A high court in London says the WikiLeaks founder won’t be extradited “immediately” and the US must provide more “assurances” about any extradition.

The UK high court has extended WikiLeaks founder Julian Assange’s hope to avoid espionage charges in the United States, allowing Assange to further challenge his extradition from the UK to the US.

In a ruling issued in London on Tuesday, two high court judges said that Assange will not be immediately extradited to the United States. In a press summary of the 60-page decision, the court said Assange has a “real prospect of success” in appealing his extradition order and that it requires the US and UK to make further “assurances” about his treatment if he were to be extradited.

“The Court has given the Government of the United States three weeks to give satisfactory assurances: that Mr Assange is permitted to rely on the First Amendment to the United States Constitution (which protects free speech), that he is not prejudiced at trial (including sentence) by reason of his nationality, that he is afforded the same First Amendment protections as a United States citizen and that the death penalty is not imposed,” the press summary says.

Assange’s extradition was first authorized by the British government in June 2022, more than three years after his arrest. The appeals process was repeatedly delayed by the Covid-19 pandemic and Assange’s own deteriorating health, a result, his doctors say, of his prolonged pretrial confinement and his previous stay in the Ecuadorian embassy in London, where he lived under asylum for nearly seven years.

The embattled WikiLeaks founder faces an 18-count indictment in the US, which alleges a conspiracy to commit computer crimes and, most significantly, violations of the Espionage Act for soliciting and publishing classified information related primarily to the US-led wars in Iraq and Afghanistan.

For Assange, his supporters, and the US government, Tuesday’s ruling has been a long time coming, culminating more than four years of legal battles in the UK. The extensive delay inevitably gave rise to a flood of analysis and conjecture from legal scholars, human rights defenders, and envoys of the US intelligence system, spawning myriad theories about the ultimate repercussions of his potential capture, trial, and imprisonment.

Free press advocates have argued the charges against Assange amount to an attack on legal journalistic activities, portrayed by prosecutors as crimes against the state. The right of journalists to publish stolen or leaked information, even when classified “secret,” has been repeatedly affirmed by the US Supreme Court.

US prosecutors allege that Assange in 2010 took matters a step further than what is legally permitted, encouraging then-WikiLeaks source Chelsea Manning to violate the law further by stealing additional files, and by offering to help her crack a hashed password that would have, ostensibly, furthered her access inside a classified Defense Department network.

Though it is unclear whether any of Assange’s offers actually aided Manning or resulted in any additional files being leaked, under the scope of US law, legal experts widely agree, success is beside the point.

Manning, a former US Army intelligence analyst, confessed during a court martial in 2013 to leaking more than 725,000 documents to WikiLeaks, though her conviction pertains only to portions of hundreds of documents. Manning was accused but acquitted of “aiding the enemy.” Her 35-year prison sentence was commuted in January 2017 by former US president Barack Obama in one of his final acts of office.

The Espionage Act, under which Assange is charged, is among the most controversial in the nation’s criminal code, wielded by prosecutors against whistleblowers and national security leakers with the same intensity as any captured traitor or spy.

Much of the US case is based on digital logs of conversations held between WikiLeaks associates and accounts allegedly manned by Assange himself. Ironically, most if not all of this evidence has itself been leaked over the years or otherwise amassed by independent researchers. Distributed Denial of Secrets (DDOS), a WikiLeaks successor, has compiled at least hundreds of thousands of pages of relevant documents from various confidential sources, including those targeted by FBI informers and by the bureau itself via search warrants.

A private database created by DDOS, reviewed by WIRED, currently contains roughly 100 gigabytes’ worth of WikiLeaks material, including several hundred thousand internal emails and tens of thousands of chat logs, many bearing account names known to have been used by Assange personally.

Despite being rigorously cataloged by DDOS researchers, it remains difficult to quantify how many individuals’ communications were logged due to the sheer volume of text. The anti-secrecy organization’s earliest files pertaining to Assange’s activities online date back 30 years.

Emma Best, a journalist and co-founder of DDOS, says it is believed the organization possesses all—or nearly all—of the recorded conversations cited in the US government’s indictment. A large percentage of internal WikiLeaks chatter is said to have been recorded by Sigurdur Thordarson, a former WikiLeaks associate, in the years and months prior to his betrayal of the organization.

Following his stint as an FBI informer in 2011, Thordarson faced multiple convictions in Icelandic court for sex crimes involving minors and for fraud in relation to funds embezzled from WikiLeaks. According to Best, a close inspection of the files would shed even further doubt as to Thordarson’s reliability, as he often mischaracterizes statements by Assange when communicating with other WikiLeaks associates and supporters.

Best says making the WikiLeaks files public is a priority due to the US’s aggressive moves in the case and the international repercussions, but distribution remains limited currently to trusted professionals, primarily for privacy reasons. WIRED’s review found that the documents identify countless individuals, including many who are not affiliated with WikiLeaks. Additionally, while the US and UK governments presumably have access to all or most of the same files, Best says, other governments, which could seek to act upon them legally, likely do not.

“The case against WikiLeaks and Assange is as misunderstood as it is secretive and important, problems worsened by the many liars involved and the largely vibes-based analysis of it,” she tells WIRED. “The first step to fixing this is simple: Leak the case.”

Assange’s case has garnered scrutiny from human rights groups, many evaluating the conditions inside US prisons as too brutal and lousy to be considered anything but cruel and inhumane.

Concerns over American prison conditions posed a major hurdle for US prosecutors in 2021 after the UK high court ruled the odds they would result in Assange’s death by suicide as unacceptable. The court decided that the US successfully mitigated these concerns by offering assurances that Assange would not face certain treatments that, while commonplace in the US, are widely gauged to run afoul of international law, including the use of extreme isolation.

The US’s assurances did little to quell protests from rights groups and Assange family members, as they’d been offered in the past to little effect. Frequently highlighted is the case of British poet Syed Talha Ahsan, who was kept in solitary confinement for years in a Connecticut “supermax” prison known as the Northern Correctional Institution. The prison closed in June 2021.

A key assurance offered by the US is that Assange will never be confined at another supermax prison, Colorado’s ADX Florence, which currently cages more than 300 prisoners. The use of prolonged isolation, common within the prison but employed throughout the US, has been labeled “torture” by current and past United Nations prison watchdogs. Repeated studies have shown prolonged isolation to have deleterious and potentially irreversible effects on the human brain, leading to significantly higher rates of suicide, homicide, and opioid dependence among incarcerated people upon their release.

Another assurance offered by the US is that Assange will not be subjected to “special administrative measures,” an Orwellian euphemism for the government surveilling a prisoner’s attorney-client communications. Among other justifications, the US can implement this procedure—known as SAM—by claiming the monitoring is necessary to “prevent the disclosure of classified information.”

If convicted, Assange’s lawyers say he faces a maximum of 175 years in prison, though US prosecutors have downplayed in the press the likelihood of him receiving such a lengthy sentence.

_This is a developing story and is being updated with new information._

Julian Assange Won’t Be Extradited to the US Yet

US and UK officials hit Chinese hacking group APT31 with sanctions and criminal charges after they targeted thousands of businesses, politicians, and critics of China.

For years, China’s state-backed hackers have stolen huge troves of company secrets, political intelligence, and the personal information of millions of people. On Monday, officials in the United States and United Kingdom expanded the long list of hacking allegations, claiming China is responsible for breaching the UK’s elections watchdog and accessing 40 million people’s data. The countries also issued a raft of criminal charges and sanctions against a separate Chinese group following a multiyear hacking rampage.

In August last year, the UK’s Electoral Commission revealed “hostile actors” had infiltrated its systems in August 2021 and could potentially access sensitive data for 14 months until they were booted out in October 2022. The deputy prime minister, Oliver Dowden, told lawmakers on Monday that a China state-backed actor was responsible for the attack. In addition, Dowden said, the UK’s intelligence services have determined that Chinese hacking group APT31 targeted the email accounts of politicians in 2021.

“This is the latest in a clear pattern of malicious cyber activity by Chinese state-affiliated organizations and individuals targeting democratic institutions and parliamentarians in the UK and beyond,” Dowden said in the UK’s House of Commons. The revelations were accompanied by the UK sanctioning two individuals and one company linked to APT31.

Alongside the UK’s announcement on Monday, the US Department of Justice and Department of the Treasury’s Office of Foreign Assets Control unveiled further action against APT31, also known as Violet Typhoon, Bronze Vinewood, and Judgement Panda, including charging seven Chinese nationals with the conspiracy to commit computer intrusions and wire fraud.

The DOJ claims the hacking group, which has been linked back to China’s Ministry of State Security (MSS) spy agency, has spent 14 years targeting thousands of critics, businesses, and political entities around the world in widespread espionage campaigns. This includes posing as journalists to send more than 10,000 malicious emails that tracked recipients, compromising email accounts, cloud storage accounts, telephone call records, home routers, and more. The spouses of one high-ranking White House official and those of multiple US senators were also targeted, the DOJ says.

“These allegations pull back the curtain on China’s vast illegal hacking operation that targeted sensitive data from US elected and government officials, journalists and academics; valuable information from American companies; and political dissidents in America and abroad,” Breon Peace, a US attorney for the Eastern District of New York, said in a statement. “Their sinister scheme victimized thousands of people and entities across the world, and lasted for well over a decade.”

The moves come as countries increasingly warn of an increase in China-linked espionage, during a year when more than 100 countries will host major elections. Statements from officials focus on the impact of the hacking activity on democratic processes, including the targeting of elected officials around the world and the compromising of pro-democracy activists and lawmakers in Hong Kong. However, the disclosures also coincide with continued jostling from Western politicians over pro- or anti-China stances, including the proposed sale of TikTok to a US company, which could result in a ban on the popular app if the sale fails to go through.

As officials in the UK disclosed the details of the hacking activity, Lin Jian, a Chinese foreign ministry spokesperson, claimed it was “disinformation” and told reporters the country “opposes illegal and unilateral” sanctions. “When investigating and determining the nature of cyber cases, one needs to have adequate and objective evidence, instead of smearing other countries when facts do not exist, still less politicize cybersecurity issues,” Jian said in a daily press conference on Monday.

“China is embarking on a huge global campaign of interference and espionage, and the UK and the like-minded nations are pretty sick of it,” says Tim Stevens, a global security lecturer and head of the cybersecurity research group at King’s College London. Stevens says the public shaming and sanctions are unlikely to significantly change China’s actions but may signal a warning to other countries about what is and isn’t deemed acceptable when it comes to international affairs.

China has a broad range of hacking groups linked to its intelligence services and military, as well as companies that it contracts to launch some cyber operations. Many of these groups have been active for more than a decade. Dakota Cary, a China-focused consultant at security firm SentinelOne, says that groups associated with China’s civilian intelligence service are largely conducting diplomatic or government intelligence collection and espionage, while China’s military hackers are behind attacks on power grids and US critical infrastructure such as water supplies. “We do see China engaging in all of those activities simultaneously,” Cary says.

In announcing criminal charges and sanctions against members of APT31, officials in the US laid out a series of hacking allegations that include the targeting of businesses, political entities, and dissidents around the world. These included a “leading provider” of 5G telecoms equipment in the US, Norwegian government officials, and people working in the aerospace and defense industries. APT31 was run by the MSS’s Hubei State Security Department in the city of Wuhan, US officials say.

The seven Chinese nationals hit with charges are Ni Gaobin, Weng Ming, Cheng Feng, Peng Yaowen, Sun Xiaohui, Xiong Wang, and Zhao Guangzong. Both Zhao Guangzong and Ni Gaobin were also sanctioned. The two are alleged to be affiliated with Wuhan XRZ, a company that has also been sanctioned by the US and UK and is believed to be a cover for MSS-linked hacking operations. Employees of the company hacked into a Texas-based energy company in 2018, the US Treasury Department said.

The group used sophisticated malware—including Rawdoor, Trochilus, and EvilOSX—to compromise systems, according to a 27-page indictment unsealed by the DOJ. They also used a “cracked/pirated” version of penetration testing tool Cobalt Strike Beacon to compromise victims, the indictment says. It adds that, between 2010 and November 2023, the group “gained access” to a defense contractor that designed flight simulators for the US Army, Air Force, and Navy; a multi-factor authentication company; an American trade association; a steel company; a machine learning laboratory based in Virginia; and multiple research hospitals.

In its announcement, the UK outlined two separate China-linked incidents: first, the targeting of the email inboxes of 43 members of parliament (MPs) by APT31 in 2021; and second, the hack of the Electoral Commission by further unnamed China-linked hackers. Elections in the UK are decentralized and organized locally, with the commission overseeing the entire process. This setup means the integrity of the electoral process was not impacted, the commission says; however, a huge amount of data may have been taken by the hackers.

When the Electoral Commission revealed it had been compromised last year, it said the details of around 40 million people may have been accessed. The commission said names and addresses of people in Great Britain who were registered to vote between 2014 and 2022 could have been compromised, and that file-sharing and email systems could have been made accessible. “It’s really remarkable that China would go after election oversight systems, particularly given the diplomacy that the PRC \[People’s Republic of China\] is trying to pull off with the EU,” Cary says. “It’s a very significant act for the PRC to go after these types of systems,” Cary says. “It’s something that democracies are really sensitive to.”

While nations have called out China’s hacking activities for years, the country has evolved its tactics and techniques to become harder to detect. “Over the past couple of years, tired of having their operations rumbled and publicly outed, the Chinese have placed a growing emphasis on stealthy tradecraft in cyber espionage attacks,” Don Smith, vice president of threat intelligence at security firm Secureworks’ counter-threat unit, said in a statement. “This is a change in MO from its previous ‘smash and grab’ reputation but it is viewed by the Chinese as a necessary evolution to one, make it harder to get caught and two, make it nearly impossible to attribute an attack to them.”

Chinese Hackers Charged in Decade-Long Global Spying Rampage

Plus: The Biden administration warns of nationwide attacks on US water systems, a new Russian wiper malware emerges, and China-linked hackers wage a global attack spree.

The next time you stay in a hotel, you may want to use the door’s deadbolt. A group of security researchers this week revealed a technique that uses a series of security vulnerabilities that impact 3 million hotel room locks worldwide. While the company is working to fix the issue, many of the locks remain vulnerable to the unique intrusion technique.

Apple is having a tough week. In addition to security researchers revealing a major, virtually unpatchable vulnerability in its hardware (more on that below), the United States Department of Justice and 16 attorneys general filed an antitrust lawsuit against the tech giant, alleging that its practices related to its iPhone business are illegally anticompetitive. Part of the lawsuit highlights what it calls Apple’s “elastic” embrace of privacy and security decisions—particularly iMessage’s end-to-end encryption, which Apple has refused to make available to Android users.

Speaking of privacy, a recent change to cookie pop-up notifications reveals the number of companies each website shares your data with. A WIRED analysis of the top 10,000 most popular websites found that some sites are sharing data with more than 1,500 third parties. Meanwhile, employer review site Glassdoor, which has long allowed people to comment about companies anonymously, has begun encouraging people to use their real names.

And that’s not all. Each week, we round up the security and privacy news we don’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

Apple’s M-series of chips contain a flaw that could allow an attacker to trick the processor into revealing secret end-to-end encryption keys on Macs, according to new research. An exploit developed by a team of researchers, dubbed GoFetch, takes advantage of the M-series chips’ so-called data memory-dependent prefetcher, or DMP. Data stored in a computer’s memory have addresses, and DMP’s optimize the computer’s operations by predicting the address of data that is likely to be accessed next. The DMP then puts “pointers” that are used to locate data addresses in the machine’s memory cache. These caches can be accessed by an attacker in what’s known as a side-channel attack. A flaw in the DMP makes it possible to trick the DMP into adding data to the cache, potentially exposing encryption keys.

The flaw, which is present in Apple’s M1, M2, and M3 chips, is essentially unpatchable because it is present in the silicon itself. There are mitigation techniques that cryptographic developers can create to reduce the efficacy of the exploit, but as Kim Zetter at Zero Day writes, “the bottom line for users is that there is nothing you can do to address this.”

**US Warns of Widespread Cyberattacks Against Water Systems**

In a letter sent to governors across the US this week, officials at the Environmental Protection Agency and the White House warned that hackers from Iran and China could attack “water and wastewater systems throughout the United States.” The letter, sent by EPA administrator Michael Regan and White House national security adviser Jake Sullivan, says hackers linked to Iran’s Islamic Revolutionary Guard and Chinese state-backed hacker group known as Volt Typhoon have already attacked drinking water systems and other critical infrastructure. Future attacks, the letter says, “have the potential to disrupt the critical lifeline of clean and safe drinking water, as well as impose significant costs on affected communities.”

**A New Russian Wiper Malware Threatens Communication Networks**

There’s a new version of a wiper malware that Russian hackers appear to have used in attacks against several Ukrainian internet and mobile service providers. Dubbed AcidPour by researchers at security firm SentinelOne, the malware is likely an updated version of the AcidRain malware that crippled the Viasat satellite system in February 2022, heavily impacting Ukraine’s military communications. According to SentinelOne’s analysis of AcidPour, the malware has “expanded capabilities” that could allow it to “better disable embedded devices including networking, IoT, large storage (RAIDs), and possibly ICS devices running Linux x86 distributions.” The researchers tell CyberScoop that AcidPour may be used to carry out more widespread attacks.

**China’s Earth Krahang Hackers Target Victims Around the World**

Volt Typhoon isn’t the only China-linked hacker group wreaking widespread havoc. Researchers at security firm TrendMicro revealed a hacking campaign by a group known as Earth Krahang that’s targeted 116 organizations across 48 countries. Of those, Earth Krahang has managed to breach 70 organizations, including 48 government entities. According to TrendMicro, the hackers gain access through vulnerable internet-facing servers or through spear-phishing attacks. They then use access to the targeted systems to engage in espionage and commandeer the victims’ infrastructure to carry out further attacks. Trend Micro, which has been monitoring Earth Krahang since early 2022, also says it found “potential links” between the group and I-Soon, a Chinese hack-for-hire firm that was recently exposed by a mysterious leak of internal documents.

Apple Chip Flaw Leaks Secret Encryption Keys

Privacy and security are an Apple selling point. But the DOJ’s new antitrust lawsuit argues that Apple selectively embraces privacy and security features in ways that hurt competition—and users.

For well over a decade, Apple has been praised by privacy advocates for its decision in 2011 to end-to-end encrypt iMessage, securing users' communications on the default texting app for all its devices so thoroughly that even Apple itself can't read their messages. This was years before WhatsApp switched on end-to-end encryption in 2016, and before Signal—now widely considered the most private end-to-end encrypted messaging platform—even existed, Apple quietly led the way with that security feature, baking it into a core piece of the Apple ecosystem.

So it's ironic that the US Department of Justice has now hit Apple with a landmark antitrust lawsuit, alleging that it has sought for years to monopolize the smartphone market and gravely harmed consumers in the process, iMessage's end-to-end encryption has become Exhibit A for an argument about Apple's privacy hypocrisy—that Apple's allegedly anticompetitive practices have denied users not only better prices, features, and innovation, but also better digital security.

In its sweeping antitrust lawsuit, the DOJ on Thursday laid out a broad set of allegations against Apple, accusing it of monopolistic practices in how it uses its walled-garden operating systems and app stores to deprive consumers of apps and services that might make it easier for them to wean themselves from their Apple addictions—keeping out of the App Store so-called super apps with cross-platform, broad functionality; limiting streaming and cloud-based applications; and handicapping the functionality of competitors' devices like smartwatches.

The DOJ's complaint also homes in on Apple's approach to security and privacy, arguing that it uses those principles as an excuse for its anticompetitive practices, yet jettisons them whenever they might hurt the bottom line. “In the end, Apple deploys privacy and security justifications as an elastic shield that can stretch or contract to serve Apple’s financial and business interests,” the complaint reads.

“I definitely think that Apple has strategically used privacy and security in ways that benefit its business,” says Caitlin Chin-Rothmann, a research fellow at the Center for Strategic & International Studies (CSIS) who focuses on technology policy. “Apple has taken some steps to improve end-to-end encryption in iMessage, for example, but it hasn’t extended that to iPhone users that text Android users or iPhone users that don’t use iMessage.”

In its privacy and security arguments, the DOJ faults Apple for decisions like its deal with Google to make Google's search engine the default on Apple products, rather than a more privacy-preserving alternative, or allowing data-harvesting apps into its App Store. But it repeatedly returns to iMessage as perhaps the clearest example of how Apple's anticompetitive practices directly harm users security. The DOJ argues that by refusing to allow users of other smartphone platforms like Android to use its end-to-end encryption iMessage protocol, it has significantly reduced the overall security of messaging worldwide, both for those Android users and for the Apple users who communicate with them.

“Text messages sent from iPhones to Android phones are unencrypted as a result of Apple’s conduct,” the complaint reads. “If Apple wanted to, Apple could allow iPhone users to send encrypted messages to Android users while still using iMessage on their iPhone, which would instantly improve the privacy and security of iPhone and other smartphone users.”

The argument is one that some Apple critics have made for years, as spelled out in an essay in January by Cory Doctorow, the science fiction writer, tech critic, and coauthor of _Chokepoint Capitalism_. “The instant an Android user is added to a chat or group chat, the entire conversation flips to SMS, an insecure, trivially hacked privacy nightmare that debuted 38 years ago—the year _Wayne's World_ had its first cinematic run,” Doctorow writes. “Apple's answer to this is grimly hilarious. The company's position is that if you want to have real security in your communications, you should buy your friends iPhones.”

In a statement to WIRED, Apple says it designs its products to “work seamlessly together, protect people’s privacy and security, and create a magical experience for our users,” and it adds that the DOJ lawsuit “threatens who we are and the principles that set Apple products apart” in the marketplace. The company also says it hasn't released an Android version of iMessage because it couldn't ensure that third parties would implement it in ways that met the company's standards.

“If successful, \[the lawsuit\] would hinder our ability to create the kind of technology people expect from Apple—where hardware, software, and services intersect,” the statement continues. “It would also set a dangerous precedent, empowering government to take a heavy hand in designing people’s technology. We believe this lawsuit is wrong on the facts and the law, and we will vigorously defend against it.”

Apple has, in fact, not only declined to build iMessage clients for Android or other non-Apple devices, but actively fought against those who have. Last year, a service called Beeper launched with the promise of bringing iMessage to Android users. Apple responded by tweaking its iMessage service to break Beeper's functionality, and the startup called it quits in December.

Apple argued in that case that Beeper had harmed users' security—in fact, it did compromise iMessage's end-to-end encryption by decrypting and then re-encrypting messages on a Beeper server, though Beeper had vowed to change that in future updates. Beeper cofounder Eric Migicovsky argued that Apple's heavyhanded move to reduce Apple-to-Android texts to traditional text messaging was hardly a more secure alternative.

“It’s kind of crazy that we’re now in 2024 and there still isn't an easy, encrypted, high-quality way for something as simple as a text between an iPhone and an Android,” Migicovsky told WIRED in January. “I think Apple reacted in a really awkward, weird way—arguing that Beeper Mini threatened the security and privacy of iMessage users, when in reality, the truth is the exact opposite.”

Even as Apple has faced accusations of hoarding iMessage's security properties to the detriment of smartphone owners worldwide, it's only continued to improve those features: In February it upgraded iMessage to use new cryptographic algorithms designed to be immune to quantum codebreaking, and last October it added Contact Key Verification, a feature designed to prevent man-in-the-middle attacks that spoof intended contacts to intercept messages. Perhaps more importantly, it's said it will adopt the RCS standard to allow for improvements in messaging with Android users—although the company did not say whether those improvements would include end-to-end encryption.

Even as it makes those advances in iMessage's security and privacy, Apple has rarely touted them in its public-facing marketing, points out Nadim Kobeissi, a cryptographer focused on secure messaging and the director of the cryptography consultancy Symbolic Software, and has actively contributed to public, nonproprietary security products. He argues that this deflates any argument the DOJ might make that Apple has intentionally hoarded security features as a competitive advantage.

Instead, Kobeissi says that the security gap is a byproduct of Apple's attempt to preserve the exclusivity of more visibly integrated and fun social features—reactions, FaceTime, coveted blue bubbles—while also conscientiously maintaining the product's security. “It’s not a security question, it's a societal question about the openness of communication platforms,” Kobeissi says. He points out that people who are aware of iMessage's security advantages are also aware of other end-to-end encrypted messaging options like WhatsApp and Signal.

Apple critics like Doctorow and Migicovsky both point out, however, that iMessage is deeply integrated in Apple devices as their default messaging app, and thus will always be used on those devices far more often than Signal or WhatsApp. “Defaults matter,” Doctorow says, pointing out that Google pays Apple a fortune for the right to make Google the default search engine on its devices. “Apple makes \[nearly\] $20 billion a year off the proposition that a click away is a click too far.”

Even if Apple's security features are good for its customers, “Apple’s size does matter” because it gives the company power over the broader market in ways that smaller technology companies cannot, regardless of whether they market their security and privacy features to beat out the competition, says CSIS's Chin-Rothmann. The question, ultimately, is whether people should be relying on technology giants like Apple to set the standards for privacy and security at all. She points out that comprehensive data privacy legislation that ensures minimum security requirements for software might well be a better approach than depending entirely on the private sector to decide who gets privacy—and who is denied it.

“If Congress or the US government really wants to increase privacy and security," Chin-Rothmann says, “we really should take these decisions out of the hands of massive technology companies like Apple.”

Apple's iMessage Encryption Puts Its Security Practices in the DOJ's Crosshairs

The company behind the Saflok-brand door locks is offering a fix, but it may take months or years to reach some hotels.

When thousands of security researchers descend on Las Vegas every August for what's come to be known as “hacker summer camp,” the back-to-back Black Hat and Defcon hacker conferences, it's a given that some of them will experiment with hacking the infrastructure of Vegas itself, the city's elaborate array of casino and hospitality technology. But at one private event in 2022, a select group of researchers were actually _invited_ to hack a Vegas hotel room, competing in a suite crowded with their laptops and cans of Red Bull to find digital vulnerabilities in every one of the room's gadgets, from its TV to its bedside VoIP phone.

One team of hackers spent those days focused on the lock on the room's door, perhaps its most sensitive piece of technology of all. Now, more than a year and a half later, they're finally bringing to light the results of that work: a technique they discovered that would allow an intruder to open any of millions of hotel rooms worldwide in seconds, with just two taps.

Today, Ian Carroll, Lennert Wouters, and a team of other security researchers are revealing a hotel keycard hacking technique they call Unsaflok. The technique is a collection of security vulnerabilities that would allow a hacker to almost instantly open several models of Saflok-brand RFID-based keycard locks sold by the Swiss lock maker Dormakaba. The Saflok systems are installed on 3 million doors worldwide, inside 13,000 properties in 131 countries.

By exploiting weaknesses in both Dormakaba's encryption and the underlying RFID system Dormakaba uses, known as MIFARE Classic, Carroll and Wouters have demonstrated just how easily they can open a Saflok keycard lock. Their technique starts with obtaining any keycard from a target hotel—say, by booking a room there or grabbing a keycard out of a box of used ones—then reading a certain code from that card with a $300 RFID read-write device, and finally writing two keycards of their own. When they merely tap those two cards on a lock, the first rewrites a certain piece of the lock's data, and the second opens it.

“Two quick taps and we open the door,” says Wouters, a researcher in the Computer Security and Industrial Cryptography group at the KU Leuven University in Belgium. “And that works on every door in the hotel.”

A video of the researchers demonstrating their lock-hacking technique. (The pattern of lights shown on the lock is redacted at one point at the researchers’ request to avoid revealing a detail of their technique they agreed with Dormakaba not to make public.)Video: Ian Carroll

Wouters and Carroll, an independent security researcher and founder of travel website Seats.aero, shared the full technical details of their hacking technique with Dormakaba in November 2022. Dormakaba says that it's been working since early last year to make hotels that use Saflok aware of their security flaws and to help them fix or replace the vulnerable locks. For many of the Saflok systems sold in the last eight years, there's no hardware replacement necessary for each individual lock. Instead, hotels will only need to update or replace the front desk management system and have a technician carry out a relatively quick reprogramming of each lock, door by door.

Wouters and Carroll say they were nonetheless told by Dormakaba that, as of this month, only 36 percent of installed Safloks have been updated. Given that the locks aren't connected to the internet and some older locks will still need a hardware upgrade, they say the full fix will still likely take months longer to roll out, at the very least. Some older installations may take years.

“We have worked closely with our partners to identify and implement an immediate mitigation for this vulnerability, along with a longer-term solution,” Dormakaba wrote to WIRED in a statement, though it declined to detail what that “immediate mitigation” might be. “Our customers and partners all take security very seriously, and we are confident all reasonable steps will be taken to address this matter in a responsible way.”

The technique to hack Dormakaba's locks that Wouters and Carroll's research group discovered involves two distinct kinds of vulnerabilities: One that allows them to write to its keycards, and one that allows them to know _what_ data to write to the cards to successfully trick a Saflok lock into opening. When they analyzed Saflok keycards, they saw that they use the MIFARE Classic RFID system, which has been known for more than a decade to have vulnerabilities that allow hackers to write to keycards, though the brute-force process can take as long as 20 seconds. They then cracked a part of Dormakaba's own encryption system, its so-called key derivation function, which allowed them to write to its cards far faster. With either of those tricks, the researchers could then copy a Saflok keycard at will, but still not generate one for a different room.

The researchers' more crucial step required them to obtain one of the lock programming devices that Dormakaba distributes to hotels, as well as a copy of its front desk software for managing keycards. By reverse engineering that software, they were able to understand all the data stored on the cards, pulling out a hotel property code as well as a code for each individual room, then create their own values and encrypt them just as Dormakaba's system would, allowing them to spoof a working master key that opens any room on the property. “You can make a card that really looks as if it was created by the software from Dormakaba, essentially,” says Wouters.

And how did Carroll and Wouters obtain Dormakaba's front desk software? “We nicely asked a few people,” Wouters says. “Manufacturers assume that no one will sell their equipment on eBay, and that no one will make a copy of their software, and those assumptions, I think everyone knows, are not really valid.”

Once they'd managed all that reverse engineering work, the final version of their attack could be pulled off with little more than a $300 Proxmark RFID read-write device and a couple of blank RFID cards, an Android phone, or a Flipper Zero radio hacking tool.

A Saflok branded lock.

Photograph: Dormakaba

The biggest caveat to the hackers' Unsaflok technique is that it still requires that they have a keycard—even an expired one—for a room somewhere in the same hotel as the room they're targeting. That's because each card has a property-specific code they need to read and then duplicate on their spoofed card, as well as a room-specific one.

Once they have that property code, the technique also requires using an RFID read-write device to write two cards—one card that reprograms a target lock as well as the second spoofed card that unlocks it. (An Android phone or a Flipper Zero could also be used to emit one signal after another instead of the two cards, the researchers say.) The researchers hint that the first card allows them to open a target room without guessing its unique identifier in the hotel's system, but declined to say exactly what that first card does. They're holding that element of the technique in confidence to avoid giving too clear a set of instructions to would-be intruders or thieves.

By contrast, one security researcher presented a similar hotel keycard hack that opened locks sold by the firm Onity at the Black Hat conference in 2012 with no such obfuscation, and allowed any hacker to build a device that opened any of Onity's 10 million locks worldwide. When Onity refused to pay for the hardware upgrades necessary to solve the problem and instead put the onus on its customers, the issue remained unfixed in many hotels—and eventually was exploited in at least one hacker's cross-country burglary spree.

Carroll and Wouters say that they're trying to avoid that scenario by taking a more cautious approach, while still warning the public about their technique, given that hundreds of properties will likely remain vulnerable to it even now that Dormakaba has offered its fix. “We're trying to find the middle ground of helping Dormakaba to fix it quickly, but also telling the guests about it," says Carroll. “If someone else reverse engineers this today and starts exploiting it before people are aware, that might be an even bigger problem.”

To that end, Carroll and Wouters point out that hotel guests can recognize the vulnerable locks most often—but not always—by their distinct design: a round RFID reader with a wavy line cutting through it. They suggest that if hotel guests do have a Saflok on their door, they can determine if it's been updated by checking their keycard with the NFC Taginfo app by NXP, available for iOS or Android. If the lock is manufactured by Dormakaba, and that app shows that the keycard is still a MIFARE Classic card, it's likely still vulnerable.

If that's the case, the two researchers say, there's not much to do other than avoid leaving valuables in the room and, when you're inside, bolt the chain on the door. They warn that the deadbolt on the room is also controlled by the keycard lock, so it doesn't provide an extra safeguard. “If someone locks the deadbolt, they’re still not protected,” says Carroll.

Even without a perfect or fully implemented fix, Wouters and Carroll argue, it's better for hotel guests to know the risks than to have a false sense of security. After all, they point out, the Saflok brand has been sold for more than three decades, and may have been vulnerable for much or all of those years. Though Dormakaba says it's not aware of any past use of Wouters and Carroll's technique, the researchers point out that doesn't mean it never happened in secret.

“We think the vulnerability has been there for a long time,” says Wouters. “It's unlikely that we are the first to find this.”

Hackers Found a Way to Open Any of 3 Million Hotel Keycard Locks in Seconds

Cookie pop-ups now show the number of “partners” that websites may share data with. Here's how many of these third-party companies may get your data from some of the most popular sites online.

Everywhere you go online, you’re being tracked. Almost every time you visit a website, trackers gather data about your browsing and funnel it back into targeted advertising systems, which build up detailed profiles about your interests and make big profits in the process. In some places, you’re tracked more than others.

In a little-noticed change at the end of last year, thousands of websites started being more transparent about how many companies your data is being shared with. In November, those infuriating cookie pop-ups—which ask your permission to collect and share data—began sharing how many advertising “partners” each website is working with, giving a further glimpse of the sprawling advertising ecosystem. For many sites, it’s not pretty.

A WIRED analysis of the top 10,000 most popular websites shows that dozens of sites say they are sharing data with more than 1,000 companies, while thousands of other websites are sharing data with hundreds of firms. Quiz and puzzle website JetPunk tops the pile, listing 1,809 “partners” that may collect personal information, including “browsing behavior or unique IDs.”

More than 20 websites from publisher Dotdash Meredith—including Investopedia.com, People.com, and Allrecipes.com—all say they can share data with 1,609 partners. The newspaper _The Daily Mail_ lists 1,207 partners, while internet speed-monitoring firm Speedtest.net, online medical publisher WebMD, and media outlets Reuters, ESPN, and BuzzFeed all state they can share data with 809 companies. (WIRED, for context, lists 164 partners.) These hundreds of advertising partners include dozens of firms most people have likely never heard of.

“You can always assume all of them are first going to try and disambiguate who you are,” says Midas Nouwens, an associate professor at Aarhus University in Denmark, who has previously built tools to automatically opt out of tracking by cookie pop-ups and helped with the website analysis. The data collected can vary by website, and the cookie pop-ups allow some control over what can be gathered; however, the information can include IP addresses, fingerprinting of devices, and various identifiers. “Once they know that, they might add you to different data sets, or use it for enrichment later when you go to a different site,” Nouwens says.

The online advertising world is a messy, murky space, which can involve networks of companies building profiles of people with the aim of showing you tailored ads the second you open a webpage. For years, strong privacy laws in Europe, such as the GDPR, have resulted in websites showing cookie consent pop-ups that ask for permission to store cookies that collect data on your device. In recent years, studies have shown that cookie pop-ups have included dark patterns, disregarded people’s choices, and are ignored by people. “Every single person we’ve ever observed in user testing doesn't read any of this. They find the fastest way they can to close it out,” says Peter Dolanjski, a product director at privacy-focused search engine and browser DuckDuckGo. “So they end up in a worse privacy state.”

For the website analysis, Nouwens scraped the 10,000 most popular websites and analyzed whether the collected pop-ups mentioned partners and, if so, the number they disclosed. WIRED manually verified all the websites mentioned in this story, visiting each to confirm the number of partners they displayed. We looked at the highest total number of partners within the whole data set, and the highest number of partners for the top 1,000 most popular websites. The process, which is only a snapshot of how websites share data, provides one view of the complex ecosystem. The results can vary depending on where in the world someone visits a website from.

It also only includes websites using just one system to display cookie pop-ups. Many of the world’s biggest websites—think Google, Facebook, and TikTok—use their own cookie pop-ups. However, thousands of websites, including publishers and retailers, use third-party technology, made by consent management platforms (CMPs), to show the pop-ups. These pop-ups largely follow standards from the marketing and advertising group IAB Europe, which details the information that should be included in the cookie pop-ups.

Some of the Most Popular Websites Share Your Data With Over 1,500 Companies

Anonymous, candid reviews made Glassdoor a powerful place to research potential employers. A policy shift requiring users to privately verify their real names is raising privacy concerns.

Using Glassdoor, the site famous for candid employee reviews that break through corporate facades, is less anonymous than it used to be.

In July last year, the company added new social features integrated from Fishbowl, an app for work-related discussions acquired in 2021. Glassdoor has also changed its sign-up process to ask people to disclose their full name, job title, and employer; historically, it had required email addresses, but not names. In tests by WIRED, returning users who didn’t previously provide a full name are prompted to enter one by an impossible-to-dismiss pop-up that says, “Entering your real name is required to verify your profile but other users won't see your name unless you choose to share it.”

Reviews of employers posted to Glassdoor remain anonymous, and people can post in its new discussion channels with only their work titles or employer visible, but the company’s policy of collecting and verifying real names has triggered concern among some users and privacy experts.

Alarm about those changes recently spread on social media, where several people described logging in to old Glassdoor accounts and allegedly finding their names had been added, they say, without their consent. WIRED reviewed emails in which one user was told by a Glassdor support representative that they would not be able to remove their name, and would have to delete their account if they wanted it gone. Glassdoor did not provide comment on these scenarios. When this reporter attempted to delete or change her name from a Glassdoor profile, the site instead provided a link to contact the help center to make changes.

Glassdoor’s help pages say it has to verify identities and employment information to “ensure that our users can engage in authentic, candid conversations with other professionals, coworkers, and company leaders in a safe space.” Having verified identity info on file could also make it more seamless for people to respond to the job ads listed on the platform. But trying to maintain that accuracy comes with a cost.

“You can’t both be verified and anonymous,” says Albert Fox Cahn, founder and executive director of the Surveillance Technology Oversight Project, a pro-privacy organization. “You can’t both be a social network and a confidential reporting space. You can do one of those well, or you can do both of them badly.”

The concerns over Glassdoor’s evolving policies on real names show how confusion can arise when a platform that many people visit only infrequently shifts its business model. Amanda Livingood, Glassdoor’s VP of corporate communications, provided a statement saying that integrating Fishbowl with Glassdoor created a broader set of services that user information is now shared across—a different model to that many people with older Glassdoor accounts signed up for. Fishbowl’s old terms of service state that people who signed up for accounts may have been required to add their names.

“When a user provides information, either during the sign-up process or by uploading a résumé, that information will automatically cross-populate between all Glassdoor services, including our community app Fishbowl,” Livingood says. “When using Glassdoor and Fishbowl, there is always the option to remain anonymous. Users can choose to be fully anonymous or reveal elements of their identity, like company name or job title, while using our community service.” Company help pages say real names and email addresses are used only for “verification purposes _only_.”

Glassdoor has a history of working to keep its users’ identities private, but there are concerns about these identity changes. “Glassdoor has been second to none in defending their user’s First Amendment rights,” says Aaron Mackey, a senior staff attorney with the digital rights group Electronic Frontier Foundation. He represented a Glassdoor user in a case initiated in 2019 when their former employer, cryptocurrency exchange Kraken, attempted to unmask the authors of reviews, alleging that former workers had violated severance agreements with their posts. (The parties settled and the subpoena was withdrawn in 2020).

The current terms, Mackey says, are a big shift. “This is concerning, if the way in which they’re operating their business now creates potential for people to be identified, separate from whether or not they’re sued.”

Glassdoor won name recognition by marketing itself as a place focused on protecting anonymity, but companies with smaller workforces have always had good odds at guessing who wrote a particular review. That might be even easier if managers can also see social channels on Glassdoor where people are posting with their real names, indicating which workers have accounts on the site. People unaccustomed to thinking about their online footprint could inadvertently leave big clues, for example, by posting anonymously and then less covertly at the same time.

Glassdoor’s terms cite the risk. “You acknowledge that Glassdoor cannot guarantee your anonymity,” as a company or department’s size, the content posted, and the user’s location may allow employers’ to infer who left a review, the document says. “You should understand this risk before submitting Content to the services.”

**Social Pivot**

Glassdoor’s acquisition of Fishbowl in 2021 united two platforms that lured users by hosting relatively unfiltered discussions of work, a place to pick up the kind of gossip more often shared in person. Together they had offered a counterweight to LinkedIn, which relies on people using their full identities and often results in rose-tinted, overly congratulatory, and sometimes downright cringey posts about work.

Glassdoor is owned by Recruit Holdings, which also owns Indeed. Indeed and Glassdoor profit from advertising open jobs. Some 55 million people visit Glassdoor every month, according to the company. Verifying profiles could help prevent trolls from posting fake information about companies and misleading those seeking an insider’s view—all of which erode trust with other users.

Changing policies on names and verification can erode trust, too. If Glassdoor isn’t so anonymous, it may change how some of those users engage. The recent social media discussion inspired some people to try and delete their accounts.

Tracking the evolution of Glassdoor’s terms of service shows how its commitments to users changed as it began to add new social features. The company consolidated its terms with Fishbowl between December 2022 and January 2023, months before the company announced the new discussion channels on Glassdoor.

Some of the changes to the terms added information about how users are verified, as well as how they can be anonymous across services. Glassdoor’s terms of use state that the company may use information obtained from third parties to update profiles, along with personal data provided on résumés or elsewhere on its services. It may also attempt to verify employment history.

Glassdoor’s approach is very different from that of Blind, a younger, competing forum where people discuss work. It requires an email to sign up, and a work email to access certain features, but says that it does not store email addresses, and that activity on the site cannot be linked back to a person’s email. Blind does not require real names to use its services, but employers could potentially know an employee signed up by seeing they received a verification code at a company email address.

Glassdoor calls its community aspects a “verified network,” requiring people to confirm their identity, including name, job title, industry, company, and active email address or social network to gain access to all of the Glassdoor services. (It also recommends handing over both work and personal email addresses, as well as a phone number.) On a page updated in December, Glassdoor says it uses a “proprietary verification process” to validate accounts, along with confirming emails or an active profile from another social network.

The company’s help pages also say, “We don’t allow anyone, including employers, to access the identity of anonymous posts.”

But Glassdoor’s pages add a caveat: “Considering the reality of our digital age, we're unable to fully confirm our users' identities, the truthfulness of their contributions, or their employment status.”

Glassdoor Wants to Know Your Real Name

Plus: The operator of a dark-web cryptocurrency “mixing” service is found guilty, and a US senator reveals that popular safes contain secret backdoors.

How do you know the internet has a deepfake porn problem? Just look at copyright takedown requests. WIRED found this week that Google is receiving thousands of Digital Millennium Copyright Act complaints for deepfake nudes, most of which are published by just a handful of websites. Experts say the deluge of DMCA takedown requests is evidence that Google should delist the offending sites from search. In Texas, meanwhile, a federal court upheld the state’s age-verification requirements for porn sites, which could lead to even more lawsuits.

In a win for privacy advocates, Airbnb announced on Monday that it will ban the use of indoor security cameras at short-term rental properties around the world. The ban extends to outdoor areas where there is a “greater expectation of privacy,” such as saunas or outdoor showers. The company has long banned the use of hidden cameras and required hosts to tell guests where it has security cameras installed. Hosts who violate the security cam ban could have their properties removed from Airbnb.

Cryptocurrency firm Binance’s troubles have gone from bad to downright scary. Two of the company's executives—Tigran Gambaryan, a former financial crimes investigator for the IRS, and UK-based government affairs specialist Nadeem Anjarwalla, have been held for weeks by Nigeria’s government amid its broader crackdown on cryptocurrency. Neither man has been charged with any crime, and their families are asking the US and UK governments for help securing their release.

In case you’re wondering: No, the US government isn’t hiding evidence of aliens, according to a new Pentagon report. But it sure seems to be hiding _something_, raising more questions about what’s out there if that thing isn’t UFOs. Elsewhere in the world of government secrets, the US House Intelligence Committee chair recently held a closed-door meeting in which he urged lawmakers to block privacy reforms to a major US surveillance program by citing how it could be used to surveil US-based protesters, further raising civil liberties concerns. Congress’ efforts to renew that program, known as Section 702, remain ongoing.

Donald Trump this week earned enough delegates in the 2024 Republican primary to officially win the party’s nomination. If Trump does win another term in the White House, experts fear he could use a slate of “emergency powers” to carry out an authoritarian agenda—and there’s little the other branches of government could do to stop him.

Finally, reporters at _Der Spiegel_, Recorder, _The_ _Washington Post_, and WIRED collaborated on an investigation into a global network of violent predators who use major platforms like Discord, Telegram, and even Roblox to target children and extort them into committing horrific acts of abuse—or worse.

And that’s not all. Each week, we round up the security news we didn’t cover in-depth ourselves. Click the headlines to read the full stories, and stay safe out there.

Insurance companies have long offered discounts to drivers who'll carry GPS devices or download smartphone apps that track their driving habits. But when wary drivers refuse, insurers find other ways of monitoring their driving. Data brokers like LexisNexus are buying people's car data directly from manufacturers, such as General Motors, which are making a killing by selling it off. This data is then used to create “risk” scores for individual drivers, which insurance providers use to set premiums. The businesses claim the data-sharing is consensual, but most drivers have no idea what's happening. Drivers whose risk scores are shared with insurance providers often see their monthly insurance payments skyrocket.

**The Bitcoin Fog Case Ends in a Guilty Verdict**

The operator of a darknet cryptocurrency “mixing” service called Bitcoin Fog faces a maximum of 20 years in prison after his conviction this week by a federal jury in Washington, DC. Roman Sterlingov, 35, ran Bitcoin Fog between 2011 and 2021, moving roughly $400 million worth of currency, much of which, prosecutors say, was tied to narcotics, identity theft, and cybercrime. Sterlingov had denied founding Bitcoin Fog in interviews with WIRED; however, the US Justice Department countered that claim in court with blockchain analysis and a trial of financial paperwork.

**Popular Safes Contain Secret Backdoors**

Two commercial safe makers have been called out for installing backdoors in their safes, according to a letter by Ron Wyden, a US senator from Oregon. The reset codes are one reason the Department of Defense has banned the safes from being used inside the US government. Knowledge of the codes, which Wyden says leaves consumers vulnerable to criminals and spies, was made public through a letter he wrote to the National Counterintelligence and Security Center. In it, he asks the agency to issue an alert, warning Americans about the risks posed by the safes.

Automakers Are Telling Your Insurance Company How You Really Drive

For months, US lawmakers have examined every side of a historic surveillance debate. With the introduction of the SAFE Act, all that’s left to do now is vote.

A bill introduced by senators Dick Durbin and Mike Lee to reauthorize the Section 702 surveillance program is the fifth introduced in the US Congress this winter. The authority is threatening to expire in a month, disrupting a global wiretapping program said to inform a third of articles in the President’s Daily Briefing—a morning “tour d’horizon” of US spies’ top concerns.

But the stakes aren't exactly so clear. With or without Congress, the Biden administration is seeking court approval to extend the 702 program into 2025. From the moment US representative Mike Johnson assumed the House speakership, he’s been unable to orchestrate a vote on the program. Outgunned most recently by Mike Turner, the chairman of the House Intelligence Committee, Johnson was forced to kill a vote after a month of negotiations.

This, even though Congress can essentially agree on one thing if nothing else: that the 702 program is vital to the national defense and that it can’t be allowed to expire. Johnson has, once again, vowed to hold a vote on the matter, this time after Easter. And historically, this is where things have begun to fall apart.

The biggest hurdle to reauthorizing the program is a dispute between lawmakers over whether the government should get search warrants before looking up Americans using 702, a massive wiretap database full of millions of email, voice, and text conversations intercepted by spies.

The Durbin-Lee bill contains tweaks designed, its authors say, to meet the Biden administration halfway. While all the legislation up to this point has wrestled over the title of “reform bill,” Durbin’s has set its sights on an idea far more defensible: The Security and Freedom Enhancement (SAFE) Act, he says, is a “bill of compromise.”

Unlike other reform bills, the SAFE Act would _not_ require the FBI to obtain a warrant to find out if the 702 database contains an American’s communications. Only if the search produces results would investigators need a warrant, and only if they wanted to read what the messages say.

Without going to court, investigators could learn whether the communications they’re after exist, whether the person they’re looking at communicated with any foreigners under US surveillance, and when exactly those conversations took place. As it’s generally trivial for law enforcement to obtain these kinds of records anyway, this is a compromise that doesn’t serve up a major loss for lawmakers on the side of reform.

The tweak will add to the difficulty the FBI is having convincing lawmakers that warrants will hinder investigations or destroy the program altogether. “This narrow warrant requirement is carefully crafted to ensure that it is feasible to implement,” Durbin says, “and sufficiently flexible to accommodate legitimate security needs.”

“There is little doubt that Section 702 is a valuable national security tool,” adds Durbin, but the program sweeps up “massive amounts of Americans’ communications.”

“Even after implementing compliance measures, the FBI still conducted more than 200,000 warrantless searches of Americans’ communications in just one year—more than 500 warrantless searches per day,” he says.

The SAFE Act contains the same menu of emergency exceptions that members of the House Judiciary Committee offered up in previously introduced legislation. The exceptions would allow the FBI to ignore the warrant requirements during emergencies, such as people faced with imminent harm or death. The bureau can search the database at will using “known threat signatures” linked to cybercrimes as well, a carve-out designed to help the FBI dodge legal red tape while mitigating harm from malicious software.

While the possibility looms that the Foreign Intelligence Surveillance Court (FISC) will approve the Biden administration’s request, extending the 702 program into 2025 on its own, it's an outcome that all sides seem eager to avoid—improvising a way to prolong a hotly debated surveillance program being a bad look for nearly everyone involved.

One of the program’s core tenets, according to a “fact sheet” distributed by the Office of the Director of National Intelligence (ODNI) this year, reflects the bargain it strikes between the government and the public: US spies are to receive an “invaluable source of intelligence on foreigners located outside the US.” Americans get in return “robust civil liberties and privacy safeguards, overseen by all three branches of government.”

If Congress had meant, in 2018, to reauthorize the 702 program for seven years rather than six, its members wouldn’t have found out last week. Allowing the program to carry on without a mandate from Congress—with nothing but a green light from a secret court—is a legacy of dysfunction that most members aren’t eager to carry, and one that the intelligence community may also come to resent, as people start to question the integrity of its oversight.

“Although the legislation does not include every reform we have called for, it is a thoughtful compromise that would meaningfully restore privacy in the United States,” says Sean Vitka, policy director at Demand Progress, a digital rights nonprofit.

“An overwhelming number of Americans from across the political spectrum want Congress to seize this once-in-a-generation moment and get this done.”

Sinking Section 702 Wiretap Program Offered One Last Lifeboat

Every US president has the ability to invoke “emergency powers” that could give an authoritarian leader the ability to censor the internet, restrict travel, and more.

Donald Trump appears to dream of being an American authoritarian should he return to office. The former US president, who on Tuesday secured enough delegates to win the 2024 Republican nomination, plans to deport millions of undocumented immigrants and house scores of them in large camps. He wants to invoke the Insurrection Act to deploy the military in cities across the nation to quell civil unrest. He wants to prosecute his political opponents. There’s an organized and well-funded effort to replace career civil servants in the federal government with Trump loyalists who will do his bidding and help him consolidate power.

What’s also concerning to legal experts, though, are the special powers that would be available to him that have been available to all recent presidents but have not typically been used. Should Trump decide to go full authoritarian, he could utilize what are called “emergency powers” to shut down the internet in certain areas, censor the internet, freeze people’s bank accounts, restrict transportation, and more.

Utilizing laws like the National Emergencies Act, the Communications Act of 1934, and the International Emergency Economic Powers Act (IEEPA), he would be able to wield power in ways this country has never seen. Furthermore, America’s vast surveillance state, which has regularly been abused, could theoretically be abused even further to surveil his perceived political enemies.

“There really aren’t emergency powers relating to surveillance, and that’s because the non-emergency powers are so powerful and give such broad authority to the executive branch. They just don’t need emergency powers for that purpose,” says Elizabeth Goitein, senior director of the Brennan Center for Justice’s Liberty & National Security Program at the New York University School of Law.

Goitein says she worries most about what a president could do with the emergency powers available to them, though, when she considers whether a president might decide to behave like an authoritarian. She says the laws surrounding these powers offer few opportunities for another branch of government to stop a president from doing as they please.

“Emergency powers are meant to give presidents extraordinary authorities for use in extraordinary circumstances. Because they provide these very potent authorities, it is critical that they have checks and balances built into them and safeguards against abuse,” Goitein says. “The problem with our current emergency powers system—and that system comprises a lot of different laws—is that it really lacks those checks and balances.”

Under the National Emergencies Act, for example, the president simply has to declare a national emergency of some kind to activate powers that are contained in more than 130 different provisions of law. What constitutes an actual emergency is not defined by these laws, so Trump could come up with any number of reasons for declaring one, and he couldn’t easily be stopped from abusing this power.

“There's a provision of the Communications Act of 1934 that allows the president to shut down or take over communications facilities in a national emergency. There is a provision that allows the president to exert pretty much unspecified controls over domestic transportation, which could be read extremely broadly,” Goitein says. “There’s IEEPA, which allows the president to freeze the assets of and block financial transactions with anyone, including an American, if the president finds it necessary to address an unusual or extraordinary threat that is emanating at least partly from overseas.”

Goitein says that if someone is targeted using IEEPA, they wouldn’t be allowed to even rent an apartment, buy groceries, or have a job in the US. She says Congress needs to reform these laws before a president decides to abuse them.

You can imagine Trump deciding he wants to shut down the internet, use the military as a police force, and utilize the government’s surveillance powers if a large anti-Trump protest were to occur in one or more cities around the country. This would resemble the tactics authoritarians have used to quash popular resistance in less democratic countries around the globe.

Though the Insurrection Act is not technically an emergency power, because no emergency has to be declared for it to be used, Goitein says she’s deeply concerned about how that law could be utilized.

“It clearly falls into the category of extraordinary powers that are meant for extraordinary circumstances,” Goitein says. “The Insurrection Act gives the president incredibly broad discretion to use federal armed forces as a domestic police force.”

Chris Edelson, an assistant professor of government at the American University, tells WIRED that he worries what Trump might do regardless of what is lawfully allowed.

“I think he will do what he can get away with, and he will make use of whatever tools are available, which could include statutory provisions like the National Emergencies Act, or it could just include acting by fiat. He could just say, ‘I’ll order the government to do whatever I want,’” Edelson says.

If the US Supreme Court were to rule that Trump has overstepped what he’s allowed to do, Edelson says he’s not confident Trump would obey such a decision. This harkens back to something that happened in 1832 when President Andrew Jackson said of the Supreme Court decision in _Worcester v. Georgia_, “\[Chief Justice\] John Marshall has made his decision, now let him enforce it.” The Supreme Court can put out a decision, but it’s not guaranteed that a president will listen. The executive branch has been operating under norms, and Trump likes to break norms.

“Trump is a bully at heart. He might try to ignore a court ruling,” Edelson says. “He’ll do whatever he thinks he can get away with, including ignoring a judicial decision.”

Regardless of who’s president, Goitein and Delson both say that Congress needs to reform the laws that allow presidents to wield such great power. If they’re not abused by Trump, they could be abused by another president in the future. It’s best not to leave a powerful weapon available to someone who may one day be tempted to use it, and Trump has historically tested what a president can get away with.

Source

Wired