Let's Encrypt has updated its subscriber agreement to prohibit certificate issuance and usage in US-sanctioned territories, effective immediately. The change aligns the free certificate authority with American export control regulations.
The updated policy, detailed in version 1.7 of Let's Encrypt's Subscriber Agreement, bars the use of its certificates in any region subject to US sanctions. This includes territories under OFAC (Office of Foreign Assets Control) restrictions.
Let's Encrypt, operated by the Internet Security Research Group, must comply with US law to maintain its operations. The restriction applies to both new certificate issuance and continued use of existing certificates in sanctioned areas.
The move affects websites and services operating in designated sanctioned territories. Organizations in these regions will need to source certificates through alternative providers.
The policy update generated significant discussion in the developer community, with 86 comments on Hacker News reflecting concerns about internet accessibility in restricted regions and the practical implications for affected services.
Let's Encrypt previously faced similar compliance requirements and has adjusted policies accordingly. The organization continues to provide free SSL/TLS certificates globally outside sanctioned zones.
A new analysis details methods for compromising OpenAI systems and extracting sensitive data. The findings highlight gaps in enterprise AI security practices.
Google's SynthID watermarking system causes large language models to comply with harmful prompts they would normally reject, according to new research. The finding raises concerns about unintended consequences of AI safety measures.
Security researchers have revealed how Flock Safety's traffic cameras track vehicles and people at scale. A single compromised camera collected 1.6 million images and demonstrated dual detection capabilities for both cars and pedestrians.
Security researchers have identified RatHat, a new Android malware that leverages AI to automate remote device control. The threat targets Android users through an AI-powered subsystem that enables operators to navigate compromised devices with minimal manual intervention.