The world-leading data law changed how companies work. But four years on, there’s a lag on cleaning up Big Tech.

One thousand four hundred and fifty-nine days have passed since data rights nonprofit NOYB fired off its first complaints under Europe’s flagship data regulation, GDPR. The complaints allege Google, WhatsApp, Facebook, and Instagram forced people into giving up their data without obtaining proper consent, says Romain Robert, a program director at the nonprofit. The complaints landed on May 25, 2018, the day GDPR came into force and bolstered the privacy rights of 740 million Europeans. Four years later, NOYB is still waiting for final decisions to be made. And it’s not the only one.

Since the General Data Protection Regulation went into effect, data regulators tasked with enforcing the law have struggled to act quickly on complaints against Big Tech firms and the murky online advertising industry, with scores of cases still outstanding. While GDPR has immeasurably improved the privacy rights of millions inside and outside of Europe, it hasn’t stamped out the worst problems: Data brokers are still stockpiling your information and selling it, and the online advertising industry remains littered with potential abuses.

Now, civil society groups have grown frustrated with GDPR’s limitations, while some countries’ regulators complain the system to handle international complaints is bloated and slows down enforcement. By comparison, the information economy moves at breakneck speed. “To say that GDPR is well enforced, I think it’s a mistake. It's not enforced as quickly as we thought,” Robert says. NOYB has just settled a legal case against the delays in its consent complaints. “There’s still what we call an enforcement gap and problems with cross-border enforcement and enforcement against the big players,” adds David Martin Ruiz, a senior legal officer at the European Consumer Organization, which filed a complaint about Google’s location tracking four years ago.

Lawmakers in Brussels first proposed reforming Europe’s data rules back in January 2012 and passed the final law in 2016, giving companies and organizations two years to fall in line. GDPR builds upon previous data regulations, super-charging your rights and altering how businesses must handle your personal data, information like your name or IP address. GDPR doesn’t ban the use of data in certain cases, such as police use of intrusive facial recognition; instead, seven principles sit at its heart and guide how your data can be handled, stored, and used. These principles apply equally to charities and governments, pharmaceutical companies and Big Tech firms.

Crucially, GDPR weaponized these principles and handed each European country’s data regulator the power to issue fines of up to 4 percent of a firm's global turnover and order companies to stop practices that violate GDPR's principles. (Ordering a company to stop processing people’s data is arguably more impactful than issuing fines.) It was never likely that GDPR fines and enforcement were going to flow quickly from regulators—in competition law, for instance, cases can take decades—but four years after GDPR started, the total number of major decisions against the world’s most powerful data companies remains agonizingly low.

Under the dense series of rules that make up GDPR, complaints against a company that operates in multiple EU countries are usually funneled to the country where its main European headquarters are based. This so-called one-stop-shop process dictates that the country leads the investigation. The tiny nation of Luxembourg handles complaints against Amazon; the Netherlands deals with Netflix; Sweden has Spotify; and Ireland is responsible for Meta’s Facebook, WhatsApp, and Instagram, plus all of Google’s services, Airbnb, Yahoo, Twitter, Microsoft, Apple, and LinkedIn.

A glut of early and complex GDPR complaints has led to backlogs at regulators, including the Irish body, and international cooperation has been slowed down by paperwork. Since May 2018, the Irish regulator has completed 65 percent of cases involving cross-border decisions—400 are outstanding, according to the regulator's own stats. Other cases, launched by NOYB against Netflix (Netherlands), Spotify (Sweden), and PimEyes (Poland) have all also dragged on for years.

Europe’s data regulators claim GDPR enforcement is still maturing and that it is working well and improving over time. (Officials from France, Ireland, Germany, Norway, Luxembourg, Italy, the UK, and Europe’s two independent bodies, the EDPS and EDPB, were all interviewed for this article.) The number of fines has ramped up as the legislation has aged, hitting a running total of €1.6 billion (around $1.7 billion). The biggest? Luxembourg fined Amazon €746 million ($790 million), and Ireland fined WhatsApp €225 million ($238.5 million) last year. (Both companies are appealing the decisions). At the same time, one lesser-known Belgian fine could change how the entire ad tech industry works. However, officials concede that changes to the way GDPR is enforced could speed up the process and ensure swifter action.

Helen Dixon is at the heart of Europe’s GDPR enforcement, with the Irish Data Protection Commission (DPC) responsible for an outsized number of Big Tech firms. The DPC has faced criticism for struggling to keep up with the number of complaints under its purview, drawing ire from fellow regulators and calls to reform the body. “If everything comes at you at the same time, clearly there’s going to be a lag in terms of prioritizing and dealing sequentially with the issues while standing up what is a very significant legal framework,” Dixon says, defending her office’s performance. Dixon says the DPC has had to handle GDPR’s complexity from scratch, leading to many cases and new processes, and there aren’t simple answers for many of them.

“I would classify the DPC as being very effective in the first four years of application of the GDPR,” Dixon says. “The fact that DPC has stood up a new legal framework that many described as 'the law of everything' in a couple of short years, and implemented what are very significant sanctions in the form of fines and corrective measures already in that time period” shows its success, Dixon says. The organization has enforced measures against Twitter, WhatsApp, Facebook, and Groupon, among thousands of national cases, during this time.

“There should be an independent review of how to reform and strengthen the DPC,” says Johnny Ryan, a senior fellow at the Irish Council for Civil Liberties. “We cannot know from outside what the problems are.” Ryan adds that blame can’t just be leveled at the Irish regulator. “The European Commission has immense power. The GDPR is supposed to be an immense project. And the Commission has neglected the GDPR,” he says. “It doesn't just propose the laws, it also has to see that they are applied.”

So far, the European Commission has backed enforcement of GDPR in Ireland and across the continent. “The Commission has consistently called on data protection authorities to continue stepping up their enforcement efforts,” Didier Reynders, the European Commissioner for Justice, says in a statement. “We have launched six infringement procedures under the GDPR.” These legal cases include action against Slovenia for failing to import GDPR into its national law and questioning the independence of the Belgian data authority.

However, following a complaint from Ryan in February, the EU Ombudsman, a watchdog for European institutions, opened an inquiry into how the Commission has been monitoring data protection in Ireland. (The Ombudsman says the Commission has until May 25 to reply, after asking for its initial deadline to be extended. Reynders says the Commission does not comment on ongoing inquiries). If the Commission does look into Ireland, it could make recommendations, says Estelle Massé, the global data protection lead at Access Now, a technology-focused civil rights organization. “There is an issue, and if you don't intervene in this way, I don’t really see how the situation will resolve,” Massé says. “It has to go through an infringement procedure.”

Despite clear enforcement problems, GDPR has had an incalculable effect on data practices broadly. EU countries have made decisions in thousands of local cases and issued guidance to organizations to say how they should use people’s data. Spain’s LaLiga soccer league was fined after its app spied on users, retailer H&M was fined in Germany after it saved details about employees’ personal lives, the Netherlands’ tax body was fined over its use of a ‘blacklist,’ and these are just a handful of the successful cases.

Some of GDPR’s impact is also hidden—the law isn’t just about fines and ordering companies to change—and it has improved company behaviors. “If you compare the awareness about cybersecurity, about data protection, about privacy, as it looked like 10 years ago and it looks today, these are completely different worlds,” says Wojciech Wiewiórowski, the European Data Protection Supervisor, who oversees GDPR cases against European institutions, such as Europol.

Companies have been put off using people’s data in dubious ways, experts say, when they wouldn’t have thought twice about it pre-GDPR. One recent study estimated that the number of Android apps on Google’s Play store has dropped by a third since the introduction of GDPR, citing better privacy protections. “More and more businesses have allocated significant budgets to doing data protection compliance,” says Hazel Grant, head of the privacy, security, and information group at London-headquartered law firm Fieldfisher. Grant says that when GDPR decisions are made—such as Austria’s decision to make the use of Google Analytics unlawful—companies are concerned about what it means for them. “Four or five years ago, that enforcement wouldn't have happened,” Grant says. “And if it had happened, maybe a few data protection lawyers would have known about it—it wouldn't have been out there with clients coming to us saying we need advice on this.”

But at Big Tech levels where data is plentiful, the scale of complying with GDPR is different. One recent internal Facebook document obtained by Motherboard hints that the company doesn't really know what it does with your data—an assertion Facebook denied at the time. Equally, a WIRED and _Reveal_ joint investigation at the end of 2021 found serious shortcomings in the ways Amazon handles customer data. (Amazon said it had an “exceptional” track record in protecting data.)

Microsoft declined a request to comment. Neither Google nor Facebook provided comment in time for publication.

“There is a lag, especially on Big Tech, enforcing the law on Big Tech—and Big Tech means cross-border cases, and that means the one-stop-shop and the cooperation among the data protection authorities,” says Ulrich Kelber, the head of the German federal data protection regulator. The one-stop-shop allows all of Europe’s regulators to have a say on the final decision of the lead regulator in that case, which can then be challenged. Ireland’s fine against WhatsApp grew from the original proposed penalty of as little as €30 million ($31.8 million) to €225 million ($238.5 million) after other regulators weighed in. Another Irish case against Instagram is currently being discussed, Dixon says, which will add months to its final outcome.

The one-stop-shop was created under GPDR, meaning the process has started with teething problems, but four years in, a lot still needs to be improved. Tobias Judin, the head of international at Norway’s data protection authority, says that each week several drafts of decisions are circulated among Europe’s data regulators. “In the vast majority of those cases, we actually agree,” Judin says. (German authorities object the most.) Decisions can face a lot of back and forth between regulators, wrapped up in bureaucracy. “We do question whether, in those cases that have a European-wide impact, it makes sense and whether it is feasible that these cases are solely dealt with by one data protection authority until we reach the decision stage,” Judin says.

Luxembourg’s data regulator hit Amazon with a record-breaking €746 million ($790.6 million) fine last year, its first case against the retailer. Amazon is contesting the fine in court—in a statement to WIRED, the company repeated its assertion that “there has been no data breach, and no customer data has been exposed to any third party”—but Luxembourg’s regulator says investigations will always be lengthy despite it bringing in new ways to investigate companies. “I think under one year or one-half year, I think it’s almost impossible to have it closed before such a delay,” says Alain Herrmann, one of Luxembourg’s four data protection commissioners. “There are huge \[amounts of\] information to deal with.” Herrmann says Luxembourg has a few other international cases ongoing, but national secrecy laws prevent it from talking about them. “It’s just the \[one-stop-shop\] system, the lack of resources, the lack of clear law and procedure, which makes their job even more difficult,” Robert says.

The French data regulator has, in some ways, sidestepped the international GDPR process by directly pursuing companies’ use of cookies. Despite common beliefs, annoying cookie pop-ups don’t come from GDPR—they’re governed by the EU’s separate E-Privacy law, and the French regulator has taken advantage of this. Marie-Laure Denis, the head of French regulator CNIL, has hit Google, Amazon, and Facebook with hefty fines for bad cookie practices. Perhaps more importantly, it has forced companies to change their behavior. Google is altering its cookie banners across the whole of Europe following the French enforcement.

“We are starting to see really concrete changes to the digital ecosystems and evolution of practices, which is really what we are looking \[for\],” Denis says. She explains that CNIL will next look at data collection by mobile apps under the E-Privacy law, and cloud data transfers under GDPR. The cookie enforcement effort wasn’t to avoid GDPR’s protracted process, but it was more efficient, Denis says. “We still believe in the GDPR enforcement mechanism, but we need to make it work better—and quicker.”

In the last year, there have been growing calls to change how GDPR works. “Enforcement should be more centralized for big affairs,” Viviane Redding, the politician who proposed GDPR back in 2012, said of the data law in May last year. The calls have come as Europe passed its next two big pieces of digital regulation: the Digital Services Act and the Digital Markets Act. The laws, which focus on competition and internet safety, handle enforcement differently from GDPR; in some instances, the European Commission will investigate Big Tech companies. The move is a nod to the fact that GDPR enforcement may not have been as smooth as politicians would have liked.

There appears to be little appetite to reopen GDPR itself; however, smaller tweaks could help improve enforcement. At a recent meeting of data regulators held by the European Data Protection Board, a body that exists to guide regulators, countries agreed that some international cases will work to fixed deadlines and timelines and said they would try to “join forces” on some investigations. Norway’s Judin says the move is positive but questions how effective it will be in practice.

Massé, from Access Now, says a small amendment to GDPR could significantly address some of the biggest current enforcement problems. Legislation could ensure data protection authorities handle complaints in the same way (including using the same forms), explicitly lay out how the one-stop-shop should work, and make sure that procedures in individual countries are the same, Massé says. In short, it could clarify how GDPR enforcement should be handled by every country.

The view is also shared by data regulators, at least to some degree. France’s Denis says regulators should share more information, more quickly on cross-border cases so they can build up an informal consensus around a potential decision. “The Commission could also, for example, look at resources given to data protection authorities,” Denis says. “Because it’s a member state’s obligation to give sufficient resources to data protection authorities to carry out their duties.” The staff and resources regulators have to investigate and enforce is dwarfed by those of Big Tech.

“Potentially, if there was the possibility for some kind of an instrument specific to the GDPR—being a legal instrument—that would specify certain process and procedural issues, that might assist,” Ireland’s Dixon says. She adds that complications that could be ironed out include issues around access to files during investigations, whether those making the complaints are given access to the investigation process, and problems in translations. “There’s a whole range of inconsistencies around that, giving rise to delays and dissatisfaction on all sides,” Dixon says.

Without some changes—and strong enforcement—civil society groups warn that GDPR could fail to stop the worst practices of Big Tech companies and improve people’s sense of privacy. “The immediate thing that needs to be addressed is the Big Tech firms,” Ryan says. “If we cannot deal with Big Tech, we will create a permanence to the fatalism that people feel about privacy and data.” Four years in, Massé says she still has hope for GDPR enforcement. “It's really not what we had hoped for. But it’s also not in a place that I think we can start digging a grave for the GDPR and forget about it.”

How GDPR Is Failing

You don't want just anyone in your inbox. Here's how to take control.

When it comes to Facebook, most of us will have a contacts list covering years and even decades of our lives—recent acquaintances among people we've known since high school, neighbors we saw yesterday right next to old family friends we haven't seen since we were much younger.

Whatever you think about Facebook, there's no doubting its reach, and with billions of people on the platform it's important that you're contactable only to the people that you'd like to hear from.

The good news is that Facebook has plenty of tools and options to help you with this, and we've outlined the most important below. This is best done in a desktop web browser, where you can easily access all of the relevant Facebook settings.

Limiting Who Can Find You

It's possible to limit who can find you on Facebook.

Facebook via David Nield

(Facebook via David Nield)

If other people can't find you, they can't contact you. If you go to the Facebook Privacy Checkup page and choose **How people can find you on Facebook**, you can go step by step through the relevant settings. With friend requests, for example, you can allow anyone on Facebook to ask to be connected to you, or limit it to friends of friends—that means only those people who already know someone you're linked to will be able to send you a friend request.

You can also set whether people can find you via your email address and phone number. (If your details are in someone's phone contacts, Facebook might suggest you as a friend to them.) If you want to, you can keep these details private, so no one can find you via these pieces of information.

The final option in this particular section of the Facebook settings lets you decide whether you want your profile to be visible on search engines. If you'd rather your Facebook profile didn't pop up when someone types your name into Google, turn off the toggle switch next to **Do you want search engines outside Facebook to link to your profile?** before clicking on **Next** to review your settings.

Limiting Who Can See What You Share

You can set the audience for each Facebook post you share.

Facebook via David Nield

If other people can't see what you're sharing on Facebook, they can't comment on it or react to it. Every time you post something on the social network, you get what's called an audience selector menu—the drop-down just above the area where you compose the message that you want to post.

From the Facebook Privacy Checkup page on the web, you can click **Who can see what you share** to choose what the default setting is for this audience selector. If you want your posts to be seen only by a certain group of people, or by everyone on Facebook except for a few contacts, you can configure this here.

There's also a section called **Limit past posts**. If you click the **Limit** button underneath it, any older posts that were shared with an audience of friends of friends or indeed anyone on the web will be locked down so only your current Facebook friends can view them.

Facebook Messenger

Choose what happens with messages from people you don't know.

Facebook via David Nield

Anyone you’re Facebook friends with can send you a direct message via Facebook Messenger, so if you don't want this to happen then you need to unfriend or block them. (See below for more details on this.)

Anyone else who's on Facebook can message you too, but these messages don't go directly to your inbox: Instead, they go to a message requests folder. On the desktop interface or inside the mobile app, click or tap your profile picture (top left), then pick **Message requests** to see these messages. You can reply to these messages to continue the conversation, or ignore or delete them.

From the mobile Messenger app, tap your profile picture then **Privacy** and **Message delivery** to decide whether friends of friends and non-friends on Facebook can send you message requests at all.

Unfriending and Blocking

Blocking someone on Facebook takes only a few minutes.

Screenshot: Facebook via David Nield

Friends that you are connected to on Facebook can contact you much more easily than people who aren't. To sever a connection with someone, visit their profile page on Facebook and click **Friends** then **Unfriend**.

For people who you absolutely do not want to hear from on Facebook, use the block feature. Blocked individuals won't be able to see what you post on Facebook, they won't be able to tag you, they won't be able to message you, and they won't be able to add you to events. If you block someone, they won't be notified, but they may notice they can no longer be friends with you or get in touch with you.

To block someone, from the Facebook settings page click **Blocking**, then choose **Edit** next to **Block users**. Select **Add to Blocked List**, then enter the name of the person you no longer want to hear from, then choose **Block**. You can unblock people if you change your mind, but you'll have to then manually add them as friends again.

How to Limit Who Can Contact You on Facebook

Plus: The Conti ransomware gang shuts down, Canada bans Huawei and ZTE, and more of the week’s top security news.

As Russia’s full-scale war in Ukraine heads towards its hundredth day, opposition from Ukrainian forces is as strong as ever. At the same time, hacktivists all around the world continue to breach Russian institutions and publish their files and emails. This week one hacktivist collective took a different—and slightly peculiar—approach: launching a service to prank-call Russian government officials. The new website uses leaked details to put two random Russian officials on a call with each other. It obviously won't make any difference to the outcome of the war, but the group that created it hopes the tool will cause some confusion and annoy those in Moscow.

New research from Google’s Threat Analysis Group has delved into the surveillance-for-hire industry and found that spyware vendors are targeting Android devices with zero-day exploits. State-sponsored actors in Egypt, Armenia, Greece, Madagascar, Côte d’Ivoire, Serbia, Spain, and Indonesia have all purchased hacking tools from the North Macedonian firm Cytrox, the Google team says. The malware has used five previously unknown Android exploits, alongside unpatched vulnerabilities. Overall, Google’s researchers say they’re tracking more than 30 surveillance-for-hire firms around the world.

In other malware news, academics at Germany’s Technical University of Darmstadt have figured out a way to track an iPhone’s location even when it is turned off. When you switch your iPhone off it doesn’t fully power down—instead chips inside run in a low-power mode. The researchers were able to run malware that can track the phone in this low-power mode. They believe their work is the first of its kind, but the method is unlikely to be much of a threat in the real world, as it first requires jailbreaking the targeted iPhone, which has generally become harder to do in recent years.

But wait, there's more. We’ve rounded up all the news that we didn’t break or cover in depth this week. Click on the headlines to read the full stories. And stay safe out there.

International sanctions imposed against North Korea, for its continued development of nuclear weapons and ballistic missiles, mean the nation can’t trade with other countries or bring outside money within its borders. To get around this, in recent years Pyongyang has allowed its state-affiliated hackers to raid cryptocurrency platforms and rob banks. Now the FBI, the US Department of State, and the US Treasury have warned that thousands of North Korea’s IT workers—including app and software developers—have been freelancing at businesses around the world and sending money home. Many of them are based in China or Russia, the officials say. The risks of hiring North Korean workers range from “theft of intellectual property, data, and funds to reputational harm and legal consequences, including sanctions under both US and United Nations authorities.”

In a significant public move, the US Department of Justice says it will stop prosecuting security researchers under the Computer Fraud and Abuse Act. “Computer security research is a key driver of improved cybersecurity,” deputy attorney general Lisa Monaco said in a statement. For years the anti-hacking CFFA law has been criticized for its broad scope and its potential to be abused by prosecutors. While the DOJ’s explicit shift in policy will be welcomed by researchers, as _Motherboard_ reports, the policy doesn’t go far enough and still can put legitimate researchers at risk.

The mostly Russia-based Conti ransomware gang has had a dreadful few months. After backing Vladimir Putin’s war in Ukraine, thousands of its internal messages and innermost secrets were published online. While the gang has continued to target victims, including Costa Rica’s government, researchers now say Conti has officially shut down its operations. Conti’s Tor admin panels have been taken offline, and the group’s members are splintering off into other ransomware groups, according to security firm Advanced Intel. The shutdown comes after the US government offered a $15 million reward for information about Conti's members.

Canada has become the final country in the Five Eyes intelligence group—which also includes the US, UK, Australia, and New Zealand—to ban the use of Huawei’s telecoms equipment in its 5G networks. Fellow Chinese telecom firm ZTE is also included in the ban. The Canadian government, in an announcement, cited national security concerns and the fact that companies could be forced to comply with orders from “foreign governments.” Starting in September, Canadian firms will be banned from buying new 4G and 5G equipment from the Chinese companies. They must remove all existing 5G equipment by the summer of 2024, and 4G equipment must be removed by the end of 2027.

North Korean IT Workers Are Infiltrating Tech Companies

New research from Google's Threat Analysis Group outlines the risks Android users face from the surveillance-for-hire industry.

NSO Group and its powerful Pegasus malware have dominated the debate over commercial spyware vendors who sell their hacking tools to governments, but researchers and tech companies are increasingly sounding the alarm about activity in the wider surveillance-for-hire industry. As part of this effort, Google's Threat Analysis Group is publishing details on Thursday of three campaigns that used the popular Predator spyware, developed by the North Macedonian firm Cytrox, to target Android users.

In line with findings on Cytrox published in December by researchers at University of Toronto’s Citizen Lab, TAG saw evidence that state-sponsored actors who bought the Android exploits were located in Egypt, Armenia, Greece, Madagascar, Côte d’Ivoire, Serbia, Spain, and Indonesia. And there may have been other customers. The hacking tools took advantage of five previously unknown Android vulnerabilities, as well as known flaws that had fixes available but that victims hadn’t patched.

“It's important to shine some light on the surveillance vendor ecosystem and how these exploits are being sold,” says Google TAG director Shane Huntley. “We want to reduce the ability of both the vendors and the governments and other actors who buy their products to throw around these dangerous zero-days without any cost. If there’s no regulation and no downside to using these capabilities, then you’ll see it more and more.”

The commercial spyware industry has given governments that don’t have the funds or expertise to develop their own hacking tools access to an expansive array of products and surveillance services. This allows repressive regimes and law enforcement more broadly to acquire tools that enable them to surveil dissidents, human rights activists, journalists, political opponents, and regular citizens. And while a lot of attention has been focused on spyware that targets Apple’s iOS, Android is the dominant operating system worldwide and has been facing similar exploitation attempts.

 “We just want to protect users and find this activity as quickly as possible,” Huntley says. “We don’t think we can find everything all the time, but we can slow these actors down.”

TAG says it currently tracks more than 30 surveillance-for-hire vendors that have ranging levels of public presence and offer an array of exploits and surveillance tools. In the three Predator campaigns TAG examined, attackers sent Android users one-time links over email that looked like they had been shortened with a standard URL shortener. The attacks were targeted, focusing on just a few dozen potential victims. If a target clicked on the malicious link, it took them to a malicious page that automatically began deploying the exploits before quickly redirecting them to a legitimate website. On that malicious page, attackers deployed “Alien,” Android malware designed to load Cytrox's full spyware tool, Predator.

As is the case with iOS, such attacks on Android require exploiting a series of operating system vulnerabilities in sequence. By deploying fixes, operating system makers can break these attack chains, sending spyware vendors back to the drawing board to develop new or modified exploits. But while this makes it more difficult for attackers, the commercial spyware industry has still been able to flourish.

“We can’t lose sight of the fact that NSO Group or any one of these vendors is just one piece of a broader ecosystem,” says John Scott-Railton, a senior researcher at Citizen Lab. “We need collaboration between platforms so that enforcement actions and mitigations cover the full scope of what these commercial players are doing and make it harder for them to continue.”

Spyware Vendors Target Android With Zero-Day Exploits

To protest the war in Ukraine, WasteRussianTime.today auto-dials Russian government officials, connects them to each other, and lets you listen in to their confusion.

Robocalls have become a modern scourge, the destroyer of focus, the nuisance that somehow cannot be eradicated. But perhaps they can, at least, be repurposed to strike a very small and slightly absurd blow against the Russian government's unprovoked invasion of Ukraine.

Today, a group of international hacktivists launched a website, WasteRussianTime.today, designed to combine prank calling and robocalling into an automated weapon of telephonic annoyance targeted at the Russian state. Visit the site, click a button, and it will cycle through a leaked list of Russian government, military, and intelligence phone numbers to connect two random Russian officials—and allow the site's visitor to silently listen in as those officials waste their time trying to figure out why they're speaking to each other and who initiated the call.

“We’re hoping for confusion, that they get annoyed, and that these might even be interesting calls to listen to for people who speak Russian,” says one of the site's creators who goes by the name Shera. The group of artists, activists, and coders behind the site is, according to Shera, called the Obfuscated Dreams of Scheherazade. “This war started inside Moscow and St. Petersburg, within the power circle of Putin, and that’s who we want to annoy and disturb.”

Since Russia began its full-scale war in Ukraine on February 24, hacktivists working independently and even rallied by the Ukrainian government have carried out an unprecedented campaign of hacking operations targeting Russian organizations, some of which have resulted in the theft and leak of hundreds of gigabytes of Russians' emails and other private information. The Ukrainian government itself at one point released a list of what it said were the names and contact details of 620 Russian intelligence agents. 

Now, by combing through that pile of leaked information, scraping phone numbers from emails, and combining the results with those found in other public sources, the creators of WasteRussianTime.today say they've assembled more than 5,000 Russian government phone numbers, both landlines and cell phones, including members of the Russian military police, staff of its parliament, known as the Duma, and even Russia's Federal Security Service, or FSB—all of which are now targets of its automated robo-dialing campaign.

WasteRussianTime.today is designed to work by starting a VoIP call, automatically dialing 40 of the leaked phone numbers, and merging the user into a three-way call with the first two Russian officials' phones that connect. The site's creators say they decided not to let visitors to the site actually speak on the calls, for fear that they might say something that could identify and endanger themselves. So instead, the site functions as a kind of performance art installation, allowing visitors to silently observe and enjoy its spam calls. "Join the civil intervention against war," a message on the site reads. "If you're on the phone, you can't drop bombs or coordinate soldiers."

In WIRED's dozen or so test calls on the site just before its launch, the site's creators still seemed to be ironing out some bugs. The site only worked on desktop, and most of the calls resulted in at least one non-working number audio message. In about half the calls, at least one confused Russian-speaking did pick up. But in only one call did two people pick up the phone, and one hung up before the other started speaking. Shera says the site's developers will be tweaking it over time to identify and weed out non-working numbers.

The site's creators say the idea for WasteRussianTime.today came about 24 hours after Russia launched its full-scale invasion of Ukraine in late February. As the hacktivist group discussed ways of protesting or disrupting the war, their brainstorming eventually turned to how they might be able to create a site that used leaked Russian phone numbers to allow visitors to call ordinary Russian citizens and speak to them about the invasion. But as more Russian government numbers leaked in the post-invasion hacking wave—and as they realized most visitors wouldn't be able to speak Russian, and the calls might create safety concerns—they instead pivoted to making Russian officials essentially prank call each other, with the site's visitors as the audience.

Bringing that idea to fruition took nearly three months, in part, the site's creators say, because they were designing it to be resilient against the inevitable response from the site's targets. They've prepared a broad range of numbers to call from, to make their calls more difficult to block or ignore. And they've engaged a service that offers defense against distributed denial of service attacks that might otherwise be used to knock their site offline with bombardments of junk traffic. (They declined to name the service.) “We think the whole system will not live forever; someday, it will get blocked probably,” says Shera, suggesting that the site may manage to stay online and functional for anywhere from hours to weeks.

WasteRussianTime.today's creators say they took care to screen the numbers they included to make sure they're all government or military staff, rather than random Russian civilians. For the cell phone numbers they're including, for instance, they're only using numbers leaked in recent months, since cell phone numbers are often recycled from one user to the next. But they also admit they didn't do much actual testing of the numbers for fear of alerting their targets to the project too early, which would lead to their calls being blocked. In a message posted online, they called on Russians to share any more government or military phone numbers they may have, but ask that those supplying them share verification where possible so they can avoid harassing civilians. “We’re doing our best not to call some random grandma in Siberia,” Shera says.

The hacktivists say their idea was partly inspired by journalists at Bellingcat and Russian news site The Insider who have called Russian officials and even intelligence agents, pretending to be their colleagues or superiors, to trick them into revealing sensitive information. That technique was most famously used by Alexei Navalny, working with Bellingcat, when he dialed up an FSB agent and duped him into confessing to trying to assassinate him with the Novichok nerve agent in a nearly hour-long phone call.

But Christo Grozev, the Bulgarian Bellingcat researcher and journalist who helped Navalny spoof that FSB call, points out that the WasteRussianTime.today project does come at a cost. “Whenever something like this becomes public, the whole department changes their numbers, and that's not good for investigations, including journalistic investigations,” says Grozev.

All the same, Grozev says he does appreciate the prankster spirit in which the project was conceived, and he says that it may discourage and demotivate Russian government staffers who feel their private information isn't being protected. “It’s a great psychological operation,” he says. “It’s just more of a radio morning show prank, rather than a journalistic operation.”

The site's cocreator, Shera, for his part, says that many of the numbers are already leaked and public to varying degrees. But more broadly, if the effect of the project is little more than a prank, so be it. “We just want to do our part and annoy the Russian military-industrial complex,” he says. “And make people laugh a bit.”

This Hacktivist Site Lets You Prank-Call Russian Officials

Researchers found a way to exploit the tech that enables Apple’s Find My feature, which could allow attackers to track location when a device is powered down.

When you turn off an iPhone, it doesn’t fully power down. Chips inside the device continue to run in a low-power mode that makes it possible to locate lost or stolen devices using the Find My feature or use credit cards and car keys after the battery dies. Now researchers have devised a way to abuse this always-on mechanism to run malware that remains active even when an iPhone appears to be powered down.

It turns out that the iPhone’s Bluetooth chip—which is key to making features like Find My work—has no mechanism for digitally signing or even encrypting the firmware it runs. Academics at Germany’s Technical University of Darmstadt figured out how to exploit this lack of hardening to run malicious firmware that allows the attacker to track the phone’s location or run new features when the device is turned off.

This video provides a high overview of some of the ways an attack can work.

The research is the first—or at least among the first—to study the risk posed by chips running in low-power mode. Not to be confused with iOS’s low-power mode for conserving battery life, the low-power mode (LPM) in this research allows chips responsible for near-field communication, ultra wideband, and Bluetooth to run in a special mode that can remain on for 24 hours after a device is turned off.

“The current LPM implementation on Apple iPhones is opaque and adds new threats,” the researchers wrote in a paper published last week. “Since LPM support is based on the iPhone’s hardware, it cannot be removed with system updates. Thus, it has a long-lasting effect on the overall iOS security model. To the best of our knowledge, we are the first who looked into undocumented LPM features introduced in iOS 15 and uncover various issues.”

They added: “Design of LPM features seems to be mostly driven by functionality, without considering threats outside of the intended applications. Find My after power off turns shutdown iPhones into tracking devices by design, and the implementation within the Bluetooth firmware is not secured against manipulation.”

The findings have limited real-world value, since infections required first jailbreaking an iPhone, which in itself is a difficult task, particularly in an adversarial setting. Still, targeting the always-on feature in iOS could prove handy in post-exploit scenarios by malware such as Pegasus, the sophisticated smartphone exploit tool from Israel-based NSO Group, which governments worldwide routinely employ to spy on adversaries.

It may also be possible to infect the chips in the event hackers discover security flaws that are susceptible to over-the-air exploits similar to this one that worked against Android devices.

Besides allowing malware to run while the iPhone is turned off, exploits targeting LPM could also allow malware to operate with much more stealth since LPM allows firmware to conserve battery power. And, of course, firmware infections are extremely difficult to detect since it requires significant expertise and expensive equipment.

The researchers said Apple engineers reviewed their paper before it was published, but company representatives never provided any feedback on its contents. Apple representatives didn’t respond to an email seeking comment for this story.

Ultimately, Find My and other features enabled by LPM help provide added security, because they allow users to locate lost or stolen devices and lock or unlock car doors even when batteries are depleted. But the research exposes a double-edged sword that, until now, has gone largely unnoticed.

“Hardware and software attacks similar to the ones described have been proven practical in a real-world setting, so the topics covered in this paper are timely and practical,” said John Loucaides, senior vice president of strategy at firmware security firm Eclypsium. “This is typical for every device. Manufacturers are adding features all the time, and with every new feature comes a new attack surface.”

_This story originally appeared on_ _Ars Technica__._

Your iPhone Is Vulnerable to a Malware Attack Even When It’s Off

A newly unsealed opinion is likely the first decision from a US federal court to find that cryptocurrencies can't be used to evade sanctions.

Cryptocurrencies have long been seen as the Wild West of money transfers, but few online payment and money transfer platforms have been as blatant in appealing for illicit cash as one highlighted but not named in a memorandum opinion unsealed on May 13 in the US District Court in Washington, DC. The platform is apparently based in a “comprehensively sanctioned country”—likely North Korea, according to those within the crypto law space—and advertised its services as evading US financial sanctions. It was built using a US front company that facilitated the purchase of domain names, according to court records.

The platform, which was designed to sidestep financial bans aimed at crippling pariah countries, handled more than $10 million worth of bitcoin that was transferred between the United States and the sanctioned country using a US-based crypto exchange, which, the opinion implies, was not aware that it was helping users avoid sanctions.

The opinion, written by Magistrate Judge Zia Faruqui, was likely unsealed because someone has been arrested for operating the crypto platform. It all marks a shift in the way US law enforcement—and the law—handles cryptocurrencies.

“Issue One: virtual currency is untraceable? WRONG. ... Issue Two: sanctions do not apply to virtual currency? WRONG,” Faruqui concludes in his opinion, directly citing two _Saturday Night Live_ skits parodying TV host and political commentator John McLaughlin, who was known for his direct style.

“For some time, we’ve heard a narrative that cryptocurrency could potentially be used for sanctions evasion,” says Ari Redbord, head of legal and governmental affairs at TRM Labs, which monitors crypto fraud and financial crime. “What we see here is the first time that the Department of Justice has charged a criminal case involving the use of cryptocurrency to evade sanctions.”

The decision puts crypto exchanges on notice that they can be liable for enabling users to sidestep sanctions—intentionally or not—and is a warning to those trying to evade such sanctions that law enforcement is coming for them.

For years, cryptocurrency has been seen as a safe haven for criminal gangs and enterprises looking to launder ill-gotten gains. Unlike a bank account, cryptocurrency doesn’t require a name attached to transactions, which are recorded on a public blockchain ledger. This apparent anonymity attracted criminal enterprises in the early days of cryptocurrencies like bitcoin. “You had the Silk Roads of the world and the AlphaBays,” says Jessie K. Liu, partner at law firm Skadden, Arps, Slate, Meagher & Flom. A former deputy general counsel at the US Treasury who also served in the Justice Department, Liu has prosecuted several crypto cases. “The early reporting on bitcoin made it out to be some sort of secretive, anonymous currency that bad guys used to do bad things.” The founding principles of the platform—and the libertarian, privacy-loving, decentralized attitude that gave birth to it—contributed to the perception that virtual currencies can’t be traced.

What all of those groups and individuals overlooked was that the underpinning of cryptocurrencies—the immutable blockchain that keeps a record of every transaction made—was building a stockpile of evidence for prosecutors. “The thing that’s so unique about crypto is you can actually trace and track the flow of these funds on an entirely open ledger,” says Redbord. “It’s only because crypto moves and lives on an open ledger on the blockchain that allowed for this type of investigation.”

In the opinion, Faruqui explains how the defendant’s identifying information and IP address were tracked and linked to the payments platform they operated. “The striking point is that cryptocurrency quickly became this dark asset used for illegal activity, which was never the purpose, and that is now being turned on its head and will just as quickly become more transparent than traditional asset classes,” says Nimesh Shah, CEO of London-based accountancy company Blick Rothenberg. Others go further: “Judge Faruqui's opinion pours cold water on the idea that cryptocurrencies mean the death of sanctions,” says Anupam Chander, professor of law at Georgetown University in Washington, DC. Chander says the opinion is good for cryptocurrencies as they seek to shake off their early bad reputation and gain mainstream traction: “Judge Faruqui treats the virtual objects as if they are dollars or dinars.”

While the court’s opinion sets a legal precedent that crypto transactions can and should be traced by authorities, in other ways it’s wholly unremarkable. “Judge Faruqui is, as far as I’m aware, the first judge who has actually said explicitly that cryptocurrency can run afoul of sanctions,” says Liu. “But that’s been the Treasury Department’s view for a number of years.” What’s significant about the decision is that it codifies what has long been an informal attitude toward crypto.

“The question is no longer whether virtual currency is here to stay (i.e., FUD) but instead whether fiat currency regulations will keep pace with frictionless and transparent payments on the blockchain,” Faruqui writes. (Chander says that while Faruqui isn’t the first judge to use “FUD”—meaning fear, uncertainty, and doubt—in a federal opinion, he may well be the first to use it without defining it, showing just how much crypto has burrowed its way into the mainstream.)

In the last year or so, the Treasury Department has designated three Russia-based cryptocurrency exchanges as subject to sanctions, and the Office of Foreign Assets Control (OFAC), which implements sanctions regimes, has operated under the assumption that crypto is subject to sanctions, just as fiat currencies are.

“What really strikes me is that this opinion puts all those pieces together,” says Liu. “Though all those pieces are out there in the DOJ’s approach to enforcement already, this opinion really crystallizes that.” Liu believes there will be an increased focus on tackling the use of cryptocurrency to evade sanctions—and with that, a need for those operating crypto platforms to make sure their house is in order. “This opinion really underscores the importance for anybody involved in the cryptocurrency space or any of the adjacent spaces to have a very good compliance program,” says Liu, “and to recognize that they’re in an area that can be used for problematic purposes.” Crypto companies could otherwise open themselves to civil and potentially criminal action.

It’s all part of what Redbord calls a “cat and mouse game.” Payment platforms will come and go, trying to evade sanctions, but law enforcement will always be looking to catch them. “Cases like this send a message to bad actors that law enforcement can trace and track the flow of funds, and regulators like OFAC are going to continue to sanction bad entities in the space—and are clearly looking to go after bad entities,” says Redbord. “I think judges are going to see more and more warrants, and they’re going to see more and more cases.”

US Courts Are Coming After Crypto Exchanges That Skirt Sanctions

Plus: New details of ICE’s dragnet surveillance in the US, Clearview AI agrees to limit sales of its faceprint database, and more.

A group of human rights lawyers and investigators called on the Hague this week to bring what would be the first ever “cyber war crimes” charges. The group is urging the International Criminal Court to bring charges against the dangerous and destructive Russian hacking group known as Sandworm, which is run by Russia’s military intelligence agency GRU. Meanwhile, activists are working to block Russia from using satellites controlled by the French company Eutelsat to broadcast its state-run propaganda programming.

Researchers released findings this week that thousands of popular websites record data that users type into forms on the site before they hit the Submit button—even if the user closes the page without submitting anything. Google released a report on an in-depth security analysis it conducted with the chipmaker AMD to catch and fix flaws in specialty security processors used in Google Cloud infrastructure. The company also announced a slew of privacy and security features for its new Android 13 mobile operating system along with a vision for making them easier for people to understand and use.

The European Union is considering child protective legislation that would require scanning private chats, potentially undermining end-to-end encryption at a massive scale. Plus, defenders from the cybersecurity nonprofit BIO-ISAC are racing to protect the bioeconomy from digital threats, announcing a partnership this week with Johns Hopkins University Applied Physics Lab that will help fund pay-what-you-can incident response resources.

But wait, there’s more. Each week we round up the news that we didn’t break or cover in-depth. Click on the headlines to read the full stories. And stay safe out there.

The United States is completing development of a new generation of high-security encryption standards that will be robust in the current technical climate and are designed to be resistant to circumvention in the age of quantum computing. And while the National Security Agency contributed to the new standards' creation, the agency says it has no special means of undermining the protections. Rob Joyce, the NSA’s director of cybersecurity, told Bloomberg this week, “There are no backdoors." The NSA has been implicated in schemes to backdoor encryption before, including in a situation in the early 2010s in which the US removed an NSA-developed algorithm as a federal standard over backdoor concerns.

An extensive investigation by Georgetown Law’s Center on Privacy & Technology reveals a more detailed picture than ever of US Immigration and Customs Enforcement agency surveillance capabilities and practices. According to the report, published this week, ICE began developing its surveillance infrastructure at the end of the George W. Bush administration, years before it was previously thought to have begun these efforts. And researchers found that ICE spent $2.8 billion on surveillance technology, including face recognition, between 2008 and 2021. ICE was already known for its aggressive and invasive surveillance tactics during the Donald Trump administration’s anti-immigration crackdowns, but the report also argues that ICE has “played a key role in the federal government’s larger push to amass as much information as possible” about people in the United States.

“Our two-year investigation, including hundreds of Freedom of Information Act requests and a comprehensive review of ICE’s contracting and procurement records, reveals that ICE now operates as a domestic surveillance agency,” the report says. “By reaching into the digital records of state and local governments and buying databases with billions of data points from private companies, ICE has created a surveillance infrastructure that enables it to pull detailed dossiers on nearly anyone, seemingly at any time.”

In a legal settlement this week, the face recognition and surveillance startup Clearview AI agreed to a set of restrictions on its business in the US, including that it won’t sell its faceprint database to businesses or individuals in the country. The company says it has more than 10 billion faceprints in its arsenal belonging to people around the world and collected through photos found online. The settlement comes after the American Civil Liberties Union accused Clearview of violating the Illinois Biometric Information Privacy Act. The agreement also stipulates that the company won’t be allowed to sell access to its database in Illinois for five years. “This settlement demonstrates that strong privacy laws can provide real protections against abuse,” Nathan Freed Wessler, a deputy director of the ACLU Speech, Privacy, and Technology Project said in a statement. Despite the privacy win, Clearview may continue to sell its services to federal law enforcement, including ICE, and police departments outside of Illinois.

Costa Rican president Rodrigo Chaves said on Sunday that the country was declaring a national emergency after the notorious Conti ransomware gang infected multiple government agencies with malware last week. Sunday was the first day of Chaves' presidency. Conti leaked some of a 672 GB trove of stolen data from multiple Costa Rican agencies. In April, the Costa Rican social security administration had announced that it was the victim of a Conti attack. “At this time, a perimeter security review is being carried out on the Conti Ransomware, to verify and prevent possible attacks," the agency tweeted at the time.

The NSA Swears It Has ‘No Backdoors’ in Next-Gen Encryption

Russia is using satellites controlled by French operator Eutelsat to broadcast state-run programming. A grassroots group is pushing for that to stop.

“If the European authorities impose new sanctions against Russian channels, we will stop their broadcast,” the company said. It added: “At this stage, no regulator or other competent authority has asked us to stop broadcasting private Russian television channels in Russia.”

Philipoff and Lange have been turning their appeal to politicians, but with minimal effect. “We sent letters to all French members of the European Parliament,” Lange says. “Not a single answer.”

How, exactly, Paris or Brussels might force Eutelsat to block those Russian channels is an open question. Lange and Philipoff say that if the European Parliament can ban the English-language Sputnik and RT stations from their airwaves, sanctions should have the power to remove Russian-language TV from their satellites. In May, European Commission president Ursula von der Leyen told the EU Parliament they would ban three new broadcasters “in whatever shape or form, be it on cable, via satellite, on the internet, or via smartphone apps.”

Politico has reported that those three broadcasters are Russian-language news networks that reach Europe, with some help from Eutelsat’s satellites.

Eutelsat told WIRED, “We are aware of the European Union's intention to sanction three Russian channels, two of which are broadcast on our satellites, and we are ready to immediately cease broadcasting them as soon as the corresponding European regulation is published.”

The United States recently slapped sanctions on three Russian-language TV stations, including NTV (the flagship station of provider NTV+), after concluding that they are “spreading disinformation to bolster Putin’s war.” Those sanctions are likely to have an impact on their foreign revenue, but not on their Russian operations.

Going after the satellites themselves would be a hugely disruptive escalation. Moscow and Kyiv are already taking aim at each others’ satellite communications.

Western intelligence agencies say, in the hours before its invasion, Russian hackers took aim at American satellite provider Viasat. “Although the primary target is believed to have been the Ukrainian military, other customers were affected, including personal and commercial internet users,” the UK’s National Cyber Center said in a joint statement with the US and EU.

Earlier this week, just ahead of Russia’s Victory Day celebrations—which offered Moscow a prime opportunity to project strength amidst its stalled war—the State Special Communications Service of Ukraine announced that “\[television\] broadcast from the Russian satellite to the occupied Ukrainian regions was unexpectedly turned off.”

As WIRED has reported, Ukraine is aggressively deploying American- and European-provided Starlink terminals, while Russian satellite communications remain troubled.

European cooperation isn’t limited to Eutelsat’s satellite television. Eutelsat owns two subsidiaries in Russia, including home internet provider Konnect. In turn, the Russian state satellite operator owns a small stake in Eutelsat itself. (Corporate documents say most of tje 3.62 percent ownership stake corresponds to the Russian Satellite Communications Company, or RSCC.)

Meanwhile, some two dozen countries make up the Moscow-based Intersputnik consortium, primarily in Eastern Europe, the Middle East, and Asia. Its members include the Czech Republic, Romania, Germany, and Ukraine. In 2020, France announced its intention to join Intersputnik.

Intersputnik managed part of the Soviet Union’s satellite fleet, before being privatized after the fall of the USSR. Moscow’s influence on the organization is fairly apparent: The chair of its board is a senior civil servant in the Russian government.

As the West continues its messy divorce with Russia, an organization like Intersputnik could allow Russia to launch and maintain satellite service, underpinning not just television, but internet service, military communications, and geospatial imaging.

The Diderot Committee’s Lange and Philipoff hope that this current fight could enable more open flows of information in the future—that’s what informs the tongue-in-cheek name of their group. As its website explains: “On July 6, 1762, just nine days after the coup d’état of June 28 that put her on the throne, Catherine II invited the French philosopher Denis Diderot to come to Russia in order to publish _L’encyclopédie_, which had been banned in Paris. Diderot accepted her invitation and arrived in St. Petersburg in October of 1773."

Had Russia not pushed back against France’s censorship, the _Encyclopédie_, one of the most important works of the Enlightenment, may have never been published.

How One Company Helps Keep Russia’s TV Propaganda Machine Online

A biotech threat intelligence group is gaining supporters as urgency mounts around an overlooked vulnerable sector.

A new partnership between the cybersecurity nonprofit Bioeconomy Information Sharing and Analysis Center (BIO-ISAC) and the Johns Hopkins University Applied Physics Laboratory (APL), which works on emerging research with US government agencies, is highlighting the need for more resources to better secure biomedical, bioindustrial, and biomanufacturing entities.

The Covid-19 pandemic sparked regular people around the world to think about the logistics of vaccine development and production in a tangible and immediate way. But the so-called bioeconomy is silently embedded everywhere, from breeding programs used in agriculture to the development of biofuels. And as industry after industry faces a reckoning about the state of their cybersecurity defenses, researchers are increasingly realizing that the bioeconomy is vulnerable. During the pandemic, for example, Russia, China, and other state actors raced to hack vaccine makers and distributors for intelligence gathering, in a scramble that US officials warned could have been disruptive.

“A lot of the bioeconomy is small companies; that’s the real lifeblood of American biotech,” says BIO-ISAC cofounder Charles Fracchia. “Imagine if Moderna got hacked four years ago, even with some totally non-sophisticated malware, or they faced a ransomware attack. Small companies can go bankrupt really easily, and then we lose the work they're doing for the future. I'm very grateful that APL understood the mission of the BIO-ISAC and joined as a founding member. They want to help.”

Information sharing and analysis centers exist for many industries, from financial services to health care. And Charles Frick, a principal staff member at APL, says that the lab has been supporting ISACs and collaborating with them for many years. During the George W. Bush and Barack Obama administrations, Frick says, APL collaborated with the Department of Homeland Security and the National Security Agency to study the most efficient methods for large-scale threat intelligence sharing and security automation. APL participated in a 2018 financial services pilot for automatically screening and processing machine-readable threat intelligence data in which a process that had one taken 14 hours got whittled down to eight minutes.

All of this matters, because digital attacks on critical services and trends in attacks creep up quickly. The more information an organization can not only gather but also share, the better chance others have of defending themselves against similar hacks. APL's funding for the BIO-ISAC will go toward regular operations, including research, information sharing, and public disclosures. And crucially, it will also support incident response services the BIO-ISAC is launching so biotech and biomanufacturing organizations have someone to call if they're dealing with a digital attack or otherwise suspect that something is wrong. The services will be pay what you can to make them accessible to as many organizations as possible. Depending on demand, though, the BIO-ISAC may not have the capacity immediately to respond to every request. But the group hopes to begin filling a crucial gap in the services that are currently available.

“As we start identifying threats, it's a natural fit for us to say, well, we have an existing set of capabilities and skills that can be applied to this area, and we've demonstrated our ability to work with ISACs in collaboration," says Brian Haberman, an APL program area manager. "So this accomplishes our mission of supporting national priorities in a much faster way when you’re not going it alone. It's the biggest bang for your buck."

A few years ago, the idea of designating US election systems as government “critical infrastructure” was controversial to some. The designation simply unlocks funding and expanded resources from US government agencies, including the Cybersecurity and Infrastructure Security Agency, for critical sectors that work in the public interest. But while health care, food, and agriculture industries obviously have critical infrastructure designations that cover parts of the bioeconomy, the sector as a whole doesn't specifically have its own designation. Instead the US government has classified the bioeconomy with a “critical emerging tech” label.  As a result, groups like the BIO-ISAC are working ad hoc in a largely open field.

“The bioeconomy is an emerging sector of our economy if we really want to make meaningful change and impact, now is the time to get involved—not after it’s already this big thing and we try to go in reverse," says Andrew Kilianski, senior director for emerging infectious diseases at the International AIDS Vaccine Initiative. "We’ve done some of these sectors where we try to build out IT infrastructure and cybersecurity defenses later and it doesn’t work well." Kiliansk worked closely with the US government's Covid Operation Warp Speed initiative and a new member of the BIO-ISAC's national security advisory board.

“There's that squishy, beautiful life sciences spirit that, hey, we share everything, we’re open," Kilianski adds. "But now these discoveries have huge commercial value, not just societal value, and that makes all of this even more sensitive.”

Source

Wired