The National Telecommunication Monitoring Center in Bangladesh exposed a database to the open web. The types of data leaked online are extensive.

The list of data is long. Names, professions, blood groups, parents’ names, phone numbers, the length of calls, vehicle registrations, passport details, fingerprint photos. But this isn’t a typical database leak, the kind that happens all the time—these categories of information are all linked to a database held by an intelligence agency.

For months, the National Telecommunication Monitoring Center (NTMC), an intelligence body in Bangladesh that’s involved in collecting people’s cell phone and internet activity, has published people’s personal information through an unsecured database linked to its systems. And this past week, anonymous hackers attacked the exposed database, wiping details from the system and claiming to have stolen the trove of information.

WIRED has verified a sample of real-world names, phone numbers, email addresses, locations, and exam results included in the data. However, the exact nature and purpose of the amassed information is unclear, with some entries appearing to be test information, incorrect, or partial records. The NTMC and other officials in Bangladesh have not responded to requests for comment.

The disclosure, which appears to have been unintentional, provides a tiny glimpse into the highly secretive world of signals intelligence and how communications may be intercepted. “I wouldn't be expecting this to happen for any intelligence service, even if it's not really something that sensitive,” says Viktor Markopoulos, a security researcher for CloudDefense.AI who discovered the unsecured database. “Even if many data are test data, they still reveal the structure that they're using, or what exactly it is that they are intercepting or plan to intercept.”

After Markopoulos discovered the exposed database, he linked it back to the NTMC and login pages for a Bangladeshi national intelligence platform. Markopoulos believes the database was likely exposed due to a misconfiguration. Within the database, there are more than 120 indexes of data, with different logs stored in each. The indexes include names such as “sat-phone,” “sms,” “birth registration,” “pids\_prisoners\_list\_search,” “driving\_licence\_temp,” and “Twitter.” Some of those files contain a handful of entries each, while others contain tens of thousands.

The vast majority of the data exposed in the NTMC database is metadata—the extremely powerful “who, what, how, and when” of everyone’s communications. Phone call audio isn’t exposed, but metadata shows which numbers may have called others and how long each call lasted. This kind of metadata can be used broadly to show patterns in people’s behavior and whom they interact with.

For instance, the “birth registration” log includes fields such as name (in English and Bengali), birthday, sex, birthplace, and mother’s and father’s names and nationalities, according to a sample of the data reviewed by WIRED. Another log, called “finance personal details,” also includes people’s names as well as cell phone numbers and bank account details, and lists an “amount” for the account type. National ID numbers are frequently included in the data structures, as are cell phone numbers and the names of mobile operators in Bangladesh. There are lists of base transceiver stations, which are parts of cell phone networks, and the records mention “cdr,” which may refer to call detail records.

Some of the data leaked appears to be test information, as well as data that is incomplete or incorrect. Some entries include generic strings of numbers such as “123456789,” while other entries are repeated multiple times throughout the database. Real-world data is also included within the leaked information.

One person contacted by WIRED confirmed that the email, mobile number, and a billing address listed belonged to them. The person says they are a subscriber of telecom firm BTCL, which is government-run and has some of their personal information, although it’s unclear whether this is the source of the data that was leaked. Markopoulos found exam results listed in the data, including some that were taken in the late 1990s, that matched those listed on the Ministry of Education’s website. Text messages sent to multiple numbers in the database were delivered, although one person replied saying they were not the person listed in the dataset. Another phone number is publicly listed as belonging to a Bangladeshi business. An encoded passport photo correlates with the alleged owner’s public information (although they could not be reached for comment).

From a review of a sample of the exposed information, it is unclear why the data has been collected, where it has all been collected from, or what it is being used for. There is no indication that it relates to any wrongdoing.

Jeremiah Fowler, a security consultant and cofounder of data breach discovery firm Security Discovery, reviewed the exposed database and confirmed its links to the NTMC. Fowler, who regularly finds exposed servers and databases online, says the data being linked to the intelligence body is “probably one of the first that I have seen like this.”

“The biggest thing I saw that was really dangerous was a bunch of IMEI numbers,” he says, referring to the identifying code given to each individual cell phone. “With those, you can actually track the device or clone the device.”

The NTMC has not acknowledged or responded to WIRED’s questions about the leaked information, including those about its purpose and the amount that has been gathered. The press office of the government of Bangladesh and the Bangladesh High Commission in London also did not respond to requests for comment. Markopoulos reported the exposed information to Bangladesh’s Computer Incident Response Team (CIRT) on November 8, and it acknowledged his message and thanked him for disclosing the “sensitive exposure.” In an email to WIRED, the CIRT said it had “notified the issue” to the NTMC.

The database appeared to be offline ahead of the publication of this article. However, Markopoulos says that on November 12, the database was wiped and in its place appeared a ransom note by an unknown attacker or group of attackers. The note demanded payment of 0.01 bitcoin (around $360 at current exchange rates), or the “data will be publicly disclosed and deleted.” Both Markopoulos and Fowler say this is common for exposed databases of this kind. Meanwhile, new entries have started appearing in the wiped database, Markopoulos says, and they include a “search log” index that may indicate the system is still in use.

The NTMC, which emerged from a previous monitoring body in 2013, describes itself as an organization that provides “lawful communication interception facilities” to other agencies in Bangladesh, which has a population of 167 million. It is responsible for setting up and developing an “interception platform,” and ensuring that it operates 24/7, according to its website. Recent reporting has claimed that 30 agencies are linked to the NTMC using APIs, and that it incorporates records from mobile operators, passport and immigration services, and other bodies. In January, the NTMC reportedly purchased surveillance technology from companies headed by Israelis, and government ministers have discussed the NTMC intercepting social media data.

A telecoms expert who has worked in Bangladesh, who requested anonymity over fears of government retaliation against their family, alleges that as a “lawful intercept center,” the NTMC can collect huge volumes of data. “They are not only collecting call data records from mobile companies, but also, they are collecting logs and detailed records, session history, from internet providers,” they claim. “It's really powerful, and the kind of surveillance that they do is more powerful than European countries,” they add, citing Bangladesh’s lack of legislative parallels to Europe’s strict data protection laws.

In recent weeks, protests against the current government have rocked Bangladesh as a crackdown has happened against those in opposition, ahead of the country’s next round of elections in 2024. One Bangladesh-based researcher who asked not to be named, fearing repercussions, says they “expect to see more surveillance and targeting of individuals” ahead of the elections next year.

“I think the number one priority has to be to make individuals, especially activists … aware of the surveillance system and understand how to be safe online,” the researcher says when asked about digital rights. “When, in the country, people are fighting for their basic rights—such as securing their daily livelihood and fighting for their political rights—digital rights come much later.”

A Spy Agency Leaked People's Data Online—Then the Data Was Stolen

The new generation of hardware authentication key includes support for cryptographic passkeys as Google pushes adoption of the more secure login alternative.

Passwords are a woefully insecure—and frustrating—authentication technology, but after decades of digital use, they’re ubiquitous. Recently, though, the global tech industry has been working to promote a simpler and more secure alternative known as passkeys. Along with its other initiatives to champion the login tech, Google announced today that it is launching a new version of its Titan hardware authentication keys that can store passkeys directly on the device.

For most people on most accounts, passkeys are managed directly from a smartphone or laptop. But for anyone seeking an alternative, either because they prefer a stand-alone key for ease of use or because they want maximum security separation, storing passkeys on a hardware token is a valuable option. The new Titan keys are available now and can store more than 250 unique passkeys. They are replacing Google’s existing USB-A and USB-C Titan devices.

“We’re excited about the potential of passkeys, but know there’s no security silver bullet for everyone,” Google wrote in a blog post published today. “Some people require a solution not dependent on smartphones or use devices that don’t support passkeys—everyone has different approaches to security, but we all share one goal: stop attacks. That’s why we intentionally designed the latest Titan Security Keys to encompass the secure cryptography of passkeys on a portable piece of hardware.”

As part of setting up a passkey for a Google account on a Titan device, users will be prompted to create a PIN code that they’ll enter, along with producing the security key to log in.

As part of its announcement at the Aspen Cyber Summit in New York City today, Google also said that in 2024 it will give 100,000 of the new Titan keys to high-risk individuals around the world. The effort is part of Google’s Advanced Protection Program, which offers vulnerable users expanded account monitoring and threat protection. The company has given away Titan keys through the program in the past, and today it cited the rise of phishing attacks and upcoming global elections as two examples of the need to continue expanding the use of secure authentication methods like passkeys.

Hardware authentication tokens have unique protective benefits because they are siloed, stand-alone devices. But they still need to be rigorously secured to ensure they don’t introduce a different point of weakness. And as with any product, they can have vulnerabilities. In 2019, for example, Google recalled and replaced its Titan BLE-branded security key because of a flaw in its Bluetooth implementation.

When it comes to the new Titan generation, Google tells WIRED that, as with all of its products, it conducted an extensive internal security review on the devices and it also contracted with two external auditors, NCC Group and Ninja Labs, to conduct independent assessments of the new key.

Google’s New Titan Security Key Adds Another Piece to the Password-Killing Puzzle

Jacob Chansley, the January 6 rioter known as the QAnon Shaman, will run for Congress in Arizona. The most remarkable thing about his campaign so far is how unremarkable it is in a state that’s embraced election conspiracies.

The man who became a figurehead of the January 6 Capitol riot is planning to run for Congress in Arizona, and he may not even be the most extreme candidate on the ballot.

Jacob Chansley, a January 6 rioter known as the QAnon Shaman who wore face paint and horns to breach the Capitol, pleaded guilty to taking part in the riot. Last week, Chansley filed a statement of interest to run for a seat in Arizona’s 8th congressional district. Chansley, who has lived in the district for 30 years, tells WIRED that he is running his campaign single-handedly and does not plan to accept PAC money. Though he’s not eligible to vote under Arizona law because he is still serving part of his sentence, Chansley is able to run for Congress.

“When I heard that the seat was available, I prayed on it for a while, and the message I got from God was, ‘Do it,’” says Chansley.

In Arizona, Chansley’s decision to run for office is almost standard. Though Chansley may be viewed as a fringe candidate by many, he is not an outlier in a district and state where election deniers and conspiracists are already front and center in the 2024 election races.

Ever since former US president Donald Trump lost Arizona in 2020, the state has become the epicenter of election denial conspiracies and efforts to undermine democracy. The state was home to the Cyber Ninjas–run GOP recount that cost taxpayers millions, and its voters are represented by multiple far-right extremist GOP lawmakers, including state senator Wendy Rogers and US representative Paul Gosar, who have boosted wild conspiracy theories related to vote rigging. Former TV presenter Kari Lake, who has been touted as a possible vice presidential pick by Trump in 2024, continues to claim that the Arizona secretary of state race she lost by 17,000 votes in 2022 was stolen. Lake has also boosted racist “birther” conspiracies about former president Barack Obama and has pushed for journalists and political rivals to be jailed for unspecified crimes.

In Chansley’s home district, a slate of candidates reflecting Arizona’s embrace of extremist ideologies have already declared interest in running for the seat left open by the retirement of US representative Debbie Lesko, a member of the far-right Republican Freedom Caucus in Congress who voted against certifying the 2020 election results.

Blake Masters, who ran for a US Senate seat in 2022 and lost, announced he would run for a seat in Arizona’s 8th district last month. During his Senate race, Masters was backed by money from techno-libertarian Peter Thiel, his former boss, as well as an endorsement from Trump, who told him to lean into claims of election fraud if he wanted to win the election. (Masters very much touted 2020 election denial conspiracies, but they apparently didn’t help him win.)

Masters, who published videos of him shooting guns as part of his 2022 campaign, will face a challenge for the GOP nomination from Abe Hamadeh. Hamadeh, a 2022 Republican candidate for Arizona attorney general, also lost his race in 2022 despite having Trump’s endorsement. Hamadeh was one of the loudest voices in Arizona falsely claiming that Trump had won the 2020 election, and he is still trying to have his own loss to attorney general Kris Mayes overturned.

Former US representative Trent Franks, Lesko’s predecessor, is also running again. Franks was forced to resign in 2017 after he offered female staffers millions of dollars to serve as surrogate mothers for him and his wife—and at least one aide was unsure whether Franks was requesting to impregnate her through sexual intercourse or in vitro fertilization.

Anthony Kern, an Arizona state senator who was also in Washington, DC, on January 6, and who has been accused of using campaign finances to fund his trip to the capital, has announced his candidacy for the congressional seat as well. Kern was captured on video entering a restricted area outside the Capitol, though there is no evidence he was violent or entered the Capitol itself, and he has not been charged for any crimes related to the riot.

Kern is, however, currently under investigation by the Arizona attorney general as one of 11 fake electors who signed documents in 2020 to claim that Trump had beaten President Joe Biden in Arizona, even though Biden actually won the state. Kern also took part in the sham hand-recount of ballots in Maricopa County in 2021.

Before becoming a lawmaker, Kern was fired from his position with the El Mirage Police Department for lying to his supervisor about repaying the cost of a tablet computer he had lost. He was placed on a list of Maricopa County law enforcement officials with a history of dishonesty or misconduct.

“The race in general is gonna be wild,” one independent researcher who tracks the far-right in Arizona under the moniker Arizona Right Watch tells WIRED. But, they add, they would still “take Chansley over Kern, who is totally corrupt and batshit.”

And even though the other candidates are possibly more connected politically, Chansley still thinks he has closer ties to voters in his home district.

“Several of the candidates running here in District 8 don’t even live in District 8. I’ve lived in District 8 for over 30 years,” he tells WIRED. “I’m largely doing it on my own. It’s just me and God, man.”

He’s currently working on a campaign website, and plans to begin knocking on doors to meet voters in the next couple of weeks. Chansley is also eager to take part in debates with other candidates. “That's where I think I'll shine,” Chansley says. “I'm ready to debate anyone and everyone that wants to try.”

When asked whether he would be attending a candidate forum being organized by a local community organization on Wednesday night, Chalsey says, “quite possibly.”

Chansley added that he doesn’t want any campaign donations, but says that if people want to support him, they can do so by buying merchandise on his website which includes T-shirts, mugs, and yoga leggings that feature him dressed in the notorious QAnon Shaman garb.

Despite having no experience, no money, no support, and no endorsements, Chansley is still optimistic about winning in 2024.

“I think my chances of winning are good, otherwise God wouldn't have asked me to run,” Chansley says.

The QAnon Shaman Isn’t Even the Most Extreme Candidate in His Race for Congress

Poverty, fentanyl, and lack of public funding mean morgues are overloaded with unidentified bodies. TikTok and Facebook pages are filling the gap—with AI proving a powerful and controversial new tool.

In 2021, an unidentified Black woman died by suicide after jumping off the Brooklyn Bridge. She was wearing hot pink nail polish, had a pink left eyebrow piercing and several tattoos—all distinguishing features that should have made it easier to identify her. Two years later, her identity is still unknown.

The tragedy of unidentified cadavers is something that Rionna Lee had been thinking about for years. Her mother used to transport human remains for New York’s Office of the Chief Medical Examiner, and would bring home morbid stories. One, Lee remembers, was of a man who had been hit by an MTA train. “One of the things that stuck out to me was the condition of his remains, which were scattered across the train tracks,” says Lee, 24, who now lives in Kingston, Pennsylvania. It distressed her to think of the families who would have to identify their loved ones; even more so, later, when she learned that some human remains would never be identified.

There are an average of 4,400 unidentified new cadavers per year in the US, and a total of 600,000 missing people across the country. Some of these cases are collected on databases, such as the National Missing and Unidentified Persons System (NamUs), which helps medical examiners, coroners, law enforcement officers, and members of the public solve missing, unidentified, and unclaimed cases across the country. The true scale of the problem is unknown, as the data available for the average number of unidentified cadavers comes from a 2004 census. Just 10 states have laws requiring that cases be entered into NamUs, meaning that many reports are voluntary.

As she looked into cases—including the woman with the pink nail polish—Lee noticed a pattern in which were solved and which weren’t. The decisive factor was often money. Funding from private donors, sponsorship, and public support meant that law enforcement agencies were able to access cutting-edge technology, such as Othram, a forensic genetics company, which has been pivotal in cracking several high-profile cases. Those that weren’t solved didn’t have resources behind them. Often, they were from marginalized groups. Lee, who identifies as Black and LGBTQ+, felt the need to raise awareness among overlooked members of society, those whose deaths often go unnoticed: transient individuals, racial minorities, substance users, and members of the LGBTQ+ community.

Lee set up a TikTok to try to raise awareness. After a few false starts, she went viral, attracting a following of 128,000. She set up a Facebook group—Thee Unidentified & Unsolved—which now has 39,000 members, many of whom work together to solve unidentified and unsolved cases. Thee Unidentified & Unsolved is one of several volunteer social media communities that are filling a gap left by the US state, which is getting worse due to the overlapping crises of poverty, fentanyl, and shortfalls in public funding. Now, with AI image recognition more readily available, volunteers have new tools to help them identify the deceased. This brings with it new issues around privacy and consent, but those in the communities say their work brings closure to families. “I believe everyone starts off with a name,” says Lee. “I believe everyone should be able to leave this Earth peacefully with their name.”

Lee started her TikTok campaign in October 2021. There were already several popular accounts that focused on locating missing people, but few, if any, were working to identify the deceased. She created her own page, but TikTok doesn’t allow graphic content such as morgue photos, and she struggled for traction.

She focused on cases where the decedent had been found with items that might help their friends and relatives identify them. “One of the videos I posted that gained exposure was a man with an undetermined race. He was found with a Salvatore Ferragamo gold buckle belt,” says Lee. Her audience was curious how a person with such an expensive piece of clothing could go unidentified. Her engagement grew, and finally, on November 9, 2022, one of her TikTok videos—the case of a 2022 Union County Jane Doe, a Black woman who died after being struck by multiple vehicles on US Route 22 in Hillside, New Jersey—went viral, racking up 652,000 views. A couple of days later, another video hit a million views. She created the Facebook group later that month, because the platform allows graphic content, like morgue pictures, which TikTok doesn’t. The Facebook group now has more than 39,000 members.

There are around a dozen posts each day in the group, often unsolved cases from NamUs with pictures. Members scour the internet, looking for other images, comparing images with missing person sketches or social media profiles.

Some of the identification groups work globally, others are region or country specific or dedicated to unique circumstances, such as missing and murdered Indigenous women and girls. Online detective groups often tread a delicate line between altruistic investigation and mob obsession.

Thee Unidentified has had to tread that line carefully. Earlier this year, the group helped identify Adonis Beck, a TikTok star also known as Pope the Barber. Beck was found dead on August 10. The news spread quickly, causing an influx of new members to the Facebook group. Kenyetta Burks, one of the group’s admins who had first posted Beck’s image on the group, removed the morgue photos as they were posted, but was inundated with requests from people trying to see them, many from fake accounts pretending to be relatives. Sometimes, the admins will notice comments from members who seem more intrigued by the circumstances of death than those who are empathetic to the topic of unidentified cases. In situations that appear voyeuristic, the person is suspended, and if the behavior is repeated, they are banned, Lee says.

These social media groups have helped some families find closure. In 2022, a teenage boy stumbled upon Lee’s TikTok page and identified his mother, a 2017 Jane Doe case, via her tattoos. She was hit by a vehicle while crossing a street in Pasadena, California and succumbed to her injuries in hospital. In May 2023, Burks posted a sketch, images, and information from NamUs in the Facebook group, which led to the identification of Dytavious Sanders, an MMA fighter from South Carolina, whose body was discovered earlier that month on May 9. Sander’s aunt identified him in the group and his mother asked for assistance in claiming his body.

One member of Thee Unidentified has recently began using a new tool, PimEyes, a controversial facial recognition search engine, as a means to identify the deceased via morgue photos. A quick upload produces search results in a matter of seconds. Photos from across the internet are organized in a single view, mugshots frequently among them. While this technology can accelerate the process of identifying the dead, it brings with it serious privacy concerns. In many cases, informed consent is neither obtained for the image uploaded nor the results that the technology returns, which can include the biometric data of private individuals. Thus far, a few members of the group have utilized this tool.

“While some individuals might be well-meaning, online sleuths are using dangerous surveillance tools,” says Madeleine Stone, senior advocacy officer at Big Brother Watch, a privacy campaign group. “By selling this technology, facial recognition companies risk violating the dignity of deceased individuals, but moreover are violating the privacy rights of the billions of people whose photos they have taken, processed and exploited without consent.”

PimEyes has been criticized by privacy advocates for scraping the internet for images, and giving users access to highly personal information about private individuals. PimEyes CEO Giorgi Gobronidze says that these threats are exaggerated, and that PimEyes doesn’t hold images, but just directs users to the URLs where images are hosted. “The tool is designed to help people to find the sources that publish photos, and if they shouldn't be there, apply to the website and initiate takedown.” Gobronidze says that PimEyes has many use cases, such as searching for missing people, including women and children in conflict areas, and actively cooperates with human rights organizations.

Lee says that the Thee Unidentified & Unsolved Facebook group “is not focused on the use of PimEyes…But I respect those who do use the tool and actually have successful outcomes.”

In other social media groups, PimEyes is slowly being introduced as an investigative tool for cases related to missing persons, cold cases, and human trafficking.

Experts also worry that this technology is not necessarily accurate, meaning that amateur sleuths could make mistakes with heartbreaking consequences. “This a noble goal, but a terrible approach,” says Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project, an organization that litigates and advocates for privacy, fighting excessive local and state-level surveillance. “This technology is biased and error prone, and I worry that a lot of worried families will be wrongly told their missing loved one is dead.”

For all of the challenges presented by volunteer online communities, the reality is that they exist in a vacuum left by the authorities.

In 2021, 106,699 Americans died of an overdose. In Seattle, the fentanyl crisis is so bad that the number of overdose deaths has doubled in the last three years, causing the morgues to overflow. The “fourth wave” of the crisis recently descended upon the US, an ongoing mass-overdose event that has consumed law enforcement agencies, stretching the resources necessary for identifying the dead. For medical examiners, the “tsunami” of bodies has resulted in staff burnout, exhausted resources, and jeopardized many offices’ accreditation due to the necessity to conduct more autopsies than industry guidelines permit .

“Unfortunately, the opioid crisis has meant more individuals are coming into the Medical Examiner’s Office for examination,” says Dr. Constance DiAngelo, Philadelphia’s Chief Medical Examiner. “Many of these folks are not initially identified.”

The authorities just don’t have the resources to investigate every case thoroughly. “Our challenges are related to funding,” DiAngelo says. “Exhumations, reinterment, DNA extraction and processing, and genealogy comparisons are expensive. A case could cost between $2,500 to $10,000, and that doesn’t include the need for staff who can be dedicated to this type of work.”

In King County, where Seattle is located, there are currently 57 unidentified people that the Medical Examiner’s Office is working to identify. This dire situation is a reality across major American metropolitan areas. In situations where people are found without identification, it can take weeks, if not months, to locate next of kin.

That waiting, and not knowing, can be agony for people whose loved ones have disappeared—like the family of Kallie Catron. Catron’s mother, Crystal Newman, last spoke with her on October 14, 2022. Catron said she missed her two children and wanted to come home. “When Halloween, Thanksgiving, Christmas, and New Year’s passed, my sister knew something was wrong and called to report a missing person,” says Sarah Forister, Catron’s aunt. “I guess you can say a mother knows when something is wrong with her baby.”

On January 22, 2023, Newman was sent a link to a post on Thee Unidentified’s TikTok page. Morgue photos, and images of her tattoos, confirmed it was Catron. “At first, we were so mad that’s how we found out,” says Forister. “But Kallie’s mom, me, and her cousins watched the video showing her morgue photo and all her identifying tattoos multiple times a day.”

Eventually, Lee asked the family if she could take down the video, as Catron had been identified. “I said yes, but please send me the video so I can watch it whenever I want to,” says Forister. Lee obliged. The community shared the family’s GoFundMe campaign to raise funds for Catron's funeral and to support her children. “We realized that if it wasn’t for Thee Unidentified community and Rionna, we could still be looking for Kallie,” Forister says.

Social Media Sleuths, Armed With AI, Are Identifying Dead Bodies

More than 60 groups advocating for Asian American and Pacific Islander communities are pushing the US Congress to reform the Section 702 surveillance program as Senate leaders move to renew it.

Dozens of prominent Asian American groups are asking United States lawmakers this morning to hold fast in the face of an anticipated campaign by congressional leaders to extend the Section 702 surveillance program by securing it, like a rider, to another “must pass” bill.

Sixty-three groups across the country representing and allied with Asian American and Pacific Islander communities have signed a letter of “strong opposition” to any “short-term extension” of the 702 program—surveillance, the groups say, that is almost certainly impacting Asian Americans at a disproportionate rate.

WIRED first reported last week on an effort underway by US Senate leaders to extend the 702 program, which is slated to expire at the end of the year but may continue until April under the program’s “transition procedures.” Emails from WIRED requesting comment from the Senate majority leader, Chuck Schumer, have gone unanswered since Friday.

“Section 702 and related surveillance authorities have been misused to spy on Americans, including but not limited to protesters, journalists, campaign donors, and members of Congress,” says the letter, signed by the National Council of Asian Pacific Americans, the Sikh Coalition, Asian Americans Advancing Justice, and the Stop AAPI Hate coalition, among dozens of other groups. The consequences of unlawful surveillance have had a “devastating toll” on Asian Americans, they say, and on people’s “careers, livelihoods, and reputations.”

Demanding the 702 program be “pursued through standalone legislation” and open to debate, the letter says a short-term fix would alienate lawmakers already open to salvaging the program—albeit with heavily favored reforms. Renewing the program with a last-minute amendment tucked into a bill the government can’t function without would only serve to undermine the democratic process, the groups say, and “imperil the long-term viability of Section 702.”

“There are a lot of folks who are really worried,” says Andy Wong, managing director of advocacy at Stop AAPI Hate, a coalition of community-based groups. The impact of government surveillance on the broader Asian American community, he says, runs deep. "Whether it’s traveling or communicating with their loved ones or doing anything abroad, even if it’s completely innocuous, all of this surveillance has a chilling effect.”

“Approximately two-thirds of Asian Americans are immigrants,” says Joanna YangQing Derman, a program director at Asian Americans Advancing Justice, the civic engagement and civil rights nonprofit. “We are far more likely to have family, friends, and business associates abroad. As a result, Asian Americans are likely to be overrepresented in all the data that Section 702 enables the government to collect.”

The 702 program is used by the US National Security Agency (NSA) to target the electronic communications of hundreds of thousands of foreigners each year. The program, which works to gather intel for counterterrorism, espionage, and cyber defense investigations, relies on the compulsory assistance of US telecom providers—a power granted on a year-by-year basis through “certifications” by a secret court.

Despite the government’s avowed efforts not to intercept and store Americans’ internet communications in bulk, the NSA is known to capture significant volumes of domestic calls, texts, and emails between Americans and people overseas. The law, as it is, does little to prevent federal agents from dredging up the content of those calls or messages later without a warrant, for reasons often irrelevant to why they were captured in the first place.

On Monday, another letter directed at Senator majority leader Chuck Schumer was signed by more than 20 civil liberties groups that are likewise opposed to any attempt to prolong 702 surveillance, which falls under the Foreign Intelligence Surveillance Act (FISA), by linking its fate to a spending bill that will be inevitably negotiated at a high level, with little or no opportunity for amendment once it reaches the House or Senate floor. A leading contender for such a bill, a congressional source told WIRED last week, is the National Defense Authorization Act, annual legislation that’s considered “must pass,” and which will allocate roughly $886 billion in national security spending across the Pentagon and US Department of Energy next year.

The majority leader signaled openness to adopting other “must pass” legislation on Monday: an appropriations bill sponsored by House speaker Mike Johnson, which Schumer said “pleased” him, in that it avoided “steep cuts” and was “moving in our direction.” Attaching a 702 amendment to any stopgap spending bill at this hour, however, could serve as a poison pill, eliciting stiff opposition from House Republicans—such as the chairman of the House Judiciary Committee, Jim Jordan—for whom FISA remains a four-letter word.

Asian Americans Raise Alarm Over ‘Chilling Effects’ of Section 702 Surveillance Program

In its plans to implement a White House executive order, CISA aims to strike a balance between promoting AI adoption for national security and defending against its malicious use.

Last month, a 120-page United States executive order laid out the Biden administration's plans to oversee companies that develop artificial intelligence technologies and directives for how the federal government should expand its adoption of AI. At its core, though, the document focused heavily on AI-related security issues—both finding and fixing vulnerabilities in AI products and developing defenses against potential cybersecurity attacks fueled by AI. As with any executive order, the rub is in how a sprawling and abstract document will be turned into concrete action. Today, the US Cybersecurity and Infrastructure Security Agency (CISA) will announce a “Roadmap for Artificial Intelligence” that lays out its plan for implementing the order.

CISA divides its plans to tackle AI cybersecurity and critical infrastructure-related topics into five buckets. Two involve promoting communication, collaboration, and workforce expertise across public and private partnerships, and three are more concretely related to implementing specific components of the EO. CISA is housed within the US Department of Homeland Security (DHS).

“It's important to be able to put this out and to hold ourselves, frankly, accountable both for the broad things that we need to do for our mission, but also what was in the executive order,” CISA director Jen Easterly told WIRED ahead of the road map's release. “AI as software is clearly going to have phenomenal impacts on society, but just as it will make our lives better and easier, it could very well do the same for our adversaries large and small. So our focus is on how we can ensure the safe and secure development and implementation of these systems.”

CISA's plan focuses on using AI responsibly—but also aggressively in US digital defense. Easterly emphasizes that, while the agency is “focused on security over speed” in terms of the development of AI-powered defense capabilities, the fact is that attackers will be harnessing these tools—and in some cases already are—so it is necessary and urgent for the US government to utilize them as well.

With this in mind, CISA's approach to promoting the use of AI in digital defense will center around established ideas that both the public and private sectors can take from traditional cybersecurity. As Easterly puts it, “AI is a form of software, and we can’t treat it as some sort of exotic thing that new rules need to apply to.” AI systems should be “secure by design,” meaning that they've been developed with constraints and security in mind rather than attempting to retroactively add protections to a completed platform as an afterthought. CISA also intends to promote the use of “software bills of materials” and other measures to keep AI systems open to scrutiny and supply chain audits.

“AI manufacturers \[need\] to take accountability for the security outcomes—that is the whole idea of shifting the burden onto those companies that can most bear it,” Easterly says. “Those are the ones that are building and designing these technologies, and it’s about the importance of embracing radical transparency. Ensuring we know what is in this software so we can ensure it is protected.”

Finally, CISA will conduct assessments of the threats US critical infrastructure could face from AI-powered attacks. The agency plans to collaborate across the industrial control and critical infrastructure landscape to make recommendations for how these vital services—which are often built on always-on, legacy technology—can defend against novel threats and safely implement AI-powered protections.

“In last month’s Executive Order, the President called on DHS to promote the adoption of AI safety standards globally and help ensure the safe, secure, and responsible use and development of AI,” Homeland Security secretary Alejandro Mayorkas said in a statement today. "CISA’s roadmap lays out the steps that the agency will take as part of our Department’s broader efforts to both leverage AI and mitigate its risks to our critical infrastructure and cyber defenses.”

In practice, it's a massive and unwieldy set of goals. And some, like plans to hold businesses accountable, hinge largely on voluntary commitments and collaborations. But CISA's “road map” is a gesture toward imbuing its efforts with some amount of transparency and public responsibility at a critical moment.

“Not only are these going to be the most powerful capabilities of our lifetime, they could potentially be the most powerful weapons of our lifetime,” Easterly says. “We need to ensure that we are protecting them and protecting our global citizenry from the malicious use of these capabilities.”

CISA Has a New Road Map for Handling Weaponized AI

Roswell, New Mexico, remains synonymous with the “discovery” of alien life on Earth—and a US government coverup. But history shows the reality may be far less out of this world—and still fascinating.

Across the 75 years since something—_something_—crashed outside Roswell in early July 1947, the very name itself has taken on a life of its own: Today, it’s shorthand for UFOs, extraterrestrials, and a vast government conspiracy, perhaps even where the very idea of the deep state itself was born. The city of 50,000 in southeastern New Mexico, about three hours from Albuquerque and El Paso, has leaned into its infamy: There’s a UFO museum, a space walk, and even a flying-saucer-shaped McDonald’s, not to mention any number of kitschy souvenir stands.

Untangling what exactly happened there, though, was a half-century journey through secret government programs, the Cold War, nuclear secrets, and the rise of conspiracy theories in US politics. We know something did crash in Roswell in late June or early July 1947, just weeks after the age of the flying saucer dawned. The modern age of UFOs began on June 24, 1947, when a 32-year-old Idaho businessman named Kenneth Arnold, an experienced rescue pilot with some 4,000 hours of mountain-high-altitude flight time, noticed a bright light out the window of his CallAir A-2 prop plane while flying near Mount Rainier in the Pacific Northwest.

At first, Arnold assumed it was just a glare from another plane—but then he realized he was looking at as many as nine objects, seemingly in formation and moving at tremendous speed through the air, stretched out over perhaps 5 miles. “I could not find any tails on these things,” Arnold later recalled. “They didn’t leave a jet trail behind them. I judged their size to be at least 100 feet in widespan. I thought it was a new type of missile.” As the lights continued to move together “like the tail of a Chinese kite, kind of weaving and going at a terrific speed,” he used his dashboard clock to time how long it took them to fly from between Mount Rainier and Mount Adams. It was astonishing. According to the measurements, these things—whatever they were—were moving somewhere around 1,200 to 1,700 miles per hour, far faster than anything known at the time. Altogether, Arnold watched the objects for about three minutes, during which time he even opened his airplane window to make sure he wasn’t catching a reflection off his windshield.

When he landed, he told friends at the airport about the strange sighting, and a day later, repeated the story to reporters at the _East Oregonian_. The first version of the article referred to the objects as “saucer-like aircraft,” and headline writers across the country subsequently shorthanded the label to “flying saucers.” The reports and interviews Arnold gave after he landed ignited national interest and made headlines across the country. Week by week, dozens more “flying saucer” sightings were reported in what ultimately totaled more than 34 states.

It was against this backdrop that some wreckage found outside New Mexico was delivered and shown to the commander of the Roswell Army Air Field. From the moment he saw it, Colonel William Blanchard knew something was odd about the wreckage spread out before him. The jagged wooden pieces and scraps of reflective material, hastily gathered from a crash site discovered a day earlier, were not from any aircraft he could identify, and the strange symbols weren’t any language he recognized—they looked, if anything, like hieroglyphs.

It had been found, he had been told, by a local rancher named Mac Brazel. The local sheriff, guessing it was military, had sent Brazel onward to the nearest air base to report the find, and soon after, two military intelligence officers, Major Jesse Marcel and another anonymous man whom Brazel would describe as being in plainclothes, had traveled back with him to investigate, wandering around the field and gathering up the fallen “rubber strips, tinfoil, a rather tough paper, and sticks” before transferring them back to the headquarters of the 509th Bombardment Wing.

Here’s the Proof There’s No Government Alien Conspiracy Around Roswell

Netflix, Spotify, Twitter, PayPal, Slack. All down for millions of people. How a group of teen friends plunged into an underworld of cybercrime and broke the internet—then went to work for the FBI.

The Mirai Confessions: Three Young Hackers Who Built a Web-Killing Monster Finally Tell Their Story

An effort to reauthorize a controversial US surveillance program by attaching it to a must-pass spending bill has civil liberties advocates calling foul.

Some of the United States’ largest civil liberties groups are urging Senate majority leader Chuck Schumer not to pursue a short-term extension of the Section 702 surveillance program slated to sunset on December 31.

The more than 20 groups—Demand Progress, the Brennan Center for Justice, American Civil Liberties Union, and Asian Americans Advancing Justice among them—oppose plans that would allow the program to continue temporarily by amending “must-pass” legislation, such as the bill needed now to avert a government shutdown by Friday, or the National Defense Authorization Act, annual legislation set to dictate $886 billion in national security spending across the Pentagon and US Department of Energy in 2024.

“In its current form, \[Section 702\] is dangerous to our liberties and our democracy, and it should not be renewed for any length of time without robust debate, an opportunity for amendment, and—ultimately—far-reaching reforms,” a letter from the groups to Schumer says. It adds that any attempt to prolong the program by rushed amendment “would demonstrate blatant disregard for the civil liberties and civil rights of the American people.”

The letter, which was first reported by Bloomberg Law, cited reporting by WIRED and CQ Roll Call. Schumer did not respond to a request for comment.

As WIRED has previously reported, surveillance under the 702 program may technically continue for another six months, regardless of whether Congress reauthorizes it by the end of December. The program was last certified by the Foreign Intelligence Surveillance Court in April 2023 for a full year. “Transition procedures” codified in the statute permit surveillance orders to “continue in effect” until they expire.

The 702 program is controversial for its collection of communications of “US persons.” The program legally targets roughly a quarter million foreigners each year, gathering the content of their text messages, emails, and phone calls, but collaterally intercepts an unknown but presumably large amount of American communications as well. This interception takes place with the compelled cooperation of US telecommunications companies that handle internet traffic at stages along global networks.

The program includes procedures for intercepting, storing, and querying the information in ways that are designed to “minimize” the odds of Americans’ rights being violated, but the rules are also subject to various exemptions. A top criticism of the 702 program is that it permits the Federal Bureau of Investigation to access the calls and emails of US citizens without a warrant and without evidence they’ve committed a crime.

The 702 program was last reauthorized in 2018 following a similarly contentious debate. The program currently permits the National Security Agency to target foreigners under an array of circumstances related to counterterrorism, espionage, and nuclear proliferation, though is also prominently used today to investigate and combat cybercrime and drug trafficking.

On November 7, a bipartisan, bicameral coalition of US lawmakers introduced a comprehensive privacy bill called the Government Surveillance Reform Act, led in part by veteran Senate Intelligence Committee member Ron Wyden. Among other provisions aimed at restricting warrantless surveillance and the collection of location data by police, the bill would impose several reforms of the 702 program, ensuring the FBI obtained a warrant before querying the database using “US Person” identifiers.

The GSRA is widely supported by the civil liberties groups whose letter advises Schumer against a short-term extension of Section 702.

“I plan to vote against any continuing resolution that extends FISA Section 702 without meaningful reforms," Wyden tells WIRED. "Massive surveillance programs that violate Americans’ privacy should not be rushed through without reform or review. Congress must have a real debate about reforming warrantless government surveillance of Americans. Therefore, the administration and congressional leaders should listen to the overwhelming bipartisan coalition that supports adopting commonsense protections for Americans’ privacy and extending key national security authorities at the same time.”

US Privacy Groups Urge Senate Not to Ram Through NSA Spying Powers

Plus: A DDoS attack shuts down ChatGPT, Lockbit shuts down a bank, and a communications breakdown between politicians and Big Tech.

Drones, hidden cameras, thermal vision scopes—these are just a few examples of the high-tech equipment recommended by the animal liberation group Direct Action Everywhere, according to a manual released by the organization this week. The document, which was reviewed by WIRED, is a rare glimpse into how the organization is using tech to target factory farms in often brazen operations that have rescued pigs, goats, ducks, and chickens.

Extremist groups are experimenting with generative AI to flood social media with propaganda and misinformation, researchers at Tech Against Terrorism have told WIRED. A new report from the group details how, in recent months, terrorists and other extremist organizations have been using artificial intelligence to manipulate imagery and thwart content moderation. As platforms have struggled to keep up with this flood of extremist content, a new tool called Altitude, built in collaboration between Tech Against Terrorism and Google, is seeking to address the problem. The tool centralizes the collection of verified terrorist content, allowing companies to easily vet posts shared to their platforms.

Israel is exacerbating the humanitarian catastrophe in Gaza by likely imposing devastating internet blackouts in the region. Last week, Israel reportedly imposed a full internet shutdown in the area as its troops moved into the Gaza Strip. After internet access was restored, the area suffered two additional connectivity blackouts. The most recent lasted for about 15 hours on Sunday as Israel was carrying out an intense operation to cut off Gaza City in the north from southern Gaza.

In other infrastructure news, a report from the ​​cybersecurity firm Mandiant reveals that last year, the Russian military intelligence agency known as Sandworm carried out a power grid attack targeting a Ukrainian electric utility causing a blackout for Ukrainian civilians. According to the report, the cyberattack coincided with the start of a series of missile strikes targeting Ukrainian critical infrastructure across the country.

The third GOP presidential primary debate was livestreamed on Rumble, a YouTube alternative home to what the Southern Poverty Law Center says is one of America’s most notorious white nationalists, Nick Fuentes. Since the outbreak of the Israel-Hamas conflict last month, Fuentes has used his Rumble channel to push antisemitic hate speech and Holocaust denial conspiracies, racking up hundreds of thousands of views. Fuentes’ YouTube account was terminated in 2020 after Google demonetized it.

And there's more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there

On Wednesday, you and everyone you know had trouble getting ChatGPT to ghostwrite their emails as developer OpenAI was hit by what it thought was a distributed denial-of-service attack. For nearly two hours, users who tried to access the chatbot were greeted with a message telling them “ChatGPT is at capacity right now.”

In a tweet, OpenAI CEO Sam Altman initially blamed its outage on a surge in interest in the platform's new features. By Wednesday night the company announced that the periodic outages were due to an “abnormal traffic pattern reflective of a DDoS attack.”

While it’s unclear who is behind the attack, a group known as Anonymous Sudan claimed responsibility on Wednesday, posting on Telegram that it had targeted OpenAI for "general biases towards Israel and against Palestine." OpenAI has since resolved the issue.

The US arm of the Industrial and Commercial Bank of China was hit by a ransomware attack that disrupted trades in the US Treasury market on Thursday. The bank appears to be the latest victim of the prolific ransomware gang known as Lockbit. According to the US Cybersecurity and Infrastructure Security Agency, Lockbit has hit 1,700 US organizations since 2020 and extorted more than $100 million in ransom demands. Last month it threatened Boeing with a leak of sensitive data.

"ICBC has been closely monitoring the matter and has done its best in emergency response and supervisory communication," China's foreign ministry spokesperson Wang Wenbin said at a press conference.

Signal is beta testing usernames that will allow people to communicate using the encrypted service without exchanging phone numbers, further enhancing the app's privacy applications. The feature will go live in early 2024.

Support for usernames is a major step for the messaging service as Signal has apparently been working on the feature for years. Though accounts will still need to be associated with a phone number at setup, the introduction of usernames will allow users to connect without having to share it.

Cooperation between government, researchers, and tech companies aimed at countering disinformation online is evaporating thanks to a sustained campaign by US Republicans in the press, courts, and on Capitol Hill. Tech employees tell NBC the FBI has halted communications with social media firms about foreign influence campaigns, a move the FBI director attributed to a September ruling in the country's most conservative appellate court forbidding the government from "significantly" encouraging social media companies to remove misinformation.

“We’re having some interaction with social media companies,” FBI director Christopher Wray said in testimony last week to the Senate Homeland Security Committee. “But all of those interactions have changed fundamentally in the wake of the court rulings.”

According to NBC, all the FBI’s interactions with tech platforms now have to be supervised by Justice Department lawyers.

Source

Wired