The fun-loving cybercriminals blamed for breaches of Uber and Rockstar are exposing weaknesses in ways others aren't.

After suffering a breach earlier this month, the ride-share platform Uber said last week that it believes the infamous hacking group Lapsus$ was behind the attack. The incident was in line with the group's track record of using phishing to gain access to corporate accounts that can then be parlayed into broader access. Then on September 23, police in the United Kingdom said they had arrested an unnamed 17-year-old in Oxfordshire who seems to be one of the individuals previously arrested in connection to Lapsus$ in March.

Lapsus$, which may also have breached the _Grand Theft Auto_ developer Rockstar in this latest hacking spree, has established itself in the pantheon of memorable hacking groups for breaching a slew of massive tech companies, including Microsoft, Nvidia, Okta, Samsung, and Ubisoft. They did so to make money, sure, but they also apparently wanted to take the digital-teen joyride of a lifetime. Researchers say that this wild and unpredictable streak is an important key to the group's success that should not be overlooked.

“Lapsus$ probably aren’t causing as much destruction as other actors with different motivations could, and I think that's the answer—they aren’t entirely motivated by money,” says Brett Callow, a threat analyst at the antivirus company Emsisoft. “They, therefore, attempt things that purely financially motivated cybercriminals wouldn’t. They are more likely to be adventurous and to try things—that may not have a payoff—just for the fun of it.”

This creative enthusiasm and flair for the dramatic is an important case study. While Lapsus$ seems to perpetrate crimes of opportunity rather than working under a mandate to target certain entities or achieve specific results, the way nation-state actors often do, their seemingly boundless success reveals just how many weaknesses are lurking in organizations around the world that have gone unexposed only because they weren't immediately useful to state-backed actors or cybercriminals. 

“I find the Lapsus$ group significant, because they have highlighted systemic problems in real-world implementations of single sign-on and multifactor authentication,” says independent security researcher Bill Demirkapi. “The techniques that they've used in their attacks are nothing new, but what we're seeing is the widespread abuse of these weaknesses and a wakeup call to organizations.”

Lapsus$ breached Uber by targeting an individual contractor whose username and password had been compromised by another entity through a malware infection and was sold on the dark web, the company said. Lapsus$ repeatedly sent the victim multifactor authentication login notifications until they mistakenly approved access. In a previous, unrelated attack, Lapsus$ breached a contractor working with the authentication company Okta in an attempt to compromise organizations through the identity management provider. The tactics in both instances show that there are weaknesses in some multifactor authentication strategies and they highlight a downside to “single sign-on” schemes in which one carefully protected authentication process grants access to a slew of services. The benefit to organizations is that there's only one account to protect and manage instead of many, and this cuts down on weaknesses like password reuse. The drawback, though, is that if an attacker compromises a single-sign-on account, they gain access to multiple internal services within an organization at once.

“At the end of the day, the flexibility of how you can abuse corporate accounts to move laterally and pivot over to other applications in the cloud—there are just so many different ways that attackers can use enterprise credentials,” says Crane Hassold, director of threat intelligence at Abnormal Security and a former digital behavior analyst for the FBI. “That's why phishing is so extremely popular with cybercriminals, because of that return on investment.”

There are stronger ways to implement two-factor authentication, and the new generation of “password-less” login schemes or “Passkeys” from the industry FIDO2 standard promise a much less phishable future. But organizations need to actually start implementing these more robust protections so they're in place when a ransomware actor (or restless teen) starts poking around.

“Phishing is obviously a huge problem, and most of the things that we normally think of as multifactor authentication, like using a code generator app, are at least somewhat phishable, because you can trick someone into revealing the code,” says Jim Fenton, an independent identity privacy and security consultant. “But with push notifications, it’s just too easy to get people to click ‘accept.’ If you have to plug something directly into your computer to authenticate or use something integrated with your endpoint, like a biometric sensor, those are phishing-resistant technologies."

Keeping attackers from clawing their way into an organization through phishing isn't the only problem, though. As the Uber incident showed, once Lapsus$ had compromised one account to gain access, they were able to burrow deeper into Uber's systems, because they found credentials for internal tools lying around unprotected. Security is all about raising the barrier to entry, not eliminating all threats, so strong authentication on external-facing accounts would certainly have gone a long way toward stopping a group like Lapsus$. But organizations must still implement multiple lines of defense so there's a fallback in case one is breached. 

In recent weeks, former Twitter security chief Peiter “Mudge” Zatko has publicly come out as a whistleblower against Twitter, testifying before a US Senate committee that the social media giant is woefully insecure. Zatko's claims—which Twitter denies—illuminate how high the cost could be when a company's internal defenses are lacking.

For its part, Lapsus$ may have a reputation as an outlandish and oddball actor, but researchers say that the extent of its success in compromising massive companies is not just remarkable but also disturbing.

“Lapsus$ has highlighted that the industry must take action against these weaknesses in common authentication implementations,” Demirkapi says. “In the short term we need to start by securing what we currently have, while in the longer term we must move toward forms of authentication that are secure by design.”

No wakeup call ever seems sufficiently dire to produce massive investment and quick, ubiquitous implementation of cybersecurity defenses, but with Lapsus$ organizations may have an additional motivation now that the group has shown the world just how much is possible if you're talented and have some time on your hands. 

“Cybercriminal enterprises are exactly the same as legitimate businesses in the sense that they look at what other people are doing and emulate the strategies that prove successful,” Emsisoft's Callow says. “So the ransomware gangs and other operations will absolutely be looking at what Lapsus$ has done to see what they can learn.”

The Dire Warnings in the Lapsus$ Hacker Joyride

It won’t solve all of your privacy problems, but a virtual private network can make you a less tempting target for hackers.

A virtual private network (VPN) is like a protective tunnel you can use to pass through a public network, protecting your data from outside eyes. Whether you're worried about hiding your browsing activity from your internet service provider so it doesn't sell your data to advertisers, or you want to stay safe on a public Wi-Fi hot spot to keep nearby digital snoops from capturing your passwords, a VPN can help protect you.

However, while a VPN will keep you safe at your local coffee shop, it comes with a cost. Using a VPN means your VPN provider will know everything about your browsing habits. This makes VPN providers a target for hackers. Be sure you even need one before you read on.

Picking the right VPN service is serious business. Most VPN providers say they keep no logs of their users' activity, but this is rarely verified. You're stuck taking companies at their word. For this reason, we've limited our testing to VPN providers that have been independently audited by security firms and have published the results.

To help you sort out when and why you might want a VPN, as well as why you might not, be sure to read through our complete guide to VPNs below. If you're sure you want to use a VPN, here are our top picks among commercial VPN providers.

_Updated September 2022: We've included some updated speed test results, included some new features from Surfshark, and noted our experiences paying for Mullvad with bitcoin._

_Special offer for Gear readers: Get a_ _**1-year subscription to**_ **WIRED** _**for $5 ($25 off)**__. This includes unlimited access to_ WIRED._com and our print magazine (if you'd like). Subscriptions help fund the work we do every day._

> If you buy something using links in our stories, we may earn a commission. This helps support our journalism. Learn more.

Best for Most People

**Surfshark VPN**

Surfshark wouldn't be my top pick if my life depended on my VPN, but for most of us that's not the case. If you just want a way to get around some geographical restrictions on content (aka access Netflix) and protect your traffic while using an open Wi-Fi hot spot, Surfshark is a good choice. It's secure, and it provides a great value for the money if you pay for two years up front.

Surfshark offers a kill switch that automatically stops your traffic if your VPN connection fails, and it supports multihop VPN connects, which means your traffic goes from your machine to a VPN server to another VPN server, and then to the destination server. This provides an extra layer of protection should the VPN itself be compromised, though there is a corresponding speed hit when using a multihop connection. The company also recently added support for manual Wireguard configuration. Most people will be fine sticking with Surfshark's apps, but if you're trying to connect your entire network to Surfshark directly through a router, the manual configuration will be welcome news.

In my testing over the years, Surfshark has consistently had some of the best speeds of any VPN I've used. Yes, it is slower than not using a VPN, but I have never had any problem streaming HD content through Surfshark. It's fast enough that in most cases you won't notice any speed degradation at all.

Surfshark is based in the British Virgin Islands, which, although technically a territory of Great Britain, is generally considered a safe haven and has no data-retention laws. What I don't like is that Surfshark is legally untested. The company has a zero-log policy, and you can (and should) opt out of the diagnostic crash reports in the app. Still, you're taking Surfshark at its word when it says it won't keep logs of your internet activity. Encouragingly, the company's browser extensions have undergone an independent security audit that didn't turn up any significant problems. 

Surfshark recently merged with NordVPN. So far we have not noticed any changes for its customers, but we will be keeping an eye on it going forward.

**Surfshark costs $2.50 per month if you buy two years up front, $4 per month if you buy one year up front.**

Best for Advanced Users

**Mullvad VPN**

Mullvad is based in Sweden and first came to my attention because of its early support for WireGuard, a faster protocol for tunneling VPN traffic.

Another thing I like is Mullvad's system for accepting cash payments. If you prefer to remain totally anonymous, you can generate a random account number, write that number down on a slip of paper, and mail it, along with cash, to Sweden. In theory, no one will be able to connect you to that account. (The truly paranoid will don a tinfoil hat, wear gloves, print from a public printer, and mail from a remote mailbox.) I have not tested the cash option, but I did recently extend my Mullvad subscription using bitcoin and it worked without a hitch.

Part of what I like about Mullvad is its down-to-earth approach that doesn't overhype with its marketing and helps users take additional steps to protect their privacy. For example, the company has an entire page showing you how to disable WebRTC in your web browser. As long as WebRTC is enabled (and it is by default in most browsers), websites can view your actual IP address even when you use a VPN.

Mullvad offers apps for every major platform, as well as routers. The applications are all open source, and you can check the code yourself on GitHub. The service has been independently audited as well. Advanced users can download configuration files and use them directly with OpenVPN or Wireguard.

In my testing, speeds were very good. I never encountered a situation where I couldn't get a fast connection. Over the years Mullvad has become the VPN I rely on day-to-day.

**Mullvad VPN costs 5 euros (around $6) per month, cash or charge.**

Best for VPN Newcomers

**TunnelBear VPN**

Choosing a VPN can be overwhelming. If you're tired of security mumbo jumbo and lock icons, TunnelBear might be the VPN for you. Its cute bear animations help demystify what VPNs do, how they work, and what they can offer you. Sometimes the easiest way to make technology more approachable is to put a friendly face on it.

Don't worry though, TunnelBear isn't all cute bear animations. It has the same security features as other VPN providers, like a no-logging policy and a clear privacy policy, and it's been independently audited.

In my testing, speeds with TunnelBear were competitive with the other options listed here. One of my favorite parts of TunnelBear is the free trial option, which makes it easy to test-drive it and see what your speeds are like without committing. TunnelBear has fewer geographic server locations than some of our other options, but unless you're traveling abroad or need to get around a specific geo-restriction, that shouldn't matter for most users.

**TunnelBear costs $3.33 per month if you buy one year up front****.**

Best for Circumventing Geographic Restrictions

**NordVPN**

NordVPN is one of the most popular VPNs around, thanks to a wide selection of servers and reasonable prices. It's also one of the most reliable ways I've found to circumvent location-based restrictions. I used it extensively while living in Mexico to get around Netflix's geographic restrictions. That said, this is a cat-and-mouse game; Netflix is always updating its server ban list, so NordVPN might not work in the future.

NordVPN is based out of Panama, which is not part of the Five Eyes, Nine Eyes, or 14 Eyes jurisdictions. That doesn't mean your government can't spy on you, but it does at least mean it will have to put in some extra legwork to do it (yes, that's about where we are these days). NordVPN has been audited a number of times, most recently in June of last year, when third-party auditor VerSprite found nothing amiss. As noted above, NordVPN and Surfshark recently announced a merger. Both will continue to operate as separate entities, but they are now a single company.

NordVPN also recently added a new service dubbed Threat Protection, which will block web-based trackers, phishing attempts, some ads, and malicious websites. I have not tested it extensively, and I personally rely on browser-based plug-ins to block threats like this. But if you're looking for an all-in-one solution, this might work.

I've never had an issue with speed using NordVPN, and the user interface of its apps is dead simple. Just click the country you want to use and the app will take care of connecting and configuring everything for you. If you want manual control, you can connect by using NordVPN's configuration files.

**NordVPN costs $5 per month if you buy one year up front. It also has frequent sales on a two-year deal that works out to about $3 a month.**

Best for High-Risk Use Cases

**Tor**

If you're in a situation where personal security is of the utmost importance, do not rely on a VPN. Use Tor (ideally through Tails) instead.

Using the Tor network accomplishes some of the same things as a VPN, but it's a little bit different. Tor provides anonymity, meaning no one can figure out who you are, but not necessarily privacy. People still might be able to see what you're doing, they just won't know it's you doing it. (VPNs provide privacy because no one can see what you're doing while you're going out of a VPN tunnel, but you don't have anonymity because the VPN provider knows who you are.)

Tor is simple to set up. All you need to do is download the Tor browser, and it will connect you to the web. Once you're connected to the Tor network, you can browse the web as you normally would. Except everything will be slower. When using Tor, your request for a website hops around the Tor network, bouncing between servers, before emerging and connecting to the actual site you want to visit. This makes Tor slow, sometimes incredibly slow, but that's necessary to protect your anonymity. And yes, you can combine a VPN with Tor, though that's somewhat beyond the scope of this guide.

How We Picked

VPN providers like to claim they keep no logs, which means they know nothing about what you do using their services. There are a variety of reasons to be skeptical about this claim, namely because they have to have a user ID of some kind tied to a payment method, which means the potential exists to link your credit card number (and thus your identity) to your browsing activity.

For that reason, I mainly limited my testing to providers that have been subpoenaed for user data in the US or Europe and failed to produce the logs or have at least undergone a third-party security audit. While these criteria can't guarantee the providers aren't saving log data, this method of selection gives us a starting point for filtering through the hundreds of VPN providers. Unfortunately other factors also come into play, VPNs that once made our list—Like ExpressVPN—are sometimes sold to less reputable companies. In cases like ExpressVPN I chose to remove it mainly because I have no way to know if it remains trustworthy or not.

Using these criteria, I narrowed the field to the most popular, reputable VPN providers and began testing them over a variety of networks (4G, cable, FiOS, and plenty of painfully slow coffee shop networks) over the past nine months. I tested network speed and ease of use (how you connect), and I also considered available payment methods, how often connections dropped, and any slowdowns I encountered.

Why You Might Not Need a VPN

It's important to understand not just what a VPN can do, but also what it can't do. As noted above, VPNs act like a protective tunnel. A VPN shields you from people trying to snoop on your traffic while it's in transit between your computer and the website you're browsing or the service you're using.

Public networks that anyone can join—even if they have to use a password to connect—are easy hunting grounds for attackers who want to see your network data. If your data is being sent unencrypted—like if the website you're connecting to doesn't use the secure HTTPS method—the amount of information an attacker can gather from you can be disastrous. Web browsers make it easy to tell when your connection is secure. Just look for a green lock icon at the top of your screen next to the web address. These days, most websites connect using HTTPS, so you're probably fine. But if that green lock icon isn't there, as it sometimes isn't on school, library, and small business websites, anyone can view whatever data you're sending. Unless you're using a VPN, which hides all of your activity, even on unencrypted websites.

Just connecting to a VPN isn't enough. Be sure to check out our guide to using a VPN to make sure you have everything set up correctly.

A VPN also changes your IP address, which adds an additional layer of protection. By giving you a different IP address, a VPN can make it appear as though you're in a different physical location. So even if you're sitting in California, the website you're accessing will think you're in Canada, Hungary, Uruguay, or Thailand. Unfortunately, this method of obscuring your location is not airtight. Technology built into web browsers that's known as WebRTC can leak your true IP address even when you're using a VPN. If this is a concern, disable WebRTC in your browser before connecting to a VPN. Mullvad has instructions on how to disable WebRTC in most browsers.

It's debatable how much masking your IP address really helps protect your privacy in the first place. Your IP address is only one of many, many bits of data websites collect about you. If privacy is your concern, you're better off using web browsers (and extensions) that offer additional tools to protect your privacy. Mozilla Firefox has several of these tools available. Or if you want to get serious about it, use the ultra-private Tor browser as noted above.

To add to the confusion around VPNs, providers—even some I've recommended here, unfortunately—often engage in misleading marketing. Nearly every VPN service website I visited had some kind of red banner claiming I was “not protected,” even when I was using a VPN at the time. The problem is that I wasn't using _their_ VPN. More honest VPN providers, like Mullvad, tell you what's actually happening: “You're not protected _by Mullvad_.” Kudos to Mullvad for not using fear to sell subscriptions.

Either way, the important thing to remember is that using a VPN does not make you anonymous. While VPNs may not be able to do much to protect your privacy, they are an essential tool when it comes to protecting you from snoops trying to gather your unencrypted data sent over insecure networks.

The Best VPNs to Protect Yourself Online

UN countries are preparing to pick a new head of the International Telecommunications Union. Who wins could shape the open web's future.

This week in Romania, a US State Department candidate is facing a Russian challenger in an election for the leadership of one of the most important international technology bodies in the world.

Who wins could determine whether the internet remains a relatively decentralized and open platform—or begins to centralize into the hands of nation-states and state-run companies that may want great control over what their citizens see and do online. Yet, with just days to go before the vote, the race for secretary-general of the International Telecommunications Union (ITU) has garnered painfully little attention.

It’s a two-person race: On one side is the American, Doreen Bogdan-Martin, a former Commerce Department expert on telecommunications who joined the ITU in the 1990s. She’s squaring off against Rashid Ismailov, the former deputy minister for Russia’s telecommunications ministry.

According to their election platforms, Bogdan-Martin and Ismailov signal the same core objective: connecting every person in the world to the internet and cellphone service by 2030. The two candidates, however, represent fundamentally different visions for the future of the internet. Bodgan-Martin’s campaign has focused on her track record of navigating the complex machinery of the United Nations body. Ismailov, meanwhile, has promised a “humanization” of telecommunications infrastructure—and has invoked his candidacy as a way to reject American “dominance” online.

If the wrong candidate wins, says Göran Marby, head of Internet Corporation for Assigned Names and Numbers (Icann), the stakes couldn’t be higher: “People around the world might not be able to connect to one single interoperable internet.”

Today, the ITU technically sits under the auspices of the United Nations. But it predates the world’s major deliberative body by about 80 years.

Originally established to do things like standardize the Morse code alphabet and codify the standard distress call, the ITU is today responsible for creating standards and interoperability between an array of services and technologies and expanding access to modern communications platforms.

Maintaining interoperability is an unsung but critical job. The ITU needs to ensure that all countries can agree on allocating space on the radio frequency spectrum, and it assigns orbital slots to various communication satellites, amongst other tasks. For example, the ITU is the reason a Japanese cellphone can still work in Dakar, and vice versa.

Unlike other UN bodies, the ITU is not merely the purview of nation-states: Its members include 190 nation-states, as well as 900 corporations, research bodies, and NGOs. (Only nations can vote in leadership elections, however.) For the past eight years, the organization has been led by Secretary-General Zhao Houlin, who had been rising in the ranks of the sprawling ITU bureaucracy since he left the Chinese telecommunications ministry in 1986.

Kristen Cordell, an adjunct fellow at the Center for Strategic and International Studies (CSIS), has called the ITU “the most important UN agency you have never heard of.” Decisions made at the international body, she argued, “have a tremendous impact on the everyday lives of Americans.”

Authoritarian states like China, Cordell wrote, “have increased their interest and activism in the ITU, leading to concerns that their outsized influence in standards setting may lead to the bifurcation of the internet.” Houlin’s time at the helm of the organization, according to Cordell, has been marked by “highly favorable comments and decisions in support of Chinese companies.” Those companies have, in turn, ramped up their involvement in the ITU. Huawei alone has submitted some 2,000 new standards proposals to the organization, according to Cordell.

In 2019, Houlin signed a memorandum of understanding between the ITU and the Export-Import Bank of China to expand internet access through the Global South under China’s signature Belt and Road Initiative. The initiative has been criticized as a form of neocolonialism: hooking up countries, particularly in Africa, to high-interest loans that leave them beholden to Chinese investment.

Proposals from Chinese state enterprises and from Beijing itself suggest, in their words, a “New IP” and are purportedly a response to a lack of innovation in how data is processed at the lowest levels of the internet. China has suggested that tagging data packets by their intended purpose could improve data routing and reduce latency. Beijing, in ITU proposals, offers altruistic examples, like prioritizing streaming data associated with virtual surgeries.

Critics, however, say the issues diagnosed by China are already being addressed and that such a proposal would likely worsen these fundamental problems, not improve them. The Internet Society, a US-based nonprofit that promotes internet openness, derided the proposal as one likely to make those identified problems worse and said it ignores progress in making the patchwork of different systems and operators play well with each other. “Creating overlapping work is duplicative and costly. In the end, it does not enhance interoperability,” wrote Internet Society analysts Hascall Sharp and Olaf Kolkman.

Many see an ulterior motive. This new balkanized internet “would lack free and open standards and be primed for manipulation by autocrats that seek to limit civil liberties and human rights,” Cordell argues.

“The internet, at its lowest level, should be data-agnostic,” says Mallory Knodel, chief technology officer at the Center for Democracy & Technology. There is “less information control if the data is agnostic,” she says.

“New IP would centralize control over the network into the hands of telecoms operators, all of which are either state-run or state-controlled in China,” reads a 2020 report from Oxford Information Labs, prepared for NATO and obtained by _Infosecurity Magazine_. “So, internet infrastructure would become an arm of the Chinese state.”

Members of the ITU have largely shot down these proposals for New IP. But that doesn’t mean China is giving up.

Fiona Alexander, a cofounder of Salt Point Strategies who is also part of the American delegation to the ITU, points out that there is a “sleight of hand” going on with some of the authoritarian regimes as they advance proposals like New IP—most recently, China has rebranded that proposal to the innocuous-sounding “IPV6+.”

China has acknowledged that increased central control is, in its view, an upside of these proposals. “States have the right to make ICT-related \[information and communications technology\] public policies consistent with national circumstances to manage their own ICT affairs and protect their citizens’ legitimate interests in cyberspace,” reads a set of 2019 submissions written by Beijing.

This kind of work is, traditionally, not the purview of the ITU. Nongovernmental groups, like Icann and the Internet Engineering Task Force (IETF), tend to be more directly responsible for managing the actual protocols that govern the internet.

The Russian candidate to replace him, Ismailov, is no stranger to China’s international policy: He spent three years as a regional vice president at Huawei. From there, Ismailov rose through the ranks of the Russian Ministry of Telecom and Mass Communications before joining Nokia and later Russian telecommunications firm PJSC VimpelCom.

Beijing and Moscow have made no secret of the fact that they’re on the same page at the ITU.

A 2021 pact between Beijing and Moscow committed both countries to flexing their muscle when it comes to international technology governance, with an eye to “preserving the sovereign right of States to regulate the national segment of the Internet.”

“Russia and China emphasize the need to enhance the role of the International Telecommunication Union and strengthen the representation of the two countries in its governing bodies,” the agreement concludes.

Ismailov has been transparent that his view of the organization stands in stark contrast to that of his American competitor.

“Americans are, perhaps, allergic to everyone who has anything to do with Huawei,” Ismailov said in his official, 30-minute campaign video. “I don’t understand why this has happened.” He added that the “demonization” of the Chinese company was done, in his view, “out of fear of competition.”

While Ismailov said he would “strive to avoid this politicization” of the organization, he also pledged to defend Russia against consequences levied for its war in Ukraine.

“I want to make sure that the organization focuses more on its actual objectives—frequencies standardization, etc,” he said, through a translator, in his campaign video. “Of course this won’t be totally possible because technology is now an integral part of our everyday life, including geopolitics. We are seeing this with the sanctions that are being imposed. Russia is being pressured in all international organizations—some want to strip it of its voting rights, others want to expel Russia.”

In a press conference in May, Ukraine’s head of the State Special Communications Service, Yurii Shchyhol, said his country had moved to sanction Russia at the ITU as a denouncement of its invasion of Ukraine—what Ismailov euphemistically refers to as a “special military operation.”

If she wins, Bodgan-Martin will be the first woman to lead the ITU—she will also be the first American to lead the organization since 1965. While the State Department says Bodgan-Martin’s candidacy is a matter of having “the right candidate at the right time,” her bid for the job is no accident.

Houlin’s first candidacy for the secretary-general position, in 2014, went unopposed. In 2017, the Trump administration unveiled its National Security Strategy: a hodgepodge of tactics to counter China’s rising influence in the world. In it, the White House identified the protection of a free and open internet as a top priority and set “active engagement in key organizations” as necessary measures, mentioning the ITU by name.

Yet at the 2018 ITU Plenipotentiary Conference, Houlin again ran unopposed—his re-election bid was supported by 176 of the 178 countries present.

Ahead of the vote on September 29, at this year’s conference in Bucharest, the United States seems to be taking the race seriously. Members from the American delegation, as well as a senior official at the State Department who spoke on the condition of anonymity, said Bodgan-Martin has been campaigning intensely. A litany of photos posted to Twitter, and a surprisingly active hashtag, show her meeting with technical and civil society groups around the world.

In February, the United States appointed Ambassador Erica Barks-Ruggles as their representative responsible for the ITU conference—with marching orders to get Bogdan-Martin elected. She appeared before a House foreign affairs subcommittee late last year to underscore the fact that the United States’ focus on the ITU election, amongst others, meant “countering the efforts of countries such as the People’s Republic of China and Russia to reshape and undermine international law, institutions, and standards.” President Joe Biden has also released a statement endorsing Bogdan-Martin.

“What we’re really hearing from countries around the world,” the official says, is that connecting the roughly 3 billion people on the planet with no access to the internet is a top priority—closing the so-called digital divide. “We learned during Covid the stark digital divide that’s out there, and they want it closed as soon as possible,” the official said.

On that, they said, Bogdan-Martin “is focused like a laser.”

Ismailov, meanwhile, is trying to turn the race into a referendum on America.

“You can clearly see the two camps humankind is divided into: developing countries and the West,” he says in his campaign video. He set up the United States, and the West more broadly, as a monopolistic entity with respect to the internet.

“They encouraged extremist resources on their platforms at the same time they eradicated anyone who goes against their agenda,” Ismailov adds, citing Donald Trump’s Twitter ban as a prime example. In the friendly interview, Ismailov was asked about Russian media, such as RT, being taken offline in the United States and Europe. Ismailov likened it to “cancel culture.”

Ismailov drew a stark comparison: The Soviet Union’s development of nuclear weapons, followed by China, “offset everyone’s ambitions and made the perception of risk very tangible.” There had not been the same nuclear arms race in the telecommunications space, he says.

It’s a message that could just work, but the Americans are paying it no mind. “He’s focusing on a very negative vision, moaning about things,” the official says of Ismailov. “Let him do that.”

The State Department official spoke on background, and the department declined to make Bogdan-Martin available for an interview. A request to the Russian mission in Geneva, where the ITU is located, went unanswered.

While there was some quiet optimism about Bodgan-Martin’s chances, none of the experts and delegates to the ITU who spoke with WIRED were willing to predict her victory. Even though Russia has lost a number of major votes at the UN in recent months, the race for secretary-general is—unlike many other votes at the international body—a secret ballot, leaving room for horse-trading.

Some of Russia’s appeal is macro: The Beijing and Russia compact is undoubtedly attractive to less democratic countries that want to be free to regulate and restrict the internet as they see fit. Ismailov might also be attractive for other reasons. Earlier this year, Russian satellite operator Intersputnik announced that the country would be sponsoring a 200-seat cafeteria at the ITU’s new Geneva headquarters.

The top-tier race isn’t the only one that matters, however. At their annual meeting later this month, the ITU members will also select a number of senior functionaries, elect the make-up of regulatory boards, and choose a new council. All of those races have the potential to determine the way the ITU approaches these core questions over the next four years.

The secretary-general race will, however, signal what direction the organization is headed. Göran Marby, CEO of Icann—a core administrator of the technical infrastructure of the internet—would not officially endorse Bodgan-Martin, but he told the organization’s annual meeting last week that voting for Ismailov would mean “people around the world might not be able to connect to one single interoperable internet.”

Marby said he was remaining neutral, but added: “We vividly oppose one of the platforms, that the Russian potential secretary-general stands for.”

In an email statement, a spokesperson for Marby told WIRED that Ismailov’s candidacy threatens to further centralize control within the ITU, taking those authorities away from stakeholder groups like Icann.

“Technically, this is not possible,” they wrote. “The internet operates based on a system of voluntary standards, best practices, cooperation, and trust.” This cooperative model, they added, “is a model that works. The internet has operated without fail for nearly 40 years.”

While reiterating their neutrality in the race, the spokesperson added that “if the functions of Icann were moved to the ITU, the risk of internet fragmentation would be very real, and the interoperability of the internet would be jeopardized.”

This Vote Could Change the Course of Internet History

Many companies have pulled physical servers from the country as a mandate to collect customer data goes into effect.

Ahead of the deadline to comply with the Indian government’s new data-collection rules, VPN companies from across the globe have pulled their servers out of the country in a bid to protect their users’ privacy.

Starting today, the  , or CERT—a body appointed by the Indian government to deal with cybersecurity and threats—will require VPN operators to collect and maintain customer information including names, email addresses, and IP addresses for at least five years, even after they have canceled their subscription or account.

In April, CERT said it needed to implement these rules because “the requisite information is not found available” with the security provider during investigations into cybersecurity threats, thereby thwarting inquiries. The new rules, CERT claims, will “strengthen cyber security in India” and are “in the interest of sovereignty or integrity of India.”

VPN companies and privacy experts believe this move impacts user privacy and freedom of speech, and defeats the sole purpose of using VPNs, which encrypt users’ internet activity and mask their locations and identities.

“As digital privacy and security advocates, we are concerned about the possible effect this regulation may have on not only our users but people’s data in general,” says a NordVPN spokesperson. “From what it seems, the amount of stored private information will be drastically increased throughout hundreds or maybe thousands of different companies.” She adds that similar regulations have been “typically introduced by authoritarian governments in order to gain more control over their citizens.”

Last year, India became the country with the highest rate of growth in the use of VPN services worldwide. During the first half of 2021, 348.7 million VPNs were installed, showing a 671 percent jump in growth when compared to the same period in 2020, according to a 2021 analysis by Atlas VPN. This massive growth can be attributed to continuous internet shutdowns, a rise in digital scams, and the need for Indians to protect themselves online.

“VPNs by nature can be a privacy advancing tool and can be capable of protecting information security in multiple ways, being used by individuals and companies to secure confidential information,” says Tejasi Panjiar, associate policy counsel at the Internet Freedom Foundation. “They also help secure digital rights under the constitution, especially for journalists and whistleblowers, because the nature of information that’s transferred over VPNs is primarily encrypted, which allows them not only to secure confidential information but also to safeguard their own identity, protecting them from surveillance and censorship.”

The government defended its rules, saying it will not violate user privacy as information would be sought only on a case-by-case basis. This claim ignores the Indian government’s track record of surveilling critics, politicians, and activists. In August, an official investigation into whether Indians were spied on by the government using Israeli spyware Pegasus revealed that at least five phones of victims contained malware, but refused to disclose the report. Instead, the country’s top court recommended that existing surveillance laws incorporate the right to privacy and introduce mechanisms for citizens to raise complaints against illegal surveillance.

CERT did not respond to WIRED’s request for comment.

After CERT first announced the rules in April, it caused a flurry of panic among VPN companies. It then gave them a three-month window to comply with the rules. But most global VPN providers used this time to pull physical servers out of the country. “India has ordered all VPN providers in the country to start logging user activity and storing it for five years. This is incompatible with our commitment to user privacy, so we made the straightforward decision to stop operating VPN servers within India,” says a spokesperson for ExpressVPN, one of the first companies to pull servers out of India. They add that ExpressVPN “will never collect logs of user activity, including no logging of browsing history, traffic destination, data content, or DNS queries.”

Proton VPN is also pulling its servers from India, the _Wall Street Journal_ reports. Meanwhile, other VPN companies are looking for solutions that have minimal impact on their users while also maintaining their privacy. Enter: virtual servers.

Spokespeople of ExpressVPN, based in the British Virgin Islands; Private Internet Access, based in the US; and Surfshark VPN, based in Lithuania, tell WIRED that they have set up virtual servers outside India for users who want to use an Indian IP address. ExpressVPN users who want to use Indian IP addresses can do it through their “India (via Singapore) or India (via UK)” virtual server location.

“Virtual locations are functionally identical to physical ones—the main difference is that they’re not located in the stated country,” says a Surfshark spokesperson. “They still provide the same functionality–in this case, getting an Indian IP.”

VPN Providers Flee India as a New Data Law Takes Hold

Plus: A leaked trove illuminates Russia’s internet regulator, a report finds Facebook and Instagram violated Palestinian rights, and more.

Some churches across the United States are using invasive phone-monitoring technology in efforts to discourage “sinful” behavior, a WIRED investigation revealed this week. The churches are using a series of apps, dubbed “shameware,” that track people’s activity and use their personal data as a way to control their lifestyle choices. The apps can record everything you do on your phone, like your browsing history, by capturing thousands of screenshots of your activity before reporting it back to a designated chaperone. In addition to their draconian surveillance, our investigation found the apps are full of security flaws.

As Vladimir Putin once again raises the specter of nuclear weapons in his full-scale invasion of Ukraine, we have looked at one way in which Russia is trying to integrate areas of Ukraine into its territory. In recent months, new Russian mobile network providers have appeared in Ukraine, promising they will provide internet connectivity to “liberated” regions. While Russian officials plan to hold referendums in some of these areas, they are also losing ground to successful Ukrainian counteroffensives. When that happens, these shadowy mobile companies wipe their existence in the areas from the web.

Iran’s latest internet shutdowns are significant as the government continues to tighten its grip on citizens’ ability to connect, and the roots of Nigeria’s cybersecurity problem shed light on digital challenges in the country, including how data collection remains largely unmonitored despite strong data protection laws. The supply chain security firm Chainguard launched an open source way to guard against supply chain attacks this week, and new research indicates that the workplace communication platforms Slack and Microsoft Teams have gaps in their security that could be exploited.

And there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

The popular streaming service Twitch, owned by Amazon, offers a rich source of information about the daily lives of kids to child predators, according to new research. A researcher who manually browsed Twitch from October 2020 to August 2022 found hundreds of seemingly predatory accounts run by adults that mostly followed children or young teenagers. Each account followed more than 1,000 children, and the study found 279,016 children who were potentially targeted by predatory accounts. “In the course of reporting, Bloomberg discovered additional live videos and predatory accounts not cataloged by the researcher, suggesting the problem could be even more widespread than the data portrays,” the investigation reads. Bloomberg granted the researcher anonymity but conducted its own vetting of the findings. “We know that online platforms can be used to cause harm to children, and we have made extensive investments over the last two years to better stay ahead of bad actors and prevent any users who may be under 13 from accessing Twitch,” the company said in a statement to Bloomberg.

In March, the nonprofit transparency group DDoSecrets published a trove of more than 160,000 records, or 700 GB of data, from the Bashkortostan regional office of Russia’s internet regulator, Roskomnadzor. This week, _The New York Times_ published an in-depth analysis of the documents, revealing rare insights into how the agency, which wields significant digital monitoring and censorship powers, goes about exerting control. The documents highlight how the Kremlin works to silence detractors, monitor social movements including those related to topics like “sexual freedoms” and recreational drug use, control the flow of information within Russia, spread disinformation, and monitor dissidents such as opposition leader Alexey Navalny. The analysis also provides insight into how Roskomnadzor’s role has shifted in recent years. “Roskomnadzor was never part of this game before of providing political intelligence,” Andrei Soldatov, a fellow at the Center for European Policy Analysis, told the _Times_. “They’re getting more and more ambitious.”

In implementing their speech policies, Facebook and Instagram impeded the human rights of Palestinian users last May during a rash of Israeli attacks on the Gaza Strip, an investigation commissioned by Meta found. The independent group Business for Social Responsibility, which Meta has previously tasked with conducting third-party audits on controversial topics, found  “a lack of oversight at Meta that allowed content policy errors with significant consequences to occur.” While the report was scheduled to come out at the beginning of 2022, Meta delayed the release of the report to this week. Last month, human rights groups protested the delay in an open letter. “Meta’s actions in May 2021 appear to have had an adverse human rights impact … on the rights of Palestinian users to freedom of expression, freedom of assembly, political participation, and non-discrimination, and therefore on the ability of Palestinians to share information and insights about their experiences as they occurred," the report said.

Optus, Australia’s second-largest telecommunications company, said Thursday that a “significant” portion of its almost 10 million customers had been impacted by a data breach. It’s unclear whether the attack came from criminal or state-sponsored actors, but Australian officials warned that affected customers will face the threat of identity theft because of the breach. “If you are an Optus customer, your name, date of birth, phone number, email addresses may have been released,” wrote the Australian Competition and Consumer Commission’s Scamwatch group. “For some customers identity document numbers such as driver’s licence or passport numbers could be in the hands of criminals. It is important to be aware that you be may be at risk of identity theft and take urgent action to prevent harm."

Optus chief executive Kelly Bayer Rosmarin was contrite in an interview with ABC’s Afternoon Briefing on Thursday. “We’re so deeply disappointed because we spend so much time and we invest so much in preventing this from occurring,” she said. "Our teams have thwarted a lot of attacks in the past, and we’re very sorry that this one was successful."

Child Predators Mine Twitch to Prey on Kids

New research shows how third-party apps could be exploited to infiltrate these sensitive workplace tools.

Collaboration apps like Slack and Microsoft Teams have become the connective tissue of the modern workplace, tying together users with everything from messaging to scheduling to video conference tools. But as Slack and Teams become full-blown, app-enabled operating systems of corporate productivity, one group of researchers has pointed to serious risks in what they expose to third-party programs—at the same time as they're trusted with more organizations' sensitive data than ever before.

A new study by researchers at the University of Wisconsin-Madison points to troubling gaps in the third-party app security model of both Slack and Teams, which range from a lack of review of the apps’ code to default settings that allow any user to install an app for an entire workspace. And while Slack and Teams apps are at least limited by the permissions they seek approval for upon installation, the study's survey of those safeguards found that hundreds of apps' permissions would nonetheless allow them to potentially post messages as a user, hijack the functionality of other legitimate apps, or even, in a handful of cases, access content in private channels when no such permission was granted.

“Slack and Teams are becoming clearinghouses of all of an organization’s sensitive resources,” says Earlence Fernandes, one of the researchers on the study who now works as a professor of computer science at the University of California at San Diego, and who presented the research last month at the USENIX Security conference. “And yet, the apps running on them, which provide a lot of collaboration functionality, can violate any expectation of security and privacy users would have in such a platform.”

When WIRED reached out to Slack and Microsoft about the researchers' findings, Microsoft declined to comment until it could speak to the researchers. (The researchers say they communicated with Microsoft about their findings prior to publication.) Slack, for its part, says that a collection of approved apps that is available in its Slack App Directory does receive security reviews before inclusion and are monitored for any suspicious behavior. It "strongly recommends" that users install only these approved apps and that administrators configure their workspaces to allow users to install apps only with an administrator's permission. "We take privacy and security very seriously," the company says in a statement, "and we work to ensure that the Slack platform is a trusted environment to build and distribute apps, and that those apps are enterprise-grade from day one."

But both Slack and Teams nonetheless have fundamental issues in their vetting of third-party apps, the researchers argue. They both allow integration of apps hosted on the app developer's own servers with no review of the apps' actual code by Slack or Microsoft engineers. Even the apps reviewed for inclusion in Slack's App Directory undergo only a more superficial check of the apps' functionality to see whether they work as described, check elements of their security configuration such as their use of encryption, and run automated app scans that check their interfaces for vulnerabilities.

Despite Slack's own recommendations, both collaboration platforms by default allow any user to add these independently hosted apps to a workspace. An organization's administrators can switch on stricter security settings that require the administrators to approve apps before they're installed. But even then, those administrators must approve or deny apps without themselves having any ability to vet their code, either—and crucially, the apps' code can change at any time, allowing a seemingly legitimate app to become a malicious one. That means attacks could take the form of malicious apps disguised as innocent ones, or truly legitimate apps could be compromised by hackers in a supply chain attack, in which hackers sabotage an application at its source in an effort to target the networks of its users. And with no access to apps' underlying code, those changes could be undetectable to both administrators and any monitoring system used by Slack or Microsoft.

All of that leaves users—who have grown accustomed to more well-secured third-party app environments, such as the code reviews implemented in Apple's App Store and Google Play—vulnerable to risks they don't expect when they install a seemingly innocent app on their organization's collaboration workspace. "Compared to iOS or Android, I would say their security model is at least five to six years behind," University of Wisconsin researcher Yunang Chen says of Slack and Teams.

As in other stricter app models, Slack and Teams limit apps' data access with a set of permissions that users must approve for an app to be installed. But—setting aside that a single user can often approve those access permissions for an entire organization—the researchers found that apps' permissions can sometimes allow them to perform unexpected and dangerous behaviors. An app intended for scheduled posts that asks for the ability to post as the user can, for instance, impersonate them as part of a phishing scheme or send messages from their account to trigger another app's functionality. In some instances, software developers even allow changes to their code repositories based on Slack messages, potentially allowing an app that sends messages from a user account to alter code and corrupt their software.

In another attack, researchers found that apps can "overwrite" the command that launches another app in Slack or Teams, such as typing "/zoom" in one of the platforms to start a Zoom meeting. A malicious app, the researchers point out, could hijack that command to make "/zoom" instead launch an imposter copy of Zoom that intercepts all the users' communications. While the researchers note that Slack has recently added a safeguard that warns when an app overwrites a command in this way, it warns the user only upon installation of the app, and malicious apps can still perform that takeover trick after they're installed.

To get a sense of just how many apps might pose these sorts of risks, the researchers surveyed the permissions of all Slack and Teams apps and found that about one in three Teams apps and almost one in four Slack apps ask for permissions that would allow them to act as the user, posting messages or adding emoji reactions on their behalf. 52 percent of Slack apps ask for permissions that would allow them to overwrite another app's launch command.

The researchers also point to yet another security issue, specific to Slack, that can allow an app to access private channels that are "locked" and intended to be accessible only to specific users—even when the app asks for no such permission. The researchers found that when a link to a message in a private channel is copied into a user's direct messages to themselves, the private channel message "unfurls," and its text appears in that conversation if the user is a member of the private channel. So an app that merely asks for read and write access to a user's direct messages and basic information about—but not the content of—their private channels can also read all the messages posted to a private channel. (The app could also quickly delete the direct messages it sends to the user as part of the attack, to avoid leaving a record of its snooping.) In their survey of app permissions, the researchers found 11 Slack apps that ask for exactly those permissions, and thus could gain this unexpected private channel access.

Despite Microsoft's response to WIRED that it wanted to discuss the researchers' findings before commenting, the researchers write in their paper that they approached both Slack and Microsoft with their findings prior to publication, and both companies confirmed that their attack techniques were possible. They write, however, that Slack and Microsoft didn't consider their findings to "meet their definitions of a security vulnerability," since they required deceiving users into installing a malicious app, and both Slack and Microsoft expect workspace administrators to police those installations. But that response only puts the onus on administrators, argues University of Wisconsin researcher Yue Gao, who "are even worse off than Slack" when it comes to assessing an app's legitimacy.

Some of the problems that the researchers identified in Slack and Teams—like apps' ability to overwrite other apps' launch commands and read messages in private channels—could be fixed with relatively simple patches, says Andrei Sabelfeld, a computer science professor at Chalmers University of Technology in Sweden who reviewed the researchers' work. But if Slack and Teams apps continue to be hosted on third-party servers, the deeper problem would remain. "There's no way to have any account of what the developers are doing," Sabelfield says. "This points to a fundamental tension: The code is outside their control."

That means, both Sabelfield and the University of Wisconsin researchers argue, that any real fix would require Slack and Microsoft to broadly overhaul their app model to make it more like traditional operating systems that carefully vet the code of apps, monitor that code for changes, and strictly enforce the permissions apps are granted. If Slack and Teams are going to become the hub traversed by every organization's holiest of holy data, in other words, it's time they took better care of who is invited to the inner sanctum.

Slack’s and Teams’ Lax App Security Raises Alarms

Amid protests against the killing of Mahsa Amini, authorities have cut off mobile internet, WhatsApp, and Instagram. The death toll continues to rise.

In the Iranian city of Shahrud, surrounded by hundreds of protesters, two women climb onto a platform and defiantly wave their hijabs above their heads in an act of public defiance. The scene, caught on video, is posted online by the 1500tasvir Instagram account. In recent days, the account has published dozens of videos from Iranian towns and cities as thousands of people protest the death of 22-year-old Mahsa Amini, who died in police custody after being arrested by Iran’s “morality police.”

In another video shared by 1500tasvir, women burn their headscarves while chanting for freedom. Protesters are shown confronting police officers in another. And other videos claim to show people bleeding, injured, or dead, following brutal clashes with police officers as protests have spread to more than 80 cities across Iran. “They stood against the police, who are armed, and they \[protesters\] just shout at them,” says one person behind the 1500tasvir Instagram account, whom WIRED is not naming to protect their safety.

The 1500tasvir account was set up in 2019 following widespread protests in which hundreds of people were killed by police. During those protests, Iranian officials totally shut down the internet, stopping people from organizing protests and limiting the information flowing in and out of Iran. Now history is repeating itself. But this time, more people are watching.

As thousands of people have taken to the streets to protest the death of Amini this week, Iranian officials have repeatedly shut down mobile internet connections and disrupted the services of Instagram and WhatsApp, two of the most popular social media services in the country. The internet shutdowns are the largest since November 2019 and raise fears about further atrocities. So far, more than 30 people have reportedly been killed, while the Iranian government has admitted to 17 deaths.

“Shutting down mobile internet service has become a go-to for the Iranian government when dealing with civil unrest,” says Doug Madory, director of internet analysis at monitoring firm Kentik, who has been following the shutdowns. “People were using these services to share videos of the protests and the government’s crackdown, so they became targets of government censorship.”

Iran started shutting the internet down on September 19 as protests around Amini’s death gained momentum. Since then, multiple internet-monitoring organizations, including Kentik, Netblocks, Cloudflare, and the Open Observatory of Network Interference, have documented the disruptions. Mobile network operators, including the country’s biggest providers—Irancell, Rightel, and MCI—have faced rolling blackouts, the groups say. Multiple mobile providers have lost connectivity for around 12 hours at a time, with Netblocks saying it has seen a “curfew-style pattern of disruptions.” Felicia Anthonio, who leads NGO Access Now’s fight against internet shutdowns, says the group’s partners have reported that text messages containing Amini’s name have been blocked. “If you’re sending a message containing that name, it doesn’t go through,” Anthonio says.

The clampdown against Instagram and WhatsApp started on September 21. While shutting down mobile connections is hugely disruptive, blocking access to WhatsApp and Instagram cuts off some of the only remaining social media services in Iran. Facebook, Twitter, and YouTube have been banned for years. State-backed Iranian media said it was unclear how long the blocks on Instagram and WhatsApp would last but that they had been imposed for “national security” reasons. “It does seem they are targeting these platforms that are the lifeline for information and communication that’s keeping the protests alive,” says Mahsa Alimardani, an academic at the Oxford Internet Institute who has extensively studied Iran’s internet shutdowns and controls.

The 1500tasvir team member says the account, which is run by a group of around 10 core people both inside and outside of Iran, is posting videos to document the protests. People on the ground send the videos—in some areas, patchy connections are available and fixed Wi-Fi connections still work​​—and the group checks the content before posting it online. The group says it is receiving more than 1,000 videos per day, and its Instagram account has more than 450,000 followers.

Internet shutdowns can have a “huge” impact on protests, the 1500tasvir team member says, because when people around Iran can’t see that others are protesting, they may be likely to stop themselves. “When you … see other people feel the same way, you get more brave. You are more enthusiastic to do something about it,” they say. “When the internet is cut off … you feel alone.”

The blocks against WhatsApp also appear to have impacted people outside of Iran. People using Iranian +98 telephone numbers have complained that WhatsApp has been slow to work or not functioning at all. WhatsApp has denied it is doing anything to block Iranian phone numbers. However, the Meta-owned company has refused to provide any more information on why +98 numbers outside of Iran have faced problems. “There's something strange going on, and it’s likely to do with the way Iran is implementing censorship on these different platforms because it does seem a bit more targeted,” Alimardani says.

In recent years, governments wanting to silence their citizens or control their behavior have increasingly turned to draconian internet shutdowns as tools of suppression. In 2021, 23 countries, from Cuba to Bangladesh, shut the internet down a collective 182 times. Iranian officials are no strangers to the practice. Anthonio says Iran’s latest internet shutdown is the third time the country has disrupted the internet in the past 12 months. “We continue to see that internet shutdowns also provide a cover for authorities to hide atrocities that are perpetrated against people during protests,” Anthonio says.

Iran’s current shutdown is the biggest since its November 2019 protests, when people took to the streets over drastic fuel price rises. More than 200,000 protesters were faced with a brutal response from the police: Amnesty International has documented the names of 321 people who were killed during the protests, but the NGO says the figure is likely far higher. (Previous estimates say up to 1,500 people were killed and 4,800 were injured.)

Throughout those protests, Iranian officials conducted a complete internet blackout. All internet connections were blocked, preventing people from telling the world what was happening. (The country’s home-brewed, heavily censored, intranet remained available.) So far, the internet shutdowns following Amini’s death haven’t reached the same scale. However, experts worry they may continue to grow the longer the protests last. That could also mean an increase in police violence. The Center for Human Rights in Iran says it has already recorded 36 deaths linked to the protests, including 15- and 16-year-old boys.

Despite the internet shutdowns, footage from the protests has managed to get out. So far. “I’m seeing more content and more footage from these protests than I think I even saw during November 2019,” Alimardani says. However, when the internet is disconnected everything can go silent. “I don’t get any messages in the past hour. Because they cut off the internet,” the 1500tasvir member, who is based outside of Iran, says in a phone call. “They don’t want the world to know how cruel they are.”

Iran’s Internet Shutdown Hides a Deadly Crackdown

Churches are using invasive phone-monitoring tech to discourage “sinful” behavior. Some software is seeing more than congregants realize.

Gracepoint is the kind of evangelical Southern Baptist church that’s compelled to publicly enumerate all of the ways it’s not a cult. “We’ll admit that we’re a bit crazy about the Great Commission and sharing the Gospel,” reads an FAQ page titled, “Is Gracepoint a Cult?” So when Grant Hao-Wei Lin came out to a Gracepoint church leader during their weekly one-on-one session, he was surprised to learn that he wasn’t going to be kicked out. According to his church leader, Hao-Wei Lin says, God still loved him in spite of his “struggle with same-sex attraction.”

But Gracepoint did not leave the matter in God’s hands alone. At their next one-on-one the following week, Hao-Wei Lin says the church leader asked him to install an app called Covenant Eyes on his phone. The app is explicitly marketed as anti-pornography software, but according to Hao-Wei Lin, his church leader told him it would help “control all of his urges.”

Covenant Eyes is part of a multimillion-dollar ecosystem of so-called accountability apps that are marketed to both churches and parents as tools to police online activity. For a monthly fee, some of these apps monitor everything their users see and do on their devices, even taking screenshots (at least one per minute, in the case of Covenant Eyes) and eavesdropping on web traffic, WIRED found. The apps then report a feed of all of the users’ online activity directly to a chaperone—an “accountability partner,” in the apps’ parlance. When WIRED presented its findings to Google, however, the company determined that two of the top accountability apps—Covenant Eyes and Accountable2You—violate its policies.

The omnipotence of Covenant Eyes soon weighed heavily on Hao-Wei Lin, who has since left Gracepoint. Within a month of installing the app, he started receiving accusatory emails from his church leader referencing things he had viewed online. “Anything you need to tell me?” reads one email Hao-Wei Lin shared with WIRED. Attached was a report from Covenant Eyes that detailed every single piece of digital content Hao-Wei Lin had consumed the prior week. It was a trail of digital minutiae accumulated from nights spent aimlessly browsing the internet, things Hao-Wei Lin could barely remember having seen—and would have forgotten about had a member of his Church not confronted him. The church leader zeroed in on a single piece of content that Covenant Eyes had flagged as “Mature”: Hao-Wei Lin had searched “#Gay” on a website called Statigr.am, and the app had flagged it.

Gracepoint, which focuses on colleges, claims to “serve students” on more than 70 campuses across the United States. According to emails between a Covenant Eyes representative and a former Gracepoint church leader that WIRED reviewed, the company said that in 2012 as many as 450 Gracepoint Church members were signed up to be monitored through Covenant Eyes.

“I wouldn’t quite call it spyware,” says a former member of Gracepoint who was asked to use Covenant Eyes and spoke on the condition of anonymity, due to privacy concerns. “It’s more like ‘shameware,’ and it’s just another way the church controls you.”

Similar to surveillance software like Bark or NetNanny, which is used to monitor children at home and school, “shameware” apps are lesser-known tools that are used to keep track of behaviors parents or religious organizations deem unhealthy or immoral. Fortify, for instance, was developed by the founder of an anti-pornography nonprofit called Fight the New Drug and tracks how often an individual masturbates in order to help them overcome “sexual compulsivity.” The app has been downloaded over 100,000 times and has thousands of reviews on the Google Play store.

The current iteration of the Covenant Eyes app was developed by Michael Holm, a former NSA mathematician who now serves as a data scientist for the company. The system is allegedly capable of distinguishing between pornographic and non-pornographic images. The software captures everything visible on a device’s screen, analyzing the images locally before slightly blurring them and sending them to a server to be saved. “Image-based pornography detection was a huge conceptual change for Covenant Eyes,” Holm told _The Christian Post_, an evangelical Christian news outlet, in 2019. “While I didn’t yet know it, God had put me in that place at that time for a purpose higher than myself, just as I and others had desired and prayed for.”

Covenant Eyes spokesperson Dan Armstrong says the company is “concerned” about “people being monitored without proper consent.” He adds that “accountability relationships are better off between people who already know each other and want the best for one another, such as close personal friends and family members,” and that the company discourages using its app in relationships with a power imbalance.

Among the top accountability apps—including Accountable2You and EverAccountable—Covenant Eyes appears to be the largest player. The company organizes conferences that are attended by thousands of people and dedicated to educating attendees about the dangers of pornography while pitching the company’s product as an urgent solution to what it characterizes as a growing moral crisis. According to the app analytics firm AppFigures, in the past year more than 50,000 people have downloaded Covenant Eyes. Rocketreach estimates that the company has an annual revenue of $26 million.

Ed Kang, pastor of Gracepoint Church in Berkeley, California, and a major figure in the organization, says in an email that volunteer staff members are required to install Covenant Eyes or Accountable2You “as part of their staff agreement.” But he disputes that church leaders were instructed to monitor congregants’ phone activity. “Usually it’s whoever they \[congregants\] designate, and we actually discourage leaders from being the accountability partners as that seems a bit too heavy,” he writes. (All five former Gracepoint congregants who spoke to WIRED said a church leader was their accountability partner.) Kang adds that the number of Gracepoint congregants who use Covenant Eyes or Accountable2You “may be significantly higher than 450 nowadays” and that Accountable2You “has better pricing.”

What’s common across Covenant Eyes, Accountable2You, and EverAccountable is their zero-tolerance approach to pornography. All three suggest in their marketing materials that not only is watching porn a moral failure, but any amount of porn consumption is bad for your health. Their solution: Promote purity through what they call “radical accountability,” a concept wherein a community comes together to confront a person who is living in sin. At its most basic level, the idea is pretty straightforward: Why would anyone watch porn if they are going to have to talk to their parents or pastor about it?

While these apps claim to have helped many people overcome pornography addictions, experts who study sexual health are skeptical that the apps have a lasting positive effect. “I’ve never seen anyone who’s been on one of these apps feel better about themselves in the long term,” says Nicole Praus, a scientist at the University of California, Los Angeles, who studies the effects of pornography on the brain and the spread of disinformation on sexual health. “These people just end up feeling like there’s something wrong with them when the reality is that there likely isn’t.”

But Covenant Eyes and Accountable2You do much more than just police pornography. When WIRED downloaded, decompiled, and tested Covenant Eyes and Accountable2You, we found that both apps are built to collect, monitor, and report all sorts of innocent behavior. The applications exploited Android’s accessibility permissions to monitor almost everything someone does on their phone. While the accessibility functionalities are meant to help developers build out features that assist people with disabilities, these apps take advantage of such permissions to either capture screenshots of everything actively being viewed on the device or detect the name of apps as they’re being used and record every website visited in the device’s browser.

In Hao-Wei Lin’s case, that included his Amazon purchases, articles he read, and even which friends’ accounts he looked at on Instagram. The trouble is, according to Hao-Wei Lin, providing his church leader with a ledger of everything he did online meant his pastor could always find something to ask him about, and the way Covenant Eyes flagged content didn’t help. For example, in Covenant Eyes reports that Hao-Wei Lin shared with WIRED, his online psychiatry textbook was rated “Highly Mature,” the most severe category of content reserved for “anonymizers, nudity, erotica, and pornography.” The same was true of anything Hao-Wei Lin felt was “remotely gay,” like his Statigr.am searches.

After WIRED contacted Google about Covenant Eyes and Accountable2You, both apps were suspended from the Google Play store. “Google Play permits the use of the Accessibility API for a wide range of applications,” spokesperson Danielle Cohen says in an email. “However, only services that are designed to help people with disabilities access their device or otherwise overcome challenges stemming from their disabilities are eligible to declare that they are accessibility tools.”

Covenant Eyes and Accountable2You both remain available on iOS. While WIRED did not test the apps on Apple devices, neither app appears to utilize iOS’ accessibility permissions. Apple has not yet responded to a request for comment.

In our tests of Accountable2You prior to its suspension, we found that the software similarly flagged content with keywords like “gay” or “lesbian” in the URL. For instance, when we set up a test account and navigated to the US Centers for Disease Control’s website for LGBTQ youth resources, the phone we designated as our accountability partner was immediately texted and emailed a “questionable activity report” indicating that our test phone had visited a “Highly Questionable” website.

“It’s really not about pornography,” says Brit, a former user of Accountable2You who asked to only be identified by her first name, due to privacy concerns. “It’s about making you conform to what your pastor wants.” Brit says she was asked to install the app by her parents after she was caught looking at pornography and that her mother and her pastor were both her designated accountability partners. “I remember I had to sit down and have a conversation with him \[her pastor\] after I Wikipedia’d an article about atheism,” she says. “I was a kid, but that doesn’t mean I don’t have some kind of right to read what I want to read.”

While accountability apps are largely marketed to parents and families, some also advertise their services to churches. Accountable2You, for example, advertises group rates for churches or small groups and has set up several landing pages for specific churches where members can sign up. Covenant Eyes, meanwhile, employs a director of Church and Ministry Outreach to help onboard religious organizations.

Accountable2You did not respond to WIRED’s requests for comment.

Eva Galperin is director of cybersecurity at the Electronic Frontier Foundation, a digital rights nonprofit, and cofounder of the Coalition Against Stalkerware. Galperin says consent to such surveillance is a major concern. “One of the key elements of consent is that a person can feel comfortable saying no,” she says. “You could argue that any app installed in a church setting is done in a coercive manner.” While WIRED did not speak to anyone who was unaware that the app was on their phone, which is often the case with spyware, Hao-Wei Lin says he didn’t feel like he was in a position where he could say no to his church leader when he was asked to install Covenant Eyes. Gracepoint had secured him a $400-a-month apartment in Berkeley, where he was attending college. Without the church’s support, he might have had nowhere to live.

But this is not the experience of everyone we spoke to. James Nagy is a former Gracepoint church member who, as a one-time congregation leader, was on both sides of Covenant Eyes reports. Nagy, who is gay, was taught from a young age that homosexuality was a sin. So when Gracepoint offered him a software solution that claimed to be able to help what he then considered to be a moral dilemma, he jumped at the opportunity. He says that while he believed many people at Gracepoint were pressured to install the app, in his case, the pressure came from himself. “Gracepoint didn’t try to change me,” Nagy says. “I tried to change me.” Nagy is now an elder at the Presbyterian Church (USA) and until 2021 was a facilitator with the Reformation Project, a nonprofit whose mission is to advance LGBTQ inclusion in the church.

In the quest to curb behavior churches deem immoral, these accountability apps will collect and store extremely sensitive personal information from their users, including from those under the age of 18. Fortify, which describes itself as an addiction recovery app, asks its users to log information about when they last masturbated, where they were when it happened, and what device they used. While Fortify’s privacy policy states that the company doesn’t sell or otherwise share this data with third parties, its policy does allow it to share data with trusted third parties to perform statistical analysis, though it does not mention who these trusted third parties are. In a phone call, Clay Olsen, the CEO of Fortify parent company Impact Suite, clarified that these trusted third parties include companies like Mixpanel, an analytics service company that tracks user interactions with web and mobile applications.

While WIRED found several churches recommending Fortify to their congregations, Olsen says neither Fortify nor Impact Suite count religious institutions as customers.

When WIRED tested the Fortify software, we found that the app also utilizes other technology to track users. For instance, because it includes Facebook’s Pixel, data related to Fortify’s masturbation-tracking form is sent to Facebook. While the data does not appear to include the contents of the tracking form, it does have metadata about the form itself, including when it was filled out. Facebook appears to store that data and, when possible, associates it with a user’s account. After setting up a test account with Facebook, logging in, and then interacting with Fortify, we were able to see interactions with Fortify in a copy of the test account’s data obtained through Facebook’s privacy center.

Fortify’s inclusion of Facebook’s Pixel isn’t just a privacy issue, it’s a security problem. While testing the app, we also noticed that the password to our account was sent in plaintext to Facebook in the URL of the tracking requests. Facebook claims to have filtering mechanisms to prevent its systems from storing this type of personal information, but Fortify’s apparent oversight is still concerning to experts like Galperin. “That’s a huge vulnerability,” she says. “It’s the sort of behavior that makes me feel like they don’t have security experts reviewing the app or its policies.”

Facebook spokesperson Emil Vazquez says companies that share sensitive user data with the Meta-owned social media platform are violating its policies. “Advertisers should not send sensitive information about people through our Business Tools. Doing so is against our policies,” Vazquez says. “Our system is designed to filter out potentially sensitive data it is able to detect.” Facebook did not say whether its filters detected the plaintext passwords sent by Fortify.

After being notified of the password issue, Olsen said Fortify would stop transmitting users’ unencrypted passwords to Facebook. As we went to press, the issue had not yet been addressed.

Hao-Wei Lin has since moved on from Gracepoint but is still processing the trauma he feels the church has caused him. I met him earlier this month at his thesis exhibition at Parsons School of Design in New York City, where he is about to get his Master of Fine Arts in photography. He tells me that it was only after he went back to school that he felt he was in a safe enough space to start processing what he went through at Gracepoint.

Hao-Wei Lin’s photography was somber, but not without humor. One was of a 3D rendering of a room where he says he and other members of Gracepoint would meet after their Sunday service. A solitary figure is hunched over praying, his head resting in the seat of his plastic chair. As I look at the photo, Hao-Wei Lin tells me he wants the viewer to feel like they are a surveillance camera perched in the top corner of the room. The name of his work: “Covenant Eyes.”

The Ungodly Surveillance of Anti-Porn ‘Shameware’ Apps

Security firm Chainguard has created a simple, open source way for organizations to defend the cloud against some of the most insidious attacks.

In the wake of alarming incidents like Russia’s massive 2017 NotPetya malware attack and the Kremlin’s 2020 SolarWinds cyberespionage campaign—both pulled off by poisoning wells for software distribution—organizations around the world have been scrambling to get a handle on software supply chain security. In general, and for open source software in particular, stronger defense rests in knowing what software you’re actually running, with a crucial focus on enumerating all the little pieces that make up the whole and validating that they are what they should be. That way, when you pack a box of software heirlooms and store it on a shelf, you know there isn’t a live microphone or a Tupperware full of deviled eggs sitting in the box for years. 

Creating a system to generate a manifest of what’s inside every box in every basement and garage is a massive effort, but a new tool from security firm Chainguard aims to do just that for the software "containers” that underly almost all digital services today.

On Thursday, Chainguard launched a Linux distribution called Wolfi that is designed specifically for how digital systems are actually built today in the cloud. Most consumers don’t use Linux, the famed open source operating system, on their personal computers. (If they do, they don’t necessarily know it, as is the case with Android, which is built on a modified version of Linux.) But the open source operating system is widely used in servers and cloud infrastructure around the world, partly because it can be deployed in such flexible ways. Unlike operating systems from Microsoft and Apple, where your only choice is whatever ice cream flavor they release, the open nature of Linux allows developers to create all sorts of flavors—known as “distributions”—to suit specific cravings and needs. But the developers at Chainguard, who have all been working in open source software for years, including on other Linux distributions, felt that a key flavor was missing.

“What we’ve done is built a distribution that we feel will work well for enterprises looking to seriously address supply chain security,” says Chainguard principal engineer Ariadne Conill. “Different distributions have different pieces of software that they include—they’re curated collections of software. By starting with a Linux distribution that gets everything right from the beginning, that’s a huge advantage for software developers to get their own stuff right.”

Think of software containers like a home built out of a shipping container. Everything you need to live is in there, but you can pick up the container house and move it wherever it needs to go. If an operating system is like the appliances, electrical wiring, plumbing, and other infrastructure in the container home, that’s what Wolfi is vetting and pre-itemizing to ensure the security of everything in your container house. Wolfi is designed to work smoothly with other tools from Chainguard that help developers build out and add to the software in their container in a secure way. In other words, it’s simple to validate furniture and personal effects and add them to your container home index. That way, if your house gets broken into, it’s easier to determine what happened and how. And if you ever want to ship your house overseas, you have a detailed manifest to show customs.

“It’s the exact same thing with software as with physical goods—there can be contraband or counterfeit goods that people are trying to hide and sneak by,” says Adolfo Garcia, a software engineer at Chainguard. “For software, if you don’t have the capability to collect the information at build time, you’re going to be missing a lot about what’s in there.”

In software supply chain security, and particularly in open source environments where there are generally fewer resources to invest in improvements, the stakes are high—and governments have started taking the problem seriously. In May 2021, the Biden administration issued an executive order that specifically addressed software supply chain security imperatives. And last week, the White House announced that the US Office of Management and Budget had issued specific supply chain security guidance to federal agencies.

“Not too long ago, the only real criteria for the quality of a piece of software was whether it worked as advertised. With the cyber threats facing Federal agencies, our technology must be developed in a way that makes it resilient and secure,” Chris DeRusha, the US federal chief information security officer and deputy national cyber director, wrote in the White House announcement. "This is not theoretical: Foreign governments and criminal syndicates are regularly seeking ways to compromise our digital infrastructure.”

When it comes to Wolfi, Santiago Torres-Arias, a software supply chain researcher at Purdue University, says that developers could accomplish some of the same protections with other Linux distributions, but that it’s a valuable step to see a release that’s been stripped down and purpose-built with supply chain security and validation in mind.

“There’s past work, including work done by people who are now at Chainguard, that was kind of the precursor of this train of thought that we need to remove the potentially vulnerable elements and list the software included in a particular container or Linux release,” Torres-Arias says. “Something like this is part of a constellation of software supply chain controls. And on a technical level, it’s a straightforward idea. But on a business level, in terms of getting organizations to adopt these practices, it could be very good.”

Both Torres-Arias and Chainguard’s CEO, Dan Lorenc, point out that generating a manifest—known in software supply chain security as a “software bill of materials,” or SBOM—doesn’t produce better security in itself. It’s how organizations act on the information that will really make the difference. But as with anything in security, a defense is only valuable and protective if it’s already in place before something goes awry.

“People have been struggling to make things work with distributions that previously existed and other workarounds,” Chainguard’s Conill says. “But they can have a piece of software, a dependency in there that they didn’t know was there until they find out the hard way. And, you know, suddenly it turns out that there was a little baggie of coke in that teddy bear in the container.”

A New Linux Tool Aims to Guard Against Supply Chain Attacks

But as Ukrainians retake ground, some of the firms are erasing their online presence.

For six months, people in occupied Ukrainian cities have lived under the gloom of Russian rule. Across the south and east of Ukraine, Vladimir Putin’s forces have tried to legitimize makeshift administrations: Newly announced referendums would see occupied areas officially join the Russian Federation; citizens have been previously handed Russian passports; and troops have tried taking over the internet, potentially submitting people to the Kremlin’s powerful censorship machine.

As part of these efforts, in recent months two new Russian mobile and internet companies have appeared seemingly from nowhere in occupied Ukraine—claiming to provide cell phone coverage across “liberated territories.” At the same time, existing Russian internet companies in the separatist areas of the Donbas claimed to have expanded their mobile coverage, experts say. These are some of the latest efforts to convert areas of Ukraine to Russian infrastructure and control, with the actions mimicking a playbook similar to Russia’s annexation of Crimea in 2014.

“All this seems to be so obviously priming customers for taking away this impression that they’re bringing connection and peace and liberation to these areas,” says Olena Lennon, a national security practitioner in residence at the University of New Haven who has looked at the new mobile companies. “The language is very propagandist and manipulative,” says Lennon, who is from eastern Ukraine. She compares the actions to an act of “soft power.”

The two mobile providers—7Telecom and MirTelecom—have both been visible since around June, when people spotted new, unbranded SIM cards being sold in occupied Ukraine for the first time. Both companies use the +7 Russian mobile code, and their websites are registered on Russian domains. They claim to provide mobile coverage over Ukrainian towns and cities in the Kherson, Melitopol, and Zaporizhzhia regions.

The 7Telecom operator says people need to register for its services at one of its offices and must bring ID when they do. Lennon says the mobile tariffs she has seen show MirTelecom charging more for calls to Ukrainian phone numbers than for calls to Russian numbers. (Internet companies in Ukraine have previously said Russian occupying forces have taken over their equipment to run services. In some cases, Ukrainians have purposefully destroyed equipment to stop it from falling into Russian hands.)

The new Russian companies claim to offer both 2G and 4G cell service in the regions. Cathal Mc Daid, the chief technology officer at mobile security company Enea AdaptiveMobile Security, is researching the companies and says this approach makes sense. The 2G mobile spectrum will allow for a wide coverage for calls, while 4G coverage, where available, will let people use data to get online.

This, Mc Daid says, suggests Russian forces expect to occupy the areas for some time. “\[In\] contested areas, you don’t generally have two or three new operators coming to a place,” Mc Daid says. “I would say also, that’s a sign that they expect to be there for a while.” Mc Daid says the networks may also have been created for Russian troops to use.

Since the companies emerged earlier this year, they claim to have expanded their services. Their websites list dozens of claimed locations, including shops, where people can buy SIM cards and internet access. In one online post, 7Telecom says it’s hiring a recruitment manager, office administrator, sales manager, and IT specialist to work in the Kherson region.

It isn’t clear how popular the networks are. Maps showing areas receiving cell phone signals cannot be verified, nor can Russian media claims that 7Telecom has more than 100,000 subscribers. MirTelecom and a Gmail account linked to 7Telecom’s Kherson recruitment efforts did not respond to WIRED’s request for comment. There have been a few sporadic online posts showing posters or advertising flyers for the companies, but it’s not clear how widespread they are. 7Telecom has the larger social media presence of the two, with around 8,600 followers of its account on VKontakte, Russia’s version of Facebook. While there are unofficial Telegram channels for both companies, linked to a firm that allows people to top up SIM cards, each has only a few dozen subscribers. (Although this has not stopped people from complaining about poor connections.)

While the scale of their presence is uncertain, both MirTelecom and 7Telecom appear to have some links to existing mobile companies, which were created following Russia’s annexation of Crimea in 2014 and have formed part of its long-term occupation in the area. “The main Russian operators are not operating a commercial presence in this part, and this is the same as what they did in Crimea,” says Mc Daid. In Crimea and the Donbas, Russian forces created new internet providers. In recent months, Mc Daid says, existing Russian mobile providers in the Donbas have updated their coverage maps claiming that new areas of Ukraine fall under their service.

Analysis shared with WIRED, which Mc Daid is due to present at a conference later this month, shows MirTelecom and 7Telecom appear to be linked to Crimean mobile companies KrymTelecom and K-Telecom, respectively. Details posted publicly by MirTelecom and reporting by Russian media also appear to show some links. (Neither KrymTelecom nor K-Telecom responded to requests for comment.)

Being able to control the internet gives occupying forces the power to shape what people read, watch, and hear. In parts of Ukraine where Russian forces have control, reports have indicated that internet censorship is more heavily enforced than in Russia, where there have been widespread crackdowns on freedom of expression. Lennon says that controlling mobile networks could also allow Russian forces to “pacify” local populations, as it may “disincentivize people from resisting and potentially protesting against new local authorities.”

However, the tide of the war in Ukraine has started to turn. Russian troops are no longer making as many gains as they were at the start of the full invasion, and successful Ukrainian counteroffensives are pushing Putin’s forces back toward Russia’s borders. President Volodymyr Zelensky has claimed Russian troops are “clearly in a panic” during their retreats. Russian officials have downplayed any retreats.

Large parts of the Kharkiv region have been retaken by Ukraine’s forces, the country’s troops are making important gains in Luhansk, and a long-awaited counteroffensive in the Kherson region has begun. The Ukrainian victories have revealed mass graves and potential Russian war crimes, but they also mark one small step toward Ukraine regaining control. For instance, Ukraine claims it has arrested Russian teachers who had been shipped into occupied areas.

As Ukraine has retaken occupied areas, some of its mobile and internet connectivity has returned. On September 11, one of Ukraine’s biggest internet providers, Kyivstar, announced that “communication” in the city of Balaklia in the Kharkiv region had been restored. Since then it tweeted that its engineers have brought connectivity back in the cities of Izyum and Chkalovskoe, along with multiple towns and villages in retaken areas. The company said in a post that it restored 195 base stations in one area during a single week and tweeted: “Where the armed forces go, we go there too!”

While some people’s connectivity is being restored—allowing them to reunite with loved ones and let them know they are alive—the newly created Russian-linked mobile internet firms appear to be scrubbing some of their presence in occupied areas. Until the middle of September, MirTelecom’s web page showing its claimed cell coverage included three maps: the Kherson region, the Zaporizhzhya region, and the Kharkiv region. Then Ukrainian troops retook Kharkiv.

MirTelecom has now removed its coverage map of Kharkiv, only displaying the other two areas. MirTelecom also appears to have wiped news pages from its website: A page introducing the director of MirTelecom’s Kharkiv branch is no longer live, and an article about its “first sales office” in the area is also dead. An archived version of that page claims the company exists to help “erase borders.”

Source

Wired