Plus: Russian spies keep hijacking other hackers’ infrastructure, Hydra dark web market admin gets life sentence in Russia, and more of the week’s top security news.

A consortium of global law enforcement agencies led by Britain’s National Crime Agency announced a takedown operation this week against two major Russian money-laundering networks that process billions of dollars each year in more than 30 locations around the world. WIRED had exclusive access to the investigation, which uncovered new and troubling laundering techniques, particularly schemes to directly change cryptocurrency for cash. As the United States government scrambles to address China’s “Salt Typhoon” digital espionage campaign into US telecoms, two senators demanded this week that the Department of Defense investigate its failure to secure its own communications and address known vulnerabilities in US telecom infrastructure. Meanwhile, Signal Foundation president Meredith Whittaker spoke at WIRED’s The Big Interview event in San Francisco this week about Signal’s enduring commitment to bring private, end-to-end encrypted communication services to people all over the world regardless of geopolitical climate.

A new smartphone scanner from the mobile device security firm iVerify can quickly and easily detect spyware and has already flagged seven devices infected with the invasive Pegasus surveillance tool. Programmer Micah Lee built a tool to help you save and delete your X posts after he offended Elon Musk and was banned from the platform. And privacy advocate Nighat Dad is fighting to protect women from digital harassment in Pakistan after escaping from an abusive marriage.

The US Federal Trade Commission is targeting data brokers who it says unlawfully tracked protesters and US military personnel, but the enforcement efforts seem likely to trail off under the Trump administration. Similarly, the US Consumer Financial Protection Bureau has devised a strategy to impose new oversight on predatory data brokers, but the new administration may not continue the initiative. Some new laws are finally coming around the world in 2025 that will attempt to regulate the dysfunction of the digital advertising industry, but malicious advertising is still booming around the world and continues to play a big role in global scamming.

And there’s more. Each week, we round up the security and privacy news we didn’t cover in-depth ourselves. Click the headlines to read the full stories. And stay safe out there.

**US Officials Urge Americans to Encrypt Calls and Texts After Chinese Telecom Hacking**

Remember how the US federal government spent much of the last three decades periodically decrying the dangers of strong, freely available encryption tools, arguing that because they enable criminals and terrorists, they should be outlawed or required to implement government-approved backdoors? As of this week, the government will never again be able to make that argument without privacy advocates pointing to a particular phone call where two officials recommended Americans use exactly those encryption tools to protect themselves amidst an ongoing massive breach of US telecoms by Chinese hackers.

In a briefing with reporters about the breach of no fewer than eight phone companies by the Chinese state-sponsored espionage hackers known as Salt Typhoon, officials from the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI both said that amid the still-uncontrolled infiltration of US telecoms that have exposed calls and texts, Americans should use encryption apps to safeguard their privacy. “Encryption is your friend, whether it’s on text messaging or if you have the capacity to use encrypted voice communication,” said Jeff Greene, CISA’s executive assistant director for cybersecurity. (Signal and WhatsApp, for instance, end-to-end encrypt calls and texts, though the officials didn’t name any particular apps.)

The recommendation amid what one senator has called “the worst telecom hack in our nation’s history” represents a stunning reversal from previous US officials’ rhetoric on encryption, and in particular the FBI’s repeated calls for access to backdoors in encryption. In fact, it was exactly this sort of government-approved wiretap capability requirement for US telecoms that the Salt Typhoon hackers in some cases exploited to access Americans communications.

**Russia’s FSB Hackers Keep Hijacking Other Hackers’ Infrastructure for Spying**

The hacker group known as Secret Blizzard, Snake, or Turla, widely believed to work for Russia’s FSB intelligence agency, is known for using some of the most ingenious hacking techniques ever seen to spy on its victims. One of the tricks that’s now become its signature move: hacking the infrastructure of other hackers to stealthily piggyback on their access. This week Microsoft’s threat intelligence researchers and security firm Lumen Technologies revealed that Turla gained access to the servers of a Pakistan-based hacker group and used its visibility into victim networks to spy on government, military and intelligence targets in India and Afghanistan of interest to the Kremlin. In some cases, Turla hijacked the Pakistani hackers’ access to install their own malware, while in other instances they appear to have used the other group’s tools for even greater stealth and deniability. The incident marks the fourth known time since 2017, when it penetrated an Iranian hacker group’s command-and-control servers, that Turla has freeloaded on another hacker group’s infrastructure and tooling, according to Lumen.

**Admin of Russian Dark Web Market Hydra Sentenced to Life in Prison**

The Russian government is known for turning a blind eye to cybercrime—until it doesn’t. This week 15 convicted members of the notorious dark web market Hydra learned the limits of that forbearance when they reportedly received prison sentences ranging from 8 years to 23 years, as well an unprecedented life sentence for the site’s creator Stanislav Moiseyev. Before it was taken down two years ago in a law enforcement operation led by IRS criminal investigators in the US and Germany’s BKA police agency, Hydra was a uniquely sprawling dark web marketplace, one that not only served as the post-Soviet world’s biggest online bazaar for narcotics but also a vast money laundering machine for crimes including ransomware, scams, and sanctions evasion. In total, Hydra enabled more than $5 billion dollars in dirty cryptocurrency transactions since 2015, according to crypto tracing firm Elliptic.

**Suspected Ransomware Actor “Wazawaka” Reportedly Charged and Apprehended by Russia**

Russian law enforcement charged and arrested a software developer last week who is suspected of prolific contributions to multiple ransomware groups, including building malware to extort money from businesses and other targets. The suspect is reportedly Mikhail Matveev, or “Wazawaka,” who has worked as an affiliate with ransomware gangs like Conti, LockBit, Babuk, DarkSide, and Hive. Social media reports indicate that Matveev confirmed his indictment and said that he has been released from law enforcement custody on bail.

Russia’s prosecutor general did not name Matveev, but described charges last week against a 32-year-old hacker under Article 273 of Russia’s Criminal Code, which bans the creation or use of malware. The move came as Russia seemed to be sending some sort of message about its tolerance for cybercrime with the sentencing of the dark web marketplace Hydra’s staff, including a life sentence for its administrator. In 2023, the US government indicted and sanctioned Matveev.

**FBI Is Investigating Exxon Lobbyist Firm Over Hack-and-Leak Operation Targeting Activists**

In a disturbing scoop (one we didn’t cover last week due to the Thanksgiving holiday), Reuters reporters have revealed that the FBI is now investigating a lobbying consultancy hired by Exxon over the firm’s role in a hack-and-leak operation that targeted climate change activists. DCI Group, a lobbying firm hired at the time by Exxon, allegedly gave a list of target activists to a private investigator who then outsourced a hacking operation against those targets to mercenary hackers. After the private investigator—an Israeli man named Amit Forlit, who was later arrested in London and faces US hacking charges—allegedly gave the hacked material to DCI, it leaked the activists’ internal communications about climate change litigation against Exxon to the media, Reuters discovered. The FBI, according to Reuters, has determined that DCI also first previewed that material to Exxon before leaking it. “Those documents were directly employed by Exxon to come after me with all guns blazing,” one attorney working with the activist group, the Center for Climate Integrity, told Reuters. “It turned my life upside down.”

Exxon has denied knowing about any hacking activities and DCI told Reuters in a statement that “we direct all our employees and consultants to comply with the law.”

US Officials Recommend Encryption Apps Amid Chinese Telecom Hacking

The new film about an FBI agent chasing a white supremacist terror cell is based on a true story—and one that connects the headlines of 30 years ago to those of today.

In _The Order,_ director Justin Kurzel’s electric new film, Terry Husk, a haggard, possessed FBI veteran played by Jude Law, pores over a thin paperback with a blood-red cover, paging through diagrams of targeted killings, bombings, and a gallows erected in front of the United States Capitol.

“There are six steps in that book,” says a young sheriff deputized as his assistant, played by Tye Sheridan. He gives the Cliff Notes version as he scours the book, his eyes riveted.

“Recruiting,” he says. “Fundraising. Armed revolution. Domestic terror. Assassination.

“Number six is the day of the rope.”

The book is _The Turner Diaries_, a 1978 novel that depicts the violent overthrow of the American government by armed white supremacist insurgents and the extermination of people of color and Jews in a race war. Photocopied pages from it were found in Oklahoma City bomber Timothy McVeigh’s getaway car when he was apprehended by law enforcement.

Along with Husk and Bob Mathews—the founder of a murderous underground white supremacist guerrilla outfit that counterfeited money and robbed banks and armored cars, played by Nicholas Hoult—_The Turner Diaries_ is the third major character in _The Order_. Though Mathews formally named his group the Silent Brotherhood and claimed he took little inspiration from William Luther Pierce’s incendiary novel, he and his comrades did refer to their group as “The Order”—the same term used in the book for the protagonist’s genocidal militants.

The book’s crimson cover and lurid drawings resurface time and time again. Mathews reads excerpts to his young son before bedtime; a pastor at a neo-Nazi compound in Idaho proffers it to visiting law enforcement agents; and it turns up in the hands of FBI agents desperately seeking to plot out the insurgents’ next moves.

_The Order_ unearths a critical chapter in the history of the American extreme right largely forgotten by the general public. The murder of Jewish talk radio host Alan Berg in 1984 by two of Mathews’ acolytes brought the Order to national attention 30 years ago and inspired not one but two Hollywood films in that decade—_Betrayed_ and Oliver Stone’s _Talk Radio_. Since then, though, only close observers of prison gang and skinhead culture have had cause to track mentions of the Silent Brotherhood by tweaked-out Aryan Brotherhood killers or the annual “Martyrs Day” pilgrimage of Hammerskins from across the West Coast to Whidbey Island in the Puget Sound, where Mathews met his fiery death during a shootout with the FBI.

Now, as the country ponders a return to the 2016-2020 period, when Mathews’ ideological offspring ran riot from Oregon to Washington, DC, his saga is getting marquee billing.

While the film debuts almost a full decade into the American extreme right’s current revival, screenwriter Zach Baylin and producer Bryan Haas began developing the project back in 2016, before the deadly 2017 Unite the Right rally in Charlottesville, Virginia. Baylin tells WIRED that he and Haas stumbled on _The Turner Diaries_ while researching Ruby Ridge, the 1990s militia movement, and McVeigh (who slept with the book under his pillow) and casting around for a lesser-known story to explore the origins of American extremism.

“We were looking to encase the story of one of these groups inside a classic crime thriller,” Baylin says. They stumbled across _The Silent Brotherhood_, a 1989 book by reporters Kevin Flynn and Gary Gerhardt that traced the entire arc of Mathews’ crime spree, from his teenage radicalization through the John Birch Society and Phoenix militias all the way through his death and the subsequent criminal trials of his followers.

“The crimes the Order committed and the way the investigation unfolded, it had the framework of the kind of film that we’d been talking about,” he said.

Flynn and Gerhart’s book, which began with their coverage of Berg’s assassination in his driveway and followed the Order’s saga through the federal pursuit, investigation, and prosecution, is remarkably detailed. Once members of the group were up for trial, Flynn and Gerhart spent hours interviewing them in the Arapahoe County jail, gathering priceless material that allowed them to reconstruct the terrorist group’s inner workings in minute detail. Readers of the book, which is back in print (with a new title) after three decades off the shelves, will note the film’s fidelity to life, particularly in the robbery and heist scenes. However, for Flynn and Gerhardt—who died in 2015—the minutiae of Mathews’ terror campaign were a mechanism to engage audiences with a deeper, darker reality.

“We didn’t write the book for the details. We wrote it to expose the banality of evil, so readers could understand where these folks come from and how endemic it is in American society,” says Flynn, who reported for the Rocky Mountain News for nearly three decades before it shuttered in 2009. Since 2015, he has served as a city councilman in Denver.

_The Order_ is the sort of film America does not produce anymore. Its taut action scenes hearken back to _Heat_, _To Live and Die in L.A._, _The French Connection_, and Sidney Lumet’s police corruption canon (_Serpico_, _Prince of the City_, _Q&A_); the droning soundtrack does not overwhelm viewers; and Adam Arkapaw’s washed-out cinematography encapsulates both the grandeur and the intimidating solitude of the interior Pacific Northwest. The dialog is sparing, direct, and—in spite of Mathews’ grandiose promises of a renewed whites-only bastion in the Pacific Northwest—remarkably free of proselytizing.

For a movie shot in such wide-open landscapes, _The Order_ is tinged through with claustrophobia, a testament to the tension rife throughout Baylin’s writing and Kurzel’s meticulous direction. Like Al Pacino and Robert DeNiro in Michael Mann’s _Heat_, Hoult and Law only come face to face with each other a few times before their penultimate confrontation. However, Kurzel had both actors follow each other for a day and compile dossiers on their opposite number to develop a granular sense of how a manhunt actually functions.

“I wanted them to ask themselves, what does that feel like having a relationship with someone you’re trying to take down? You’re living with a phantom, in a way,” Kurzel says.

Law, whose slow-burn performance is unlike any prior role from his four decades on stage and screen, says the similarities between Husk and Mathews as two opposites of the same coin are at the core of _The Order_’s dramatic tension.

“They’re more alike than they’d ever admit—both are driven, charismatic, and know exactly how to manipulate those around them to achieve their goals,” he says. “Nicholas and I really leaned into that symmetry during our scenes together. It’s almost like they’re looking into a dark mirror—each recognizing qualities in the other that they either admire or fear. That underlying connection adds layers to their conflict, making it not just a clash of ideologies but also a deeply personal battle. It was fascinating to explore that tension with Nicholas.”

Mathews’ brief campaign of armed insurgency and domestic terrorism has continued to inspire generations of extremists in the United States and beyond, from McVeigh and the neo-Nazi bankrollers of the Aryan Republican Army to the killers of Germany’s National Socialist Underground, all the way through to contemporary groups like Atomwaffen Division, the Base and the Terrorgram Collective. The latter group, which federal law enforcement believes to be a “bold-letter, category one” domestic terrorism threat, circulates voluminous propaganda booklets that meld the ethos of _The Turner Diaries_ with Ted Kaczynski’s anti-industrial-civilization ethos and neo-Nazi occultism.

Terrorgram’s materials, which include viable bomb-making instructions, camouflage and tactical guides, and instructions on how to disable critical infrastructure like electrical substations, water treatment plants and dams, have radicalized at least one so-called “saint,” or mass shooter, and are alleged to have been connected to a series of power grid attacks in North Carolina as well as several active federal prosecutions.

“William Pierce doesn’t build bombs,” Mark Potok of the Southern Poverty Law Center, told Rolling Stone a quarter of a century ago. “He builds bombers.” In many ways, the Terrorgram Collective fulfills the same role now, and its publications have become the modern-day version of the _Turner Diaries_. Disseminated worldwide through the moderation-free wilderness of Telegram, the group’s message of hate and violence is now circulating independently of any organized group or ideology for disaffected, unbalanced “lone wolves” to latch onto as justification for future atrocities.

While _The Order_ remains firmly rooted in the past save for one passing reference to the 1995 Oklahoma City bombing in a title card, during production there was no escaping the drumbeat of resurgent far-right militancy in the United States. Kurzel, the director, recalls watching news coverage of the January 6 insurrection and remarking on the gallows erected outside the Capitol building—a drawing of which features in the book and the exposition scene with law. “_The Turner Diaries_ started to become more visible in a present-day setting in a way I was kind of shocked by,” he says, speaking to WIRED from his Tasmania residence. Indeed, following January 6, Amazon removed _The Turner Diaries_ from its online inventory.

Hoult’s bravura portrayal of an ice-cool, controlled yet menacing Mathews through the Order’s campaign of armed robbery, counterfeiting, murder, and armed confrontation with the FBI is one of the film’s dual anchors. Aside from a striking physical resemblance to the Silent Brotherhood’s founder, Hoult closely studied his subject, aping Mathews’ mannerisms and movements from old documentary footage, studying texts that radicalized his subject, lifting weights, and cutting alcohol from his diet.

“Mathews was someone who thought and planned so in advance of what his ultimate goal was, I think he always kept in sight. That’s something Justin and I spoke about, that he wouldn’t lose his head on trivial things or things that would potentially harm his cause. In his mind, he’d already, in some ways, planned his destiny,” Hoult tells WIRED.

By choosing to play Mathews with reserve instead of bombast, as more of a watcher who carefully observes his surroundings and other people to better understand how to turn situations to his advantage, Hoult aimed to show audiences how someone with the charisma of his villain could attract followers and build a movement.

“I think that shows how they penetrate communities and societies in a different way, and perhaps people in the future might be less susceptible to people who behave like him,” he says.

As with any artistic project that focuses on extremism and mass violence, _The Order_’s production team walked a fine line between showing Mathews’ magnetism and the murderous project at the heart of his ideology and actions.

“I think you need to understand the pull of a figure like this,” says Kurzel, whose prior films _Snowtown_ and _Nitram_ depicted, respectively, youthful serial killers and Australia’s worst mass shooting, the 1996 Port Arthur massacre. “Mathews is definitely someone who understands their reach and how to communicate and gather people. There’s gonna be a certain kind of charisma about that.”

Haas, one of the film’s producers, echoed Kurzel's remarks about art pushing the boundaries of acceptability. “It felt like part of the movie was to show the appeal of Bob. He was someone who had charisma, and that tied to these really toxic ideas is really dangerous,” Haas says, praising the “unrelenting realism” the cast brought to their performances.

Ultimately, the hope of slipping an unsparing portrayal of domestic extremism—produced outside of the Hollywood studio system—into the December award season is to reintroduce a discussion of radicalization to American society. “If you don’t learn from history, you’re doomed to repeat it—how a guy that, in the way Nick depicted him, could live down anybody’s street,” says Haas. “There are lots of people right now who are hurting and struggling and looking for answers.”

_Updated: 12/6/2024 4:01 pm EST: This story was updated to clarify which character reads out six steps given in_ The Turner Diaries.

The Real Story of “The Order”

Inspired by her own experience of abuse, Nighat Dad fights for women’s social and digital rights in Pakistan and beyond.

Nighat Dad grew up in a conservative family in Jhang, in Pakistan’s Punjab province. The threat of early marriage hung over her childhood like a cloud. But despite their traditional values, Dad’s parents were determined that all their children get an education, and they moved the family to Karachi so she could complete her bachelor’s degree. “I never really thought I would work, because I was never taught that we could work and be independent,” she says. “We always needed permission to do anything.”

Dad thought a master’s in law might delay the inevitable betrothal, but soon after she completed the course, she found out her parents had arranged a marriage for her. She didn’t mind her new life of domestic chores in a household she describes as “lower-middle class”—that is, until the abuse started. “That’s when my legal education reminded me that this was wrong,” she says. “Our laws, our constitution, everything protects me, so why was I facing this? Why was I tolerating it?”

With her family’s backing, Dad left her husband and filed for divorce. But after years of domestic violence and abuse and with no experience of working, she struggled with a lack of confidence. “I had no idea that women who are divorced and have a child face such difficulties in a society like ours,” she says. When her ex-husband filed a custody case for their 2-month-old baby, Dad wasn’t sure how she would pay for a lawyer. That’s when her father reminded her that she was a lawyer too.

Dad used her degree to win custody of her only child. In the process, she realized how many women in Pakistan were facing years of violence and systemic injustice. But the thing that bothered her most was the digital divide.

Before her marriage, Dad’s family never allowed her access to her own cell phone, and when she finally did get one, her husband would use it as a surveillance tool—keeping track of who she called and who was texting her. She had an escape tool in her hand, but she couldn’t use it. “Going through that by myself made me realize how quickly technology is evolving, and how it’s creating virtual spaces for marginalized communities that might not have access to physical ones,” she says. “Facing those restrictions made me understand just how crucial it is to challenge societal norms and structures around women's access to technology and the internet, so they can use it as freely as men.”

In 2012, Dad established the Digital Rights Foundation, an NGO that aims to address the digital divide and fight online abuse of women and other gender minorities in Pakistan. She began by helping women who reached out to the organization, providing advice on digital safety and emotional and mental support. In 2016—the same year Pakistan finally passed legislation against online crimes—Dad and her team launched a cyber-harassment helpline. Since 2016, it has addressed more than 16,000 complaints from across the country. “Sometimes, the police would give our phone numbers to victims seeking reliable help,” she says.

The DRF’s in-house legal team offers pro bono advice and helps women file and follow-up complaints against their abusers. “In many cases, we were successful in actually getting the perpetrator arrested and taken to trial,” Dad says. In October 2021, the DRF’s legal team helped journalist Asma Shirazi win a landmark case in the Islamabad High Court against broadcaster ARY News, after she became the target of a coordinated troll campaign which was exacerbated by a false story aired on the channel.

“If an organization like the DRF had existed when I was facing my own issues, I would have felt so much more supported—knowing there was someone to guide me legally and help me navigate the complexities,” she says. “My abuse started with surveillance, and if I had someone to talk to back then, I might have avoided the deep depression that followed. I might not have ended up in such a miserable situation.”

Today, Dad and the DRF are helping to steer global conversations about tech policy reform. She recently joined the United Nations’ AI Advisory Board, and was a founder member of Meta’s Oversight Board, which acts as an independent platform for people to appeal decisions made by the social media giant. “The emerging tech space is mostly driven by big Western companies and governments, leaving out civil society NGOs from the Global South,” she says. “This puts us far behind in global AI governance, always playing catch-up in a fast-moving world. If we’re not part of the conversation, the gap just keeps widening. It’s about reminding the powerful that they can’t win this race alone—they have a responsibility to include the rest of the world, especially those without the same resources.”

_This article first appeared in the January/February 2025 edition of WIRED UK._

She Escaped an Abusive Marriage—Now She Helps Women Battle Cyber Harassment

The mobile device security firm iVerify has been offering a tool since May that makes spyware scanning accessible to anyone—and it’s already turning up victims.

In recent years, commercial spyware has been deployed by more actors against a wider range of victims, but the prevailing narrative has still been that the malware is used in targeted attacks against an extremely small number of people. At the same time, though, it has been difficult to check devices for infection, leading individuals to navigate an ad hoc array of academic institutions and NGOs that have been on the front lines of developing forensic techniques to detect mobile spyware. On Tuesday, the mobile device security firm iVerify is publishing findings from a spyware detection feature it launched in May. Of 2,500 device scans that the company's customers elected to submit for inspection, seven revealed infections by the notorious NSO Group malware known as Pegasus.

The company’s Mobile Threat Hunting feature uses a combination of malware signature-based detection, heuristics, and machine learning to look for anomalies in iOS and Android device activity or telltale signs of spyware infection. For paying iVerify customers, the tool regularly checks devices for potential compromise. But the company also offers a free version of the feature for anyone who downloads the iVerify Basics app for $1. These users can walk through steps to generate and send a special diagnostic utility file to iVerify and receive analysis within hours. Free users can use the tool once a month. iVerify's infrastructure is built to be privacy-preserving, but to run the Mobile Threat Hunting feature, users must enter an email address so the company has a way to contact them if a scan turns up spyware—as it did in the seven recent Pegasus discoveries.

“The really fascinating thing is that the people who were targeted were not just journalists and activists, but business leaders, people running commercial enterprises, people in government positions,” says Rocky Cole, chief operating officer of iVerify and a former US National Security Agency analyst. “It looks a lot more like the targeting profile of your average piece of malware or your average APT group than it does the narrative that’s been out there that mercenary spyware is being abused to target activists. It is doing that, absolutely, but this cross section of society was surprising to find.”

Seven out of 2,500 scans may sound like a small group, especially in the somewhat self-selecting customer base of iVerify users, whether paying or free, who want to be monitoring their mobile device security at all, much less checking specifically for spyware. But the fact that the tool has already found a handful of infections at all speaks to how widely the use of spyware has proliferated around the world. Having an easy tool for diagnosing spyware compromises may well expand the picture of just how often such malware is being used.

“NSO Group sells its products exclusively to vetted US & Israel-allied intelligence and law enforcement agencies,” NSO Group spokesperson Gil Lainer told WIRED in a statement. "Our customers use these technologies daily.”

iVerify says that it took significant investment to develop the detection tool because mobile operating systems like Android, and particularly iOS, are more locked down than traditional desktop operating systems and don't allow monitoring software to have kernel access at the heart of the system. Cole says that the crucial insight was to use telemetry taken from as close to the kernel as possible to tune machine learning models for detection. Some spyware, like Pegasus, also has characteristic traits that make it easier to flag. In the seven detections, Mobile Threat Hunting caught Pegasus using diagnostic data, shutdown logs, and crash logs. But the challenge, Cole says, is in refining mobile monitoring tools to reduce false positives.

Developing the detection capability has already been invaluable, though. Cole says that it helped iVerify identify signs of compromise on the smartphone of Gurpatwant Singh Pannun, a lawyer and Sikh political activist who was the target of an alleged, foiled assassination attempt by an Indian government employee in New York City. The Mobile Threat Hunting feature also flagged suspected nation state activity on the mobile devices of two Harris-Walz campaign officials—a senior member of the campaign and an IT department member—during the presidential race.

“The age of assuming that iPhones and Android phones are safe out of the box is over,” Cole says. “The sorts of capabilities to know if your phone has spyware on it were not widespread. There were technical barriers and it was leaving a lot of people behind. Now you have the ability to know if your phone is infected with commercial spyware. And the rate is much higher than the prevailing narrative.”

_Updated at 12:12 pm EST, December 4, 2024, to include a statement from NSO Group._

A New Phone Scanner That Detects Spyware Has Already Found 7 Pegasus Infections

In a letter to the Department of Defense, senators Ron Wyden and Eric Schmitt are calling for an investigation into fallout from the Salt Typhoon espionage campaign.

The senators also provide evidence in their letter that US telecoms have worked with third-party cybersecurity firms to conduct audits of their systems related to the telecom protocol known as SS7 but have declined to make the results of these evaluations available to the Defense Department. “The DOD has asked the carriers for copies of the results of their third-party audits and were informed that they are considered attorney-client privileged information,” the department wrote in answer to questions from Wyden’s office.

The Pentagon contracts with major US carriers for much of its telecom infrastructure, which means that it inherits any potential corporate security weaknesses they may have but also the legacy vulnerabilities at the heart of their telephony networks.

AT&T and Verizon did not respond to multiple requests for comment from WIRED. T-Mobile was also reportedly breached in the Salt Typhoon campaign, but the company said in a blog post last week that it has seen no signs of compromise. T-Mobile has contracts with the Army, Air Force, Special Operations Command, and many other divisions of the DOD. And in June, it announced a 10-year, $2.67 billion contract with the Navy that “will give all Department of Defense agencies the ability to place orders for wireless services and equipment from T-Mobile for the next 10 years.”

In an interview with WIRED, T-Mobile chief security officer Jeff Simon said that the company recently detected attempted hacking activity coming from its routing infrastructure by way of an unnamed wireline partner that suffered a compromise. T-Mobile isn't certain that the “bad actor” was Salt Typhoon, but whoever it was, Simon says the company quickly stymied the intrusion attempts.

“From our edge routing infrastructure you can’t get to all of our systems—they’re somewhat contained there and then you need to try to move between that environment and another one in order to gain more access,” Simon says. “That requires them to do things that are rather noisy and that’s where we were able to detect them. We’ve invested heavily in our monitoring capabilities. Not that they’re perfect, they never will be, but when someone’s noisy in our environment, we like to think that we’re going to catch them.”

In the midst of the Salt Typhoon chaos, T-Mobile’s assertion that it did not suffer a breach in this instance is noteworthy. Simon says that the company is still collaborating with law enforcement and the telecom industry more broadly as the situation unfolds. But it is no coincidence that T-Mobile has invested so extensively in cybersecurity. The company had suffered a decade of repeated, vast breaches, which exposed an immense amount of customer data. Simon says that since he joined the company in May 2023, it has undergone a significant security transformation. As one example, the company implemented mandatory two-factor authentication with physical security keys for all people who interact with T-Mobile systems, including all contractors in addition to employees. Such measures, he says, have drastically reduced the risk of threats like phishing. And other improvements in device population management and network detection have helped the company feel confident in its ability to defend itself.

“The day we did the transition, we cut off a number of people’s access, because they hadn’t gotten their YubiKeys yet. There was a line out the door of our headquarters,” Simon says. “Every life form that accesses T-Mobile systems has to get a YubiKey from us.”

Still, the fact remains that there are fundamental vulnerabilities in US telecom infrastructure. Even if T-Mobile successfully thwarted Salt Typhoon’s latest intrusion attempts, the espionage campaign is a dramatic illustration of long-standing insecurity across the industry.

“We urge you to consider whether DOD should decline to renew these contracts,” the senators wrote, “and instead renegotiate with the contracted wireless carriers, to require them to adopt meaningful cyber defenses against surveillance threats.”

_Additional reporting by Dell Cameron._

Senators Warn the Pentagon: Get a Handle on China’s Telecom Hacking

Western authorities say they’ve identified a network that found a new way to clean drug gangs’ dirty cash. WIRED gained exclusive access to the investigation.

She Was a Russian Socialite and Influencer. Cops Say She’s a Crypto Laundering Kingpin

At WIRED’s The Big Interview event, the president of the Signal Foundation talked about secure communications as critical infrastructure and the need for a new funding paradigm for tech.

“We don’t want to be the outlier that proves the rule, we want to be a new set of rules leading the way to a much more open and diverse tech ecosystem,” Whittaker said, “that isn’t reliant on like five companies and 15 guys and a paradigm that is very, very stale and ultimately not healthy for the world and the future.”

It costs around $50 million per year to run Signal, and Whittaker noted at the event that there are no easy answers to finding that type of funding—or more—for projects that need consistent, independent, and secure backing without being subject to the forces of data monetization and surveillance capitalism.

“None of this is simple, friend,” Whittaker said. “There’s a type of capital we need. How do we get it?”

The first Trump presidency in the United States was increasingly hostile to encryption and independent tech, so with a new Trump administration looming and anti-encryption advocates making inroads in governments around the world, what comes next for Signal?

“Signal knows who we are. Signal will continue being Signal,” Whittaker says. “Signal has one thing we do, and we do it really well and we do it pretty obsessively, and that is: provide truly private communications infrastructure to everyone, everywhere, globally. Full stop. We’re not changing.”

With Threats to Encryption Looming, Signal’s Meredith Whittaker Says ‘We’re Not Changing’

The FTC is targeting data brokers that monitored people’s movements during protests and around US military installations. But signs suggest the Trump administration will be far more lenient.

The United States Federal Trade Commission is taking action against two American data brokers accused of unlawfully trafficking in people’s sensitive location data. The data was used, the agency says, to track Americans in and around churches, military bases, and doctors’ offices, among other protected sites. It was sold not only for advertising purposes but also for political campaigns and government uses, including immigration enforcement.

Mobilewalla, a Georgia-based data broker that’s said to have digitally tracked the residents of domestic abuse shelters, is accused by the agency of purposefully tracking protesters in the wake of George Floyd’s murder in 2020. In a court filing, the FTC says Mobilewalla attempted to unmask the protesters’ racial identities by tracking their mobile devices to, for example, Hindu temples and Black churches.

The FTC also accused Gravy Analytics and its subsidiary Venntel of harvesting and exploiting consumers’ location data without consent, alleging that the company used that data to unfairly infer health decisions and religious beliefs.

According to the FTC, Gravy Analytics collected over 17 billion location signals from approximately a billion mobile devices daily. It has reportedly sold access to that data to federal law enforcement agencies such as the Department of Homeland Security, the Drug Enforcement Agency, and the Federal Bureau of Investigation.

Gravy Analytics could not be immediately reached for comment.

A spokesperson for Mobilewalla says the company's privacy policies are constantly evolving, adding: “While we disagree with many of the FTC’s allegations and implications that Mobilewalla tracks and targets individuals based on sensitive categories, we are satisfied that the resolution will allow us to continue providing valuable insights to businesses in a manner that respects and protects consumer privacy.”

“This data can be used to identify and target consumers based on their religion,” the FTC says. The location data collected by the two companies makes it possible, the agency says, to “identify where individual consumers lived, worked, and worshipped, thus suggesting the mobile device user’s religion and routine and identifying the user’s friends and families.”

According to the two settlements, which must be finalized in court before they would go into effect, Gravy Analytics and Mobilewalla are barred from collecting sensitive location data from consumers and must delete the historical data they gathered on millions of Americans. Mobilewalla would be banned from acquiring location data and other sensitive information from online auctions known as real-time bidding exchanges, marketplaces where advertisers compete to instantaneously deliver ads to targeted consumers. This case marks the first time the FTC has moved to police the collection of data directly from an ad exchange.

In another first, the proposed Gravy Analytics settlement would introduce military installations to the list of “sensitive locations” where the FTC bans location tracking. Under the terms, the company would be prohibited from selling, disclosing, or using data drawn from these locations, which include mental health clinics, substance abuse centers, and child care service providers.

In November, a collaborative investigation by WIRED, Bayerischer Rundfunk, and Netzpolitik.org revealed that over 3 billion phone location data points, collected by a US-based data broker, exposed the movements of US military and intelligence personnel in Germany. These movements included visits to nuclear vaults and brothels. In that story, WIRED first reported on FTC chair Lina Khan’s efforts to shield US military and intelligence personnel from data brokers.

US senator Ron Wyden of Oregon, who first urged the FTC to take action against Mobilewalla in 2020, praised the announcements, calling the companies’ actions “outrageous violations of Americans’ privacy.”

“These companies enabled US government agencies to surveil Americans without a warrant and enabled foreign countries to spy on service members with just a credit card,” says Wyden, who also previously investigated Venntel with other members of Congress.

While the FTC’s orders don’t directly tackle the issue of government agencies purchasing Americans’ location data—information for which a warrant is normally required—Wyden says the cases nevertheless undermine the government’s case for allowing the purchases. The orders make clear, he says, that federal agencies are hiding behind a “flimsy claim that Americans consented to the sale of their data.”

In a statement, FTC commissioner Alvaro Bedoya notes that while surveillance conducted by private companies won't raise the same constitutional issues as surveillance by government, the difference between the two is “porous if not irrelevant” to the people being watched. "Governments have long relied on private citizens for work that would be impractical or illegal for law enforcement," he says.

Whether the orders against Gravy Analytics and Mobilewalla will be enforced remains to be seen. Major changes are coming to the agency under the future Trump administration—most expected to undermine years of work by Khan and her staff. Many of Donald Trump's allies have been vocally critical of Khan's aggressive pro-consumer approach, including Republican megadonor Elon Musk, who has taken command of an ad hoc office that will purportedly advise the White House on improving “government efficiency.”

FTC commissioner Andrew Ferguson, whose name was floated last month as a potential Khan replacement, partially concurred with the agency’s decision to bring cases against the two data brokers on Tuesday. He agreed the companies had taken insufficient steps to ensure consumer data was properly anonymized, adding that they’d failed to obtain the “meaningfully informed consent” of the consumers they targeted.

Unlike Khan, however, Ferguson argues that the companies did not run afoul of the law by “categorizing consumers based on sensitive characteristics,” such as whether they attend church or political meetings. “These are all public acts that people carry out in the sight of their fellow citizens every day,” he says.

Ferguson likewise chastised the agency for attempting to restrict the power of data brokers to target protesters specifically. “Treating attendance at a political protest as uniquely private and sensitive is an oxymoron,” he says.

In a separate action Tuesday morning, the Consumer Financial Protection Bureau announced it was taking steps to crack down on predatory data brokers that traffic in people’s financial information, calling the practice a gateway for “scamming, stalking, and spying.”

Musk, who donated more than $100 million toward Trump’s reelection, called publicly last week for the bureau to be “deleted.”

FTC Says Data Brokers Unlawfully Tracked Protesters and US Military Personnel

When programmer Micah Lee was kicked off X for a post that offended Elon Musk, he didn't look back. His new tool for saving and deleting your X posts can give you that same sweet release.

At around 5 pm on a Thursday in December 2022, a privacy- and information-freedom-focused programmer named Micah Lee learned, to his shock, that he had just been banned from Twitter. His crime: posting a link to @Elonjets, an account on the competing social media service Mastodon that tracked the location of the private jet of Twitter’s new billionaire owner, Elon Musk—a link that Musk would later claim amounted to “doxing” despite the jet’s location info being publicly available.

For a moment, Lee grieved the loss of an account he'd spent years building, with more than 50,000 followers. Then, almost immediately, that feeling was replaced with relief to have escaped a platform he felt was already in precipitous moral decline. Since Musk had taken it over two months earlier, Twitter's new owner had already allowed previously banned far-right and even neo-Nazi figures back onto the service in the name of free speech—while simultaneously axing the accounts of leftists. Perhaps getting banned for offending the mercurial mogul behind those partisan decisions was “a good way to go,” Lee decided.

He hasn't looked back. Twitter eventually told Lee he could return to the service if he deleted his @Elonjets tweet. Instead, he stayed off the platform for eight months before finally deleting that post, but only so that he could log in and delete his entire history on the platform. A few months later, after Twitter had become X, he wrote a few messages promoting a book he'd written—all now deleted, too—and says he has barely touch the service otherwise. “Honestly, my mental health is much better since then,” he adds.

Now, Lee wants to help you achieve that same cleansing release. Today, he launched Cyd—an acronym for “Claw back Your Data”—a desktop application designed to give users more control over their X history: archiving it, trimming it to their preferences, or destroying it altogether. In the free version of Cyd, the program allows anyone to download their X posts—Cyd can save up to 2,000 of your most recent posts itself, or you can use X's built-in feature that allows you to download your entire archive—and then automatically delete them. For $36 a year, users can access Cyd's premium features, like erasing the contents of their account with more fine-grained filters based on variables like date, number of likes or retweets, or keywords, un-retweeting or removing likes from posts en masse, and unfollowing all X users.

While Cyd for now is designed specifically for managing—or emptying out—your X account, Lee says he hopes to eventually add other features for carrying out the same archiving and deletion functions on services like Facebook and Reddit. “A handful of billionaires like Elon Musk and Mark Zuckerberg and Jeff Bezos control all the platforms that we use all the time and where we have all our data,” Lee says. “I want to basically make it so that the users of these platforms—everybody else who isn't one of these really rich tech billionaires—has a bit more power.”

Cyd creator Micah Lee.Courtesy of BSidesPDX

Lee is launching Cyd in the midst of a mass X exodus: Millions of users have fled the service in the wake of the election of Donald Trump, many turned off by Elon Musk's support for Trump in the form of both campaign contributions and in his own nonstop political posts, as well as the increasingly conservative bent of X's remaining user base. The social media Bluesky, in particular, appears to have gained most of those X refugees, adding at least 8 million users in the weeks after the election.

“I think it's incredibly timely for people to delete as much as they can, as much as they want to, off of X, and just stop using the platform,” Lee says, “and try to take some of its influence away and move it to better platforms like Bluesky or Mastodon.”

Cyd is only one of several apps like TweetDeleter and Redact.dev that offer to archive and prune your X account. But unlike TweetDeleter, Cyd allows mass deletion of posts in its free version. While Redact.dev offers more free deletion features than Cyd, Cyd's $36 paid version is about half the price of Redact's $6 a month premium plan. It also offers some features that Redact doesn't, like deleting posts based on number of likes or retweets, so that users can, for instance, scrub all but their most viral posts.

Despite Cyd's timeliness, Lee says he's been working on a social media archiving and deletion tool for years, even before Musk acquired Twitter. In 2019, he released Semiphemeral, an earlier app with social media management features similar to Cyd, partially in response to his own experience of becoming the target of harassment and antisemitic tweets in the previous years. To perform its social media archiving and curation, Semiphemeral tapped into Twitter's API, an interface to its backend data provided to developers.

A few months after Musk acquired Twitter, however—and after the site summarily banned Lee and a handful of other journalists for linking to @Elonjets—Twitter ended free access to that API, killing Semiphemeral. A year later, however, Lee was laid off from his job as the director of information security at the news outlet the Intercept, along with about a third of the newsroom, and started looking for projects to work on. He soon figured out that he could revive Semiphemeral by designing it to automatically view and scrape X pages from a web browser instead of using X's API. “Everything it does is actually something you can do yourself in a web browser,” Lee says. “It would just take you a lot more time.” He also rebranded the app to Cyd in an attempt to make its name easier to remember and spell, and created a cute blue bird in a pirate mask (also named Cyd) to serve as its animated logo.

Though it's cheaper than some other options, Cyd's annual cost of $36 for its premium features will no doubt still be too steep for many users. Lee says he plans to work with organizations that represent at-risk groups to offer the tool for free to those who need it. He also points out, perhaps only half-jokingly, that $36 is less than half the annual cost of a Twitter blue account.

More to the point, he says that he hopes that unlike some of his previous software projects—the secure and anonymous file-sharing tool Onionshare and the safe-download protection app Dangerzone—he hopes this one will have a business model that gives him time to work on it and expand its feature set to include other social media platforms. “I would love to make it so that it can pay for itself,” Lee says, “so that I can make it bigger.”

Despite those big ambitions, Lee says that he hadn't quite intended to launch Cyd just as Bluesky experiences a user explosion at X's expense—and as more users than ever consider the motives and power of the tech billionaires who control the platforms they use.

“I knew that X was going down the drain, and I knew that people would be pissed off about it. I didn't really quite realize that people would be quitting en masse like they are now," says Lee. “It just happens to be perfect timing.”

He Got Banned From X. Now He Wants to Help You Escape, Too

A new proposal by the Consumer Financial Protection Bureau would use a 54-year-old privacy law to impose new oversight of the data broker industry. But first, the agency must survive Elon Musk.

The United States government’s leading consumer protection watchdog announced Tuesday the first steps in a plan to crack down on predatory data broker practices that the agency says help fuel scams, violence, and threats to US national security.

The Consumer Financial Protection Bureau is proposing a rule that would allow regulators to police data brokers under the Fair Credit Reporting Act (FCRA), a landmark privacy law enacted more than a half century ago. Under the proposal, data brokers would be limited in their ability to sell certain sensitive personal information, including financial data and credit scores, phone numbers, Social Security numbers, and addresses. The CFPB says that closing the loopholes allowing data brokers to trade in this data with little to no oversight will benefit vulnerable people and the US as a whole.

“By selling our most sensitive personal data without our knowledge or consent, data brokers can profit by enabling scamming, stalking, and spying,” Rohit Chopra, CFPB’s director, said in a statement. “The CFPB’s proposed rule will curtail these practices that threaten our personal safety and undermine America’s national security.”

Passed in 1970 as the first US privacy law, the FCRA requires “credit reporting agencies” to adhere to certain standards of accuracy and privacy in their dealing with people’s financial information, including credit histories, credit scores, debt payment histories, and other related data. The CFPB’s proposal aims to treat data brokers like credit reporting agencies when they deal in this sensitive data. It would require data brokers to obtain “separate, explicit authorization” before acquiring or sharing people’s credit information, rather than burying these permissions in expansive legal documents that surveys show are often unread or impossible for the average person to parse.

In a conversation with reporters on Monday, Chopra pointed to the recent attacks on US telecommunications systems, which the government has attributed to China, to emphasize the value of personal data to the nation's foreign rivals. “But often, our adversaries don't need to hack anything,” he says. “Data brokers, the outfits that collect and sell detailed information about our personal and financial lives, are making this data available to anyone willing to pay a price.”

The action proposed by the CFPB is aimed, Chopra says, at stopping data brokers from “enabling scammers, stalkers and spies undermining our personal safety and America's national security.”

The CFPB’s idea of using existing US law to regulate data brokers is not novel. In February 2023, a group of consumer-focused nonprofits urged Chopra to enforce the powers the FCRA affords regulators to prevent data brokers from engaging in these potentially damaging practices.

“Protecting the personal information of all people in the US is increasingly urgent in our current political climate,” says Laura Rivera, attorney with Just Futures Law, a nonprofit that supports grassroots activists. “The stakes are too high to continue to let the data broker industry sell our information at their discretion, where the status quo has made it ripe for abuse and targeting from harmful actors.”

In a briefing with WIRED on Monday, CFPB officials declined to comment on whether they believe the regulatory action will be short lived, as president-elect Donald Trump plans to empower a number of Silicon Valley figures to reorganize the federal government with the aim of targeting “waste and fraud.”

Elon Musk, who is coleading an office named after a meme coin—the Department of Government Efficiency, or DOGE—directly attacked the CFPB's work last week, calling for the agency to be “deleted.” Musk's remarks followed an attack on the agency's work by Marc Andreessen, a venture capitalist, who claimed on a recent episode of Joe Rogan’s podcast that the agency is “terrorizing” banking startups.

The CFBP was founded in 2011 with the aim of protecting consumers from the kinds of fraud and abuse that kicked off the 2008 financial crisis.

A CFPB official tells WIRED that the agency is also concerned about data being transmitted in ways that companies allege protects people's identities but in reality can be "de-anonymized" in simple ways, as studies have repeatedly shown. "As technology advances, we surmise that it will be even easier to de-mask purportedly de-identified data," one official said. The proposed rule thus includes a range of guidelines for credit reporting agencies involved in selling data they alleged has been de-identified.

Asked whether the proposal would extend to US government agencies, an official says that US law sets forth "very clear pathways" for the government to purchase personally identifying data for law enforcement and intelligence purposes. In a recent case, US Immigration and Customs Enforcement was discovered by reporters to have purchased access to the personal data of Americans in an attempt to investigate immigrants—data acquired by the media conglomerate Thomson Reuters, which it provided to custeroms in contracts the company disclosed were worth more than $100 million. (Thomson Reuters previously denied that the purpose of the data is to track undocumented immigrants and has emphasized that its database does not contain information that normally requires a search warrant to access.)

“We are not disrupting any of those pathways,” a CFPB official says. The agency is requesting comment, however, on the potential impacts of such government purchases to ensure that access is “appropriate.”

Emily Peterson-Cassin, director of corporate power at the nonprofit advocacy group Demand Progress’s Education Fund, commended the CFPB’s proposal and urged the incoming Trump administration to see it through.

“The CFPB is doing something important that will resonate with every single American. Anyone you pick off the street can tell you about the daily scam texts, emails and calls they receive from fraudsters who easily buy our contact information from shady, unaccountable data brokers,” Peterson-Cassin says. “Finally, someone—specifically the CFPB—has stepped in to stop this daily plague affecting hundreds of millions of people by applying real standards to their sale of our sensitive information.”

Source

Wired