Get tomorrow's brief in your inbox
Today: The Supreme Court ruled in favor of a U.S. business seeking hundreds of millions from cruise lines that used Cuban docks confiscated in 1960, expanding liability under the Helms-Burton Act. Two Americans pleaded guilty to providing telecommunications services to India-based tech support scam centers that defrauded elderly victims of millions. Federal judge John Bates ordered Trump aides to comply with the Presidential Records Act, rejecting a DOJ opinion that claimed the 1978 law unconstitutionally intrudes on presidential power.
Two Americans plead guilty to supporting India-based tech support scam operation
Adam Young (42) and Harrison Gevirtz (33) pleaded guilty to misprision of a felony for providing telecommunications infrastructure to India-based tech support scammers from 2016 to 2022. The defendants operated C.A. Cloud Attribution, a U.S. tech firm that provided phone numbers, call routing services, and call tracking tools to scammers who targeted elderly and disabled Americans with fake malware pop-up messages. Prosecutors established that Young and Gevirtz learned their customers were conducting fraud in 2017 but continued service and advised scammers on detection avoidance techniques, including rotating large pools of telephone numbers on pop-up ads. The scheme defrauded Americans of millions in fake technical support services.
FCC Chairman Carr uses false immigrant fraud claims to restrict Lifeline broadband program
FCC Chairman Brendan Carr announced reforms to the Lifeline program, which provides $9.25 monthly subsidies for low-income Americans to afford broadband or phone service, claiming 116,000 dead people in California received federal dollars due to immigrant fraud. The California Public Utilities Commission confirmed Carr's claims were false: the 116,000 people died while enrolled in the program, and there was no evidence they were immigrants. Despite this, the FCC is proceeding with restrictions that will impose new participation barriers on a program where only 19-22% of eligible households currently enroll. Public Knowledge and the National Digital Inclusion Alliance filed complaints noting that historically, most Lifeline fraud has been committed by private companies (Q-Link 2025, Armstrong Group 2024, San Francisco whistleblower 2022), not subscribers.
European law enforcement dismantles First VPN service used by cybercriminals
European authorities dismantled First VPN, a service marketed on Russian-speaking cybercrime forums as a secure platform for criminals to evade law enforcement. The May 19-20 operation, led by France and the Netherlands, resulted in questioning of the administrator in Ukraine and seizure of 33 servers. Europol stated First VPN appeared in nearly every major cybercrime investigation it supported in recent years. Investigators obtained the service's user database, exposing thousands of users linked to ransomware attacks, fraud operations, and data theft. Authorities notified users they had been identified and the investigation is ongoing.
Supreme Court rules for Havana Docks in Cuban asset confiscation case (Havana Docks Corporation v. Royal Caribbean Cruises)
The Supreme Court ruled 8-1 that Havana Docks Corporation can pursue hundreds of millions of dollars from four cruise lines (Royal Caribbean, Norwegian, Carnival, MSC) that used Havana port facilities between 2016 and 2019. The case hinged on the 1996 Cuban Liberty and Democratic Solidarity Act (Helms-Burton Act), which allows U.S. nationals to sue anyone who traffics in property confiscated by Cuba after January 1, 1959. Justice Clarence Thomas wrote for the majority that "confiscated property" refers both to the plaintiff's specific interest in property and to the physical property itself, meaning the docks were "tainted" and off-limits such that anyone using them can be liable to those who had an interest in the property. The district court had awarded Havana Docks more than $400 million before the 11th Circuit reversed; the Supreme Court vacated the 11th Circuit decision and remanded for consideration of the cruise lines' other defenses.
Federal judge orders White House to comply with Presidential Records Act
U.S. District Judge John Bates ordered Trump administration aides to continue observing the Presidential Records Act, rejecting a Justice Department opinion that found the 1978 law unconstitutionally intrudes on presidential power. Bates granted a preliminary injunction that nullifies the DOJ opinion, writing that "the original public meaning of the text of the Constitution, canons of interpretation, Supreme Court precedent, general principles of property law, and almost 50 years of practice confirm that Congress has the enumerated power to regulate presidential records."
Supreme Court dismisses Alabama death penalty IQ dispute (Hamm v. Smith)
The Supreme Court dismissed Alabama's petition in Hamm v. Smith as "improvidently granted" in a 5-4 effective vote, leaving in place an 11th Circuit ruling that Joseph Smith is intellectually disabled under Atkins v. Virginia and cannot be executed. The case involved how courts should assess intellectual disability claims when a defendant has taken multiple IQ tests. Smith obtained five IQ scores ranging from 72 to 78. The 11th Circuit emphasized it had not thrown out Smith's death sentence simply because the margin of error for his lowest score (72) would put his IQ at 69, but rather based on the complete record including expert testimony on significantly subaverage intellectual function, significant deficits in adaptive behavior, and manifestation before age 18. Justice Alito wrote a 24-page dissent joined by Justice Thomas and partially by Chief Justice Roberts and Justice Gorsuch.
Supreme Court delays Trump-Carroll defamation case consideration for 11th time
The Supreme Court rescheduled consideration of President Trump's petition seeking review of the $5 million jury verdict in E. Jean Carroll's sexual abuse and defamation case for the 11th time. The case has been fully briefed since late January but continues to be postponed without explanation. Trump argues Carroll's lawyers should not have been allowed to introduce testimony by other women alleging assault and the 2005 "Access Hollywood" tape. The delay may be related to a separate defamation case involving an $83 million verdict where Trump has indicated plans to ask the Supreme Court for review and to have the U.S. government take his place in the lawsuit because he was president when he made the statements.
Ninth Circuit reverses dismissal of "naturally flavored" false advertising suit (Trammell v. KLN Enterprises, Inc.)
The Ninth Circuit reversed a Southern District of California dismissal and held that a plaintiff adequately alleged claims that a defendant falsely advertised licorice candy as "naturally flavored" when testing allegedly showed the product contained synthetic malic acid functioning as a flavor. The court held the complaint satisfied Rule 9(b) by alleging sufficient details about laboratory testing that detected artificial malic acid and by providing the essential fraud elements: who (defendant), what (representation the product was free of artificial colors and flavors), when (May 2023), where (Target store in Encinitas, California), and how (statements represented "naturally flavored"). The court distinguished Trammell from other malic acid cases where plaintiffs failed to state claims because they did not allege sufficient details about alleged laboratory testing. The court also held the plaintiff sufficiently alleged consumer fraud because a reasonable consumer is likely to be deceived by a product that claims to be free of artificial flavors when laboratory tests allegedly show that claim is not true.
More than 10,000 judges rule against Trump administration immigration detentions
Federal judges have ruled more than 10,000 times that Trump administration immigration detentions carried out with no opportunity for detainees to plead their case were illegal, representing roughly 90% of all such cases. The detentions have infuriated lower courts across multiple jurisdictions and appointments spanning multiple administrations. Trump administration officials attributed their losses to "the left and their activist proxies on the judiciary" and predicted they will prevail at the Supreme Court. A Justice Department spokesperson stated "the law is not a popularity contest among judges."
SEC two-year update on Form 8-K cybersecurity incident disclosure practices
Two years after the SEC's May 21, 2024 clarification on using Item 1.05 of Form 8-K for material cybersecurity incident disclosures, voluntary Item 8.01 filings (where materiality has not yet been determined) have significantly outpaced Item 1.05 filings (for material incidents). Since the May 2024 guidance, 29 issuers have made Item 1.05 filings and 50 issuers have made Item 8.01 filings. Only five issuers disclosed under both items; each initially used Item 8.01 and later filed under Item 1.05 after determining materiality. Most incidents disclosed under Item 8.01 have not subsequently resulted in Item 1.05 filings. The May 2024 guidance clarified that Item 1.05 is intended for incidents a registrant has determined are material, while Item 8.01 is appropriate for voluntary disclosures where materiality has not been determined. Post-guidance, registrants are using Item 1.05 more consistently only for incidents where they have reached a definitive materiality conclusion.
CISA creates public nomination form for Known Exploited Vulnerabilities catalog
The Cybersecurity and Infrastructure Security Agency (CISA) announced a new nomination form enabling researchers, vendors, and industry partners to report bugs to its Known Exploited Vulnerabilities (KEV) catalog. Experts can submit vulnerabilities through the form or via email and must provide information about the bug and evidence of its exploitation. The KEV catalog provides federal cybersecurity defenders with an authoritative list of software and hardware vulnerabilities requiring remediation within three weeks. Organizations remediate vulnerabilities added to the KEV 3.5 times faster than non-KEV bugs. The catalog has become critical as defenders contend with a growing deluge of AI-discovered vulnerabilities, many of which are insignificant and unlikely to be exploited.
UK regulator secures commitments from tech platforms to protect children online
Ofcom, the UK communications regulator, secured commitments from Snap, Roblox, and Meta to make platform changes to better protect children after requiring six tech companies to answer questions about efforts to remove harmful algorithms, verify ages, and protect children from sexual predators by end of April. Snap will adopt every recommended grooming protection step in the Illegal Harms Codes, restricting how adults can contact children and stopping prompts for children to connect with unknown people. Roblox will give parents the ability to turn off direct chats for children under 16. Meta will hide teens' connection lists on Instagram by default and use AI to detect sexualized conversations between adults and teens in Instagram direct messages, reporting offenses to the National Center for Missing and Exploited Children. The new protections apply only to UK users. Ofcom stated it was not satisfied with responses from TikTok and YouTube, which "failed to commit to any significant changes" and maintained their feeds are already safe for children.
UK cybercrime law reform proposals offer limited protections for security researchers
The UK government's plans to reform the Computer Misuse Act 1990 would provide such narrow legal protections that most security researchers would remain in the same position as today, according to sources briefed on the proposals. The statutory defense would be restricted only to cases where researchers are prosecuted for scanning internet-facing systems and would require researchers to cease activity the moment a vulnerability is identified, meaning they could not confirm it was real, assess severity, or determine exploitability. The defense would be limited to British nationals holding accreditations with the UK Cyber Security Council, currently around 300 people (0.4% of nearly 70,000 sector professionals). The reforms exclude bug bounty hunters, academic researchers, hobbyists, and professionals at smaller businesses. Security Minister Dan Jarvis had pledged in December 2024 to introduce a statutory defense protecting researchers "as long as they meet certain safeguards."
Senate bill to end U.S. involvement in Iran war gains support after Louisiana primary
Senator Bill Cassidy (R-LA) voted to advance a Senate measure to end U.S. involvement in the war with Iran until the Trump administration obtains congressional authorization, the first time he has supported the bill after repeatedly voting no. Cassidy lost his primary for renomination over the weekend after facing opposition from President Trump. Cassidy stated, "While I support the administration's efforts to dismantle Iran's nuclear program, the White House and Pentagon have left Congress in the dark on Operation Epic Fury. In Louisiana, I've heard from people, including President Trump's supporters, who are concerned about this war. Until the administration provides clarity, no congressional authorization or extension can be justified." The bill would still need to pass the Republican House and survive a presidential veto.
Congress demands telecom anti-scam accountability from AT&T, T-Mobile, Verizon
U.S. Congress Joint Economic Committee Chairman David Schweikert (R-AZ) and Ranking Member Maggie Hassan (D-NH) sent a letter to AT&T, T-Mobile, and Verizon demanding detailed information about company efforts to identify and curb scam calls and texts. The letter noted Americans received 52.5 billion robocalls in 2025 and recent FTC studies show calls and texts were the most common ways scammers contacted victims. Median losses for phone scams were $1,835 and $1,000 for text-based scams. "Consumers need to be able to trust that the calls and texts they receive from their doctor's office or their child's school, for example, are authentic," the lawmakers stated. "Scam communications, however, are increasingly difficult to distinguish from legitimate messages, and too much of the burden of detection is falling on customers."
Remediate KEV vulnerabilities within three weeks. CISA's Known Exploited Vulnerabilities catalog now accepts public nominations. Federal contractors under BOD 22-01 must meet KEV remediation deadlines. Private sector organizations should prioritize KEV-listed bugs over non-KEV vulnerabilities, which are remediated 3.5 times slower.
File cybersecurity incidents under Item 8.01 when materiality is undetermined. SEC guidance clarifies Item 1.05 is for material incidents only. If you file under Item 8.01 and later determine materiality, file Item 1.05 within four business days of that determination. Most Item 8.01 filings do not result in subsequent Item 1.05 filings.
Verify "naturally flavored" claims with laboratory testing. The Ninth Circuit ruling in Trammell requires plaintiffs to support false advertising claims with lab test evidence of artificial ingredients. Food manufacturers must conduct testing to confirm no detectable artificial acids (malic, citric) are present when making "naturally flavored" claims.
Prepare for FCC Lifeline restrictions and enhanced telecom fraud controls. Telecommunications providers should implement customer due diligence protocols that flag high-volume telephone number rotation and pop-up ad-linked number pools. Review Lifeline participation verification systems and ensure fraud detection targets provider-side abuse.
Assess Cuban asset exposure under expanded Helms-Burton liability. The Supreme Court's Havana Docks ruling establishes that physical property confiscated by Cuba after January 1, 1959 is "tainted" and creates liability for anyone who uses it, even if the original plaintiff's property interest would have expired. Conduct due diligence on Cuban facilities and infrastructure.