Every federal employee's smart card is about to get a second set of keys. @NIST ‘s working drafts for post-quantum PIV take a dual-stack approach, classical keys kept and ML-DSA and ML-KEM credentials added, which is the right design. What the drafts do not yet contain are the decisions, and the calendar does not wait: a PIV card can be valid for six years, and NIST's own transition plan expects today's public-key algorithms to be disallowed after 2035. A classical-only card issued in 2030 outlives the algorithms that make it work, so the parameters and interfaces need to be final by about 2027. My twelve comments answer the open questions NIST marked in the drafts: ML-DSA-65 and ML-KEM-768 as the baseline with the category 5 sets permitted; dates in the tables; precedence and key-separation rules for the dual stack; seed storage so twenty retired keys fit on the card; mandatory extended-length APDUs and a defined signing input; card authentication at the door with timing requirements; a post-quantum secure-messaging suite now rather than later, because PIN entry over contactless rides on ECDH today; PKI and validation in the same revision; an identifier registry built for the next transition; and no new freely readable objects that make a cardholder easier to track. Drafts: pages.nist.gov/piv-standards

NIST's rewrite of SP 800-82, the operational technology security guide, is a real improvement: restructured around CSF 2.0, new sections for building automation, food and agriculture, rail, maritime, and water, and an architecture chapter that endorses analog backups and out-of-band management. I filed twelve comments, in the letter and in NIST's template. Two gaps stood out. 1. The post-quantum transition gets eight lines in a 320-page guide, with no date, no algorithm, and no acquisition rule, for devices the draft itself says have life cycles measured in decades. A controller bought against this guide in 2027 will still be verifying firmware with an RSA signature in 2040; the root of trust is the one element a patch cannot migrate, and @NIST already has the signing schemes (LMS and XMSS under SP 800-208, ML-DSA under FIPS 204) that procurements should require now. 2. And biocontainment laboratories are absent entirely: the words biocontainment, biosafety, and BSL do not appear, yet a BSL-3 pressure cascade is building automation whose failure is a biosafety event. Also in the letter: the food and agriculture section's best sentence (ventilation shutoffs on circuits independent of the monitoring systems) promoted to a design principle, disease-control OT added, the radio layer answered rather than named, detection measured like surveillance (case definitions, denominators, false-positive rates, medians instead of means), consequence-first risk analysis, and zero trust kept out of every safety path. Draft: csrc.nist.gov/pubs/sp/800/82… #OTsecurity #ICS #criticalinfrastructure #NIST #postquantum #biosecurity #foodsecurity #biodefense

My Analysis & Perspective on Ebola: no US cases, and CDC assesses the likelihood of spread here as very low. Uganda’s exported chain closed in July. The DRC curve has been flat since June, not accelerating. Large and unresolved, but not a US emergency. Follow it closely. Don’t panic.