron A. Tepfer and Sarah Martin.

    24cr296

    MIL Security OSI

  • MIL-OSI Security: Serial Armed Robber and Rapist Sentenced for “Nightmarish” Crimes

    Source: Office of United States Attorneys

    DETROIT – Today, Deandre Martece Williams was sentenced to 327 months in prison on charges of felon in possession of a firearm and kidnapping, in connection with a series of armed robberies, non-fatal shootings, and rapes he committed in 2023, United States Attorney Jerome F. Gorgon Jr. announced. In sentencing Williams, United States District Judge Mark A. Goldsmith stated that Williams’s “utter disregard for human dignity is breathtaking in the worst sense of the word” and referred to his conduct as “nightmarish.” During a three month stretch in 2023, Williams victimized fifteen people in eight separate incidents, seriously injuring four people, and raping three at gunpoint.

    Gorgon was joined in the announcement by James Deir, Special Agent in Charge of the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), Detroit Field Division, Chief Todd Bettison, Detroit Police Department (DPD), and Kym Worthy, Wayne County Prosecutor.

    During the investigation, DPD collected fired cartridge casings from the scene of multiple shootings. With the help of the ATF and the National Integrated Ballistic Information Network (NIBIN), they identified a pattern of targeting sex workers and their customers. The ATF and DPD methodically pieced together other evidence from the crime scenes and identified Williams as a suspect. On October 20, 2023, ATF agents executed a federal search warrant at Williams’s house, arrested him, and found the gun used in the robberies.

    Williams frequently found his victims in parked cars along neighborhood streets. Williams commonly approached on foot, placed his handgun through an open window or door, and robbed his victims. After the robberies, Williams shot at several of the victims as they tried to flee. Several of the victims were injured by gunfire. Williams raped two of his victims during the robberies.

    Through their investigation of the robberies, the ATF and DPD uncovered evidence linking Williams to a rape and adult kidnapping. Williams and that victim had agreed to meet over a dating app. When Williams arrived at the victim’s hotel room, he pulled out a handgun and held the victim at gunpoint for several hours while repeatedly raping the victim.

    Williams’s arrest for the robberies also led to DNA evidence linking him to an unsolved Criminal Sexual Conduct from 2012. Williams pleaded guilty to two counts of Criminal Sexual Conduct in the Third Circuit Court in Detroit for those offenses and was sentenced in March to 10 years 6 months up to 20 years prison in the Wayne County Third Circuit Court.

    “We should all hate robbery and cruelty. And this sinister man did plenty of both. For years, he was prowling around our streets. But through ingenuity and hard work, the ATF and DPD made our city safer,” said U.S. Attorney Gorgon.

    “Deandre Williams is a ruthless predator who used firearms to dominate, violate, and destroy lives,” said ATF Special Agent in Charge James Deir. “He didn’t just break the law — he shattered families, preyed on the vulnerable, instilled fear, and left a trail of mayhem wherever he went. ATF’s unique firearm expertise will continue to be the bedrock of gun violence reduction efforts in Detroit.  This expertise enables ATF and our law enforcement partners to identify AND target the most prolific shooters across the Detroit metropolitan community for federal prosecution.  Mr. Williams is a poster child for what this partnership does: removing violent thugs from the community. Williams will now need to pack a suitcase because he will be behind bars.  Exactly, where he deserves to be.”

    “The investigation of Deandre Williams yielded an unexpected dividend.  WCPO was able to successfully prosecute Williams on a 2012 sexual assault case as a direct result of evidence collected in his federal cases.  We are pleased that all of his victims will see him receive the justice he deserves,” said Wayne County Prosecutor Kym Worthy.

    This case was investigated by the Bureau of Alcohol Tobacco, Firearms and Explosives in conjunction with the Detroit Police Department. The case is being prosecuted by the United States Attorney’s Office for the Eastern District of Michigan.

    MIL Security OSI

  • MIL-OSI Security: CEO and Medical Director Charged in $500M COVID-19 Test Billing Fraud

    Source: Office of United States Attorneys

    DETROIT – Two individuals were charged for their involvement in a $500 million, nationwide scheme that involved billing Medicare, Medicaid, TRICARE, and other health insurance programs for COVID-19 testing services that were never rendered, United States Attorney Jerome F. Gorgon Jr. announced today.

    Cemhan “Jimmy” Biricik (age 46) of Boca Raton Florida, and Dr. Martin Perlin (age 74) of Fairfield, Connecticut were charged with conspiracy to commit health care fraud and more than 50 substantive counts of health care fraud. Biricik was the sole member and Chief Executive Officer of Fast Lab Technologies, LLC (Fast Lab).  Dr. Perlin was Fast Lab’s Medical Director and provider responsible for ordering the majority of the tests. Both defendants were arrested this morning.

    According to the Indictment, during the Covid-19 pandemic, New York-based Fast Lab operated a website offering “free” covid tests.  When individuals went to the website to order tests, they were asked to provide their insurance information.  Fast Lab then used this insurance information to fraudulently bill Medicare, Medicaid, TRICARE and numerous private insurances for both antigen (“rapid”) and PCR (“laboratory) tests, across multiple dates for each beneficiary. Specifically, Fast Lab’s claims represented that (1) the antigen tests had been observed by medical professionals, (2) saliva samples were collected by medical professionals, and (3) PCR testing was performed on those samples.  In reality, the vast majority of antigen tests—if taken at all—were taken at home and not observed by medical professionals; saliva samples were never collected nor returned to Fast Lab; and PCR testing was never performed. Dr. Perlin was the ordering physician for these tests, despite not having a treating relationship with the beneficiaries.  Further, Fast Lab would regularly submit insurance claims before the test kits were even delivered to the beneficiaries.  In total, Biricik billed or caused to be billed more than $500 million in claims and was paid more than $50 million.

    Gorgon was joined in the announcement by Special Agent in Charge Mario Pinto, U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG), Chicago Regional Office; Special Agent in Charge Cheyvoryea Gibson, Federal Bureau of Investigation, Detroit Division; Special Agent in Charge Derek M. Holt of the U.S. Office of Personnel Management Office of the Inspector General; Acting Assistant Secretary of Labor for the Employee Benefits Security Administration Janet Dhillon (DOL-EBSA); Detroit Division; Acting Special Agent in Charge Christopher Silvestro, Defense Criminal Investigative Service (DCIS); Special Agent in Charge Charles Miller, Detroit Field Office, Internal Revenue Service – Criminal Investigation (IRS-CI); Special Agent in Charge Megan Howell, Great Lakes Region, U.S. Department of Labor, Office of Inspector General (DOL-OIG); Acting Inspector in Charge Sean McStravick, U.S. Postal Inspection Service (USPIS); Owen Cypher, U.S. Marshal for the Eastern District of Michigan and Michigan Attorney General Dana Nessel, Medicaid Fraud Control Unit (MFCU).

    The public is reminded that an Indictment is not evidence of guilt. The defendants are presumed innocent and entitled to a fair trial at which the government has the burden of proving guilt beyond a reasonable doubt.

    This case is being investigated by Special Agents from HHS-OIG, FBI, OPM-OIG, DOL-EBSA, DCIS, MFCU, IRS-CI, DOL-OIG, USPIS, and the U.S. Marshal’s Service.  It is being prosecuted by Assistant U.S. Attorneys Regina R. McCullough and Ryan A. Particka.  Assistant United States Attorney Ryan T. Nees of the United States Attorney’s Office for the Southern District of New York also provided assistance. 

    MIL Security OSI

  • MIL-OSI USA: Governor Stein Announces District Attorney Appointment

    Source: US State of North Carolina

    Headline: Governor Stein Announces District Attorney Appointment

    Governor Stein Announces District Attorney Appointment
    lsaito

    Raleigh, NC

    Today Governor Josh Stein announced the following District Attorney appointment:

    Matthew T. Wareham as District Attorney in Prosecutorial District 4, serving Carteret, Craven, and Pamlico counties. Wareham is filling the vacancy created after the Honorable Scott Thomas retired.

    • Wareham currently serves as the Chief Assistant District Attorney in Prosecutorial District 4. From 2017 to 2024, he served as an Assistant District Attorney in the same office. He also served for almost three years as an Assistant District Attorney in Alamance County. Wareham received his Bachelor of Science and Master of Arts degrees from East Carolina University and his Juris Doctor from North Carolina Central University School of Law.

    “Matt has spent his entire career in public service, serving as a prosecutor for more than a decade in Alamance, Carteret, Craven, and Pamlico counties,” said Governor Josh Stein. “I look forward to seeing all he accomplishes in his new role.” 

    Jul 31, 2025

    MIL OSI USA News

  • MIL-OSI USA: California Defense Contractor and Private Equity Firm Agree to Pay $1.75M to Resolve False Claims Act Liability Relating to Voluntary Self-Disclosure of Cybersecurity Violations

    Source: US State of California

    Defense contractor Aero Turbine Inc., of Stockton, California, and private equity company Gallant Capital Partners LLC, of Los Angeles, have agreed to pay $1.75 million to resolve their liability under the False Claims Act for knowingly failing to comply with cybersecurity requirements in an Aero Turbine contract with the Department of the Air Force. In connection with the settlement, the United States acknowledged that Aero Turbine and Gallant took significant steps entitling them to credit for cooperating with the government.

    “Government contractors must follow required cybersecurity standards to protect sensitive defense information,” said Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division. “When defense contractors fail to comply with cybersecurity requirements, they can mitigate the consequences by making timely self-disclosures, cooperating with investigations, and taking prompt remedial measures.”

    “Every defense contractor must provide adequate security to safeguard covered defense information,” said Acting U.S. Attorney Kimberly A. Sanchez for the Eastern District of California. “We commend Aero Turbine and Gallant for disclosing the issue and promptly cooperating to address it. We encourage others to follow their example of self-reporting to resolve violations.”

    “Protecting the integrity of the Department of Defense (DoD) procurement processes is a top priority for the DoD Office of Inspector General’s Defense Criminal Investigative Service (DCIS),” said Director Kelly Mayo of DCIS. “Failing to comply with DoD contract specifications and cybersecurity requirements puts DoD information and programs at risk of exploitation. DCIS will continue to collaborate with our law enforcement partners and the Department of Justice to investigate allegations of false claims on DoD contracts.”

    “This case serves as a reminder that cybersecurity transcends mission sets. Ensuring companies adhere to robust cybersecurity safeguards is integral to maintaining the Air Force’s operational edge against adversaries,” said Special Agent in Charge Caroline Galinis of the Air Force Office of Special Investigations (AFOSI), Procurement Fraud Detachment 1. “AFOSI’s Procurement Fraud team, alongside investigative partner agencies and the Department of Justice, played a critical role in protecting U.S. national security interests.”

    The settlement resolves the liability of Aero Turbine and Gallant under the False Claims Act for knowingly submitting or causing others to submit false or fraudulent claims for payment on a Department of the Air Force contract, which were allegedly false or fraudulent because they had not complied with the contract’s cybersecurity requirements. From January 2018 to February 2020, Aero Turbine allegedly failed to implement certain cybersecurity controls in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 that, if not implemented, could lead to significant exploitation of the system or exfiltration of sensitive defense information.

    In addition, from June to July 2019, Aero Turbine and Gallant allegedly failed to control the flow of, and limit unauthorized access to, sensitive defense information by providing a software company based in Egypt with files containing such information, even though the software company and its foreign citizen personnel were not authorized to receive sensitive defense information under the Air Force contract. After learning of the issues, Aero Turbine and Gallant provided the government with multiple written self-disclosures, cooperated with the government’s investigation of the issues, and took prompt remedial action.

    The resolution obtained in this matter was the result of a coordinated effort between the Justice Department’s Civil Division, Commercial Litigation Branch, Fraud Section, the U.S. Attorney’s Office for the Eastern District of California, DCIS, AFOSI, and the Air Force Materiel Command Law Office Procurement Fraud Division. The matter was handled by Fraud Section attorneys Robin Overby and Christopher Terranova and Assistant U.S. Attorney David Thiess.

    The claims resolved by the settlement are allegations only, and there has been no determination of liability.

    Note: Read the Settlement here.

    MIL OSI USA News

  • MIL-OSI USA: Risch, Colleagues Introduce Legislation to Ensure Fairness for Firearm Small Businesses

    US Senate News:

    Source: United States Senator for Idaho James E Risch

    WASHINGTON – U.S. Senator Jim Risch (R-Idaho) and 17 Republican colleagues today introduced the Equal Shot Act. The legislation prohibits the Small Business Administration (SBA) from discriminating against firearm-related businesses.

    “Federal agencies have no authority to deny critical support to small businesses based on ideological bias,” said Risch. “The Equal Shot Actdefends the Second Amendment rights of Idaho’s small business firearm industry and ensures these law-abiding Americans have fair access to resources that will help them thrive.”

    Risch is joined by U.S. Senators Mike Crapo (R-Idaho), Marsha Blackburn (R-Tenn.), Ted Budd (R-N.C.), Shelley Moore Capito (R-W.Va.), Bill Cassidy (R-La.), Steve Daines (R-Mont.), Deb Fischer (R-Neb.), Lindsey Graham (R-S.C.), Cindy Hyde-Smith (R-Miss.), Jim Justice (R-W.Va.), John Kennedy (R-La.), James Lankford (R-Okla.), Mike Lee (R-Utah), Cynthia Lummis (R-Wyo.), Tim Scott (R-S.C.), Tim Sheehy (R-Mont.), and Tommy Tuberville (R-Ala.) in introducing the Equal Shot Act.

    The Equal Shot Act was introduced in the House by U.S. Representative Roger Williams (R-Texas), chairman of the House Committee on Small Business.

    “The Equal Shot Act ensures every eligible small business is treated fairly and without political bias,” said Williams. “Under the Biden Administration, firearm-related businesses were targeted and singled out by federal agencies and financial institutions simply because of what they represent. These law-abiding job creators should not be punished for supporting the Second Amendment. I want to thank Senator Risch for his support on this important legislation. Every business on Main Street deserves the same opportunity to succeed.”

    “Under the last administration, the Small Business Administration was caught red-handed adopting discriminatory policies aimed at denying financial assistance to members of the firearm industry that provide the means for Americans to exercise their Second Amendment rights,” said Lawrence G. Keane, National Shooting Sports Foundation (NSSF) Senior Vice President and General Counsel. “The federal government should not be picking winners and losers in a free market based on political ideology. Every lawful business should have an equal shot at success. NSSF is grateful to Senator Risch for his leadership in sponsoring the Equal Shot Act which will ensure the Small Business Administration can never again be weaponized to deny financial assistance to help small businesses in our industry grow and create jobs that are vital to the future of our nation’s economy and the Second Amendment.”

    MIL OSI USA News

  • MIL-OSI Security: California Defense Contractor and Private Equity Firm Agree to Pay $1.75M to Resolve False Claims Act Liability Relating to Voluntary Self-Disclosure of Cybersecurity Violations

    Source: United States Attorneys General

    Defense contractor Aero Turbine Inc., of Stockton, California, and private equity company Gallant Capital Partners LLC, of Los Angeles, have agreed to pay $1.75 million to resolve their liability under the False Claims Act for knowingly failing to comply with cybersecurity requirements in an Aero Turbine contract with the Department of the Air Force. In connection with the settlement, the United States acknowledged that Aero Turbine and Gallant took significant steps entitling them to credit for cooperating with the government.

    “Government contractors must follow required cybersecurity standards to protect sensitive defense information,” said Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division. “When defense contractors fail to comply with cybersecurity requirements, they can mitigate the consequences by making timely self-disclosures, cooperating with investigations, and taking prompt remedial measures.”

    “Every defense contractor must provide adequate security to safeguard covered defense information,” said Acting U.S. Attorney Kimberly A. Sanchez for the Eastern District of California. “We commend Aero Turbine and Gallant for disclosing the issue and promptly cooperating to address it. We encourage others to follow their example of self-reporting to resolve violations.”

    “Protecting the integrity of the Department of Defense (DoD) procurement processes is a top priority for the DoD Office of Inspector General’s Defense Criminal Investigative Service (DCIS),” said Director Kelly Mayo of DCIS. “Failing to comply with DoD contract specifications and cybersecurity requirements puts DoD information and programs at risk of exploitation. DCIS will continue to collaborate with our law enforcement partners and the Department of Justice to investigate allegations of false claims on DoD contracts.”

    “This case serves as a reminder that cybersecurity transcends mission sets. Ensuring companies adhere to robust cybersecurity safeguards is integral to maintaining the Air Force’s operational edge against adversaries,” said Special Agent in Charge Caroline Galinis of the Air Force Office of Special Investigations (AFOSI), Procurement Fraud Detachment 1. “AFOSI’s Procurement Fraud team, alongside investigative partner agencies and the Department of Justice, played a critical role in protecting U.S. national security interests.”

    The settlement resolves the liability of Aero Turbine and Gallant under the False Claims Act for knowingly submitting or causing others to submit false or fraudulent claims for payment on a Department of the Air Force contract, which were allegedly false or fraudulent because they had not complied with the contract’s cybersecurity requirements. From January 2018 to February 2020, Aero Turbine allegedly failed to implement certain cybersecurity controls in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 that, if not implemented, could lead to significant exploitation of the system or exfiltration of sensitive defense information.

    In addition, from June to July 2019, Aero Turbine and Gallant allegedly failed to control the flow of, and limit unauthorized access to, sensitive defense information by providing a software company based in Egypt with files containing such information, even though the software company and its foreign citizen personnel were not authorized to receive sensitive defense information under the Air Force contract. After learning of the issues, Aero Turbine and Gallant provided the government with multiple written self-disclosures, cooperated with the government’s investigation of the issues, and took prompt remedial action.

    The resolution obtained in this matter was the result of a coordinated effort between the Justice Department’s Civil Division, Commercial Litigation Branch, Fraud Section, the U.S. Attorney’s Office for the Eastern District of California, DCIS, AFOSI, and the Air Force Materiel Command Law Office Procurement Fraud Division. The matter was handled by Fraud Section attorneys Robin Overby and Christopher Terranova and Assistant U.S. Attorney David Thiess.

    The claims resolved by the settlement are allegations only, and there has been no determination of liability.

    Note: Read the Settlement here.

    MIL Security OSI

  • MIL-OSI Security: California Defense Contractor and Private Equity Firm Agree to Pay $1.75M to Resolve False Claims Act Liability Relating to Voluntary Self-Disclosure of Cybersecurity Violations

    Source: United States Attorneys General

    Defense contractor Aero Turbine Inc., of Stockton, California, and private equity company Gallant Capital Partners LLC, of Los Angeles, have agreed to pay $1.75 million to resolve their liability under the False Claims Act for knowingly failing to comply with cybersecurity requirements in an Aero Turbine contract with the Department of the Air Force. In connection with the settlement, the United States acknowledged that Aero Turbine and Gallant took significant steps entitling them to credit for cooperating with the government.

    “Government contractors must follow required cybersecurity standards to protect sensitive defense information,” said Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division. “When defense contractors fail to comply with cybersecurity requirements, they can mitigate the consequences by making timely self-disclosures, cooperating with investigations, and taking prompt remedial measures.”

    “Every defense contractor must provide adequate security to safeguard covered defense information,” said Acting U.S. Attorney Kimberly A. Sanchez for the Eastern District of California. “We commend Aero Turbine and Gallant for disclosing the issue and promptly cooperating to address it. We encourage others to follow their example of self-reporting to resolve violations.”

    “Protecting the integrity of the Department of Defense (DoD) procurement processes is a top priority for the DoD Office of Inspector General’s Defense Criminal Investigative Service (DCIS),” said Director Kelly Mayo of DCIS. “Failing to comply with DoD contract specifications and cybersecurity requirements puts DoD information and programs at risk of exploitation. DCIS will continue to collaborate with our law enforcement partners and the Department of Justice to investigate allegations of false claims on DoD contracts.”

    “This case serves as a reminder that cybersecurity transcends mission sets. Ensuring companies adhere to robust cybersecurity safeguards is integral to maintaining the Air Force’s operational edge against adversaries,” said Special Agent in Charge Caroline Galinis of the Air Force Office of Special Investigations (AFOSI), Procurement Fraud Detachment 1. “AFOSI’s Procurement Fraud team, alongside investigative partner agencies and the Department of Justice, played a critical role in protecting U.S. national security interests.”

    The settlement resolves the liability of Aero Turbine and Gallant under the False Claims Act for knowingly submitting or causing others to submit false or fraudulent claims for payment on a Department of the Air Force contract, which were allegedly false or fraudulent because they had not complied with the contract’s cybersecurity requirements. From January 2018 to February 2020, Aero Turbine allegedly failed to implement certain cybersecurity controls in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 that, if not implemented, could lead to significant exploitation of the system or exfiltration of sensitive defense information.

    In addition, from June to July 2019, Aero Turbine and Gallant allegedly failed to control the flow of, and limit unauthorized access to, sensitive defense information by providing a software company based in Egypt with files containing such information, even though the software company and its foreign citizen personnel were not authorized to receive sensitive defense information under the Air Force contract. After learning of the issues, Aero Turbine and Gallant provided the government with multiple written self-disclosures, cooperated with the government’s investigation of the issues, and took prompt remedial action.

    The resolution obtained in this matter was the result of a coordinated effort between the Justice Department’s Civil Division, Commercial Litigation Branch, Fraud Section, the U.S. Attorney’s Office for the Eastern District of California, DCIS, AFOSI, and the Air Force Materiel Command Law Office Procurement Fraud Division. The matter was handled by Fraud Section attorneys Robin Overby and Christopher Terranova and Assistant U.S. Attorney David Thiess.

    The claims resolved by the settlement are allegations only, and there has been no determination of liability.

    Note: Read the Settlement here.

    MIL Security OSI

  • MIL-OSI Security: Mother-Daughter Duo Sentenced in Elder Fraud Scheme

    Source: US FBI

    BIRMINGHAM, Ala. – A mother and daughter have been sentenced for their involvement in an elder fraud scheme, announced U.S. Attorney Prim F. Escalona.

    U.S. District Court Judge Anna M. Manasco sentenced Mykia L. Henderson, 32, of Moody, to 87 months in prison, and Cynthia H. Mixon, 50, of Fairfield, to 57 months in prison. Both pleaded guilty to conspiracy to commit wire fraud and aggravated identity theft.

    According to the plea agreements, between December 2020 and February 2022, Mixon and Henderson were the in-home caretakers for the elderly victim. In their role as caretakers, Henderson and Mixon had access to the victim’s financial information, which they shared with one another and with other members of the conspiracy. The defendants devised a scheme to defraud the victim by using fake and fraudulent accounts they set up through Square, Inc. and Stripe, Inc. Through the scheme, the defendants charged the victim’s credit cards through the Square and Stripe accounts and then deposited the funds into their bank accounts or shared the proceeds with one another. The defendants hid the charges from the victim by including false “descriptions” to prevent their discovery. The defendants also wrote unauthorized checks to themselves that were drawn on the victim’s bank accounts. In total, members of the conspiracy stole nearly $500,000 from the victim.   

    The Federal Bureau of Investigation and Mountain Brook Police Department investigated the case.  Assistant United States Attorney Ryan S. Rummage prosecuted the case.

    Reporting from consumers about fraud and fraud attempts is critical to law enforcements’ efforts to investigate and prosecute schemes targeting older adults. If you or someone you know is age 60 or older and has been a victim of financial fraud, help is available at the National Elder Fraud Hotline: 1-833 FRAUD-11 (1-833-372-8311). This Department of Justice Hotline, managed by the Office for Victims of Crime, is staffed by experienced professionals who provide personalized support to callers by assessing the needs of the victim and identifying next steps. The hotline is staffed seven days a week from 6:00 a.m. to 11:00 p.m. [ET]. English, Spanish and other languages are available. More information about the Department’s elder justice efforts can be found on the Department’s Elder Justice website, www.elderjustice.gov.

    MIL Security OSI

  • MIL-OSI Security: Mother-Daughter Duo Sentenced in Elder Fraud Scheme

    Source: US FBI

    BIRMINGHAM, Ala. – A mother and daughter have been sentenced for their involvement in an elder fraud scheme, announced U.S. Attorney Prim F. Escalona.

    U.S. District Court Judge Anna M. Manasco sentenced Mykia L. Henderson, 32, of Moody, to 87 months in prison, and Cynthia H. Mixon, 50, of Fairfield, to 57 months in prison. Both pleaded guilty to conspiracy to commit wire fraud and aggravated identity theft.

    According to the plea agreements, between December 2020 and February 2022, Mixon and Henderson were the in-home caretakers for the elderly victim. In their role as caretakers, Henderson and Mixon had access to the victim’s financial information, which they shared with one another and with other members of the conspiracy. The defendants devised a scheme to defraud the victim by using fake and fraudulent accounts they set up through Square, Inc. and Stripe, Inc. Through the scheme, the defendants charged the victim’s credit cards through the Square and Stripe accounts and then deposited the funds into their bank accounts or shared the proceeds with one another. The defendants hid the charges from the victim by including false “descriptions” to prevent their discovery. The defendants also wrote unauthorized checks to themselves that were drawn on the victim’s bank accounts. In total, members of the conspiracy stole nearly $500,000 from the victim.   

    The Federal Bureau of Investigation and Mountain Brook Police Department investigated the case.  Assistant United States Attorney Ryan S. Rummage prosecuted the case.

    Reporting from consumers about fraud and fraud attempts is critical to law enforcements’ efforts to investigate and prosecute schemes targeting older adults. If you or someone you know is age 60 or older and has been a victim of financial fraud, help is available at the National Elder Fraud Hotline: 1-833 FRAUD-11 (1-833-372-8311). This Department of Justice Hotline, managed by the Office for Victims of Crime, is staffed by experienced professionals who provide personalized support to callers by assessing the needs of the victim and identifying next steps. The hotline is staffed seven days a week from 6:00 a.m. to 11:00 p.m. [ET]. English, Spanish and other languages are available. More information about the Department’s elder justice efforts can be found on the Department’s Elder Justice website, www.elderjustice.gov.

    MIL Security OSI

  • MIL-OSI Security: Canadian Cybercriminal Sentenced to One Year in Prison for NFT Theft Scheme

    Source: US FBI

    ALEXANDRIA, Va. – A Canadian was sentenced yesterday to a year in prison for conspiracy to commit wire fraud, wire fraud, and conspiracy to commit aggravated identity theft.

    According to court documents, in May 2022, Cameron Albert Redman, 22, of Mississauga, Ontario, formed a scheme to steal non-fungible tokens (NFTs) by gaining unauthorized access to the X accounts of various digital artists. The conspirators used the artists’ online identities to direct the artists’ followers to fraudulent websites. There, victims would seek to claim new NFTs from the digital artists. Though victims thought they were authorizing a transaction to receive NFTs into their digital wallets, they unknowingly enabled the conspirators to remove cryptocurrency and NFTs from their wallets.

    Within a few days, Redman and his co-conspirators defrauded over 200 victims and profited over $794,000.

    Erik S. Siebert, U.S. Attorney for the Eastern District of Virginia, and Reid Davis, Special Agent in Charge of the FBI Washington Field Office’s Criminal Division, made the announcement after sentencing by U.S. District Judge Leonie M. Brinkema.

    The Justice Department’s Office of International Affairs provided substantial assistance to secure the arrest and March 2025 extradition from Portugal of Redman. The Royal Canadian Mounted Police Cybercrime Investigation Team, Central Region, provided valuable assistance in this case.

    Assistant U.S. Attorney Zoe Bedell prosecuted the case.

    A copy of this press release is located on the website of the U.S. Attorney’s Office for the Eastern District of Virginia. Related court documents and information are located on the website of the District Court for the Eastern District of Virginia or on PACER by searching for Case No. 1:25-cr-129.

    MIL Security OSI

  • MIL-OSI Security: Canadian Cybercriminal Sentenced to One Year in Prison for NFT Theft Scheme

    Source: US FBI

    ALEXANDRIA, Va. – A Canadian was sentenced yesterday to a year in prison for conspiracy to commit wire fraud, wire fraud, and conspiracy to commit aggravated identity theft.

    According to court documents, in May 2022, Cameron Albert Redman, 22, of Mississauga, Ontario, formed a scheme to steal non-fungible tokens (NFTs) by gaining unauthorized access to the X accounts of various digital artists. The conspirators used the artists’ online identities to direct the artists’ followers to fraudulent websites. There, victims would seek to claim new NFTs from the digital artists. Though victims thought they were authorizing a transaction to receive NFTs into their digital wallets, they unknowingly enabled the conspirators to remove cryptocurrency and NFTs from their wallets.

    Within a few days, Redman and his co-conspirators defrauded over 200 victims and profited over $794,000.

    Erik S. Siebert, U.S. Attorney for the Eastern District of Virginia, and Reid Davis, Special Agent in Charge of the FBI Washington Field Office’s Criminal Division, made the announcement after sentencing by U.S. District Judge Leonie M. Brinkema.

    The Justice Department’s Office of International Affairs provided substantial assistance to secure the arrest and March 2025 extradition from Portugal of Redman. The Royal Canadian Mounted Police Cybercrime Investigation Team, Central Region, provided valuable assistance in this case.

    Assistant U.S. Attorney Zoe Bedell prosecuted the case.

    A copy of this press release is located on the website of the U.S. Attorney’s Office for the Eastern District of Virginia. Related court documents and information are located on the website of the District Court for the Eastern District of Virginia or on PACER by searching for Case No. 1:25-cr-129.

    MIL Security OSI

  • MIL-OSI Security: Five Co-Conspirators Plead Guilty to Smuggling Contraband Into the D.C. Jail

    Source: US FBI

               WASHINGTON – LaTara Brown, 31, of Capitol Heights, Maryland, Kiya Holland, 33, of Oxon Hill, Maryland, Darius Robertson, 31, of Washington, D.C., Marcel Vines, 28, of Washington, D.C., and Stefon Freshley, 28 of Washington, D.C. have all pleaded guilty in a conspiracy to provide a knife, cell phones, and fentanyl and other controlled substances to inmates in the D.C. jail as they awaited trial for murder and assault with intent to kill while armed. The pleas were announced by U.S. Attorney Jeanine Ferris Pirro.

               Brown, Holland, Robertson, Vines and Freshley pleaded guilty in District Court. They were previously indicted on November 14, 2024 for providing or possessing contraband in a prison, as well as conspiring to do so. The sixth co-conspirator, Rashaad Roper, 45, of Gaithersburg, MD is set to go to trial.

               As part of the plea, Brown, Holland, Robertson, Vines and Freshley admitted to their role in the conspiracy which included Holland and Brown admitting to packaging contraband, such as a knife, cell phones, and controlled substances to include fentanyl, into Tupperware containers which would then be brought to the Central Detention Facility, also known as the D.C. Jail. Robertson, Vines, and/or Freshley, who were inmates inside the housing unit, admitted to receiving the contraband from Officer Roper or another corrections officer after they were smuggled into the jail.

                Sentencings are scheduled for August 13, 2025 (Vines), September 5, 2025 (Holland), September 16, 2025 (Robertson), September 25, 2025 (Freshley), and October 21, 2025 (Brown). Each defendant faces a statutory maximum sentence of 5 years in prison for conspiracy to provide or possess contraband in a prison. Judge Timothy J. Kelly will determine the appropriate sentence at each of the respective sentencings. 

               Joining in the announcement was FBI Washington Field Office Criminal Division Special Agent in Charge Reid Davis and Chief Investigator Kevin L. Hammond of the D.C. Department of Corrections Office of Investigative Services.

               This case was investigated by the FBI’s Washington Field Office and the D.C. Department of Corrections Office of Investigative Services with the assistance of the Department of Justice Office of Inspector General. It is being prosecuted by Assistant U.S. Attorneys Joshua Gold and Sarah Santiago.

    MIL Security OSI

  • MIL-OSI Security: Five Co-Conspirators Plead Guilty to Smuggling Contraband Into the D.C. Jail

    Source: US FBI

               WASHINGTON – LaTara Brown, 31, of Capitol Heights, Maryland, Kiya Holland, 33, of Oxon Hill, Maryland, Darius Robertson, 31, of Washington, D.C., Marcel Vines, 28, of Washington, D.C., and Stefon Freshley, 28 of Washington, D.C. have all pleaded guilty in a conspiracy to provide a knife, cell phones, and fentanyl and other controlled substances to inmates in the D.C. jail as they awaited trial for murder and assault with intent to kill while armed. The pleas were announced by U.S. Attorney Jeanine Ferris Pirro.

               Brown, Holland, Robertson, Vines and Freshley pleaded guilty in District Court. They were previously indicted on November 14, 2024 for providing or possessing contraband in a prison, as well as conspiring to do so. The sixth co-conspirator, Rashaad Roper, 45, of Gaithersburg, MD is set to go to trial.

               As part of the plea, Brown, Holland, Robertson, Vines and Freshley admitted to their role in the conspiracy which included Holland and Brown admitting to packaging contraband, such as a knife, cell phones, and controlled substances to include fentanyl, into Tupperware containers which would then be brought to the Central Detention Facility, also known as the D.C. Jail. Robertson, Vines, and/or Freshley, who were inmates inside the housing unit, admitted to receiving the contraband from Officer Roper or another corrections officer after they were smuggled into the jail.

                Sentencings are scheduled for August 13, 2025 (Vines), September 5, 2025 (Holland), September 16, 2025 (Robertson), September 25, 2025 (Freshley), and October 21, 2025 (Brown). Each defendant faces a statutory maximum sentence of 5 years in prison for conspiracy to provide or possess contraband in a prison. Judge Timothy J. Kelly will determine the appropriate sentence at each of the respective sentencings. 

               Joining in the announcement was FBI Washington Field Office Criminal Division Special Agent in Charge Reid Davis and Chief Investigator Kevin L. Hammond of the D.C. Department of Corrections Office of Investigative Services.

               This case was investigated by the FBI’s Washington Field Office and the D.C. Department of Corrections Office of Investigative Services with the assistance of the Department of Justice Office of Inspector General. It is being prosecuted by Assistant U.S. Attorneys Joshua Gold and Sarah Santiago.

    MIL Security OSI

  • MIL-OSI USA: Fischer, Cortez Masto Introduce MAP for Broadband Funding Act

    US Senate News:

    Source: United States Senator for Nebraska Deb Fischer

    Provides fresh oversight over FCC’s Broadband Funding Map, originally created by Fischer, Cortez Masto

    Today, U.S. Senators Deb Fischer (R-Neb.) and Catherine Cortez Masto (D-Nev.) introduced the Modernization, Accountability, and Planning (MAP) for Broadband Funding Act, to provide oversight of the Federal Communication Commission’s (FCC) Broadband Funding Map to ensure it is functioning effectively for the public, federal agencies, and broadband providers.

    Fischer and Cortez Masto originally created the Broadband Funding Map as part of the Bipartisan Infrastructure Law. With oversight needed to ensure federal agencies are utilizing the Map to its full potential, the MAP For Broadway Funding Act will ensure that these agencies are reliably reporting their funding data to the FCC.

    “I have worked diligently for years to close the digital divide for unserved and underserved communities. My work with Senator Cortez Masto was underscored by the Broadband Funding Map, which we created in 2021. While I’m pleased the FCC launched the Map in 2023, it is clear oversight is needed here to ensure all federal agencies are utilizing the Map to its full potential. I won’t relent in my efforts to expand Internet connectivity for those who lack access—this is a critical step in that mission,”
     Fischer said. 

    “As we work to expand broadband access across the country, it’s critical that we do with as much transparency, accountability, and coordination as possible. Reliable access to the internet is already so important for people to work and take care of their everyday tasks. Congress must ensure we continue to expand its access efficiently,” Cortez Masto said.

    “Big thanks to Senators Fischer and Cortez Masto for their work in bringing about the MAP for Broadband Funding Act. By improving the accuracy and transparency of the Broadband Funding Map, we can more effectively target federal funding for broadband deployment where it’s truly needed. Plus, requiring federal agencies to report broadband deployment data to the FCC and NTIA will strengthen coordination and accountability across programs,” USTelecom President and CEO Jonathan Spalter said. 

    “Senator Fischer should be commended for marshaling the Federal Communications Commission and the Government Accountability Office to ensure that precious federal broadband dollars are spent as efficiently as possible. CostQuest appreciates the Senator’s data-driven approach to ensuring accountability for broadband spending across the government,”CostQuest Associates said.

    Background
    :

    The MAP for Broadband Funding Act provides fresh oversight for the FCC’s Broadband Funding Map to ensure the Map is functioning effectively, efficiently, and transparently as possible for the public, federal agencies, and broadband providers alike.

    To meet this goal, the bill:
     

    1. Directs the FCC to conduct a Notice of Inquiry on the Map’s function and data it displays for maximum usability, assessing any necessary updates from a user-experience perspective, and 
    1. Directs the Government Accountability Office (GAO) to evaluate how well federal agencies are populating the Map in compliance with current law, identifying any gaps in reporting for its optimum functionality. 

    MIL OSI USA News

  • MIL-OSI USA: “Free Money” Gang Members Indicted for Committing Murder at Local Shopping Center

    Source: US State of Vermont

    Two alleged members of Free Money, a violent Houston-based street gang, were indicted yesterday in the Southern District of Texas for their alleged roles in the murder of one individual and attempted murder of another during a gang-related ambush.

    According to court documents, Free Money members and associates engage in robbery, home invasions, drug distribution, and murder. The defendants, Terry Ardoin, 24, and Travonte Ardoin, 27, both of Houston, allegedly committed the murder in connection with an ongoing gang war with a rival group.

    On June 24, 2022, in broad daylight, surveillance footage captured the Ardoins following a Chevrolet Equinox into a shopping center parking lot in a Black Nissan Altima. As alleged in court documents, the driver of the Equinox entered a nearby store while the passenger remained in the vehicle. When the driver returned, the Ardoins allegedly exited the Altima wearing masks and opened fire on both individuals.

    Witnesses reported hearing numerous gunshots and described the distinct sound of a fully automatic weapon, believed to have been modified with a machine gun conversion device commonly referred to as a “switch.” 

    Multiple rounds struck the vehicle’s passenger compartment. Houston Police Department officers responded within minutes and found one victim deceased.

    Terry and Travonte Ardoin are charged with murder in aid of racketeering, attempted murder in aid of racketeering, use of a firearm in furtherance of a crime of violence and causing death through the use of a firearm. If convicted, they face a maximum penalty of life in prison or a death sentence. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

    The FBI conducted the investigation with the assistance of the Houston Police Department.

    Trial Attorney Ralph Paradiso of the Criminal Division’s Violent Crime and Racketeering Section (VCRS) and Assistant U.S. Attorney Benjamin Brown for the Southern District of Texas are prosecuting the case.

    This case is part of the Criminal Division’s Violent Crime Initiative to prosecute violent crimes in Houston. The Criminal Division and the U.S. Attorney’s Office for the Southern District of Texas have partnered, along with local, state, and federal law enforcement agencies, to confront violent crimes committed by gang members and associates through the enforcement of federal laws and use of federal resources to prosecute the violent offenders and prevent further violence.

    An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

    MIL OSI USA News