Amid growing concerns over Big Tech firms aligning with Trump administration policies, people are starting to move their digital lives to services based overseas. Here's what you need to know.

Law enforcement requests for user data from Apple, Google, and Meta mean that these companies can decide whether government authorities have access to your personal information, including location data. This means the companies with the most insight into our lives, movements, and communications are frontline arbiters of our constitutional rights and the rights of non-US citizens—a fact some are likely feeling more acutely now than ever.

Collaboration between Big Tech and the Trump administration began before Donald Trump’s swearing-in on January 20. Amazon, Meta, Google, Microsoft, and Uber each gave $1 million to Trump’s inauguration. Separately, in personal donations, so did Meta CEO Mark Zuckerberg and Apple’s Tim Cook.

Americans concerned about the Trump administration and Silicon Valley’s embrace of it, may consider becoming a “digital expat”—moving your digital life off of US-based systems. Meanwhile, Europeans are starting to see US data services as “no longer safe” for businesses, governments, and societies.

Here’s a brief rundown of the privacy, security, and civil liberties issues related to the use of US-based digital services that suddenly feel more urgent—and what to do about it.

**Cozying Up**

In anticipation of Trump’s inauguration, Meta-owned Facebook, Instagram, and Threads made drastic policy changes citing alignment with Trump administration values, to permit hate speech and abuse “on topics like immigration and gender.” Meta also signaled its allegiance by ditching its fact-checkers—a frequent target of MAGA world ire. Two days after the inauguration, Meta quietly rolled out pro-life moderation actions through post suppression and account suspensions. Zuckerberg explained the company’s new direction to staff, saying: “We now have an opportunity to have a productive partnership with the United States government.”

Meta did not immediately respond to our request for comment regarding its partnership, data sharing, or policy changes.

Google followed suit. The company changed its Maps and Search results to rename part of the world—the Gulf of Mexico—following a Trump executive order renaming it the Gulf of America, despite the the US claiming control of less than 50 percent of the Gulf. Apple and Microsoft also followed Trump’s order.

Google’s consumer products also received a swath of updates in line with the new administration, including further changes to Maps, Calendar, and Search. Next, Google removed the new administration’s “banned” terms from its Google Health product. Then it did an about-face on its public promise not to build weaponized AI tools, such as Project Dragonfly, which was discovered in 2018 to be tailoring Google’s entire platform to enable China’s aggressive crackdown on its citizens. When reached for comment, Google did not immediately respond.

Big Tech aligning with the Trump administration matters because its business models rely on surveillance and amassing our personal data. Meta, Google, Apple and other large tech firms are among the gatekeepers standing between privacy and government requests for user data. Even when tech firms must comply by law, they’re often still free to decide how much information they collect about people and how long they store the data.

**Government Hand-Outs**

Current US laws around tech, privacy, and government requests have been guided by bulwarks like the Fourth and Fifth Amendments, US court rulings, and tech companies’ willingness to question the federal government’s opinion that it is entitled to access our personal information and location data. Apple, Google, and Meta each have language about law enforcement data requests that make it seem like they have our backs when it comes to overreach. Now, with companies shaping certain policies, tools, and practices in pursuit of “partnership” with the Trump administration, these companies’ powers over our data takes on new focus.

Generally, law enforcement can compel US companies to hand over user data using a subpoena, court order, search warrant—or, in rarer cases, a National Security Letter (NSL). As Google explains, an NSL is “one of the authorities granted under the Foreign Intelligence Surveillance Act (FISA).” Google adds, “FISA orders and authorizations can be used to compel electronic surveillance and the disclosure of stored data, including content from services like Gmail, Drive, and Photos.” How companies respond to these demands can vary in consequential ways.

A nearly decade-old battle over encrypted communication provides a clear example of the push and pull over user data between tech companies and federal law enforcement. In 2016, the FBI tried to compel Apple to backdoor an iPhone so law enforcement could access its encrypted contents. Apple refused to break its iOS security to do so. Then-candidate Trump said the company should be made to comply or be punished. “We should force them to do it,” he stated. Backdoors for law enforcement data access became a pet project in Trump’s first term; his DOJ appointee Rod Rosenstein launched a 2017 campaign to rebrand encrypted communications (and locked phones) as “law-free zones.” By 2019, Trump officials were brainstorming laws and bans against “unbreakable” consumer security measures, like end-to-end encryption.

The second Trump administration’s stance on encryption is less clear. Prior to Trump’s new term, in December 2024, FBI officials urged Americans to use encrypted messaging apps in the wake of cyberattacks on telecom companies attributed to the Salt Typhoon hacking campaign. (Since then, Trump’s team disbanded the DHS board investigating Salt Typhoon.) When reached for comment regarding the administration's current stance on companies using forms of encryption law enforcement can't break, a While House official told WIRED via email: “The White House looks forward to working with industry leaders to unlock the Golden Age of digital literacy.”

Apple did not immediately respond to WIRED”s request for comment.

Big Tech’s MAGA pivot is pointedly problematic for countries that rely on services like Meta platforms for government communications, official emergency response coordination, social tools like Marketplace, news, public health messaging, and small business services. Officials in one New Zealand district are exploring Facebook and Instagram exit strategies "until such time as we can be assured of the safety of our whole community and the integrity of democracy on these platforms."

It's a global concern. This week, an annual report on the global state of democracy, the Varieties of Democracy project (V-Dem), told reporters, "the United States will not score as a democracy when we release \[next year's\] data." V-Dem’s principal investigator, Staffan Lindberg, added: "If it continues like this, democracy \[in the US\] will not last another six months." With an expected downgrade to the status of electoral autocracy, the US will share its label with Turkey, Hungary, Iraq, India, and Russia.

This makes Big Tech's data collection, storage, control over, or any use of that data an even more urgent issue around the world. This is particularly true for countries the US government has in its sights for territorial expansion, extracting resources, or MAGA grievance politics.

Of course, saying, “just quit Facebook” is one thing—it’s not that simple. Ditching Messenger and WhatsApp for Signal is pretty straightforward, though. Trading X for Bluesky is easier. Keep in mind that both are currently based in the US and that these are merely _safer_ alternatives. In other words, editing your digital footprint is an act of risk and harm reduction, where you identify threats and take the appropriate steps for your situation to reduce potential harms to yourself and those you care about.

**Cutting Ties**

If you’re thinking it might be handy to know about secure non-US options for your digital footprint, good news: There are a variety of well-established services worth checking out—ones that are increasing in popularity as fears of a DOGE\-Facebook partnership seem less far-fetched by the day..

In the wake of deletions and alterations in the Trump administration’s war on science, accurate health information, inclusion, and equity, an archived copy of the CDC’s pre-Trump website is hosted in Europe due to concerns about US jurisdiction. Similarly, the Internet Archive has a full, live copy of itself preserved outside the US (Internet Archive Canada), also using decentralized Filecoin storage for the 2024/2025 EOT Web Archive “as an added layer of preservation.”

It’s no coincidence that a majority of jurisdictionally-aware US data preservation efforts are listing ProtonMail accounts as their contact info. Proton is a Swiss company offering services comparable to Gmail, Google Drive and Docs, as well as having an end-to-end encrypted platform, a password manager, backup storage, photos, and a VPN. Proton explains in a March 2023 blog post that Swiss law and encryption protects Proton’s users from abortion-related data requests, and details the difference between data requests they receive and those sent to Facebook and Google.

For people who prefer globally accurate maps free of Trump Sharpie defacements, and the Gulf of Mexico keeping its name, check out MagicEarth, TomTom AmiGO, HERE WeGo (all Netherlands-based) or OpenStreetMap (global contributors). Check out Vivaldi (Norway) for browsing, and Qwant (France) or Startpage (Netherlands) for a search engine. IONOS (Germany) is a Squarespace/Wix alternative, Pixelfed (Canada) can stand in for Instagram. StoryGraph (UK) for Goodreads. Affinity (UK/AU) or Canva (AU) can replace Adobe products, and Kobo (Canada/Japan) for an ebook reader.

Check out Plex or Jellyfin for music and video, Nextcloud for file storage and syncing, LibreOffice for an office suite, Affinity Suite to replace Adobe, SearXNG for search—all based outside the US. Codeberg (EU) is basically an open source, privacy-forward, community-run Github; one user has a handy Linux-Is-Best/Outside\_Us\_Jurisdiction listing for digital service providers. If you’re looking for a non-U.S. Starlink alternative, Eutelsat may have you covered.

To find other services that suit your needs, take a look through this sprawling, collectively curated Non-US Alternatives List of everything from email to antivirus programs, e-commerce and social media options, and more. European Alternatives also has a growing collection of categories listing services from web analytics and cloud platforms to password managers, web browsers, calendars, and even a few music streaming services.

Concerns prompting people to jettison US digital services isn’t new, but it’s only getting more popular as the lines between Trump’s White House and Big Tech grow less distinct by the day. There are over a quarter million members in the r/degoogle subreddit, where members share tips, tricks, and reviews on everything they’re using to replace Google products or ditch US products altogether.

“Cancelled all my US streamers and moved to a Crave/GEM combo,” one member explained. “Spent 2 weeks moving to Proton and deleted/cancelled everything US during that process. Bye PayPal, bye Amazon, goodbye American everything.”

How to Avoid US-Based Digital Services—and Why You Might Want To

Chinese ecommerce giants like Temu and AliExpress sell drone accessories like those used by soldiers in the Russia-Ukraine conflict.

Commercial quadcopters have been on the mainstream gadget scene for 15 years, proliferating across industries and among hobbyists. There's a swanky DJI store on New York City's Fifth Avenue, and you probably have a neighbor, not to mention a roofer, who owns a drone. So when researchers at the embedded-device security firm Red Balloon started seeing surprising quadcopter accessories on Chinese shopping platforms like Temu and AliExpress, they didn't think much of it at first. As with any popular gadget type, there's a whole ecosystem of niche, wacky, and comical add-ons available for drones. But the more Red Balloon CEO Ang Cui thought about it, the more unsettled he and his colleagues became about how cheap and easy it would be for anyone to buy seemingly disparate add-ons that could easily turn a mainstream quadcopter into a war machine.

The accessories the researchers found include AI drone guidance modules—essentially small mounted cameras that use object recognition to identify humans and road vehicles at long range—and miles-long fiber optic tethers. Like plugging an ethernet cable directly into your laptop, miles-long tethers allow drones to fly around a large area without being vulnerable to disruption by signal jammers. The researchers recognized them from battlefield footage and other reports that such tethers—not to mention AI guidance modules—are being used by both sides in the Russia\-Ukraine war to drop explosives or autopilot crash entire drones themselves into tracked objects without requiring operator control.

The fact that battlefield technology is widely available in the United States and around the world at low cost augurs a climate in which any actor—from criminal syndicates to paramilitary groups, from disgruntled employees to ostracized teens—can quickly and cheaply gather the needed equipment to remotely go on a destructive and violent rampage.

“The more we looked at this and started to see the big picture, the more my heart sank, because these are toys that are really amazing at killing people,” Cui tells WIRED. “This tech didn't exist in the commercial space two years ago, it wasn't in demand from hobbyists, but now manufacturers are making it for war and it's spilling over.”

The Red Balloon researchers found that long-range quadcopters are readily available on marketplaces like AliExpress for under $300, with many priced at around $200 each. And the unit price of a long-range drone can drop even lower when purchased in bulk. The researchers noticed sellers who were claiming that they ship 60,000 of the long-range drones per month. They purchased a 1-mile-long tether from a seller on AliExpress for about $260 and another that is 7.5 miles long for about $700. Meanwhile, the researchers also purchased an AI guidance module from a different AliExpress seller for $325. Cui and his colleagues also purchased cargo holders that strap to drones and can be used to transport beer cans or water bottles, but could also be loaded with mortar bombs. These were $106 each. In the two months since the researchers made the purchases, they say the prices of most of the products they bought have even dropped slightly.

“This equipment is mainstream, but it does not just cost a few dollars to make, so I think this stuff is being sold either at or below cost,” Cui says.

In December the Kyiv Post reported of the Ukrainian military's own long-range, tethered drones, that, “currently about 40 percent of the components \[are\] sourced locally in Ukraine while, because there is limited domestic microelectronics manufacturing capability, the rest are imported, primarily from China.”

AliExpress parent company Alibaba and Temu did not respond to requests for comment from WIRED about whether such accessories—which are not inherently weapons themselves—pose any risks or have purchasing restrictions imposed on them in any markets.

“I don't know a hobbyist that wants to fly a drone miles away with a tether to drop a water bottle in someone's yard,” says Dave Torres, Red Balloon's head of FPGA security. “I'm a combat veteran, so I'm used to dealing with IEDs and worrying about things that are buried in the ground. Well, now you have the capability to fly your IED over whoever you want to attack.”

Red Balloon specializes in embedded device hardware and firmware analysis, so the researchers were interested to evaluate the processors and low-level code powering the fiber optic tethers and AI guidance components. In the tethers, they were surprised to find years-old, but relatively pricey, reprogrammable chips known as “field programmable gate arrays” or FPGAs (Torres' area of expertise). Inclusion of these chips was notable, because it suggests that the devices are designed to be more dynamic and expandable than what a hobbyist would presumably need. Meanwhile, the guidance modules have largely reliable object recognition using all the cheapest components possible, including Chinese-made chips as their main processor.

“When I first saw the AI guidance components, one was advertising that it could identify a bird at 30 meters away and a horse at a hundred meters away—but later they actually just changed that to identifying people and cars,” says Cui. "It's not specific people or specific models of vehicles, but they're not even dancing around it anymore that those are the categories of targets this would be used for.”

Counter-drone defense tech is still, relatively, in its infancy around the world. Even vague sightings of unidentified aerial phenomena can throw airports, or the state of New Jersey, into chaos. As WIRED reported in December, the US Department of Homeland Security has been encouraging state and local law enforcement since at least last summer to assess their ability to respond to weaponized drones. In a memo, DHS warned that violent extremists in the US have been looking to modify “off-the-shelf” quadcopters to carry weapons, including "explosives, conductive materials, and chemicals."

Red Balloon is based in New York City, and the researchers note that as they were investigating drone accessories they began to realize that the few options currently available for stymying malicious drones can't be used in dense urban areas.

“The things that work at taking them down are machine guns, lasers, and massive jammers—none of which can be used in a city,” Cui says. “This is why Red Balloon has been focusing on developing techniques appropriate for high-density environments to track and safely defeat these drones without shooting at them or without jamming.”

Such approaches could involve targeting drones at the protocol and firmware level to commandeer them and cause them to land. The researchers point out that the drones' ultra-low-cost development and manufacturing leaves no margin for research and development, testing, or onboard security protections. This represents a vulnerability for operators but could also be a benefit for defenders seeking to diffuse violent attacks without collateral damage.

For now, though, the proliferation of accessories to weaponize mainstream drones is a looming threat with no easy resolution.

“Somebody who designs a plan and puts it into action could do some sophisticated damage for really, really cheap,” Red Ballon's Torres says. "I wonder if the US military can even get defense contractors to build these devices for them for the price they're selling online.”

Low-Cost Drone Add-Ons From China Let Anyone With a Credit Card Turn Toys Into Weapons of War

Plus: A nominee to lead CISA emerges, Elon Musk visits the NSA, a renowned crypto cracking firm’s secret (and problematic) cofounder is revealed, and more.

Knifings, firebombings, shootings, and murder-for-hire plots—all linked to a splinter group of the 764 crime network called “No Lives Matter.” According to its own manifesto, the group seeks to “purify mankind through endless attacks” and has released at least two “kill guides” tied to violent plots in the US and Europe. Intelligence documents reviewed by WIRED reveal growing concern among analysts, but experts remain unsure how to stop the group’s spread.

On Monday, X experienced intermittent outages after a botnet flooded the social network with junk traffic in an attempt to take down its system. Elon Musk stated that the distributed denial-of-service attack originated from Ukrainian IP addresses, implying that the country—already under siege by a Russian invasion and frequently mocked by the centibillionaire—may have been responsible. Security experts tell WIRED that this is not how DDoS attacks work.

Meanwhile, inside the Cybersecurity and Infrastructure Security Agency, mass layoffs are hurting US cyberdefense, weakening protections against foreign adversaries. Vital staff cuts have left employees overworked and strained international partnerships, according to interviews with staff at the agency that helps safeguard cities, businesses, and nonprofits from cyberattacks. “A lot of people are scared,” says one employee. “We’re waiting for that other shoe to drop. We don't know what's coming.” As WIRED takes you inside the agencies at the center of the uncertainty and chaos of the second Trump administration, we've updated our quick and easy guide to using Signal to help you get the most out of the messaging app’s end-to-end encryption.

That’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click on the headlines to read the full stories. And stay safe out there.

Those “green bubbles,” the cross-platform text messages that annoy iPhone owners and keep Android users relegated to a group-chat underclass, aren’t just a cultural disconnect. They’re also a security issue: Text messages sent between Android and iOS devices—unlike blue-bubble iMessage texts or Android-to-Android messages—aren’t end-to-end encrypted, leaving them open to surveillance or interception. Now, that may finally be changing.

The GSM Association, responsible for many widely used telecom standards, this week announced that its Rich Communication Services (or RCS) protocol will now support end-to-end encryption for cross-platform texting, and Apple revealed that it will now integrate that feature of RCS into its iOS devices. Until now, Apple and Google had both supported RCS’s other features in texts sent between iOS and Android, but not end-to-end encryption, which ensures that only the devices sending and receiving messages can decrypt them and not any server or snoop that sees them in transit.

Neither Apple nor the GSMA has said exactly when the new privacy features are launching. Until then, anyone sending cross-platform messages would be wise to stick with apps like WhatsApp or Signal that have long provided end-to-end encryption—and have also helped Android and iPhone users avoid personal disputes over bubble colors.

**Sean Plankey Nominated as Head of CISA, America’s Top Cybersecurity Agency**

The White House has tapped Sean Plankey to run CISA, the agency within the Department of Homeland Security primarily responsible for American digital defense. Plankey, long considered the leading contender for the role, served in multiple cybersecurity positions in the first Trump administration and previously held senior roles in US Cyber Command. In that DOD agency focused on cyber offense, he served as a weapons and tactics branch chief and earned a Bronze Star for hacking operations in Afghanistan. CISA, like many federal agencies, has faced hundreds of personnel cuts in recent weeks, and its previous director, Chris Krebs, came under harsh criticism under the previous Trump administration for the agency’s work to counter disinformation and secure elections. Krebs was fired in a Trump tweet near the end of his term after CISA described the 2020 election, whose results Trump baselessly contested, as the “most secure in American history.”

**Elon Musk Visits the National Security Agency**

Not even the National Security Agency has been spared from Elon Musk’s scorched-earth campaign to gut the federal government. On Wednesday, The Wall Street Journal reported that Musk had visited the intelligence agency in Fort Meade, meeting with leadership to discuss staff reductions and operational changes, according to current and former US officials who spoke to the Journal.

Despite being one of the most insulated branches of US intelligence, the NSA has still found itself pulled into Musk’s orbit. The visit to Fort Meade is another sign of the sweeping nature of his influence and the extraordinary access the world’s richest man has been granted over even the most secretive federal operations.

Last month, staff at the intelligence agency received emails offering deferred resignations, signaling impending changes. Then, a week ahead of his visit, Musk publicly called for an overhaul of the intelligence and cybersecurity agency. Posting to his social media site X, Musk wrote, “The NSA needs an overhaul,” alongside an apparent agency recruitment graphic featuring a group of college-aged people of color and a list of universities where the NSA was conducting outreach—seemingly mocking the agency’s recruitment efforts.

**A Buzzy Crypto Cracking Firm Had a Hidden CoFounder Accused of Sexual Assault**

The cryptocurrency recovery firm Unciphered has made headlines with its feats of whitehat wallet cracking on behalf of customers who have lost access to their cryptocurrency fortunes. In the fall of 2023, for instance, the company cracked a model of encrypted IronKey USB drive believed to hold 7,000-plus bitcoins now worth well over half a billion dollars. Now, The Washington Post reports that one of the cofounders of that company was Morgan Marquis-Boire, a once-lauded hacker and security researcher for Google and Citizen Lab who was later accused of sexually assaulting multiple women. The reported involvement of Marquis-Boire, who has largely disappeared from the cybersecurity world after facing the sex crime accusations in 2017, was kept secret from even many of the startup’s staff, and the revelations of his role have left the company in “disarray,” according to the Post.

**A Reporter Behind an Indian Hacker-for-Hire Story Is Fighting to Regain His Citizenship**

In November of 2023, Raphael Satter was one of a team of Reuters reporters who published an in-depth feature on Appin Technology, a startup that allegedly hacked numerous celebrity and civil society targets on behalf of clients. A group with a similar name responded by suing, and obtained a court ruling that for a time successfully censored Reuters’ story—a remarkable case of an Indian judge restricting free speech internationally. Satter is now fighting a different battle following publication of that story. In late 2023, his Overseas Citizen of India (OCI) card—a kind of international citizenship extended to foreign citizens of Indian origin and those married to Indians—was revoked around the same time as the judge filed the injunction. A letter sent to Satter in December of that year accused him of “maliciously creating adverse and biased opinion against Indian institutions in the international arena.” Satter is now petitioning a Delhi court to reverse that revocation, which has prevented him from entering India to visit family there.

End-to-End Encrypted Texts Between Android and iPhone Are Coming

The UK, France, Sweden, and EU have made fresh attacks on end-to-end encryption. Some of the attacks are more “crude” than those in recent years, experts say.

Over the past decade, encrypted communication has become the norm for billions of people. Every day, Signal, iMessage, and WhatsApp keep billions of messages, photos, videos, and calls private by using end-to-end encryption by default—while Zoom, Discord, and various other services all have options to enable the protection. But despite the technology’s mainstream rise, long-standing threats to weaken encryption keep piling up.

Over the past few months, there has been a surge in government and law enforcement efforts that would effectively undermine encryption, privacy advocates and experts say, with some of the emerging threats being the most “blunt” and aggressive of those in recent memory. Officials in the UK, France, and Sweden have all made moves since the start of 2025 that could undermine or eliminate the protections of end-to-end encryption, adding to a multiyear European Union plan to scan private chats and Indian efforts that could damage encryption.

These latest assaults on encryption come as intelligence agencies and law enforcement officials in the United States have recently backtracked on years of anti-encryption attitudes and now recommend that people use encrypted communication platforms whenever they can. The drastic shift in attitude followed the China-backed Salt Typhoon hacker group’s widespread breach of major US telecoms, and it comes as the second Trump administration ramps up potential surveillance of millions of undocumented migrants living in the US. Simultaneously, the administration has been straining longtime, crucial international intelligence-sharing agreements and partnerships.

“The trend is bleak,” says Carmela Troncoso, a longtime privacy and cryptography researcher and the scientific director at the Max-Planck Institute for Security and Privacy in Germany. “We see these new policies coming up as mushrooms trying to undermine encryption.”

End-to-end encryption is designed so only the sender and receiver of messages have access to their contents—governments, tech companies, and telecom providers can’t snoop on what people are saying. Those privacy and security guarantees have made encryption a target for law enforcement and governments for decades, because officials claim that the protection makes it prohibitively difficult to investigate urgent threats such as child sexual abuse material and terrorism.

As a result, governments around the world have frequently proposed technical mechanisms to bypass encryption and allow access to messages for investigations. Cryptographers and technologists have repeatedly and definitively warned, though, that any backdoor created to access end-to-end encrypted communications could be exploited by hackers or authoritarian governments, compromising everyone’s safety. Additionally, it is likely that criminals would find ways to continue to use self-made encryption tools to conceal their messages, meaning that backdoors in mainstream products would succeed at undermining protections for the public without eliminating its use by bad actors.

Broadly, the recent threats to encryption have come in three forms, says Namrata Maheshwari, the encryption policy lead at international nonprofit Access Now. First, there are those where governments or law enforcement agencies are asking for backdoors to be built into encrypted platforms to gain “lawful access” to content. At the end of February, for example, Apple pulled its encrypted iCloud backup system, called Advanced Data Protection, from use in the UK after the country’s lawmakers reportedly hit the Cupertino company with a secret order demanding Apple provide access to encrypted files. To do so, Apple would have had to create a backdoor. The order, which has been criticized by the Trump administration, is set to be challenged in a secret court hearing on March 14.

Meanwhile, lawmakers in Sweden are also considering legislation that would require encrypted messaging companies, such as Signal and WhatsApp, to keep copies of messages that people send on their platforms so they could allow law enforcement to access suspects’ histories. Signal has said it would pull out of Sweden if the potential law goes ahead. While in France earlier this year, a proposed amendment to a drug trafficking law outlined plans to require encrypted messaging services to hand over decrypted chat messages within 72 hours of a request or face fines of up to 2 percent of annual global revenue. This week, the proposal was reportedly scrapped, while some politicians said they supported the idea.

“We’re seeing some democracies revert back to very crude approaches to circumventing encryption that we maybe thought were something of the past,” Callum Voge, the director of governmental affairs and advocacy at nonprofit Internet Society, says of efforts that could require a backdoor to be created.

In January, the head of EU law enforcement agency Europol told the Financial Times that tech companies have a “social responsibility” to provide access to encrypted messages. “Anonymity is not a fundamental right,” Catherine De Bolle told the publication. The comments expanded upon a previous statement from European police chiefs saying “we do not accept that there need be a binary choice between cybersecurity or privacy on the one hand and public safety on the other.”

The second threat, Maheshwari says, relates to an increase in proposals related to a technology known as “client-side scanning.” The process, which is sometimes called “on-device scanning,” involves scanning messages locally on a person’s device before they are encrypted, and comparing them against a database of prohibited content that is held elsewhere. Client-side scanning is an effort to contort encryption backdoors into something more palatable to privacy proponents by keeping people’s personal data on their own devices.

Ultimately, though, cryptographers and digital rights advocates have repeatedly warned that client-side scanning does not sidestep the fundamental dangers posed by creating a way for a third party to access encrypted data. The Internet Society’s Voge describes such efforts as a more “sophisticated” way that democracies have been trying to circumvent encryption in recent years.

For instance, politicians in the EU have been fiercely debating plans to scan billions of messages for potential child sexual abuse material using client-side scanning for more than three years. The unresolved debates have proved highly controversial, with multiple countries pushing to weaken encryption. “Scanning for one type of content, for instance, opens the door for bulk surveillance and could create a desire to search other encrypted messaging systems across content types,” Apple officials said in a letter first reported by WIRED in August 2023, after the company ditched its own, separate plans to introduce a form of client-side scanning on iPhones.

“It’s very divided in Europe, \[there are\] countries strongly in favor of scanning and countries strongly against it as well,” Voge says of the EU’s long-running chat monitoring plans. In May 2023, WIRED obtained leaked documents that stated many European countries’ positions on encryption. At the time, Spanish officials said they would like to prevent end-to-end encryption entirely in the EU, while many others were in favor of scanning people’s messages. Other countries, such as Germany, were against weakening encryption. Dutch political documentation says the country’s intelligence agency, AIVD, considers client-side scanning to be “too great a security risk for the digital resilience of the Netherlands.”

Finally, Maheshwari says, there is always the looming threat of potential bans or blocks for encrypted services. Toward the end of 2024, Russian officials blocked access to Signal amid the country’s ongoing full-scale war against Ukraine and widescale efforts to censor and control information environments. India has an ongoing lawsuit against WhatsApp, which could threaten its ability to operate in the country or necessitate that the platform retreat from end-to-end encryption in that market. Maheshwari also points out that while all virtual private networks do not specifically use end-to-end encryption, India has already banned multiple VPN services.

While each potential proposal that could undermine encryption is slightly different, the Internet Society’s Voge says that they’ve been met with some “stronger” pro-encryption voices coming from government or law enforcement services around the world, particularly when it comes to protecting national security.

In December, two officials from the US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI, encouraged more people to use encrypted communications systems after China’s Salt Typhoon hackers gained deep access to US telecoms providers, exposing unencrypted calls and texts. “Encryption is your friend, whether it’s on text messaging or if you have the capacity to use encrypted voice communication,” one of the officials said.

Voge points out that as well as CISA and the FBI’s calls to use encrypted messaging, the Swedish armed forces has specifically cleared Signal for use with unclassified material, saying it can stop messages and calls from being intercepted by third parties.

Ahead of the UK’s March 14 legal hearing about the backdoor order reportedly made to Apple, US senators and privacy groups urged there to be more transparency about the demands and the risks to global encryption it presents. A bipartisan group of five members of Congress said the “cloak of secrecy” should be removed.

UK civil liberties groups Privacy International and Liberty also filed legal challenges over the secrecy of the proceedings. “While the UK Government seems to have come for Apple today, tomorrow it may be any other big tech companies, such as Google and Microsoft, and the day after it could be Signal, your VPN Provider, Proton and others,” Privacy International said in a statement.

Ultimately, Access Now’s Maheshwari says, efforts to defend encryption will almost certainly continue, as they have for decades, to protect people’s human rights.

“Encryption right now is exceptionally important because it's a crucial enabler of the full spectrum of human rights,” Maheshwari says. “It’s not just privacy. It is what enables you to speak freely, to exercise your freedom of expression, to organize, to assemble, to associate.”

A New Era of Attacks on Encryption Is Starting to Heat Up

Employees at the Cybersecurity and Infrastructure Security Agency tell WIRED they’re struggling to protect the US while the administration dismisses their colleagues and poisons their partnerships.

Mass layoffs and weak leadership are taking a severe toll on the US government’s cyber defense agency, undermining its ability to protect America from foreign adversaries bent on crippling infrastructure and ransomware gangs that are bleeding small businesses dry.

Inside the Cybersecurity and Infrastructure Security Agency, vital support staff are gone, international partnerships have been strained, and workers are afraid to discuss threats to democracy that they’re now prohibited from countering. Employees are even more overworked than usual, and new assignments from the administration are interfering with important tasks. Meanwhile, CISA’s temporary leader is doing everything she can to appease President Donald Trump, infuriating employees who say she’s out of touch and refusing to protect them.

“You've got a lot of people who … are looking over their shoulder as opposed to looking at the enemy right now,” says one CISA employee.

As the Trump administration’s war on the federal bureaucracy throws key agencies into chaos, CISA’s turmoil could have underappreciated consequences for national security and economic prospects. The agency, part of the Department of Homeland Security, has steadily built a reputation as a nonpartisan source of funding, guidance, and even direct defensive support for cities, businesses, and nonprofits reeling from cyberattacks. That mission is now under threat, according to interviews with seven CISA employees and another person familiar with the matter, all of whom requested anonymity to avoid reprisals.

“Our enemies are not slowing their continuous assaults on our systems,” says Suzanne Spaulding, who led CISA’s predecessor during the Obama administration. “We need all hands on deck and focused, not traumatized and distracted.”

**Talent Exodus**

CISA’s mission has grown significantly since its creation in 2018. Established mainly to defend government networks, the agency increasingly embraced new roles supporting private companies and state governments, advocating for secure software, and cooperating with foreign partners. This helped CISA raise its profile and gain credibility. But now, following several rounds of layoffs and new restrictions from the Trump administration, the agency is struggling to sustain its momentum.

The extent of the cuts at CISA is still unclear—employees are only learning about the loss of colleagues through word of mouth—but multiple employees estimate that, between the layoffs and the Office of Personnel Management’s deferred-resignation program, CISA has lost between 300 and 400 staffers—roughly 10 percent of its 3,200-person workforce. Many of those people were hired through DHS’s Cybersecurity Talent Management System (CTMS), a program designed to recruit experts by competing with private-sector salaries. As a result, they were classified as probationary employees for three years, making them vulnerable to layoffs. These layoffs at CISA also hit longtime government workers who had become probationary by transferring into CTMS roles.

Key employees who have left include Kelly Shaw, who oversaw one of CISA’s marquee programs, a voluntary threat-detection service for critical infrastructure operators; David Carroll, who led the Mission Engineering Division, the agency’s technological backbone; and Carroll’s technical director, Duncan McCaskill. “We've had a very large brain drain,” an employee says.

The departures have strained a workforce that was already stretched thin. “We were running into \[a\] critical skills shortage previously,” says a second employee. “Most people are and have been doing the work of two or more full-time \[staffers\].”

The CISA team that helps critical infrastructure operators respond to hacks has been understaffed for years. The agency added support positions for that team after a Government Accountability Office audit, but “most of those people got terminated,” a third employee says.

CISA’s flagship programs have been mostly unscathed so far. That includes the threat-hunting branch, which analyzes threats, searches government networks for intruders, and responds to breaches. But some of the laid-off staffers provided crucial “backend” support for threat hunters and other analysts. “There's enhancements that could be made to the tools that they're using,” the first employee says. But with fewer people developing those improvements, “we're going to start having antiquated systems.”

In a statement, DHS spokesperson Tricia McLaughlin says CISA remains “committed to the safety and security of the nation’s critical infrastructure” and touted “the critical skills that CISA experts bring to the fight every day.”

National Security Council spokesperson James Hewitt says the reporting in this story is “nonsense,” adding that “there have been no widespread layoffs at CISA and its mission remains fully intact.”

“We continue to strengthen cybersecurity partnerships, advance AI and open-source security, and protect election integrity,” Hewitt says. “Under President Trump’s leadership, our administration will make significant strides in enhancing national cybersecurity.”

**Partnership Problems**

CISA’s external partnerships—the cornerstone of its effort to understand and counter evolving threats—have been especially hard-hit.

International travel has been frozen, two employees say, with trips—and even online communications with foreign partners—requiring high-level approvals. That has hampered CISA’s collaboration with other cyber agencies, including those of “Five Eyes” allies Canada, Australia, New Zealand, and the UK, staffers say.

CISA employees can’t even communicate with people at other federal agencies the way they used to. Previously routine conversations between CISA staffers and high-level officials elsewhere now need special permissions, slowing down important work. “I can’t reach out to a CISO about an emergency situation without approval,” a fourth employee says.

Meanwhile, companies have expressed fears about sharing information with CISA and even using the agency’s free attack-monitoring services due to DOGE’s ransacking of agency computers, according to two employees. “There is advanced concern about all of our services that collect sensitive data,” the third employee says. “Partners \[are\] asking questions about what DOGE can get access to and expressing concern that their sensitive information is in their hands.”

“The wrecking of preestablished relationships will be something that will have long-lasting effects,” the fourth employee says.

CISA’s Joint Cyber Defense Collaborative, a high-profile hub of government-industry cooperation, is also struggling. The JCDC currently works with more than 300 private companies to exchange threat information, draft defensive playbooks, discuss geopolitical challenges, and publish advisories. The unit wants to add hundreds more partners, but it has “had difficulty scaling this,” the first employee says, and recent layoffs have only made things worse. Contractors might be able to help, but the JCDC’s “vendor support contracts run out in less than a year,” the employee says, and as processes across the government have been frozen or paused in recent weeks, CISA doesn’t know if it can pursue new agreements. The JCDC doesn't have enough federal workers to pick up the slack, the fourth CISA employee says.

With fewer staffers to manage its relationships, the JCDC confronts a perilous question: How should it focus its resources without jeopardizing important visibility into the threat landscape? Emphasizing ties with major companies might be more economical, but that would risk overlooking mid-sized firms whose technology is quietly essential to vital US industries.

“CISA continuously evaluates how it works with partners,” McLaughlin says, “and has taken decisive action to maximize impact while being good stewards of taxpayer dollars and aligning with Administration priorities and our authorities.”

**Gutting Security Advocacy**

Other parts of CISA’s mission have also begun to atrophy.

During the Biden administration, CISA vowed to help the tech industry understand and mitigate the risks of open-source software, which is often poorly maintained and has repeatedly been exploited by hackers. But since Trump took office, CISA has lost the three technical luminaries who oversaw that work: Jack Cable, Aeva Black, and Tim Pepper. Open-source security remains a major challenge, but CISA’s efforts to address that challenge are now rudderless.

The new administration has also frozen CISA’s work on artificial intelligence. The agency had been researching ways to use AI for vulnerability detection and networking monitoring, as well as partnering with the private sector to study AI risks. “About 50 percent of \[CISA’s\] AI expert headcount has been let go,” says a person familiar with the matter, which is “severely limiting” CISA’s ability to help the US Artificial Intelligence Safety Institute test AI models before deployment.

The administration also pushed out CISA’s chief AI officer, Lisa Einstein, and closed down her office, the person familiar with the matter says. Einstein’s team oversaw CISA’s use of AI and worked with private companies and foreign governments on AI security.

A large team of DHS and CISA AI staffers was set to accompany Vice President JD Vance to Paris in February for an AI summit, but those experts “were all pulled back” from attending, according to a person familiar with the matter.

**‘Nefarious’ Retribution**

CISA staffers are still reeling from the agency’s suspension of its election security program and the layoffs of most people who worked on that mission. The election security initiative, through which CISA provided free services and guidance to state and local officials and worked with tech companies to track online misinformation, became a target of right-wing conspiracy theories in 2020, which marked it for death after Trump’s return to the White House.

The program—on hold pending CISA’s review of a recently completed internal assessment—was a tiny part of CISA’s budget and operations, but the campaign against it has alarmed agency employees. “This is definitely in the freak-out zone,” says the first employee, who adds that CISA staffers across the political spectrum support the agency’s efforts to track online misinformation campaigns. “All of us recognize that this is a common deception tactic of the enemy.”

The election security purge rippled across the agency, because some of the laid-off staffers had moved from elections to other assignments or were simultaneously working on both missions. Geoff Hale, who led the elections team between 2018 and 2024, was serving as the chief of partnerships at the JCDC when he was placed on administrative leave, setting off a scramble to replace him.

The removal of Hale and his colleagues “was the start to a decline in morale” at CISA, according to the second employee. Now, staffers are afraid to discuss certain topics in public forums: “No one's going to talk about election security right now,” the first employee says.

“The fact that there’s retribution from the president … is kind of frightening,” this employee adds. “A very nefarious place to be.”

**Abandoned and Demoralized**

The layoffs, operational changes, and other disruptions at CISA have severely depleted morale and undermined the agency’s effectiveness. “Even simple tasks feel hard to accomplish because you don't know if your teammates won't be here tomorrow,” says the fourth employee.

The biggest source of stress and frustration is acting CISA director Bridget Bean, a former Trump appointee who, employees say, appears eager to please the president even if it means not defending her agency. Bean “just takes whatever comes down and implements \[it\] without thought of how it will affect \[CISA’s\] mission,” the fifth employee says. Employees describe her as a poor leader and ineffective communicator who has zealously enacted Trump’s agenda. In town-hall meetings with employees, Bean has said CISA must carefully review its its authorities and urged staffers to “assume noble intent” when dealing with Trump officials. While discussing Elon Musk’s mass-buyout program, she allegedly said, “I like to say ‘Fork in the Road’ because it's kind of fun,.” according to the fourth employee. She was so eager to comply with Musk’s “What did you do last week?” email that she instructed staffers to respond to it before DHS had finalized its department-wide approach. DHS later told staff not to respond, and Bean had to walk back her directive.

“Bean feels like she's against the workforce just to please the current administration,” the second employee says. The fourth employee describes her as “not authentic, tone-deaf, spineless, \[and\] devoid of leadership.”

McLaughlin, the DHS spokesperson, says CISA “is not interested in ad hominem attacks against its leadership,” which she says “has doubled down on openness and transparency with the workforce.”

The return-to-office mandate has also caused problems. With all employees on-site, there isn’t enough room in CISA’s offices for the contractors who support the agency’s staff. That has made it “very difficult” to collaborate on projects and hold technical discussions, according to the first employee. “There wasn’t much thought about \[RTO’s\] impact to operations,” says the fourth employee. According to a fifth employee, “executing some of our sensitive operations is now harder.” (“CISA has worked tirelessly to make the return to office as smooth as possible from space to technology,” McLaughlin says.)

Employees are dealing with other stressors, too. They have no idea who’s reading their Musk-mandated performance reports, how they’re being evaluated, or whether AI is analyzing them for future layoffs. And there’s a lot of new paperwork. “The amount of extra shit we have to do to comply with the ‘efficiency measures’ … \[takes\] a lot of time away from doing our job,” says the fifth employee.

**Bracing for More**

When Trump signed the bill creating CISA in November 2018, he said the agency’s workforce would be “on the front lines of our cyber defense” and “make us, I think, much more effective.” Six and a half years later, many CISA employees see Trump as the biggest thing holding them back.

“This administration has declared psychological warfare on this workforce,” the fourth employee says.

With CISA drawing up plans for even larger cuts, staffers know the chaos is far from over.

“A lot of people are scared,” says the first employee. “We’re waiting for that other shoe to drop. We don't know what's coming.”

Entire wings of CISA—like National Risk Management Center and the Stakeholder Engagement Division—could be on the chopping block. Even in offices that survive, some of the government’s most talented cyber experts—people who chose public service over huge sums of money and craved the lifestyle of CISA’s now-eliminated remote-work environment—are starting to see their employment calculus differently. Some of them will likely leave for stabler jobs, further jeopardizing CISA’s mission. “What is the organization going to be capable of doing in the future?” the first employee asks.

If Trump’s confrontational foreign-policy strategy escalates tensions with Russia, China, Iran, or North Korea, it’s likely those nations could step up their use of cyberattacks to exact revenge. In that environment, warns Nitin Natarajan, CISA’s deputy director during the Biden administration, weakening the agency could prove very dangerous.

“Cuts to CISA’s cyber mission,” Natarajan says, “will only negatively impact our ability to not only protect federal government networks, but those around the nation that Americans depend on every day.”

‘People Are Scared’: Inside CISA as It Reels From Trump’s Purge

“No Lives Matter” has emerged in recent months as a particularly violent splinter group within the extremist crime network known as Com and 764, and experts are at a loss for how to stop its spread.

The kids are all grown up. In the face of international law enforcement pressure, dozens of prosecutions, and worldwide disrepute, the network of young sadists, misanthropes, child predators, and extortionists known as Com and 764 has not shrunk away into obscurity.

Rather, its members have progressed from online extortion and crimes related to child sexual abuse material, to real-world violence, a trajectory that alarms extremism researchers and government officials alike. Knifings, killings, firebombings, drive-by shootings, school shootings, and murder-for-hire plots in North America and Europe have all been connected to a splinter group called “No Lives Matter” that, per the group’s own manifesto, “idolizes death” and “seeks the purification of all mankind through endless attacks.” The group has released at least two “kill guides” that have been connected to violent attacks and plots in Europe and the United States.

The US Department of Justice classifies Com and 764 as a “Tier One” terrorism threat, the highest priority afforded to an extremist group, ideology, or tendency in American law enforcement’s internal rubric. Intelligence documents reviewed by WIRED show a stream of concern from analysts about the group’s harm to juvenile exploitation victims and the growing exhortations to physical violence that embody the No Lives Matter ethos.

However, the phenomenon has proved incredibly hard to combat due to a lack of coherent structure or ideology. Along with the insidious neo-Nazi propaganda group the Terrorgram Collective, over the past four years, Com/764 has morphed into a twisted amalgam of the Columbine Effect and older domestic terror groups like the Atomwaffen Division: Young extortionists and assailants egg each other on to progressively more lurid and debased acts of violence for the sake of internet notoriety and status.

In response, Western governments have employed terrorism charges against young people accused of conspiring to kill homeless people or phoning in bomb threats to schools and religious institutions beyond their own borders. In the United Kingdom, the Crown Prosecution Service recently secured a six-year prison term for 19-year-old Cameron Finnegan, who went by the handle “Acid,” for a raft of 764-related offenses, including possessing CSAM, urging young people to kill themselves, and possessing a “kill manual” authored by No Lives Matter adherents, replete with viable instructions for carrying out lethal attacks with knives, firearms, and vehicles.

"We want to make the public aware of \[Com/764\]," Detective Chief Superintendent Claire Finlay, the head of Counter Terrorism Policing Southeast, told the BBC following Finnegan’s guilty plea in January. "The threat that they pose, not just within the United Kingdom but globally, is immense."

According to senior DOJ officials who were granted anonymity to speak about internal law enforcement matters, the feds have come across related cases in every field office in the US. US authorities are so hell-bent on pursuing this trend that they are trying to extradite a 17-year-old Romanian boy who prosecutors at the Southern District of New York claim took part in exploiting minors and soliciting and distributing CSAM. The teenager also faces US terrorism charges for allegedly phoning in several hundred bomb threats to dozens of schools and institutions in the US as part of 764 and its splinter groups, according to information obtained by this reporter.

"We’ve seen a lot of hybrid movements and ideologies, new trends that we can’t categorize under the traditional categories,” says Bàrbara Molas, a senior analyst at RAND Europe who specializes in far-right extremism and who testified as an expert witness for the prosecution in Finnegan’s recent Com/764-related case.

For Molas, Com/764 represents that type of hybridity, where participants in the network will pick and choose elements from a series of discrete ideologies—neo-Nazism; the satanist group Order of Nine Angles, which has become prevalent throughout the most transgressive spheres of the transnational far right; Ted-Kaczynski-inspired neo-Luddism—and assemble their own belief pantheon.

“When 764 was only about CSAM, their targets tended to be women—but specifically women from diminished social groups, who were seen as the weak party of society,” Molas says. “That ideal of imposing violence on this part of society has carried on and become more violent.” When members of the network commit violence in the name of the group, Molas says, it “helps them rise within the group and advance the larger cause, which is to change society through violence and chaos.”

The lodestar for this transition towards wanton violence is a German teenager named Nino Luciano, who went by the handle “Tobbz” within 764. Sent to live in a foster home in Romania because his mental illnesses overwhelmed the capacity of institutions in his home country, Tobbz was drawn into 764 during the Covid-19 pandemic and quickly became enthralled with the group, daubing its name on a wall in his room and tattooing himself with “764” and a septagram from the Order of Nine Angles. In March 2022, he committed and livestreamed a series of knife attacks, stabbing an elderly woman to death and severely wounding an old man. He was convicted in August 2023 and is serving 14 years in prison.

Tobbz’s behavior inspired other young extremists in the Com/764 network, who have since either tried to emulate his livestreamed attacks or commit similar acts of violence to boost their notoriety and status within their extremist peer group. No Lives Matter’s exhortations to commit mass casualty events and distribution of detailed guides to violence are patterned off Tobbz’s example, according to experts who’ve studied the network.

Baron Martin, a resident of Tucson, Arizona, was charged in federal court with cyberstalking and sexual exploitation of a child that included the production of CSAM. According to court records, the government also accused Martin of soliciting the murder of the grandmother of one of his victims under the handle “Convict.” He allegedly sent the following message to a Discord server, court records show: “know anyone in \[state\] thats willing to do kidnappings or shootings...i need someone to tobbz a grandma. Somebody wanted to dox one of my egirls. now I’m getting their grandma merked.” The use of “Tobbz” as a synonym for murder was not casual: Martin allegedly offered to pay another user to carry out the hit, which was never realized.

According to court documents, Martin, through his handle, was connected to authoring a detailed guide widely distributed in 764’s channels on how to groom victims for extortion, which the FBI claims Martin bragged online was “the catalyst for thousands of extortions.” (Martin has pleaded not guilty.)

Molas, of RAND Europe, says Martin’s alleged path from extortion to soliciting a homicide traces a familiar path of transgressive behavior often seen in Com/764’s online world. “They’ll start with little acts of sin—shoplifting, then robberies, abuse of minors, weapons violations, then all the way up to kidnapping and murder,” Molas says.

In mid-February, Jairo Tinajero, a 25-year-old Arkansas man who took part in the 764 splinter group 8884, pleaded guilty to CSAM and conspiracy charges for extorting an underage girl in Louisville, Kentucky. According to his plea agreement, Tinajero confessed to plotting to kill the girl once she stopped complying with him, posting her address and personal information about her and her family family in 764’s servers, unsuccessfully trying to buy an assault rifle, and talking through a murder plot with other 764 members.

Tinajero also admitted taking part in 764 online chats where prior mass casualty attacks were discussed along with “future attacks on heavily populated areas such as malls or other large gatherings, LGBTQ+ events and gatherings, schools, public places, government buildings and police stations” with the intent to “destabilize society and cause the collapse of governments and rule of law.”

Most recently, neo-Nazi Aidan Harding’s inspiration from 764 was brought up during a mid-February federal court hearing for CSAM possession charges. In addition to participating in public actions with a number of Pittsburgh-area extremist groups, prosecutors claimed that Harding and another man were deeply interested in the Columbine massacre, visiting the memorial in Littleton, Colorado, and posing for a photo in front of a swastika flag while dressed as Dylan Klebold and Eric Harris. “Eric and Dylan were kickstarting a revolution,” Harding wrote in a message, which prosecutors showed in court. Harding and the other man, who hasn’t been charged, also discussed carrying out mass shootings through Instagram direct messages, which were presented in court. “The only thing holding me back is a partner … I don’t want to do it alone or die alone,” Harding wrote.

According to two researchers who attended Harding’s three-and-a-half-hour court appearance related to probable cause on February 12, an FBI agent claimed during questioning that investigators found reams of videos depicting children being raped, ultraviolent videos of executions, and the extremist mass shootings in Buffalo, Nashville, and Columbine, along with a photo on Harding’s phone of a phrase daubed in blood: “I sold my soul to 764,” above a swastika and a Lviathan cross often used by 764. Another photo, handed up to the judge and not shown in court, depicted the naked chest of a young girl wearing a cross, with the words “No Lives Matter” carved into her body with a sharp instrument.” Harding has pleaded not guilty.

The crimes described in court cases this year follow a months-long surge in No Lives Matter–related violence. In October, authorities claim, a 14-year-old Swede committed eight attacks on unsuspecting passersby in Stockholm. The attacker, per national broadcaster SVT, took part in 764 and went by the handle “Slain” in the group. Documents circulated by 764 participants on Telegram and elsewhere claim “Slain764” as one of their own, and identify Sweden, the UK, and Bulgaria as countries where their group has a presence.

In mid-February, Italian police arrested a 15-year-old boy on suspicion of planning to murder a homeless man and livestream the act. Police said the teenager was reportedly involved in 764 and faces charges for explosives possession and possession of CSAM material. Italian authorities claim he planned his actions as part of a “week of terror” along with unspecified colleagues.

There is also evidence of 764’s praxis and imagery merging with that of the Terrorgram Collective, a neo-Nazi propaganda network that aims to radicalize young people and inspire solo acts of sabotage and mass murder.

Solomon Henderson, a Tennessee teenager whom police said shot up his high school last month, posted a sprawling manifesto that referenced both mass shooters inspired by Terrorgram as well as homicidal 764 members, including Tobbz. Henderson’s social media accounts also show extensive imagery from 764’s channels as well as the Order of Nine Angles “The influence I see most heavily in that agenda is the Order of Nine Angles,” Molas says.

That confluence of extremist inspirations is highly unpredictable, and may prove influential: There is reportedly evidence that social media accounts connected to Henderson may have communicated with accounts linked to Natalie “Samantha” Rupnow, a young Wisconsin woman who killed two and wounded classmates in a mid-December shooting at her school before dying by suicide. Earlier in December, a high school student in Guadalajara, Mexico, livestreamed an axe attack on his classmates before they were able to subdue him. The young man’s social media posts were rife with O9A influence, including photos of himself with butchered animals and another with a blood pact, a common O9A practice.

The Violent Rise of ‘No Lives Matter’

Elon Musk said a “massive cyberattack” disrupted X on Monday and pointed to “IP addresses originating in the Ukraine area” as the source of the attack. Security experts say that's not how it works.

The social network X suffered intermittent outages on Monday, a situation owner Elon Musk attributed to a “massive cyberattack.” Musk said in an initial X post that the attack was perpetrated by “either a large, coordinated group and/or a country.” In a post on Telegram, a pro-Palestinian group known as Dark Storm Team took credit for the attacks within a few hours. Later on Monday, though, Musk claimed in an interview on Fox Business Network that the attacks had come from Ukrainian IP addresses.

Web traffic analysis experts who tracked the incident on Monday were quick to emphasize that the type of attacks X seemed to face—distributed denial-of-service, or DDoS, attacks—are launched by a coordinated army of computers, or a “botnet,” pummeling a target with junk traffic in an attempt to overwhelm and take down its systems. Botnets are typically dispersed around the world, generating traffic with geographically diverse IP addresses, and they can include mechanisms that make it harder to determine where they are controlled from.

“It’s important to recognize that IP attribution alone is not conclusive. Attackers frequently use compromised devices, VPNs, or proxy networks to obfuscate their true origin," says Shawn Edwards, chief security officer of the network connectivity firm Zayo.

X did not return WIRED's requests for comment about the attacks.

Multiple researchers tell WIRED that they observed five distinct attacks of varying length against X's infrastructure, the first beginning early Monday morning with the final burst on Monday afternoon.

The internet intelligence team at Cisco's ThousandEyes tells WIRED in a statement, “During the disruptions, ThousandEyes observed network conditions that are characteristic of a DDoS attack, including significant traffic loss conditions which would have hindered users from reaching the application.”

DDoS attacks are common, and virtually all modern internet services experience them regularly and must proactively defend themselves. As Musk himself put it on Monday, “We get attacked every day.” Why, then, did these DDoS attacks cause outages for X? Musk said it was because “this was done with a lot of resources,” but independent security researcher Kevin Beaumont and other analysts see evidence that some X origin servers, which respond to web requests, weren't properly secured behind the company's Cloudflare DDoS protection and were publicly visible. As a result, attackers could target them directly. X has since secured the servers.

“The botnet was directly attacking the IP and a bunch more on that X subnet yesterday. It's a botnet of cameras and DVRs,” Beaumont says.

A few hours after the final attack concluded, Musk told Fox Business host Larry Kudlow in an interview, “We're not sure exactly what happened, but there was a massive cyberattack to try to bring down the X system with IP addresses originating in the Ukraine area.”

Musk has mocked Ukraine and its president, Volodymyr Zelensky, repeatedly since Russia invaded its neighbor in February 2022. A major campaign donor to President Donald Trump, Musk now heads the so-called Department of Government Efficiency, or DOGE, which has razed the US federal government and its workforce in the weeks since Trump's inauguration. Meanwhile, the Trump administration has recently warmed relations with Russia and moved the US away from its longtime support of Ukraine. Musk has already been involved in these geopolitics in the context of a different company he owns, SpaceX, which operates the satellite internet service Starlink that many Ukrainians rely on.

DDoS traffic analysis can break down the firehose of junk traffic in different ways, including by listing the countries that had the most IP addresses involved in an attack. But one researcher from a prominent firm, who requested anonymity because they are not authorized to speak about X, noted that they did not even see Ukraine in the breakdown of the top 20 IP address origins involved in the X attacks.

If Ukrainian IP addresses did contribute to the attacks, though, numerous researchers say that the fact alone is not noteworthy.

“What we can conclude from the IP data is the geographic distribution of traffic sources, which may provide insights into botnet composition or infrastructure used,” Zayo’s Edwards says. “What we can’t conclude with certainty is the actual perpetrator’s identity or intent.”

_Additional reporting by Zoë Schiffer._

What Really Happened With the DDoS Attacks That Took Down X

Plus: The world’s “largest illicit online marketplace” gets hit by regulators, police seize the Garantex crypto exchange, and scammers trick targets by making up ransomware attacks.

As Donald Trump’s administration continues its relentless reorganization of the United States federal government, documents obtained by WIRED showed this week that the Department of Defense is looking at cutting as much as three-quarters of its workforce that’s specifically focused on stopping proliferation of chemical, biological, and nuclear weapons. Meanwhile, the US Army is using its “CamoGPT” AI tool to “review” diversity, equity, inclusion, and accessibility policies per Trump administration orders. The military originally developed the AI service to improve productivity and operational readiness.

US civil liberties organizations are pushing the director of national intelligence. Tulsi Gabbard, to declassify details about Section 702 of the Foreign Intelligence Surveillance Act—a central overseas wiretap authority that is notorious for also capturing a large number of calls, texts, and emails made or sent by Americans. And the US Justice Department on Wednesday charged 10 alleged hackers and two Chinese government officials over digital crimes spanning more than a decade as part of China’s extensive hack-for-hire ecosystem.

Ongoing analysis from a consortium of researchers led by Human Security found that at least a million low-price Android devices, like TV streaming boxes and tablets, have been compromised as part of a scamming and ad fraud campaign known as Badbox 2.0. The activity, which the researchers say comes out of China, is an evolution of a previous effort to backdoor similar devices.

And there's more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

**Cybercriminals Allegedly Used a Backdoor to Steal Taylor Swift Tickets**

Two people who allegedly worked as part of a group to access nearly 1,000 tickets to concerts and other events—many for Taylor Swift’s Eras Tour—before selling them on for more than $600,000 profit were arrested and charged with the potential crimes in Queens this week. Tyrone Rose, 20, and Shamara P. Simmons, 31, of Jamaica, Queens, were arrested and arraigned in connection to the theft and sales, according to Queens district attorney Melinda Katz.

Between June 2022 and July 2023, it is alleged that 350 orders—totaling 993 tickets—on ticketing platform StubHub were accessed at a third-party contractor called Sutherland. “The Sutherland employees, defendant Tyrone Rose and an unapprehended accomplice, allegedly used their access to StubHub’s computer system to find a backdoor into a secure area of the network where already sold tickets were given a URL and queued to be emailed to the purchaser to download,” the district attorney’s office wrote in a statement.

They then emailed URLs to another accomplice who has since died, the office says, before posting the tickets to StubHub for resale. While the investigations are ongoing, the District Attorney’s office claimed the proceeds of the cybercrime totaled around $635,000 and also involved tickets for Ed Sheeran concerts, NBA games, and the US Open Tennis Championships.

**Payment Provider Linked to ‘Largest Illicit Online Marketplace’ Loses Banking License**

Every year, criminals make billions from the operations of highly organized scam compounds in Southeast Asia. As these operations have grown in sophistication, so has the wider ecosystem that supplies them with the technology and services needed to run the scams. And experts say there’s no bigger marketplace than Huione Guarantee—a Cambodian gray market selling scam services that researchers claim has facilitated more than $24 billion in transactions.

This week, according to a report by Radio Free Asia, the banking arm of Huione Guarantee’s parent company, Huione Group, had its financial license suspended by officials in Cambodia. According to the report, the Huione Pay service had its license withdrawn for failing to comply with “existing regulations.” The United Nations Office on Drugs and Crime and crypto tracing firm Elliptic previously had linked money moving through Huione Pay to cyberscamming. “They are willing facilitators of pig butchering and other fraud, so any regulatory action against them should be welcomed,” Elliptic founder Tom Robinson claimed to Radio Free Asia.

**Russian Cryptocurrency Exchange Garantex Taken Down in Law Enforcement Action**

The US Department of Justice announced an operation this week with Germany and Finland to disrupt the digital infrastructure behind notorious Russian cryptocurrency exchange Garantex. For years, the platform has allegedly been used for money laundering and other criminal transactions, including sanctions evasion. The DOJ claimed in its announcement that “transnational criminal organizations—including terrorist organizations” have utilized the exchange. Law enforcement said that the platform has processed at least $96 billion in cryptocurrency transactions since April 2019. US authorities said they froze over $26 million in funds used to facilitate money laundering as part of the Garantex takedown.

**Scammers Are Impersonating Notorious Ransomware Attackers to Extort Targets**

The FBI warned this week that scammers pretending to be attackers from the BianLian ransomware gang are demanding ransoms from corporate executives in the US. The demands include claims that the group has breached a company’s network and threaten to publish sensitive information unless a target pays up. Such criminal digital extortion is common enough that scammers apparently feel that they can plausibly make the claims and intimidate targets without even attacking them. The FBI says that the scammers’ ransom demands say that they come from BianLian and range from $250,000 to $500,000 payable via a QR code that links to a Bitcoin wallet. The real BianLian group has links to Russia and has targeted US critical infrastructure since June 2022, according to a November alert from the US Cybersecurity and Infrastructure Security Agency.

Cybercriminals Allegedly Used a StubHub Backdoor to Steal Taylor Swift Tickets

Eleven11bot infects webcams and video recorders, with a large concentration in the US.

A newly discovered network botnet comprising an estimated 30,000 webcams and video recorders—with the largest concentration in the US—has been delivering what is likely to be the biggest denial-of-service attack ever seen, a security researcher inside Nokia said.

The botnet, tracked under the name Eleven11bot, first came to light in late February when researchers inside Nokia’s Deepfield Emergency Response Team observed large numbers of geographically dispersed IP addresses delivering “hyper-volumetric attacks.” Eleven11bot has been delivering large-scale attacks ever since.

Volumetric DDoSes shut down services by consuming all available bandwidth either inside the targeted network or its connection to the Internet. This approach works differently than exhaustion DDoSes, which over-exert the computing resources of a server. Hypervolumetric attacks are volumetric DDoses that deliver staggering amounts of data, typically measured in the terabits per second.

**Johnny-Come-Lately Botnet Sets a New Record**

At 30,000 devices, the Eleven11bot was already exceptionally large (although some botnets exceed well over 100,000 devices). Most of the IP addresses participating, Nokia researcher Jérôme Meyer told me, had never been seen engaging in DDoS attacks.

Besides a 30,000-node botnet seeming to appear overnight, another salient feature of Eleven11bot is the record-size volume of data it sends its targets. The largest one Nokia has seen from Eleven11bot so far occurred on February 27 and peaked at about 6.5 terabits per second. The previous record for a volumetric attack was reported in January at 5.6 Tbps.

"Eleven11bot has targeted diverse sectors, including communications service providers and gaming hosting infrastructure, leveraging a variety of attack vectors," Meyer wrote. While in some cases the attacks are based on the volume of data, others focus on flooding a connection with more data packets than a connection can handle, with numbers ranging from a "few hundred thousand to several hundred million packets per second." Service degradation caused in some attacks has lasted multiple days, with some remaining ongoing as of the time this post went live.

A breakdown showed that the largest concentration of IP addresses, at 24.4 percent, was located in the US. Taiwan was next at 17.7 percent, and the UK at 6.5 percent.

In an online interview, Meyer made the following points:

> *   This botnet is much larger than what we're used to seeing in DDoS attacks (the only precedent I have in mind is an attack from 2022 right after the Ukraine invasion, at ~60k bots, but not public).
> *   The vast majority of its IPs were not involved in DDoS attacks prior to last week.
> *   Most of the IPs are security cameras (Censys thinks Hisilicon, I saw multiple sources talk to a Hikvision NVR too so that is a possibility but not my area of expertise).
> *   Partly because the botnet is larger than average, the attack size is also larger than average.

According to a post updated on Wednesday from security firm Greynoise, Eleven11bot is most likely a variant of Mirai, a family of malware for infecting webcams and other Internet of Things devices. Mirai debuted in 2016, when tens of thousands of IoT devices infected by it delivered what at the time were record-setting DDoSes of about 1 Tbps and took down security news site KrebsOnSecurity for almost a week. Shortly after that, Mirai developers published their source code in a move that made it easy for copycats everywhere to deliver the same massive attacks. Greynoise said that the variant driving Eleven11bot is using a single new exploit to infect TVT-NVMS 9000 digital video recorders that run on HiSilicon chips.

There have been conflicting reports on the number of devices comprising Eleven11bot. Following Nokia's report last Saturday of roughly 30,000 devices, the nonprofit Shadowserver Foundation said Tuesday that the true size was more than 86,000. Then in Wednesday's update, Greynoise said that based on data from fellow security firm Censys, both numbers were inflated and the true number was likely fewer than 5,000.

The upward revision from Shadowserver was likely the result of the belief that all infected devices displayed unique device information. That suspicion now appears to be incorrect. Instead, Meyer believes the information seen on infected devices is displayed on all such hardware, whether infected or not. Researchers from Greynoise and Censys weren't immediately available to explain how they arrived at the much lower estimate of fewer than 5,000.

Meyer said that he has consistently observed as many as 20,000 to 30,000 IP addresses participating in follow-on attacks, although many attacks come from much smaller subsets. He said that he has since sent a list of all 30,000 or so IP addresses he has observed to Censys and plans to also send them to Shadowserver soon in hopes of getting consensus on the true size.

"I am still confident on the estimated count as this is what we keep seeing in attacks and after human review of the source IPs," he wrote.

Mirai-based botnets employ various methods for infecting their targets. One common method is to attempt to log in to device administrator accounts using username/password pairs commonly set as defaults by manufacturers. Mirai botnets have also been known to exploit vulnerabilities that bypass security settings.

In any case, anyone running any sort of IoT devices should position them behind a router or other form of firewall so they're not visible from outside a local network. Remote administration from outside the Internet should be enabled only when needed. Users should also ensure each device is protected by a strong unique password. Last, devices should be updated as soon as security patches become available.

_This story originally appeared on_ _Ars Technica._

A Brand-New Botnet Is Delivering Record-Size DDoS Attacks

Tulsi Gabbard, the director of national intelligence, has long held anti-surveillance views. Now she oversees a key surveillance program she once tried to dismantle.

Former US congresswoman Tulsi Gabbard’s ascendance to director of national intelligence last month signaled a major shift in views toward government surveillance at the highest rung of the US intelligence community. While backing down from some of her more extreme anti-surveillance views in the run-up to her confirmation, Gabbard nevertheless held fast to a few promises of reform that have been traditionally eschewed by federal law enforcement leaders.

Now, some of the nation’s premier civil liberties organizations have begun lobbying America’s “top spy” to follow through on a pledge to bring about new levels of oversight and transparency to a key US surveillance program that’s long been plagued by reports of misuse.

Led by the American Civil Liberties Union, at least 20 major privacy groups this week urged Gabbard to declassify information concerning Section 702 of the Foreign Intelligence Surveillance Act (FISA)—the nation’s cornerstone wiretap authority that, while aimed at collecting intelligence on foreigners overseas, is known to vacuum up large quantities of calls, texts, and emails belonging to Americans.

In a letter first obtained by WIRED, the groups privately urged Gabbard this week to declassify information regarding the types of US businesses that can now be secretly compelled to install wiretaps on the US National Security Agency’s (NSA) behalf.

While it’s no secret that the government routinely compels phone and email service providers like AT&T and Google into conducting wiretaps, Congress passed a new provision last year expanding the range of businesses that can receive such orders. Legal experts had warned in advance that the provision was far too ambiguous and likely to vastly increase the number of Americans whose communications are wiretapped. But their warnings were not heeded.

It is widely assumed that the classified purpose behind the expanded authority is allowing the government to obtain access to communications in US data centers. Lawyers for the US Justice Department attempted to unilaterally expand the reach of the program in 2022, but its efforts were foiled by the secret surveillance court that oversees FISA. Only Congress has the power to expand FISA, the department was told.

As its a matter of secret law, lawmakers were unable to specify much about the limits of the government’s access in the provision they ultimately passed. This inevitably led to the adoption of a vague new definition for what the government calls an “electronic communications service provider” (ECSP)—the term for companies whose cooperation can be compelled under FISA.

Privacy experts and industry leaders had likewise raised concerns about introducing ambiguity into a law that defines the scope of a powerful surveillance tool, warning the changes could expose a near limitless new range of new businesses to secret government demands.

As WIRED reported last spring, opponents of the provision in Washington had cast the surveillance program’s new parameters as effectively “Stasi-like”—a reference to the defunct East German secret police agency notorious for infiltrating industry and forcing private citizens to spy on one another.

Senator Ron Wyden of Oregon, a renowned privacy hawk who has served on the Senate intelligence committee since just after 9/11, has referred to the new provision as “one of the most dramatic and terrifying expansions of government surveillance authority in history.”

Declassifying the new types of businesses that can actually be considered an ECSP is an essential step in bringing about clarity to an otherwise nebulous change in federal surveillance practices, according to the ACLU and the other organizations joined in its effort. “Without such basic transparency, the law will likely continue to permit sweeping NSA surveillance on domestic soil that threatens the civil liberties of all Americans,” the groups wrote in their letter to Gabbard this week.

The Office of the Director of National Intelligence did not respond to multiple requests for comment.

In addition to urging Gabbard to declassify details about the reach of the 702 program, the ACLU and others are currently pressing Gabbard to publish information to quantify just how many Americans have been “incidentally” wiretapped by their own government. Intelligence officials have long claimed that doing so would be “impossible,” as any analysis of the wiretaps would involve the government accessing them unjustifiably, effectively violating those Americans’ rights.

The privacy groups, however, point to research published in 2022 out of Princeton University, which details a methodology that could effectively solve that issue. “The intelligence community’s refusal to produce the requested estimate undermines trust and weakens the legitimacy of Section 702,” the groups say.

Gabbard is widely reported to have softened her stance against government spying while working to secure her new position as director of the nation’s intelligence apparatus. During the 116th Congress, for instance, Gabbard introduced legislation that sought to completely dismantle the Section 702 program, which is considered the “crown jewel” or US intelligence collection and crucial to keeping tabs on foreign threats abroad, including terrorist organizations and cybersecurity threats—exhibiting a stance far more extreme than those traditionally held by lawmakers and civil society organizations who’ve long campaigned for surveillance reform.

While begging off from this position in January, Gabbard’s newly espoused views have, in fact, brought her more closely in line with mainstream reformers. In response to questions from the US Senate ahead of her confirmation, for example, Gabbard backed the idea of requiring the Federal Bureau of Investigation to obtain warrants before accessing the communications of Americans swept up by the 702 program.

Slews of national security hawks from former House speaker Nancy Pelosi to former House intelligence committee chairman Mike Turner have long opposed this warrant requirement, as traditionally have all directors of the FBI. “This warrant requirement strengthens the \[intelligence community\] by ensuring queries are targeted and justified," Gabbard wrote in response to Senate questions in late January.

The Section 702 program was reauthorized last spring, but only for an additional two years. Early discussions about reauthorizing the program once more are expected to kick off again as early as this summer.

Sean Vitka, executive director of Demand Progress, one of the organizations involved in the lobbying effort, notes that Gabbard has a long history of supporting civil liberties, and refers to her recent statements about secret surveillance programs “encouraging.” “Congress needs to know, and the public deserves to know, what Section 702 is being used for,” Vitka says, “and how many Americans are swept up in that surveillance.”

“Section 702 has been repeatedly used to conduct warrantless surveillance on Americans, including journalists, activists, and even members of Congress,” adds Kia Hamadanchy, senior policy counsel for the ACLU. “Declassifying critical information, as well as providing long-overdue basic data about the number of US persons whose communications are collected under this surveillance are essential steps to increasing transparency as the next reauthorization debate approaches.”

Source

Wired