Roman Sterlingov, accused of laundering $336 million, is proclaiming his innocence—and challenging a key investigative tool.

Tools to trace cryptocurrencies have, over just the past several years, allowed law enforcement agencies to convict dark-web black-market administrators, recover millions in ransomware payments, seize billions in stolen bitcoins, and even disrupt networks of child abuse. Now one criminal defendant claims those same tools have also unjustly put him in jail for more than 15 months.

In the spring of 2021, Roman Sterlingov, a 33-year-old Swedish-Russian national, was arrested by Internal Revenue Service criminal investigators at the Los Angeles airport and was accused of creating and operating Bitcoin Fog, a bitcoin “mixing” service on the dark web that took in coins from its users and returned others with the intention of preventing forensic accountants from following that money’s trail. The US Justice Department accuses Sterlingov of no less than $336 million in money laundering over Bitcoin Fog’s decade online.

Now, Sterlingov’s legal team, led by the well-known hacker defense attorney Tor Ekeland, has fired back: They’re claiming in a series of legal motions filed late yesterday that Sterlingov is innocent and vowing to take his case to trial. In doing so, Sterlingov’s defense says, they plan to show not only that he never ran Bitcoin Fog but also that the blockchain analysis techniques used to pin the case on him were faulty, leading to his wrongful arrest and a lost year of his life.

"I did not create Bitcoin Fog. I was never an administrator of Bitcoin Fog,” Sterlingov told WIRED, speaking from a Northern Virginia jail. "I’ve been here for more than a year now. I’m really perplexed at the system that could put me in here, at what they can do to an innocent man. It’s a Kafkaesque nightmare."

Unlike in some more-clear-cut investigations of criminal use of cryptocurrency, prosecutors in Sterlingov’s case haven’t pointed to any smoking-gun digital evidence retrieved from Sterlingov’s possessions or devices when he was arrested during his trip to the US last year. Instead, the statement of facts released when charges against Sterlingov became public in April 2021 detailed a combination of blockchain-based cryptocurrency tracing, IP address matching, and online account information links. The IRS says that collection of evidence ties Sterlingov to Bitcoin Fog’s creation in 2011 and shows—through Bitcoin tracing in particular—that he continued to receive profits from the service as late as 2019.

“Where’s the corroborating evidence?” asks Sterlingov’s defense attorney Ekeland. He runs through the inventory of items found on Sterlingov at the time of his arrest, which he says included laptops, hard drives, backup codes for his accounts, Bitcoin debit cards, and a customized smartphone for storing cryptocurrency. “But you know what’s not found when they catch him traveling? A shred of evidence that he operated Bitcoin Fog. No witnesses, no logs, no communications. They’re pinning it on a multi-layer guessing game.”

The Department of Justice did not yet respond to WIRED’s request for comment. The IRS declined to comment on pending litigation.

Sterlingov and his lawyers yesterday filed a motion to dismiss, a motion for a bill of particulars, a motion to free seized assets, and a motion to reconsider pretrial detention, among other items. The DOJ has produced more than three terabytes of data related to the case during discovery. The defense alleges that the sheer volume of information is difficult to parse but that nothing in it seems to establish a direct connection between Sterlingov and the creation or operation of Bitcoin Fog. And they further argue that the digital forensic analysis the prosecution has shared is flawed and opaque at best.

If the prosecution doesn’t produce clear evidence as Sterlingov’s case unfolds, it may have to rely on the more indirect digital connections between Sterlingov and Bitcoin Fog that it describes in the statement of facts assembled by the IRS’s criminal investigations division, much of which was based on cryptocurrency tracing techniques. That statement shows a trail of financial transactions from 2011 allegedly linking Sterlingov to payments made to register the Bitcoinfog.com domain, which was not Bitcoin Fog’s actual dark-web site but a traditional website that advertised it.

The funds to pay for that domain traveled through several accounts and were eventually exchanged from Bitcoin for the now-defunct digital currency Liberty Reserve, according to prosecutors. But the IRS says IP addresses, blockchain data, and phone numbers linked with the various accounts all connect the payments to Sterlingov. A Russian-language document in Sterlingov’s Google Account also described a method for obfuscating payments similar to the one he’s accused of using for that domain registration.

Sterlingov says he “can’t remember” if he created Bitcoinfog.com and points out that he worked at the time as a web designer for a Swedish marketing company, Capo Marknadskommunikation. “That was 11 years ago,” Sterlingov says. “It’s really hard for me to say anything specific."

Even if the government _can_ prove that Sterlingov created a website to promote Bitcoinfog.com in 2011, however—and Ekeland argues even that is based on faulty IP address connections that came from Stertlingov’s use of a VPN—Ekeland points out that’s very different from running the Bitcoin Fog dark-web service for the subsequent decade it remained online and laundered criminal proceeds.

To show Sterlingov’s deeper connection to Bitcoin Fog beyond a domain registration, the IRS says it used blockchain analysis to trace Bitcoin payments Sterlingov allegedly made as “test transactions” to the service in 2011 before it was publicly launched. Investigators also say that Sterlingov continued to receive revenue from Bitcoin Fog until 2019, also based on their observations of cryptocurrency payments recorded on the Bitcoin blockchain.

Ekeland counters that the defense hasn’t received any details of that blockchain analysis and points out that it was left out of the most recent superseding indictment against Sterlingov, which was filed last week. That means, he argues, that the government has based the core of its case on an unproven, relatively new form of forensics—one that he says led them to the wrong suspect. “Has it been peer-reviewed? No,” Ekeland says of blockchain analysis. “Is it generally accepted in the scientific community? No. Does it have a known error rate? No. It’s unverifiable. They can say total nonsense, and everyone has to take it on faith."

Ekeland says that discovery documents in the case show that the prosecution’s cryptocurrency tracing was performed with tools sold by Chainalysis, a New York–based blockchain analysis startup, along with consulting help from Excygent, a government contractor specializing in cybercriminal and cryptocurrency investigations, which Chainalysis acquired in 2021.

Ekeland argues that Chainalysis, valued at $8.6 billion in a recent investment round and frequently used in high-profile cybercriminal law enforcement investigations, had a conflict of interest in the case, given its financial dependence on US government contracts and a flow of former government investigators who have gone to work for Chainalysis. “This is a story of people profiteering and advancing their careers, throwing people in jail to promote their blockchain analysis tool that is junk science and doesn’t withstand any scrutiny,” says Ekeland. He adds that, based on the evidence provided in Sterlingov’s case, he believes “Chainalysis is the Theranos of blockchain analysis."

Chainalysis declined to comment about the motions filed yesterday, their broader implications, or Ekeland’s characterization of its work.

Sterlingov, for his part, says his cryptocurrency holdings—all of which were frozen at the time of his arrest—came not from Bitcoin Fog but from early investment in cryptocurrency. He concedes that he did send and receive payments to Bitcoin Fog as a user of the service seeking privacy, but says he didn’t use his bitcoins for anything illegal. “I think some of my transfers must have gotten mixed up with everything," he says.

Along with their motions, the defense filed two expert declarations with the court, one from cybersecurity researcher Chris Vickery and the other from intelligence analyst Eric Garland. The documents are meant to support Sterlingov and his lawyer’s accusations about the prosecution’s digital forensic analysis and Chainalysis and Excygent’s alleged conflicts of interest in investigating Sterlingov’s potential ties to Bitcoin Fog.

Sterlingov, who moved with his family from Voronezh, Russia, to Gothenburg, Sweden, when he was 14, also argues that as a Swedish citizen he should be tried in Sweden rather than the United States. He had flown to the US, he says, only to go to flight school to train as a commercial pilot. His defense has argued in Monday’s motions that the District of Columbia prosecutors charging Sterlingov have no venue to pursue the case, given that he has no connection to Washington, DC.

"I don’t understand how I’m in an American jail. I’ve never done business with America,” says Sterlingov. “I’m worried. I don’t know what’s going to happen. I’m thousands of miles from my home. If I were some kind of crypto criminal kingpin, which I’m not, Sweden could deal with me."

Furthermore, Sterlingov’s lawyers argue in their motion to dismiss that the statute of limitations has run out on the charges against him, since the alleged conduct at issue, including registering the Bitcoinfog.com domain and conducting particular Bitcoin transactions, occurred in 2011. The motion argues that three of the counts brought against Sterlingov have a five-year statute of limitations and that one has a six-year statute.

Given that blockchain analysis and cryptocurrency payment tracing techniques have matured over the past decade and have become central to many cybercriminal investigations in the US and worldwide, it is inevitable that their methodology and validity will be called into question and interrogated. Sterlingov’s case is taking the first step to establish that battleground.

Bitcoin Fog Case Could Put Cryptocurrency Tracing on Trial

Keep your logins locked down with our favorite apps for PC, Mac, Android, iPhone, and web browsers.

Bitwarden offers a paid upgrade account. The cheapest of the bunch, Bitwarden Premium, is $10 per year. That gets you 1 GB of encrypted file storage, two-factor authentication with devices like YubiKey, FIDO U2F, Duo, and a password hygiene and vault health report. Paying also gets you priority customer support.

_After signing up,_ _download the app_ _for Windows, MacOS, Android, iOS, or Linux. There are also browser extensions for_ _Firefox, Chrome, Safari, Edge, Vivaldi, and Brave__._

Best Full-Featured Manager

Courtesy of Dashlane

I first encountered Dashlane several years ago. Back then, it was the same as its competitors with no standout attributes. But recent updates have added several helpful features. One of the best is Site Breach Alerts, something other services have since added as well. Dashlane actively monitors the darker corners of the web, looking for leaked or stolen personal data, and then alerts you if your information has been compromised.

Setup and migration from another password manager is simple, and you’ll use a secret key to encrypt your passwords, much like 1Password’s setup process. In practice, Dashlane is very similar to the others in this list. The company did discontinue its desktop app earlier this year, moving to a web-based user interface, which is a little different than 1Password and Bitwarden. (The desktop apps officially shut down on January 10, 2022.) I primarily use passwords in the web browser anyway, and Dashlane has add-ons for all the major browsers, along with iOS and Android apps. If a desktop app is important to you, it’s something to be aware of. Dashlane offers a 30-day free trial, so you can test it out before committing.

_After signing up,_ _download the app_ _for Android and iOS, and grab the browser extensions for_ _Firefox, Chrome, and Edge__._

Best DIY Option (Self-Hosted)

Courtesy of KeePassXC

Want to retain more control over your data in the cloud? Try using a desktop application like KeePassXC. It stores encrypted versions of all your passwords into an encrypted digital vault that keeps you secure with a master password, a key file, or both. The difference is that instead of a hosted service like 1Password syncing it for you, you sync that database file yourself using a file-syncing service like Dropbox or Edward Snowden’s recommended service, SpiderOak. Once your file is in the cloud, you can access it on any device that has a KeePassXC client.

Why do it yourself? In a word: transparency. Like Bitwarden, KeepassXC is open source, which means its code can be and has been inspected for critical flaws.

_Download the_ _desktop app_ _for Windows, MacOS, or Linux and create your vault. There are also extensions for_ _Firefox__,_ _Edge__, and_ _Chrome__. It does not have official apps for your phone. Instead, the project recommends_ _KeePass2Android_ _or_ _Strongbox for iPhone__._

Another Option

Courtesy of NordPass

NordPass is a relatively new kid on the password manager block, but it comes from a company with significant pedigree. NordVPN is a well-known VPN provider, and the company brings to its password manager much of the ease of use and simplicity that made its VPN offering popular. The installation and setup process is a breeze. There are apps for every major platform (including Linux), browser, and device.

The free version of NordPass is limited to one device, and there’s no syncing available. There is a seven-day free trial of the premium version, which lets you test device syncing. But to get that for good, you’ll have to upgrade to the $36-a-year plan. (Like its VPN service, NordPass accepts payment in cryptocurrencies.)

You Need a Password Manager. Here Are the Best Ones

Plus: A Google Chrome patch licks the DevilsTongue spyware, Android’s kernel gets a tune-up, and Microsoft fixes 84 flaws.

July has been a month of important updates, including patches for already-exploited vulnerabilities in Microsoft and Google products. This month also saw the first Apple iOS update in eight weeks, fixing dozens of security flaws in iPhones and iPads.

Security vulnerabilities continue to hit enterprise products, too, with July patches issued for SAP, Cisco, and Oracle software. Here’s what you need to know about the vulnerabilities fixed in July.

Apple iOS 15.6

Apple has released iOS and iPadOS 15.6 to fix 37 security flaws, including an issue in Apple File System (APFS) tracked as CVE-2022-32832. If exploited, the vulnerability could allow an app to execute code with kernel privileges, according to Apple’s support page, giving it deep access to your device.

Other iOS 15.6 patches fix vulnerabilities in the kernel and WebKit browser engine, as well as flaws in IOMobileFrameBuffer, Audio, iCloud Photo Library, ImageIO, Apple Neural Engine, and GPU Drivers.

Apple isn’t aware of any of the patched flaws being used in attacks, but some of the vulnerabilities are pretty serious—especially those affecting the kernel at the heart of the operating system. It’s also possible for vulnerabilities to be chained together in attacks, so make sure you update as soon as possible.

The iOS 15.6 patches were released alongside watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, macOS Big Sur 11.6.8, and macOS Catalina 10.15.7 2022-005.

Google Chrome

Google released an emergency patch for its Chrome browser in July, fixing four issues, including a zero-day flaw that has already been exploited. Tracked as CVE-2022-2294 and reported by Avast Threat Intelligence researchers, the memory corruption vulnerability in WebRTC was abused to achieve shellcode execution in Chrome’s renderer process.

The flaw was used in targeted attacks against Avast users in the Middle East, including journalists in Lebanon, to deliver spyware called DevilsTongue.

Based on the malware and tactics used to carry out the attack, Avast attributes the use of the Chrome zero-day to Candiru, an Israel-based company that sells spyware to governments.

Microsoft’s Patch Tuesday

Microsoft’s July Patch Tuesday is a big one, fixing 84 security issues including a flaw already being used in real-world attacks. The vulnerability, CVE-2022-22047, is a local privilege escalation flaw in the Windows Client/Server Runtime Subsystem (CSRSS) server and client Windows platforms, including the latest Windows 11 and Windows Server 2022 releases. An attacker able to successfully exploit the vulnerability could gain System privileges, according to Microsoft.

Of the 84 issues patched in Microsoft’s July Patch Tuesday, 52 were privilege escalation flaws, four were security feature bypass vulnerabilities, and 12 were remote code execution issues.

Microsoft security patches do sometimes cause other issues, and the July update was no different: Following the release, some users found MS Access runtime applications did not open. Thankfully, the firm is rolling out a fix.

Android July Security Bulletin

Google has released July updates for its Android operating system, including a fix for a critical security vulnerability in the System component that could lead to remote code execution with no additional privileges needed.

Google also fixed serious issues in the kernel–which could result in information disclosure—and the framework, which could lead to local privilege escalation. Meanwhile, vendor-specific patches from MediaTek, Qualcomm, and Unisoc are available if your device is using those chips. Samsung devices are starting to receive the July patch, and Google also released updates for its Pixel range.

SAP

Software maker SAP has issued 27 new and updated security notes as part of its July Security Patch Day, fixing multiple high-severity vulnerabilities. Tracked as CVE-2022-35228, the most serious issue is an information disclosure flaw in the central management console of the vendor’s Business Objects platform.

The vulnerability allows an unauthenticated attacker to gain token information over the network, according to security firm Onapsis. “Fortunately, an attack like this would require a legitimate user to access the application,” the firm adds. However, it’s still important to patch as soon as possible.

Oracle

Oracle has issued 349 patches in its July 2022 Critical Patch Update, including fixes for 230 flaws that can be exploited remotely.

Oracle’s April Patch Update included 520 security fixes, some of which addressed CVE-2022-22965, aka Spring4Shell, a remote code execution flaw in the spring framework. Oracle’s July update continues to address this issue.

Apple Just Patched 37 iPhone Security Bugs

Plus: Google delays the end of cookies (again), EU officials were targeted with Pegasus spyware, and more of the top security news.

Russia’s full-scale invasion of Ukraine has been ongoing for more than 150 days, with no end to the conflict in sight. While Ukrainian troops are having some success with counteroffensives in the south of the country, the war is having long-lasting impacts on freedom of speech and online censorship.

This week, we documented how a flurry of more than half a dozen new Russian laws, all proposed or passed in recent months, will help to separate Russia from the global internet. The move, if successful, could damage the very idea of the free and open internet and have global ramifications. But it is not all bad news. Russia’s attempts to block and censor people’s online lives are hitting some stumbling blocks: Its long-held ambition to block anonymity service Tor is faltering.

Last month, Joe Biden signed the Bipartisan Safer Communities Act, the first major federal gun law passed in years. However, senators lacked any real government data on gun violence when they were drafting the law, in part because, until 2019, the Centers for Disease Control and Prevention was banned for decades from studying gun violence in America. As a result, much of the data used to inform the Act came from elsewhere. We also looked at whether states could legally block people seeking abortions from crossing state lines to do so following the fall of _Roe v. Wade_.

Elsewhere, we’ve also put together a guide to how you can safely lend your phone to someone else, whether to a friend who wants to look at your holiday photos or a stranger who needs to make an emergency phone call. A few simple tweaks to your iPhone or Android settings can quickly help to secure your data.

And there’s more. Each week we round up the news that we didn’t break or cover in depth. Click on the headlines to read the full stories. And stay safe out there!

Every year, the list of companies getting hacked or suffering data breaches continues to grow. These incidents are often the result of businesses’ technical misconfigurations or poor security practices. While each incident is different, it is undeniable that data breaches can have huge impacts on those impacted: individuals who have their data leaked, for example, and companies who have to deal with reputation and financial damage. This week, an IBM report revealed that the cost of a data breach in 2022 has reached an “all-time high,” averaging $4.35 million. That’s a 2.6 percent increase from last year.

Perhaps more salient, according to IBM’s data, is that companies are hitting their customers with the costs of data breaches. The company surveyed 550 organizations that had suffered a data breach between March 2021 and March 2022, and 60 percent of them said they had increased their prices as a result of the breach. No specific examples were given in the report. And it’s unclear whether companies passing on the costs of cybersecurity incidents are investing that extra income into better protecting their customer’s data in the future. However, according to IBM, only 17 percent of the 550 companies surveyed said it was the first data breach they had suffered.

Another week, another set of spyware bombshells. This week Reuters revealed that the European Union found evidence that phones belonging to its staff were targeted with Pegasus, the powerful hacking tool of Israeli firm NSO Group. EU Justice Commissioner Didier Reynders was apparently told by Apple that his iPhone may have been hacked in 2021. An ongoing EU investigation, according to Reuters, found indicators of compromise on some devices. It follows officials announcing that 14 EU member states have purchased Pegasus in the past.

That was not the only spyware revelation this week. The leader of Greece’s opposition political party launched a complaint alleging his phone had been targeted with Israeli-made Predator spyware, developed by Cytrox. Microsoft also linked spyware, dubbed Subzero, to European firm DSIRF. The details, published to coincide with a spyware hearing of the House Intelligence Committee, claimed Subzero had been used to target banks and consultancy firms in Austria, the UK, and Panama.

If technology companies want to operate in China and sell their products to a market of more than a billion people, they’re going to have to bend to the rules. Firms are required to store data locally and, as Apple learned, may have to compromise the security protections they put in place around people’s data. As the video game _Roblox_ prepared to launch in China in 2017 and 2018, its developer was well aware of the potential consequences.

According to _Roblox_ documents obtained by VICE, the company believed it could be hacked if it entered China and that rivals would create their own version of its game. “Expect that hacking has already started,” an internal presentation in 2017 said. The documents also show how _Roblox_ applied Chinese censorship laws—“illegal content” included tampering with historical facts and misrepresenting Chinese territories on maps—and other local laws, such as collecting players’ real names. _Roblox_ eventually launched its Chinese app LuoBuLesi in July 2021, but shut it down at the start of this year.

For years, Apple’s Safari and Mozilla’s Firefox browsers have limited how third-party cookies can track you across the web. These small snippets of code, which are saved to your device when you visit websites, are able to track your browsing history and show you ads based on what you’ve seen. They’re widely considered a privacy nightmare. So when Google announced, in January 2020, that Chrome would finally ditch creepy third-party cookies by 2022, the move was a big deal. However, in practice, Google has struggled to make the change. This week, Google announced its plan has been delayed for a second time. Third-party cookies have been given a stay of execution until at least the backend of 2024, when they will start to be phased out. So far, Google’s efforts to replace third-party cookies have been turbulent, with privacy advocates claiming the replacements are worse than cookies, and the advertising industry saying they’ll decrease competition.

You Pay More When Companies Get Hacked

Russia has been trying to block the anonymous browser since December—with mixed results.

For years, the anonymity service Tor has been the best way to stay private online and dodge web censorship. Much to the ire of governments and law enforcement agencies, Tor encrypts your web traffic and sends it through a chain of computers, making it very hard for people to track you online. Authoritarian governments see it as a particular threat to their longevity, and in recent months, Russia has stepped up its long-term ambition to block Tor—although not without a fight.

In December 2021, Russia’s media regulator, Roskomnadzor, enacted a 4-year-old court order that allows it to order internet service providers (ISPs) to block the Tor Project website, where the Tor Browser can be downloaded, and restrict access to its services. Since then, censors have been locked in a battle with Tor’s technical team and users in Russia, who are pushing to keep the Tor network online and allow people to access the uncensored web, which is otherwise heavily restricted in the country.

Russia’s efforts to block Tor come in two flavors: the technical and the political. So far, Tor has had some success on both fronts. It has found ways to avoid Russian blocking efforts, and this month, it was removed from Russia’s list of blocked websites following a legal challenge. (Although this doesn’t mean blocking efforts will instantly end.)

“We are being attacked by the Russian government, they are trying to block Tor,” says Gustavo Gus, community team lead of the Tor Project. The past few months have seen Russian officials adapt their tactics, Gus says, while the Tor Project’s anti-censorship engineers have successfully launched updates to stop its services from being blocked. “The fight is not over,” Gus says. “People can connect to Tor. People can easily bypass censorship.”

In Russia, the internet infrastructure is relatively decentralized: ISPs can receive blocking orders from Roskomnadzor, but it’s up to individual companies to implement them. (China is the only country to have effectively blocked Tor, which was possible due to more centralized internet control). While Russian authorities have been installing new equipment that uses deep packet inspection to monitor and block online services, the effectiveness of these blocks is mixed.

“The censorship that’s happening in Russia is not constant and uniform,” Gus says. Gus explains that because of different ISPs, Tor may be blocked for some people but not others, even those in the same city. Both Tor’s metrics and external analysis appear to show the dwindling effectiveness of Russian censorship.

Tor’s data shows that since the end of 2021 there has been a big drop in the number of people directly connecting to Tor in Russia. However, people are able to connect to its services using volunteer-run bridges—entry points to the network that can’t easily be blocked, as their details aren’t public—and Tor’s anti-censorship tool Snowflake. External data from the internet monitoring group Open Observatory of Network Interference shows a big rise in people in Russia accessing Tor using Snowflake.

Since the start of Russia’s war with Ukraine in February, Russian officials have introduced a slurry of new laws to control the internet and have clamped down on civil society groups. Natalia Krapiva, tech legal counsel at NGO Access Now, says Russia blocking Tor is part of larger efforts to control people’s access to information, such as the Kremlin’s VPN clampdown. “Russia is trying to eliminate any possible sources of truthful alternative information about the war and about what is going on in Russia internally,” Krapiva says. This feeds into a “chilling effect,” where people change their behavior or self-censor. “Certain measures, even if they don’t directly block or censor, create this fear of retaliation and fear of consequences coming later on.”

There have been two major incidents against Tor’s Snowflake, Gus says. The first, in December, was fixed within 10 days. The second, in May of this year, was also patched shortly after it was discovered. “They were blocking Snowflake in different ways,” Gus says. These attacks against Snowflake often involve fingerprinting, which uses small details about browsers and internet connections to try and uniquely identify the technology that someone is using. For instance, the number of times a browser connects with an external source may make it stand out from other browsers. If Snowflake can be identified, it is easier to block.

Gus claims that some of the censorship efforts are being conducted by hand. “I have some evidence that they are doing that manually,” he says. Gus claims it is likely that some officials in Russia appear to be downloading Tor and then fetching bridges so they can then take steps to block access. “They try to simulate that they are a user so they can get the bridge address, and then they block it,” he says. Roskomnadzor, the Russian internet regulator, had not replied to a request for comment at the time of publication.

The latest version of the Tor browser, 11.5, which was released last week, introduces new features to automatically try to help people circumvent censorship based on their location. In addition to issuing updates to circumvent the way Tor is being blocked, the nonprofit technology organization has also been directly gathering information from people in Russia. Gus says it has introduced more support for Russian users, who can report back if they are being blocked. There are also more volunteer-run bridges that people in Russia can use to access Tor.

Gus also says that using Telegram to share details of Tor bridges has been effective in fighting blocks. “The bridges that they were blocking were not the same bridges that we were sharing with users,” Gus says, adding that Tor has plans to share bridges via Signal and WhatsApp in the future.

Tor is also working to stop the potential abuse of bridges. In 2016, researchers proposed a system called Salmon that aims to weed out those accessing bridge details with the intent of blocking or abusing them. Gus says the Tor team is working to turn this proposal into reality, and it would essentially assign “reliability” scores around the use of bridges. If someone requests a bridge and it ends up getting blocked, they may be considered less trustworthy. “If I give you another bridge and it gets blocked again, then you will get another bad score,” Gus says.

Russia’s efforts to block Tor aren’t just confined to within its own borders, though. In some areas of occupied Ukraine, such as the city of Kherson, Ukrainian internet connections are being rerouted through Russian networks, and that brings censorship and surveillance with it. Gus says that as this shift has started to happen—signaling a potential long-term occupation and “Russification” of the areas—people using Tor in Ukraine have reported it not working and websites not loading. “They are being affected by the same censorship that people in other places in Russia were reporting to us,” Gus says.

If people are able to access Tor—both in Russia and occupied Ukraine—they will be able to access news and information that isn’t controlled by the Russian government. Sarkis Darbinyan, head of legal practice of Russian digital rights group Roskomsvoboda, says more than 5,500 websites have been blocked in Russia since its full-scale invasion of Ukraine in February. “For getting access to truthful information for Russian users, it is now critical to have tools like VPN and Tor, which let people quickly and effectively restore their violated rights,” Darbinyan says.

Roskomsvoboda has been representing Tor in its legal cases against Russian authorities pro bono. So far it has successfully overturned Roskomnadzor’s December decision to block Tor—in part because of procedural issues. Although other related legal proceedings are ongoing, Darbinyan says Roskomsvoboda is seeking a “complete cancel” of the decision that Tor should be blocked.

Krapiva describes the court case against Tor as a “rare victory” for digital and human rights in Russia. However, she cautions that it is likely to be a “temporary” win, and that Russian authorities may try to legally block Tor again. But this doesn’t mean it will be able to stop people from using Tor. “We’re still seeing that the technologies they have can be quite effective for blocking some things, but are not 100 percent effective,” Krapiva says. “In practice, whether Tor will be fully blocked—I doubt it, to be honest. But legally, I think they will try again, and might eventually succeed.”

How Tor Is Fighting—and Beating—Russian Censorship

Democratic senators lacked actionable gun data for their negotiations—so they passed mental health reform instead.

“Yeah, I think that was,” Republican senator Thom Tillis says of Cornyn’s unscientific news clipping.

JFK’s Legacy

For Tillis, what truly unified the disparate group of progressives and conservatives was data—just not gun data. Instead, he says, their negotiations were most influenced by former president John F. Kennedy.

On October 31, 1963, Kennedy signed into law the Community Mental Health Act, a measure aimed at replacing asylums with community-based mental health clinics. Three weeks later, Kennedy was gunned down, burying the promise of his vision to reform mental health care in the US. In the ensuing decades, communities nationwide ditched asylums, but robust funding for local clinics never materialized.

In 2014, Congress passed the Excellence in Mental Health Act, which promised to be the realization of JFK’s now half-century-old dream. Republican senator Roy Blunt of Missouri and Democratic senator Debbie Stabenow of Michigan teamed up to pass those mental health reforms, and they have since tracked the pilot programs their law set up, initially, in eight states. Over a five-year period, these federally supported Certified Community Behavioral Health Clinics “had 63.2% fewer emergency department visits for behavioral health issues, saw a 40.7% decrease in homelessness and spent 60.3% less time in correctional facilities,” according to the Department of Health and Human Services.

Those results and related stats proved magnetic to Washington’s fiscal conservatives and defund-the-police progressives alike.

“It was critical because other people wanted to do something and had ideas, yet none of it was developed or actionable,” Stabenow says. “People felt like it was real. It was tangible.”

A huge selling point is that to be eligible for the federal program, states are required to set up 24-hour psychiatric crisis centers. That reduces police responsibility, which was appreciated by law enforcement groups nationwide, who don’t want officers charged with mental health duties. Hence, these local efforts were nationalized this summer as a part of the compromise measure.

“There were a few around the country, but no national effort to make this happen,” Blunt says. “We had a program working, producing significant results, widely supported by law enforcement, by emergency rooms, by families who didn't have the kind of relief they needed to the mental health problems peaceful people were facing.”

The Blunt-Stabenow mental health program provided Senate negotiators with around five years of unambiguous data from states as different as Oklahoma and New York. That proved essential to its inclusion.

“We started using as much data as we could to say, ‘This is a hypothetical, this is measurable,’” Tillis says. “It was tangible.”

That’s also why Cornyn’s not wrong when he bristles at the “gun control” label. Roughly two-thirds of the funding tucked into the new federal “gun” law goes to behavioral health. Lawmakers expect, based on results from those local pilot programs, to see a trickle-up effect nationwide as cops are (on paper, at least) replaced with much-needed mental health workers.

“We ended up going, ‘What are the root causes?’” Tillis says. “If we're taking a look at reducing gun deaths and taking a look at behavioral health, which is linked to a lot of these active shooter environments, it was using data to say, ‘What decisions could we make that would most likely make the best outcome?’”

Heavy Traffic

Then there’s the US-Mexico border. Mexico estimates that some 2 million proudly made-in-America guns have flooded its streets and those of its own southern neighbors, fueling incomprehensible—and unquantifiable—bloodshed. And the violence, in return, causes hundreds of thousands to flee their homes and risk death to head north annually.

One of the most dramatic changes tucked into the new law fundamentally alters the relationship between the United States and Mexico, as well as Guatemala, El Salvador, and Honduras (aka the Northern Triangle).

Don’t Call the New Federal Gun Law a Gun Law

The DOJ vows to protect people’s ability to travel out of state for abortion care, but legal experts warn we can’t take it for granted.

Now that Congress has failed to pass a bill that would guarantee a right to travel across state lines to obtain an abortion, many are worried that conservative states that have started restricting abortion rights could soon decide to block people seeking abortions from leaving their own state for that purpose. Many Republican lawmakers are already discussing this possibility. But would such drastic restrictions even be possible—or, at the very least, legal?

The Biden administration, aware that Congress will likely not act on abortion rights before the November midterms, has been making efforts to determine what the executive branch can do to protect abortion access on its own. President Joe Biden signed an executive order at the beginning of the month that directed the Department of Health and Human Services (HHS) to expand access to abortion pills, protect patient privacy, and more.

Following that executive order, the US Department of Justice announced the establishment of a Reproductive Rights Task Force, which will “monitor and evaluate” efforts to ban abortion pills, prevent someone from obtaining an abortion in a state where it is legal, or punish federal employees who provide health care that is legal at the federal level. How much the Department of Justice can do to protect the right to travel across state lines for an abortion, and whether states can ban people from doing so remain glaring unknowns.

In terms of what the Justice Department can do if a state were to ban traveling to obtain an abortion, the most likely response would be a lawsuit against that state. Mary Ziegler, a law professor at UC Davis, says the agency would argue that such a ban is unconstitutional. (The DOJ itself did not respond to a request for comment.)

Justice Brett Kavanaugh wrote in his concurring opinion in _Dobbs v. Jackson Women's Health Organization_, which overturned _Roe v. Wade_, that states may not ban people from traveling across state lines to get an abortion. That being said, Ziegler isn’t exactly confident the right to travel will remain protected.

“What Kavanaugh said was really vague. It’s true there’s a right to travel, but I don’t know how much that gets you,” says Ziegler. “There used to be a right to abortion, and now there is not. When the court is talking about unenumerated rights, that can change. Even if you take Kavanaugh at his word about this, that doesn’t answer all of the questions.”

The right to travel is generally seen as protected by the Fourteenth Amendment, and this has been upheld by the Supreme Court in the past. However, the right to an abortion was also seen as something that was protected by the Fourteenth Amendment until _Roe_ was overturned.

“I think efforts to try and deal with the right to travel—this is uncharted territory in a lot of ways. There’s not a lot of broad precedent about the right to travel,” says Melissa Murray, a law professor at New York University. “A lot of it is going to present issues that for some courts will feel or seem like a first impression.”

In order to avoid an anti-travel law being struck down by the courts, a state could craft legislation that effectively but not explicitly bans interstate travel. Texas’ SB 8, which banned abortion after six weeks prior to _Roe_ being struck down, was able to survive judicial review because it is effectively enforced by private individuals or groups, in the form of lawsuits, instead of the state. Interestingly enough, research from the University of Texas at Austin found that out-of-state travel dramatically increased following the passage of SB 8.

Rachel Rebouché, interim dean and a professor of law at the Temple University School of Law, says a lawsuit from the Department of Justice over anti-travel legislation may not be successful.

“SB 8 in Texas was unconstitutional, and it’s still in force. It was in force while there was _Roe_ on the books. I’m not sure we can predict with any certainty what future courts are going to hold,” says Rebouché. “There’s already case law of a law that a court could interpret as unconstitutional at the time it was passed being shielded from federal court review because of the kind of enforcement mechanism it has.”

Without Congress passing a law to protect the right to travel, it will likely be difficult for the Department of Justice to defend that right. Rebouché says the department needs to look at all of the laws that are already on the books, such as laws related to interstate commerce or civil rights, and see if there are any that would allow it to enforce the right to travel.

“The DOJ is a huge entity with so many moving parts, so many different kinds of powers and responsibilities. Thinking about how it could intervene means thinking creatively about where are these touch points of DOJ powers and duties that might touch on abortion access,” Rebouché says.

What is clear is that a showdown between the Department of Justice, states, and the courts is likely fast approaching. If the DOJ is going to prioritize protecting abortion access, it will have to do a full survey of every power it has available and hope the Supreme Court doesn’t decide that it doesn’t, in fact, have those powers.

Interstate Travel Post-Roe Isn’t as Secure as You May Think

Since Vladimir Putin blocked Facebook, Instagram, and Twitter in March, Russia has been pushing away from the global internet at a rapid pace.

Finally, Shakirov says, there is the “restriction of access to information”—blocking websites. The legal ability to block websites was implemented through the adoption of Russia’s sovereign internet law in 2016, and since then, Russia has been expanding its technical capabilities to block sites. “Now the possibilities for restricting access are developing by leaps and bounds,” Shakirov says.

The sovereign internet law helps to build upon the idea of the RuNet, a Russian internet that can be disconnected from the rest of the world. Since the start of the war against Ukraine in late February, more than 2,384 sites have been blocked within Russia, according to an analysis by Top10 VPN. These range from independent Russian news websites and Ukrainian domains to Big Tech and foreign news sites.

“The Russian government is continually trying to have more control over the content that people are able to access,” says Grant Baker, a technology and democracy research associate at nonprofit Freedom House. (Roskomnadzor, the country’s media and communications regulator, did not respond to a request for comment from WIRED.) All the internet control measures and surveillance systems, Baker says, are coupled with wider societal clampdowns, including the detention of more than 16,000 peaceful protestors and the increased use of face recognition.

But building a surveillance empire isn’t straightforward. China is widely considered the most restrictive online nation in the world, with its Great Firewall blocking websites that fall outside its political vision. This Chinese “sovereign” model of the internet took years to flourish, with even the creator of China's firewall reportedly getting around it using a VPN.

As Russia has aimed to emulate this Chinese model to some degree, it’s faltered. When officials tried to block messaging app Telegram in 2018, they failed miserably and gave up two years later. Building Russia’s vision of the RuNet has faced multiple delays. However, many of Russia's most recent policy announcements aren’t designed for the short term—controlling the internet is a long-term project. Some of the measures may never exist at all.

“It is still difficult to assess in detail the impact of all these measures, given the often-blurred distinction between a clear political signal and ambition from the Kremlin, and its effective translation into concrete projects and changes,” says Julien Nocetti, senior associate fellow at the French Institute of International Relations, who studies Russia’s internet.

For instance, multiple Russian language app stores have appeared in recent months, but many of them have few apps available for download. According to the independent newspaper _The Moscow Times_, one leading app store contender, RuStore, has fewer than 1,000 apps available to download.

Other sovereign internet efforts have floundered too. RuTube, Russia’s equivalent to YouTube, has failed to gain popularity despite officials pushing its use. Meanwhile, the website of Rossgram, a potential Instagram alternative that hasn’t launched yet, displays a message saying it is “under development” and warns people not to download versions of the app they may find online as they “come from scammers.”

While many of Russia’s sovereign internet measures have struggled to get off the ground, its ability to block websites has improved since it first tried to throttle Twitter in March 2021. And other nations are watching. “Countries are learning various internet regulation practices from each other,” Shakirov says. “Russia decided to make a Chinese version of its internet, and now other countries of the post-Soviet space, Africa, or Latin America can follow this example.”

Lokot says that as more nations look to regulate the internet and do so with their national security in mind, the internet itself is put at risk. “When the conversation changes from ‘the internet as a public good’ to the ‘internet, and internet access, as a matter of national security,’ the questions change,” Lokot says. “We will potentially see some really problematic choices made by states—and not just by authoritarian states, but also by democratic states.”

Russia Is Quietly Ramping Up Its Internet Censorship Machine

The next time someone wants to borrow your device to make a call or take a picture, take these steps to protect your privacy.

From the nephew who wants to play games for a few minutes, to the friend who wants to see your vacation snaps, to the stranger who needs to make a call, there are going to be people who want to borrow your phone.

That's quite a privacy and security risk if you think about everything that your phone gives you access to: social media profiles, banking details, instant messenger conversations, photos and videos that you'd rather the world didn't see, and so on.

However, there are ways to hand over your phone to someone else without having to worry about what they might get up to on it. You just need to make sure that you've taken a few precautions before the exchange takes place.

iPhone

Guided Access is built into iOS.

Apple via David Nield

(Apple via David Nield)

The feature you need to know about on the iPhone is called Guided Access, and you can enable it by opening up iOS Settings and choosing **Accessibility** and **Guided Access**. Turn the **Guided Access** toggle switch on and the feature is ready to go—just make sure you use **Passcode Settings** to set a passcode to protect Guided Access mode.

To actually turn Guided Access on, you need to triple-tap the home button if your iPhone has one, or the side button if it doesn't. You can then tap **Options** to configure how Guided Access is going to work: You're able to restrict access to the volume buttons, for example, and the software keyboard. You can even turn off touchscreen functionality and put a limit on Guided Access mode. Tapping **Start** launches Guided Access.

Whoever is using the iPhone is then locked into the current app, so you need to open up the app in question—the Phone app, a particular game, or whatever it is—before you triple-tap the button on your device to launch Guided Access. You get out of Guided Access with another triple-tap of the same button, at which point you'll need the passcode that you set at the start.

The idea is that without the passcode, the person using your iPhone can't get out of the app you've put them in—there's no way to switch apps, open up the Control Center, or even turn the phone off. It's worth being aware of the app that they're in, though, and what they can do inside that app: If you're showing someone your photos, they'll be able to access all of them.

One extra option in the Photos app is to hide photos and videos by opening them, tapping the share button (bottom left), and choosing **Hide**. This hides these pictures and clips in a special Hidden folder. They won't be visible in normal view in the Photos app, and they won't appear in searches, but the person borrowing your smartphone can still get at them by choosing **Hidden** from the **Albums** tab.

Android

Apps can be pinned inside Android.

Google via David Nield

If you're using an Android device, you can take advantage of a feature similar to Guided Access on iOS. It's called App Pinning, and again the idea is that the person borrowing your phone is limited to one app. They're not able to get to another app or access the phone's settings without a PIN code set by you.

There are certain software variations among Android phone makers when it comes to finding and enabling App Pinning, but you should be able to find it without too much trouble. On the stock version of Android that Google puts in its Pixel phones, you can enable it by going to the main Android Settings menu, then choosing **Security**, **Advanced Settings** and **App Pinning**.

Turn on the **Use App Pinning** toggle switch, and make sure that **Ask for PIN Before Unpinning** is enabled as well—this prevents everyone but you from switching apps. To find the app you want to pin, swipe up and hold from the bottom of the screen until you see thumbnails of your recently used apps. Find the one you want, tap the app icon at the top, and choose **Pin** from the drop-down menu. 

To get out of app pinning, swipe up and hold from the bottom of the screen again. The phone will be locked, and your PIN code will be required to regain access and move between apps. Assuming that the person borrowing your phone doesn't know your PIN, you'll be able to keep them in one app.

Like Apple Photos, Google Photos can also hide photos and videos, which can help if someone is browsing through your pictures. Open an image or clip, tap the three dots (top right), then choose **Move to Locked Folder**—the photos and videos that you send here can't be accessed without unlocking your phone first, which will require a PIN, a fingerprint scan, or a face scan, depending on how you've set it up.

How to Safely Lend Someone Else Your Phone

Plus: The FCC cracks down on car warranty robocalls, Thai activists get targeted by NSO's Pegasus, and the Russia-Ukraine cyberwar continues.

As the United States midterm elections near, lawmakers and law enforcement officials are on high alert about violent threats targeted at election officials across the country—domestic threats that have taken first billing over foreign influence operations and meddling as the primary concern for the 2022 elections. In another arena, though, Congress is making progress on generating bipartisan support for sorely needed and overdue privacy legislation in the form of the American Data Privacy and Protection Act.

Iranian women’s rights activists sounded the alarm this week that Meta has not been responsive to their concerns about targeted bot campaigns flooding their Instagram accounts during a crucial moment for the country’s feminist movement. And investigators looking at attacks on internet cables in Paris have still not determined who was behind the vandalism or what their motive was, but new details have emerged about the extent of the sabotage, making the situation all the more concerning and intriguing. 

The ACLU released documents this week that detail the Department of Homeland Security’s contracts with phone-tracking data brokers who peddle location information. And if you’re worried about Big Brother snooping on your reproductive data, we have a ranking of the most popular period-tracking apps by their data privacy protections. 

And there’s more. Each week we round up the news that we didn’t break or cover in-depth. Click on the headlines to read the full stories. And stay safe out there!

The Department of Homeland Security Inspector General told the Secret Service on Thursday to halt its investigation into the deletion of January 6 insurrection-related text messages because of an “ongoing criminal investigation” into the situation. Secret Service spokespeople have said conflicting things: that data on the phones was erased during a planned phone migration or factory reset, and that the erased messages were not relevant to the January 6 investigation. The Secret Service said it provided agents with a guide to backing up their data before initiating the overhaul process, but noted that it was up to the individuals to complete this backup. 

Zero Day spoke to Robert Osgood, director of the forensics and telecommunications program at George Mason University and a former FBI digital forensics examiner, about the situation. “Osgood said that telling agents to back up their own phones ‘makes absolutely no sense’— particularly for a government agency engaged in the kind of work the Secret Service does and required to retain records. The agency is not only charged with protecting the president, vice president and others, it also investigates financial crimes and cybercrime,” reports Zero Day author Kim Zetter. “I’m pro-government, and \[telling agents to back up their own phones\] sounds strange,” Osgood told Zetter. “If that did happen, the IT manager that’s responsible for that should be censured. Something should happen to that person because that’s one of the dumbest things I’ve ever heard in my life.'”

The Federal Communications Commission’s Robocall Response Team said on Thursday that it is ordering phone companies to block robocalls that warn about expiring car warranties and offer renewal deals. The FCC said that the calls, which are familiar to people around the US, have come from “Roy Cox Jr., Aaron Michael Jones, their Sumco Panama companies, and international associates.” Since 2018 or possibly earlier, their operations have resulted in more than 8 billion prerecorded message calls to Americans, the FCC said. “We are not going to tolerate robocall scammers or those that help make their scams possible," FCC chairperson Jessica Rosenworcel said in a statement. “Consumers are out of patience and I’m right there with them.”

After Apple warned a number of Thai activists and their associates in November that their devices might have been targeted with NSO Group’s notorious Pegasus spyware, a number of them reached out to human rights groups and researchers who established a broader picture of a campaign in Thailand. In all, more than 30 Thai victims have been identified. The targets worked with the local human rights group iLaw, which found that two of its own members had been victims of the campaign, as well as University of Toronto’s Citizen Lab and Amnesty International. The researchers did not provide attribution for who was behind the Pegasus campaigns, but found that a lot of the targeting occurred in the same general time when the targets were participating in protests against government policies.

Google’s Threat Analysis Group reported this week that it has seen Russia’s digital meddling continue apace, both in Ukraine as the Kremlin’s invasion rages on and in Eastern Europe more broadly. TAG detected the Russia-linked hacking group Turla attempting to spread two different malicious Android apps through sites that masqueraded as being Ukrainian. The group tried to market the apps by claiming that downloading them would play a role in launching denial of service attacks on Russian websites, an interesting twist given the civilian efforts in Ukraine to mount cyberattacks against Russia. TAG also detected activity from other known Russian hacking groups that were exploiting vulnerabilities to target Ukrainian systems and launching disinformation campaigns in the region.

Ukrainian officials also said this week that Russia had conducted an attack on Ukraine’s TAVR Media, hacking nine popular radio stations to spread false information that Ukrainian President Volodymyr Zelensky was in intensive care because of a critical ailment. The broadcast further claimed that Ruslan Stefanchuk, chairperson of the Verkhovna Rada, was in command in Zelensky’s stead. TAVR put out a statement on Facebook saying that the broadcasts did “not correspond to reality.” And Zelensky posted a video on his Instagram attributing the attack to Russia and saying that he is in good health.

Source

Wired