While tensions over a possible nuclear attack on Ukraine remain high, experts say surveillance will likely catch Russia if it plans to do the unthinkable.

This week, NATO is conducting its regular, long-planned nuclear strike exercise known as “Steadfast Noon" to practice deploying fighter jets used to carry nuclear weapons. And Russia is expected to conduct its own nuclear drills sometime this month—as it typically does—in reaction to NATO's exercises.  While these rehearsals don't involve actual bombs, they come at a fraught moment, given Russian president Vladimir Putin's recent suggestion that the Kremlin could deploy nuclear weapons in its war against Ukraine. 

Officials from the United States and the United Kingdom have emphasized that they do not see indications that Russia is actively preparing to launch a nuclear strike. And the signals the global community has to draw on in monitoring the Russian nuclear weapons program, while not infallible, are robust. That means the world would likely know if a nuclear attack were imminent.

 “We take any nuclear weapons or nuclear saber-rattling very seriously here," White House press secretary Karine Jean-Pierre told reporters earlier this month. But, she added, “we have not seen any reason to adjust our own strategic nuclear posture, nor do we have any indication that Russia is preparing to imminently use nuclear weapons."

Similarly, Jeremy Fleming, director of the UK's GCHQ intelligence agency, said last week, “I would hope that we will see indicators if they started to go down that path.” He added that there would be a “good chance” of detecting Russian preparations.

“With Russia, the arsenal is old and established, much like the US's nuclear weapons program," says Eric Gomez, a senior fellow at the Cato Institute focused on arms control and nuclear stability. “Russia is very much enmeshed in the international and bilateral arms control treaties that provide a lot of transparency. They’re not an open book—no country is. Everyone still has certain secrets that they preserve. But if you can keep satellite or aircraft sensors trained on key spots, you can catch it if things are moving or dispersing.”

As is the case in the US and among other world nuclear powers, Russia's intercontinental ballistic missiles and submarine-launched ballistic missiles are always deployed and in a constant state of readiness. Known as “strategic” nuclear weapons, these bombs are meant to target cities or large industrial targets—probably what you think of when you imagine a nuclear bombing. The “tactical” nuclear weapons that are of more immediate concern in a Russian strike on neighboring Ukraine are smaller and meant for more contained attacks, namely in battle zones. These bombs are also known as “battlefield” or “nonstrategic” nuclear weapons and have never been used in combat.

Russia's nuclear bombs are stored in military facilities and would need to be transported and loaded into either aircraft or launchers for deployment. Pavel Podvig, who runs the research organization Russian Strategic Nuclear Forces, notes that the global community knows the location of the roughly 12 nuclear weapons storage facilities around Russia where this activity would likely originate. He adds that the US has intimate knowledge of most of the sites because it worked with Russia to improve the physical security of the repositories between 2003 and 2012 as part of an initiative called Cooperative Threat Reduction.

“The procedure for deploying these weapons would include a number of steps,” says Podvig, who is also a senior research fellow at the UN Institute for Disarmament Research. “First taking these weapons out of their bunkers, loading them on trucks, and driving them to an airfield—moving them closer to the delivery systems—and doing a checkup procedure. My understanding is, you would see the movement of the launchers, the missiles, the aircraft. It would be a pretty visible operation, and quite frankly, I think Russia would want it to be visible."

Global powers monitor each others' nuclear weapons programs through a combination of aerial and satellite surveillance and other signals intelligence. The analysis is part art, part science, as monitoring of North Korea's nuclear program has particularly shown, given the country's extreme isolation. And while GCHQ's Fleming and other researchers caution that there is never perfect information, global knowledge of Russia's nuclear program and long-standing intelligence operations inside the country will likely allow international observers to spot any Russian nuclear preparations.

“What we’ve mostly seen from North Korea is technology tests where they're showing off a lot in the public space to send specific signals internationally and domestically,” Cato's Gomez says. “With the Russians, it's a different situation. In the lead-up to Russia's invasion of Ukraine in February, the Biden administration was putting out a lot of intelligence saying, ‘We’re seeing a buildup of troops here and these units moving to these places,’ and I think that would very likely be the playbook if they saw signs of Russian nuclear preparations.”

Podvig also notes that another version of Russia's nuclear weapons staging could involve transporting the weapons to forests and then readying the strike under tree cover to minimize aerial visibility. Such an approach would still be detectable during the transport phase and could offer a sort of hybrid in which the exact nature of Russia's plan remains unknown, but the activity still sends an escalatory signal to Ukraine and the world.

“I don’t see why Russia would want to hide the deployment,” Podvig says. “But even if it wanted to, I think they will not have the certainty that they could be successful. I would assume that US intelligence and everybody is watching those sites. The Americans cannot have absolute certainty that they will see it, but Russia does not have certainty that they will not.”

How the World Will Know If Russia Is Preparing to Launch a Nuclear Attack

Custodians of the crowdsourced encyclopedia are charged with protecting it from state-sponsored manipulators. A new study reveals how.

This network mapping may also identify a particular strategy used by bad actors of splitting their edit histories between a number of accounts to evade detection. The editors put in the effort to build reputation and status within the Wikipedia community, mixing legitimate page edits with the more politically sensitive ones.

“The main message that I have taken away from all of this is that the main danger is not vandalism. It's entryism,” Miller says.

If the theory is correct, however, it means that it could also take years of work for state actors to mount a disinformation campaign capable of slipping by unnoticed.

“Russian influence operations can be quite sophisticated and go on for a long time, but it's unclear to me whether the benefits would be that great,” says O’Neil.

Governments also often have more blunt tools at their disposal. Over the years, authoritarian leaders have blocked the site, taken its governing organization to court, and arrested its editors.

Wikipedia has been battling inaccuracies and false information for 21 years. One of the most long-running disinformation attempts went on for more than a decade after a group of ultra-nationalists gamed Wikipedia’s administrator rules to take over the Croatian-language community, rewriting history to rehabilitate World War II fascist leaders of the country. The platform has also been vulnerable to “reputation management” efforts aimed at embellishing powerful people’s biographies. Then there are outright hoaxes. In 2021, a Chinese Wikipedia editor was found to have spent years writing 200 articles of fabricated history of medieval Russia, complete with imaginary states, aristocrats, and battles.

To fight this, Wikipedia has developed a collection of intricate rules, governing bodies, and public discussion forums wielded by a self-organizing and self-governing body of 43 million registered users across the world.

Nadee Gunasena, chief of staff and executive communications at the Wikimedia Foundation, says the organization “welcomes deep dives into the Wikimedia model and our projects,” particularly in the area of disinformation. But she also adds that the research covers only a part of the article’s edit history.

“Wikipedia content is protected through a combination of machine learning tools and rigorous human oversight from volunteer editors,” says Gunasena. All content, including the history of every article, is public, while sourcing is vetted for neutrality and reliability.

The fact that the research focused on bad actors who were already found and rooted out may also show that Wikipedia’s system is working, adds O’Neil. But while the study did not produce a “smoking gun,” it could be invaluable to Wikipedia: “The study is really a first attempt at describing suspicious editing behavior so we can use those signals to find it elsewhere,” says Miller.

Victoria Doronina, a member of the Wikimedia Foundation’s board of trustees and a molecular biologist, says that Wikipedia has historically been targeted by coordinated attacks by “cabals” that aim to bias its content.

“While individual editors act in good faith, and a combination of different points of view allows the creation of neutral content, off-Wiki coordination of a specific group allows it to skew the narrative,” she says. If Miller and its researchers are correct in identifying state strategies for influencing Wikipedia, the next struggle on the horizon could be “Wikimedians versus state propaganda,” Doronina adds.

The analyzed behavior of the bad actors, Miller says, could be used to create models that can detect disinformation and find how just how vulnerable the platform is to the forms of systematic manipulation that have been exposed on Facebook, Twitter, YouTube, Reddit, and other major platforms.

The English-language edition of Wikipedia has 1,026 administrators monitoring over 6.5 million pages, the most articles of any edition. Tracking down bad actors has mostly relied on someone reporting suspicious behavior. But much of this behavior may not be visible without the right tools. In terms of data science, it's difficult to analyze Wikipedia data because, unlike a tweet or a Facebook post, Wikipedia has many versions of the same text.

As Miller explains it, “a human brain just simply can't identify hundreds of thousands of edits across hundreds of thousands of pages to see what the patterns are like.”

The Hunt for Wikipedia's Disinformation Moles

Google wants to make your digital life—in its ecosystem, anyway—passwordless and more secure.

Google recently announced that passkey support is coming to both the Android operating system and the Google Chrome web browser—and if you're wondering exactly what that means, you're in the right place. Passkeys are essentially a replacement for passwords that are designed to be more secure. You use them instead of traditional passwords to get into your various digital accounts, whether that's Google, Twitter, Dropbox, or anything else.

You don't get an _actual_ key. Instead, some kind of unlocking mechanism—typically facial recognition or fingerprint recognition, or just a PIN code—is used to prove you are who you say you are for the purposes of logging in.

However, it's not just a case of pressing a button and switching over. Developers need to also code passkey support into their apps and websites, which is why Google made the announcement on its Android Developers Blog.

The move is part of a broader industry push toward a passwordless future—you might have noticed that Microsoft is doing something similar. Users don't have to remember passwords, and there aren't any passwords for hackers to steal.

How Passkeys Work

You'll soon be able to create passkeys on your Android devices.

Google via David Nield

As Google puts it, a passkey “identifies a particular user account on some online service.” At its center is a cryptographic private key that gets stored on the devices you use. This is then matched against a public key held by the digital services you're signing into to confirm your identity.

To make sure it's really you, you'll need to unlock your phone or computer, which on a phone usually means entering a PIN code or letting your face or fingerprint get scanned. On computers, passwords may still be used to verify your identity, but the industry is moving toward biometric authentication all the time.

You don't actually see the passkey itself or need to know what it is—you just have to be you. Your face or fingerprint replaces that long list of passwords on a Post-it note that you might have, so it's much simpler and more convenient.

These passkeys use public-key cryptography, so if they're involved in a data breach, they're useless to bad actors without your face or your fingerprint. Similarly, if your laptop or phone gets stolen, your accounts can't be accessed because you're not going to be around to provide the necessary authentication.

This isn't just a Google initiative. Organizations such as the FIDO Alliance and the W3C Web Authentication group are busy working toward a passwordless future as well, so you'll be able to use these systems across any device, whether made by Google, Apple, Microsoft, or any other hardware maker.

Setting Up and Using Passkeys

Biometric authentication can be used in place of a password.

Google via David Nield

The good news is that using passkeys is as easy as unlocking your phone—it's intended to be as straightforward as possible. You'll be able to choose to move to a passkey system for your accounts, but only when the app you're logging in to and the device you're using have been upgraded with passkey support.

Let's say Google has finished rolling out passkey support to Android, you're logging in to an app that has been updated to use passkeys, and you've said yes when prompted to make the switch from a standard password. You'll then be asked to create a passkey, which will involve you having to do the same action you do to unlock your phone—show your face, press down your fingerprint, or enter a PIN. That creates the passkey and authenticates the link between the app in question and the device in your hand. Whenever you need to log in to that app in future, you'll need to go through the same unlock process. As with passwords, how long that authentication lasts will vary: With your banking app, you'll usually have to log in every time, whereas with a social media account one login per device is often enough.

You'll also be able to log in to sites on your computer through your phone via the magic of a QR code. The site will display a QR code that you scan with your phone—once you've gone through the unlock process on your mobile device, your identity will be confirmed and you'll be logged in to the site.

Encrypted synchronization across devices will also be handled—Google Password Manager is adding support for passkeys, for example, so should you lose access to one device, you can still get at your accounts from another one or from the cloud, assuming you're able to provide the necessary authentication (and you haven't changed your fingerprints or face in the meantime).

How to Use Passkeys in Google Chrome and Android

Plus: Hackers hit the Mormon Church, Signal plans to ditch SMS for Android, and a Fat Bear election erupts in scandal.

Users of the cryptocurrency exchange Celsius are in danger. Last week, as part of its bankruptcy proceedings, the company submitted a 14,500-page document that appears to contain the full names and recent transactions of its users. Typically private, this sensitive information ties people’s real-world identities to their once-anonymous cryptocurrency transactions, making them ripe targets for scammers and other criminals—and crypto-tracing investigators.

If you’re considering upgrading to the new Pixel 7 or Pixel 7 Pro, rest assured that Google put the phone’s security hardware through the wringer to make hacking the device as costly as possible. Not only that, the tech giant plans to roll out a built-in VPN for Android later this year.

For Windows 11 users, we walked through how to take advantage of Microsoft’s automatic phishing protection features. And for students and their parents, we explained exactly what to do to protect against school surveillance technology.

Finally, a Connecticut jury decided this week that Infowars host Alex Jones must pay nearly $1 billion in damages for defaming the families of victims of the 2012 mass shooting at Sandy Hook Elementary, as well as an FBI agent who responded to the horrific scene. The historic jury award doesn’t change what “free speech” means in the United States, but it might make social media platforms rethink their disinformation strategies.

But that’s not all! Each week, we round up the news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

SpaceX says it can no longer fund Starlink satellite internet service in war-torn Ukraine, according to documents obtained by CNN. More than 20,000 Starlink terminals have been donated to the country since Russia invaded in February, and the service has been a lifeline for Ukrainian military efforts. But the $120 million it will take to fund the service through the end of the year is too much for SpaceX, and the company has reportedly asked the Pentagon to pick up the bill going forward.

The move to pull funding comes at an inauspicious time for Elon Musk, SpaceX’s outspoken CEO. The leaked letter asking the Pentagon to pay for Ukraine’s Starlink terminals and service is dated September 8. Less than a month later, on October 3, Musk got into a fight on Twitter with Ukrainian officials after suggesting the country end the war by largely agreeing to Russia’s demands. While a report said that Musk had a call with Russian president Vladimir Putin prior to his tweet about Ukraine appeasing Russia, both the billionaire and the Kremlin deny the call took place.

The Church of Jesus Christ of Latter-Day Saints (often known as LDS or the Mormon Church) revealed this week that hackers breached its systems in late March. In a statement, the church said that it did not disclose the intrusion until now at the request of law enforcement. While LDS says that donation histories and payment card information were not accessed, the data may include “your username, membership record number, full name, gender, email address(es), birthdate, mailing address, phone number(s), and preferred language.” According to the church, federal authorities believe the breach was “part of a pattern of state-sponsored cyberattacks aimed at organizations and governments around the world that are not intended to cause harm to individuals.”

Signal users on Android collectively groaned this week after the Signal Foundation announced that it would no longer support SMS and MMS messaging in the app. The convenient feature allowed Android users to message anyone, regardless of whether they were on Signal, through the app. (Signal’s iOS version did not support this feature.) Signal said in its announcement that the move was due to the inherent insecurity of SMS and the potential for users to forget that they weren’t sending end-to–end encrypted messages to non-Signal contacts. Signal’s lead Android developer, Greyson Parrelli, added in a forum post that part of the reason Signal was ditching SMS and MMS was because Signal “doesn’t play well” with RCS, Google’s new messaging protocol.

Not even bear-based elections are safe these days. On Sunday, officials behind Katmai National Park’s annual Fat Bear Week contest discovered that someone had monkeyed with the vote by flooding it with some 9,000 fake ballots in favor of a bear named 435. Fat Bear election integrity officials soon discovered thousands of fake email addresses linked to the bogus ballots, corrected the tally, and added a captcha to the site to fend off the spammers. Ultimately, a 1,400-pound grizzly aptly named 747 overtook 435 by some 7,000 votes and won the competition. “Bears don’t actually get anything from competing in or winning Fat Bear Week,” Amber Kraft, who helps run the competition at the park, told _Bloomberg_. “Despite which bear wins the most votes in the Fat Bear Week competition, they are all winners.”

Elon Musk’s SpaceX Bails on Starlink Funding for Ukraine

The Infowars host now knows the cost of “free speech”—but does the landmark judgment signal a crackdown on disinformation?

Anyone could have seen the blow coming. What the world didn’t expect was quite how much Alex Jones would have to pay for weaponizing disinformation and piling misery onto the Sandy Hook families as they mourned their lost loved ones. 

Jones was found liable for defaming the parents of children killed at Sandy Hook Elementary almost a year ago, in November 2021, when Connecticut judge Barbara Bellis issued a default judgment against the world’s most notorious shock jock and conspiracy theorist. In reality, most knew Jones had crossed a line after he floated the idea that the 2012 mass murder of 20 children, six educators, and the attacker’s mother was a “government operation” while speaking on an Infowars broadcast in April 2013. It would be the first of many times he repeated the lie. Yesterday, the Connecticut jury decided it would cost him everything.

Decisions against Jones in Texas and Connecticut courts add up to $1.014 billion in damages to the families of Sandy Hook victims and an FBI agent who responded to the shooting at the elementary school in Newtown, Connecticut—with attorney fees to be added to that total in a month. Jones is rapidly learning the cost of “free speech” that allowed him to warp reality in a web of lies—and it’s a staggering sum. But there may also be lessons for the platforms that for years enabled Jones’ rise—and potential consequences for them too.

“By any standard, this is an enormous jury award in a defamation case,” says Lyrissa Lidsky, a US constitutional law scholar at the University of Florida Law School. “It seems to reflect the jury’s outrage over Jones’ behavior in profiting from lies about murdered children.”

The judgment also sends a message to anyone thinking of deliberately deploying disinformation to disrupt people’s lives for financial gain: Think twice—or risk being hit with a similarly large damages payment. “There has to be some message sent here to people like him that this is simply not acceptable in a civilized society,” says Stephen D. Solomon, a journalism professor at New York University and the founding editor of online news and educational resource site First Amendment Watch.

The jury that decided Jones’ level of financial punishment certainly seems to have taken to heart the words of Christopher Mattei, a lawyer representing the Sandy Hook families in Connecticut. “It is your job to make sure he understands the extent of the wreckage that he caused,” Mattei said in his closing argument, “because you know damn well he doesn’t get it.”

This decision could mark the end of a decade of users spreading disinformation on social media with few consequences, as platforms were reluctant to step in and censure them.

It took more than five years for Facebook, Twitter, YouTube, Apple, and Spotify to ban Jones for spreading wild conspiracy theories to his audience of millions. One report at the time covered social media’s inaction as “a timeline of vacillation.” By the time platforms acted, Jones had already built Infowars into an alternative media powerhouse, and his army of adherents was prepared to follow him to fringe social media platforms. Court documents surfaced in a concurrent trial in Texas showed that at his peak in 2018, Jones was making $800,000 a day from his Infowars acolytes, and at one point he paid himself $6 million a year. That cash was—of course—built on falsehoods and enabled by social media platforms that turned a blind eye because it brought them their most prized metric: attention. Jones put a particular focus on the families of Sandy Hook victims, claiming without any evidence or credibility that their children were crisis actors and the losses were not real. Jones turned his mass audience against them in perpetual campaigns of harassment that denied their children’s existence, even as they tried to grieve their losses.

The amount awarded to Sandy Hook families has already spooked those who see the decision as an attempt to silence someone simply because they disagree with the individual’s views. In the immediate aftermath of the decision, US representative Marjorie Taylor Greene warned that the ruling was “political persecution.” “Were his words wrong and did he apologize? Yes,” Greene tweeted. “That’s what freedom of speech is. Freedom to speak words.” Meanwhile, Jack Posobiec, an alt-right conspiracist, asked his followers on Truth Social: “How much money can we get awarded for suing every media figure who said the vaccine would stop transmission?” Underneath the bombast and false threat to weaponize the US legal system is a telling truth: Jones’ defenders recognize that such judgments can bring people to heel in a way platform bans can’t.

Those who fear the erosion of First Amendment rights may be misguided. “The United States provides robust protection for freedom of expression,” says Joseph A. Tomain, senior lecturer at the Maurer School of Law at Indiana University. “That robust protection is critical for a functional self-governing democracy. At the same time, that robust protection is not absolute, and this case demonstrates the limits of free speech under US law. For the vast majority of speakers, I do not see this case as a harbinger of things to come or something that is going to result in self-censorship to avoid legal risk.”

Ken Paulson, director of the Free Speech Center at Middle Tennessee State University, also believes that the decision won’t have the detrimental impact on free speech some fear, but he says the outsized value of the damages in the case is meant to make a point. “I’ve monitored libel cases for 40 years, and I’m not sure I’ve ever seen a less sympathetic defendant,” he says. “What he did was just despicable, and at a level that would be hard to rival. The jury is just conveying its utter disgust and anger and attaching a really big number like a billion dollars to their outrage.” Yet Paulson does believe something has changed post-judgment—not least because of the ongoing debate around the future of Section 230 of the Communications Decency Act, the shield that protects social media platforms from liability for content their users post. The Supreme Court is scheduled to hear two cases that could rewrite Section 230’s power, potentially leaving platforms liable for such content.

“If there were no Section 230, this would send a massive chill through every online organization in the US that hosts comments of any sort,” Paulson says. It would signal a huge shift in platforms’ approach to policing the content posted on their sites, in large part because they’d want to avoid a massive financial punishment of the type Jones has just been walloped with. “For various reasons, including legal risk and a platform’s own standards regardless of legal risk, companies will continue to engage in content moderation,” says Indiana University’s Tomain. “At the same time, individuals will continue to seek redress in courts when they believe that the law provides a remedy based on the speech of others.”

“Large platforms have an important role to play in not giving extra oxygen to false claims that cause concrete injuries,” says Mathias Vermeulen, a disinformation expert and director of AWO, a digital rights agency. “Some of them have taken good steps to prevent such claims from being monetized on their platforms. But that never has been a real deterrent for mass-disinformation producers like Jones, who continued to thrive financially even when they were banned from these platforms.”

Now the billion-dollar judgment sets a precedent that not only can cases be won, but those who are found liable could be on the hook for monumental damages. “The lesson that anyone should take away from this is that if you use your freedom of speech to defame or to engage in fraud, you will face consequences,” says Paulson.

This could mark a sea change in how people speak on social media. For decades, shock jocks and conspiracy quacks wanted to be the next Alex Jones, rich atop a sea of true believers. Now his name is permanently associated with that landmark financial figure—one that stands to ruin him. No one will aspire to that. “Some speakers seem to be under a false impression that defamation law doesn’t apply to social media and that they can say anything they want without consequence,” says the University of Florida’s Lidsky. “This damages award is a corrective to that false impression.”

The $1 Billion Alex Jones Effect

By releasing half a million users’ transactions in a bankruptcy court filing, the company has opened a vast breach in its users’ financial privacy.

The paradoxical nature of cryptocurrency's privacy is that the blockchain, that unchangeable ledger of all a cryptocurrency's transactions, serves as both a map and a mask: Bitcoin are easy enough to follow from one address to the next. But only a few entities, like the cryptocurrency exchanges that allow users to trade their crypto for traditional currency, are able to match the inscrutable strings of numbers and letters in those addresses to real-world identities. So when one of those exchanges suddenly dumps a massive internal user database online, they haven't just spilled their own data. They've offered a key to decipher a vastly larger set of financial secrets.

That's what happened last week when Celsius, a cryptocurrency exchange facing bankruptcy, leaked an enormous collection of its users' transaction data through an unusual sort of privacy breach: a court filing. As part of its bankruptcy proceedings—in which the company's owners are accused of pulling tens of millions of dollars worth of crypto out of the exchange before revealing its insolvency—the company's attorneys released a document that appears to include the transaction data of half a million of its users from April of this year until it ceased trading in June. That database was briefly posted as a 14,500-page PDF to the court records website PACER before being taken down—but not before Gizmodo copied it to the Internet Archive, where it was widely downloaded before being removed there, too.

The data dump includes the names and transaction details of Celsius' users along with the dates and amounts of each payment. The database doesn't include the cryptocurrency addresses that directly identify senders and recipients on cryptocurrencies' blockchains, but the unique payment amounts, detailed down to more than a dozen decimal places of precision in many cases, nonetheless make it possible to match the payments to blockchains' records.

All of that means that the Celsius leak offers a rare gift to both professional and amateur cryptocurrency tracers, allowing them to not only see Celsius users' transactions, but also identify and trace those users' funds across the blockchains. That could potentially open new possibilities to identify scammers, hackers, or any other illicit users who might have exploited Celsius as a cash-out service for ill-gotten coins. But it also opens Celsius' users to exploitation by any rip-off artist or thief who combs through the data, connects it to other accounts, and identifies their cryptocurrency holdings as a ripe target.

"This is really one of the worst exchange data breaches since Mt. Gox," says Nick Bax, head of research at security consultancy and asset recovery firm Convex Labs. But even as he compares the Celsius leak to the disastrous breach of the early Bitcoin exchange Mt. Gox, which was bankrupted by hackers in 2014 and had its transaction database leaked online, he also calls it a "dream come true for analysts" focused on cryptocurrency tracing.

“You can find someone’s balance, deposits, and withdrawals and then correlate all that to the blockchain,” Bax says. “We can use it for good, but it can absolutely be misused too. Criminals are going through this right now, looking for whoever has the biggest balances.” Once they’re identified, Bax warns, those wealthy crypto holders could be targeted with spear-phishing, scams, and even physical extortion.

Cryptocurrency tracers in law enforcement, government regulators, and private firms are no doubt already following flows of funds to and from Celsius, scouring it for leads in their own research. "This is data we'll ingest, analyze, and have available as part of our investigations, and I suspect others will too," says Matt Edman, cofounder of the security startup Naxo. Edman previously worked as an FBI contractor at the Mitre Corporation, where he helped trace cryptocurrency in the criminal case of Ross Ulbricht, the creator of the Silk Road dark web market.

"When it comes to cryptocurrency tracing, following the flow of funds is not really the hard part," Edman adds. "The tricky part in those investigations is the attribution—associating an address or transaction with an individual. That's where datasets like this are key."

Celsius didn't respond to WIRED's request for comment.

In just the days following Celsius' disclosure of the database in court records, internet sleuths have already begun posting findings from the data. One well-known independent cryptocurrency tracer, who goes by the Twitter handle ZachXBT, posted evidence from the leak that a Celsius user and influencer named Lark Davis had promoted Celsius after pulling his own $2.5 million worth of crypto out of the exchange. (Davis didn't immediately respond to WIRED's request for comment.) The website Celsiusnetworth.com already claims to allow anyone to search the data for individuals' holdings at the exchange.

Meanwhile, a cryptocurrency tracer and developer for decentralized finance firm Viper Labs, who goes by the name Federico Notte, converted the PDF from Celsius' court filing into a spreadsheet and posted a link to his public Twitter account. He tells WIRED he hopes to use the database in combination with blockchain analysis to figure out the transactions of major trading funds, in hopes of learning their tactics. "It's something you can definitely do," says Notte. "It's also a major privacy concern for these people, too."

But even as legitimate analysts and investigators dig into the data, some cryptocurrency tracers emphasize that it will be of far more value to criminals. "The amount of private information is quite scary, really," says Thibaud Madelin, who leads research at cryptocurrency-tracing firm Elliptic. "Scammers will be scouting this list, and they’ll know how much people have spent, how much they’ve lost, how much they hope to make back."

"They’re ruthless," Madelin adds, referring to scammers. "And this will give them thousands of opportunities."

Celsius Exchange Data Dump Is a Gift to Crypto Sleuths—and Thieves

The company says it hardened the security of its new flagship phones—and plans to release a built-in Android VPN.

When Google launched its flagship Pixel 6 and 6 Pro smartphones last year, the company touted its Tensor “system on a chip” and dedicated Titan M2 security chip as being designed to underpin a new generation of security and privacy features. Now, as it releases Pixel 7 and 7 Pro, the company said on Tuesday that it is building on that foundation with the new Tensor G2 processor, expanded independent security certifications for Titan M2, and software features like an upcoming built-in Android VPN to protect user privacy while maintaining performance.

Google spent three years subjecting Titan M2 to testing by the third-party lab SGS Brightsight. The chip now has an array of Common Criteria hardware security certifications, the same process that smartcards, SIM cards, and bank card chips go through. Titan M2 passed the highest hardware vulnerability assessment, meaning that it is highly resistant to physical attacks, an area that has been increasingly important to chip makers in recent years.

“This testing emulates the sophistication of state-sponsored attacks, someone who’s got almost unlimited resources and determination,” says Dave Kleidermacher, vice president of engineering for Android security and privacy. “At Google and for Pixel, we talk a lot about the exploit cost. Nothing is ever perfect—there are going to be vulnerabilities and exploits—but we want to always continually raise the cost to the attacker.”

With Pixel 7 and 7 Pro, Google is continuing to expand its efforts on what the company calls Protected Computing. The goal is to restrict how and when user data can be accessed, de-identify and anonymize data when it must be used, minimize the amount of identifying data that is generally produced about a user, and keep as much processing out of the cloud and on users’ devices as possible. On Pixel devices, Google has control of both hardware and software, which the company says allows it to plan strategically and maximize security and performance rather than having to make tradeoffs.

Though the privacy and security benefits of VPNs are somewhat debated for the average user, VPN by Google One will be released as a built-in service for Pixel 7 and 7 Pro by the end of this year for users who want to encrypt their network traffic and shield their IP address from mobile networks and internet providers. Google points out that, historically, users who wanted to add a VPN on mobile needed to download a third-party option instead of having an optimized and integrated service.

VPN by Google One is open source and aims to address some classic concerns about VPNs by separating authentication and key management for encryption onto distinct servers that can't access each other. In essence, the service is set up to blind itself such that even a rogue insider would not be able to determine who you are and what your browsing history is by compromising the service. Google also says that it does not log user browsing data, though the company says it does record some anonymized, aggregate metrics. In addition to publishing a breakdown of how the service works, Google also commissioned and published an independent audit from NCC Group on VPN by Google One’s security. 

“We’re investing quite a lot in making sure we have extensive first-party and third-party audits, reviews, certification, and analysis to see that we really are providing verifiable security and privacy guarantees,” says Jesse Seed, Google’s product manager lead for silicon security.

Just as Pixel 7 and 7 Pro have logged mostly incremental improvements in their feature sets, the security and privacy changes aren’t revolutionary. But Kleidermacher and Seed emphasize that the changes this year are hard-won—and with so many digital threats to contend with, both for high-risk targets and regular users, every little bit counts.

Google’s Pixel 7 and Pixel 7 Pro Pack New Android VPN and Tensor G2, Titan M2 Chips

The latest September 2022 version 22H2 update for Windows 11 includes a new feature designed to keep you even safer than before from phishing attacks: the practice of bad actors attempting to get you to reveal your usernames and passwords so they can log in rather than break in to your accounts.

These sneaky deceptions are usually carried out over email, but they don't always have to be. Requests for your login details—made up to look like they're from genuine, respected sources—can also arrive over instant messengers, social media platforms, and SMS texts (which is then known as smishing rather than phishing).

The new protections don't need much in the way of setup or configuration—the idea is they just work when required. It's still important to be aware of how they work, and how they keep you safe.

How Phishing Works

Phishing attacks often arrive over email.

Photograph: Silas Stein/Getty Images

Phishing has been going on for a long, long time and takes many different forms. What phishing scams all have in common, however, is that they try to get you to part with your username and password details for a particular account. This is typically done through some smart subterfuge to make it look as though you're dealing with someone credible (at your bank, on a social media platform, or at your work) rather than a hacker.

For example, you might get an email that looks as though it's from your credit card company and asks for changes to be made to your account: It would redirect you to a scam website mocked up to look authentic. Once you innocently log in with your normal details, they're then in the hands of the phishers.

Or you might get an email purporting to be from your boss in the office several floors above you. It could ask you to log in to a particular company website (which again would be a fraudulent copy of the actual site), for instance, or it might ask you to simply email over a list of usernames and passwords as a matter of urgency.

Phishing attacks shape-shift to maximize their chances of success: They typically contain warnings and often put a time limit on responses (giving you less time to think about what you're doing.) Recent scams focusing on the coronavirus pandemic involved emails that hid malevolent purposes behind health and safety information.

Many phishing attempts are cleverly done and difficult to spot, but by taking your time and being cautious about any kind of digital communication that comes your way, you can usually steer clear of them—if something seems suspect, then it probably is. We've written more about staying safe in our guide to avoiding phishing scams.

Enhanced Phishing Protection

You'll see warnings like this from the new enhanced phishing protection.

Screenshot: Microsoft

One way to stay safe against phishing attacks is to keep your computer's software—from the operating system to your web browser—up to date. Modern-day applications are built with security in mind and should throw up warnings when the majority of phishing attacks are detected.

This brings us to the enhanced phishing protection now available in Windows 11. As we mentioned above, a lot of it works in the background: Whenever you enter a password into any application or website, Windows will check whether or not there's a secure connection to a trusted place on the web receiving that information.

If not—if your username and password data have been sent somewhere unknown and potentially untrustworthy—you'll see a message onscreen advising you to change your password to something different. The idea is that you'll be able to modify your login credentials before anyone has been able to exploit them.

That's not all. The new enhanced phishing protection built into Windows will also keep an eye on passwords that you use for programs and websites and warn you if any of them match the password you also use to sign into Windows: Keeping each of your passwords separate and unique is important for keeping your accounts safe.

As you might already know, you can also ditch the password for your Microsoft and Windows accounts and use a prompt on your phone to log in instead. This is an option that's becoming increasingly popular—while it's not 100 percent perfect (no security solution is), it's theoretically harder for someone to physically steal your phone off you than it is to steal a password through phishing.

Windows 11 Now Offers Automatic Phishing Protection

Colleges and K-12 campuses increasingly monitor student emails, social media, and more. Here’s how to secure your (or your child’s) privacy.

There are more eyes on students today than just a teacher’s watchful gaze. Thousands of school districts use monitoring software that can track students’ online searches, scan their emails, and in some cases, send alerts of perceived threats to law enforcement. A recent investigation by _The Dallas Morning News_ revealed that colleges have been using an AI social-media-monitoring tool to surveil student protesters.

While technology companies claim to be able to prevent violence, there’s little proof that surveillance can actually protect students. Meanwhile, monitoring software has been used to eveal students' sexuality without their consent. Low-income, Black, and Hispanic students are also disproportionately exposed to surveillance and discipline.

If your school (or your child’s school) uses monitoring software, there are a couple of steps you can take to protect your privacy—and start a conversation with your school.

Ask Your School These Questions

It’s important first to understand why your school is using monitoring software in the first place. In the US, schools _are_ required by the Children’s Internet Protection Act to have some kind of web filtering in place to prevent students from accessing obscene or harmful material online. Schools are _not_ required to implement sophisticated technologies that can scan the content of students’ emails and send alerts to police.

Next, find out your specific school’s exact monitoring practices. “A lot of these student activity monitoring tools are different. You don’t actually know the full scope of what it is until you’re able to have a conversation with someone,” says Marika Pfefferkorn, cofounder of the Twin Cities Innovation Alliance and executive director of the Midwest Center for School Transformation. Pfefferkorn also helps to lead the No Data About Us Without Us Institute, where she works to educate parents and students about data, privacy, and equity issues in their school district.

She suggests starting with a trusted teacher or counselor. If they don’t know specifics, or don’t have any documentation to answer your questions, that can be a red flag—and an indication that you may need to approach school or district leadership.

Here are some questions you can ask:

*   What software is being used? Does it operate on school devices, over the school Wi-Fi network, or both?
*   If it’s student monitoring software, what kind of information does the algorithm scan for? If the algorithm detects a “threat” or “inappropriate content,” who does the alert go to? At what point does content get flagged to a third party, such as law enforcement?
*   How is student data secured?
*   Where can students and parents report violations of privacy in the district? What processes does the district have to repair harm?
*   How much of the budget is used for surveillance technology?

Pfefferkorn also encourages asking your school to perform an audit of its monitoring software, which could reveal what kind of content the algorithm is tracking and how. An audit might reveal whether the software is truly effective or is picking up on false alarms. Encourage your school to document and inform parents of exactly what they track, how they store, and when they delete student data. Ask if you can have your child’s data deleted, or at least see what has been collected.

Act Like You’re Being Watched, Even After School

Whether you’re using your phone on your school’s Wi-Fi, or you’re using a school laptop at home, assume that everything you do is being scanned and logged by monitoring software. Did you plug in your personal phone to your school laptop? The photos on your phone might be scanned too.  Nude photos sent from students’ personal phones, if plugged into school devices to charge, have triggered alerts to school administrators.

“You should assume that anything touching your school-issued device is going to be monitored in some way,” says Jason Kelley, associate director of digital strategy at the nonprofit Electronic Frontier Foundation. Monitoring doesn’t stop after school or off-campus either.

If you’re a student, practice the basics of digital privacy. Don’t use your school laptop or Wi-Fi to search for anything sensitive, such as medical information. Remember that any kind of data or content on a school communications platform can be scanned and flagged: your school email address, the documents you type into your school Google Drive, your online searches, the images you download, the videos you watch. Even content that is completely safe might be flagged by the algorithm: For example, the software Gaggle can flag keywords related to LGBTQ identity such as ”gay” and “queer” as instances of bullying.

Even if you trust a handful of teachers or counselors, remember that your activity could be seen by other adults in the school, or even law enforcement. Don’t do anything on your device that you wouldn’t want them to see as well.

Others might advise students to “just use your personal device, on your family’s personal network.” It’s important to note that this kind of guidance isn’t accessible to all students. For low-income students, who might rely more on school technology, it may be more difficult to sidestep a school’s surveillance structures.

Mind Your Social Media

Schools might also use AI tools to track social media posts. This is particularly relevant for college students. While colleges generally don’t use content monitoring software, it’s likely they’ll monitor students’ social media for potential risk of violence or protest.

Just as you would assume that anything you type on your school-issued device can be seen and scanned by an algorithm, assume that your public social profiles can be, too. Even private accounts aren’t completely safe, says Kelley. (Yes, even your super-locked-down Finsta.) If you comment on a public account, for example, that might be scanned and subjected to social-media-monitoring algorithms as well.

If you’re in doubt, send text messages rather than using a social media platform. You might consider using an encrypted messaging app like Signal. If you’re discussing topics that might be more sensitive (such as reproductive rights access), the safest way to communicate is with a trusted person, in person.

Team Up With Other Students and Parents

After gathering your research, you might feel that your school isn’t using monitoring software fairly or appropriately. Pfefferkorn recommends having conversations with other students and parents. Listen to what they’re experiencing and how they’re thinking through it, especially if you want to push back against your school’s use of monitoring software.

If you feel you need legal support, reach out to a local agency. Pfefferkorn recommends your local ACLU, NAACP, or Restore the Fourth as good options for advocacy assistance.

Your school’s response will depend on whether you go to a public or private school. For example, a public school might be required to disclose more information, for example, about how much it spends on monitoring software. A private school would not be obliged to give that same information. As another example, while public schools must abide by the recent ruling that room-scanning proctoring software is unconstitutional, private schools do not.

Now is a critical moment for students, parents, and communities to help shape the future of safety in schools, according to Pfefferkorn. Congress passed a law that directs $300 million for schools to strengthen security infrastructure, in addition to the funding to schools through the American Rescue Plan. She hopes that communities can be more involved in how schools invest that funding, and can help shape more proactive solutions. “It’s really critical right now for us to prioritize our values as a community of what safety means,” she says. “For me, safety is not being surveilled.”

How to Protect Yourself If Your School Uses Surveillance Tech

Plus: The US warns of a mysterious military contractor breach, a "poisoned" version of the Tor Browser is tracking Chinese users, and more.

As A Swatting spree spreads across the US, in which false reports of active shooters send police charging into schools, WIRED investigated more than 90 of the incidents and found potential connections between many of them. “In speaking to a number of people who experienced it, I can tell you that the anxiety and fear—it was real to them for 15 minutes,” Amanda Klinger, director of programs and cofounder of the Educator’s School Safety Network, told WIRED. “There’s a period of time in these incidents where people are literally running for their lives, law enforcement is responding with their weapons, and people think it's the real thing.”

Even after extensive sanctions meant to isolate Russia from the global economy amidst its ongoing war with Ukraine, investigators around the world are working to curb the ongoing influx of capital to Russian military and paramilitary groups. Former Uber executive Joe Sullivan was convicted this week of obstructing a Federal Trade Commission investigation and failure to report a felony, a development that is being watched closely by the tech industry because it is likely the first time a corporate executive has faced criminal charges related to a data breach. The Biden administration's new executive order addressing privacy seems like more of a Band-Aid than a panacea, as it attempts to reassure Europeans that their data is safe when stored in the US, despite government surveillance. 

Meanwhile, Meta released findings on more than 400 malicious Android and iOS apps that it says were harvesting Facebook credentials to take over users' accounts. And we took a look at the toll of living your life online, the potential erosion of privacy that comes with consistent social media posting, and the ways it can impact your sense of self. 

Plus, there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

Another day, another massive hack in the cryptocurrency industry. But this one is strange.

Binance revealed Friday that unidentified hackers managed to exploit a flaw in the company's BNB Chain crypto token, allowing them to mint 2 million of the company’s decentralized tokens worth a total of $569 million. That money wasn’t actually stolen from Binance, in other words, but rather fabricated out of thin air thanks to a flaw in the security of Binance’s cryptocurrency. But the hack nonetheless seemed poised to flood the market with BNB and thus reduce its value for legitimate owners, while allowing the hackers to walk away with half a billion dollars.

Unfortunately for those hackers, even they didn’t seem prepared for their sudden windfall. Cryptocurrency-tracing firm Elliptic found that they quickly traded away some fraction of their tokens for a variety of other cryptocurrencies. That allowed them to obtain about $53 million in Ethereum-based tokens. But other cryptocurrencies that they traded their BNB for, like Tether and USDC, are more centrally controlled, allowing the funds to be frozen. Binance, meanwhile, managed to temporarily shut down its BNB blockchain to prevent the hackers’ newly mined currency from moving further. “So we have a very sophisticated exploit, managing to mint yourself $569 million,” says Elliptic research lead Thibaud Madelin. “But what followed was a complete shambles, to be honest.”

In the end, Elliptic believes the hackers kept hold of less than 10 percent of their loot—not bad for a day’s work but little more than a blip in the wild world of digital money.

A joint advisory from the Cybersecurity and Infrastructure Security Agency, the FBI, and the NSA warned that the network of an unnamed military agency or contractor had been breached by a so-called “advanced persistent threat” hacker group, an industry code phrase for state-sponsored hackers. According to the alert, the spies maintained their access inside the network for around 10 months, penetrating a Microsoft Exchange server where they installed a commonly used backdoor known as China Chopper. The hackers also used a tool called Impacket to move from machine to machine and another tool called CovalentStealer to siphon data from their targets. As is often the case with government alerts, the advisory didn't attribute the breach to any particular country's government, nor even a known hacker group. The eagle-eyed (or vulture-eyed) Register spotted that the advisory initially included a box at the top suggesting organizations “protect against Russian-state sponsored malicious cyber activity,” which was later deleted. But others, like cybersecurity firm AttackIQ, point to Chinese calling cards in the intrusion.

Since early this year, hackers have been distributing a tainted version of the Tor Browser that collects personal data about Chinese users including form data they submit, browsing history, location data, and computer name, according to security firm Kaspersky. The Tor Browser is meant to be an anonymity-focused tool that is often used in countries like China where users are seeking to circumvent government-imposed internet restrictions, tracking, and censorship. Kaspersky found that the attackers advertised the malicious app by including a link to download it in a video posted to a popular Chinese-language YouTube channel. The video has more than 64,000 views. The installer for the malicious browser includes a compromised version of Tor that siphons victim data and sends it to attackers.

Isabela Fernandes, executive director of the nonprofit Tor Project, told CyberScoop that there is now a patch available. “Basically this ‘poisoned’ Tor Browser modifies the update URL so it cannot be updated normally. What we did was to add a redirect so we are responding to the modified URL, this way people will update. Now their URL is a working update URL.”

As part of its push to crack down on robocalling, the US Federal Communications Commission said this week that it is taking seven voice over IP services off of its trusted carriers list unless they add legally required robocall protections. The move would essentially block the services from being able to complete calls in the US. “Fines alone aren’t enough,” the FCC wrote in its announcement. “Providers that don’t follow our rules and make it easy to scam consumers will now face swift consequences.”

Source

Wired