Policy Roast: CIRCIA's 72-Hour Reporting Window Is Already Obsolete
CISA's 72-hour incident reporting rule assumes breaches are discovered instantly. Reality: most take 200+ days to detect.
policy-roast
Policy Roast: WhatsApp's View Once Feature Has a Fourth Bypass and Meta Won't Fix It
When 'ephemeral' messaging requires trusting both the platform and every person you message with.
Policy Roast: JCPenney's AI Makeup Advisor Just Became a $50M BIPA Liability
Virtual try-on tech meets Illinois biometric law. JCPenney faces class action over facial scanning without consent. Again.
Policy Roast: AI Companies Pay $12.5M to Clean Up the Mess AI Created
Anthropic, OpenAI, Google, and Microsoft just funded open source security. Specifically, security from AI-generated vulnerability spam their tools created.
Policy Roast: When the Fine Is Just the Cost of Doing Business
A mobile carrier paid $60K for breaking international carrier rules. For context, that's less than one executive's quarterly bonus.
Policy Roast: Banning the Symptom While Missing the Disease
The EU added nudification tools to the AI Act ban list. Good. Now explain how you'll enforce it when the tools are free, open-source, and run locally.
Policy Roast: "Reasonable security" is doing a lot of work in California
California did what policymakers love to do: it shipped a compliance object that sounds precise, then hid the hard part in a word like \\\"reasonable.