To protest the war in Ukraine, WasteRussianTime.today auto-dials Russian government officials, connects them to each other, and lets you listen in to their confusion.

Robocalls have become a modern scourge, the destroyer of focus, the nuisance that somehow cannot be eradicated. But perhaps they can, at least, be repurposed to strike a very small and slightly absurd blow against the Russian government's unprovoked invasion of Ukraine.

Today, a group of international hacktivists launched a website, WasteRussianTime.today, designed to combine prank calling and robocalling into an automated weapon of telephonic annoyance targeted at the Russian state. Visit the site, click a button, and it will cycle through a leaked list of Russian government, military, and intelligence phone numbers to connect two random Russian officials—and allow the site's visitor to silently listen in as those officials waste their time trying to figure out why they're speaking to each other and who initiated the call.

“We’re hoping for confusion, that they get annoyed, and that these might even be interesting calls to listen to for people who speak Russian,” says one of the site's creators who goes by the name Shera. The group of artists, activists, and coders behind the site is, according to Shera, called the Obfuscated Dreams of Scheherazade. “This war started inside Moscow and St. Petersburg, within the power circle of Putin, and that’s who we want to annoy and disturb.”

Since Russia began its full-scale war in Ukraine on February 24, hacktivists working independently and even rallied by the Ukrainian government have carried out an unprecedented campaign of hacking operations targeting Russian organizations, some of which have resulted in the theft and leak of hundreds of gigabytes of Russians' emails and other private information. The Ukrainian government itself at one point released a list of what it said were the names and contact details of 620 Russian intelligence agents. 

Now, by combing through that pile of leaked information, scraping phone numbers from emails, and combining the results with those found in other public sources, the creators of WasteRussianTime.today say they've assembled more than 5,000 Russian government phone numbers, both landlines and cell phones, including members of the Russian military police, staff of its parliament, known as the Duma, and even Russia's Federal Security Service, or FSB—all of which are now targets of its automated robo-dialing campaign.

WasteRussianTime.today is designed to work by starting a VoIP call, automatically dialing 40 of the leaked phone numbers, and merging the user into a three-way call with the first two Russian officials' phones that connect. The site's creators say they decided not to let visitors to the site actually speak on the calls, for fear that they might say something that could identify and endanger themselves. So instead, the site functions as a kind of performance art installation, allowing visitors to silently observe and enjoy its spam calls. "Join the civil intervention against war," a message on the site reads. "If you're on the phone, you can't drop bombs or coordinate soldiers."

In WIRED's dozen or so test calls on the site just before its launch, the site's creators still seemed to be ironing out some bugs. The site only worked on desktop, and most of the calls resulted in at least one non-working number audio message. In about half the calls, at least one confused Russian-speaking did pick up. But in only one call did two people pick up the phone, and one hung up before the other started speaking. Shera says the site's developers will be tweaking it over time to identify and weed out non-working numbers.

The site's creators say the idea for WasteRussianTime.today came about 24 hours after Russia launched its full-scale invasion of Ukraine in late February. As the hacktivist group discussed ways of protesting or disrupting the war, their brainstorming eventually turned to how they might be able to create a site that used leaked Russian phone numbers to allow visitors to call ordinary Russian citizens and speak to them about the invasion. But as more Russian government numbers leaked in the post-invasion hacking wave—and as they realized most visitors wouldn't be able to speak Russian, and the calls might create safety concerns—they instead pivoted to making Russian officials essentially prank call each other, with the site's visitors as the audience.

Bringing that idea to fruition took nearly three months, in part, the site's creators say, because they were designing it to be resilient against the inevitable response from the site's targets. They've prepared a broad range of numbers to call from, to make their calls more difficult to block or ignore. And they've engaged a service that offers defense against distributed denial of service attacks that might otherwise be used to knock their site offline with bombardments of junk traffic. (They declined to name the service.) “We think the whole system will not live forever; someday, it will get blocked probably,” says Shera, suggesting that the site may manage to stay online and functional for anywhere from hours to weeks.

WasteRussianTime.today's creators say they took care to screen the numbers they included to make sure they're all government or military staff, rather than random Russian civilians. For the cell phone numbers they're including, for instance, they're only using numbers leaked in recent months, since cell phone numbers are often recycled from one user to the next. But they also admit they didn't do much actual testing of the numbers for fear of alerting their targets to the project too early, which would lead to their calls being blocked. In a message posted online, they called on Russians to share any more government or military phone numbers they may have, but ask that those supplying them share verification where possible so they can avoid harassing civilians. “We’re doing our best not to call some random grandma in Siberia,” Shera says.

The hacktivists say their idea was partly inspired by journalists at Bellingcat and Russian news site The Insider who have called Russian officials and even intelligence agents, pretending to be their colleagues or superiors, to trick them into revealing sensitive information. That technique was most famously used by Alexei Navalny, working with Bellingcat, when he dialed up an FSB agent and duped him into confessing to trying to assassinate him with the Novichok nerve agent in a nearly hour-long phone call.

But Christo Grozev, the Bulgarian Bellingcat researcher and journalist who helped Navalny spoof that FSB call, points out that the WasteRussianTime.today project does come at a cost. “Whenever something like this becomes public, the whole department changes their numbers, and that's not good for investigations, including journalistic investigations,” says Grozev.

All the same, Grozev says he does appreciate the prankster spirit in which the project was conceived, and he says that it may discourage and demotivate Russian government staffers who feel their private information isn't being protected. “It’s a great psychological operation,” he says. “It’s just more of a radio morning show prank, rather than a journalistic operation.”

The site's cocreator, Shera, for his part, says that many of the numbers are already leaked and public to varying degrees. But more broadly, if the effect of the project is little more than a prank, so be it. “We just want to do our part and annoy the Russian military-industrial complex,” he says. “And make people laugh a bit.”

This Hacktivist Site Lets You Prank-Call Russian Officials

Researchers found a way to exploit the tech that enables Apple’s Find My feature, which could allow attackers to track location when a device is powered down.

When you turn off an iPhone, it doesn’t fully power down. Chips inside the device continue to run in a low-power mode that makes it possible to locate lost or stolen devices using the Find My feature or use credit cards and car keys after the battery dies. Now researchers have devised a way to abuse this always-on mechanism to run malware that remains active even when an iPhone appears to be powered down.

It turns out that the iPhone’s Bluetooth chip—which is key to making features like Find My work—has no mechanism for digitally signing or even encrypting the firmware it runs. Academics at Germany’s Technical University of Darmstadt figured out how to exploit this lack of hardening to run malicious firmware that allows the attacker to track the phone’s location or run new features when the device is turned off.

This video provides a high overview of some of the ways an attack can work.

The research is the first—or at least among the first—to study the risk posed by chips running in low-power mode. Not to be confused with iOS’s low-power mode for conserving battery life, the low-power mode (LPM) in this research allows chips responsible for near-field communication, ultra wideband, and Bluetooth to run in a special mode that can remain on for 24 hours after a device is turned off.

“The current LPM implementation on Apple iPhones is opaque and adds new threats,” the researchers wrote in a paper published last week. “Since LPM support is based on the iPhone’s hardware, it cannot be removed with system updates. Thus, it has a long-lasting effect on the overall iOS security model. To the best of our knowledge, we are the first who looked into undocumented LPM features introduced in iOS 15 and uncover various issues.”

They added: “Design of LPM features seems to be mostly driven by functionality, without considering threats outside of the intended applications. Find My after power off turns shutdown iPhones into tracking devices by design, and the implementation within the Bluetooth firmware is not secured against manipulation.”

The findings have limited real-world value, since infections required first jailbreaking an iPhone, which in itself is a difficult task, particularly in an adversarial setting. Still, targeting the always-on feature in iOS could prove handy in post-exploit scenarios by malware such as Pegasus, the sophisticated smartphone exploit tool from Israel-based NSO Group, which governments worldwide routinely employ to spy on adversaries.

It may also be possible to infect the chips in the event hackers discover security flaws that are susceptible to over-the-air exploits similar to this one that worked against Android devices.

Besides allowing malware to run while the iPhone is turned off, exploits targeting LPM could also allow malware to operate with much more stealth since LPM allows firmware to conserve battery power. And, of course, firmware infections are extremely difficult to detect since it requires significant expertise and expensive equipment.

The researchers said Apple engineers reviewed their paper before it was published, but company representatives never provided any feedback on its contents. Apple representatives didn’t respond to an email seeking comment for this story.

Ultimately, Find My and other features enabled by LPM help provide added security, because they allow users to locate lost or stolen devices and lock or unlock car doors even when batteries are depleted. But the research exposes a double-edged sword that, until now, has gone largely unnoticed.

“Hardware and software attacks similar to the ones described have been proven practical in a real-world setting, so the topics covered in this paper are timely and practical,” said John Loucaides, senior vice president of strategy at firmware security firm Eclypsium. “This is typical for every device. Manufacturers are adding features all the time, and with every new feature comes a new attack surface.”

_This story originally appeared on_ _Ars Technica__._

Your iPhone Is Vulnerable to a Malware Attack Even When It’s Off

A newly unsealed opinion is likely the first decision from a US federal court to find that cryptocurrencies can't be used to evade sanctions.

Cryptocurrencies have long been seen as the Wild West of money transfers, but few online payment and money transfer platforms have been as blatant in appealing for illicit cash as one highlighted but not named in a memorandum opinion unsealed on May 13 in the US District Court in Washington, DC. The platform is apparently based in a “comprehensively sanctioned country”—likely North Korea, according to those within the crypto law space—and advertised its services as evading US financial sanctions. It was built using a US front company that facilitated the purchase of domain names, according to court records.

The platform, which was designed to sidestep financial bans aimed at crippling pariah countries, handled more than $10 million worth of bitcoin that was transferred between the United States and the sanctioned country using a US-based crypto exchange, which, the opinion implies, was not aware that it was helping users avoid sanctions.

The opinion, written by Magistrate Judge Zia Faruqui, was likely unsealed because someone has been arrested for operating the crypto platform. It all marks a shift in the way US law enforcement—and the law—handles cryptocurrencies.

“Issue One: virtual currency is untraceable? WRONG. ... Issue Two: sanctions do not apply to virtual currency? WRONG,” Faruqui concludes in his opinion, directly citing two _Saturday Night Live_ skits parodying TV host and political commentator John McLaughlin, who was known for his direct style.

“For some time, we’ve heard a narrative that cryptocurrency could potentially be used for sanctions evasion,” says Ari Redbord, head of legal and governmental affairs at TRM Labs, which monitors crypto fraud and financial crime. “What we see here is the first time that the Department of Justice has charged a criminal case involving the use of cryptocurrency to evade sanctions.”

The decision puts crypto exchanges on notice that they can be liable for enabling users to sidestep sanctions—intentionally or not—and is a warning to those trying to evade such sanctions that law enforcement is coming for them.

For years, cryptocurrency has been seen as a safe haven for criminal gangs and enterprises looking to launder ill-gotten gains. Unlike a bank account, cryptocurrency doesn’t require a name attached to transactions, which are recorded on a public blockchain ledger. This apparent anonymity attracted criminal enterprises in the early days of cryptocurrencies like bitcoin. “You had the Silk Roads of the world and the AlphaBays,” says Jessie K. Liu, partner at law firm Skadden, Arps, Slate, Meagher & Flom. A former deputy general counsel at the US Treasury who also served in the Justice Department, Liu has prosecuted several crypto cases. “The early reporting on bitcoin made it out to be some sort of secretive, anonymous currency that bad guys used to do bad things.” The founding principles of the platform—and the libertarian, privacy-loving, decentralized attitude that gave birth to it—contributed to the perception that virtual currencies can’t be traced.

What all of those groups and individuals overlooked was that the underpinning of cryptocurrencies—the immutable blockchain that keeps a record of every transaction made—was building a stockpile of evidence for prosecutors. “The thing that’s so unique about crypto is you can actually trace and track the flow of these funds on an entirely open ledger,” says Redbord. “It’s only because crypto moves and lives on an open ledger on the blockchain that allowed for this type of investigation.”

In the opinion, Faruqui explains how the defendant’s identifying information and IP address were tracked and linked to the payments platform they operated. “The striking point is that cryptocurrency quickly became this dark asset used for illegal activity, which was never the purpose, and that is now being turned on its head and will just as quickly become more transparent than traditional asset classes,” says Nimesh Shah, CEO of London-based accountancy company Blick Rothenberg. Others go further: “Judge Faruqui's opinion pours cold water on the idea that cryptocurrencies mean the death of sanctions,” says Anupam Chander, professor of law at Georgetown University in Washington, DC. Chander says the opinion is good for cryptocurrencies as they seek to shake off their early bad reputation and gain mainstream traction: “Judge Faruqui treats the virtual objects as if they are dollars or dinars.”

While the court’s opinion sets a legal precedent that crypto transactions can and should be traced by authorities, in other ways it’s wholly unremarkable. “Judge Faruqui is, as far as I’m aware, the first judge who has actually said explicitly that cryptocurrency can run afoul of sanctions,” says Liu. “But that’s been the Treasury Department’s view for a number of years.” What’s significant about the decision is that it codifies what has long been an informal attitude toward crypto.

“The question is no longer whether virtual currency is here to stay (i.e., FUD) but instead whether fiat currency regulations will keep pace with frictionless and transparent payments on the blockchain,” Faruqui writes. (Chander says that while Faruqui isn’t the first judge to use “FUD”—meaning fear, uncertainty, and doubt—in a federal opinion, he may well be the first to use it without defining it, showing just how much crypto has burrowed its way into the mainstream.)

In the last year or so, the Treasury Department has designated three Russia-based cryptocurrency exchanges as subject to sanctions, and the Office of Foreign Assets Control (OFAC), which implements sanctions regimes, has operated under the assumption that crypto is subject to sanctions, just as fiat currencies are.

“What really strikes me is that this opinion puts all those pieces together,” says Liu. “Though all those pieces are out there in the DOJ’s approach to enforcement already, this opinion really crystallizes that.” Liu believes there will be an increased focus on tackling the use of cryptocurrency to evade sanctions—and with that, a need for those operating crypto platforms to make sure their house is in order. “This opinion really underscores the importance for anybody involved in the cryptocurrency space or any of the adjacent spaces to have a very good compliance program,” says Liu, “and to recognize that they’re in an area that can be used for problematic purposes.” Crypto companies could otherwise open themselves to civil and potentially criminal action.

It’s all part of what Redbord calls a “cat and mouse game.” Payment platforms will come and go, trying to evade sanctions, but law enforcement will always be looking to catch them. “Cases like this send a message to bad actors that law enforcement can trace and track the flow of funds, and regulators like OFAC are going to continue to sanction bad entities in the space—and are clearly looking to go after bad entities,” says Redbord. “I think judges are going to see more and more warrants, and they’re going to see more and more cases.”

US Courts Are Coming After Crypto Exchanges That Skirt Sanctions

Plus: New details of ICE’s dragnet surveillance in the US, Clearview AI agrees to limit sales of its faceprint database, and more.

A group of human rights lawyers and investigators called on the Hague this week to bring what would be the first ever “cyber war crimes” charges. The group is urging the International Criminal Court to bring charges against the dangerous and destructive Russian hacking group known as Sandworm, which is run by Russia’s military intelligence agency GRU. Meanwhile, activists are working to block Russia from using satellites controlled by the French company Eutelsat to broadcast its state-run propaganda programming.

Researchers released findings this week that thousands of popular websites record data that users type into forms on the site before they hit the Submit button—even if the user closes the page without submitting anything. Google released a report on an in-depth security analysis it conducted with the chipmaker AMD to catch and fix flaws in specialty security processors used in Google Cloud infrastructure. The company also announced a slew of privacy and security features for its new Android 13 mobile operating system along with a vision for making them easier for people to understand and use.

The European Union is considering child protective legislation that would require scanning private chats, potentially undermining end-to-end encryption at a massive scale. Plus, defenders from the cybersecurity nonprofit BIO-ISAC are racing to protect the bioeconomy from digital threats, announcing a partnership this week with Johns Hopkins University Applied Physics Lab that will help fund pay-what-you-can incident response resources.

But wait, there’s more. Each week we round up the news that we didn’t break or cover in-depth. Click on the headlines to read the full stories. And stay safe out there.

The United States is completing development of a new generation of high-security encryption standards that will be robust in the current technical climate and are designed to be resistant to circumvention in the age of quantum computing. And while the National Security Agency contributed to the new standards' creation, the agency says it has no special means of undermining the protections. Rob Joyce, the NSA’s director of cybersecurity, told Bloomberg this week, “There are no backdoors." The NSA has been implicated in schemes to backdoor encryption before, including in a situation in the early 2010s in which the US removed an NSA-developed algorithm as a federal standard over backdoor concerns.

An extensive investigation by Georgetown Law’s Center on Privacy & Technology reveals a more detailed picture than ever of US Immigration and Customs Enforcement agency surveillance capabilities and practices. According to the report, published this week, ICE began developing its surveillance infrastructure at the end of the George W. Bush administration, years before it was previously thought to have begun these efforts. And researchers found that ICE spent $2.8 billion on surveillance technology, including face recognition, between 2008 and 2021. ICE was already known for its aggressive and invasive surveillance tactics during the Donald Trump administration’s anti-immigration crackdowns, but the report also argues that ICE has “played a key role in the federal government’s larger push to amass as much information as possible” about people in the United States.

“Our two-year investigation, including hundreds of Freedom of Information Act requests and a comprehensive review of ICE’s contracting and procurement records, reveals that ICE now operates as a domestic surveillance agency,” the report says. “By reaching into the digital records of state and local governments and buying databases with billions of data points from private companies, ICE has created a surveillance infrastructure that enables it to pull detailed dossiers on nearly anyone, seemingly at any time.”

In a legal settlement this week, the face recognition and surveillance startup Clearview AI agreed to a set of restrictions on its business in the US, including that it won’t sell its faceprint database to businesses or individuals in the country. The company says it has more than 10 billion faceprints in its arsenal belonging to people around the world and collected through photos found online. The settlement comes after the American Civil Liberties Union accused Clearview of violating the Illinois Biometric Information Privacy Act. The agreement also stipulates that the company won’t be allowed to sell access to its database in Illinois for five years. “This settlement demonstrates that strong privacy laws can provide real protections against abuse,” Nathan Freed Wessler, a deputy director of the ACLU Speech, Privacy, and Technology Project said in a statement. Despite the privacy win, Clearview may continue to sell its services to federal law enforcement, including ICE, and police departments outside of Illinois.

Costa Rican president Rodrigo Chaves said on Sunday that the country was declaring a national emergency after the notorious Conti ransomware gang infected multiple government agencies with malware last week. Sunday was the first day of Chaves' presidency. Conti leaked some of a 672 GB trove of stolen data from multiple Costa Rican agencies. In April, the Costa Rican social security administration had announced that it was the victim of a Conti attack. “At this time, a perimeter security review is being carried out on the Conti Ransomware, to verify and prevent possible attacks," the agency tweeted at the time.

The NSA Swears It Has ‘No Backdoors’ in Next-Gen Encryption

Russia is using satellites controlled by French operator Eutelsat to broadcast state-run programming. A grassroots group is pushing for that to stop.

“If the European authorities impose new sanctions against Russian channels, we will stop their broadcast,” the company said. It added: “At this stage, no regulator or other competent authority has asked us to stop broadcasting private Russian television channels in Russia.”

Philipoff and Lange have been turning their appeal to politicians, but with minimal effect. “We sent letters to all French members of the European Parliament,” Lange says. “Not a single answer.”

How, exactly, Paris or Brussels might force Eutelsat to block those Russian channels is an open question. Lange and Philipoff say that if the European Parliament can ban the English-language Sputnik and RT stations from their airwaves, sanctions should have the power to remove Russian-language TV from their satellites. In May, European Commission president Ursula von der Leyen told the EU Parliament they would ban three new broadcasters “in whatever shape or form, be it on cable, via satellite, on the internet, or via smartphone apps.”

Politico has reported that those three broadcasters are Russian-language news networks that reach Europe, with some help from Eutelsat’s satellites.

Eutelsat told WIRED, “We are aware of the European Union's intention to sanction three Russian channels, two of which are broadcast on our satellites, and we are ready to immediately cease broadcasting them as soon as the corresponding European regulation is published.”

The United States recently slapped sanctions on three Russian-language TV stations, including NTV (the flagship station of provider NTV+), after concluding that they are “spreading disinformation to bolster Putin’s war.” Those sanctions are likely to have an impact on their foreign revenue, but not on their Russian operations.

Going after the satellites themselves would be a hugely disruptive escalation. Moscow and Kyiv are already taking aim at each others’ satellite communications.

Western intelligence agencies say, in the hours before its invasion, Russian hackers took aim at American satellite provider Viasat. “Although the primary target is believed to have been the Ukrainian military, other customers were affected, including personal and commercial internet users,” the UK’s National Cyber Center said in a joint statement with the US and EU.

Earlier this week, just ahead of Russia’s Victory Day celebrations—which offered Moscow a prime opportunity to project strength amidst its stalled war—the State Special Communications Service of Ukraine announced that “\[television\] broadcast from the Russian satellite to the occupied Ukrainian regions was unexpectedly turned off.”

As WIRED has reported, Ukraine is aggressively deploying American- and European-provided Starlink terminals, while Russian satellite communications remain troubled.

European cooperation isn’t limited to Eutelsat’s satellite television. Eutelsat owns two subsidiaries in Russia, including home internet provider Konnect. In turn, the Russian state satellite operator owns a small stake in Eutelsat itself. (Corporate documents say most of tje 3.62 percent ownership stake corresponds to the Russian Satellite Communications Company, or RSCC.)

Meanwhile, some two dozen countries make up the Moscow-based Intersputnik consortium, primarily in Eastern Europe, the Middle East, and Asia. Its members include the Czech Republic, Romania, Germany, and Ukraine. In 2020, France announced its intention to join Intersputnik.

Intersputnik managed part of the Soviet Union’s satellite fleet, before being privatized after the fall of the USSR. Moscow’s influence on the organization is fairly apparent: The chair of its board is a senior civil servant in the Russian government.

As the West continues its messy divorce with Russia, an organization like Intersputnik could allow Russia to launch and maintain satellite service, underpinning not just television, but internet service, military communications, and geospatial imaging.

The Diderot Committee’s Lange and Philipoff hope that this current fight could enable more open flows of information in the future—that’s what informs the tongue-in-cheek name of their group. As its website explains: “On July 6, 1762, just nine days after the coup d’état of June 28 that put her on the throne, Catherine II invited the French philosopher Denis Diderot to come to Russia in order to publish _L’encyclopédie_, which had been banned in Paris. Diderot accepted her invitation and arrived in St. Petersburg in October of 1773."

Had Russia not pushed back against France’s censorship, the _Encyclopédie_, one of the most important works of the Enlightenment, may have never been published.

How One Company Helps Keep Russia’s TV Propaganda Machine Online

A biotech threat intelligence group is gaining supporters as urgency mounts around an overlooked vulnerable sector.

A new partnership between the cybersecurity nonprofit Bioeconomy Information Sharing and Analysis Center (BIO-ISAC) and the Johns Hopkins University Applied Physics Laboratory (APL), which works on emerging research with US government agencies, is highlighting the need for more resources to better secure biomedical, bioindustrial, and biomanufacturing entities.

The Covid-19 pandemic sparked regular people around the world to think about the logistics of vaccine development and production in a tangible and immediate way. But the so-called bioeconomy is silently embedded everywhere, from breeding programs used in agriculture to the development of biofuels. And as industry after industry faces a reckoning about the state of their cybersecurity defenses, researchers are increasingly realizing that the bioeconomy is vulnerable. During the pandemic, for example, Russia, China, and other state actors raced to hack vaccine makers and distributors for intelligence gathering, in a scramble that US officials warned could have been disruptive.

“A lot of the bioeconomy is small companies; that’s the real lifeblood of American biotech,” says BIO-ISAC cofounder Charles Fracchia. “Imagine if Moderna got hacked four years ago, even with some totally non-sophisticated malware, or they faced a ransomware attack. Small companies can go bankrupt really easily, and then we lose the work they're doing for the future. I'm very grateful that APL understood the mission of the BIO-ISAC and joined as a founding member. They want to help.”

Information sharing and analysis centers exist for many industries, from financial services to health care. And Charles Frick, a principal staff member at APL, says that the lab has been supporting ISACs and collaborating with them for many years. During the George W. Bush and Barack Obama administrations, Frick says, APL collaborated with the Department of Homeland Security and the National Security Agency to study the most efficient methods for large-scale threat intelligence sharing and security automation. APL participated in a 2018 financial services pilot for automatically screening and processing machine-readable threat intelligence data in which a process that had one taken 14 hours got whittled down to eight minutes.

All of this matters, because digital attacks on critical services and trends in attacks creep up quickly. The more information an organization can not only gather but also share, the better chance others have of defending themselves against similar hacks. APL's funding for the BIO-ISAC will go toward regular operations, including research, information sharing, and public disclosures. And crucially, it will also support incident response services the BIO-ISAC is launching so biotech and biomanufacturing organizations have someone to call if they're dealing with a digital attack or otherwise suspect that something is wrong. The services will be pay what you can to make them accessible to as many organizations as possible. Depending on demand, though, the BIO-ISAC may not have the capacity immediately to respond to every request. But the group hopes to begin filling a crucial gap in the services that are currently available.

“As we start identifying threats, it's a natural fit for us to say, well, we have an existing set of capabilities and skills that can be applied to this area, and we've demonstrated our ability to work with ISACs in collaboration," says Brian Haberman, an APL program area manager. "So this accomplishes our mission of supporting national priorities in a much faster way when you’re not going it alone. It's the biggest bang for your buck."

A few years ago, the idea of designating US election systems as government “critical infrastructure” was controversial to some. The designation simply unlocks funding and expanded resources from US government agencies, including the Cybersecurity and Infrastructure Security Agency, for critical sectors that work in the public interest. But while health care, food, and agriculture industries obviously have critical infrastructure designations that cover parts of the bioeconomy, the sector as a whole doesn't specifically have its own designation. Instead the US government has classified the bioeconomy with a “critical emerging tech” label.  As a result, groups like the BIO-ISAC are working ad hoc in a largely open field.

“The bioeconomy is an emerging sector of our economy if we really want to make meaningful change and impact, now is the time to get involved—not after it’s already this big thing and we try to go in reverse," says Andrew Kilianski, senior director for emerging infectious diseases at the International AIDS Vaccine Initiative. "We’ve done some of these sectors where we try to build out IT infrastructure and cybersecurity defenses later and it doesn’t work well." Kiliansk worked closely with the US government's Covid Operation Warp Speed initiative and a new member of the BIO-ISAC's national security advisory board.

“There's that squishy, beautiful life sciences spirit that, hey, we share everything, we’re open," Kilianski adds. "But now these discoveries have huge commercial value, not just societal value, and that makes all of this even more sensitive.”

The Hidden Race to Protect the US Bioeconomy From Hacker Threats

A group of human rights lawyers and investigators has called on the Hague to bring the first-ever “cyber war crimes” charges against Russia’s most dangerous hackers.

For weeks, evidence has been piling up of the Russian military's apparent war crimes in the midst of its brutal invasion of Ukraine: mass graves, bombed hospitals, even makeshift torture chambers. But amidst those atrocities—and the push to hold the perpetrators accountable—one group is making the counterintuitive case that another arm of the Russian military should be included in any international war crimes charges: the Kremlin's most disruptive and dangerous hackers.

In late March, a group of human rights lawyers and investigators in the Human Rights Center at UC Berkeley's School of Law sent a formal request to the Office of the Prosecutor for the International Criminal Court (ICC) in the Hague. It urges the ICC to consider war crime prosecutions of Russian hackers for their cyberattacks in Ukraine—even as the prosecutors gather evidence of more traditional, ongoing war crimes there. Specifically, the Human Rights Center's international criminal investigations team points in its detailed brief to Sandworm, a notorious group of hackers within Russia's GRU military intelligence agency, and to two of Sandworm's most egregious acts of cyberwarfare: blackouts that those hackers triggered by targeting electric utilities in Western Ukraine in December 2015 and in the capital, Kyiv, a year later, affecting hundreds of thousands of civilians.

The Berkeley group's document was sent under a provision of the Rome Statute treaty, which gives the ICC its authority, allowing recommendations from nongovernmental organizations. It asks the ICC's prosecutor, Karim Khan, “to expand the scope of his investigation to include the cyber domain in addition to traditional domains of warfare–land, air, maritime, and space–given the Russian Federation’s history of hostile cyber activities in Ukraine.” The brief acknowledges that charges against Sandworm would represent the first case of “cyber war crimes” ever brought by the ICC. But it argues that precedent would help not only to seek justice for those harmed by Sandworm's cyberattacks, but also to deter future, potentially worse cyberattacks affecting critical civilian infrastructure around the world.

“In fact, in the absence of consequences or any mechanisms for meaningful accountability, State-sponsored cyberattacks have escalated in the shadows,” reads the Human Rights Center's Article 15 document sent to the ICC and shared with WIRED. “An investigation into Russia’s hostile cyber operations would shine a light on tactics against which few civilians know how to protect themselves.”

Lindsay Freeman, the director of technology, law, and policy at the Human Rights Center, tells WIRED the ICC prosecutor's office responded privately to the group, saying it had received and is considering the group's recommendations. The ICC prosecutor's office didn't respond to WIRED's request for comment.

Freeman argues that the ICC prosecutor's office, which has been investigating ongoing war crimes in Russia's Ukraine invasion—along with the governments of Ukraine, Poland, and Lithuania and the European law enforcement agency—needs to demonstrate that its remit includes cyberattacks that violate the international laws of armed conflict. “We would like to make sure they're seeing the cyber domain as an actual domain of warfare, because in this case, it truly is,” says Freeman. She emphasizes that any cyber war crime charges should be in addition to, not instead of, charges for the ongoing massacres, reckless killing of civilians, and mass deportations in Ukraine. But she adds that “the only way you can properly investigate and understand this conflict is through seeing not just what's happening in the physical world, but also what's happening in the cyber and information spaces, and this is not something war crimes investigators have ever paid attention to.”

Since Russia's last major invasion of Ukraine began in 2014, Russia has targeted the country with a years-long bombardment of cyberattacks of a kind never before seen in history. The GRU's Sandworm hackers alone have attempted three blackouts in the country—at least two of which succeeded; destroyed the networks of media outlets, private companies, and government agencies in targeted attacks; and in 2017 released the destructive, self-spreading NotPetya malware that infected hundreds of organizations across Ukraine and eventually many more around the world, causing a record-breaking $10 billion in damage.

With the current, larger-scale invasion Russia launched on February 24, the Kremlin's state-sponsored hackers have unleashed a broad new campaign of destructive hacking against hundreds of Ukrainian targets, often carefully coordinated with physical military tactics. That new barrage included one cyberattack in which GRU hackers targeted Viasat satellite systems, knocking out broadband connections across Ukraine and Europe, including those of thousands of wind turbines in Germany.

Freeman says that the UC Berkeley Human Rights Center's recommendations for war crime charges, which was sent to the ICC before some of the most recent cyberattacks fully came to light, single out Sandworm's two blackout attacks in 2015 and 2016 for legal and practical reasons: They've already been thoroughly investigated and pinned on Sandworm's hackers through both private sector and government detective work. Six of the group's hackers were indicted by the US Department of Justice in October 2020 with a long rap sheet that includes those blackouts. The cyberattacks occurred in the early years of Russia's war in Ukraine, during active fighting in the eastern region of the country, which makes it easier to argue they occurred in the context of a military conflict and thus constitute a war crime. They have a clear civilian target, given that no military operations were occurring in Western Ukraine or Kyiv at the times of the blackouts there. And perhaps most importantly, they had a clear and direct physical result, which makes for a simpler case that they were equivalent to the sort of physical attacks that war crimes tribunals have charged in the past.

On top of all of that, Freeman points to the seriousness of Sandworm's attacks on civilian power grids. In the 2016 incident in Kyiv in particular, the hackers used a piece of malware known as Industroyer or Crash Override to automatically trigger that power outage. Although that blackout in Ukraine's capital lasted only about an hour, a 2019 analysis of the attack found that a component of the malware intended to disable safety systems was designed to cause physical destruction of electrical equipment, and only failed due to a misconfiguration in the malware. “A cyber weapon that is able to interact with an actual electrical system or an industrial control system and result in kinetic harm is extremely dangerous,” says Freeman. “The power grid attacks are the ones that really cross the line where it's clear we should just say, ‘No state should be attacking critical infrastructure for civilians.’”

If war crimes charges could serve as a punitive measure capable of deterring that sort of critical infrastructure cyberattack, it makes sense to bring them against a group like Sandworm now, says John Hultquist, who leads threat intelligence at cybersecurity firm Mandiant and has tracked Sandworm for the better part of a decade, even naming the group in 2014. The Biden administration has repeatedly warned that Western sanctions against Russia may lead the country to lash out with cyberattacks against targets in the United States or Europe. “We need to be doing everything we can right now to prepare for Sandworm or deter them,” says Hultquist. “If you're going to do this, now is the time.”

On the other hand, Hultquist, a combat veteran who served in Afghanistan and Iraq, also wonders whether cyber war crimes should be a priority given Russia's ongoing physical war crimes in Ukraine. “There's a stark difference between cyberattacks and attacks on the physical ground right now,” he says. “You simply cannot achieve the same effects with cyberattacks that you can when you're bombing things and tanks are rolling down streets.”

Berkeley's Freeman agrees that any ICC charges against Sandworm for cyber war crimes shouldn't detract or distract from its investigation of traditional war crimes in Ukraine. But those ongoing, on-the-ground war crime investigations are likely to take years to bear fruit, she says; the investigation and prosecution of war crimes in Yugoslavia's 1990s conflict, for instance, took decades. Freeman argues that prosecuting Sandworm for Russia's 2015 and 2016 cyberattacks, by contrast, would be “low-hanging fruit,” given the evidence already assembled by security researchers and Western governments of the group's culpability. That means it could offer immediate results while other Russian war crimes investigations continue. “A lot of what you need to try this case is there,” says Freeman. “You could bring this case to get _some_ justice, as a first step, while other investigations are ongoing.”

Sandworm's hackers already face criminal charges in the US. And last month, the State Department went so far as to issue a bounty of up to $10 million for information that could lead to the capture of the six hackers. But Freeman argues that the gravity of convicting the hackers as war criminals would have a larger deterrent effect, and might help actually lead to their arrest, as well. She points out that 123 countries are parties to the Rome Statute and obliged to help capture convicted war criminals—including some countries that don't have extradition treaties with the United States, such as Switzerland, Ecuador, and Cuba, which might otherwise serve as safe havens for the hackers.

If ICC prosecutors did bring war crimes charges against Sandworm for its blackout attacks, the case would have to clear certain legal hurdles, says Bobby Chesney, director of the Strauss Center for International Security and Law at the University of Texas Law School. They'd have to convince the court that the attacks occurred in the context of war, for instance, and that the power grid wasn't a military target, or that the attacks disproportionately affected civilians, he says.

But the more fundamental idea of extending the international laws of war to cover cyberattacks with physical effects—while unprecedented in ICC cases—is an easy argument to make, he says.

“All you have to do is ask, ‘What if the Russians had set up bombs at the relevant electrical substations to achieve the same effect? Is that a war crime?’ That's the exact same sort of question,” says Chesney. He compares the new “cyber domain” of warfare to other kinds of warfare like aerial and submarine warfare, which were once new modes of war but no less subject to international law. “For all these new operational domains, extending the existing law-of-war concepts of proportionality and distinctions to them is a no-brainer.”

But the cyber domain _is_ nonetheless different, says Freeman: It has no borders, and it allows attackers to instantly reach across the world, regardless of distance. And that makes holding Russia's most dangerous hackers accountable all the more urgent. “Sandworm is continually active, and continually executing serious attacks with impunity,” she says. “The risk it presents is incredibly serious, and it puts the entire world at the front lines of this conflict.”

The Case for War Crimes Charges Against Russia’s Sandworm Hackers

With its latest mobile OS update, Google aims to simplify the adoption of Android’s protective features for users and developers alike.

For years, Android’s security and privacy teams have been wrestling the world’s most popular mobile operating system to make it more controllable and updatable while still being open source and easy to deploy. And while scams, malware, and rogue apps are still real threats, the debut of Android 13 at Google’s I/O developer’s conference on Wednesday feels less like triage mode and more like a logical iteration. As Charmaine D'Silva, Android’s director of product management puts it, “This is the release where we bring it all together.”

If anything, the big problem for Android security and privacy now is trying to get users, device makers, and developers to understand and be motivated to use a slew of new and recently released protective features. And after setting so many privacy and security initiatives in motion over the past few years, there's a huge amount for the Android team to maintain and try to get right at any given time.

“We will continue to go deeper, and that’s going to be a continued investment, but the challenge as you go deep is you end up fragmenting experiences, you end up actually confusing users unintentionally,” says Krish Vitaldevara, Android senior director of product management. “That’s a very hard problem to solve, and that’s what we’re going to solve with Android 13.”

Google Play Protect now scans about 125 billion apps per day on user devices to assess their behavior and attempt to identify security issues. And Google says that its Messages app now blocks 1.5 billion spam messages per month in an attempt to cut down on phishing and other scams that actually reach users. And after finally introducing end-to-end encryption in Messages last year for one-on-one texting with the long-awaited RCS messaging standard, Google says that later this year it will add end-to-end encryption in beta for group chats as well.

“We feel both excited and hopeful,” Jan Jedrzejowicz,  a Messages product manager tells WIRED. “Excited because providing out-of-box and encrypted-by-default group text messaging on Android is a huge upgrade for a large number of people all over the world. Hopeful because cross-platform messaging still uses SMS/MMS, and we really hope we can upgrade that to a more modern and encrypted protocol.”

Android 13 imposes more limitations and user controls for the permissions apps are granted and what data they can access when. For example, the operating system gives developers the option to easily incorporate Google’s “Photo picker” that lets users choose specific photos and videos to share with an app through the conduit of the picker, rather than granting the app access to their full photo library. Google has increasingly leaned on the system access that Android already has to provide specific data to apps, making it more like the bartender who’s mixing drinks than the cashier at the liquor store. Similarly, Android 13 now requires apps to request permission to access audio files, image files, and video files separately as part of an effort to limit access to different storage buckets.

Android already limited how much access apps had to the clipboard and notified users when an app grabbed something from it. But Android 13 adds another layer by automatically deleting whatever is in your clipboard after a short interval. This way, apps can’t find out old things that you copied, and—bonus—you’re less likely to inadvertently share your coworker’s list of reasons they hate your company with your boss. Android 13 also continues a process of reducing apps’ ability to require location sharing for things like enabling Wi-Fi. 

Android 13 requires new apps to ask permission before they can send you notifications. And the new release expands on a feature from Android 11 that automatically resets an app’s permissions once you haven’t used it for a long time. Since its debut, Google has extended the feature all the way back to devices running Android 6, and the operating system has now automatically reset more than 5 billion permissions, according to the company. This way, a game you don’t play anymore that had permission to access your microphone three years ago can’t still listen in. And Android 13 makes it easier for app developers to remove permissions proactively if they don’t want to retain access for longer than they absolutely need.

Making sure that Android devices around the world can get security updates has been a core hurdle for Google, since Android’s open source ethos allows any manufacturer to deploy its own version of the operating system. To improve the situation, the company has spent years investing in a framework called Google System Updates that breaks down the operating system into components and allows phone makers to directly send updates for the different modules through Google Play. There are now more than 30 of these components, and Android 13 adds ones for Bluetooth and ultra-wideband, the radio tech used at short range for things like radar.

Google is working to reduce common vulnerabilities that can show up in software by rewriting some crucial parts of the Android code base in more secure programming languages like Rust and creating defaults that nudge developers in a more secure direction with their own apps. The company has also worked to make its application programming interfaces more secure and has started offering a new service called Google Play SDK Index that provides some transparency into widely used software development kits, so developers can be more informed before they incorporate these third-party modules into their apps.

Similar to Apple’s iOS Privacy Labels, Android recently added a “Data Safety” field in Google Play to give users a sort of nutrition-fact label explaining how apps say they will handle your data. In practice, though, these types of disclosures aren’t always reliable, so Google is offering developers the option to have a third party independently validate their claims against an established mobile security standard. The process is still voluntary, though.

“We provide all these tools to developers to make their apps safer, but it’s important that they can actually prove that out and validate it through an independent third party, a set of labs testing against an established standard,” says Eugene Liderman, director of Android Security Strategy.

Android and Apple’s iOS have both been moving toward offering the ability to store government-issued identification. In Android 13, Google Wallet can now store such digital IDs and driver’s licenses, and Google says it’s working with both individual states in the United States and governments globally to add support this year.

With so much to focus on and refine, Android 13 attempts to take a sprawling situation and rein it in rather than letting it spin out of control. And Android's D'Silva says there's one release coming later this year that she's particularly looking forward to: a sort of safety center within Settings that will centralize privacy and security options in one location for users. An acknowledgment, perhaps, that it's all become too much for the average user to keep track of on their own.

Android 13 Tries to Make Privacy and Security a No-Brainer

Europe’s proposed child protection laws could undermine end-to-end encryption for billions of people.

All of your WhatsApp photos, iMessage texts, and Snapchat videos could be scanned to check for child sexual abuse images and videos under newly proposed European rules. The plans, experts warn, may undermine the end-to-end encryption that protects billions of messages sent every day and hamper people’s online privacy.

The European Commission today revealed long-awaited proposals aimed at tackling the huge volumes of child sexual abuse material, also known as CSAM, uploaded to the web each year. The proposed law creates a new EU Centre to deal with child abuse content and introduces obligations for tech companies to “detect, report, block and remove” CSAM from their platforms. The law, announced by Europe’s commissioner for home affairs, Ylva Johansson, says tech companies have failed to voluntarily remove abuse content, and it has been welcomed by child protection and safety groups.

Under the plans, tech companies—ranging from web hosting services to messaging platforms—can be ordered to “detect” both new and previously discovered CSAM, as well as potential instances of “grooming.” The detection could take place in chat messages, files uploaded to online services, or on websites that host abusive material. The plans echo an effort by Apple last year to scan photos on people’s iPhones for abusive content before it was uploaded to iCloud. Apple paused its efforts after a widespread backlash.

If passed, the European legislation would require tech companies to conduct risk assessments for their services to assess the levels of CSAM on their platforms and their existing prevention measures. If necessary, regulators or courts may then issue “detection orders” that say tech companies must start “installing and operating technologies” to detect CSAM. These detection orders would be issued for specific periods of time. The draft legislation doesn’t specify what technologies must be installed or how they will operate—these will be vetted by the new EU Centre—but says they should be used even when end-to-end encryption is in place.

The European proposal to scan people’s messages has been met with frustration from civil rights groups and security experts, who say it’s likely to undermine the end-to-end encryption that’s become the default on messaging apps such as iMessage, WhatsApp, and Signal. “Incredibly disappointing to see a proposed EU regulation on the internet fail to protect end-to-end encryption,” WhatsApp head Will Cathcart tweeted. “This proposal would force companies to scan every person's messages and put EU citizens' privacy and security at serious risk.” Any system that weakens end-to-end encryption could be abused or expanded to look for other types of content, researchers say.

“You either have E2EE or you don’t,” says Alan Woodward, a cybersecurity professor from the University of Surrey. End-to-end encryption protects people’s privacy and security by ensuring that only the sender and receiver of messages can see their content. For example, Meta, the owner of WhatsApp, doesn’t have any way to read your messages or mine their contents for data. The EU’s draft regulation says solutions shouldn’t weaken encryption and says it includes safeguards to ensure this doesn’t happen; however, it doesn’t give specifics for how this would work.

“That being so, there is only one logical solution: client-side scanning where the content is examined when it is decrypted on the user's device for them to view/read,” Woodward says. Last year, Apple announced it would introduce client-side scanning—scanning done on people’s iPhones rather than Apple’s servers—to check photos for known CSAM being uploaded to iCloud. The move sparked protests from civil rights groups and even Edward Snowden about the potential for surveillance, leading Apple to pause its plans a month after initially announcing them. (Apple declined to comment for this story.)

For tech companies, detecting CSAM on their platforms and scanning some communications is not new. Companies operating in the United States are required to report any CSAM they find or that is reported to them by users to the National Center for Missing and Exploited Children (NCMEC), a US-based nonprofit. More than 29 million reports, containing 39 million images and 44 million videos, were made to NCMEC last year alone. Under the new EU rules, the EU Centre will receive CSAM reports from tech companies.

“A lot of companies are not doing the detection today,” Johansson said in a press conference introducing the legislation. “This is not a proposal on encryption, this is a proposal on child sexual abuse material,” Johansson said, adding that the law is “not about reading communication” but detecting illegal abuse content.

At the moment, tech companies find CSAM online in different ways. And the amount of CSAM found is increasing as tech companies get better at detecting and reporting abuse—although some are much better than others. In some cases, AI is being used to hunt down previously unseen CSAM. Duplicates of existing abuse photos and videos can be detected using “hashing systems,” where abuse content is assigned a fingerprint that can be spotted when it’s uploaded to the web again. More than 200 companies, from Google to Apple, use Microsoft's PhotoDNA hashing system to scan millions of files shared online. However, to do this, systems need to have access to the messages and files people are sending, which is not possible when end-to-end encryption is in place.

“In addition to detecting CSAM, obligations will exist to detect the solicitation of children (‘grooming’), which can only mean that conversations will need to be read 24/7,” says Diego Naranjo, head of policy at the civil liberties group European Digital Rights. “This is a disaster for confidentiality of communications. Companies will be asked (via detection orders) or incentivized (via risk mitigation measures) to offer less secure services for everyone if they want to comply with these obligations.”

Discussions about protecting children online and how this can be done with end-to-end encryption are hugely complex, technical, and combined with the horrors of the crimes against vulnerable young people. Research from Unicef, the UN’s children’s fund, published in 2020 says encryption is needed to protect people’s privacy—including children—but adds that it “impedes” efforts to remove content and identify the people sharing it. For years, law enforcement agencies around the world have pushed to create ways to bypass or weaken encryption. “I’m not saying privacy at any cost, and I think we can all agree child abuse is abhorrent,” Woodward says, “but there needs to be a proper, public, dispassionate debate about whether the risks of what might emerge are worth the true effectiveness in fighting child abuse.”

Increasingly, researchers and tech companies have been focusing on safety tools that can exist alongside end-to-encryption. Proposals include using metadata from encrypted messages—the who, how, what, and why of messages, not their content—to analyze people’s behavior and potentially spot criminality. One recent report by the nonprofit Business for Social Responsibility, which was commissioned by Meta, found that end-to-end encryption is an overwhelmingly positive force for upholding people's human rights. It suggested 45 recommendations for how encryption and safety can go together and not involve access to people’s communications. When the report was published in April, Lindsey Andersen, BSR's associate director for human rights, told WIRED: “Contrary to popular belief, there actually is a lot that can be done even without access to messages.”

The EU Wants Big Tech to Scan Your Private Chats for Child Abuse

A surprising number of the top 100,000 websites effectively include keyloggers that covertly snag everything you type into a form.

When you sign up for a newsletter, make a hotel reservation, or check out online, you probably take for granted that if you mistype your email address three times or change your mind and X out of the page, it doesn't matter. Nothing actually happens until you hit the Submit button, right? Well, maybe not. As with so many assumptions about the web, this isn't always the case, according to new research: A surprising number of websites are collecting some or all of your data as you type it into a digital form.

Researchers from KU Leuven, Radboud University, and University of Lausanne crawled and analyzed the top 100,000 websites, looking at scenarios in which a user is visiting a site while in the European Union and visiting a site from the United States. They found that 1,844 websites gathered an EU user's email address without their consent, and a staggering 2,950 logged a US user's email in some form. Many of the sites seemingly do not intend to conduct the data-logging but incorporate third-party marketing and analytics services that cause the behavior.

After specifically crawling sites for password leaks in May 2021, the researchers also found 52 websites in which third parties, including the Russian tech giant Yandex, were incidentally collecting password data before submission. The group disclosed their findings to these sites, and all 52 instances have since been resolved.

“If there’s a Submit button on a form, the reasonable expectation is that it does something—that it will submit your data when you click it,” says Güneş Acar, a professor and researcher in Radboud University's digital security group and one of the leaders of the study. “We were super surprised by these results. We thought maybe we were going to find a few hundred websites where your email is collected before you submit, but this exceeded our expectations by far.”

The researchers, who will present their findings at the Usenix security conference in August,  say they were inspired to investigate what they call “leaky forms” by media reports, particularly from Gizmodo_,_ about third parties collecting form data regardless of submission status. They point out that, at its core, the behavior is similar to so-called key loggers, which are typically malicious programs that log everything a target types. But on a mainstream top-1,000 site, users probably won't expect to have their information keylogged. And in practice, the researchers saw a few variations of the behavior. Some sites logged data keystroke by keystroke, but many grabbed complete submissions from one field when users clicked to the next.

“In some cases, when you click the next field, they collect the previous one, like you click the password field and they collect the email, or you just click anywhere and they collect all the information immediately," says Asuman Senol, a privacy and identity researcher at KU Leuven and one of the study coauthors. "We didn’t expect to find thousands of websites; and in the US, the numbers are really high, which is interesting,” 

The researchers say that the regional differences may be related to companies being more cautious about user tracking, and even potentially integrating with fewer third parties, because of the EU's General Data Protection Regulation. But they emphasize that this is just one possibility, and the study didn't examine explanations for the disparity.

Through a substantial effort to notify websites and third parties collecting data in this way, the researchers found that one explanation for some of the unexpected data collection may have to do with the challenge of differentiating a “submit” action from other user actions on certain web pages. But the researchers emphasize that from a privacy perspective, this is not an adequate justification.

Since completing their paper, the group also had a discovery about Meta Pixel and TikTok Pixel, invisible marketing trackers that services embed on their websites to track users across the web and show them ads. Both claimed in their documentation that a customers could turn on “automatic advanced matching,” which would trigger data collection when a user submitted a form. In practice, though, the researchers found that these tracking pixels were grabbing hashed email addresses, an obscured version of email addresses used to identify web users across platforms, before submission. For US users, 8,438 sites may have been leaking data to Meta, Facebook’s parent company, through pixels, and 7,379 sites may be impacted for EU users. For TikTok Pixel, the group found 154 sites for US users and 147 for EU users.

The researchers filed a bug report with Meta on March 25, and the company quickly assigned an engineer to the case, but the group has not heard an update since. The researchers notified TikTok on April 21—they discovered the TikTok behavior more recently—and have not heard back. Meta and TikTok did not immediately return WIRED's request for comment about the findings.

“The privacy risks for users are that they will be tracked even more efficiently; they can be tracked across different websites, across different sessions, across mobile and desktop,” Acar says. “An email address is such a useful identifier for tracking, because it’s global, it’s unique, it’s constant. You can’t clear it like you clear your cookies. It's a very powerful identifier.”

Acar also points out that, as tech companies look to phase out cookie-based tracking in a nod to privacy concerns, marketers and other analysts will rely more and more heavily on static IDs like phone numbers and email addresses.

Since the findings indicate that deleting data in a form before submitting it may not be enough to protect yourself from all collection, the researchers created a Firefox extension called LeakInspector to detect rogue form collection. And they say they hope their findings will raise awareness about the issue, not only for regular web users but for website developers and administrators who can proactively check whether their own systems or any of the third parties they're using are collecting data from forms without consent. 

Leaky forms are just one more type of data collection to be wary of in an already extremely crowded online field.

Source

Wired