Law & Policy on Rietta Cybersecurity

Threat Modeling for ADA/WCAG Compliance

Tue, 28 Jul 2026 14:00:00 +0000

Why Accessibility Belongs in Your Threat Model Most organizations treat digital accessibility as a content problem: someone finds a missing alt tag, fixes it, and moves on. I think that’s the wrong frame entirely. Digital accessibility is an organizational risk and governance gap, and once you see it that way, the right tool for the job isn’t a content checklist. It’s the same discipline we already use for application security: threat modeling and continuous technical monitoring.

The Five Pillars of Information Security (And Why We Audit Accessibility)

Sat, 25 Jul 2026 15:00:00 +0000

Rietta is a cybersecurity firm. So why have the last three posts on this blog been about missing document titles, undefined languages, and metadata fields in government PDFs? My reasoning comes down to this: accessibility failures are security failures, specifically, they’re availability failures, and detecting them at scale is exactly the discipline our industry already practices. To explain why, it helps to back up and lay out the actual model we use to reason about security in the first place.

Metadata in WordPerfect: ADA and WCAG 2.1 Compliance

Fri, 24 Jul 2026 10:00:00 +0000

Courts throughout the United States still use WordPerfect. So why is metadata still being ignored? In our work with State courts, we have come across WordPerfect files, or PDF documents generated from them, with metadata deficiencies: no title (or subject), no author, and so forth. Now that WCAG 2.1 requirements are enforced through ADA Title II, documents without sufficient metadata to assist a user with disabilities using assistive technology are non-conformant with federal law.

Real ADA Title II Findings for Government Documents

Tue, 07 Jul 2026 15:00:00 +0000

I recently wrote about the upcoming ADA Title II deadline for governments with 50k or more residents in their jurisdiction. Overview As we continue to work with Government organizations, Rietta is providing plain language reporting on the issues and tying them directly back to the requirements. Our reports cover a lot of ground, some of which is not talked about in accessibility circles quite enough. For example, we have a very strong argument that using the same title over and over again is not compliant even though accessibility vendors will do that as they seem to be looking at documents one at a time and not corpus wide.

297 Days: The Real ADA Title II Deadline for Government Documents

Fri, 03 Jul 2026 06:00:00 +0000

As a government agency, do you know how many of your documents will soon be a litigation risk under the ADA? In our cybersecurity work, Rietta has the pleasure of working with a number of government entity clients. In the last few years, a new risk has appeared linked with web content accessibility. Last year, we worked with one particular client to ensure their thousands of PDF documents were ready by the deadline with appropriate alternate content and an accommodation workflow.

Stop Thinking about GA SB 315 in Terms of "Digital Homes"

Wed, 25 Apr 2018 21:55:46 -0400

Throughout the public debate over Georgia SB 315, a bad analogy has been repeated by others that a public business or institution’s website server is like an online home. And, because nobody lets strangers just walk into their own home, Georgia should set the expectation that no one, criminal or ethical, should be allowed to come into an organization’s digital “home” without permission. But this analogy does not match reality!

Governor Deal, veto SB 315 because white hat security researchers should be thanked not jailed!

Thu, 19 Apr 2018 07:00:00 -0400

Friday, April 13, 2018

Governor Nathan Deal
Office of the Governor
206 Washington Street
111 State Capitol
Atlanta, Georgia 30334

Dear Governor Deal:

I am writing you today on behalf of my Georgia-based security firm, asking that you veto SB 315. I am a long term Georgia resident, raised in the Atlanta area, and earned a B.S. in Computer Science and an M.S. in Information Security at Georgia Tech. My wife Danielle is a Mercer University alumna, and we are both conservative Christians who voted for you. My interests in computer security started early after I founded AtlantaWebHost.com eighteen years ago and started to see first hand how websites and servers were under continuous attack by malicious hackers. This first hand experience was the catalyst for pursuing a career dedicated to protecting websites and web applications from attackers.

Georgia SB 315, set to criminalize most independent security threat research, heads to Georgia Governor Nathan Deal for signature or veto

Tue, 27 Mar 2018 13:55:53 -0400

This article has been updated since originally published to reflect the current status of SB 315, which is now heading to the Governor's desk.) The Georgia House of Representatives voted 107 to 63 to approve GA SB 315 (LC 29 8107S) (PDF / legis.ga.gov) on Tuesday, March 27, 2018, on the Senate voted 42 to 7 to accept the House changes in the last hours of the session on Thursday, March 29, 2018.

Georgia SB 315 anti-hacking law dangerously misses the mark of protecting people, making us all less safe

Mon, 26 Mar 2018 12:00:00 -0400

GA SB 315 (LC 29 8107S) (PDF / legis.ga.gov) just passed the House Judiciary Non-Civil Committee and will be voted on this week. While significantly improved through the committee process, it still creates a dangerously broad definition of Criminal Unauthorized Computer Access that is so sweeping, people will need permission before visiting any website.

This bill was drafted because Georgia law enforcement and the U.S. FBI could not find any law broken by a professional security researcher. This researcher tried to alert Georgia election officials of voter data inappropriately published publicly on the Internet by Kennesaw State University, a contractor for the Georgia Secretary of State’s Office. What he discovered through ordinary Google searching was that voters’ names, addresses, and other private information was indexed by Google and accessible by anyone. After months, he and another researcher discovered that the data was still available on the public Internet and brought it to the attention of the media. Only under the daylight of public attention was the data removed from the Internet in an embarrassing scandal.

Troubling ISP Privacy Repeal: The Data Will be Breached

Thu, 18 May 2017 11:59:59 -0400

Your Internet Service Provider has direct access to the type of information on you and your family that the National Security Agency uses for spying.

Your ISP knows when you are at home and when you are not, when your kids are doing their homework. They know or can know what you’re watching on Netflix (even when its encrypted) and YouTube. If any member of your household ever views pornographic content, your ISP knows how much and at what times such content is accessed. They can infer through traffic analysis how many people are living at your home and even know how many iPhone and Android devices that you have. And even though they cannot see into your encrypted search queries on Google, your ISP knows every medical website that you visited to research a condition that you think you have or are looking into a drug that your doctor has prescribed to you.

Americans' Access to Strong Encryption is at Risk, an Open Letter to Congress

Wed, 03 May 2017 19:34:59 -0400

Dear Honorable Members of the United States Congress:

I work in application security in the cybersecurity field to make software more secure from attack. The cybersecurity threats that face our nation are very important to my wife and me. As Americans, our private data is in great jeopardy because of increased cybersecurity threats. Our infrastructure is prone to being hacked, and major data breaches of both private and government networks are routinely in the news. The best way to prevent these breaches is to increase the use of strong encryption with no backdoors.

The track record of data breaches demonstrates an uncomfortable truth: when sophisticated adversaries want to hack a network, they will ultimately win. Among the few tools known to computer science that can prevent a data breach is strong encryption. This means that there is no backdoor and no backup key. Either the original user needs to enter the password, or the data is un-retrievable.

Calls to Ban Effective Encryption Continue Despite Data Breach Crisis

Fri, 22 Apr 2016 09:00:00 -0400

The continued calls for the U.S. Congress to ban effective encryption despite the current computer security crisis in which data breaches are regular news is dangerous, shortsighted, and destined to harm all Americans. The two most effective tools that we have capable of helping prevent data breaches are encryption and reducing the attack surface of computer systems that handle sensitive or private data. Under the proposed legal framework, both will be sacrificed for a false sense of safety.

The latest installment of Congressional hearings was held by the Energy and Commerce Committee on April 19, 2016, and was titled Deciphering the Debate Over Encryption: Industry and Law Enforcement Perspectives. The calls for Congress to ban effective encryption are repeated with little variance from the past. Some Members of Congress are expressing frustration that the debate is repeating itself without law enforcement suggesting any particular middle ground that would be workable for the tech community. But what is most chilling is that those in law enforcement continue to demand exceptional access despite years of back and forth and the parade of high profile data breaches both within government and the private sector. We’re losing the cybersecurity battle and the government is calling for a ban on one of the most effective tools that computer science has at its disposal.

U.S. Senate Bill Seeks to Ban Effective Encryption, Making Security Illegal

Fri, 08 Apr 2016 10:11:33 -0400

The anticipated Feinstein-Burr Compliance with Court Orders Act, an anti-security bill, would require the provision of data in an intelligible format to a government pursuant to a court order (scribd.com). A draft copy was uploaded by The Hill reporter Cory Bennett, though whether it has been submitted officially within the Senate is not yet clear (vice.com).

This bill essentially says you can not have any conversation or data exchange that the government can not access if it wants to. It is the legal culmination of what the FBI has been lobbying Congress for years. If Feinstein-Burr becomes law, it will be illegal to deploy strong encryption without key escrow maintained by each company. Cryptographers and computer scientists near-unanimously assert key backup systems are insecure at scale.

Wikipedia blackout tomorrow in protest to SOPA/PIPA

Tue, 17 Jan 2012 00:00:00 +0000

Tomorrow (Jan 18) Wikipedia will be shut down for 24 hours in protest of Congress’ continuation of consideration of the Stop Online Privacy Act (SOPA) and Protect IP Act (PIPA).

The Wikipedia blackout demonstrates the chilling nature of what can happen when websites can be shutdown on mere accusation without due process. The new requirements could even stifle early-stage investment in internet startup companies.