Donald Trump has vowed to go after political enemies, undocumented immigrants, and others if he wins. Experts warn he could easily turn the surveillance state against his targets.

Every president of the United States has within their grasp the power of a vast surveillance state that has grown significantly over the past few decades and has beaten back any real effort to rein it in. Through America’s numerous enigmatic intelligence agencies, presidents possess the ability to dive deeply into the communications, movements, and relationships of everyday Americans. Presidents of both parties have abused the surveillance state, but under a second Trump administration, this power could be abused in ways it has never been before.

Donald Trump, a now convicted felon and the presumptive 2024 Republican presidential nominee, has said he plans to prosecute his political opponents should he return to the White House. He’s said he would allow states to monitor pregnant women and prosecute those who seek abortions. Trump wants to deport millions of undocumented immigrants. He plans to invoke the Insurrection Act to quell civil unrest, which means sending the military into the streets. The much publicized Project 2025 outlines how he would quickly replace thousands of career civil servants in the federal government with loyalists.

If a president was interested in prosecuting their political opponents, crushing protests, targeting undocumented immigrants, and had the right people in place to help them carry out those plans, surveillance could become a valuable tool for accomplishing those goals. Like former US president Richard Nixon in the late 1960s and early 1970s, Trump could use the surveillance powers available to him to monitor his political opponents, disrupt protest movements, and more.

Nixon and former FBI director J. Edgar Hoover famously surveilled the president’s political opponents and activists, including Martin Luther King Jr., through a program called COINTELPRO. One of the main goals of the program was to “expose, disrupt, misdirect, discredit, or otherwise neutralize” civil rights groups.

If he so desired, Trump could create his own version of this program, but he’d be working with much more advanced technology—and it’d be in a time when there are countless data points available on every American. Hoover could have only dreamed of a world where everyone was walking around with tracking devices.

“So much of what we depend on, in terms of the rule of law, depends on norms. When those norms are ignored, that’s when things start to fall apart,” says Jeffrey L. Vagle, an assistant professor of law at Georgia State University. “Some of the norms, like prosecutorial discretion, might be eroded or disappear entirely. That could mean a number of things in terms of surveillance.”

Vagle says that if a second Trump administration wanted to defend its abuse of surveillance powers, it could stretch the use of national security as a justification for doing so. He says presidents have done this in the past in other ways.

“Administrations from both parties have invoked the term ‘national security’ and have used national security loopholes to justify surveillance and profiling,” says Patrick Toomey, deputy director of the American Civil Liberties Union’s National Security Project. “They have too often used national security as a pretext for law enforcement to target Muslims, communities of color, and immigrants.”

Toomey says Trump has sent “mixed signals” when it comes to how he feels about surveillance, but he’s made it clear he plans to target his political opponents in various ways if he’s elected again.

“A second Trump administration could be disastrous for many of our most fundamental freedoms,” Toomey says.

The administration may not even need to come up with a justification for surveilling Americans without a warrant, because it could simply purchase scores of people's personal data. The federal government has been known to purchase data from private brokers in the past, and doing so doesn’t require a warrant.

“We are just awash in data, and data brokers can just collect and sell these data,” Vagle says. “Law enforcement or quasi-law enforcement can collect that information.”

Surveillance can be done in secret so that the people being surveilled don’t realize they’re being surveilled, or it can be done openly as a way to stifle free expression, Vagle says. The government might tell you they’re keeping an eye on people, and then you might be less likely to speak out.

“If you think you’re being watched, you act differently,” Vagle says. “You could see a Trump version of COINTELPRO—only maybe not so covert. They might be more open about it with the idea that it might chill speech.”

As for the abortion issue, some of what may occur will depend on the future legal status of abortion, which could involve a US Supreme Court decision or congressional action. A major change in its legal status would likely affect how the federal government approaches the issue. If it remains a state issue, the federal government wouldn’t typically get involved in how a state is implementing a law it’s passed, but that’s not to say it couldn’t. If a state wanted help tracking people who are crossing state lines for abortions, for example, the federal government could conceivably assist with that.

“The federal government is not in the business of enforcing state laws, but there are a lot of what-ifs. How crazy might a Trump administration be willing to be?” Vagle says.

Whether it’s monitoring political opponents, activists, immigrants, or pregnant people, there are many ways in which a second Trump administration could utilize surveillance powers to exert more control over the populace. If the FBI and the Department of Justice are staffed with people who won’t push back when Trump orders them to do things that might be legally or morally questionable, they may carry out his wishes, and Americans may discover how much their privacy rights have eroded over the years.

“One of the things about Project 2025 is that it’s clear that the Trump camp, and more broadly the Republican Party that’s behind Trump, want to make it a more organized presidency than his first presidency was,” Vagle says. “It would be very unsurprising if the Department of Justice and the FBI dismissed anyone if they even had a whiff of disloyalty.”

How Donald Trump Could Weaponize US Surveillance in a Second Term

Data breaches at Ticketmaster and financial services company Santander have been linked to attacks against cloud provider Snowflake. Researchers fear more breaches will soon be uncovered.

One of the biggest hacks of the year may have started to unfold. Late on Friday, embattled events business Live Nation, which owns Ticketmaster, confirmed it suffered a data breach after criminal hackers claimed to be selling half a billion customer records online. Banking firm Santander also confirmed it had suffered a data breach impacting millions of customers and staff after its data was advertised by the same group of hackers.

While the specific circumstances of the breaches—including exactly what information was stolen and how it was accessed—remain unclear, the incidents may be linked to attacks against company accounts with cloud hosting provider Snowflake. The US-based cloud firm has thousands of customers, including Adobe, Canva, and Mastercard, which can store and analyze vast amounts of data in its systems.

Security experts say that as more details become clear about hackers' attempts to access and take data from Snowflake’s systems, it is possible that other companies will reveal they had data stolen. At present, though, the developing situation is messy and complicated.

“Snowflake recently observed and is investigating an increase in cyber threat activity targeting some of our customers’ accounts,” Brad Jones, Snowflake’s chief information security officer wrote in a blog post acknowledging the cybersecurity incident on Friday. Snowflake has found a “limited number” of customer accounts that have been targeted by hackers who obtained their login credentials to the company’s systems, Jones wrote. Snowflake also found one former staff member’s “demo” account that had been accessed.

However, Snowflake doesn’t “believe” it was the source of any leaked customer credentials, the post says. “We have no evidence suggesting this activity was caused by any vulnerability, misconfiguration, or breach of Snowflake’s product,” Jones writes in the blog post.

While the number of Snowflake accounts accessed and what data may have been taken have not been released, government officials are warning about the impact of the attack. Australia’s Cyber Security Center issued a “high” alert on Saturday saying it is “aware of successful compromises of several companies utilizing Snowflake environments” and companies using Snowflake should reset their account credentials, turn on multi-factor authentication, and review user activity.

“It looks like Snowflake has had some rather egregiously bad security compromise,” security researcher Troy Hunt, who runs data breach notification website Have I Been Pwned, tells WIRED. “It being a provider to many other different parties, it has sort of bubbled up to different data breaches in different locations.”

Details of the data breaches started to emerge on May 27. A newly registered account on cybercrime forum Exploit posted an advertisement where they claimed to be selling 1.3 TB of Ticketmaster data, including more than 560 million people’s information. The hacker claimed to have names, addresses, email addresses, phone numbers, some credit card details, ticket sales, order details, and more. They asked for $500,000 for the database.

One day later, the established hacking group ShinyHunters—which first emerged in 2020 with a data-stealing rampage, before selling 70 million AT&T records in 2021—posted the exact same Ticketmaster ad on rival marketplace BreachForums. At the time, Ticketmaster and its parent company Live Nation had not confirmed any data theft and it was unclear if either post selling the data was legitimate.

On May 30, ShinyHunters also claimed to be selling 30 million customer details and staff information from Santander, putting a $2 million price tag on the information. Both posts on BreachForums have drawn attention to the illegal marketplace, which was recently revived by ShinyHunters after the FBI took the website down on May 15. The posts may, at least in part, be efforts to restore the disrupted forum’s damaged reputation with criminals.

The two hacks were linked to Snowflake’s systems by Israeli security firm Hudson Rock, which, in a now-removed blog post, posted conversations its researchers had with the alleged hacker who claimed to have accessed Snowflake’s systems and exfiltrated data. The hacker claimed they had tried to sell the data back to Snowflake for $20 million. (Hudson Rock did not respond to WIRED’s questions about why it has removed its research).

The Hudson Rock post claimed a Snowflake employee may have been infected by an infostealer that collected the details the hacker needed to login to its systems. Charles Carmakal, the chief technology officer at Google-owned security firm Mandiant, told BleepingComputer that its investigations, which have been taking place in recent weeks, indicate information-stealing malware may have been used to get Snowflake account credentials.

A Ticketmaster spokesperson told TechCrunch that its stolen database was hosted on Snowflake after the company acknowledged a data breach in a filing to the Securities and Exchange Commission on Friday evening. In the middle of May, before its data was advertised online, Santander first said it had seen unauthorized access to one of its databases “hosted by a third-party provider,” however it has refused to name the third party.

Snowflake’s CISO, Jones, acknowledged the security incident on Friday, saying that if a “threat actor obtains customer credentials, they may be able to access the account.” The company says it became aware of the suspicious activity on May 23 but has since found out it had been happening since mid-April. Jones’ post says Snowflake has notified all of its customers and “encouraged” them to review account settings and ensure they have implemented multi-factor authentication. In an additional security bulletin, Snowflake says it has seen “malicious traffic” from a client calling itself “rapeflake” and also connections from another client called “DBeaver\_DBeaverUltimate.” A company spokesperson tells WIRED they have “nothing else to add” beyond the information included in company posts.

Cloud security company Mitiga says its investigations have seen a threat actor targeting organizations using Snowflake databases and using an attack tool called “​​rapeflake” in the process. Roei Sherman, field CTO at Mitiga, tells WIRED one possible scenario is that a threat actor managed to get information about Snowflake’s systems and then stole information about its clients, possibly using automated tools and brute-forcing their way into accounts.

Sherman says little is known about what data was stolen at the moment or the “​​rapeflake” tool, but that the attack could have wider ramifications going forward. There are already early signs other companies may be impacted.

Sherman says some of Mitiga’s customers have reached out to it for help, while Mandiant told BleepingComputer it had been assisting Snowflake customers in recent weeks. Cybersecurity researcher Kevin Beaumont shared online that he knows of six companies that have been impacted. And Australian events company Ticketek has also revealed customer names and email addresses stored in a “cloud-based platform, hosted by a reputable, global third party supplier” have been accessed, although a spokesperson refused to confirm if this was related to Snowflake at all.

“We haven’t seen the entire blast radius yet,” Sherman says. “Snowflake has thousands of clients—they offer self-registration—and some of their clients are huge companies. We expect to learn about additional companies compromised.”

The Ticketmaster Data Breach May Be Just the Beginning

Plus: A whistleblower claims the Biden administration falsified a report on Gaza, “Operation Endgame” disrupts the botnet ecosystem, and more.

If you have a crypto wallet containing a fortune but forgot the password, all may not be lost. This week, a pair of researchers revealed how they cracked an 11-year-old password to a crypto wallet containing roughly $3 million in bitcoins. With a lot of skill and a bit of luck, the researchers uncovered a flaw in how a previous version of the RoboForm password manager generates passwords that allowed them to accurately figure out the missing login and access the buried treasure.

Police in Western countries are using a new tactic to go after cybercriminals who remain physically out of reach of US law enforcement: trolling. The recent takedowns of ransomware groups like LockBit go beyond the traditional disruption of online infrastructure to include messages on seized websites meant to mess with the minds of criminal hackers. Experts say these trollish tactics help sow distrust between cybercriminals—who already have ample reason to distrust one another.

A graduate student at the University of Minnesota has been charged under the Espionage Act for photographing a shipyard in Virginia where the US Navy assembles nuclear submarines and other vessels whose components are classified. What makes the case novel, however, is that he allegedly took the photos with a drone, making his prosecution likely the first of its kind in the US.

It was a big week for cops taking down botnets (as you’ll read more about below). This week, the US announced that it had disrupted what may be the “largest botnet ever,” according to FBI director Christopher Wray. The botnet, called 911 S5, included some 19 million hijacked IP addresses around the world, which authorities say were used to carry out billions of dollars in Covid-19 relief fraud, make bomb threats, traffic in child sexual abuse material, and more.

But that’s not all. Each week, we round up the security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

More than a half-million internet routers were disabled last year in a malware attack carried out by an unknown threat actor targeting a US internet service provider. Launched in late October, the attack—one of the largest ever against the sector—reportedly disrupted internet across several Midwestern states. The attack was first disclosed this week by the security firm Black Lotus Labs, which did not identify the specific company affected. However, Ars Technica reports that the incident appears to have impacted a ISP called Windstream, which provides internet service to 18 states in the US Midwest and South.

Black Lotus Labs researchers say the attacker used off-the-shelf Chalubo malware to gain access to the routers, and that their firmware was eventually overwritten, effectively bricking the devices. The disruption resulted in a flood of complaints on a forum about the damaged routers. “The routers now just sit there with a steady red light on the front,” a user wrote on the DSLReports forum. “They won't even respond to a RESET.”

**Whistleblower Claims US “Falsified” Gaza Report to Protect Arms Sales**

The Biden administration allegedly fabricated the conclusion of a report released in early May which found the United States did not have “complete information to verify” whether US-made weapons had been used by Israel in contravention of international humanitarian law, according to a whistleblower, Stacy Gilbert, a senior civil-military expert who resigned in protest this week from the US State Department. Gilbert says the State Department experts who compiled the report clearly implicated Israel in limiting the amount of food and medical supplies able to reach Gaza; however, the report was reportedly taken out of the experts’ hands and then “edited at a higher level.”

The report consisted of a mandatory national security assessment that, had Israel been found in violation of humanitarian law, would have obligated the US to discontinue its arms sales. At the time of the report’s publishing, critics of the administration’s Gaza policy accused the White House of willfully ignoring the conduct of Israeli forces attempting to disrupt food deliveries to the famine-stricken Palestinian territory. Gilbert is the second US official to publicly resign this week in protest over the US’s involvement in the attacks.

**“Operation Endgame” Knocks Down Botnet Underworld**

An international coalition of law enforcement agencies, cybersecurity firms, and other organizations announced this week the disruption of large swathes of the global botnet ecosystem. Branded “Operation Endgame,” the effort targeted malware “droppers,” or malicious software that’s used to infiltrate a machine so it can be used to infect a machine with additional malware more easily. The droppers Operation Endgame targeted include IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee, and Trickbot, according to Europol, which says authorities seized more than 100 servers and 2,000 websites allegedly linked to cybercriminal activity. Law enforcement also arrested four “high-value” individuals; Germany added eight others to its most-wanted list. One of the “main suspects,” according to Europol, amassed a cryptocurrency fortune worth 69 million euros ($74 million) by renting out infrastructure for ransomware attacks. And the action isn’t over: The Operation Endgame website indicates a new announcement coming in the next several days.

**Pro-Israel Influence Op, Driven by AI, Targeted Americans on Meta Apps**

Meta says it has shut down an AI-driven network comprising hundreds of fake Facebook and Instagram accounts linked to an Israeli business intelligence firm. The company, Stoic, is accused of accepting contracts to propagate inauthentic pro-Israel content across the platforms for the purpose of manipulating North American users’ political views. Meta claimed Stoic’s influence operation was still in its “audience building” phase, “before they were able to gain engagement among authentic communities.”

Mysterious Hack Destroyed 600,000 Internet Routers

Drought-stricken hydro dams have led to daily electricity cuts in Ecuador. As weather becomes less predictable die to climate change, experts say other countries need to take notice.

During times of low water, Ecuador has few options to meet its baseline energy demands, because it doesn’t have any other major energy sources, says Proaño Aviles. Colombia and Peru usually trade energy with Ecuador, but they won’t sell their electricity right now because they too have had to ration water for their dams. And trying to plan ahead for this—at least with much confidence—hasn’t been easy either. Studies have projected that between 2000 and 2071, hydropower generation in Ecuador could see anything from a 55 percent drop to a 39 percent increase, depending on the climate change scenario, says Michel.

Other factors have also reduced the function of Ecuador’s power plants. “There’s also increased erosion or sedimentation in the river that then gets into the turbines and decreases their efficiency,” says Michel, with deforestation and forest fires both culprits. In Ecuador, some of the recent outages have been because of the Coca Codo Sinclair dam needing to have sediment removed from its turbine inputs.

Despite hydropower’s vulnerabilities, more capacity is expected to be installed in parts of the world. In Southeast Asia, countries such as Myanmar, Laos, and Cambodia are increasing their hydro capacity to meet rising energy needs. “Hydropower has this tremendous promise for expanding electricity access to underserved populations, generating revenue for states, and for linking regions together in power-sharing agreements and selling electricity across borders,” says Michel. “But these challenges of climate change—what we’re seeing in Ecuador—are also going to be challenges in Southeast Asia.”

Effective management strategies for handling these climate challenges will be essential, and will vary by region. One promising approach for areas with heavy rainfall, according to Michel, is to increase the use of rainwater harvesting systems, which use catchment areas, like a roof, gutters, and storage tanks, to capture and store heavy rainfall in localized systems. This helps replenish groundwater and supports agricultural and municipal needs, reducing the amount of water extracted from rivers, meaning more can be held for electricity generation.

Additionally, modernizing the grid—admittedly a costly, intensive job—can enhance its ability to handle fluctuations in demand, says Proaño Aviles. New infrastructure can both minimize energy losses and optimize the distribution of electricity, so less energy needs to be produced overall, meaning less water is needed.

Countries should also invest in other renewable sources to diversify their power supply, so that when water levels are low, they have a backup. In Ecuador, for example, the government is offering a 100 percent income tax exemption for new investments in renewables, including wind and solar farms. Proaño Aviles notes that private investment will be an essential step, as it can help fund renewable energy projects faster than the government can alone.

Finally, energy and water conservation are essential tools, no matter the region. Proaño Aviles has seen small businesses in Ecuador adhering to efficient energy-management standards to prepare for future events. In some places, resource-use regulations are even mandated by government. Michel points to Las Vegas as a case study: The city has strict water-conservation measures, including incentives for residents to replace grass lawns with desert-friendly landscaping and restrictions on watering schedules. The city also uses a tiered water-pricing system that charges higher rates as water use increases, and an advanced water-recycling system that treats and reuses wastewater.

“I think it has a powerful demonstration effect because it raises the visibility for policymakers in other cities and for consumers around the country who can see what’s happening,” Michel says. “It stands as a signal that, yeah, we do have policies and approaches that can help answer these challenges.”

As climate change alters weather patterns and increases the frequency of extreme events, proactive and comprehensive management are crucial to prevent widespread energy crises—whether in South America, the US, or Asia. For Ecuador, its energy future hinges on the ability to address immediate challenges but also plan for long-term resilience. “I think we’re moving in the right direction, but I don’t know if it is at the right pace,” says Proaño Aviles. “I don’t know if it’s fast enough.”

Ecuador Is Literally Powerless in the Face of Drought

In seemingly the first case of its kind, the US Justice Department has charged a Chinese national with using a drone to photograph a Virginia shipyard where the US Navy was assembling nuclear submarines.

The United States Department of Justice is quietly prosecuting a novel Espionage Act case involving a drone, a Chinese national, and classified nuclear submarines.

The case is such a rarity that it appears to be the first known prosecution under a World War II–era law that bans photographing vital military installations using aircraft, showing how new technologies are leading to fresh national security and First Amendment issues.

“This is definitely not something that the law has addressed to any significant degree,” Emily Berman, a law professor at the University of Houston who specializes in national security, tells WIRED. “There’s definitely no reported cases.”

On January 5, 2024, Fengyun Shi flew to Virginia while on leave from his graduate studies at the University of Minnesota and rented a Tesla at the airport. His research focused on using AI to detect signs of crop disease in photos. Shi’s subject that week wasn’t plants, however, but allegedly the local shipyards—the only ones manufacturing the latest generation of Navy carrier ships in the country, and nuclear submarines as well.

According to an affidavit filed by FBI special agent Sara Shalowitz in February, a shipyard security officer alerted the Naval Criminal Investigative Service to Shi’s actions. The affidavit alleges that on January 6, Shi was flying a drone in “inclement weather” before it got stuck in a neighbor’s tree. When Shi, who is a Chinese citizen, approached the neighbor for help, he was questioned about his nationality and purpose for being in the area. The unnamed resident took photos of Shi, his license plate, and his ID, and called the police. The affidavit alleges that Shi was “very nervous” when questioned by police and “did not have any real reasons” for flying a drone in bad weather. The police gave Shi the number for the fire department and said he would need to stay on the scene. Instead, he returned the rental car an hour later and left Hampton Roads, Virginia, abandoning the drone.

When the FBI seized the drone and pulled the photos off its memory card, they discovered images that special agent Shalowitz said she recognized as being taken at Newport News Shipyard and BAE Systems, which is a 45-minute drive away. The affidavit states that on the day Shi took the photos, the Newport News Shipyard was “actively manufacturing” aircraft carriers and Virginia class nuclear submarines.

“Naval aircraft carriers have classified and sensitive systems throughout the carriers,” the affidavit states. “The nuclear submarines present on that date also have highly classified and sensitive Navy Nuclear Propulsion Information (‘NNPI’) and those submarines even in the design and construction phase are sensitive and classified.”

The DOJ is charging Shi with six Espionage Act misdemeanors under two statutes: one banning photographing a vital military installation and one banning the use of an aircraft to do so. Each misdemeanor can result in up to a year in prison upon conviction. While he awaits trial, Shi is restricted to living in Virginia under probation. He was forced to surrender his passport. According to court filings, he appears to require a translator.

Shi’s case, filed in federal court in Virginia’s Eastern District, was first spotted by Court Watch in February. Its rarity became apparent in March, after prosecutors filed a motion for a time extension. The judge agreed, writing that it was justified because the case is “so unusual due to the nature of the prosecution and the novel questions of both law and fact.”

Indeed, Shi is being charged “under two statutes which have been rarely prosecuted” to the degree that “the Court has been able to only find one reported case,” the judge wrote. That case, _Genovese v. Town of Southampton,_ centered on just one of the two statutes Shi is being charged under—photographing a military installation, without an aircraft.

The DOJ declined to comment when WIRED posed questions about Shi’s case, including whether the Chinese government is being engaged on the issue.

According to a filing from US prosecutors, both parties wish to end the case in a plea agreement. Shi’s attorney did not respond to multiple requests for comment.

WIRED found multiple social media accounts connected to Shi. He appears to have a small online footprint and few interactions with others online, portraying a life of quiet normalcy. He appears to be a soccer fan who enjoys campus and is a devoted _League of Legends_ player. He even attended the competitive online game’s 2022 World Championship tournament in San Francisco. In fact, according to online records, he often plays _League of Legends_ multiple times a day while awaiting trial in Virginia. His university research is similarly innocuous: He’s developing an app for detecting crop diseases in photos called Gopher Eye, which is being funded by the National Science Foundation, and has applied for a patent. He describes himself as a “startup manager” on LinkedIn.

One of Shi’s colleagues at the University of Minnesota, who spoke to WIRED under the condition of anonymity, says that he was a “typical” kid who was “very passionate” about his research. In the fall of 2023, however, financial and familial strife compounded by mounting pressure from lagging grades led to a break. The colleague said that Shi soon all but disappeared, taking leave from his studies and “basically hiding from all of his normal relationships.” He’s been difficult to contact since then, they say, adding that they did not know that Shi is currently in the US—much less embroiled in a rare national security case.

“From my point of view, he’s had very bad luck,” they say. “I don’t think that he did anything wrong intentionally.”

The question of why the DOJ is prosecuting Shi in the first place looms large over his case. After all, satellites originating in China photograph the US daily, including military sites and aircraft carriers. The degree to which Shi’s nationality played a role in the DOJ’s decision to prosecute the case isn’t clear. The case is proceeding amid rising animosity between China and the US, but Shi isn’t being charged under any laws related to collecting intelligence for a foreign government. He is not being accused of acting as a spy. His only alleged crime is taking photos with a drone.

“The Justice Department has guidelines that say \[nationality\] is not supposed to play a role in a criminal investigation, but there are exceptions to that rule for national security and border-related investigations,” Berman says. “It certainly seems likely that the fact Shi is a Chinese national raises red flags for investigators that wouldn't necessarily go up in the same way if he was an American citizen, rightly or wrongly.”

Cases prosecuted under statutes banning photographing military bases can have implications for First Amendment rights, Berman says. Photographing in a public place is a constitutionally protected activity.

“It would be a good thing to litigate some of these cases and clarify what the rules actually are about what you can and can't do,” she says. “Any time there is uncertainty, that may make people hesitant to do things that they are constitutionally entitled to do.”

The few occasions where statutes banning photographing military installations have come up illustrate this concern. In _Genovese v. Town of Southampton,_ Nancy Genovese sued law enforcement officials who arrested her for photographing an airport—part of which was a military base—while having guns in her car. A jury agreed that law enforcement was maliciously prosecuting Genovese, and she landed a settlement amounting to more than $1 million in 2016. In another incident, in 2014, reporters for The Blade in Ohio filed a federal lawsuit after they were unlawfully detained for taking photos outside a military base. In that case, too, the law favored the plaintiffs, and the reporters were awarded $18,000.

Shi’s case is scheduled to start on June 20.

The Unusual Espionage Act Case Against a Drone Photographer

The US says a Chinese national operated the “911 S5” botnet, which included computers worldwide and was used to file hundreds of thousands of fraudulent Covid claims and distribute CSAM, among other crimes.

The United States Department of Justice on Wednesday announced charges against a 35-year-old Chinese national, Yunhe Wang, accused of operating a massive botnet allegedly linked to billions of dollars in fraud, child exploitation, and bomb threats, among other crimes.

Wang, identified by numerous pseudonyms—Tom Long and Jack Wan, among others—was arrested on May 24 and is accused of distributing malware through various pop-up VPN services, such as “ProxyGate” and “MaskVPN,” and by embedding viruses in internet files distributed via peer-to-peer networks known as torrents.

The malware is said to have compromised computers located in nearly every country in the world, turning them into proxies through which criminals were able to hide their identities while committing countless crimes. According to prosecutors in the US, this included the theft of billions of dollars slated for Covid-19 pandemic relief—funds allegedly stolen by foreign actors posing as unemployed US citizens.

According to an indictment, the infected computers allegedly provided Wang’s customers with a persistent backdoor, allowing them to disguise themselves as any one of the victims of Wang’s malware. This illicit proxy service, known as “911 S5,” launched as early as 2014, the US government says.

“The 911 S5 Botnet infected computers in nearly 200 countries and facilitated a whole host of computer-enabled crimes, including financial frauds, identity theft, and child exploitation,” says FBI director Christopher Wray, who described the illicit service as “likely the world’s largest botnet ever.”

The US Treasury Department has also sanctioned Wang and two other individuals allegedly tied to 911 S5.

Wang is said to have amassed access to nearly 614,000 IP addresses in the US and more than 18 million others worldwide—collectively forming the botnet. 911 S5’s customers were able to filter the IPs geographically to choose where they’d like to appear to be located, down to a specific US zip code, the DOJ claims.

The indictment states that of the 150 dedicated servers used to manage the botnet, as many as 76 were leased by US-based service providers, including the one hosting 911 S5’s client interface, which allowed criminals overseas to purchase goods using stolen credit cards, in many cases for the alleged purpose of circumventing US export laws.

More than half a million fraudulent claims lodged with pandemic relief programs in the United States are allegedly tied to 911 S5. According to the indictment, nearly $6 billion in losses have been linked to IP addresses captured by 911 S5. Many of the IP addresses have been reportedly tied to more insidious crimes, including bomb threats and the trafficking of child sexual abuse material, or CSAM.

“Proxy services like 911 S5 are pervasive threats that shield criminals behind the compromised IP addresses of residential computers worldwide,” says Damien Diggs, the US attorney for the Eastern District of Texas, where the charges against Wang were brought by a grand jury earlier this month.

Adds Nicole Argentieri, head of the Justice Department’s Criminal Division: “These criminals used the hijacked computers to conceal their identities and commit a host of crimes, from fraud to cyberstalking.”

At the time of writing, it is unclear whether these virtual impersonations resulted in any criminal investigations or charges against US-based victims whose IP addresses were hijacked as part of the 911 S5 botnet. WIRED is awaiting a response from the Department of Justice regarding this concern.

According to the Justice Department, law enforcement agencies in Singapore, Thailand, and Germany collaborated with US authorities to effect Wang’s arrest.

Wang faces charges of conspiracy, computer fraud, conspiracy to commit wire fraud, and conspiracy to money laundering, with a maximum penalty of 65 years in prison. The US is also seeking to seize a mountain of luxury cars and goods allegedly owned by Wang, including a 2022 Ferrari Spider valued at roughly half a million dollars as well as a Patek Philippe watch worth potentially several times that amount.

‘Largest Botnet Ever’ Tied to Billions in Stolen Covid-19 Relief Funds

Thanks to a flaw in a decade-old version of the RoboForm password manager and a bit of luck, researchers were able to unearth the password to a crypto wallet containing a fortune.

Two years ago when “Michael,” an owner of cryptocurrency, contacted Joe Grand to help recover access to about $2 million worth of bitcoin he stored in encrypted format on his computer, Grand turned him down.

Michael, who is based in Europe and asked to remain anonymous, stored the cryptocurrency in a password-protected digital wallet. He generated a password using the RoboForm password manager and stored that password in a file encrypted with a tool called TrueCrypt. At some point, that file got corrupted and Michael lost access to the 20-character password he had generated to secure his 43.6 BTC (worth a total of about €4,000, or $5,300, in 2013). Michael used the RoboForm password manager to generate the password but did not store it in his manager. He worried that someone would hack his computer and obtain the password.

“At \[that\] time, I was really paranoid with my security,” he laughs.

Grand is a famed hardware hacker who in 2022 helped another crypto wallet owner recover access to $2 million in cryptocurrency he thought he’d lost forever after forgetting the PIN to his Trezor wallet. Since then, dozens of people have contacted Grand to help them recover their treasure. But Grand, known by the hacker handle “Kingpin,” turns down most of them, for various reasons.

Grand is an electrical engineer who began hacking computing hardware at age 10 and in 2008 cohosted the Discovery Channel’s _Prototype This_ show. He now consults with companies that build complex digital systems to help them understand how hardware hackers like him might subvert their systems. He cracked the Trezor wallet in 2022 using complex hardware techniques that forced the USB-style wallet to reveal its password.

But Michael stored his cryptocurrency in a software-based wallet, which meant none of Grand’s hardware skills were relevant this time. He considered brute-forcing Michael’s password—writing a script to automatically guess millions of possible passwords to find the correct one—but determined this wasn’t feasible. He briefly considered that the RoboForm password manager Michael used to generate his password might have a flaw in the way it generated passwords, which would allow him to guess the password more easily. Grand, however, doubted such a flaw existed.

Michael contacted multiple people who specialize in cracking cryptography; they all told him “there’s no chance” of retrieving his money. But last June he approached Grand again, hoping to convince him to help, and this time Grand agreed to give it a try, working with a friend named Bruno in Germany who also hacks digital wallets.

Grand and Bruno spent months reverse engineering the version of the RoboForm program that they thought Michael had used in 2013 and found that the pseudo-random number generator used to generate passwords in that version—and subsequent versions until 2015—did indeed have a significant flaw that made the random number generator not so random. The RoboForm program unwisely tied the random passwords it generated to the date and time on the user’s computer—it determined the computer’s date and time, and then generated passwords that were predictable. If you knew the date and time and other parameters, you could compute any password that would have been generated on a certain date and time in the past.

If Michael knew the day or general time frame in 2013 when he generated it, as well as the parameters he used to generate the password (for example, the number of characters in the password, including lower- and upper-case letters, figures, and special characters), this would narrow the possible password guesses to a manageable number. Then they could hijack the RoboForm function responsible for checking the date and time on a computer and get it to travel back in time, believing the current date was a day in the 2013 time frame when Michael generated his password. RoboForm would then spit out the same passwords it generated on the days in 2013.

There was one problem: Michael couldn’t remember when he created the password.

According to the log on his software wallet, Michael moved bitcoin into his wallet for the first time on April 14, 2013. But he couldn’t remember if he generated the password the same day or some time before or after this. So, looking at the parameters of other passwords he generated using RoboForm, Grand and Bruno configured RoboForm to generate 20-character passwords with upper- and lower-case letters, numbers, and eight special characters from March 1 to April 20, 2013.

It failed to generate the right password. So Grand and Bruno lengthened the time frame from April 20 to June 1, 2013, using the same parameters. Still no luck.

Michael says they kept coming back to him, asking if he was sure about the parameters he’d used. He stuck to his first answer.

“They really annoyed me, because who knows what I did 10 years ago,” he recalls. He found other passwords he generated with RoboForm in 2013, and two of them did not use special characters, so Grand and Bruno adjusted. Last November, they reached out to Michael to set up a meeting in person. “I thought, ‘Oh my God, they will ask me again for the settings.”

Instead, they revealed that they had finally found the correct password—no special characters. It was generated on May 15, 2013, at 4:10:40 pm GMT.

“We ultimately got lucky that our parameters and time range was right. If either of those were wrong, we would have … continued to take guesses/shots in the dark,” Grand says in an email to WIRED. “It would have taken significantly longer to precompute all the possible passwords.”

Grand and Bruno created a video to explain the technical details more thoroughly.

RoboForm, made by US-based Siber Systems, was one of the first password managers on the market, and currently has more than 6 million users worldwide, according to a company report. In 2015, Siber seemed to fix the RoboForm password manager. In a cursory glance, Grand and Bruno couldn’t find any sign that the pseudo-random number generator in the 2015 version used the computer’s time, which makes them think they removed it to fix the flaw, though Grand says they would need to examine it more thoroughly to be certain.

Siber Systems confirmed to WIRED that it did fix the issue with version 7.9.14 of RoboForm, released June 10, 2015, but a spokesperson wouldn’t answer questions about how it did so. In a changelog on the company’s website, it mentions only that Siber programmers made changes to “increase randomness of generated passwords,” but it doesn’t say how they did this. Siber spokesman Simon Davis says that “RoboForm 7 was discontinued in 2017.”

Grand says that, without knowing how Siber fixed the issue, attackers may still be able to regenerate passwords generated by versions of RoboForm released before the fix in 2015. He’s also not sure if current versions contain the problem.

“I'm still not sure I would trust it without knowing how they actually improved the password generation in more recent versions,” he says. “I'm not sure if RoboForm knew how bad this particular weakness was.”

Customers may also still be using passwords that were generated with the early versions of the program before the fix. It doesn’t appear that Siber ever notified customers when it released the fixed version 7.9.14 in 2015 that they should generate new passwords for critical accounts or data. The company didn’t respond to a question about this.

If Siber didn’t inform customers, this would mean that anyone like Michael who used RoboForm to generate passwords prior to 2015—and are still using those passwords—may have vulnerable passwords that hackers can regenerate.

“We know that most people don't change passwords unless they're prompted to do so,” Grand says. “Out of 935 passwords in my password manager (not RoboForm), 220 of them are from 2015 and earlier, and most of them are \[for\] sites I still use.”

Depending on what the company did to fix the issue in 2015, newer passwords may also be vulnerable.

Last November, Grand and Bruno deducted a percentage of bitcoins from Michael’s account for the work they did, then gave him the password to access the rest. The bitcoin was worth $38,000 per coin at the time. Michael waited until it rose to $62,000 per coin and sold some of it. He now has 30 BTC, now worth $3 million, and is waiting for the value to rise to $100,000 per coin.

Michael says he was lucky that he lost the password years ago because, otherwise, he would have sold off the bitcoin when it was worth $40,000 a coin and missed out on a greater fortune.

“That I lost the password was financially a good thing.”

How Researchers Cracked an 11-Year-Old Password to a $3 Million Crypto Wallet

Police are using subtle psychological operations against ransomware gangs to sow distrust in their ranks—and trick them into emerging from the shadows.

Russian cybercriminals are almost untouchable. For years, hackers based in the country have launched devastating ransomware attacks against hospitals, critical infrastructure, and businesses, causing billions in losses. But they’re out of reach of Western law enforcement and largely ignored by the Russian authorities. When police do take the criminals’ servers and websites offline, they’re often back hacking within weeks.

Now investigators are increasingly adding a new dimension to their disruption playbook: messing with cybercriminals’ minds. To put it bluntly, they’re trolling the hackers.

In recent months, Western law enforcement officials have turned to psychological measures as an added way to slow down Russian hackers and cut to the heart of the sweeping cybercrime ecosystem. These nascent psyops include efforts to erode the limited trust the criminals have in each other, driving subtle wedges between fragile hacker egos, and sending offenders personalized messages showing they’re being watched.

“We’re never going to get to the kernel of these organized criminal gangs, but if we can minimize the impact they have by reducing their ability to scale, then that's a good thing,” says Don Smith, vice president of threat research at security firm Secureworks. “All of these little things, which in themselves may not be a killer blow, they all add friction,” he says. “You can look for cracks, amplify them, and create further discord and mistrust so it slows down what the bad guys are doing.”

Take Operation Cronos. In February, a global law enforcement operation, led by the UK’s National Crime Agency (NCA), infiltrated the LockBit ransomware group, which authorities say has extorted more than $500 million from victims, and took its systems offline. Investigators at the NCA redesigned LockBit’s leak website, where it published its victims’ stolen data, and used the site to publish LockBit’s inner workings.

Demonstrating the control and data they had, law enforcement published images of LockBit’s administration system and internal conversations. Investigators also published the usernames and login details of 194 LockBit “affiliate” members. This was expanded in May to include the members’ surnames.

The policing operation also teased the unveiling of “LockBitSupp,” the mastermind behind the group, and said they had been “engaging” with law enforcement. Russian national Dmitry Yuryevich Khoroshev was charged with running LockBit in May, following a multiday countdown clock being published on the seized LockBit website and bold graphics naming him as the group’s organizer.

“LockBit prided itself on its brand and anonymity, valuing these things above anything else," says Paul Foster, director of threat leadership at the NCA. “Our operation has shattered that anonymity and completely undermined the brand, driving cybercriminals away from using their services.” The NCA says it carefully considered the operation, with its efforts to rebuild LockBit's site leading to the group being widely mocked online and making its brand “toxic” to cybercriminals who had worked with it.

“We recognized that a technical disruption in isolation wouldn’t necessarily destroy LockBit, therefore our additional infiltration and control, alongside arrests and sanctions in partnership with our international partners, has enhanced our impact on LockBit and created a platform for more law enforcement action in the future,” Foster says.

When LockBit members logged in to the group’s administration systems, they received a personalized message saying authorities had gathered their username, cryptocurrency wallet details, internal chats and chats with victims, and IP addresses. As noted by researchers at cybersecurity firm Analyst1, these “psychological tactics” targeted two areas: “brand reputation and interpersonal relationships among actors.”

The efforts go beyond the LockBit takedown. In April, London’s Metropolitan Police disrupted LabHost, a service that allowed scammers to create phishing websites to trick people into handing over their emails and passwords. Around 800 criminal LabHost users were sent personalized video messages by the police detailing “all the data we have about you.” Countries where they targeted victims were included, as well as IP addresses they had used. “We’ve been watching you every time you visited us,” the voiceover in the video says.

“These messages aren't just for the existing participants in the criminal ecosystem,” says Secureworks’ Smith. “These are messages for people who maybe are on the edge of deciding to participate.” Within the sprawling cybercrime ecosystem, there’s not much trust between thieves who can con each other out of millions of dollars, but reinforcing and amplifying the divisions has the potential to make it harder to organize efficient criminal enterprises.

Understanding how much of an impact psychological operations have is difficult, but researchers say the criminals are always watching. Of 194 LockBit affiliates, only 69 have returned to the platform since the law enforcement action in February, the NCA says. The hackers read the news and cybersecurity research, discussing it on Russian-language cybercrime forums, researchers say. The XSS forum has one thread called “Juicy arrests” that has more than 1,000 posts since 2017, says Victoria Kivilevich, director of threat research at security firm KELA, which monitors the cybercriminal underground.

Opinions on the LockBit takedown were divided among XSS users, Kivilevich says. In one post in February, Kivilevich says, a cybercriminal questioned why the group’s leader had not been named or sanctioned at that point. “They have that much information, they must have at least something about him,” a translated post reads. “Or maybe he works with them.” Another urged people not to make memes or joke about the situation. “You understand that at some point this may affect you too,” they wrote.

Kivilevich points to other instances where cybercriminals on forums have become disillusioned or disgruntled by law enforcement targeting some members. When members of the Conti and Trickbot ransomware groups were sanctioned in February 2023, LockBitSupp asked where the sanctions were for the Trickbot leader “Stern” and other high-profile actor “Baddie.” As a further 11 members of Conti and Trickbot were sanctioned in September 2023, days after WIRED named one of the members, a cybercriminal complained that some of those sanctioned “never have had high profiles.” They went on to say there is a feeling of “injustice”: “What was the point of adding fucking managers who didn’t decide much in the business.”

Andréanne Bergeron, director of research at security firm GoSecure who specializes in criminal behavior and police intervention, says there may be two outcomes from naming some criminals and not others. Those that are named may “feel it is unjust to be punished while others go free” and may end up cooperating or working with law enforcement as a result.

Bergeron also says malicious hackers often “crave recognition” for their actions. “When their colleagues receive all the ‘credit,’ even if it includes being sanctioned, these unnamed individuals may feel compelled to reveal themselves to gain recognition,” Bergeron says. “This desire for recognition can drive them to engage in risky behaviors, potentially exposing themselves to authorities in their pursuit of validation.”

While law enforcement may be using some psychological tactics alongside more traditional technical takedowns and sanctions, there’s also scientific research looking at the ways in which cyber psychology can disrupt criminal hackers. The US Intelligence Community's research agency, the Intelligence Advanced Research Projects Activity (Iarpa), has started work on a project to create new cybersecurity defenses by exploiting the human weaknesses of attackers.

Psychology can be used as a way to “understand, anticipate, and influence” the behavior of cyberattackers, says Kimberly Ferguson-Walter, the Iarpa program manager leading the project. The research, which is in its early stages, is looking to build tools and methods to capitalize on the human weaknesses of cybercriminals based on established psychology principles. For instance, if an attacker can be made to feel like they are safe when they are compromising a system, they may engage in riskier behavior and expose themselves.

“If you can deter somebody from attacking your network, that’s about as good as it gets,” Ferguson-Walter says. “I think the more scared or uncertain they are about how the defenses work, the better your odds for doing that are."

Cops Are Just Trolling Cybercriminals Now

Plus: US surveillance reportedly targets pro-Palestinian protesters, the FBI arrests a man for AI-generated CSAM, and stalkerware targets hotel computers.

Sex, drugs, and … Eventbrite? A WIRED investigation published this week uncovered a network of spammers and scammers pushing the illegal sale of controlled substances like Xanax and oxycodone, escort services, social media accounts, and personal information on the event management platform. Making matters worse, Eventbrite’s recommendation algorithm promoted posts for opioids alongside addiction recovery events. The good news is, the company appears to have removed most of the more than 7,400 illicit posts WIRED uncovered.

If you drive a Tesla Model 3, make sure to enable your PIN-to-drive feature or your car could be easily stolen within seconds. While the company has added new ultra-wideband radio tech to its keyless system, which can prevent “relay attacks,” researchers at Beijing-based security firm GoGoByte found that Model 3s (as well as other unnamed makes and models of vehicles) are still vulnerable. Relay attacks use inexpensive radios to transmit the signal from someone’s key fob or phone app that can then be used to unlock and start an impacted vehicle. Tesla says its adoption of ultra-wideband radio was not meant to stop relay attacks (even though it technically could), but it’s possible the automaker will add that protection in the future.

Police busting people for running illicit online markets is nearly as old a tale as the dark web itself. But this week’s takedown offered a new twist. The FBI recently arrested Lin Rui-siang, a 23-year-old accused of operating Incognito Market, which authorities claim facilitated $100 million in sales of narcotics on the dark web. US prosecutors claim Lin then extorted Incognito’s users by threatening to expose them unless they paid up. Curiously, Lin’s professional experience includes teaching police how to catch cybercriminals by tracing cryptocurrency on blockchains. If the US Justice Department is correct about his alleged involvement in Incognito Market, that would make him one of the most unusual cybercriminals we’ve ever encountered.

Leaks don’t just impact people on the wrong side of the law, of course. An unsecured database recently exposed biometric data of police officers in India, including face scans, fingerprints, and more. The incident reveals the dangers of collecting sensitive biometrics in the first place.

Finally, the saga of WikiLeaks founder Julian Assange inched forward again this week, with a British court ruling that he can appeal his extradition to the US, where he faces 18 charges under the Espionage Act for WikiLeaks’ publication of classified US military information. The judges said that Assange can appeal US prosecutors’ assurances about how his trial would be conducted and on First Amendment grounds. The appeals process will inevitably push back any final decision about his potential extradition for months.

But that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

Following the trend of tech companies in the AI race throwing privacy and caution to the wind, Microsoft unveiled plans this week to launch a tool on its forthcoming Copilot+ PCs called Recall that takes screenshots of its customers’ computers every few seconds. Microsoft says the tool is meant to give people the ability to “find the content you have viewed on your device.” The company also claims to have a range of protections in place and says the images are only stored locally in an encrypted drive, but the response has been roundly negative nonetheless, with some watchdogs reportedly calling it a possible “privacy nightmare.” The company notes that an intruder would need a password and physical access to the device to view any of the screenshots, which should rule out the possibility of anyone with legal concerns ever adopting the system. Ironically, Recall’s description sounds eerily reminiscent of computer monitoring software the FBI has used in the past. Microsoft even acknowledges that the system takes no steps to redact passwords or financial information.

**US Surveillance Reportedly Targets Pro-Palestinian Protesters**

Federal authorities are reportedly working quietly to establish ties between antiwar demonstrators on US campuses and any foreign groups or individuals overseas, according to journalist Ken Klippenstein, formerly of the Intercept, who says the National Counterterrorism Center is at the center of the effort. Evidence of overseas ties would lend further ammunition to politicians, university officials, and police, who’ve widely claimed “outside agitators” are to blame for the demonstrations—an allegation that’s routinely lobbed at protesters in the United States, often meant to imply that the protesters themselves are dupes. Incidentally, authorities may also overcome constitutional hurdles to surveillance by establishing a foreign target to spy on; someone unprotected by the country’s Fourth Amendment. Republicans in Congress—representatives Mark Green and August Pfluger—have, meanwhile, asked the FBI and Department of Homeland Security to supply congressional committees with records about the government’s surveillance of the protesters, including any efforts to infiltrate them using “online covert employees or confidential human sources.”

**FBI Arrests Man for AI-Generated CSAM**

The FBI has nabbed a 42-year-old Wisconsin man for using Stable Diffusion, the text-to-image generative AI software, to manufacture child sexual abuse material. The man was reportedly caught with “thousands of realistic images” of children, some featuring them nude or partially clothed with men. Court records indicate the evidence includes more than 13,000 gen-AI images as well as the prompts he used to create the images. “Using AI to produce sexually explicit depictions of children is illegal, and the Justice Department will not hesitate to hold accountable those who possess, produce, or distribute AI-generated child sexual abuse material,” Nicole Argentieri, head of the Justice Department’s Criminal Division, says in a statement. The arrest is part of Project Safe Childhood, a collaboration between the government and corporations reportedly targeting online offenders.

**Stalkerware Targets US Hotel Computer Systems**

Security researchers this week disclosed to TechCrunch that they’d discovered consumer-grade spyware—often known as “stalkerware”—on the computers of “at least three” Wyndham hotels in the United States, potentially exposing travelers’ personal details. The stalkerware, called pcTattletale, can be installed on Android and Windows devices, giving whoever has control of the sneaky app the ability to access data on the targeted machine and monitor users’ activity. The presence of pcTattletale was discovered thanks to a security flaw in the spyware that exposed screenshots of infected machines to the open internet, according to the researchers. Although the researchers found pcTattletale on Wyndham computers, the hotel company says each of its locations are franchises, suggesting that the spyware infection could be limited to just a few locations.

Microsoft’s New Recall AI Tool May Be a ‘Privacy Nightmare’

The strange journey of Lin Rui-siang, the 23-year-old accused of running the Incognito black market, extorting his own site’s users—and then refashioning himself as a legit crypto crime expert.

Two months ago, Lin Rui-siang, a young Taiwanese man wearing black-rimmed glasses and a white polo shirt, stood behind a lectern emblazoned with the crest of the St. Lucia police, giving a presentation titled “Cyber Crime and Cryptocurrency” in nearly fluent English to a roomful of cops from the tiny Caribbean country.

The St. Lucia government would later issue a press release lauding the success of Lin's training course, which had been organized by the Taiwanese embassy, where Lin worked as a diplomatic specialist in IT. The statement boasted that 30 officers had learned “nuances of the dark web" and cryptocurrency tracing skills from Lin, who had “used his professional background and qualifications in the field" to teach them how to better combat cybercrime.

Only earlier this week did it become clear exactly what Lin's “professional background and qualifications in the field” allegedly entailed, seemingly unbeknownst to either his Taiwanese employers or his St. Lucian law enforcement trainees. For nearly four years, according to the US Justice Department, 23-year-old Lin ran a dark-web drug market called Incognito that authorities say enabled the sale of at least $100 million worth of narcotics, ranging from MDMA to heroin for cryptocurrencies including bitcoin and monero. That was before Lin's alleged theft of his own users' funds earlier this year and then his arrest last week by the FBI in New York's JFK airport.

Over his years working as a cryptocurrency-focused intern at Cathay Financial Holdings in Taipei and then as a young IT staffer at St. Lucia's Taiwanese embassy, Lin allegedly lived a double life as a dark-web figure who called himself “Pharoah" or “faro”—a persona whose track record qualifies as remarkably strange and contradictory even for the dark web, where secret lives are standard issue. In his short career, Pharoah launched Incognito, built it into a popular crypto black market with some of the dark web's better safety and security features, then abruptly stole the funds of the market's customers and drug dealers in a so-called “exit scam” and, in a particularly malicious new twist, extorted those users with threats of releasing their transaction details.

During those same busy years, Pharoah also launched a web service called Antinalysis, designed to defeat crypto money laundering countermeasures—only for Lin, who prosecutors say controlled that Pharoah persona, to later refashion himself as a crypto-focused law enforcement trainer. Finally, despite his supposed expertise in cryptocurrency tracing and digital privacy, it was Lin's own relatively sloppy money trails that, the DOJ claims, helped the FBI to trace his real identity.

An April post on Lin Rui-siang’s LinkedIn account about his cybercrime and cryptocurrency training course for police in St. Lucia.

Among all those incongruities, though, it's the image of Lin giving his cryptocurrency crime training in St. Lucia—which Lin proudly posted to his LinkedIn account—that shocked Tom Robinson, a cofounder of the blockchain analysis firm Elliptic, who has long tracked Lin's alleged Pharoah alter ego. “This is an alleged dark-net market admin standing in front of police officers, showing them how to use blockchain analytics tools to track down criminals online,” says Robinson. “Assuming he is who the FBI says he is, it's incredibly ironic and brazen.”

**Pharoah the Kingpin—and Extortionist**

Lin has been charged with not only narcotics conspiracy and money laundering but also running a “continuing criminal enterprise,” the so-called “kingpin statute” reserved for organized crime leaders who allegedly oversaw at least five employees. For that charge alone, he faces a potential life sentence.

In the DOJ's criminal complaint against Lin, it points to a handwritten document the FBI pulled from his email, which appears to sketch out a flow chart for a dark-web market's mechanics. The complaint's FBI affidavit says Lin emailed himself the sketch in March 2020 when he was at most 19 years old. It describes functionality such as how “vendors” and “buyers” would register, make purchases, and encrypt shipping addresses. Seven months later, Lin would allegedly launch Incognito Market.

A sketch of a dark-web market's infrastructure that Lin emailed to himself eight months before allegedly creating Incognito Market, according to the DOJ.

According to the FBI, the market took nearly a year to catch on, with virtually no sales during that time. But by late 2021, Incognito had started to attract users, and by the middle of 2022, the market had drawn enough vendors and sellers to generate more than $1.5 million a month in sales.

A 2022 Twitter thread about Incognito posted by Eileen Ormsby, an author of several dark-web-focused books including _The Darkest Web_, shows how the market by that time had added features that may have helped it to catch the attention of security- and safety-conscious users. It required that new users demonstrate they could use the encryption tool PGP before entering the market, prompted them to take a security quiz, allowed buyers to spend the more privacy-focused cryptocurrency monero as well as bitcoin, encouraged dealers to post results from a fentanyl test to certify their product was “fent free,” and even experimented with democratic voting for market-wide decisions.

By the summer of 2023, Incognito had spiked in popularity and was approaching $5 million a month in sales. Then in March of this year, the site suddenly dropped offline, taking all the funds stored in buyers' and sellers' wallets with it. A few days later, the site reappeared with a new message on its homepage. “Expecting to hear the last of us yet?” it read. “We got one final little nasty surprise for y'all.”

The message explained that Incognito was now essentially blackmailing its former users: It had stored their messages and transaction records, it said, and added that it would be creating a “whitelist portal” where users could pay a fee—which for some dealers would later be set as high as $20,000—to remove their data before all the incriminating information was leaked online at the end of this month. “YES THIS IS AN EXTORTION!!!” the message added.

In retrospect, Ormsby says that the site's apparent user-friendliness and its security features were perhaps a multiyear con laying the groundwork for its endgame, a kind of user extortion never seen before in dark-web drug markets. “Maybe the whole thing was set up to create a false sense of security,” Ormsby says. “The extorting thing is completely new to me. But if you've lulled people into a sense of security, I guess it's easier to extort them.”

In total, Incognito Market promised to leak more than half a million drug transaction records if buyers and sellers didn't pay to remove them from the data dump. It's still not clear whether the market's administrator—Lin, according to prosecutors, whom they accuse of personally carrying out the extortion campaign—planned to follow through on the threat: He appears to have been arrested before the deadline set for the victims of the Incognito blackmail.

**An Expert in ‘Anti Anti-Money Laundering’**

At the same time the FBI says Lin was laying the groundwork for this double-cross, he also appears to have briefly tried engineering an entirely different scheme. In the summer of 2021, during Incognito Market's relatively quiet first year, Lin's alleged alter ego, Pharoah, launched a service called Antinalysis, a website designed to analyze blockchains and let users check—for a fee—whether their cryptocurrency could be connected to criminal transactions.

In a post to the dark-web market forum Dread, Pharoah made clear that Antinalysis was designed not to help anti-money-laundering investigators, but rather those who sought to evade them—presumably including his own dark-web market's users. “Our goals do not lie in aiding the surveillance autocracy of state-sponsored agencies,” Pharoah's post read. “This service is dedicated to individuals that have the need to possess complete privacy on the blockchain, offering a perspective from the opponent's point of view in order for the user to comprehend the possibility of his/her funds getting flagged down under autocratic illegal charges.”

After independent cybersecurity reporter Brian Krebs wrote about the Antinalysis service in August 2021, describing it as an “anti anti-money laundering service for crooks,” Pharoah posted another message complaining that Antinalysis had lost access to its blockchain data source, which Krebs had identified as the anti-money-laundering tool AMLBot, and that it would be going offline. “Stay posted and fuck LE," Pharoah wrote, using the abbreviation LE to mean “law enforcement.” Antinalysis eventually returned, however, and pivoted last year to acting instead as a service for swapping bitcoin for monero and vice versa.

Meanwhile, Lin appears to have maintained his obsession with cryptocurrency tracing and blockchain analysis: His final LinkedIn post last week before his arrest in New York announced that he had become a certified user of Reactor, the crypto tracing tool sold by blockchain analysis firm Chainalysis. “I'm excited to share that I've completed Chainalysis's new qualification: Chainalysis Reactor Certification (CRC)!” Lin wrote in Mandarin. His last X post shows a Chainalysis diagram of money flows between dark-web markets and cryptocurrency exchanges.

It's not clear whether Lin obtained his Chainalysis certification to bolster a new career training law enforcement in blockchain analysis or, if US prosecutors are to be believed, to advance his previous alleged career as a dark-web criminal. But it raises the troubling possibility that a former dark-web kingpin—one who was still extorting his own users—was perhaps playing both sides of the crypto tracing game, says Elliptic's Tom Robinson.

“There’s a larger issue here about bad actors accessing blockchain analytics tools,” says Robinson. “That is a potentially risky situation, where someone who’s in the process of laundering proceeds of crime can check in commercially available tools whether they have laundered them such that they can get away with it.” Running certain checks in those tools might even allow someone to determine if they're being actively investigated by law enforcement, Robinson says.

WIRED reached out to Chainalysis to ask about Lin's Reactor certification and what sort of safeguards prevent criminals from using the company's software, but the company declined to comment.

If Lin did hope to evade law enforcement by becoming an expert in crypto tracing himself, he was far too late to avoid creating his own blockchain trail of evidence: In January of this year, the FBI says it somehow identified a central Incognito server and obtained a search warrant for its contents. That allowed investigators to identify a bitcoin wallet stored there, which the FBI says Lin had also carelessly used to pay web registrar Namecheap for four web domains—including one that tracked which dark-web markets were online or down—and register them under his own name.

Although the FBI says Lin tried to swap his bitcoins for harder-to-trace monero before cashing out the cryptocurrency at an exchange, the criminal complaint points to timing and amount correlations that nonetheless allowed the FBI to follow his funds to a crypto exchange where he allegedly liquidated the dirty funds. That exchange account, too, was registered in Lin's real name, according to the DOJ.

The operational security mistakes the FBI describes suggest that, regardless of which side of the cryptocurrency cat-and-mouse game Lin intended to end up on, he was far from a criminal mastermind. His brief, strange journey from alleged kingpin to crypto crime expert ultimately provides plenty of lessons to criminals and law enforcement alike—though probably not the ones he intended.

Source

Wired