Top senate officials are planning to save the Section 702 surveillance program by attaching it to a must-pass piece of legislation. Critics worry a chance to pass privacy reforms will be missed.

Leaders in the United States Senate have been discussing plans to extend Section 702 of the Foreign Intelligence Surveillance Act (FISA) beyond its December 31 deadline by amending must-pass legislation this month.

A senior congressional aide tells WIRED that leadership offices and judiciary sources have both disclosed that discussions are underway about saving the Section 702 program in the short term by attaching an amendment extending it to a bill that is sorely needed to extend federal funding and avert a government shutdown one week from now.

The program, last extended in 2018, is due to expire at the end of the year. Without a vote to reauthorize 702, the US government will lose its ability to obtain year-long “certifications” compelling telecommunications companies to wiretap overseas calls, text messages, and emails without being served individual warrants or subpoenas.

Whether the authority is reauthorized before expiring on January 1 or not, the actual surveillance is likely to continue into the spring, when this year’s certifications expire.

Extending the program by attaching it to another bill that Congress can’t avoid is a risky political maneuver that will cause significant unrest among a majority of House lawmakers and a number of senators who are working to reform the 702 program. A top priority for privacy hawks is curtailing the ability of federal law enforcement to use 702 data “incidentally” collected on Americans. The 702 program collects communications from two sources: internet service providers and the companies that conduct traffic between them. The latter source is tapped less frequently but intercepts a greater quantity of domestic communications.

An aide to Jim Jordan, the Republican chair of the House Judiciary Committee, said Jordan was firmly on the side of the reformers and would not support extending 702 through a temporary measure. Chuck Schumer, the senate majority leader, did not respond to a request for comment Thursday afternoon.

“America’s security and its citizens’ rights demand more than a short-term fix. Congress has had all year to scrutinize and address this crucial policy question,” says James Czerniawski, a senior policy analyst at the nonprofit Americans for Prosperity. “Doing a short-term extension punts the ball on the critical reforms desperately needed to this program to protect Americans civil liberties.”

While surveillance of US calls is illegal and unconstitutional without a warrant based on probable cause, the government is permitted to collect domestic calls for specific national security purposes under procedures created to minimize its access to them later. The US National Security Agency, which conducts electronic surveillance for the Pentagon, is only permitted to eavesdrop on foreigners who are overseas. Those foreigners, however, many of whom are likely government officials and not criminals or terrorists, frequently exchange calls and emails with people inside the United States, and those get collected as well.

Roughly a quarter of a million people are targeted by the program each year, and it is estimated that the number of individual messages collected reaches into the hundreds of millions.

While the NSA is not allowed to target the communications of “US persons” (an umbrella term for US citizens, legal residents, and corporations), the government has long been permitted to query the database for information on US persons without obtaining warrants.

It is known that the 702 program collects significant numbers of US communications, but the exact quantity is unknown, even to the government. The NSA argues that it would be unfeasible to count the number of Americans incidentally spied on without analyzing the collection thoroughly, further imperiling people’s rights. Privacy watchdogs who have classified knowledge of the program say the term “incidental” is deceiving, in that it makes the volume of the collection sound small.

The term is also frequently conflated with wiretaps that accidentally target Americans, which is called “inadvertent” collection. Incidental collection is factored into the program as an acceptable risk to Americans’ civil liberties, ameliorated by various internal procedures approved by the Justice Department and the Office of the Director of National Intelligence. Critics of the program say these procedures are frequently violated and do little to nothing to stop the FBI from warrantlessly accessing Americans’ calls and emails without evidence that they’ve committed a crime.

Congressional offices striving for a reform—introduced this week in the form of a bipartisan, bicameral bill known as the Government Surveillance Reform Act (GSRA)—say the White House has lobbied Congress for a “clean” reauthorization. Renewing the 702 program for another four to five years without additional privacy safeguards is in line with the intelligence community’s own desires.

The same sources say other bills may also be in the works and could drop by December, excluding many of the additional protections offered by the GSRA. The bill, which has significant support in the House, bans warrantless FBI searches of 702 data but also curtails the use of commercial data available to the government—a known loophole for evading warrant requirements available to law enforcement and intelligence agencies at virtually all levels of government. Many Republicans favor the bill because it would strip security clearances from federal employees caught abusing their access to the database.

Cynthia Choi, cofounder of the nonprofit Stop AAPI Hate, which tracks incidents of discrimination against Asian Americans and Pacific Islanders, said the GSRA would prove particularly crucial in the fight for privacy of immigrant communities. “It is disappointing to learn that Majority Leader Schumer and other congressional leaders are reportedly considering depriving us of this critical opportunity to stop the unjust warrantless surveillance of our family and friends,” she says. “They are well aware that we have experienced decades of wrongful targeting, and they should be fighting alongside us to ensure these issues are addressed as soon as possible.”

Senate Leaders Plan to Prolong NSA Surveillance Using a Must-Pass Bill

US government officials continue to warn that the public and private sectors need to identify and root out China-backed attackers lurking in industrial control systems.

The United States National Security Agency is often tight-lipped about its work and intelligence. But at the Cyberwarcon security conference in Washington DC on Thursday, two members of the agency’s Cybersecurity Collaboration Center had a “call to action” for the cybersecurity community: Beware the threat of Chinese government-backed hackers embedding in US critical infrastructure.

Alongside its “Five Eyes” intelligence alliance counterparts, the NSA has been warning since May that a Beijing-sponsored group known as Volt Typhoon has been targeting critical infrastructure networks, including power grids, as part of its activity.

Officials emphasized on Thursday that network administrators and security teams need to be on the lookout for suspicious activity in which hackers manipulate and misuse legitimate tools rather than malware—an approach known as “living off the land”—to carry out clandestine operations. They added that the Chinese government also develops novel intrusion techniques and malware, thanks to a substantial stockpile of zero-day vulnerabilities that hackers can weaponize and exploit. Beijing collects these bugs through its own research, as well as a law that requires vulnerability disclosure.

The People’s Republic of China “works to gain unauthorized access to systems and wait for the best time to exploit these networks,” Morgan Adamski, director of the NSA’s Cybersecurity Collaboration Center, said on Thursday. “The threat is extremely sophisticated and pervasive. It is not easy to find. It is pre-positioning with intent to quietly burrow into critical networks for the long haul. The fact that these actors are in critical infrastructure is unacceptable, and it is something that we are taking very seriously—something that we are concerned about.”

Microsoft’s Mark Parsons and Judy Ng gave an update on Volt Typhoon’s activity later in the day at Cyberwarcon. They noted that after seemingly becoming dormant in the spring and most of the summer, the group reappeared in August with improved operational security to make its activity more difficult to track. Volt Typhoon has continued attacking universities and US Army Reserve Officers’ Training Corps programs—a type of victim the group particularly favors—but it has also been observed targeting additional US utility companies.

“We think Volt Typhoon is doing this for espionage-related activity, but in addition, we think there’s an element that they could use it for destruction or disruption in a time of need,” Microsoft’s Ng said on Thursday.

The NSA’s Adamski and Josh Zaritsky, chief operations officer of the Cybersecurity Collaboration Center, urged network defenders to manage and audit their system logs for anomalous activity and store logs such that they can’t be deleted by an attacker who gains system access and is looking to hide their tracks.

The two also emphasized best practices, like two-factor authentication and limiting users’ and admins’ system privileges to minimize the possibility that attackers can compromise and exploit accounts in the first place. And they emphasized that not only is it necessary to patch software vulnerabilities, it is crucial to then go back and check logs and records to make sure that there aren’t signs that the bug was exploited before it was patched.

“We are going to need internet service providers, cloud providers, endpoint companies, cybersecurity companies, device manufacturers, everybody in this fight together. And this is a fight for our US critical infrastructure,” Adamski said. “The products, the services that we rely on, everything that matters—that’s why this is important.”

The NSA Seems Pretty Stressed About the Threat of Chinese Hackers in US Critical Infrastructure

Small platforms without resources to handle takedown requests have been weaponized by terrorist groups that share their content online. A free new tool is coming to help clean house.

Terrorist groups have found a home on smaller, less well-known online platforms in recent years where they store, share, and link to content such as violent beheading videos and recruitment propaganda.

Those platforms have struggled to deal with the problem due to a lack of resources and expertise, but a new tool being built by a Google subsidiary in collaboration with a terror-tracking NGO is seeking to solve that problem.

Launched in Paris on Friday, Altitude is a free tool built by Jigsaw—a unit within Google that tracks violent extremism, misinformation, and repressive censorship—and Tech Against Terrorism, a group that seeks to disrupt terrorists’ online activity. The tool aims to give smaller platforms the ability to easily and efficiently detect terrorist content on their networks and remove it.

The project is also working with the Global Internet Forum to Counter Terrorism, which is an industry-led group founded in 2017 by Facebook, Microsoft, Twitter, and YouTube that hosts a shared database of image hashes—a kind of digital fingerprint—of terrorist content.

After years of missteps and failing to deal with the problem of removing terrorist content from their networks, big tech platforms like Facebook, Google, and X (formerly Twitter) have—with the help of dedicated NGOs and law enforcement—largely removed this content from their networks, with the notable exception of Telegram. As a result, terrorists have moved to less regulated and under-resourced platforms where their presence either goes unnoticed or cannot be dealt with because the companies involved simply don’t have the resources to cope with a flood of takedown requests.

“Islamic State and other terrorist groups didn't give up on the internet just because they no longer had the megaphone of their social media platforms. They went elsewhere,” Yasmin Green, the CEO of Jigsaw, tells WIRED. “They found this opportunity to host content on file-hosting sites or other websites, small and medium platforms. Those platforms were not welcoming terrorist content, but they still were hosting it—and actually, quite a lot of it.”

While there are some tools on the market that work in a similar way to Altitude, they are prohibitively expensive for a lot of smaller companies. Experts like Green believe that tools like this need to be open source and free of charge.

The new tool can be integrated straight into the backend of whatever platform it is working with. It then connects to Tech Against Terrorism’s own Terrorist Content Analytics Platform, which centralizes the collection of content that has been created by officially designated terrorist organizations. The database allows all the platforms using Altitude to easily check whether a piece of content has been verified as terrorist content.

Altitude will also provide context about the terrorist groups the content is associated with, other examples of this type of material, information on what other platforms have done with the material, and, eventually, even information pertaining to the relevant laws in a particular country or region.

“We are not here to tell platforms what to do but rather to furnish them with all the information that they need to make the moderation decision," Adam Hadley, executive director of Tech Against Terrorism, tells WIRED. “We want to improve the quality of response. This isn’t about the volume of material removed but ensuring that the very worst material is removed in a way that is supporting the rule of law.”

Tech Against Terrorism works with more than 100 platforms, almost all of which don’t want to be named because of the negative impact on their business of being linked to terrorist content. The type of companies that Tech Against Terrorism works with include pastebins, messaging apps, video-sharing platforms, social media networks, and forums.

For many of these smaller platforms, dealing with takedown requests from governments, civil society organizations, law enforcement, and the platform's own users can be overwhelming and result in companies going to one extreme or the other.

“Platforms can become easily overwhelmed by the takedown requests, and they either ignore them all or they take everything down,” Hadley says. “What we're looking for is to try to create an environment where platforms have the tools to be able to properly assess whether they should remove material or not, because it's imperative to take down terror content, but it's also really important that they're not just removing any content because of concerns about freedom of expression.”

The Israel-Hamas war has shown what an important role Telegram continues to play in allowing terrorist groups to spread their messages. While efforts to hold Telegram to account have had limited success in recent weeks, terror content remains accessible, and it is from here that the content is quickly shared on a multitude of other platforms. And this is where the Altitude tool can make a difference, according to Hadley.

“Ideally, the content wouldn’t be put up on Telegram in the first place,” Hadley says. “But given that it is, the next best thing we can do is make sure that other platforms that are being co-opted into this by terrorists are aware of this activity and have the right information to take down the material in an appropriate fashion.”

This New Tool Aims to Keep Terrorism Content Off the Internet

Experts are finding thousands of examples of AI-created content every week that could allow terrorist groups and other violent extremists to bypass automated detection systems.

Extremist groups have begun to experiment with artificial intelligence, and in particular generative AI, in order to create a flood of new propaganda. Experts now fear the growing use of generative AI tools by these groups will overturn the work Big Tech has done in recent years to keep their content off the internet.

“Our biggest concern is that if terrorists start using gen AI to manipulate imagery at scale, this could well destroy hash-sharing as a solution,” Adam Hadley, the executive director of Tech Against Terrorism, tells WIRED. “This is a massive risk.”

For years, Big Tech platforms have worked hard to create databases of known violent extremist content, known as hashing databases, which are shared across platforms to quickly and automatically remove such content from the internet. But according to Hadley, his colleagues are now picking up around 5,000 examples of AI-generated content each week. This includes images shared in recent weeks by groups linked to Hezbollah and Hamas that appear designed to influence the narrative around the Israel-Hamas war.

“Give it six months or so, the possibility that \[they\] are manipulating imagery to break hashing is really concerning,” Hadley says. “The tech sector has done so well to build automated technology, terrorists could well start using gen AI to evade what's already been done.”

Other examples that researchers at Tech Against Terrorism have uncovered in recent months have included a neo-Nazi messaging channel sharing AI-generated imagery created using racist and antisemitic prompts pasted into an app available on the Google Play store; far-right figures producing a “guide to memetic warfare” advising others on how to use AI-generated image tools to create extremist memes; the Islamic State publishing a tech support guide on how to securely use generative AI tools; a pro-IS user of an archiving service claiming to have used an AI-based automatic speech recognition (ASR) system to transcribe Arabic language IS propaganda; and a pro-al-Qaeda outlet publishing several posters with images highly likely to have been created using a generative AI platform.

Beyond detailing the threat posed by generative AI tools that can tweak images, Tech Against Terrorism has published a new report citing other ways in which gen AI tools can be used to help extremist groups. These include the use of autotranslation tools that can quickly and easily convert propaganda into multiple languages, or the ability to create personalized messages at scale to facilitate recruitment efforts online. But Hadley believes that AI also provides an opportunity to get ahead of extremist groups and use the technology to preempt what they will use it for.

“We're going to partner with Microsoft to figure out if there are ways using our archive of material to create a sort of gen AI detection system in order to counter the emerging threat that gen AI will be used for terrorist content at scale,” Hadley says. “We're confident that gen AI can be used to defend against hostile uses of gen AI.”

The partnership was announced today, on the eve of the Christchurch Call Leaders’ Summit, a movement designed to eradicate terrorism and extremist content from the internet, to be held in Paris.

“The use of digital platforms to spread violent extremist content is an urgent issue with real-world consequences,” Brad Smith, vice chair and president at Microsoft said in a statement. “By combining Tech Against Terrorism’s capabilities with AI, we hope to help create a safer world both online and off.”

While companies like Microsoft, Google, and Facebook all have their own AI research divisions and are likely already deploying their own resources to combat this issue, the new initiative will ultimately aid those companies that can’t combat these efforts on their own.

“This will be particularly important for smaller platforms that don't have their own AI research centers,” Hadley says. “Even now, with the hashing databases, smaller platforms can just become overwhelmed by this content.”

The threat of AI generative content is not limited to extremist groups. Last month, the Internet Watch Foundation, a UK-based nonprofit that works to eradicate child exploitation content from the internet, published a report that detailed the growing presence of child sexual abuse material (CSAM) created by AI tools on the dark web.

The researchers found over 20,000 AI-generated images posted to one dark web CSAM forum over the course of just one month, with 11,108 of these images judged most likely to be criminal by the IWF researchers. As the IWF researchers wrote in their report, “These AI images can be so convincing that they are indistinguishable from real images.”

Here’s How Violent Extremists Are Exploiting Generative AI Tools

Omegle connected strangers to one another and had a long-standing problem of pairing minors with sexual predators. A legal settlement took it down.

Omegle, the video and text chat site that paired strangers together to talk, ultimately shut down as part of a legal mediation with a female user who sued the company, claiming its defective and negligent design enabled her to be sexually abused through the site.

Omegle’s chatting service was shut down Wednesday, just a week after it settled a court case with a plaintiff identified as A.M. Her lawsuit, filed in 2021, alleged that she met a man in his thirties on Omegle who forced her to take naked photos and videos over a three-year period. She was just 11 when it began in 2014.

“The permanent shutdown of Omegle was a term negotiated between Omegle and our client in exchange for Omegle getting to avoid the impending jury trial verdict,” Carrie Goldberg, an attorney who represented A.M., tells WIRED. Attorneys for Omegle did not respond to a request for comment on the settlement. Emails to Omegle were not returned.

Omegle, founded in 2009, regained popularity during 2020 as Covid-19 lockdowns kept people at home. That popularity was, at least in part, driven by it becoming a place where lonely people could chat and also a place for sexual exploration. But its very design was different from other social apps: It instantaneously paired strangers on camera.

“Virtually every tool can be used for good or for evil, and that is especially true of communication tools, due to their innate flexibility,” Leif K-Brooks, Omegle’s founder, wrote in a note announcing the site’s end. “The telephone can be used to wish your grandmother ‘happy birthday’, but it can also be used to call in a bomb threat. There can be no honest accounting of Omegle without acknowledging that some people misused it, including to commit unspeakably heinous crimes.” K-Brooks’ note did not mention the settlement in his statement, but blamed the closure of Omegle on unspecified “attacks” against communication services.

There’s a flaw in K-Brooks’ argument: The telephone doesn’t connect children and teens directly to sexual predators with the click of a button. Omegle’s model allowed sexual predators to sign on and click through a roulette of people, continuously jumping from one to another until they were face-to-face with who they were looking for.

Omegle has a long, problematic history of sexual abuse issues. In August, a man was sentenced to 16 years in prison after admitting to chatting with approximately 1,000 minors on Omegle and recording many of them undressing. The recent settlement with A.M. stems from a $22 million lawsuit which claims the man who abused her had saved thousands of sexually exploitative images of children, including some of A.M. In 2022, a CBC reporter spent time on Omegle and found that the majority of the people she matched to chat with appeared to be men who were either naked or off-camera.

In 2022, there were 608,601 reports of child exploitation on Omegle to the nonprofit National Center for Missing and Exploited Children’s CyberTipline. Of all the sites the center tracked, only Facebook, Google, Instagram, and WhatsApp ranked higher.

In the US, social platforms are often protected by Section 230, a broad act that shields them from liability for the content their users post. But the judge in A.M.’s case found last July that Omegle’s design was at fault and it was not protected by Section 230: It could have worked to prevent matches between minors and adults before sexual content was even sent, the judge said.

K-Brooks wrote that he took a “good Samaritan” approach “to implement reasonable measures to fight crime and other misuse.” That included “basic safety and anonymity,” as well as “a great deal of moderation behind the scenes” that used both AI and human moderators. “Omegle punched above its weight in content moderation, and I’m proud of what we accomplished,” he wrote.

Omegle ultimately was brought down by a lawsuit from a sexual abuse survivor. But abusive content will still circulate around the web, and it shows how far away a long-term solution is. “We’ve got to ask ourselves some pretty good questions about how we even permitted this for so long,”  said Signy Arnason, associate executive director of the Canadian Centre for Child Protection, a charity focused on reducing sexual abuse and exploitation of children. “If we don’t address things at the regularity level, we’re just waiting for another site to backfill what Omegle.”

Omegle Was Forced to Shut Down by a Lawsuit From a Sexual Abuse Survivor

Meta now offers users an ad-free option, but it’s only available in Europe for those who can afford the €10-a-month subscription.

Meta just launched its first ad-free option for Facebook and Instagram. The update is in response to the European Union’s General Data Protection Regulation, passed in 2018. Subscriptions for the ad-free experience are only available to users located in the EU as well as Iceland, Liechtenstein, Norway, and Switzerland.

In these locations, anyone 18 and older on Facebook or Instagram now gets to decide whether they want to use the social media platforms for free or pay €10 every month for ad-free access. Meta provides the ad-free option without charge to users who are younger than 18.

What happens if you sign up? “We don't use any data for ad purposes at all. That turns off first-party data as well as stopping any third parties, like Nike, sending us information about you,” says Alex Dziedzan, a policy communication spokesperson at Meta. While it won’t be used for targeted advertising, Meta confirms that first-party data about you will still be used for functions not related to advertising.

Users who choose the free option allow Meta to perform targeted advertising by tracking their information. The company previously argued that consent was not required to target adults in the EU with hyper-specific advertising—before changing course and rolling out this new subscription tier for Facebook and Instagram. Earlier in 2023, Meta received a billion dollar fine for transferring data on European users to the United States.

When will this option roll out in the US? It’s unlikely Meta will ever offer an ad-free experience for users in the US, unless American lawmakers pass more aggressive legislation to regulate data privacy.

How to Get Ad-Free Facebook

If it’s an option that’s available in your region, you can expect to see a pop-up the next time you log in to Facebook or Instagram with a sign-up option for the ad-free social media. “This is part of our process for getting consent under the GDPR,” says Dziedzan. “It's a requirement for us to make sure that everyone sees the choice that they can make.” He emphasizes that Meta is not hiding this new option from users.

A subscription to ad-free Facebook or Instagram costs €10 per month if you sign up on your desktop. Anyone who signs up through the smartphone app pays €3 more a month for the subscription. No matter where your subscription starts, the ad-free plan includes both in-app and web browsing.

Want to sign up later? You can find the option in the Settings of your Facebook or Instagram account. Return to the same place if you ever want to get rid of your Meta subscription.

Your subscription can cover multiple profiles in your accounts center, for now. Meta plans to increase the price for users with more than one Facebook or Instagram in March of next year. After the company’s introductory pricing ends, each additional account will cost €6 a month if you sign up in your browser or €8 if you sign up in-app.

“If you have, let's say, a Facebook account and an Instagram account you would have to pay for both,” he says. “The reason for that is they’re two separate services.” So a person who signs up in a browser for ad-free access in their Facebook and Instagram accounts can soon expect to pay around €192 a year.

Why Is This Change Controversial?

It’s common for services, like Netflix, to offer ad-free versions of their products at a higher price. So why are privacy experts critical of Meta’s subscription plan?

“When you’re buying Netflix, you’re buying the convenience of not seeing ads,” says Thorin Klosowski, a security and privacy activist at the Electronic Frontier Foundation. “Buying into not being tracked is more about a pay-for-privacy scheme.” If Meta tracks the browsing habits of every adult user, except those who cough up €10 or more a month, then aspects of online privacy are out of reach for people without disposable income.

Dziedzan disagrees with the characterization of Meta’s ad-free subscription as a pay-for-privacy plan. He points out the privacy options that are available to all Facebook and Instagram users, like the ability to turn off aspects of third-party advertising. “The GDPR still applies to everybody who chooses to use the free version of our service, as do all the other privacy laws,” says Dziedzan.

Privacy advocates continue to push back against Meta’s advertising. “We already disagree with behavioral advertising to begin with,” says Klosowski. “Paying to get out of that just adds a second layer of confusion for users and grossness from the company.”

How to Get Facebook Without Ads—if It’s Available for You

Russia's most notorious military hackers successfully sabotaged Ukraine's power grid for the third time last year. And in this case, the blackout coincided with a physical attack.

The notorious unit of Russia's GRU military intelligence agency known as Sandworm remains the only team of hackers to have ever triggered blackouts with their cyberattacks, turning off the lights for hundreds of thousands of Ukrainian civilians not once, but twice within the past decade. Now it appears that in the midst of Russia's full-scale war in Ukraine, the group has achieved another dubious distinction in the history of cyberwar: It targeted civilians with a blackout attack at the same time missile strikes hit their city, an unprecedented and brutal combination of digital and physical warfare.

Cybersecurity firm Mandiant today revealed that Sandworm, a cybersecurity industry name for Unit 74455 of Russia's GRU spy agency, carried out a third successful power grid attack targeting a Ukrainian electric utility in October of last year, causing a blackout for an unknown number of Ukrainian civilians. In this case, unlike any previous hacker-induced blackouts, Mandiant says the cyberattack coincided with the start of a series of missile strikes targeting Ukrainian critical infrastructure across the country, which included victims in the same city as the utility where Sandworm triggered its power outage. Two days after the blackout, the hackers also used a piece of data-destroying "wiper" malware to erase the contents of computers across the utility's network, perhaps in an attempt to destroy evidence that could be used to analyze their intrusion.

Mandiant, which has worked closely with the Ukrainian government on digital defense and investigations of network breaches since the start of the Russian invasion in February of 2022, declined to name the targeted electric utility or the city where it was located. Nor would it offer information like the length of the resulting power loss or the number of civilians affected.

Mandiant does note in its report on the incident that as early as two weeks before the blackout, Sandworm's hackers appear to have already possessed all the access and capabilities necessary to hijack the industrial control system software that oversees the flow of power at the utility's electrical substations. Yet it appears to have waited to carry out the cyberattack until the day of Russia's missile strikes. While that timing may be coincidental, it more likely suggests coordinated cyber and physical attacks, perhaps designed to sow chaos ahead of those air strikes, complicate any defense against them, or add to their psychological effect on civilians.

"The cyber incident exacerbates the impact of the physical attack," says John Hultquist, Mandiant's head of threat intelligence, who has tracked Sandworm for nearly a decade and named the group in 2014. "Without seeing their actual orders, it's really hard on our side to make a determination of whether or not that was on purpose. I will say that this was carried out by a military actor and coincided with another military attack. If it was a coincidence, it was a terribly interesting coincidence."

Nimbler, Stealthier Cybersaboteurs

The Ukrainian government's cybersecurity agency, SSSCIP, declined to fully confirm Mandiant's findings in response to a request from WIRED, but it didn't dispute them. SSSCIP's deputy chair, Viktor Zhora, wrote in a statement that the agency responded to the breach last year, working with the victim to "minimize and localize the impact." In an investigation over the two days following the near-simultaneous blackout and missile strikes, he says, the agency confirmed that the hackers had found a "bridge" from the utility's IT network to its industrial control systems and planted malware there capable of manipulating the grid.

Mandiant's more detailed breakdown of the intrusion shows how the GRU's grid hacking has evolved over time to become far more stealthy and nimble. In this latest blackout attack, the group used a "living off the land" approach that has become more common among state-sponsored hackers seeking to avoid detection. Instead of deploying their own custom malware, they exploited the legitimate tools already present on the network to spread from machine to machine before finally running an automated script that used their access to the facility's industrial control system software, known as MicroSCADA, to cause the blackout.

In Sandworm's 2017 blackout that hit a transmission station north of the capital of Kyiv, by contrast, the hackers used a custom-built piece of malware known as Crash Override or Industroyer, capable of automatically sending commands over several protocols to open circuit-breakers. In another Sandworm power grid attack in 2022, which the Ukrainian government has described as a failed attempt to trigger a blackout, the group used a newer version of that malware known as Industroyer2.

Sandworm Hackers Caused Another Blackout in Ukraine—During a Missile Strike

Face recognition technology has been controversial for years. Cops in the UK are drastically increasing the amount they use it.

A Beyoncé gig, the coronation of King Charles, and the British Formula One Grand Prix all have one thing in common: Thousands of people at the events, which all took place earlier this year, had their faces scanned by police-operated face recognition tech.

Backed by the Conservative government, police forces across England and Wales are being told to rapidly expand their use of the highly controversial technology, which globally has led to false arrests, misidentifications, and lives derailed. Police have been told to double their use of face searches against databases by early next year—45 million passport photos could be opened up to searches—and police are increasingly working with stores to try to identify shoplifters. Simultaneously, more regional police forces are testing real-time systems in public places.

The rapid expansion of face recognition comes at a time when trust in policing levels are at record lows, following a series of high-profile scandals. Civil liberties groups, experts, and some lawmakers have called for bans on the use of face recognition technology, particularly in public places, saying it infringes on people’s privacy and human rights, and isn’t a “proportionate” way to find people suspected of committing crimes.

“In the democratic world, we are an outlier at the moment,” says Madeleine Stone, a senior advocacy officer with Big Brother Watch, a privacy-focused group that has called for a ban and “immediate stop” on live face recognition, a proposal backed by 65 UK lawmakers. The EU, which the UK left in 2016, may ban the real-time use of face recognition systems, and one of its highest courts has called the technology “highly intrusive.” Various US states have banned police from using the technology.

Cops in England and Wales can hunt for potential criminals using two main kinds of face recognition. First, there are live face recognition systems (LFR): These usually include cameras mounted on police vans that scan people’s faces as they walk by and check them against a “watchlist” of wanted people. The LFR technology is deployed for some big events and announced in advance by the police. Second, there’s retrospective face recognition (RFR), where images from CCTV, smartphones, and doorbell cameras can be fed into a system that tries to identify the person based on millions of existing photos. Police use of both systems is increasing.

Two police forces in England and Wales—London’s Metropolitan Police and South Wales Police—have embraced LFR, using the technology for multiple years. (Police in Scotland, where policing is overseen locally, don’t use live systems but are reportedly increasing their use of RFR). So far this year, the Met and South Wales Police have used LFR on 22 separate occasions, according to statistics published on their websites.

Across 13 deployments, an estimated 247,764 people have passed the Met’s cameras this year, including at the King’s coronation and a soccer match between Arsenal and Tottenham. In 2023 so far, the Met’s system has pinged 18 times when it has matched a person with someone on the predetermined watchlist. Twelve of those people have been arrested. South Wales Police has used LFR nine times this year, scanning an estimated 705,290 faces and arresting two people.

Researchers and academics have long shown face recognition technologies to be biased or less accurate for people of color, particularly Black people. In all of the LFR uses by the Met and South Wales police forces this year, their figures show, there have been no false alerts or misidentifications. In short, every time the system made a match, it was correct, according to the departments’ data. The data published by the police forces show the LFR systems they are using are set to an accuracy threshold of either 0.6 or 0.64. A study conducted by the National Physical Laboratory, a UK public sector research organization, recommended the threshold setting of 0.64 as a way to reduce biased and incorrect matches.

Pete Fussey, a professor at the University of Essex who previously audited the Met’s face recognition, says that the report shows the algorithms may still be discriminatory and biased, but setting the thresholds neutralizes the system entirely. “If you desensitize the system, then you'll get fewer matches and fewer of those will be wrong,” Fussey says. Big Brother Watch’s Stone says it “brings into question the necessity and proportionality of the whole endeavor if you’re having dozens of police officers standing around the street looking at iPads just to make one arrest.” Stone argues “it’s not a good use of time.”

A spokesperson for the Home Office, the government department responsible for policing in England and Wales, says it is “committed” to giving police the technology they need to help solve crimes. “Technology such as facial recognition helps the police quickly and accurately identify those wanted for serious crimes, as well as missing or vulnerable people,” the spokesperson says, claiming it “frees up police time and resources.” They point to a blog post about police use of face recognition technologies.

“Live facial recognition isn't just deployed on its own. It's in support of wider policing operations,” says detective chief inspector Jamie Townsend, who is the operational lead for the Met's face recognition. A policing operation may make 30 arrests in an area with face recognition contributing two or three of them, he says.

Townsend says that the biometric data of people isn’t stored when they are scanned by LFR cameras, and he considers the system to be “precision policing” as it allows for the identification of specific individuals. The Home Office’s blog post claims LFR has led to the arrest of sex offenders and someone wanted for possessing a knife. South Wales Police did not respond to WIRED’s request for comment at the time of writing.

Two other UK police forces have tried LFR in recent months, raising concerns about how the technology will be used going forward and who is put on the watchlists of people the systems are looking for. There are more than 30 police forces that have not used LFR, although the government has said it is “very supportive” of more forces using it.

Around 380,000 people had their faces scanned by Northamptonshire police over three days at the British Grand Prix in July, according to public records requests. No arrests were made. A Freedom of Information Act request from Big Brother Watch revealed the force had placed 790 people on the watchlist for the event while only 234 were wanted for arrest. “It was largely individuals who were not wanted for any criminal reasons, which leads us to believe that these were protesters who were being put on watchlists,” Stone says. The previous year’s British Grand Prix was disrupted by protesters.

A statement from Northamptonshire Police says the watchlist “included a range of offences from organized crime to aggravated trespass, which had the potential of leading to the death or serious injury of the public, racing drivers and staff, especially if there was a repeat of the 2022 track incursion. We were not targeting those taking part in lawful, peaceful protests.”

Police forces are also being encouraged to ramp up the use of after-the-fact, retrospective face recognition. All police forces across the UK have the ability to run searches for faces against the Police National Database, which has more than 16 million photos and includes millions of images that should have been deleted years ago. In 2022, according to data from freedom of information requests, there were 85,158 face searches—up 330 percent on the previous year. Policing minister Chris Philp said in October that he wants the number of searches to double by May 2024.

Fussey, the University of Essex professor, says retrospective face recognition is often thought to be more “benign” than live face recognition, but he doesn't believe it is the case. “The issues and harms and human rights implications are the same, whether it's live or retrospective,” he says, adding there is a lot of ambiguity around how the technology is being used.

In August 2020, the UK’s Court of Appeal ruled that South Wales Police’s use of LFR was unlawful. Since then, police forces using the technology say they have changed their procedures in response to the court decision, and the Home Office spokesperson says there is a “comprehensive legal framework in the UK” that requires police to use the technology only when it is “necessary, proportionate, and fair.”

Many disagree. A wide-ranging review from the Ada Lovelace Institute, a nonprofit, says there is “legal uncertainty” about the use of LFR. Another report by University of Cambridge academics, from the Minderoo Centre for Technology and Democracy, concluded that three examined police deployments of face recognition “failed to meet the minimum ethical and legal standards.”

“It’s wholly legitimate for police to use technology to keep the public safe,” says Fussey, who recently completed a report on proposals to change the oversight of biometrics in the UK. “The question is about how lawful and necessary it is,” he says. “At the moment, we’re in a situation where the legal basis isn’t clear. There’s no external oversight of how it’s used, how it’s authorized, who’s on the watchlist.”

Police Use of Face Recognition Is Sweeping the UK

The third GOP debate is sponsored by the Republican Jewish Coalition and will be livestreamed on a platform favored by one of America’s most notorious white nationalists.

Tonight, the third GOP presidential primary debate will take place in Miami. The event is sponsored by the Republican Jewish Coalition (RJC) at a time when antisemitic incidents in the US, according to the Anti-Defamation League, have risen by nearly 400 percent since the Israel-Hamas war erupted last month.

While the Republican National Committee (RNC) has partnered with NBC to broadcast the debate on TV, the event will also be livestreamed for the third time on Rumble, the YouTube alternative that is home to what the Southern Poverty Law Center says is one of America’s most notorious white nationalists, Nick Fuentes.

For the past month, Fuentes has used the Israel-Hamas conflict to push antisemitic hate speech and Holocaust denial conspiracies on his Rumble channel, racking up hundreds of thousands of views. Fuentes has hailed Rumble for reviving his audience, which has gained thousands of followers since Hamas attacked Israel on October 7.

“I think the show is bigger than it's been in a really long time,” Fuentes told his more than 40,000 viewers last week during one of his frequent livestreams on the platform. “If you look at the viewership on Rumble, it’s crazy. I’ve been getting really good viewership on Rumble like I haven’t since I was on YouTube … The replays have been insane.”

Fuentes is a white nationalist leader of the Groyper movement. He attended the neo-Nazi Unite the Right rally in Charlottesville in 2017, has openly praised Hitler, and repeatedly denied the Holocaust. He has also had dinner with former president Donald Trump.

Fuentes’ YouTube account was terminated in 2020 as Google demonetized it, and he initially struggled to retain his audience on a number of other platforms, including DLive and his own Cozy.tv streaming service. Fuentes joined Rumble in March 2021, and he was initially critical of the platform’s failure to promote his videos. He claims he was briefly suspended from the platform in July after posting the livestream of a rally where he called for a “holy war” against non-Christians. Now, less than four months later, he claims his channel is flourishing.

Since the outbreak of the Israel-Hamas war in early October, Fuentes has used his channel on Rumble, which has 42,600 followers, to spread antisemitic conspiracies, claiming in one video that the Israeli government had created the Hamas attack as “atrocity propaganda” to advance “Jewish interests.”

Fuentes compared the Hamas attack to the Holocaust, claiming both were created to “elicit a certain emotional response \[to give the government\] the popular mandate to do whatever it is the government wants to do.”

While it portrays itself as a free speech network, Rumble does have specific policies in place against racism and antisemitism. The platform removed two of Fuentes’ videos on Tuesday evening after WIRED flagged the antisemitic comments made in them, but many others remain. Rumble declined WIRED’s request to comment on whether or not it had an antisemitism problem on its platform.

Fuentes’ is one of many accounts that researchers at Media Matters, a left-leaning media watchdog group, have identified as not only spreading antisemitic content on Rumble, but also monetizing it.

“There is a plethora of antisemitic content on the platform as well as other violent content, conspiracy theories, and bigotry,” Kayla Gogarty, research director at Media Matters, tells WIRED. “We found about 16 far-right figures and groups who have made antisemitic content and have run advertisements on the platform, including Keith Woods, Elijah Schaffer, Stew Peters, and other accounts like Vincent James Foxx.”

Fuentes’ account has not monetized his own channel, but clips of his content have been monetized on Rumble, Gogarty says.

Fuentes did not respond to WIRED’s request for comment, nor did Woods, Schaefer, Peters, and Fox.

The RNC told WIRED in an emailed statement that “hate, bigotry and violence is unfortunately prevalent on every social media platform, and the RNC condemns it entirely, but the RNC does not manage content or pages outside of our own.”

The RJC did not respond to multiple requests from WIRED about the presence of Fuentes and antisemitism on Rumble. At the announcement of the RJC’s sponsorship of the debate last month, the group’s chairman, former US senator Norm Coleman from Minnesota, told NBC: “As the horrific events of the last week have unfolded in Israel, the issue of American foreign policy has taken on an even greater role. American strength and American resolve—and our candidates’ vision for America’s role in the world—are more important than ever.”

Founded in 2013, Rumble has in recent years become a home for many right-wing extremists, conspiracy peddlers, and election deniers who have been banned from mainstream platforms like YouTube, Facebook, and Instagram, or who have had their ability to monetize their content removed.

Rumble, which went public in 2022 and has seen significant growth in users over the past 18 months, has also partnered with Trump’s struggling social media platform Truth Social to provide video services. Donald Trump Jr., the former president’s son, and his wife, Kimberly Guilfoyle, both have exclusive deals with the platform where they post video podcast series.

The GOP Presidential Debate Is Livestreaming on Rumble, Home to White Nationalist Nick Fuentes

For the first time, guerrilla animal rights group Direct Action Everywhere reveals a guide to its investigative tactics and toolkit, from spy cams to night vision and drones.

In recent years, the animal liberation group Direct Action Everywhere has carried out some of the most brazen and tech-savvy operations and investigations to ever target the animal agriculture industry. It has rescued pigs, goats, ducks, and chickens from factory farms and slaughterhouses in midnight intrusions; captured virtual reality footage with custom-built 360-degree video rigs inside massive pig barns; and used hidden cameras to record some of the meat industry's most disturbing practices, from the carbon dioxide gas chambers that are increasingly used in pig slaughterhouses to the “ventilation shutdowns” designed to cull thousands of farm animals through overheating and suffocation.

To pull off all those revelatory and often highly controversial actions, Direct Action Everywhere (which uses the abbreviation DxE) has also spent years evolving its toolkit and operational rigor—from communications security and physical stealth, to penetration tactics for getting inside factory farms and slaughterhouses. It has also long maintained a manual of its own methods for those operations. Now, for the first time, it's publicly releasing that guide.

The document is a rare glimpse into the detailed tech and tactics of a group that carries out sophisticated and often illegal acts of intrusion and espionage, turning a playbook that might otherwise be used by spies or thieves into one for grassroots activism. “To spend so much time thinking about the vulnerabilities in these facilities, how to get in, avenues of approach,” says Lewis Bernier, a longtime investigator at DxE who has led or participated in hundreds of operations inside farms and slaughterhouses around the country, “I think it's really changed the way I see security as a whole.”

A note of warning: Despite the “how-to” tone of the guide itself, do not try this at home. DxE investigators frequently face criminal charges, and DxE's critics in the agriculture industry and in law enforcement describe the group as radicals with extreme tactics. Despite the group’s nonviolent approach, the agribusiness trade group WATT Global Media wrote in 2018 that DxE “could very well be the most dangerous animal rights organization out there.” Even some other animal rights organizations have balked at their risky methods, especially given the potential for prison sentences under some US states’ severe laws protecting animal agriculture businesses.

DxE goes as far as to welcome those criminal charges, often willingly identifying themselves after an investigation's findings are released in an effort to draw more attention to their revelations and argue the justice of their cause. In fact, the group's cofounder, Wayne Hsiung, was convicted just last week on a felony charge of conspiracy to commit trespassing related to the removal of ducks and chickens from a California poultry farm. He now potentially faces years in prison.

Bernier says that DxE decided to publicly release its guide, even in the wake of Hsiung’s conviction, to help activists who are already committed to carrying out covert investigations do their work more safely and effectively. “More and more people around the world want to do this stuff, or at least are just interested in how it works,” he says. “I think this guide will offer an opportunity for people to understand what's really involved.”

Drones, Night Vision, and Spy Cams

Much of the guide is focused less on spy tricks and espionage gear than on effective activism: team building, creating a chain of command, understanding the media, logistics, planning, biosecurity to avoid contaminating farms with disease, and creating a “security culture” that avoids the gossip, bragging, prying, and infighting that can lead to operations being blown or infiltrated by law enforcement.

But other elements of the manual offer specific descriptions of surveillance tools like drones, hidden cameras, and thermal and night vision scopes. For stealthy after-hours intrusions into factory farms and other facilities, for instance, the guide describes assigning a team member as a scout, equipped with night vision and thermal imaging tools. The guide specifically names the Sionyx Aurora Sport as its recommended night vision camera for both reconnaissance and capturing images in the dark, but notes that thermal imaging tools like the Flir Scout TK offer its scouts other advantages. Thermal imaging can reveal which parts of a facility are active, the guide notes, given that those buildings will be running heating or fans, and also show from a distance which vehicles outside a building have their engines running or have recently moved, revealed in heat traces on a car or truck's brakes.

Source

Wired