Deepfake scam services. Victim data. Electrified shackles for human trafficking. Crypto tracing firm Elliptic found all were available for sale on an online marketplace linked to Cambodia’s ruling family.

As the crypto scam commonly known as “pig butchering” has exploded into a full-blown criminal industry that steals tens of billions of dollars a year, an entire ecosystem has formed around it. That sub-industry offers tools and data for finding and tricking targets, money laundering services to help liquidate stolen funds—even detention tools to imprison and coerce the human trafficking victims enslaved to work in scam operations.

New research now shows how all of those secondary services enabling the global scourge of pig butchering can be found on a single Cambodian online platform—part of a company linked to the Cambodian ruling family—known as Huione Guarantee.

On Wednesday, crypto-tracing firm Elliptic published a report that delves into crypto scammers’ extensive use of Huione Guarantee, a deposit and escrow service for peer-to-peer transactions that lets users buy and sell over the Telegram messaging service with the cryptocurrency Tether while preventing them from defrauding each other. By analyzing listings on the platform, engaging with sellers—sometimes undercover—and following funds across Tether’s blockchain sent to those sellers’ addresses, Elliptic was able to trace $11 billion in total transactions in just the three years since Huione Guarantee launched, including $3.4 billion so far this year.

Total transactions in the cryptocurrency Tether made via Huione Guarantee’s platform since its founding.

Courtesy of Elliptic

Elliptic estimates, based largely on public Chinese-language advertisements for the products and services available on Huione Guarantee, that the majority of those transactions were in service of pig butchering. “I’m not sure whether Huione Guarantee was originally established with this in mind, but it’s certainly become primarily a marketplace for online scammers,” says Tom Robinson, Elliptic’s cofounder and chief scientist. Robinson says Elliptic knows of around 10 platforms like Huione Guarantee that are used by crypto scammers, but none that are nearly so big. “This is the largest public guarantee platform for illicit crypto transactions that we’re aware of,” he says.

By some estimates, pig butchering scams have netted a whopping $75 billion from the start of 2020 to February of this year. The FBI said in April that reported crypto-investment fraud losses for the US hit $3.94 billion in 2023. In addition to scam victims, who are tricked into buying cryptocurrency and transferring it to criminals, the scammers on the other end are often victims of elaborate forced-labor schemes. Compounds where people are forced to live and work generating content to target scam victims have been reported in Myanmar, the Philippines, Cambodia, and other countries in Southeast Asia.

A listing on Huione Guaranteed for a scam-focused deepfake face-alteration tool.

Courtesy of Elliptic

Huione Guarantee’s crypto scam offerings span the entire food chain of the pig butchering industry: The researchers found shock-enabled GPS tracking shackles and electric batons for sale, used in the human trafficking operations that force enslaved victims to work on scam operations day in and day out in compounds across Southeast Asia. Other listings offered data on potential scam targets, fake investment websites to persuade targets to transfer funds, and deepfake face-altering services advertised for tricking scam victims. Finally, money laundering services advertised on Huione Guarantee offered to liquidate and obfuscate the source of the scammers’ stolen Tether, which accounted for the majority of the platform’s money flows.

“I would hypothesize that this is one of the drivers behind the increasing scale of these scams,” says Robinson. “Scammers no longer need to acquire victims' contact details, build telecoms infrastructure, or launder the scam proceeds themselves. They can outsource each of these to this community of service providers.”

WIRED reached out to the public email address listed on Huione Group’s website and several of its executives for comment but didn’t yet receive a response.

A listing on Huione Guaranteed for an electric baton, intended to be used to coerce enslaved laborers inside scam compounds.

Courtesy of Elliptic

Beyond Huione Guarantee, crypto scamming researchers say they’ve seen signs of code and toolkits being circulated and re-used between pig butchering operations. For example, Sean Gallagher, a senior threat researcher at Sophos, says he's recognized the same code underlying multiple fake crypto investment platforms and exchanges meant to trick victims into depositing their funds. “There are a number of identical kits I was seeing being run on different infrastructure with different domain names,” Gallagher says

Robinson notes that Elliptic wasn’t able to penetrate some “VIP” Telegram channels that appeared to be selling scam-related offerings on Huione Guarantee’s platform. That means, in fact, that the $11 billion in total revenue since 2021 is a lower bound for the marketplace’s total business, since Elliptic couldn’t identify some sellers’ Tether addresses. But otherwise, the platform’s bustling business in crypto scam products and services is largely conducted in public, albeit using Chinese-language jargon that can be difficult to penetrate: a “quick kill,” for instance, refers to a financial scam, while “runaway dogs” refers to trafficked prisoners who might try to escape, and “dog pushers” refers to those working in the scammer compounds.

That public nature of the criminal transactions is all the more shocking given that Huione Guarantee is operated by Huione Group, a Cambodian financial conglomerate that includes a company linked to the family of Cambodia’s prime minister, Hun Manet. One of the companies' directors, in fact, is Hun To, the prime minister’s cousin, who has been linked in an Al Jazeera investigation to an alleged scam compound reportedly owned by Heng He, a Cambodian conglomerate owned by two Chinese nationals.

Crypto scam researchers say that Huione Guarantee, despite its size, is just one of many money laundering methods that pig butcherers use. Given that much of the pig butchering ecosystem has ties to Chinese organized crime, pig butchering revenue is often laundered in a decentralized way by convincing individual Chinese citizens to accept and hand off cryptocurrency through their personal Alipay accounts for a small fee, notes Gary Warner, director of intelligence at cybersecurity firm DarkTower. Markets like Huione Guarantee, however, offer a path for scammers who don’t already have a laundering network they can rely on or who need to diversify their options for liquidating funds.

A listing on Huione Guaranteed for electrified GPS-tracking shackles for detaining enslaved scam laborers.

Courtesy of Elliptic

It’s perhaps no surprise that Huione Guarantee began operating in 2021, given that crypto scams surged during the Covid-19 pandemic. Sophos’ Gallagher notes that in Cambodia, pig butchering operations are largely run out of hotels and resorts that struggled with plummeting tourism in 2020 and 2021. “They were financed heavily or outright owned by Chinese companies in connection with special economic zones and other development tied to Belt and Road,” he says. Gallagher’s research indicates that laborers working on pig butchering in Cambodia—often against their will—are typically not citizens but have come from the surrounding region. “These facilities follow the same playbook as far as taking people’s passports and then using electrical shocks, cattle prods, and other physical punishment for not following the rules.”

As disturbing as it may be that a service enabling billions of dollars annually in crypto scam industry transactions is being run in the open—and with links to one of Cambodia’s most powerful families—Elliptic’s Robinson suggests that brazenness offers an opportunity to disrupt a keystone of that criminal industry: He proposes international sanctions targeting Huione’s leadership.

“This has the hallmarks of a darknet marketplace, but it's run by a large Cambodian conglomerate, which has documented links to the ruling family there,” Robinson argues. “There is surely scope to impose sanctions on a business such as this, to hinder this type of marketplace from operating.”

The $11 Billion Marketplace Enabling the Crypto Scam Economy

The US military has abandoned its half-century dream of a suit of powered armor in favor of a “hyper enabled operator,” a tactical AI assistant for special operations forces.

The day is slowly turning into night, and the American special operators are growing concerned. They are deployed to a densely populated urban center in a politically volatile region, and local activity has grown increasingly frenetic in recent days, the roads and markets overflowing with more than the normal bustle of city life. Intelligence suggests the threat level in the city is high, but the specifics are vague, and the team needs to maintain a low profile—a firefight could bring known hostile elements down upon them. To assess potential threats, the Americans decide to take a more cautious approach. Eschewing conspicuous tactical gear in favor of blending in with potential crowds, an operator steps out into the neighborhood's main thoroughfare to see what he can see.

With a click of a button, the operator sees … everything. A complex suite of sensors affixed to his head-up display start vacuuming up information from the world around him. Body language, heart rates, facial expressions, and even ambient snatches of conversation in local dialects are rapidly collected and routed through his backpack supercomputers for processing with the help of an onboard artificial intelligence engine. The information is instantly analyzed, streamlined, and regurgitated back into the head-up display. The assessment from the operators’ tactical AI sidekick comes back clear: There are a series of seasonal events coming into town, and most passersby are excited and exuberant, presenting a minimal threat to the team. Crisis averted—for now.

This is one of many potential scenarios repeatedly presented by Defense Department officials in recent years when discussing the future of US special operations forces, those elite troops tasked with facing the world’s most complex threats head-on as the “tip of the spear” of the US military. Both defense officials and science-fiction scribes may have envisioned a future of warfare shaped by brain implants and performing enhancing drugs, or a suit of powered armor straight out of _Starship Troopers_, but according to US Special Operations Command, the next generation of armed conflict will be fought (and, hopefully, won) with a relatively simple concept: the “hyper enabled operator.”

**More Brains, Less Brawn**

First introduced to the public in 2019 in an essay by officials from SOCOM’s Joint Acquisition Task Force (JATF) for Small Wars Journal, the hyper-enabled operator (HEO) concept is the successor program to the Tactical Assault Light Operator Suit (TALOS) effort that, initiated in 2013, sought to outfit US special operations forces with a so-called “Iron Man” suit. Inspired by the 2012 death of a Navy SEAL during a hostage rescue operation in Afghanistan, TALOS was intended to improve operators’ survivability in combat by making them virtually resistant to small-arms fire through additional layers of sophisticated armor, the latest installment of the Pentagon’s decades-long effort to build a powered exoskeleton for infantry troops. While the TALOS effort was declared dead in 2019 due to challenges integrating its disparate systems into one cohesive unit, the lessons learned from the program gave rise to the HEO as a natural successor.

The core objective of the HEO concept is straightforward: to give warfighters “cognitive overmatch” on the battlefield, or “the ability to dominate the situation by making informed decisions faster than the opponent,” as SOCOM officials put it. Rather than bestowing US special operations forces with physical advantages through next-generation body armor and exotic weaponry, the future operator will head into battle with technologies designed to boost their situational awareness and relevant decisionmaking to superior levels compared to the adversary. Former fighter pilot and Air Force colonel John Boyd proposed the “OODA loop” (observe, orient, decide, act) as the core military decisionmaking model of the 21st century; the HEO concept seeks to use technology to “tighten” that loop so far that operators are quite literally making smarter and faster decisions than the enemy.

“The goal of HEO,” as SOCOM officials put it in 2019, “is to get the right information to the right person at the right time.”

To achieve this goal, the HEO concept calls for swapping the powered armor at the heart of the TALOS effort for sophisticated communications equipment and a robust sensor suite built on advanced computing architecture, allowing the operator to vacuum up relevant data and distill it into actionable information through a simple interface like a head-up display—and do so “at the edge,” in places where traditional communications networks may not be available. If TALOS was envisioned as an “Iron Man'' suit, as I previously observed, then HEO is essentially Jarvis, Tony Stark’s built-in AI assistant that’s constantly feeding him information through his helmet’s head-up display.

“\[JATF\] is targeting technologies to deliver cognitive overmatch to SOF operators working at the edge in austere and contested environments in coordination with and working through partners and allies,” SOCOM spokesperson James O. Gregory tells WIRED, invoking a general description of the program from the command’s website. “Such technologies will enable tactical teams of SOF operators to intuitively use information made available by next-generation sensors, networks, computing, and communication systems to rapidly build situation awareness. It will also help make timely, well-informed decisions, and take actions inside an adversary's ability to react.”

**Enter the Gray Zone**

So what does the HEO actually look like today, five years after its introduction into the US military’s tactical lexicon? Given the sensitive (and somewhat notional) nature of the effort, details remain scarce, and SOCOM officials have remained relatively tight-lipped about its progress. But according to SOCOM’s Gregory, the scenario and concept the HEO seeks to address has “evolved” from what officials previously described to reporters at the program’s inception. Indeed, rather than augmenting warfighters deployed to active combat zones, SOCOM officials envision something more like a casually dressed operator vacuuming up information on a busy urban avenue through a Google Glass-like eyepiece and sizing up the situation—in other words, more James Bond than Tony Stark.

“The operational environment for the JATF’s current efforts is in the competition phase of warfare, in permissive or semi-permissive locations,” Gregory says. (A permissive environment is generally defined as an operational environment where US forces have the backing of a host country’s security apparatus, according to the US Army, while a “semi-permissive” environment is potentially hostile and local support is often not reliable.) No longer just another tool for a kinetic assault, the HEO will help elite troops operating in the “gray zone” between peace and conflict.

A SOCOM broad agency announcement—a general request for research and development proposals from the defense industry—published in 2020 and updated as recently as November 2023 details the JATF’s push for advanced technologies designed to boost situational awareness. Those technologies include: intelligence, surveillance, and reconnaissance capabilities “without substantial manning or networking resources” (the aforementioned “at the edge”); sophisticated sensors capable of “iris, facial, anatomical measures, gestures, gait, heartbeat, electromagnetic signals, deoxyribonucleic acid \[DNA\], and microbiome recognition”; low-visibility communications systems; and “data visualizations” that “permit \[operators\] to receive and intuitively understand networked information from communication, computing, and sensor systems,” among others. In short, the HEO envisions systems that enable the constant, real-time collection and distillation of data into actionable intel that could potentially mean the difference between life and death in an uncertain situation.

**Edge Case**

Envisioning a suite of aspirational capabilities is one thing; actually building them is another thing entirely. In terms of developing new products, Gregory says that the HEO effort has remained focused on three major experimental technology areas for the last several years: sensing and edge computing, architecture and analysis, and language translation.

“Sensing and edge computing” generally refers to the collection and processing of data from a variety of sources, but it also refers to the specialized computing power that operators need not only to function “at the edge,” but to actually run the AI-enabled software that will form the foundation of the HEO.

“Emerging technologies and solutions in artificial intelligence/machine learning require specialized ‘compute’ hardware, as traditional CPU-based devices are insufficient,” Gregory says. “We aim to feature a manpack device with a graphics processing unit, neural processing engine, and/or tensor processing unit capabilities. This will provide the necessary platform to leverage advanced technologies like language translation and other solutions at the edge, even when disconnected from the cloud.”

That computing power forms the basis for the “architecture and analysis” element focused on the rapid assessment and presentation of data to operators in the field. Gregory tells WIRED that, to support this element, the command has developed “a flexible \[system\] architecture that fuses data from various sources and media types” into an easily digestible format for operators to assess and act upon.

As for language translation, that’s self-explanatory. SOCOM believes that “prior to any hostilities ever occurring, clear communication can greatly enhance development of our long-term relationships,” Gregory says. “Voice-to-voice translation enables operators to communicate more effectively than relying on often scarce interpreters in the field. Even though many SOF personnel are multilingual, they are frequently deployed to regions with different languages or dialects.”

In line with these experimental technology areas, SOCOM has reportedly concentrated on six immediate lines of product development, per C4ISRNet: the “operator-worn kit” that includes both sensors and onboard computer processing power; application development resources; a unique, mission-agnostic system architecture; the “human-machine interface” that’s generally envisioned as a digital head-up display; a product called “information realization” that likely involves the clear presentation of data; and beyond-line-of-sight (BLoS) communications designed to keep troops in contact with their commanders (and each other) in satellite-denied environments.

According to Gregory, the command has gradually rolled out a handful of fresh capabilities from the HEO effort in recent years. In 2021, SOCOM announced that two products—a BLoS communications system and an unspecified “integrated situational awareness tool”—were transitioning into official programs of record, as Janes reported at the time. Gregory confirmed to WIRED that the BLoS system consists of “a steerable gimble antenna system that enhances the functionality” of the command’s SOF deployable nodes, a family of advanced satellite communications systems. The spokesperson also confirmed that the situational awareness tool, known as SEEKER, is an app that “enables advisers to build advanced situational awareness, thereby allowing them to select actions with an eye toward the broader situation rather than just the immediately apparent problem.” It’s unclear if the latter is related to the “automate the analyst” effort the command kicked off in 2020 to provide operators with an autonomous AI assistant.

Then there’s the “visual environment translation” system that’s designed to convert foreign language inputs into clear English in real time. Known overarchingly as the Versatile Intelligent Translation Assistant (VITA), the system encompasses both a visual environment translation effort and voice-to-voice translation capabilities and is “the most mature” of the JATF’s experimental technology areas, according to SOCOM. VITA is essentially “a voice-to-voice translation engine that functions offline on GPU-enabled devices,” Gregory says, small enough to be carried in the field on a laptop-tethered smartphone or wearable device and “engage in effective conversations where it was previously impossible.” And not only has VITA successfully demonstrated Russian, Chinese Mandarin, and Ukrainian language translation capabilities during testing, but the system has even been deployed to two undisclosed theaters of operations already.

“The visual translation component enhances situational awareness by translating video images, such as street signs, graffiti, and other written texts, in real time,” Gregory says. “Operators can use their phone cameras to scan their surroundings and understand foreign languages instantly.”

VITA provides US special operations forces with “a high-quality translation capability that is not reliant on the cloud or local interpreters, thus significantly reducing risk and logistical costs while increasing operational range and effectiveness for USSOF and our partners,” Gregory says. “The JATF is currently working with industry partners to reduce the size of the hardware and transition it into a SOF Program Executive Office for eventual fielding.” (And that language translation may not be restricted to a mobile device for long: According to SOCOM’s fiscal year 2025 budget request published in March, the command is still plowing ahead with head-mounted sensors and an augmented-reality HUD to present these functions right before operators’ eyes.)

**Field Work**

To US military planners, the HEO concept is promising: According to one Army assessment, the successful adoption of the system could potentially increase operator survivability far beyond that provided by the additional body armor of the TALOS program. But like other potentially revolutionary technology ventures, there’s certainly the possibility that HEO could end up a science fiction dream that collapses under the weight of its own technical complexity. And there’s no guarantee that operators will embrace the new technology seamlessly in the first place: Although VITA has shown operational promise, it’s unclear if other HEO products will prove intuitive enough to actually augment operators in the field rather than burden them with some complicated newfangled system. As Heinlein put it so aptly in _Starship Troopers_: “If you load a mud foot down with a lot of gadgets that he has to watch, somebody a lot more simply equipped—say with a stone ax—will sneak up and bash his head in while he is trying to read a vernier.”

Perhaps, like TALOS, the promise of a tactical AI assistant like Tony Stark’s Jarvis sidekick may prove simply too ambitious for military engineers to realize in a fully formed product. But even if the HEO effort ends up only fielding, say, the VITA language translation tool, it will still represent a major boost in capabilities for US special operators deployed abroad. The day is slowly turning into night, but American commandos own the night and, with the help of the HEO, will do so well into the next conflict.

AI-Powered Super Soldiers Are More Than Just a Pipe Dream

Plus: Researchers uncover a new way to expose CSAM peddlers, OpenAI suffered a secret cyberattack, cryptocurrency thefts jump in 2024, and Twilio confirms hackers stole 33 million phone numbers.

Proton, the company behind Proton Mail, launched an end-to-end encrypted alternative to Google Docs, seeking to compete with the cloud giant on privacy. We broke down how Apple is taking a similar approach with its implementation of AI, using a system it calls Private Cloud Compute in its new Apple Intelligence features.

In other news, we dug into how the US bans on TikTok and Kaspersky software, despite their national security justifications, pose a threat to internet freedom. We went inside a crash course for US diplomats on cybersecurity, privacy, surveillance, and other digital threats. And we published an in-depth investigation into the origins of the world’s most popular 3D-printed gun, which revealed that its creator was a self-described “incel” with fantasies of right-wing terror.

But that’s not all. Each week, we round up the security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

The giant hack against Ticketmaster may have taken another twist. In June, criminal hackers claimed they had stolen 560 million people’s information from the ticketing company owned by Live Nation. The company has since confirmed a breach, saying its information was taken from its Snowflake account. (More than 165 Snowflake customers were impacted by attacks on the cloud storage company that exploited a lack of multi-factor authentication and stolen login details).

Now in a post on cybercrime marketplace BreachForums, a hacker going by the name of Sp1d3rHunters is threatening to publish more data from Ticketmaster. The account claims to be sharing 170,000 ticket barcodes for upcoming Taylor Swift gigs in the US during October and November. The hacker demanded Ticketmaster “pay us $2million USD” or it will leak “680 million” users’ information and publish millions more event barcodes, including for concerts by artists such as Pink and Sting, and sporting events such as NFL games and F1 races.

The claims appear to be dubious, however, as Ticketmaster's barcodes aren't static, according to the company. “Ticketmaster’s SafeTix technology protects tickets by automatically refreshing a new and unique barcode every few seconds so it cannot be stolen or copied,” a Ticketmaster spokesperson tells WIRED in a statement. The spokesperson adds that the company has not paid any ransom or engaged with the hackers’ demands.

Hacker groups are known to lie, exaggerate, and overinflate their claims as they try to get victims to pay. The 680 million customers that Sp1d3rHunters claimed to have data on is higher than the original figure provided when the Ticketmaster breach was first claimed, and neither number has been confirmed. Even if victims do decide to pay, hackers can still keep the data and try to extort companies for a second time.

Despite the breach at Ticketmaster originally being publicized in June, the company has only recently begun emailing customers alerting them to the incident, which happened between April 2 and May 18 this year. The company says the database accessed may include emails, phone numbers, encrypted credit card information, and other personal information.

**Stolen Login Details Can Unmask Child Abuse Viewers, Researchers Say**

In recent years, there’s been a sharp uptick in cybercriminals deploying infostealers. This malware can grab all of the login and financial details that someone enters on their machine, which hackers then sell to others who want to exploit the information.

Cybersecurity researchers at Recorded Future have now published proof-of-concept findings showing these stolen login details can be used to potentially track down people visiting dark-web child sexual abuse material (CSAM) sites. Within infostealer logs, the researchers say they were able to find thousands of login details for known CSAM websites, which they could then cross-reference with other details and identify the potential real-world names connected to the abusive website logins. The researchers reported details of individuals to law enforcement.

Hackers Leaking Taylor Swift Tickets? Don’t Get Your Hopes Up

Growing numbers of insurgents and extremists use the FGC-9. Forensic analysis of online platforms reveals the dark world of the man who created it—a self-described incel who supported the German far right.

The World’s Most Popular 3D-Printed Gun Was Designed by an Aspiring Terrorist

Generative AI is seeping into the core of your phone, but what does that mean for privacy? Here’s how Apple’s unique AI architecture compares to the “hybrid” approach adopted by Samsung and Google.

Yet Google and its hardware partners argue privacy and security are a major focus of the Android AI approach. VP Justin Choi, head of the security team, mobile eXperience business at Samsung Electronics, says its hybrid AI offers users “control over their data and uncompromising privacy.”

Choi describes how features processed in the cloud are protected by servers governed by strict policies. “Our on-device AI features provide another element of security by performing tasks locally on the device with no reliance on cloud servers, neither storing data on the device nor uploading it to the cloud,” Choi says.

Google says its data centers are designed with robust security measures, including physical security, access controls, and data encryption. When processing AI requests in the cloud, the company says, data stays within secure Google data center architecture and the firm is not sending your information to third parties.

Meanwhile, Galaxy’s AI engines are not trained with user data from on-device features, says Choi. Samsung “clearly indicates” which AI functions run on the device with its Galaxy AI symbol, and the smartphone maker adds a watermark to show when content has used generative AI.

The firm has also introduced a new security and privacy option called Advanced Intelligence settings to give users the choice to disable cloud-based AI capabilities.

Google says it “has a long history of protecting user data privacy,” adding that this applies to its AI features powered on-device and in the cloud. “We utilize on-device models, where data never leaves the phone, for sensitive cases such as screening phone calls,” Suzanne Frey, vice president of product trust at Google, tells WIRED.

Frey describes how Google products rely on its cloud-based models, which she says ensures “consumer's information, like sensitive information that you want to summarize, is never sent to a third party for processing.”

“We’ve remained committed to building AI-powered features that people can trust because they are secure by default and private by design, and most importantly, follow Google’s responsible AI principles that were first to be championed in the industry,” Frey says.

**Apple Changes the Conversation**

Rather than simply matching the “hybrid” approach to data processing, experts say Apple’s AI strategy has changed the nature of the conversation. “Everyone expected this on-device, privacy-first push, but what Apple actually did was say, it doesn’t matter what you do in AI—or where—it’s how you do it,” Doffman says. He thinks this “will likely define best practice across the smartphone AI space.”

Even so, Apple hasn’t won the AI privacy battle just yet: The deal with OpenAI—which sees Apple uncharacteristically opening up its iOS ecosystem to an outside vendor—could put a dent in its privacy claims.

Apple refutes Musk’s claims that the OpenAI partnership compromises iPhone security, with “privacy protections built in for users who access ChatGPT.” The company says you will be asked permission before your query is shared with ChatGPT, while IP addresses are obscured and OpenAI will not store requests—but ChatGPT’s data use policies still apply.

Partnering with another company is a “strange move” for Apple, but the decision “would not have been taken lightly,” says Jake Moore, global cybersecurity adviser at security firm ESET. While the exact privacy implications are not yet clear, he concedes that “some personal data may be collected on both sides and potentially analyzed by OpenAI.”

How Apple Intelligence’s Privacy Stacks Up Against Android’s ‘Hybrid AI’

Proton is adding an end-to-end encrypted documents editor to its privacy tools, boosting its competition with Google’s suite of productivity apps.

When particle physicist Andy Yen launched the privacy-focused email service Proton Mail as an ambitious crowdfunding campaign in 2014, the ultimate goal was to make it easier for people to be private online. Now, more than a decade on, his Switzerland-based company, Proton, is in the process of taking one of its biggest potential steps to reduce Google’s online dominance.

Today, Proton is launching the ability to create, edit, and collaborate on end-to-end encrypted documents within its online file storage systems. This means that only the creator of a document, and anyone they have shared it with, can view the contents of the file. Nobody else, including Proton, can see what has been written in the documents, according to the company.

The move to add encrypted documents to Proton is a shot at the data-hungry approaches of Google and Microsoft, which both host individual and business cloud services but don’t encrypt files and can also collect vast amounts of data about people. It also makes Proton one of only a handful of businesses providing encrypted documents and editing online.

“One thing that we’ve heard a lot from both businesses and also consumers is that they need a document product, because Google Docs is the reason they stay on Google,” Proton founder and CEO Yen tells WIRED. “It will look and feel a bit like Google Docs, because in fact, it's supposed to be easy for people to adopt. The biggest barrier to privacy has always been user experience.”

Courtesy of Proton

Documents in Proton Drive, which will start rolling out to people today, does look like Google Docs. In screenshots shared by Proton, it appears to be a clean document editor, with many of the standard options you would expect: font and text changes, formatting, adding links, images, and more. The document editor is initially only available on the web and not in app form.

Yen says Proton has been internally using the system for the last month and is now ready to roll it out to consumers. “I feel it is relatively polished,” Yen says. To compete with other online document editors, he says, the team also built in collaboration functionality from the beginning. This includes real-time editing by multiple people, commenting, and showing when someone else is viewing the document.

In April, Proton acquired encrypted note-taking app Standard Notes, which is a separate product from Docs. “It's actually not ‘take Standard Notes and stick it into Proton,’” Yen says, adding that the encryption architecture of the two were different, and Proton Docs is “more or less a ground-up, clean build in Proton’s ecosystem on our software stack.” (WIRED was unable to test the Docs before it was launched).

The big difference Proton is adding when compared to Google Docs is the encryption—something that is challenging to do at scale and also harder when a document has multiple people editing it at the same time. Yen says it's not just the contents of documents that are being encrypted, so are other elements like keystrokes, mouse movements, and file names and paths.

The company, which last month announced it is moving toward a nonprofit status, uses open source encryption, and Yen says building the Docs system required encryption key exchange and synchronization to happen across multiple users. Part of this was possible, Yen says, because last year the company added version history for documents stored in its Drive system, which the Docs are built on top of.

There are relatively few—if any—major end-to-end encrypted document editors online. Other existing services, which WIRED has not tried, include CryptPad and various note-taking or notepad-style apps. There are also apps that encrypt files locally on your machine, such as Cryptee and Anytype.

Recently, Proton has been moving quickly to launch new encrypted products—adding cloud storage, a VPN, a password manager, and calendar alongside its original ProtonMail email service. The company has also faced scrutiny over some information it has provided to law enforcement, such as recovery emails that have been added to accounts. It changed some of its policies in 2021 after being ordered to collect some user metadata. While the company is based outside of the US and EU, it still responds to thousands of Swiss law enforcement requests.

Ultimately, Yen says, the company is trying to offer as many private alternatives to Big Tech services, particularly Google, as it can. “Everything Google’s got, we’ve got to build as well. That's the road map. But the challenge, of course, is the order in which you do it,” Yen says. “In some sense, taking privacy to a more mainstream audience also requires going further afield, trying different things, and being a bit more adventurous in the things that we build and things that we launch.”

Proton Is Launching Encrypted Documents to Take On Google Docs

The US State Department is training diplomats in cybersecurity, privacy, telecommunications, and other technology issues, allowing them to advance US policy abroad.

In a sunlight-filled classroom at the US State Department’s diplomacy school in late February, America’s cyber ambassador fielded urgent questions from US diplomats who were spending the week learning about the dizzying technological forces shaping their missions.

“This portfolio is one of the most interesting and perhaps the most consequential at this moment in time,” Nathaniel Fick, the US ambassador-at-large for cyberspace and digital policy, told the roughly three dozen diplomats assembled before him at the Foreign Service Institute in Arlington, Virginia. “Getting smart on these issues … is going to serve everyone really well over the long term, regardless of what other things you go off and do.”

The diplomats, who had come from overseas embassies and from State Department headquarters in nearby Washington, DC, were the sixth cohort of students to undergo a crash course in cybersecurity, telecommunications, privacy, surveillance, and other digital issues, which Fick’s team created in late 2022. The training program—the biggest initiative yet undertaken by State’s two-year-old cyber bureau—is intended to reinvigorate US digital diplomacy at a time when adversaries like Russia and China are increasingly trying to shape how the world uses technology.

During his conversation with the students, Fick discussed the myriad of tech and cyber challenges facing US diplomats. He told a staffer from an embassy in a country under China’s influence to play the long game in forming relationships that could eventually help the US make inroads there. He spoke about his efforts to help European telecom companies survive existential threats from Chinese telecommunications giant Huawei in the battle for the world’s 5G networks. And he warned of a difficult balancing act on AI, saying the US needed to stave off excessive regulation at the UN without repeating past mistakes.

“We really screwed up governance of the previous generation of tech platforms, particularly the social \[media\] platforms,” Fick said. “The US essentially unleashed on the world the most powerful anti-democratic tools in the history of humanity, and now we’re digging our way out of a credibility hole.”

Restoring that credibility and expanding American influence over digital issues will require tech-savvy diplomacy, and the State Department is counting on Fick’s training program to make that possible. To pull back the curtain on this program for the first time, WIRED received exclusive access to the February training session and interviewed Fick, the initiative’s lead organizer, five graduates of the course, and multiple cyber diplomacy experts about how the program is trying to transform American tech diplomacy.

Fick has called the training program the most important part of his job. As he tells anyone who will listen, it’s a project with existential stakes for the future of the open internet and the free world.

“Technology as a source of influence is increasingly foundational,” he says. “These things are more and more central to our foreign policy, and that’s a trend that is long-term and unlikely to change anytime soon.”

**Maintaining an Edge**

From Russian election interference to Chinese industrial dominance, the US faces a panoply of digital threats. Fighting back will require skillful diplomatic pressure campaigns on every level, from bilateral talks with individual countries to sweeping appeals before the 193-member United Nations. But this kind of work is only possible when the career Foreign Service officers on the front lines of US diplomacy understand why tech and cyber issues matter—and how to discuss them.

“The US needs to demonstrate both understanding and leadership on the global stage,” says Chris Painter, who served as the first US cyber ambassador from 2011 to 2017.

This leadership is important on high-profile subjects like artificial intelligence and the 5G war between Western and Chinese vendors, but it’s equally vital on the bread-and-butter digital issues—like basic internet connectivity and fighting cybercrime—that don’t generate headlines but still dominate many countries’ diplomatic engagements with the US.

Diplomats also need to be able to identify digital shortcomings and security gaps in their host countries that the US could help fix. The success of the State Department’s new cyber foreign aid fund will depend heavily on project suggestions from tech-savvy diplomats on the ground.

In addition, because virtually every global challenge—from trade to climate—has a tech aspect, all US diplomats need to be conversant in the topic. “You’re going to have meetings where a country is talking about a trade import issue or complaining about a climate problem, and suddenly there’s a tech connection,” says Justin Sherman, a tech and geopolitics expert who runs Global Cyber Strategies, a Washington, DC, research and advisory firm.

Digital expertise will also help the US expand coalitions around cybercrime investigations, ransomware deterrence, and safe uses of the internet—all essentially proxy fights with Russia and China.

“We are in competition with the authoritarian states on everything from internet standards … to basic governance rules,” says Neil Hop, a senior adviser to Fick and the lead organizer of the training program. “We are going to find ourselves at a sore disadvantage if we don't have trained people who are representing \[us\].”

Diplomats without tech training might not even realize when their Russian and Chinese counterparts are using oblique rhetoric to pitch persuadable countries on their illiberal visions of internet governance, with rampant censorship and surveillance. Diplomats with tech training would be able to push back, using language and examples designed to appeal to those middle-ground countries and sway them away from the authoritarians’ clutches.

“Our competitors and our adversaries are upping their game in these areas,” Fick says, “because they understand as well as we do what’s at stake.”

**Preparing America’s Eyes and Ears**

The Obama administration was the first to create a tech diplomacy training program, with initial training sessions in various regions followed by week-long courses that brought trainees to Washington. Government speakers and tech-industry luminaries like internet cocreator Vint Cerf discussed the technological, social, and political dimensions of the digital issues that diplomats had to discuss with their host governments.

“The idea was to create this cadre in the Foreign Service to work with our office and really mainstream this as a topic,” says Painter, who created the program when he was State’s coordinator for cyber issues, the predecessor to Fick’s role.

But when Painter tried to institutionalize his program with a course at the Foreign Service Institute, he encountered resistance. “I think we kind of hit it too early for FSI,” he says. “I remember the FSI director saying that they thought, ‘Well, maybe this is just a passing fad.’ It was a new topic. This is what happens with any new topic.”

By the time the Senate unanimously confirmed Nate Fick to be America’s cyber ambassador in September 2022, tech diplomacy headaches were impossible to ignore, and Fick quickly tasked his team with creating a modern training program and embedding it in the FSI’s regular curriculum.

“He understood that we needed to do more and better in terms of preparing our people in the field,” Hop says.

The training program fit neatly into secretary of state Antony Blinken’s vision of an American diplomatic corps fully versed in modern challenges and nimble enough to confront them. “Elevating our tech diplomacy” is one of Blinken’s “core priorities,” Fick says.

As they developed a curriculum, Fick and his aides had several big goals for the new training program.

The first priority was to make sure diplomats understood what was at stake as the US and its rivals compete for global preeminence on tech issues. “Authoritarian states and other actors have used cyber and digital tools to threaten national security, international peace and security, economic prosperity, \[and\] the exercise of human rights,” says Kathryn Fitrell, a senior cyber policy adviser at State who helps run the course.

Equally critical was preparing diplomats to promote the US tech agenda from their embassies and provide detailed reports back to Washington on how their host governments were approaching these issues.

“It's important to us that tech expertise \[in\] the department not sit at headquarters alone,” Fick says, “but instead that we have people everywhere—at all our posts around the world, where the real work gets done—who are equipped with the tools that they need to make decisions with a fair degree of autonomy.”

Foreign Service officers are America’s eyes and ears on the ground in foreign countries, studying the landscape and alerting their bosses back home to risks and opportunities. They are also the US government’s most direct and regular interlocutors with representatives of other nations, forming personal bonds with local officials that can sometimes make the difference between unity and discord.

When these diplomats need to discuss the US tech agenda, they can’t just read monotonously off a piece of paper. They need to actually understand the positions they’re presenting and be prepared to answer questions about them.

“You can’t be calling back to someone in Washington every time there’s a cyber question,” says Sherman.

But some issues will still require help from experts at headquarters, so Fick and his team also wanted to use the course to deepen their ties with diplomats and give them friendly points of contact at the cyber bureau. “We want to be able to support officers in the field as they confront these issues,” says Melanie Kaplan, a member of Fick’s team who took the class and now helps run it.

**Inside the Classroom**

After months of research, planning, and scheduling, Fick’s team launched the Cyberspace and Digital Policy Tradecraft course at the Foreign Service Institute with a test run in November 2022. Since then, FSI has taught the class six more times—once in London for European diplomats, once in Morocco for diplomats in the Middle East and Africa, and four times in Arlington—and trained 180 diplomats.

The program begins with four hours of “pre-work” to prepare students for the lessons ahead. Students must document that they’ve completed the pre-work—which includes experimenting with generative AI—before taking the class. “That has really put us light-years ahead in ensuring that no one is lost on day one,” Hop says.

The week-long in-person class consists of 45- to 90-minute sessions on topics like internet freedom, privacy, ransomware, 5G, and AI. Diplomats learn how the internet works on a technical level, how the military and the FBI coordinate with foreign partners to take down hackers’ computer networks, and how the US promotes its tech agenda in venues like the International Telecommunication Union. Participants also meet with Fick and his top deputies, including Eileen Donahoe, the department’s special envoy for digital freedom.

One session features a panel of US diplomats who have helped their host governments confront big cyberattacks. “They woke up one morning and suddenly were in this position of having to respond to a major crisis,” says Meir Walters, a training alum who leads the digital-freedom team in State’s cyber bureau.

Students learn how the US helped Albania and Costa Rica respond to massive cyberattacks in 2022 perpetrated by the Iranian government and Russian cybercriminals, respectively. In Albania, urgent warnings from a young, tech-savvy US diplomat “accelerated our response to the Iranian attack by months,” Fick says. In Costa Rica, diplomats helped the government implement emergency US aid and then used those relationships to turn the country into a key semiconductor manufacturing partner.

“By having the right people on the ground,” Fick says, “we were able to seize these significant opportunities.”

Students spend one day on a field trip, with past visits including the US Chamber of Commerce (to understand industry’s role in tech diplomacy), the Center for Democracy and Technology (to understand civil society’s perspective on digital-rights issues), and the internet infrastructure giant Verisign.

On the final day, participants must pitch ideas for using what they’ve learned in a practical way to Jennifer Bachus, the cyber bureau’s number two official.

The course has proven to be highly popular. Fick told participants in February that “there was a long wait list” to get in. There will be at least three more sessions this year: one in Arlington in August (timed to coincide with the diplomatic rotation period), one in East Asia, and one in Latin America. These sessions are expected to train 75 to 85 new diplomats.

After the course ends, alumni can stay up-to-date with a newsletter, a Microsoft Teams channel, and a toolkit with advice and guidance. Some continue their education: Fifty diplomats are getting extra training through a one-year online learning pilot, and State is accepting applications for 15 placements at leading academic institutions and think tanks—including Stanford University and the Council on Foreign Relations—where diplomats can continue researching tech issues that interest them.

**Promising Results, Challenges Ahead**

Less than two years into the training effort, officials say they are already seeing meaningful improvements to the US’s tech diplomacy posture.

Diplomats are sending Washington more reports on their host governments’ tech agendas, Fitrell says, with more details and better analysis. Graduates of the course also ask more questions than their untrained peers. And inspired by the training, some diplomats have pushed their bosses to prioritize tech issues, including through embassy working groups uniting representatives of different US agencies.

State has also seen more diplomats request high-level meetings with foreign counterparts to discuss tech issues and more incorporation of those issues into broader conversations. Fick says the course helped the cyber officer at the US embassy in Nairobi play an integral role in recent tech agreements between the US and Kenya. And diplomats are putting more energy into whipping votes for international tech agreements, including an AI resolution at the UN.

Diplomats who took the course shared overwhelmingly positive feedback with WIRED. They say it was taught in an accessible way and covered important topics. Several say they appreciated hearing from senior US officials whose strategizing informs diplomats’ on-the-ground priorities. Maryum Saifee, a senior adviser for digital governance at State’s cyber bureau and a training alum, says she appreciated the Morocco class’s focus on regional issues and its inclusion of locally employed staff.

Graduates strongly encouraged their colleagues to take the course, describing it as foundational to every diplomatic portfolio.

“Even if you're not a techie kind of a person, you need to not shy away from these conversations,” says Bridget Trazoff, a veteran diplomat who has learned four languages at the Foreign Service Institute and compares the training to learning a fifth one.

Painter, who knows how challenging it can be to create a program like this, says he’s “heard good things” about the course. “I’m very happy that they've redoubled their efforts in this.”

For the training program to achieve lasting success, its organizers will need to overcome several hurdles.

Fick’s team will need to keep the course material up-to-date as the tech landscape evolves. They’ll need to keep it accessible but also informative to diplomats with varying tech proficiencies who work in countries with varying levels of tech capacity. And they’ll need to maintain a constant training tempo, given that diplomats rotate positions every few years.

The tone of the curriculum also presents a challenge. Diplomats need to learn the US position on issues like trusted telecom infrastructure, but they also need to understand that not every country sees things the way the US does. “It's not just knowing about these tech issues that’s so essential,” Sherman says. “It's also understanding the whole dictionary of terms and how every country thinks about these concepts differently.”

The coming years could test the course’s impact as the US strives to protect its Eastern European partners from Russia, its East Asian partners from China and North Korea, and its Middle Eastern partners from Iran, as well as to counter Chinese tech supremacy and neutralize Russia’s and China’s digital authoritarianism.

Perhaps the biggest question facing the program is whether it will survive a possible change in administrations this fall. Officials are optimistic—Fick has talked to his Trump-era counterparts, and Painter says “having an FSI course gives it a sense of permanence.”

For Fick, there is no question that the training must continue.

“Tech is interwoven into every aspect of … American foreign policy,” he says. “If you want to position yourself to be effective and be relevant as an American diplomat in the decades ahead, you need to understand these issues.”

The Tech Crash Course That Trains US Diplomats to Spot Threats

While Kaspersky and TikTok make very different kinds of software, the US has targeted both over national security concerns. But the looming bans have larger implications for internet freedom.

On July 20, the United States Commerce Department will ban new sales of popular antivirus software made by Moscow-based Kaspersky Labs. The move comes just two months after US president Joe Biden signed a law that will effectively ban the social media app TikTok in the US if its Chinese parent company doesn't sell it off. The US government banned federal use of Kaspersky antivirus software in 2017, but as the US-Russia relationship has further deteriorated and the Kremlin has exerted more stringent control over the Russian tech sector, US officials have remained concerned about the potential for the Russian government to weaponize Kaspersky software.

In its campaigns to ban these pieces of foreign software as a matter of national security, though, the US government is setting a precedent that undermines tenets of a free and open internet in which users can access any information and software they choose.

“The risks to US national security addressed in this Final Determination stem not from whether Kaspersky's products are effective at identifying viruses and other malware, but whether they can be used strategically to cause harm to the United States,” the Department of Commerce wrote last week. Commerce Secretary Gina Raimondo told reporters on Tuesday that this is the first time the US Commerce Department has banned the sale of a cybersecurity product.

Kaspersky, naturally, countered that it believes the Commerce Department “made its decision based on the present geopolitical climate and theoretical concerns, rather than on a comprehensive evaluation of the integrity of Kaspersky’s products and services.” The company added that “Kaspersky does not engage in activities which threaten US national security and, in fact, has made significant contributions with its reporting and protection from a variety of threat actors that targeted U.S. interests and allies.”

TikTok, meanwhile, has sued the US government, claiming that the potential ban of its app violates the First Amendment. The lawsuit points out that US lawmakers are forcing TikTok's China-based parent company, ByteDance, to sell TikTok to a company headquartered in the US based on “the _hypothetical_ possibility that TikTok could be misused in the future, without citing specific evidence.”

Unlike TikTok, a social media app that is built as a forum for discourse and can be downloaded for free, Kaspersky's antivirus product is paid software that is granted deep system access to monitor customers' devices and networks. Where TikTok's software is contained by the mobile operating systems it runs in, scanners like Kaspersky are given free rein by design, adding to cybersecurity concerns.

“The apps are fundamentally different,” says Patrick Wardle, a longtime Mac security researcher. “If a person of interest had Kaspersky antivirus and TikTok on their device, Kaspersky is probably the bigger problem, because it can give its developer unfettered access to the device. A mobile app like TikTok runs in an app sandbox and really can’t do much beyond you granting it access to specific data like your contacts.”

For that reason, Riana Pfefferkorn, a policy researcher at Stanford University, argues that the US government needs to share more specific and compelling information with the general public about why they should not do business with Kaspersky, rather than paternalistically banning the app. Similarly, throughout multiple administrations and terms, the White House and Congress have never released evidence or even made specific allegations about the threat TikTok may pose to US national security.

“After the TikTok law passed, it just feels like it’s open season on any tech company the government doesn’t like—so long as it’s not a domestic firm—and like the government has excused itself from giving the public the ample and damning evidence we should expect it to provide if it is to justify such drastic decisions,” Pfefferkorn tells WIRED.

Unlike a social media platform such as TikTok, where a US adversary like China might exert control to disseminate misinformation or influence public perception of key issues over time, antivirus software like Kaspersky could be directly exploited to steal data or even take control of targeted devices. And Kaspersky has been the target of multiple sophisticated hacking campaigns over the years, indicating that foreign intelligence agencies may be keen to determine what information the company has access to. But the slippery slope created by software bans is not inconsequential.

“The federal government rightfully has leeway to decide what software not to allow on its own networks on the basis of security and privacy concerns,” Pfefferkorn says. “But when it comes to the general public, the better approach is to set basic privacy and cybersecurity requirements for _all_ software, not just foreign-owned apps. That’s particularly true so long as data brokers remain free to sell Americans’ data to foreign governments.”

As the constant threat of software supply-chain attacks shows, strong security defenses and privacy guarantees are ultimately more durable and broadly protective than specific bans anyway. Meanwhile, Reuters reported on Tuesday that the Biden administration and the Commerce Department are investigating the access that China Mobile, China Telecom, and China Unicom have to US data through their cloud and internet routing services. The TikTok and Kaspersky crackdowns may be a glimpse of the US's growing digital isolationism.

The Problem the US TikTok Crackdown and Kaspersky Ban Have in Common

As more and more infrastructure is deployed in space, the risk of cyber attacks increases. The US military wants to team up with the private sector to protect assets everyone relies on.

_THIS ARTICLE IS republished from The Conversation under a_ _Creative Commons license._

The US military recently launched a groundbreaking initiative to strengthen ties with the commercial space industry. The aim is to integrate commercial equipment into military space operations, including satellites and other hardware. This would enhance cybersecurity for military satellites.

As space becomes more important to the world’s critical infrastructure, the risk increases that hostile nation-states will deploy cyberattacks on important satellites and other space infrastructure. Targets would include not just spy satellites or military communications satellites, but commercial spacecraft too.

The US Department of Defense believes its new partnership, called Commercial Augmentation Space Reserve (CASR), would enhance US national security and the country’s competitive advantage in space. It would go some way beyond the relationship between government and private contractor that already exists.

In some cases, the commercial sector has advanced rapidly beyond government capabilities. This situation exists in numerous countries with a space capability and may apply in certain areas in the US too.

The governments of some nation-states are therefore confronted with a choice. They could utilize bespoke systems for protecting their satellites, even though these may be outdated, or they could use other commercial—and potentially more advanced—“off-the-shelf” components. However, the commercial hardware may be less well understood in terms of its vulnerabilities to cyberattacks.

Nevertheless, the US military believes that CASR will give it advanced strategic capabilities, and that potential risks can be minimized by actively avoiding overreliance on any single commercial entity.

The supply chain aims to transition the US military from a restricted pool of commercial suppliers to a broader spectrum of partners. However, there are risks with a bigger pool of commercial suppliers too. Some might be unable to meet the demands of military contracts, could run into financial instability, or encounter other pressures that hinder their ability to supply critical components.

**New Priorities**

In 2022 there was a cyberattack on the KA-Sat consumer satellite broadband service. It targeted the satellites delivering the broadband and disrupted the service.

There are many ways to attack another state’s satellites, such as anti-satellite (ASAT) weapons, which are often designed to physically destroy or disable the spacecraft. However, compared to ASATs, cyberattacks can be carried out in ways that are cheaper, quicker, and more difficult to trace.

Part of the critical need to prioritize cybersecurity as a result of this strategy is that the US is an attractive market for global players in space. This strategic shift by the US Department of Defense is therefore likely to encourage more global companies to participate.

Resilience to cyberattacks in the space industry has not always been a top priority. It is likely to take time for this to enter the thinking of major players in the space sector.

This historical lack of emphasis on cybersecurity in space highlights an obvious need. There are also inconsistencies and gaps regarding the basic cyber requirements for government and industry, which vary depending on the stance of each nation-state.

The US military claims that interoperability in military standards—the ability of different hardware to work seamlessly together—will strengthen the new public-private relationship. It has also left the door open for commercial standards to be adopted in certain instances. But there’s a risk that shifting from military standards (which are typically more stringent than commercial standards) could undermine military assets and lead to the same adverse consequences the strategy seeks to avoid.

Despite the best intentions, the complexities of working with many more and newer commercial partners could also lead to inconsistencies in the application of standards across different projects and systems. Commercial cybersecurity standards are unlikely to prioritize the same level of security required for military applications, especially under extreme conditions.

In light of these challenges, the success of these initiatives hinges on having leaders who are proactive and well informed. Being able to act across the commercial and defense sectors will require key skills—one of which is being informed and educated on cybersecurity.

Recently, I developed an executive space cybersecurity course with postgraduate credentials in partnership with the International Space University. This executive-level course attracted professionals from various sectors, including the legal profession, regulators, consultants, commercial businesses, and investors.

By bridging the gap between different sectors and disciplines, the course fostered an all-round, multidisciplinary approach to space cybersecurity. Executives were able to gain a deeper understanding of the interconnectedness of various systems and the potential vulnerabilities that can arise. This not only enriched the learning experience but also encouraged participants to think outside the box and explore new strategies for mitigating cyber threats in space.

As the Pentagon and the commercial space industry forge ahead with their groundbreaking collaboration, it is important that those making decisions understand the critical nature of cybersecurity. This shift is not without its challenges. But it also presents opportunities for innovation and new partnerships which could shape the future of space exploration and lead to new approaches to cybersecurity for satellites and other space infrastructure.

The US Wants to Integrate the Commercial Space Industry With Its Military to Prevent Cyber Attacks

Plus: A cloud company says notorious Russian hacker group APT29 attacked it, Chinese hackers use ransomware to hide their espionage campaigns, and a bank popular with startups discloses a cyberattack.

WIRED learned this week that Amazon Web Services investigated claims that the AI search startup Perplexity may have violated the cloud company's rules by appearing to pull data from websites that have attempted to shield themselves from such scraping. The news comes after WIRED published findings last week about the AI search chatbot's indiscriminate data-scraping practices and questionable content generation. WIRED's inquiries to AWS about the matter spurred it to look at Perplexity's activities. A separate WIRED investigation into Quora's Poe AI platform found that it downloaded entire articles from a variety of publishers and shared the files with users, effectively circumventing paywalls.

The US Justice Department announced convictions earlier this week related to a series of violent home invasions in which more than a dozen men threatened, assaulted, tortured, or kidnapped 11 people as part of efforts to steal cryptocurrency.

On Wednesday, WikiLeaks founder Julian Assange agreed to plead guilty to one count of espionage in US court, finally concluding a protracted legal battle between the US government and the controversial, anonymity-focused publisher. The American Privacy Rights Act—the latest in an endless parade of “comprehensive” US privacy bills—got pulled from a congressional hearing and is now unlikely to receive a full vote. And a new tailor-built platform created by the firm SITU Research has been used for the first time in the International Criminal Court as a tool for prosecuting a war crimes case.

Concrete proof is finally starting to emerge from San Jose and New York City that AI gunshot detection systems operate substantially below their advertised accuracy rates. Deepfake creators are revictimizing individuals from the GirlsDoPorn sex trafficking operation by hosting altered versions of videos from that platform. And bureaucratic hurdles are making it even more difficult for health care providers like hospitals to recover and come back online after ransomware attacks.

But wait, there's more. Each week, we round up the security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

**Google Is Piloting a Face-Recognition Office Security System**

At its campus in Kirkland, Washington, Google is rolling out a face recognition system to detect “unauthorized individuals” and block their access to its offices, according to a document about the plan viewed by CNBC. Security cameras inside Google spaces have already been collecting face data and comparing it to employee badge photos in an attempt to flag people who are not regular employees or part of the broader Google workforce. If the system identifies a person of interest, Google’s “Security and Resilience Services” team will work to identify would-be intruders “who may pose a security risk to Google’s people, products, or locations,” according to the document. People who work at or visit the Kirkland campus will not be able to opt out of having their face data collected by the system, but the document notes that data is collected “strictly for immediate use and not stored.” It adds that employees can opt out of having their badge images stored by Google and that this cache of images is only being used to test the system. The document says that the goal of the program is to “maintain safety and security of our people and spaces.”

**German Cloud Company Says It Was the Target of Russian “Cozy Bear” Hackers**

The German cloud company Teamviewer confirmed on Friday that it suffered a cyberattack earlier this week. The company accused the notorious Russian hacking group APT29—also called “Cozy Bear” and “Midnight Blizzard”—of carrying out the attack. “Current findings of the investigation point to an attack on Wednesday, June 26, tied to credentials of a standard employee account within our Corporate IT environment,” Teamviewer said in a statement. The company later confirmed that “the attack was contained within TeamViewer’s internal corporate IT environment and did not touch the product environment, our connectivity platform, or any customer data.”

**Chinese Hackers Have Been Using Ransomware Attacks to Mask Their Activities**

Suspected Chinese government-backed hackers, including the group known as “ChamelGang,” have deployed ransomware in dozens of high-profile attacks as a distraction while they conduct espionage operations on victims' networks. Researchers from the security firms SentinelOne, Recorded Future, and TeamT5 have found evidence, for example, that attackers used the tactic in hacks of a critical Indian health care platform and Brazil's presidential office. Espionage actors are participating in “an increasingly disturbing trend of using ransomware as a final stage in their operations for the purposes of financial gain, disruption, distraction, misattribution, or removal of evidence,” the researchers wrote.

**Evolve Bank, Used by Startups, Confirms LockBit Ransomware Attack**

On Wednesday, Evolve Bank and Trust, a financial firm popular with fintech startups, confirmed that it was the victim of a ransomware attack and data breach that may impact customers. “Evolve is currently investigating a cybersecurity incident involving a known cybercriminal organization that appears to have illegally obtained and released on the dark web the data and personal information of some Evolve retail bank customers and financial technology partners’ customers,” the bank said in a statement on Wednesday. The prolific and aggressive ransomware gang known as LockBit recently posted data on its dark-web leak site that it claimed had been stolen from Evolve.

Source

Wired