“The people are in the streets. We can’t ignore them any longer. Really, we have little choice. Either we heal together, or we tear ourselves apart.” An exclusive excerpt from 2054: A Novel.

2054, Part IV: A Nation Divided

After a slowdown in payments to ransomware gangs in 2022, last year saw total ransom payouts jump to their highest level yet, according to a new report from crypto-tracing firm Chainalysis.

A year ago, there seemed to be a glimmer of hope in the cybersecurity industry's long-running war of attrition against ransomware gangs. Fewer corporate victims of those hackers, it seemed, had paid ransoms in 2022, and cybercriminals were earning less from their ruthless attacks. Perhaps the cocktail of improved security measures, increased focus from law enforcement, international sanctions on the ransomware operators, and scrutiny of the cryptocurrency industry could actually beat the ransomware scourge.

Well, no. That respite appears to have been a mere hiccup on ransomware's trajectory to become one of the world's most profitable, and perhaps _the_ most disruptive, form of cybercrime. In fact, 2023 was its worst year ever.

On Wednesday, cryptocurrency-tracing firm Chainalysis published new numbers from its annual crime report showing that ransomware payments exceeded $1.1 billion in 2023, based on its tracking of those payments across blockchains. That's the highest number Chainalysis has measured for a single year, and nearly twice as much as the year before. Indeed, the company now describes 2022's relatively low $567 million in ransom payments as an “anomaly,” as total extortion transactions have steadily grown since 2020 towards their current 10-figure record.

“It's like we've picked up right where we left off, the real onslaught during Covid in 2020 and 2021,” says Jackie Burns Koven, head of threat intelligence at Chainalysis. “It feels very gloves-off.”

That record-breaking $1 billion-plus in extortion payments was a result, in part, of the sheer number of ransomware attacks in 2023. Cybersecurity firm Record Future counted 4,399 ransomware attacks last year, based on news reports and ransomware gangs' public listings of victims on their dark-web sites, a tactic the groups often use to pressure victims while threatening to release their stolen data. That's compared to just 2,581 total attacks in 2022 and 2,866 in 2021.

The spike in the number of attacks appears to have offset a more positive trend: By some counts, fewer victims of ransomware are paying the ransoms that hackers demand. According to data from the incident response firm Coveware, which frequently negotiates with ransomware gangs on behalf of victims, only 29 percent of ransomware victims paid a ransom in the fourth quarter of 2023, a dramatic drop from payment rates between 70 percent and 80 percent for most of 2019 and 2020.

Even as fewer victims are paying, however, the total sum collected by ransomware gangs is nonetheless growing as more cybercriminals are drawn to a lucrative industry and carry out more attacks. Allan Liska, a threat intelligence analyst at Recorded Future, argues that the highly public nature of ransomware serves as a kind of advertising, constantly pulling in more opportunistic hackers, like sharks who smell blood in the water. “Everybody _sees_ all these ransomware attacks,” Liska says. “Criminals tend to flock to where they see the money being made.”

Total annual ransomware payments over time.

Courtesy of Chainalysis

Chainalysis notes that the record $1.1 billion in ransoms paid in 2023 was also driven by ransomware hackers demanding larger sums from victims, many of whom were carefully chosen for both their inability to tolerate a crippling attack and their ability to pay—what Chainalysis' Burns Koven calls “big game hunting.” That resulted in close to 75 percent of ransomware payments' total value coming from transactions topping the $1 million mark in 2023, compared to just 60 percent in 2021.

Given ransomware's cutthroat evolution, 2022's dip in total payments now seems to represent a rare aberration. Chainalysis and other security firms explain that off year by pointing to the war in Ukraine—which disrupted Ukrainian ransomware operators, distracted Russian ones pulled into political hacking, and caused strife within ransomware groups with mixed loyalties—as well as international sanctions that dissuaded victims from paying ransoms and major law enforcement crackdowns.

In one case, for instance, the prolific ransomware group known as Conti disbanded after one of its leaders posted a statement in support of Russia's war in Ukraine and another dissented by leaking a vast trove of the group's internal communications. Many of Conti's members then reformed under the brand of the Hive ransomware operation—which turned out to have been infiltrated for months by the FBI and other agencies who were quietly stealing the group's decryption keys to foil hundreds of their extortion attempts. Chainalysis estimates that that sting alone likely prevented more than $200 million in ransomware payments. “The dissolution of Conti was almost a perfect storm,” says Burns Koven.

Last year, by contrast, saw a perform storm of a very different kind: The Cl0p ransomware group exploited a vulnerability in the MOVEit file transfer application to compromise thousands of victims, combing through them for the most high-value targets. Several were medical companies and government agencies holding millions of sensitive records. In total, at least 62 million people were affected, and Cl0p reaped more than $100 million from that mass exploitation, accounting for 45 percent of all ransom payments in June of 2023 and 39 percent in July by Chainalysis' count.

The continued growth of the ransomware business—whose disruption for victims, it should be noted, costs well beyond the $1.1 billion that some of them paid in 2023—may seem like a sign of failure for the continued crackdown on cryptocurrency crime: Since the beginning of the decade, regulators and law enforcement have been going after not just ransomware groups, but the rogue exchanges and “mixers” that often serve as money laundering tools that allow cybercriminals to cash out their crypto profits.

Burns Koven argues, however, that even 2023's record-breaking ransom total doesn't mean the crypto crackdown isn't working. In fact, she says, it's driven ransomware groups to constantly seek new laundering methods and, in some cases, forced them to hold on to ransom payments for years before they attempt to cash out that dirty crypto, for fear that it will be frozen or seized. She adds that faster reporting to law enforcement from victims who pay ransoms—faster even than Chainalysis or other crypto-tracing firms can spot those payments on blockchains—could further aid in chasing down those funds and preventing them from being liquidated.

“The best way to bring these numbers down is to impact that laundering and cashing-out process,” says Burns Koven. Beyond even flashy law enforcement operations like the Hive takeover, she says that “there's also operational friction and paralysis that contributes to stagnating some of their operations and ability to profit.”

For now, though, ransomware is looking anything but stagnant. And if tightening the screws on money launderers—or the victims paying ransoms, or the hackers themselves—has any chance of solving the problem, those screws aren't tight enough yet.

Ransomware Payments Hit a Record $1.1 Billion in 2023

“You’d have an incomprehensible level of computational, predictive, analytic, and psychic skill. You’d have the mind of God.” An exclusive excerpt from 2054: A Novel.

2054, Part III: The Singularity

New EU rules mean WhatsApp and Messenger must be interoperable with other chat apps. Here’s how that will work.

A frequent annoyance of contemporary life is having to shuffle through different messaging apps to reach the right person. Messenger, iMessage, WhatsApp, Signal—they all exist in their own silos of group chats and contacts. Soon, though, WhatsApp will do the previously unthinkable for its 2 billion users: allow people to message you from another app. At least, that's the plan.

For about the past two years, WhatsApp has been building a way for other messaging apps to plug themselves into its service and let people chat across apps—all without breaking the end-to-end encryption it uses to protect the privacy and security of people’s messages. The move is the first time the chat app has opened itself up this way, and it potentially offers greater competition.

It isn’t a shift entirely of WhatsApp’s own making. In September, European, lawmakers designated WhatsApp parent Meta as one of six influential “gatekeeer” companies under its sweeping Digital Markets Act, giving it six months to open its walled garden to others. With just a few weeks to go before that time is up, WhatsApp is detailing how its interoperability with other apps may work.

“There’s real tension between offering an easy way to offer this interoperability to third parties whilst at the same time preserving the WhatsApp privacy, security, and integrity bar,” says Dick Brouwer, an engineering director at WhatsApp who has worked on Meta rolling out encryption to its Messenger app. “I think we're pretty happy with where we’ve landed.”

Interoperability in both WhatsApp and Messenger—as dictated by Europe’s rules—will initially focus on text messaging, sending images, voice messages, videos, and files between two people. Calls and group chats will come years down the line. Europe’s rules apply only to messaging services, not traditional SMS messaging. “One of the core requirements here, and this is really important, is for users for this to be opt-in,” says Brouwer. “I can choose whether or not I want to participate in being open to exchanging messages with third parties. This is important, because it could be a big source of spam and scams.”

WhatsApp users who opt in will see messages from other apps in a separate section at the top of their inbox. This “third-party chats” inbox has previously been spotted in development versions of the app. “The early thinking here is to put a separate inbox, given that these networks are very different,” Brouwer says. “We cannot offer the same level of privacy and security,” he says. If WhatsApp were to add SMS, it would use a separate inbox as well, although there are no plans to add it, he says.

Overall, the idea behind interoperability is simple. You shouldn’t need to know what messaging app your friends or family use to get in touch with them, and you should be able to communicate from one app to another without having to download both. In an ideal interoperable world, you could, for example, use Apple’s iMessage to chat with someone on Telegram. However, for apps with millions or billions of users, making this a reality isn’t straightforward—encrypted messaging apps use their own configurations and different protocols and have different standards when it comes to privacy.

Despite WhatsApp working on its interoperability plan for more than a year, it will still take some time for third-party chats to hit people’s apps. Messaging companies that want to interoperate with WhatsApp or Messenger will need to sign an agreement with the company and follow its terms. The full details of the plan will be published in March, Brouwer says; under EU laws, the company will have several months to implement it.

Brouwer says Meta would prefer if other apps use the Signal encryption protocol, which its systems are based upon. Other than its namesake app and the Meta-owned messengers, the Signal Protocol is publicly disclosed as being used in Google Messages and Skype. To send messages, third-party apps will need to encrypt content using the Signal Protocol and then package it into message stanzas in the eXtensible Markup Language (XML). When receiving messages, apps will need to connect to WhatsApp’s servers.

“We think that the best way to deliver this approach is through a solution that is built on WhatsApp’s existing client-server architecture,” Brouwer says, adding it has been working with other companies on the plans. “This effectively means that the approach that we’re trying to take is for WhatsApp to document our client- server protocol and letting third-party clients connect directly to our infrastructure and exchange messages with WhatsApp clients.”

There is some flexibility to WhatsApp interoperability. Meta’s app will also allow other apps to use different encryption protocols if they can “demonstrate” they reach the security standards that WhatsApp outlines in its guidance. There will also be the option, Brouwer says, for third-party developers to add a proxy between their apps and WhatsApp’s server. This, he says, could give developers more “flexibility” and remove the need for them to use WhatsApp’s client-server protocols, but it also “increases the potential attack vectors.”

So far, it is unclear which companies, if any, are planning to connect their services to WhatsApp. WIRED asked 10 owners of messaging or chat services—including Google, Telegram, Viber, and Signal—whether they intend to look at interoperability or had worked with WhatsApp on its plans. The majority of companies didn’t respond to the request for comment. Those that did, Snap and Discord, said they had nothing to add. (The European Commission is investigating whether Apple’s iMessage meets the thresholds to offer interoperability with other apps itself. The company did not respond to a request for comment. It has also faced recent challenges in the US about the closed nature of iMessage.)

Matthew Hodgson, the cofounder of Matrix, which is building an open source standard for encryption and operates the messaging app Element, confirms that his company has worked with WhatsApp on interoperability in an “experimental” way but that he cannot say any more due to signing a nondisclosure agreement. In a talk last weekend, Hodgson demonstrated “hypothetical” architectures for ways that Matrix could connect to the systems of two gatekeepers that don’t use the same encryption protocols.

Meanwhile, Julia Weis, a spokesperson for the Swiss messaging app Threema, says that while WhatsApp did approach it to discuss its interoperability plans, the proposed system didn’t meet Threema’s security and privacy standards. “WhatsApp specifies all the protocols, and we’d have no way of knowing what actually happens with the user data that gets transferred to WhatsApp—after all, WhatsApp is closed source,” Weis says. (WhatsApp’s privacy policy states how it uses people’s data.)

When the EU first announced that messaging apps may have to work together in early 2022, many leading cryptographers opposed the idea, saying it adds complexity and potentially introduces more security and privacy risks. Carmela Troncoso, an associate professor at the Swiss university École Polytechnique Fédérale de Lausanne, who focuses on security and privacy engineering, says interoperability moves could potentially lead to different power relationships between companies, depending on how they are implemented.

“This move for interoperability will, on the one hand, open the market, but also maybe close the market in the sense that now the bigger players are going to have more decisional power,” Troncoso says. “Now, if the big player makes a move and you want to continue being interoperable with this big player, because your users are hooked up to this, you're going to have to follow.”

While the interoperability of encrypted messaging apps may be possible, there are some fundamental challenges about how the systems will work in the real world. How much of a problem spam and scamming will be across apps is largely unknown until people start using interoperable setups. There are also questions about how people will find each other across different apps. For instance, WhatsApp uses your phone number to interact and message other people, while Threema randomly generates eight-digit IDs for people’s accounts. Linking up with WhatsApp “could de-anonymize Threema users,” Weis, the Threema spokesperson says.

Meta’s Brouwer says the company is still working on the interoperability features and the level of support it will make available for companies wanting to integrate with it. “Nobody quite knows how this works,” Brouwer says. “We have no idea what the demand is.” However, he says, the decision was made to use WhatsApp’s existing architecture to run interoperability, as it means that it can more easily scale up the system for group chats in the future. It also reduces the potential for people’s data to be exposed to multiple servers, Brouwer says.

Ultimately, interoperability will evolve over time, and from Meta’s perspective, Brouwer says, it will be more challenging to add new features to it quickly. “We don't believe interop chats and WhatsApp chats can evolve at the same pace,” he says, claiming it is “harder to evolve an open network” compared to a closed one. “The second you do something different—than what we know works really well—you open up a wormhole of security, privacy issues, and complexity that is always going to be much bigger than you think it is.”

WhatsApp Chats Will Soon Work With Other Encrypted Messaging Apps

“If molecules really were the new microchips, the promise of remote gene editing was that the body could be manipulated to upgrade itself.” An exclusive excerpt from 2054: A Novel.

2054, Part II: Next Big Thing

“They had, quite swiftly, begun an algorithmic scrub of any narrative of the president suffering a health emergency, burying those stories.” An exclusive excerpt from 2054: A Novel.

2054, Part I: Death of a President

Plus: Russia was likely behind widespread GPS outages, Vault 7 leaker was sentenced, police claim to trace Monero cryptocurrency, and more.

An indictment from the US Department of Justice may have solved the mystery of how disgraced cryptocurrency exchange FTX lost over $400 million in crypto. The indictment, filed last week, alleges that three individuals used a SIM-swapping attack to steal hundreds of millions in virtual currency from an unnamed company. The timing and the amount stolen coincides with FTX's theft. Meanwhile, in a letter obtained by WIRED this week, seven lawmakers have demanded the DOJ stop funding biased and inaccurate predictive policing tools until the agency has a way to ensure law enforcement won’t use them in a way that has a “discriminatory impact.”

In Florida, prosecutors say a 17-year-old named Alan Winston Filion is responsible for hundreds of swatting attacks around the United States. The news of his arrest was first reported by WIRED days before law enforcement made it public. It was the culmination of a multi-agency manhunt to piece together a trail of digital breadcrumbs left by the teenager. In Ukraine, unmanned aerial vehicles have been powerful tools since the Russian invasion began in February 2022. But as the war rages on, another kind of unmanned robot has increasingly appeared on the front-lines: the unmanned ground vehicle, or UGV.

For months lawyers affiliated with an India based hacker-for-hire firm called Appin Technology have used legal threats to censor reporting about the company’s alleged cyber mercenary past. The EFF, Techdirt, MuckRock, and DDoSecrets are now pushing back, publicly sharing details for the first time about the firm's efforts to remove content from the web. It’s a dangerous world out there, so we’ve also got a list of some major patches issued in January that you can use to update your devices to keep them secure.

And there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

For years Western security officials have warned about the threat of China collecting data about millions of people and the country’s hackers infiltrating sensitive systems. This week, Federal Bureau of Investigation director Christopher Wray said hackers affiliated with the Chinese Communist Party are constantly targeting US critical infrastructure, such as water treatment plants, the electrical grid, and oil and gas pipelines. Wray’s testimony, at a House subcommittee on China, came as the FBI also revealed it removed malware from hundreds of routers in people’s homes and offices that had been planted by the Chinese hacking group Volt Typhoon.

“China’s hackers are positioning on American infrastructure in preparation to wreak havoc and cause real-world harm to American citizens and communities,” Wray said in the public appearance. “Low blows against civilians are part of China’s plan.” The FBI director added that China has a bigger hacking operation than “every other major nation combined,” and claimed that if all of the FBI’s cyber-focused agents were assigned to work on issues related to China, they would still be outnumbered “by at least 50 to 1.”

While concerns about the scale of China’s espionage and cyber operations aren’t new, the US intelligence community has been increasingly vocal and worried about critical infrastructure being targeted by Volt Typhoon and other groups. “The threat is extremely sophisticated and pervasive,” NSA officials warned in November. In May 2023, Microsoft revealed it had been tracking Volt Typhoon intrusions at communications and transportation infrastructure, among other critical infrastructure, in US states and Guam.

The FBI and DOJ, also revealed this week that they remotely removed the KV Botnet malware from hundreds of routers infected by Volt Typhoon. The impacted routers, from Cisco and Netgear, were mostly at the end of their life, but were being used as part of wider operations. “​​The Volt Typhoon malware enabled China to hide, among other things, pre-operational reconnaissance and network exploitation against critical infrastructure like our communications, energy, transportation, and water sectors,” Wray said. It isn’t the first time US officials have obtained a court order to remotely wipe devices infected by hackers, but the move is still rare.

Since the first cryptocurrencies emerged more than a decade ago, there has been the assumption that the blockchain-based digital currencies are anonymous and untraceable. They are, in fact, very traceable. Researchers have shown how people can be linked to the transactions they make and law enforcement have used the techniques to help bust illicit dark web markets and catch pedophiles. There are, however, still some privacy-focused cryptocurrencies that appear to be less traceable than Bitcoin. This includes Monero, which is increasingly being adopted by sellers of child sexual abuse materials.

This week investigators in Finland said Moreno-tracing helped reveal the identity of a hacker who allegedly attacked psychotherapy company Vastaamo in 2020, stealing thousands of patient records and threatening to leak them unless people paid a ransom. Investigators from the Finnish National Bureau of Investigation claim they used heuristic analysis to infer where funds were moved to. The investigators did not reveal the full methods of how they allegedly traced the Monero payments, however, they add to the growing body of evidence that cryptocurrency tracing firms and investigators may be able to track the currency.

Planes flying over Europe have faced a spike in accuracy issues with GPS systems used for navigation in recent months. The head of Estonia’s Defense Forces has claimed that Russia is likely the source of this interference, according to an interview with Bloomberg. “Someone is causing it, and we think it’s Russia,” Martin Herem told the publication, adding that Russia may be testing its electronic warfare capabilities and “learning” the most effective tactics. Across Europe, and particularly the Baltics region, there has been a reported increase in GPS jamming, with Finland reporting large interferences in December and pilots repeatedly reporting issues with their navigation systems.

In 2017, the Vault 7 leaks exposed some of the CIA’s most sophisticated hacking tools, including how the agency could compromise routers, phones, PC, and TVs. Joshua Schulte, a former CIA engineer in the agency’s Operations Support Branch who prosecutors identified as being behind the data breach and responsible for leaking the materials to Wikileaks, was convicted in numerous trials in recent years. Schulte, who denied the allegations, has been sentenced to 40 years in prison for the espionage and also for possessing thousands of child abuse images. Judge Jesse Furman, sentencing Schulte, said he had caused “untold damage to national security.” In June 2022, _The New Yorker_ published this comprehensive investigation into the data breach and Schulte’s troubled history working at the agency.

China’s Hackers Keep Targeting US Water and Electricity Supplies

An indictment against three Americans suggests that at least some of the culprits behind the theft of an FTX crypto fortune may be in custody.

When more than $400 million worth of crypto was mysteriously pulled out of the coffers of what was once the world's biggest cryptocurrency exchange, FTX, on the very day that it declared bankruptcy in November of 2022, many initially suspected insiders at the company—including, potentially, then CEO Sam Bankman-Fried, now convicted of fraud. But clues left across blockchains over the past year suggested instead that external thieves had chosen a particularly inconvenient moment during FTX's meltdown to pull off an enormous heist.

Now, new clues revealed in a US Department of Justice indictment suggest something even more surprising: Some of those suspected thieves appear to have been in the United States and have now been arrested.

An indictment filed last week details charges against three people—Robert Powell, Carter Rohn, and Emily Hernandez—who are accused of running a massive cybercriminal theft ring. The group, which authorities say was known as the “Powell SIM Swapping Crew,” allegedly used SIM swaps—tricking phone companies into switching a user's mobile phone registration to the thieves' SIM card so that they can gain access to authentication codes sent to the victim's phone—to steal hundreds of millions of dollars from victims' accounts.

Most notably, the gang is accused of siphoning $400 million in virtual currency from the accounts of a company—named in the indictment only as Victim Company-1—on the night of November 11, 2022, continuing into November 12. As first spotted by cybersecurity journalist Brian Krebs, that is also the exact timing of FTX's theft, which the company itself has pegged at between $415 million and $432 million in stolen crypto.

The blockchain analysis firm Elliptic corroborated Krebs' inference that the $400 million theft described in the report is almost certainly the FTX heist. “We are not aware of any other thefts from crypto businesses on this scale, on these dates,” Elliptic wrote in a blog post. “It therefore appears likely that FTX is the ‘Victim Company-1’ named in the indictment.”

FTX didn't immediately respond to WIRED's request for comment on whether it is the SIM-swapping victim described in the indictment.

If the indictment does, in fact, describe the FTX theft—and given the relative rarity of nine-figure crypto thefts and the exact timing of this one—then the charging document reveals key details about how the FTX heist was pulled off. It describes how Powell allegedly asked Hernandez to target a specific phone number for SIM-swapping. According to prosecutors, Hernandez then obtained a fake ID with her photo but the name of her victim—potentially an FTX staffer—and presented it at an AT&T retail store in Texas to prove her identity as she requested that the staffer's account be transferred to her own phone.

That allowed the group to hijack messages intended for the victim, including authentication codes for his or her account, according to the indictment. Given that those codes usually represent a second-factor authentication mechanism required after a user enters their username and password, it’s not clear how those other credentials might have been stolen, though cybercriminals typically obtain them through phishing, credential-stealing malware, or trying credentials leaked in other database dumps and potentially reused across accounts.

The possibility that the FTX thieves have been identified as Americans, within reach of US law enforcement, comes as a surprise following Elliptic’s discovery in October of last year that the crypto stolen from FTX had moved across blockchains and through cryptocurrency swapping services in a way that suggested Russia-linked money launderers. Portions of the funds, for instance, moved through mixing services—which take in users’ funds and return others to muddy the trail of any blockchain tracing—that are popular with Russian cybercriminals, such as ChipMixer and Sinbad.

Both mixers, in fact, have been sanctioned by the US Treasury Department for their illicit use, including by Russian ransomware gangs. “It’s looking increasingly likely that the perpetrator has links to Russia,” Elliptic’s chief scientist and cofounder Tom Robison told WIRED in October. “We can’t attribute this to a Russian actor, but it’s an indication it might be.”

If the money is FTX's, those blockchain footprints suggest that the $400 million that the hackers allegedly stole is long gone, moved into the hands of international money launderers. “It is therefore not clear whether any of the stolen assets are under their control, and might be recovered,” Elliptic wrote in its blog post today. Nonetheless, if the alleged hackers were paid a portion of that sum in exchange for their work to steal it, that money might still be seized and repaid as restitution to FTX’s many creditors.

Either way, it suggests that another mystery in the story of FTX’s implosion and the billions of dollars in missing funds that disappeared with it may be at least partially solved. If so, it would seem this FTX-related crime, at least, can’t be blamed on Sam Bankman-Fried.

The Mystery of the $400 Million FTX Heist May Have Been Solved

A loose coalition of anti-censorship voices is working to highlight reports of one Indian company’s hacker-for-hire past—and the legal threats aimed at making them disappear.

Hacker-for-hire firms like NSO Group and Hacking Team have become notorious for enabling their customers to spy on vulnerable members of civil society. But as far back as a decade ago in India, a startup called Appin Technology and its subsidiaries allegedly played a similar cyber-mercenary role while attracting far less attention. Over the past two years, a collection of people with direct and indirect links to that company have been working to keep it that way, using a campaign of legal threats to silence publishers and anyone else reporting on Appin Technology’s alleged hacking past. Now, a loose coalition of anti-censorship voices is working to make that strategy backfire.

For months, lawyers and executives with ties to Appin Technology and to a newer organization that shares part of its name, called the Association of Appin Training Centers, have used lawsuits and legal threats to carry out an aggressive censorship campaign across the globe. These efforts have demanded that more than a dozen publications amend or fully remove references to the original Appin Technology’s alleged illegal hacking or, in some cases, mentions of that company’s cofounder, Rajat Khare. Most prominently, a lawsuit against Reuters brought by the Association of Appin Training Centers resulted in a stunning order from a Delhi court: It demanded that Reuters take down its article based on a blockbuster investigation into Appin Technology that had detailed its alleged targeting and spying on opposition leaders, corporate competitors, lawyers, and wealthy individuals on behalf of customers worldwide. Reuters “temporarily” removed its article in compliance with that injunction and is fighting the order in Indian court.

As Appin Training Centers has sought to enforce that same order against a slew of other news outlets, however, resistance is building. Earlier this week, the digital rights group the Electronic Frontier Foundation (EFF) sent a response—published here—pushing back against Appin Training Centers’ legal threats on behalf of media organizations caught in this crossfire, including the tech blog Techdirt and the investigative news nonprofit MuckRock.

No media outlet has claimed that Appin Training Centers—a group that describes itself as an educational firm run in part by former franchisees of the original Appin Technology, which reportedly ceased its alleged hacking operations more than a decade ago—has been involved in any illegal hacking. In December, however, Appin Training Centers sent emails to Techdirt and MuckRock demanding they too take down all content related to allegations that Appin Technology previously engaged in widespread cyberspying operations, citing the court order against Reuters.

Techdirt, Appin Training Centers argued, fell under that injunction by writing about Reuters' story and the takedown order targeting it. So had MuckRock, the plaintiffs claimed, which hosted some of the documents that Reuters had cited in its story and uploaded to MuckRock's DocumentCloud service. In the response sent on their behalf, the EFF states that the two media organizations are refusing to comply, arguing that the Indian court's injunction “is in no way the global takedown order your correspondence represents it to be.” It also cites an American law called the SPEECH Act that deems any foreign court’s libel ruling that violates the First Amendment unenforceable in the US.

“It's not a good state for a free press when one company can, around the world, disappear news articles,” Michael Morisy, the CEO and cofounder of MuckRock, tells WIRED. “That's something that fundamentally we need to push back against.”

Techdirt founder Mike Masnick says that, beyond defeating the censorship of the Appin Technology story, he hopes their public response to that censorship effort will ultimately bring even more attention to the group’s past. In fact, 19 years ago, Masnick coined the term “the Streisand effect” to describe a situation in which someone's attempt to hide information results in its broader exposure—exactly the situation he hopes to help create in this case. “The suppression of accurate reporting is problematic,” says Masnick. “When it happens, it deserves to be called out, and there should be more attention paid to those trying to silence it.”

The anti-secrecy nonprofit Distributed Denial of Secrets (DDoSecrets) has also joined the effort to spark that Streisand Effect, “uncensoring” Reuters' story on the original Appin Technology as part of a new initiative it calls the Greenhouse Project. DDoSecrets cofounder Emma Best says the name comes from its intention to foster a “warming effect”—the opposite of the “chilling effect” used to describe the self-censorship created by legal threats. “It sends a signal to would-be censors, telling them that their success may be fleeting and limited,” Best says. “And it assures other journalists that their work can survive.”

Neither Appin Training Centers nor Rajat Khare responded to WIRED's request for comment, nor did Reuters.

The fight to expose the original Appin Technology’s alleged hacking history began to reach a head in November of 2022, when the Association for Appin Training Centers sued Reuters based only on its reporters’ unsolicited messages to Appin Training Centers’ employees and students. The company’s legal complaint, filed in India’s judicial system, accused Reuters not only of defamation, but “mental harassment, stalking, sexual misconduct and trauma.”

Nearly a full year later, Reuters nonetheless published its article, “How an Indian Startup Hacked the World.” The judge in the case initially sided with Appin Training Centers, writing that the article could have a “devastating effect on the general students population of India.” He quickly ordered an injunction stating that Appin Training Centers can demand Reuters take down their claims about Appin Technology.

That ruling has preceded any legal arguments over the truth of Reuters’ reporting, which the news agency has promised to bring up in an appeal. In fact, Reuters wrote that it based its story on interviews with dozens of Appin Technology's former staff and hundreds of alleged targets, as well as thousands of its internal documents. Those files include Appin Technology's marketing pitch documents that remain publicly available on DocumentCloud thanks to MuckRock, and appear to show the company explicitly offering to hack targets on behalf of clients via “phishing,” “social engineering,” “trojan” infections, and even discussing specific cases when clients hired them for hacking operations.

Appin Training Centers, for its part, argues that it’s merely a collection of educational institutions whose brand has been tarnished by Reuters’ reporting. Reuters has responded in a legal filing arguing that Appin Training Centers was created “solely for purposes of this lawsuit, with ulterior motive,” and pointed out, through an exhibit attached to a court filing, that it was incorporated only months _after_ it named itself as the plaintiff suing Reuters.

Even so, a little more than two weeks after publishing its investigation into Appin Technology, on December 5, Reuters complied with the Indian court's injunction, removing its story. Soon, in a kind of domino effect of censorship, others began to take down their own reports about Appin Technology after receiving legal threats based on the same injunction. SentinelOne, the cybersecurity firm that had helped Reuters in its investigation, removed its research on an Appin Technology subsidiary’s alleged hacking from its website. The Internet Archive deleted its copy of the Reuters article. The legal news site Lawfare and cybersecurity news podcast Risky Biz both published analyses based on the article; Risky Biz took its podcast episode down, and Lawfare overwrote every part of its piece that referred to Appin Technology with Xs. WIRED, too, removed a summary of Reuters' article in a news roundup after receiving Appin Training Centers' threat.

Aside from the injunction that Appin Training Centers has used to demand publishers censor their stories, Appin cofounder Rajat Khare has separately sent legal threats to another collection of news outlets based on a court order he obtained in Switzerland. Two Swiss publications have publicly noted that they responded to court orders by removing Khare’s name from stories about alleged hacking. Others have removed Khare’s name or removed the articles altogether without a public explanation, including the Bureau of Investigative Journalism, the UK’s _Sunday Times_, several Swiss and French news outlets, and eight Indian ones.

“This is an organization throwing everything against the wall, trying to make as many allegations in as many venues as possible in the hopes that something, somewhere sticks,” says one person at a media outlet that has received multiple legal threats from people connected to Appin Technology, who declined to be named due to the legal risks of speaking out. “Sometimes it works, sometimes it doesn’t. Unfortunately, in India, it’s worked.”

Even before the EFF, Techdirt, MuckRock, and DDoSecrets began to push back against that censorship, some had immediately resisted it. _The New Yorker_, for instance, had mentioned a subsidiary of Appin Technology and Rajat Khare in a feature about India's hacker-for-hire industry in June of last year. It was sued by Appin Training Centers, but has kept its piece online while the lawsuit proceeds. (_The New Yorker_ and WIRED are both published by Condé Nast.) Ronald Deibert, a well-known security researcher and founder of the University of Toronto's Citizen Lab, a group that focuses on exposing hackers who target members of civil society, had also mentioned Appin Technology in a blog post. Deibert received and refused Appin Training Centers' takedown threat, posting a screenshot of its email to his X feed in December along with his response: seven middle-finger emojis.

As the backlash to the censorship of reporting on Appin Technology's alleged hacking snowballs, however, it may now be going beyond a few cases where Appin Training Centers’ and Rajat Khare’s censorship attempts have failed, says Seth Stern, director of advocacy for the Freedom of the Press Foundation, who has written about the censorship campaign. Instead, it may be backfiring, he says, particularly for Appin Technology cofounder Rajat Khare. “It does seem like a sort of dubious strategy to be stirring this up now, and I do wonder if he is starting to regret that given the coverage it's getting,” says Stern. “You could easily see that it'll do more reputational harm than good for Khare and for Appin.”

MuckRock's Morisy says that attention is exactly the intention of his move, along with Techdirt and the EFF, to put a spotlight on the legal threats they've received. “It’s leveraging the Streisand effect to an extent. But also just finding ways to push back,” says Morisy. “There needs to be a cost for groups that are trying to silence journalists.”

A Startup Allegedly ‘Hacked the World.’ Then Came the Censorship—and Now the Backlash

For nearly two years, police have been tracking down the culprit behind a wave of hoax threats. A digital trail took them to the door of a 17-year-old in California.

A California teenager prosecutors say is responsible for hundreds of swatting attacks around the United States was exposed after law enforcement pieced together a digital trail left on some of the internet’s largest platforms, according to court records released this week.

Alan Winston Filion, a 17-year-old from Lancaster, California, faces four felony charges in Florida’s Seminole County related to swatting, or fake threats called into the police to provoke a forceful response, according to Florida state prosecutors. Police arrested Filion on January 18, and he was extradited to Seminole County this week.

Filion’s arrest, first reported by WIRED on January 26, marks the culmination of a multi-agency manhunt for the person police claim is responsible for swatting attacks on high schools, historically black colleges and universities, mosques, and federal agents, and for threats to bomb the Pentagon, members of the United States Senate, and the US Supreme Court. Ultimately, a YouTube channel, Discord chats, and usernames related to _The Lord of the Rings_ helped lead authorities to Filion’s doorstep.

Florida prosecutors charged Filion with four felony counts, including three related to allegedly making false reports to law enforcement and one for unlawful use of a two-way radio for “facilitating or furthering an act of terrorism” that authorities say targeted people based on race, religion, or other protected classes. While prosecutors alleged that Filion “is responsible for hundreds of swatting and bomb threat incidents throughout the United States,” the charges Filion faces relate to a single May 12, 2023, swatting attack against the Masjid Al Hayy Mosque in Sanford, Florida.

An attorney for Filion was not immediately available to respond to WIRED’s request for comment.

More than a year before the swatting attack on the Florida mosque, agents with the US Federal Bureau of Investigation interviewed Filion’s father, William, at his home in Lancaster, California, according to court documents made public on Wednesday. The interview took place on April 21, 2022, the same day the owner of a Telegram channel linked to swatting activity posted, “SOMEONE JUST REPORTED ME TO THE FBI… LOL!”

In October 2022, authorities investigating swatting incidents involving calls made to a school in Anacortes, Washington, came across a Telegram user associated with multiple swatting and doxing channels. The user, “Nazgul Swattings,” had claimed responsibility in one of these channels for the threats to the Washington schools, according to the same court documents.

Over the following months, court records say, the FBI monitored channels linked to this user. One of those, a channel called Torswats (formerly Nazgul Swats), had shared recordings of nearly 20 hoax calls threatening locations around the country, including schools in Iowa, Louisiana, Maryland, Oklahoma, Pennsylvania, and Texas.

As the FBI tracked Torswats’ public channels, Brad “Cafrozed” Dennis, a private investigator, was running his own parallel investigation on behalf of high-profile Twitch streamers who’d been swatted. In December, Dennis reached out to a user behind Torswats and asked to chat on a peer-to-peer chatting service called Tox under the guise of ordering a swat. According to records shared with WIRED, not mentioned in the arrest warrant, while interacting on Tox, Dennis used Wireshark to monitor his network traffic. In the process, he uncovered an IP address and the username “Paimon Arnum,” which was previously unknown to law enforcement.

Source

Wired