Written by Weizhi Deng, University of Iowa; Jun Wang, University of Iowa; and Meng Zhou, research scientist at the Goddard Earth Sciences and Technology Research Center II

For decades, the United States made steady progress in reducing surface ozone pollution, the main ingredient in smog. But that progress – achieved as vehicles, industries and power sources became cleaner – is increasingly being overshadowed by a different and growing source of ozone pollution: wildfires.

Our team of atmospheric and wildfire scientists analyzed wildfires’ contribution to surface ozone levels from 2003 to 2024 across the United States.

We found that the gases in wildfire smoke have reversed the national ozone trend, forcing a shift from declining ozone levels prior to 2015 to increasing ozone levels after 2015. We also found that the number of ozone-related premature deaths due to wildfires has been increasing by about 300 deaths per year since then.

Battling smog

Most people know ozone as the protective layer of the atmosphere high above the Earth that shields the planet from harmful ultraviolet radiation. But ozone has two very different faces.

High in the atmosphere, ozone is beneficial. Near the ground, it is a harmful air pollutant that can irritate the lungs and worsen respiratory diseases.

Los Angeles made ozone visible to the nation in the 1940s and 1950s, as thick, eye-stinging smog often blanketed the city. It turned an invisible chemistry problem into a public-health crisis people could see and feel. That crisis helped motivate decades of air pollution control efforts in California and, later, across the United States.

After the passage of the Clean Air Act and its amendments in the 1970s, the U.S. made steady progress in cleaning up surface ozone. Regulations on vehicles, power plants and industrial sources reduced emissions of nitrogen oxides and other ozone-forming chemicals.

To monitor the progress, the U.S. Environmental Protection Agency has over 1,000 stations that measure ozone around the country. They cover many places, but mostly urban areas, and do not measure ground-level ozone everywhere at the neighborhood scale.

We were able to fill in the gaps by combining those monitoring station measurements with satellite-derived information about air pollution and human activity, along with weather and air quality model simulations. We then used artificial intelligence to estimate daily surface ozone levels everywhere in the contiguous U.S., with data every square kilometer, over the past 22 years.

The results show that national progress in reducing surface ozone reversed around 2015 as North America began to face more severe wildfires. In many regions, ozone levels are now increasing, especially in the western U.S. and the Midwest, where smoke and gases from wildfires are becoming more common as they are transported through the air.

Overall, surface ozone levels that had been falling by about 0.65 part per billion per year from 2003–2015 have since increased by about 0.13 parts per billion per year. If wildfires hadn’t been an influence, we found, the trend of falling surface ozone levels would have continued instead.

People often think of wildfires as a problem for the western U.S., but smoke and gas pollutants from their emissions can travel thousands of miles, affecting communities far from the fires themselves.

The 2023 Canadian wildfires offered a vivid example. In much of the Midwest, ozone reached unhealthy levels for more than a week. The impact of wildfire smoke reached as far as Georgia and New York. That year, an additional 43 million Americans lived in areas with ozone exceeding healthy standards compared to previous years because of increased wildfire emissions.

As the Earth and its atmosphere warm, wildfire seasons are becoming longer and more severe across many parts of North America, and the trend is predicted to continue. In line with projections, Canada experienced its most devastating wildfire seasons on record in 2023 and 2025. In January 2025, destructive fires burned more than 16,000 homes and businesses in and around Los Angeles during a time of year when such events have historically been uncommon.

The shift toward more fires suggests that the rising ozone problem could become even greater in the future. That’s a problem for human health.

Reducing exposure to ozone and its health risks

People can reduce their exposure to ozone pollution by checking air quality forecasts and limiting outdoor activities when wildfires are sending smoke into the air. But protecting public health in the long run will require broader actions to reduce ground-level ozone itself.

That includes efforts to mitigate fire risk by improving wildfire management, such as reducing brush and other dry undergrowth that can fuel fires, and also scaling back the causes of rising global temperatures, such as the burning of fossil fuels. As temperatures rise, the ground loses moisture, creating conditions for more extreme fires.

Protecting public health also means strengthening air quality forecasting systems to provide accurate early warnings, so people can take precautions, and maintaining air pollution monitoring networks and investing in satellite sensors to continue measuring progress, so problems can be identified and fixed.

Weizhi Deng, Ph.D. Student in Atmospheric and Environmental Science, University of Iowa; Jun Wang, Professor of Chemical and Biochemical Engineering, University of Iowa, and Meng Zhou, Researcher in Atmospheric and Earth Sciences, University of Maryland, Baltimore County

This article is republished from The Conversation under a Creative Commons license. Read the original article and see more than 300 UMBC articles available in The Conversation.

Written by Kevin Omland, professor of biological sciences, UMBC

We humans have long viewed ourselves as the pinnacle of evolution. People label other species as “primitive” or “ancient” and use terms like “higher” and “lower” animals.

This anthropocentric perspective was entrenched in 1866, when German scientist Ernst Haeckel drew one of the first trees of life. He placed “Man,” clearly labeled, at the top. This illustration helped establish the popular view that we are the ultimate goal of evolution.

Modern evolutionary biology and genomics debunk that flawed perspective, showing there is no hierarchy in evolution. All species alive today, from chimpanzees to bacteria, are cousins that each have equally long lineages, rather than ancestors or descendants.

Unfortunately, these outdated notions remain prevalent in scientific journals and science journalism. In my new book, “Understanding the Tree of Life,” I explore why it is fundamentally misleading to view any current species as primitive, ancient or simple. As an evolutionary biologist, I offer an alternative view that emphasizes evolution’s complex, nonhierarchical, interconnected history.

Not primitive, just different

Egg-laying mammals, the monotremes, are frequently labeled the most “primitive” living mammals. This category includes the platypus and four species of echidnas. Indeed, their egg-laying is an ancient characteristic shared with reptiles.

But platypuses also have many unique recent adaptations that make them well suited to their lifestyle: They have webbed feet for swimming and a bill with specialized electroreceptors that detect prey in the mud. Males have spurs with venom that they can use to defend themselves against rivals. If you take a platypus’s view, they’re the pinnacle of evolution for their specific ecological niche.

Echidnas may seem primitive, especially because they lack a capability that humans have—giving birth to live young. Yet they possess many extraordinary traits that humans lack. Echidnas are known for their outer covering of protective spines. They also have powerful claws for digging, a sensitive beak and a long sticky tongue, all of which they use foraging for ants and termites. In a head-to-head competition foraging for prey in a termite mound, an echidna would easily outperform any human.

Other mammals native to Australia also turn up on lists of primitive mammals, such as many species of marsupials – pouched mammals, including kangaroos, koalas and wombats. These species generally give birth to small, minimally developed young that move to the mother’s pouch where they complete development. Pouch development may seem inferior to the human way, but it does have advantages. For example, kangaroos can simultaneously nurture young at three stages of development.

Evolutionary tree appearance depends on focus

Marsupials such as opossums, or monotremes such as the platypus, are often shown at the bottom or left side of an evolutionary tree. However, that does not mean that they are older, more primitive or less evolved.

Evolutionary trees—what scientists call phylogenies—show cousin relationships. Just as your second or third cousin is no more primitive than you are, it is misleading to think of a koala or echidna as primitive because of where they are depicted on these trees.

When scientists and journalists choose which species to include in the evolutionary trees in their publications, it can influence how the public perceives these species. But species shown lower on the page are not “lower” on some evolutionary scale.

Rather, they are placed there because the focus of many of those trees is on placental mammals, such as humans, other primates, carnivores, rodents and so on. When the focus is on placental mammals, it makes sense to include one or two species of marsupials as comparisons for reference.

In contrast, in a tree focused on marsupials, one or two placental mammals could be included at the bottom of the page for comparison.

Why understanding the tree of life matters

Viewing humans as the goal of evolution leads to a misunderstanding of the entire evolutionary process. Since evolution is the conceptual foundation for all biology, this flawed perspective can hinder all biological and biomedical science.

Mastering a modern understanding of evolutionary trees is crucial to advances in fields ranging from animal behavior and physiology to conservation and biomedicine. For example, because rhesus monkeys are much more closely related to us than are capuchins, rhesus monkeys are generally better subjects for preliminary tests of human vaccines. Opossums, incorrectly considered to be primitive, are a great species for providing a broader framework for studies of neurobiology and aging because they are distantly related to us, not because they are lower or more ancestral.

Grasping the profound reality that humans are not the pinnacle of evolution, but one branch among many, is foundational for all modern biology. Understanding the tree of life is central to fully embracing the shared modern status of all animals, from platypuses to people.

This article is republished from The Conversation under a Creative Commons license. Read the original article and see more than 300 UMBC articles available in The Conversation.

Written by Richard Forno, teaching professor in computer science and electrical engineering, UMBC

As the United States experiences its latest government shutdown, most of the daily operations of the federal government have ground to a halt. This includes much of the day-to-day work done by federal information technology and cybersecurity employees, including those at the nation’s leading civilian cybersecurity agency, the Cybersecurity and Infrastructure Security Agency.

CISA is among the entities that will see the deepest staffing reductions during the shutdown that began Oct. 1, 2025, according to Department of Homeland Security documentation. Only about one-third of its employees remain on the job after federal employees were furloughed. As if cybersecurity wasn’t challenging enough, fewer CISA employees are being asked to do more and more work protecting American cyberspace during the shutdown. And they’ll be working with the promise of getting paid for their efforts at some date in the future once the shutdown ends.

The current CISA situation is grim, from my vantage point as a cybersecurity researcher and former industry practitioner. The agency was already experiencing deep cuts to its staff and resources before the shutdown. And now, coinciding with the shutdown, a key law that enabled the agency to facilitate information-sharing with the private sector has expired.

Taken together, the cyberdefense agency is being hobbled at a time when the need for its services has never been greater, from the ongoing China-led Salt Typhoon attack on U.S. telecommunications networks to ransomware, data breaches and threats to infrastructure.

CISA was created in 2007 within the Department of Homeland Security. As its name implies, the agency is charged with digital security matters across the federal government. The agency also works with the companies that operate and secure the numerous critical infrastructure sectors of the American economy, such as phone networks, the electric grid and energy pipelines. Additionally, it helps state and local governments across the country secure their vulnerable networks and data.

CISA also publishes threat and vulnerability alerts for the government and cybersecurity community and engages with public and private stakeholders on best practices in response to emerging vulnerabilities. Prior to the recent expiration of the 2015 Cybersecurity Information Sharing Act, the agency also made it easier for organizations to share useful information with the government to help cybersecurity teams better protect their systems.

Political football

The agency takes a nonpartisan approach to cybersecurity matters. However, some politicians have accused the agency of political bias for its work helping states protect their voting infrastructure from cyberattacks and external influence. Specifically, the agency was repeatedly maligned for calling the 2020 election the “most secure” in history. For some in elected office, this work on election security has tarnished CISA’s reputation and perhaps explains recent budgetary actions taken against the agency.

Since the Trump administration took office in January 2025, nearly 1,000 CISA employees have departed the agency through voluntary buyouts or deferred resignations. By the end of May 2025, nearly all of CISA’s senior leadership had resigned or had announced plans to do so.

For 2026, the president’s draft budget proposes to reduce CISA’s head count by nearly one-third, dramatically cutting staff from its risk management and stakeholder engagement divisions. Other cuts will significantly reduce the agency’s collaboration activities and funding for CISA’s various cybersecurity education and training programs.

Making the problem worse, the government shutdown began at the same time that Congress failed to renew the Cybersecurity Information Sharing Act. This law provided a legal shield that allowed companies and infrastructure operators to share timely and often sensitive information with CISA about the cyberattacks, vulnerabilities and incidents that they were encountering.

In the wake of the law’s expiration, prudent companies may consider restricting what information they share with the government. Without the indemnification provided by CISA, many companies will likely have their legal teams review any information to be shared with the government. And that takes time.

Unfortunately, adversaries do not reduce their attacks against the U.S. based on available federal cyber defense funding or the status of cybersecurity laws. In fact, malicious hackers often strike when their target’s guard is down.

Charting a better course

Early in my career I had to work through a prolonged government shutdown. I’ve also participated in and developed assorted public-private information-sharing environments to exchange intelligence and analysis on cyber- and national security matters. And having been in the D.C. area for over 30 years, I’ve seen how government works. So I have a good idea of what’s needed to improve American cybersecurity. The following suggestions are a starting point.

First, Congress could ensure that critical security agencies such as CISA are immune from the threat of recurring federal government shutdowns. If it desired, Congress could set budgets for America’s security agencies on a biennial basis – as 16 states already do for their entire budgets.

In terms of cybersecurity funding, the White House’s proposed 2026 budget reduces research and education on cybersecurity. For example, the nation’s premiere federal cybersecurity scholarship program to recruit, educate and place future federal cybersecurity workers would be reduced by over 60%. Protecting this funding would allow CISA and the federal government to maintain the pipeline for a robust and capable cybersecurity workforce both today and into the future.

Companies could develop new or expand existing nongovernmental information-sharing networks that are not completely dependent on the government to facilitate or fund, such as the Cyber Threat Alliance or the Center for Internet Security. Cybersecurity relies on trust. But right now, the instability of the federal government makes it difficult to rely on any entity under its policy or funding influence, no matter how well time-tested and trusted. Regardless, without legal protections, the information-sharing utility of these services will be limited.

Cybersecurity risks remain even if the federal government shuts down. So this is another reminder that each of us is responsible for our own cybersecurity. Individual users should continue to remain vigilant, follow accepted best practices for cybersecurity and always be mindful about online risks.

It’s ironic that the federal government is shutting down, CISA is being eviscerated and the Cybersecurity Information Sharing Act has expired just as the country begins to observe national Cybersecurity Awareness Month – another collaborative public engagement activity that CISA promotes to help improve cybersecurity for all Americans.

This article is republished from The Conversation under a Creative Commons license. Read the original article and see more than 300 UMBC articles available in The Conversation.

Written by Adi Foord, assistant professor of physics, UMBC
This article is part of The Conversation‘s “Curious Kids” series.

How does the camera on the James Webb Space Telescope work and see so far out?
– Kieran G., age 12, Minnesota

Imagine a camera so powerful it can see light from galaxies that formed more than 13 billion years ago. That’s exactly what NASA’s James Webb Space Telescope is built to do.

Since it launched in December 2021, Webb has been orbiting more than a million miles from Earth, capturing breathtaking images of deep space. But how does it actually work? And how can it see so far? The secret lies in its powerful cameras – especially ones that don’t see light the way our eyes do.

I’m an astrophysicist who studies galaxies and supermassive black holes, and the Webb telescope is an incredible tool for observing some of the earliest galaxies and black holes in the universe.

When Webb takes a picture of a distant galaxy, astronomers like me are actually seeing what that galaxy looked like billions of years ago. The light from that galaxy has been traveling across space for the billions of years it takes to reach the telescope’s mirror. It’s like having a time machine that takes snapshots of the early universe.

By using a giant mirror to collect ancient light, Webb has been discovering new secrets about the universe.

A telescope that sees heat

Unlike regular cameras or even the Hubble Space Telescope, which take images of visible light, Webb is designed to see a kind of light that’s invisible to your eyes: infrared light. Infrared light has longer wavelengths than visible light, which is why our eyes can’t detect it. But with the right instruments, Webb can capture infrared light to study some of the earliest and most distant objects in the universe.

Although the human eye cannot see it, people can detect infrared light as a form of heat using specialized technology, such as infrared cameras or thermal sensors. For example, night-vision goggles use infrared light to detect warm objects in the dark. Webb uses the same idea to study stars, galaxies and planets.

Why infrared? When visible light from faraway galaxies travels across the universe, it stretches out. This is because the universe is expanding. That stretching turns visible light into infrared light. So, the most distant galaxies in space don’t shine in visible light anymore – they glow in faint infrared. That’s the light Webb is built to detect.

A golden mirror to gather the faintest glow

Before the light reaches the cameras, it first has to be collected by the Webb telescope’s enormous golden mirror. This mirror is over 21 feet (6.5 meters) wide and made of 18 smaller mirror pieces that fit together like a honeycomb. It’s coated in a thin layer of real gold – not just to look fancy, but because gold reflects infrared light extremely well.

The mirror gathers light from deep space and reflects it into the telescope’s instruments. The bigger the mirror, the more light it can collect – and the farther it can see. Webb’s mirror is the largest ever launched into space.

Inside the cameras: NIRCam and MIRI

The most important “eyes” of the telescope are two science instruments that act like cameras: NIRCam and MIRI.

NIRCam stands for near-infrared camera. It’s the primary camera on Webb and takes stunning images of galaxies and stars. It also has a coronagraph – a device that blocks out starlight so it can photograph very faint objects near bright sources, such as planets orbiting bright stars.

NIRCam works by imaging near-infrared light, the type closest to what human eyes can almost see, and splitting it into different wavelengths. This helps scientists learn not just what something looks like but what it’s made of. Different materials in space absorb and emit infrared light at specific wavelengths, creating a kind of unique chemical fingerprint. By studying these fingerprints, scientists can uncover the properties of distant stars and galaxies.

MIRI, or the mid-infrared instrument, detects longer infrared wavelengths, which are especially useful for spotting cooler and dustier objects, such as stars that are still forming inside clouds of gas. MIRI can even help find clues about the types of molecules in the atmospheres of planets that might support life.

Both cameras are far more sensitive than the standard cameras used on Earth. NIRCam and MIRI can detect the tiniest amounts of heat from billions of light-years away. If you had Webb’s NIRCam as your eyes, you could see the heat from a bumblebee on the Moon. That’s how sensitive it is.

Because Webb is trying to detect faint heat from faraway objects, it needs to keep itself as cold as possible. That’s why it carries a giant sun shield about the size of a tennis court. This five-layer sun shield blocks heat from the Sun, Earth and even the Moon, helping Webb stay incredibly cold: around -370 degrees F (-223 degrees C).

MIRI needs to be even colder. It has its own special refrigerator, called a cryocooler, to keep it chilled to nearly -447 degrees F (-266 degrees C). If Webb were even a little warm, its own heat would drown out the distant signals it’s trying to detect.

Turning space light into pictures

Once light reaches the Webb telescope’s cameras, it hits sensors called detectors. These detectors don’t capture regular photos like a phone camera. Instead, they convert the incoming infrared light into digital data. That data is then sent back to Earth, where scientists process it into full-color images.

The colors we see in Webb’s pictures aren’t what the camera “sees” directly. Because infrared light is invisible, scientists assign colors to different wavelengths to help us understand what’s in the image. These processed images help show the structure, age and composition of galaxies, stars and more.

By using a giant mirror to collect invisible infrared light and sending it to super-cold cameras, Webb lets us see galaxies that formed just after the universe began.

This article is republished from The Conversation under a Creative Commons license. Read the original article and see more than 300 UMBC articles available in The Conversation.

Written by Tania Lizarazo, associate professor of Latin American studies and global studies, UMBC

It’s been almost nine years since Colombia celebrated a landmark peace agreement between one guerrilla group and the government, and three years since President Gustavo Petro vowed “total peace.” But in reality, the country’s decades-long internal conflict continues – making it one of the oldest in the world.

Violence surged in early 2025, the most intense uptick in years. Fighting between two armed guerrilla groups in the northeastern Catatumbo region killed dozens of people and displaced tens of thousands more. Since the largest armed group – the Revolutionary Armed Forces of Colombia, known as FARC – signed the 2016 peace accord, more than 400 signatories have been killed. Meanwhile, more than 1,200 social leaders and human rights defenders have been assassinated.

We often define peace as the absence of war. The problem with thinking about peace and war as an all-or-nothing binary, however, is that it obscures the violence that takes place in “peaceful times.” For Colombians, that paradox is nothing new. In many communities most affected by the violence, thinking about a “post-conflict era” feels utopian.

As a Colombian researcher who has collaborated with Afro-Colombian leaders for over a decade, I have noticed that emphasizing peace talks and accords erases the historical violence that is still present, especially for racial minorities. Colombia has the largest Black population in Spanish-speaking Latin America. In Chocó – a region on the Pacific coast where I conducted my research – Afro-Colombians form a majority.

Communities there are contending not only with the contemporary conflict, but also ongoing challenges from the legacies of slavery, colonialism and extractive industries. Many residents, particularly women, work together every day to try to bring peace and justice within reach.

Rights vs. reality

Colombia has been mired in war for over six decades, as legal and illegal armed groups across the political spectrum fight for territories and resources. The conflict is estimated to have killed around 450,000 people and displaced around 7 million.

Black and Indigenous communities have disproportionately suffered the brunt of the war – especially in rural areas, where their lives and territories have been threatened by armed groups and companies alike. In Chocó Department, the site of my research, the region’s remoteness and biodiversity have attracted illegal groups and practices like drug trafficking, as well as mining and other types of resource extraction that threaten traditional livelihoods. Mercury from industrial mining poses an additional danger to people’s health and the environment.

Black rural communities in the Pacific lowlands, where most of Chocó is located, have a legal right to collective ownership of their territories and to be consulted about development plans. In reality, land grabs and targeted killings over illegal crops, mining and other extractive practices have become the norm here, as is true throughout rural Colombia.

The conflict has intensified racism and gender hierarchies, with Black women, particularly activists, especially vulnerable. Vice President Francia Márquez Mina, for example – who has won awards for her activism against illegal mining – survived an attack near her home in the nearby department of Cauca in 2019. She and her family have received other threats on their lives since then.

Building solidarity

Even in “postconflict” times, peace is a challenging task. It requires social change that does not happen overnight. Rather, it is the accumulation of tiny sparks in people’s daily commitments.

In my book “Postconflict Utopias: Everyday Survival in Chocó, Colombia,” I write about how Black women’s organizations care for their territories and communities. The “comisionadas,” for example, belong to one of the largest associations of community councils in rural Colombia, called COCOMACIA. These women travel the Atrato River and its tributaries to lead workshops about the organization, as well as territorial rights and women’s rights.

Everyone in the community is welcome to participate in dialogues about issues such as women’s political participation, land ownership and related legislation. Comisionada María del Socorro Mosquera Pérez, for example, wrote a song to share the importance of Law 1257, a landmark 2008 law against violence and discrimination against women.

In her story for the research project that I discuss in my book, “Mujeres Pacíficas,” comisionada Rubiela Cuesta Córdoba says it best: “The best legacy that one leaves to family and friends is resistance.”

One focus of these women’s groups’ work is the Atrato River itself. Since 2016, the same year of the peace accords, Colombian courts have recognized the river as a legal person, with rights to protection, conservation, maintenance and restoration.

The river is a source of food and transportation between many basin communities where potable water, electricity and other amenities are scarce. But it is also intertwined with politics and spirituality. Pilgrimages like “Atratiando,” a trip along the river and its tributaries that has taken place multiple times since 1999, highlight that there is no life without the river. Participants travel through areas where paramilitaries and guerrillas are active, showing solidarity with vulnerable communities.

COCOMACIA’s comisionadas are part of many other organizations – highlighting how survival is not only intertwined with lands and rivers, but other regions and countries. The struggle for women’s rights has led the comisionadas to collaborate with other organizations, creating wider networks of care. These include La Red Departamental de Mujeres Chocoanas, a feminist coalition of women’s organizations in Chocó; La Ruta Pacífica de las Mujeres, a feminist movement of 300 organizations from across Colombia; and Women in Black, an anti-militarism network with members in over 150 countries.

Their solidarity is a reminder that peace and justice are a collaborative, everyday effort. As Justa Germania Mena Córdoba, leader of the comisionadas at the time, told me in 2012: “One cannot change the world by herself.”

This article has been updated to correct the description of COCOMACIA.

This article is republished from The Conversation under a Creative Commons license. Read the original and see more than 250 UMBC articles available in The Conversation.

Written by Richard Forno, principal lecturer in computer science and electrical engineering, UMBC

Reports that prominent American national security officials used a freely available encrypted messaging app, coupled with the rise of authoritarian policies around the world, have led to a surge in interest in encrypted apps like Signal and WhatsApp. These apps prevent anyone, including the government and the app companies themselves, from reading messages they intercept.

The spotlight on encrypted apps is also a reminder of the complex debate pitting government interests against individual liberties. Governments desire to monitor everyday communications for law enforcement, national security and sometimes darker purposes. On the other hand, citizens and businesses claim the right to enjoy private digital discussions in today’s online world.

The positions governments take often are framed as a “war on encryption” by technology policy experts and civil liberties advocates. As a cybersecurity researcher, I’ve followed the debate for nearly 30 years and remain convinced that this is not a fight that governments can easily win.

Understanding the ‘golden key’

Traditionally, strong encryption capabilities were considered military technologies crucial to national security and not available to the public. However, in 1991, computer scientist Phil Zimmermann released a new type of encryption software called Pretty Good Privacy (PGP). It was free, open-source software available on the internet that anyone could download. PGP allowed people to exchange email and files securely, accessible only to those with the shared decryption key, in ways similar to highly secured government systems.

Following an investigation into Zimmermann, the U.S. government came to realize that technology develops faster than law and began to explore remedies. It also began to understand that once something is placed on the internet, neither laws nor policy can control its global availability.

Fearing that terrorists or criminals might use such technology to plan attacks, arrange financing or recruit members, the Clinton administration advocated a system called the Clipper Chip, based on a concept of key escrow. The idea was to give a trusted third party access to the encryption system and the government could use that access when it demonstrated a law enforcement or national security need.

Clipper was based on the idea of a “golden key,” namely, a way for those with good intentions – intelligence services, police – to access encrypted data, while keeping people with bad intentions – criminals, terrorists – out.

Clipper Chip devices never gained traction outside the U.S. government, in part because its encryption algorithm was classified and couldn’t be publicly peer-reviewed. However, in the years since, governments around the world have continued to embrace the golden key concept as they grapple with the constant stream of technology developments reshaping how people access and share information.

Following Edward Snowden’s disclosures about global surveillance of digital communications in 2013, Google and Apple took steps to make it virtually impossible for anyone but an authorized user to access data on a smartphone. Even a court order was ineffective, much to the chagrin of law enforcement. In Apple’s case, the company’s approach to privacy and security was tested in 2016 when the company refused to build a mechanism to help the FBI break into an encrypted iPhone owned by a suspect in the San Bernardino terrorist attack.

At its core, encryption is, fundamentally, very complicated math. And while the golden key concept continues to hold allure for governments, it is mathematically difficult to achieve with an acceptable degree of trust. And even if it was viable, implementing it in practice makes the internet less safe. Security experts agree that any backdoor access, even if hidden or controlled by a trusted entity, is vulnerable to hacking.

Competing justifications and tech realities

Governments around the world continue to wrestle with the proliferation of strong encryption in messaging tools, social media and virtual private networks.

For example, rather than embrace a technical golden key, a recent proposal in France would have provided the government the ability to add a hidden “ghost” participant to any encrypted chat for surveillance purposes. However, legislators removed this from the final proposal after civil liberties and cybersecurity experts warned that such an approach would undermine basic cybersecurity practices and trust in secure systems.

In 2025, the U.K. government secretly ordered Apple to add a backdoor to its encryption services worldwide. Rather than comply, Apple removed the ability for its iPhone and iCloud customers in the U.K. to use its Advanced Data Protection encryption features. In this case, Apple chose to defend its users’ security in the face of government mandates, which ironically now means that users in the U.K. may be less secure.

In the United States, provisions removed from the 2020 EARN IT bill would have forced companies to scan online messages and photos to guard against child exploitation by creating a golden-key-type hidden backdoor. Opponents viewed this as a stealth way of bypassing end-to-end encryption. The bill did not advance to a full vote when it was last reintroduced in the 2023-2024 legislative session.

Opposing scanning for child sexual abuse material is a controversial concern when encryption is involved: Although Apple received significant public backlash over its plans to scan user devices for such material in ways that users claimed violated Apple’s privacy stance, victims of child abuse have sued the company for not better protecting children.

Even privacy-centric Switzerland and the European Union are exploring ways of dealing with digital surveillance and privacy in an encrypted world.

The laws of math and physics, not politics

Governments usually claim that weakening encryption is necessary to fight crime and protect the nation – and there is a valid concern there. However, when that argument fails to win the day, they often turn to claiming to need backdoors to protect children from exploitation.

From a cybersecurity perspective, it is nearly impossible to create a backdoor to a communications product that is only accessible for certain purposes or under certain conditions. If a passageway exists, it’s only a matter of time before it is exploited for nefarious purposes. In other words, creating what is essentially a software vulnerability to help the good guys will inevitably end up helping the bad guys, too.

Often overlooked in this debate is that if encryption is weakened to improve surveillance for governmental purposes, it will drive criminals and terrorists further underground. Using different or homegrown technologies, they will still be able to exchange information in ways that governments can’t readily access. But everyone else’s digital security will be needlessly diminished.

This lack of online privacy and security is especially dangerous for journalists, activists, domestic violence survivors and other at-risk communities around the world.

Encryption obeys the laws of math and physics, not politics. Once invented, it can’t be un-invented, even if it frustrates governments. Along those lines, if governments are struggling with strong encryption now, how will they contend with a world when everyone is using significantly more complex techniques like quantum cryptography?

Governments remain in an unenviable position regarding strong encryption. Ironically, one of the countermeasures the government recommended in response to China’s hacking of global telephone systems in the Salt Typhoon attacks was to use strong encryption in messaging apps such as Signal or iMessage.

Reconciling that with their ongoing quest to weaken or restrict strong encryption for their own surveillance interests will be a difficult challenge to overcome.

This article is republished from The Conversation under a Creative Commons license. Read the original article and see more than 250 UMBC articles available in The Conversation.

Written by Manas Gaur, assistant professor in computer science and electrical engineering, UMBC

ChatGPT and other AI chatbots based on large language models are known to occasionally make things up, including scientific and legal citations. It turns out that measuring how accurate an AI model’s citations are is a good way of assessing the model’s reasoning abilities.

An AI model “reasons” by breaking down a query into steps and working through them in order. Think of how you learned to solve math word problems in school.

Ideally, to generate citations an AI model would understand the key concepts in a document, generate a ranked list of relevant papers to cite, and provide convincing reasoning for how each suggested paper supports the corresponding text. It would highlight specific connections between the text and the cited research, clarifying why each source matters.

The question is, can today’s models be trusted to make these connections and provide clear reasoning that justifies their source choices? The answer goes beyond citation accuracy to address how useful and accurate large language models are for any information retrieval purpose.

I’m a computer scientist. My colleagues − researchers from the AI Institute at the University of South Carolina, Ohio State University and University of Maryland Baltimore County − and I have developed the Reasons benchmark to test how well large language models can automatically generate research citations and provide understandable reasoning.

We used the benchmark to compare the performance of two popular AI reasoning models, DeepSeek’s R1 and OpenAI’s o1. Though DeepSeek made headlines with its stunning efficiency and cost-effectiveness, the Chinese upstart has a way to go to match OpenAI’s reasoning performance.

Sentence specific

The accuracy of citations has a lot to do with whether the AI model is reasoning about information at the sentence level rather than paragraph or document level. Paragraph-level and document-level citations can be thought of as throwing a large chunk of information into a large language model and asking it to provide many citations.

In this process, the large language model overgeneralizes and misinterprets individual sentences. The user ends up with citations that explain the whole paragraph or document, not the relatively fine-grained information in the sentence.

Further, reasoning suffers when you ask the large language model to read through an entire document. These models mostly rely on memorizing patterns that they typically are better at finding at the beginning and end of longer texts than in the middle. This makes it difficult for them to fully understand all the important information throughout a long document.

Large language models get confused because paragraphs and documents hold a lot of information, which affects citation generation and the reasoning process. Consequently, reasoning from large language models over paragraphs and documents becomes more like summarizing or paraphrasing.

The Reasons benchmark addresses this weakness by examining large language models’ citation generation and reasoning.

Testing citations and reasoning

Following the release of DeepSeek R1 in January 2025, we wanted to examine its accuracy in generating citations and its quality of reasoning and compare it with OpenAI’s o1 model. We created a paragraph that had sentences from different sources, gave the models individual sentences from this paragraph, and asked for citations and reasoning.

To start our test, we developed a small test bed of about 4,100 research articles around four key topics that are related to human brains and computer science: neurons and cognition, human-computer interaction, databases and artificial intelligence. We evaluated the models using two measures: F-1 score, which measures how accurate the provided citation is, and hallucination rate, which measures how sound the model’s reasoning is − that is, how often it produces an inaccurate or misleading response.

Our testing revealed significant performance differences between OpenAI o1 and DeepSeek R1 across different scientific domains. OpenAI’s o1 did well connecting information between different subjects, such as understanding how research on neurons and cognition connects to human-computer interaction and then to concepts in artificial intelligence, while remaining accurate. Its performance metrics consistently outpaced DeepSeek R1’s across all evaluation categories, especially in reducing hallucinations and successfully completing assigned tasks.

OpenAI o1 was better at combining ideas semantically, whereas R1 focused on making sure it generated a response for every attribution task, which in turn increased hallucination during reasoning. OpenAI o1 had a hallucination rate of approximately 35% compared with DeepSeek R1’s rate of nearly 85% in the attribution-based reasoning task.

In terms of accuracy and linguistic competence, OpenAI o1 scored about 0.65 on the F-1 test, which means it was right about 65% of the time when answering questions. It also scored about 0.70 on the BLEU test, which measures how well a language model writes in natural language. These are pretty good scores.

DeepSeek R1 scored lower, with about 0.35 on the F-1 test, meaning it was right about 35% of the time. However, its BLEU score was only about 0.2, which means its writing wasn’t as natural-sounding as OpenAI’s o1. This shows that o1 was better at presenting that information in clear, natural language.

OpenAI holds the advantage

On other benchmarks, DeepSeek R1 performs on par with OpenAI o1 on math, coding and scientific reasoning tasks. But the substantial difference on our benchmark suggests that o1 provides more reliable information, while R1 struggles with factual consistency.

Though we included other models in our comprehensive testing, the performance gap between o1 and R1 specifically highlights the current competitive landscape in AI development, with OpenAI’s offering maintaining a significant advantage in reasoning and knowledge integration capabilities.

These results suggest that OpenAI still has a leg up when it comes to source attribution and reasoning, possibly due to the nature and volume of the data it was trained on. The company recently announced its deep research tool, which can create reports with citations, ask follow-up questions and provide reasoning for the generated response.

The jury is still out on the tool’s value for researchers, but the caveat remains for everyone: Double-check all citations an AI gives you.

This article is republished from The Conversation under a Creative Commons license. Read the original article and see more than 250 UMBC articles available in The Conversation.

Written by Ming Xie, assistant professor of emergency health management and public health systems, UMBC.

Imagine a world in which a hurricane devastates the Gulf Coast, and the U.S. has no federal agency prepared to quickly send supplies, financial aid and temporary housing assistance.

Could the states manage this catastrophic event on their own?

Normally, the Federal Emergency Management Agency, known as FEMA, is prepared to marshal supplies within hours of a disaster and begin distributing financial aid to residents who need help.

However, with President Donald Trump questioning FEMA’s future and suggesting states take over recovery instead, and climate change causing more frequent and severe disasters, it’s worth asking how prepared states are to face these growing challenges without help.

What FEMA does

FEMA was created in 1979 with the job of coordinating national responses to disasters, but the federal government has played important roles in disaster relief since the 1800s.

During a disaster, FEMA’s assistance can begin only after a state requests an emergency declaration and the U.S. president approves it. The request has to show that the disaster is so severe that the state can’t handle the response on its own.

FEMA’s role is to support state and local governments by coordinating federal agencies and providing financial aid and recovery assistance that states would otherwise struggle to supply on their own. FEMA doesn’t “take over,” as a misinformation campaign launched during Hurricane Helene claimed. Instead, it pools federal resources to allow states to recover faster from expensive disasters.

During a disaster, FEMA:

• Coordinates federal resources. For example, during Hurricane Ian in 2022, FEMA coordinated with the U.S. Coast Guard, the Department of Defense and search-and-rescue teams to conduct rescue operations, organized utility crews to begin restoring power and also delivered water and millions of meals.
• Provides financial assistance. FEMA distributes billions of dollars in disaster relief funds to help individuals, businesses and local governments recover. As of Feb. 3, 2025, FEMA aid from 2024 storms included US$1.04 billion related to Hurricane Milton, $416.1 million for Hurricane Helene and $112.6 million for Hurricane Debby.
• Provides logistical support. FEMA coordinates with state and local governments, nonprofits such as the American Red Cross and federal agencies to supply cots, blankets and hygiene supplies for emergency shelters. It also works with state and local partners to distribute critical supplies such as food, water and medical aid.

The agency also manages the National Flood Insurance Program, offers disaster preparedness training and helps states develop response plans to improve their overall responses systems.

What FEMA aid looks like in a disaster

When wildfires swept through Maui, Hawaii, in August 2023, FEMA provided emergency grants to cover immediate needs such as food, clothing and essential supplies for survivors.

The agency arranged hotel rooms, rental assistance and financial aid for residents who lost homes or belongings. Its Direct Housing Program has spent $295 million to lease homes for more than 1,200 households. This comprehensive support helped thousands of people begin rebuilding their lives after losing almost everything.

FEMA also helped fund construction of a temporary school to ensure that students whose schools burned could continue their classes. Hawaii, with its relatively small population and limited emergency funds, would have struggled to mount a comparable response on its own.

Larger states often need help, too. When a 2021 winter storm overwhelmed Texas’ power grid and water infrastructure, FEMA coordinated the delivery of essential supplies, including water, fuel, generators and blankets, following the disaster declaration on Feb. 19, 2021. Within days, it awarded more than $2.8 million in grants to help people with temporary housing and home repairs.

Which states would suffer most without FEMA?

Without FEMA or other federal support, states would have to manage the disaster response and recovery on their own.

States prone to frequent disasters, such as Louisiana and Florida, would face expensive recurring challenges that would likely exacerbate recovery delays and reduce their overall resilience.

Smaller, more rural and less wealthy states that lack the financial resources and logistical capabilities to respond effectively would be disproportionately affected.

“States don’t have that capability built to handle a disaster every single year,” Lynn Budd, director of the Wyoming Office of Homeland Security, told Stateline in an interview. Access to FEMA avoids the need for expensive disaster response infrastructure in each state.

States might be able to arrange regional cooperation. But state-led responses and regional models have limitations. The National Guard could assist with supply distribution, but it isn’t designed to provide fast financial aid, housing or long-term recovery options, and the supplies and the recovery effort still come at a cost.

Wealthier states might be better equipped to manage on their own, but poorer states would likely struggle. States with less funding and infrastructure would be left relying on nonprofits and community-based efforts. But these organizations are not capable of providing the scope of services FEMA can.

Any federal funding would also be slow if Congress had to approve aid after each disaster, rather than having FEMA already prepared to respond. States would be at the mercy of congressional infighting.

In the absence of a federal response and coordinating role, recovery would be uneven, with wealthier areas recovering faster and poorer areas likely seeing more prolonged hardships.

What does this mean?

Coordinating disaster response is complex, the paperwork for federal assistance can be frustrating, and the agency does draw criticism. However, it also fills an important role.

As the frequency of natural disasters continues to rise due to climate change, ask yourself: How prepared is your state for a disaster, and could it get by without federal aid?

This article is republished from The Conversation under a Creative Commons license. Read the original article and see more than 250 UMBC articles available in The Conversation.

Written by Richard Forno, principal lecturer in computer science and electrical engineering, UMBC

The Department of Government Efficiency (DOGE), President Donald Trump’s special commission tasked with slashing federal spending, continues to disrupt Washington and the federal bureaucracy. According to published reports, its teams are dropping into federal agencies with a practically unlimited mandate to reform the federal government in accordance with recent executive orders.

As a 30-year cybersecurity veteran, I find the activities of DOGE thus far concerning. Its broad mandate across government, seemingly nonexistent oversight, and the apparent lack of operational competence of its employees have demonstrated that DOGE could create conditions that are ideal for cybersecurity or data privacy incidents that affect the entire nation.

Traditionally, the purpose of cybersecurity is to ensure the confidentiality and integrity of information and information systems while helping keep those systems available to those who need them. But in DOGE’s first few weeks of existence, reports indicate that its staff appears to be ignoring those principles and potentially making the federal government more vulnerable to cyber incidents.

Technical competence

Cybersecurity and information technology, like any other business function, depend on employees trained specifically for their jobs. Just as you wouldn’t let someone only qualified in first aid to perform open heart surgery, technology professionals require a baseline set of credentialed education, training and experience to ensure that the most qualified people are on the job.

Currently, the general public, federal agencies and Congress have little idea who is tinkering with the government’s critical systems. DOGE’s hiring process, including how it screens applicants for technical, operational or cybersecurity competency, as well as experience in government, is opaque. And journalists investigating the backgrounds of DOGE employees have been intimidated by the acting U.S. attorney in Washington.

DOGE has hired young people fresh out of – or still in – college or with little or no experience in government, but who reportedly have strong technical prowess. But some have questionable backgrounds for such sensitive work. And one leading DOGE staffer working at the Treasury Department has since resigned over a series of racist social media posts.

According to reports, these DOGE staffers have been granted administrator-level technical access to a variety of federal systems. These include systems that process all federal payments, including Social Security, Medicare and the congressionally appropriated funds that run the government and its contracting operations.

DOGE operatives are quickly developing and deploying major software changes to very complex old systems and databases, according to reports. But given the speed of change, it’s likely that there is little formal planning or quality control involved to ensure such changes don’t break the system. Such actions run contrary to cybersecurity principles and best practices for technology management.

As a result, there’s probably no way of knowing if these changes make it easier for malware to be introduced into government systems, if sensitive data can be accessed without authorization, or if DOGE’s work is making government systems otherwise more unstable and more vulnerable.

If you don’t know what you’re doing in IT, really bad things can happen. A notable example is the failed launch of the healthcare.gov website in 2013. In the case of the Treasury Department’s systems, that’s fairly important to remember as the nation careens toward another debt-ceiling crisis and citizens look for their Social Security payments.

On Feb. 6, 2025, a federal judge ordered that DOGE staff be restricted to read-only access to the Treasury Department’s payment systems, but the legal proceedings challenging the legality of their access to government IT systems are ongoing.

DOGE email servers

DOGE’s apparent lack of cybersecurity competence is reflected in some of its first actions. DOGE installed its own email servers across the federal government to facilitate direct communication with rank-and-file employees outside official channels, disregarding time-tested best practices for cybersecurity and IT administration. A lawsuit by federal employees alleges that these systems did not undergo a security review as required by current federal cybersecurity standards.

There is an established process in the federal government to configure and deploy new systems to ensure they are stable, secure and unlikely to create cybersecurity problems. But DOGE ignored those practices, with predictable results.

For example, a journalist was able to send invitations to his newsletter to over 13,000 National Oceanic and Atmospheric Administration employees through one of these servers. In another case, the way in which employee responses to DOGE’s Fork in the Road buyout offer to federal employees are collected could easily be manipulated by someone with malicious intent – a simple social engineering attack could wrongly end a worker’s employment. And DOGE staff members reportedly are connecting their own untrusted devices to government networks, which potentially introduces new ways for cyberattackers to penetrate sensitive systems.

However, DOGE appears to be embracing creative cybersecurity practices in shielding itself. It’s reorganizing its internal communications in order to dodge Freedom of Information Act requests into its work, and it’s using cybersecurity techniques for tracking insider threats to prevent and investigate leaks of its activities.

Lacking management controls

But it’s not just technical security that DOGE is ignoring. On Feb. 2, two security officials for the U.S. Agency for International Development resisted granting a DOGE team access to sensitive financial and personnel systems until their identities and clearances were verified, in accordance with federal requirements. Instead, the officials were threatened with arrest and placed on administrative leave, and DOGE’s team gained access.

The Trump administration also has reclassified federal chief information officers, normally senior career employees with years of specialized knowledge, to be general employees subject to dismissal for political reasons. So there may well be a brain drain of IT talent in the federal government, or a constant turnover of both senior IT leadership and other technical experts. This change will almost certainly have ramifications for cybersecurity.

DOGE operatives now have direct access to the Office of Personnel Management’s database of millions of federal employees, including those with security clearances holding sensitive positions. Without oversight, this access opens up the possibilities of privacy violations, tampering with employment records, intimidation or political retribution.

Support from all levels of management is crucial to provide accountability for cybersecurity and technology management. This is especially important in the public sector, where oversight and accountability is a critical function of good democratic governance and national security. After all, if people don’t know what you’re doing, they don’t know what you’re doing wrong.

At the moment, DOGE appears to be operating with very little oversight by anyone in position willing or able to hold it responsible for its actions.

Mitigating the damage

Career federal employees trying to follow legal or cybersecurity practices for federal systems and data are now placed in a difficult position. They either capitulate to DOGE staffers’ instructions, thereby abandoning best practices and ignoring federal standards, or resist them and run the risk of being fired or disciplined.

The federal government’s vast collections of data touch every citizen and company. While government systems may not be as trustworthy as they once were, people can still take steps to protect themselves from adverse consequences of DOGE’s activities. Two good starting points are to lock your credit bureau records in case your government data is disclosed and using different logins and passwords on federal websites to conduct business.

It’s crucial for the administration, Congress and the public to recognize the cybersecurity dangers that DOGE’s activities pose and take meaningful steps to bring the organization under reasonable control and oversight.

This article is republished from The Conversation under a Creative Commons license. Read the original article and see more than 250 UMBC articles available in The Conversation.

Written by Richard Forno, principal lecturer in computer science and electrical engineering, UMBC

Cyberattacks linked to the Chinese government that compromised large portions of the American telecommunications network have the U.S. government sounding the alarm. The chair of the Senate Intelligence Committee, Sen. Mark Warner (D-VA), has called it the “worst telecom hack in our nation’s history” and noted that it makes prior cyberattacks by Russian operatives look like “child’s play” by comparison.

The complex cyberattack, carried out by a group of Chinese hackers dubbed Salt Typhoon, began as far back as 2022. Its purpose, according to U.S. officials, was to give Chinese operatives persistent access to telecommunications networks across the U.S. by compromising devices like routers and switches run by companies like AT&T, Verizon, Lumen and others.

This attack comes on the heels of reports that the FBI and Cybersecurity and Infrastructure Security Agency were assisting telephone companies with countering other China-connected compromises of their networks. The earlier hacking was part of an attack targeting people in the Washington area in government or political roles, including candidates for the 2024 presidential election.

But Salt Typhoon is not just targeting Americans. Research from security vendor Trend Micro shows that attacks by Salt Typhoon compromised other critical infrastructure around the world in recent years. U.S. officials have confirmed these findings as well – and their level of concern is noteworthy.

Chinese officials have denied the allegations that they’re behind this operation, as they have in response to allegations about previous cyberattacks.

As a cybersecurity researcher, I find this attack is indeed breathtaking in its scope and severity. But it’s not surprising that such an incident took place. Many organizations of all sizes still fail to follow good cybersecurity practices, have limited resources, or operate IT infrastructures that are too complex to effectively monitor, manage and secure.

How bad is it?

Salt Typhoon exploited technical vulnerabilities in some of the cybersecurity products like firewalls used to protect large organizations. Once inside the network, the attackers used more conventional tools and knowledge to expand their reach, gather information, stay hidden and deploy malware for later use.

According to the FBI, Salt Typhoon allowed Chinese officials to obtain a large amount of records showing where, when and who specific individuals were communicating with. In some cases, they noted that Salt Typhoon gave access to the contents of phone calls and text messages as well.

Salt Typhoon also compromised the private portals, or backdoors, that telephone companies provide to law enforcement to request court-ordered monitoring of phone numbers pursuant to investigations. This is also the same portal that is used by U.S. intelligence to surveil foreign targets inside the United States.

As a result, Salt Typhoon attackers may have obtained information about which Chinese spies and informants counterintelligence agencies were monitoring – knowledge that can help those targets try to evade such surveillance.

On Dec. 3, the Cybersecurity and Infrastructure Security Agency, National Security Agency and FBI, along with their counterparts in Australia, New Zealand and Canada, released guidance to the public on how to address the Salt Typhoon attack. Their Enhanced Visibility and Hardening Guidance for Communications Infrastructure guide essentially reiterates best cybersecurity practices for organizations that could help mitigate the impact of Salt Typhoon or future copycat attacks.

It does, however, include recommendations to protect specific telecommunication equipment for some of the Cisco products that were targeted in this attack.

As of this writing, U.S. officials and affected companies have not been able to fully ascertain the scope, depth and severity of the attack – or remove the attackers from compromised systems – even though this attack has been ongoing for months.

What can be done?

U.S. officials have said that many of the ways Salt Typhoon penetrated its targets was through existing weaknesses with the infrastructure. As I’ve written previously, failing to implement basic cybersecurity best practices can lead to debilitating incidents for organizations of all sizes. Given how dependent the world is on networked information systems, it is more important than ever to maintain cybersecurity programs that make it difficult for attacks to succeed, especially for critical infrastructure like the phone network.

In addition to following the best practices guidance issued by the Cybersecurity and Infrastructure Security Agency earlier this week, organizations should remain vigilant. They should monitor not only the news for information about this attack but the various free, proprietary or private threat intelligence feeds and informal professional networks to stay up to date on attackers’ tactics and techniques – and ways to counter them.

Companies and governments should also ensure their IT departments and cybersecurity programs are adequately staffed and funded to meet their needs and ensure that best practices are implemented. The Federal Communications Commission is already threatening companies with fines for failing to bolster their defenses against Chinese hacking.

Although any illicit surveillance is concerning, the average American probably has little to worry about from Salt Typhoon. It’s unlikely that your family phone calls or text messages to friends are of interest to the Chinese government. However, if you want to increase your security and privacy a bit, consider using end-to-end encrypted messaging services like Signal, FaceTime or Messages.

Also make sure you’re not using default or easily guessed passwords on your devices, including your home router. And consider using two-factor authentication to further strengthen the security of any critical internet accounts.

Backdoors and bad guys

Lost in the noise of the story is that Salt Typhoon has proved that the decades of warnings by the internet security community were correct. No mandated secret or proprietary access to technology products is likely to remain undiscovered or used only by “the good guys” – and efforts to require them are likely to backfire.

So it’s somewhat ironic that one of the countermeasures recommended by the government to guard against Salt Typhoon spying is to use strongly encrypted services for phone calls and text messages – encryption capabilities that it has spent decades trying to undermine so that only “the good guys” can use it.

This article is republished from The Conversation under a Creative Commons license. Read the original article and see more than 300 UMBC articles available in The Conversation.