The Government Surveillance Reform Act of 2023 pulls from past privacy bills to overhaul how police and the feds access Americans’ data and communications.

In 1763, the radical journalist and colonial sympathizer John Wilkes published issue no. 45 of _North Briton_, a periodical of anonymous essays known for its virulent anti-Scottish drivel—and for viciously satirizing a British prime minister until he quit his job. The fallout from the subsequent plan of the British king, George III, to see Wilkes put in irons for the crime of being too good at lambasting his own government reverberates today, particularly in the nation whose founders once held Wilkes up as an idol, plotting a revolt of their own.

Wilkes’ arrest boiled the Americans’ blood. Reportedly, the politician-cum-fugitive had invited the king’s men into his home to read the warrant for his arrest aloud. He quickly tossed it aside. At trial, Wilkes explained its most insidious feature: “It named nobody,” he said, “in violation of the laws of my country.” This so-called general warrant, which subsequent lawsuits by Wilkes would see permanently banned, vaguely described some criminal allegations, but not a single place to be searched nor suspect to be arrested was named. This ambiguity granted the king's men near blanket authority to arrest anyone they wanted, raid their homes, and ransack and destroy their possessions and heirlooms, confiscating large bundles of private letters and correspondence. When the Americans later passed an amendment to ban vague legal warrants describing neither "the place to be searched" nor "persons or things to be seized," it was Wilkes's home, historians say, that they pictured.

This morning, a group of United States lawmakers introduced bicameral legislation aimed, once again, at reining in a government accused of arbitrarily snatching up the private messages of its own citizens—not by breaking down doors and seizing handwritten notes, but by tapping into the power of internet directly to collect an endless ocean of emails, calls, and texts. The Government Surveillance Reform Act of 2023 (GSRA)—introduced in the US House by representatives Zoe Lofgren and Warren Davidson, and in the US Senate by Ron Wyden and Mike Lee—is a Frankenstein bill more than 200 pages long, combining the choicest parts of a stack of cannibalized privacy bills that rarely made it past committee. The patchwork effect helps form a comprehensive package, targeting various surveillance loopholes and tricks at all levels of government—from executive orders signed by the president, to contracts secured between obscure security firms and single-deputy police departments in rural areas.

“Americans know that it is possible to confront our country’s adversaries ferociously without throwing our constitutional rights in the trash can,” Wyden tells WIRED, adding that for too long surveillance laws have failed to keep up with the growing threats to people’s rights. The GSRA, he says, would not strip US intelligence agencies of their broad mandate to monitor threats at home or abroad, but rather restore warrant protections long recognized as core to democracy’s functioning.

The GSRA is a Christmas list for privacy hawks and a nightmare for authorities who rely on secrecy and circumventing judicial review to gather data on Americans without their knowledge or consent. A US Justice Department requirement that federal agents obtain warrants before deploying cell-site simulators would be codified into law and extended to cover state and local authorities. Police in the US would need warrants to access data stored on people’s vehicles, certain categories of which should already require one when the information is stored on a phone. The government could also no longer buy sensitive information about people that would require a judge’s consent, had they asked for it instead.

What’s more, the bill will end a grandfather clause that’s keeping alive expired portions of the USA Patriot Act that’s allowed the FBI to continue employing surveillance techniques that have technically been illegal for two years. Petitioners in federal court seeking relief due to privacy violations will also no longer be shown the door for having no more than a “reasonable basis” to believe they’ve been wrongfully searched or surveilled.

Not to be outstripped by the sheer variety of smaller pet reforms—such as yanking the security clearances of anyone caught abusing a classified database (a crime that’s commonly punished with a slap on the wrist), or ensuring that the government can’t simply store people’s data for the rest of their lives because it hasn’t been decrypted—the GSRA principally takes aim at Section 702 of the Foreign Intelligence Surveillance Act, the government’s most promiscuous surveillance program through which it captures a large but _indeterminate_ amount of messages en route to and from Americans’ phones each day.

After 9/11, the US government commenced with some of the most extensive domestic surveillance in modern history, a monument achieved on the back of the internet’s technological revolution that redefined what it meant for people to communicate. Exposed by journalists and leakers at the height of America’s recent wars in the Middle East, the extent of the surveillance, once publicly acknowledged, unleashed bad memories of corrupt intelligence agencies relentlessly bugging anyone with a phone—actors, comedians, civil rights leaders, and even one another.

The US Congress, fearful of foreign threats, enacted only piecemeal reforms in response to these revelations, which kicked off in the early aughts and crescendoed in 2013 with Edward Snowden’s polemic leaks. The government’s sporadic but incessant updating of agency rules and procedures have done little to stymie routine abuses of the 702 data—which is currently fathomless. The first thing to know about the program, and how many Americans it ensnares each year, is that the government doesn't know the number and has little interest in learning it. A key defense, in fact, of the government's lack of transparency in this area is that examining the data to determine who is and is not an American would technically commit the very violation its procedures are designed to prevent.

While the program is strictly authorized for the surveillance of foreigners on foreign soil, wiretapping internet communications is neither accurate nor precise. In 2008, Congress was forced to effectively recognize that the collateral surveillance of Americans was the inevitable byproduct of operating an intelligence program with Big Brother–like proportions. Faced with growing privacy fears at home and emerging national security threats abroad, Congress took stock of the situation and then resigned to split the baby.

Nearly 60 years ago, in the face of overwhelming evidence that police interrogations are inherently coercive, the US Supreme Court did not ban the practice in _Miranda v. Arizona_ but rather ruled that the threat to people's rights could be reasonably mitigated by cops reading “collared” suspects a brief statement of rights—a “warning” that has much the same purpose as legal disclaimers read aloud on customer care calls. Similarly, Congress chose not to put an end to the surveillance of Americans' communication despite the enormous scale of rights violations accumulating steadily each day. Instead, it ordered the creation of many byzantine rules and procedures designed to ameliorate constitutional risks to some reasonable degree—by merely lessening the odds of a federal employee laying eyes on any illicitly gained information.

“Incidental” is a surveillance term of art referring to communications of Americans not _accidentally_ intercepted by their own government, but _unavoidably_. In a report last month, a federal privacy watchdog stressed that while the word “incidental” made the collection sound small, “it should not be understood as occurring infrequently.”

The GSRA takes aim at the use of incidental data by federal law enforcement agents, who are not bound by the same rules against spying on Americans as are analysts at the Pentagon, whose purview lies strictly overseas. While it is illegal to target US persons under 702, once they have been surveilled, the communications become accessible nevertheless to the Federal Bureau of Investigation, which has its own procedures for “querying” the nebulous database—rules that can permit, for example, the reading of emails marked “attorney-client privilege” so long as the subject isn’t wanted for a crime.

An inspector general’s investigation last year found the FBI’s own legal experts at variance over “key legal principles” tied to rules governing 702's use. Findings like these have served only to repeatedly injure the FBI, nurturing a cycle of disappointment and distrust in its capacity to behave as a competent surveillant.

The GSRA could work positively to solve many problems at the FBI. Trust in the bureau among lawmakers is only likely to grow, once its unfettered access to a digital black box filled with everyone's secrets becomes subject to court review. The GSRA removes the ability entirely for the FBI to run queries on US persons without probable cause, that is, “a reasonable amount of suspicion, supported by circumstances sufficiently strong to justify a proven and cautious person's belief that certain facts are probably true.” (In contrast, the current standard is this: Be looking for evidence of a crime, don't go fishing, and be “reasonably” confident the information you're after is “likely” to be found.)

“For too long, intelligence and law enforcement agencies have had unchecked access to Americans’ personal data,” says Lofgren, the representative from California who issued a warning to colleagues on Tuesday against the “unwise” move of reauthorizing the 702 program without “carefully considering and enacting surveillance reforms.”

The GSRA is currently the only bill in Congress that could reauthorize the 702 statute that’s set to expire by the end of the year. The statute is what allows the government to apply for “certifications” issued by the secret Foreign Intelligence Surveillance Court (FISC). These certifications, which all last for one year, allow the government to compel the cooperation of communications services providers for three purposes: foreign intelligence, counterterrorism, and the tracking of nuclear proliferation—with an array of threats, from cybercrime to narco-trafficking, all couched within those categories.

Whether or not Congress reauthorizes 702 before it expires, the collection will continue unabated until at least April, when the certifications expire. Hypothetically, the government could reapply for new certifications, which the FISC could grant before April, thereby extending the program's life into 2025 without Congress lifting a finger. That is unlikely, however, says Bob Goodlatte, former chairman of the House Judiciary Committee, who says any attempt to wrest control away from Congress will be viewed as a “hostile gesture,” further imperiling Section 702's survivability.

“The FISA Court and the Director of National Intelligence have confirmed that our government conducted warrantless surveillance of millions of Americans’ private communications,” says Senator Mike Lee.

In remarks to WIRED, Lee pointed to high-level confirmations that the US government is conducting “warrantless surveillance of millions of Americans” each day. “It is imperative that Congress enact real reforms to protect our civil liberties,” he says, including “statutory penalties for privacy violations,” a precondition of his support for “reauthorizing Section 702.”

Government Surveillance Reform Act of 2023 Seeks to End Warrantless Police and FBI Spying

Israel has said it’s prepared to disrupt internet service in Gaza, signaling a new age of warfare. In the past two weeks, the Palestinian territory has already suffered three communications shutdowns.

Since Hamas’ tragic October attack on Israel that killed at least 1,400 people, the country’s retaliation in Gaza has led to more than 10,000 deaths, according to unverified claims from the Hamas-run Gazan Health Ministry, and broad destruction of the community's basic utilities and infrastructure. This includes its internet and communication systems, with dwindling connectivity largely cutting off 2.2 million Gazans from the outside world.

On October 27, Israel reportedly imposed a full internet shutdown in the area, cutting off the last remaining connectivity for about 34 hours as its troops moved into the Gaza Strip. After what’s left of Gaza’s internet access was restored—data shows it stands at around 15 percent or less of usual connectivity—the area has suffered two other, similar connectivity blackouts. The most recent lasted for about 15 hours on Sunday as Israel was carrying out an intense operation to cut off Gaza City in the north from southern Gaza

While researchers and technologists who monitor internet connectivity can’t conclusively say that Israel was behind the blackouts—or that they were imposed using technical controls rather than physical destruction of infrastructure—the fact that some connectivity could be restored so rapidly seems to indicate deliberate shutdowns over incidental destruction.

“In the last 10 days, there have been three periods of time that connectivity has gone to completely zero,” says Doug Madory, director of internet analysis at monitoring firm Kentik. He notes that from the data he is able to see, it's only possible to determine whether internet service providers in Gaza are communicating with the outside world and not the specific cause of an outage. One “aggressor in the conflict that's taking place in Gaza happens to have the ability to turn off service in the region that they're doing military operations in,” Madory says.

Throughout the Gaza Strip, there are around a dozen internet service providers and cell phone companies that get people online—although cell networks only use 2G technologies, as opposed to the faster 3G, 4G, and 5G connections available across much of Israel. These companies are heavily reliant on Israeli infrastructure to connect to the global internet, with open internet advocacy nonprofit the Internet Society classing Palestine as having “poor” connections to the wider internet. Since the start of the war, mobile and internet providers’ offices, cables, and cell towers have been destroyed. Many are now totally offline.

“Israel controls the telecommunication and internet that comes to Gaza,” says Husam Mekdad, a telecoms engineer living in southern Gaza in a message to WIRED. He says “most” of the main internet service providers are down, and the mobile operators that can still operate 2G connections have hugely congested networks.

“No company can repair or do anything right now,” Mekdad says. Many firms, he says, are waiting until the war is over to see the status of their infrastructure and evaluate it. The United Nations Office for the Coordination of Humanitarian Affairs said last week that 65 percent of households and businesses have lost access to the internet and half of networks have been damaged.

The Palestinian territories’ biggest internet provider, Paltel, has retained the most connectivity, according to internet analysts. But during the three complete blackouts, even Paltel has been knocked offline. “When Paltel is offline, then I think everybody's down,” Madory says.

Paltel alleges that during the three blackouts its services were being “disconnected” by Israel. The Ministry of Communications and Information Technology of the State of Palestine has also claimed there has been “systematic targeting” of networks and urged countries to “put pressure on the Israeli government” to restore connections. Paltel has not returned WIRED’s multiple requests for comment in recent weeks.

The Israeli Defense Forces declined to comment when asked whether they were behind the recent internet shutdowns in Gaza. Israel’s Ministry of Communications did not respond to WIRED’s request for comment. However, on October 17, ahead of the total blackouts, the Israeli communications ministry published an update on the war that appeared to detail its plans. “There is an ongoing examination and preparation for the shutting down of cellular communications and internet services to Gaza,” the update said.

In recent years, internet shutdowns have become a dystopian reality for millions of people in India, Iran, Pakistan, Iraq, and other countries. Last year there were 187 internet shutdowns in 35 countries, according to Access Now, a digital rights nonprofit. Internet shutdowns can do huge damage to a country’s economy as well as people’s ability to communicate with friends and loved ones and access medical care and other essential information. Typically, internet shutdowns are initiated by repressive governments trying to control protests, stop people organizing, and quell dissent. The approach is widely condemned by democratic countries, the United Nations, and human rights groups.

After internet service came back in Gaza the first time in late October, the White House wrote in a statement that “the restoration of communications in Gaza was critical. Aid workers, civilians, and journalists need to be able to communicate to each other and the rest of the world. Our Administration cared about this, worked on it, and are glad to see it restored.” The US State Department and White House National Security Council did not return requests for comment from WIRED about the implications of the two subsequent internet shutdowns in Gaza.

“Seeing intermittent shutdowns reiterates where the power to shut down actually lies,” says Helga Tawil-Souri, a digital communication and media researcher focused on Israel-Palestine at New York University. “Every major bombing campaign that Israel has taken on sees with it new strategies of what media or communication forms are allowed and what is not allowed, as in the 2008-2009 bombing of Gaza, where there was a crackdown on foreign journalists for the first time, and the 2014 bombing. The kinetic warfare, the starving, the lack of communication, lack of water, targeting solar panels—all of it just kind of works together for the total incapacitation of normal life on every possible level.”

For people living in Gaza, it’s likely that as the war continues there will be more total internet shutdowns. Some have been able to find spots of connectivity, people with access to expensive satellite phones can communicate with the outside world, and others have used eSIMs to access Israeli or Egyptian networks that reach into Gaza. These and other circumvention techniques, while a critical lifeline, have been unreliable, though, as the war rages on.

Mekdad, the network engineer in Gaza, says that with little electricity or fuel to use generators, some people are using small solar chargers to power their devices. He showed WIRED a photo of nine phones connected to a series of power outlets. “The situation is very bad. We are running out of electricity, clean water, food, and medical supplies,” Mekdad says. His relatives have fled from the north looking for safe shelter in southern Gaza. “We expected to die every second,” he says. “We just hope to stay alive.”

Internet Blackouts in Gaza Are a New Weapon in the Israel-Hamas War

A complaint filed with the EU’s independent data regulator accuses YouTube of failing to get explicit user permission for its ad blocker detection system, potentially violating the ePrivacy Directive.

Privacy campaigner Alexander Hanff claims that YouTube’s new ad blocker detection is illegal under European law, and he's taking the fight to the European Commission.

On November 6, German Pirate Party MEP Patrick Breyer addressed Hanff’s claim to the European Commission, formally requesting a legal position as to whether “protection of information stored on the device (Article 5(3) ePR) also cover information as to whether the user's device hides or blocks certain page elements, or whether ad-blocking software is used on the device” and—critically—if this kind of detection is “absolutely necessary to provide a service such as YouTube.”

YouTube began rolling out ad block detection to Europe earlier this year and is now preventing some European users from viewing its content if they have an ad blocker enabled. The EU’s ePrivacy Directive requires online service providers to get explicit permission to “gain access to information stored in the terminal equipment of a subscriber or user.” Hanff, an expert advisor to the European Data Protection Board, alleges that YouTube’s use of JavaScript-based detection scripts to look for specific HTML page elements rendered by a user’s browser is subject to that requirement and he believes it is failing to abide by it.

In a complaint lodged with Ireland's Data Protection Commissioner (DPC), Hanff called on the DPC to “take action against YouTube … for this breach of the law and demand YouTube cease their unlawful deployment of adblocker detection tools.”

Hanff, who helped to draft the forthcoming update to the EU’s ePrivacy regulations, says he believes YouTube’s JavaScript violates EU citizens' privacy.

“The script that \[YouTube\] deploys is detecting what software people are running on their machines or what behaviour their browser is exhibiting in relation to their private activities. It's not okay. It's illegal,” Hanff claims, echoing his complaint. We have a fundamental right to privacy under Article 7 of the European Charter of Fundamental Rights. We have a fundamental right to data protection under Article 8.”

YouTube reportedly started implementing anti-adblock measures in May 2023, and in June was still describing its ad blocker detection as a “experiment.” European users have reported seeing detection messages since at least mid-October. Not every user is affected, and you’ll only see these anti-adblocker messages if you’re signed into your YouTube account.

When YouTube detects an ad blocker or other privacy tool that blocks ads as part of its functions, you'll see a warning stating that “Ad blockers violate YouTube's Terms of Service” or “Ad blockers are not allowed on YouTube.” There are a few different versions of this message, including some that entirely prevent you from playing videos and others that allow you to view a number of videos with your blocker enabled before streaming is blocked.

A pop-up asking you to turn off your ad blocker is hardly an unusual sight on the internet, but could it be against the law?

All versions of YouTube's ad blocker detection that WIRED is aware of use a JavaScript program that runs in the client browser, although YouTube says that it could use non-invasive server-side methods to identify if a video ad served to a user has not been played.

Hanff’s complaint claims that YouTube’s client-side detection code meets the description, in Article 5(3) of the ePrivacy directive 2002/58/EC, of a process used to “gain access to information stored in the terminal equipment of a subscriber or user." If that’s the case, the user must be provided with “clear and comprehensive information” about what this information will be used for and given the “right to refuse such processing.”

You'll be familiar with this process from the cookie consent forms that appear whenever a website wishes to capture non-essential information about you and your browser. Right now, neither an explicit notification nor an opt-out are displayed when YouTube obtains data about whether ad blocking tools may be active on your device or network connection.

YouTube representative Christopher Lawton tells WIRED that “ads support a diverse ecosystem of creators globally and allow billions to access their favorite content on YouTube. The use of ad blockers violate\[s\] YouTube’s Terms of Service.”

YouTube’s current terms, last updated on January 5, 2022, don’t explicitly mention the use of ad blocking tools, nor any detection measures, although a Permissions and Restrictions clause that forbids user activity to “circumvent, disable, fraudulently engage, or otherwise interfere with the Service” could be read as covering this scenario.

But Hanff, who holds an advanced master of laws in privacy, cybersecurity and data management from Maastricht University, maintains that, “under EU Consumer Protection Law, you're not legally allowed to enforce any terms in the contract which infringe on the fundamental rights and freedoms of an EU resident.” The reason cookie consent forms are so intrusive is because consent for device access can’t be bundled up with other terms and conditions.

Breyer, the German MEP, echoes Hanff’s beliefs, telling WIRED that "ad blockers protect us from illegal tracking of our online life and online harms. YouTube's terms and conditions likely violate EU law. YouTube should offer surveillance-free advertising and stop its anti-adblock campaign now."

YouTube obviously wants to make money—that server bandwidth isn't going to pay for itself. In 2022, ad-free YouTube Music and Premium had 80 million subscribers, while YouTube reported ad revenue of $7.95 billion in the third quarter of 2023 alone.

Priced at $13.99 (or €12.99 in Europe), YouTube Premium's primary benefit is ad-free video and music streaming. But if you can use an ad blocker to obtain most of the benefits of a subscription, there's little incentive to pay.

YouTube also needs its content creators to make enough money to justify their efforts. If you don't watch the ads on a video, and aren’t paying for YouTube Premium, the video you’re watching doesn't make any money for its uploader. That includes if you have ads enabled but press the “skip ad” button as soon as it appears on a skippable ad.

YouTube also reserves the right to serve ads on videos by creators who are not in the YouTube Partner Program or under a monetizing agreement, without sharing any revenue from those ads with said creators.

The arguments in favor of ad blocking range from reducing bandwidth consumption to avoiding psychologically harmful ads. (YouTube, for example, runs ads for alcohol, diets, and online casinos.) But the most compelling argument in favor of ad blocking is online security. Security researchers regard online ad networks as a key threat vector when it comes to cybersecurity, and ads on YouTube have previously been cited as serving crypto-mining malware and links to scams and pornographic content.

Most ad-blocking browser extensions look for specific file paths and filenames (such as those in the ad blocking Easylist) being called from within a page, and remove them from the version of the page that is rendered in your browser.

For example, a JavaScript program called “clever\_ads.js” (the name of a script produced by the Clever Ads advertising automation service, which embeds ads in your page) would be identified by the ad blocker and removed, along with any content it would normally load. In the case of YouTube, the ad API returned JSON files, which the ad blockers would replace.

There are a few methods of detecting whether a user is blocking ads, most of which involve another JavaScript program that checks the rendered page for evidence that ad content has been removed. A frequent approach is to have your ad-loading script also insert a JavaScript variable or an HTML element that can be checked for.

Of course, ad blockers can look for and remove the anti-adblocker scripts as well, and that’s what’s happening in the case of blocking tools, such as Adblock Plus and uBlock Origin, that regularly provide extra filters to download and add to the blocker so that it can remove the latest scripts.

But as its anti-adblocker scripts are added to the filter lists, YouTube releases updated versions of those scripts. So now there’s an adblock detection arms race going on, embodied by the “Is YouTube Anti-Adblock Fixed” website, which monitors whether the uBlock Origin browser plugin is successfully circumventing YouTube’s adblock detection or not by comparing a list of YouTube anti-adblocker script IDs with the list of script IDs that are blocked by the plugin.

Fundamentally, the EU says that random websites aren't allowed to rummage around in your stuff without permission. That’s something most people agree on. Google itself forbids Android app developers from using the QUERY\_ALL\_PACKAGES permission, describing a user's installed apps as “personal and sensitive information.”

The question facing the DPC is whether YouTube’s adblock detection scripts are invasive enough to qualify: Is downloading and running a JavaScript routine equivalent to downloading and storing a cookie?

It looks like YouTube intends to argue that it isn’t, and is emphatic that it only seeks to identify whether ads have been served but not played. When WIRED asked the company if it was using or testing server-side ad blocker detection, YouTube’s Lawton said that it was currently carrying out ad blocker detection within YouTube and not on users’ devices. That doesn’t line up with our observations or those of the ad blocker developers, as a JavaScript detection routine on a website has to be run by the browser to function.

Lawton says that YouTube “will of course cooperate fully with any questions or queries from the DPC.”

The Irish Data Protection Commissioner’s office did not provide a comment for this feature, but Hanff says that the DPC has confirmed to him that it’s investigating the case.

YouTube's Ad Blocker Detection Believed to Break EU Privacy Law

When a homeless man attacked a former city official, footage of the onslaught became a rallying cry. Then came another video, and another—and the story turned inside out.

What a Bloody San Francisco Street Brawl Tells Us About the Age of Citizen Surveillance

The West Bank was Israel’s surveillance laboratory. Since the Israel-Hamas war began, Palestinian residents have been locked in for days at a time.

On Sunday, October 29, Ahmed Azza was given permission to leave his neighborhood for the first time in three days. He passed the surveillance camera trained on his front door and the group of Israeli soldiers stationed on the hill above and walked eight minutes to the checkpoint at the end of his street. He placed his belongings on a table to be searched, made mandatory eye contact with the facial recognition camera, and crossed through the rotating metal barriers into Hebron. Ten hours later, he was given a one-hour window to return home before the checkpoint closed and he was locked out—or in—for the next two days.

Azza lives in Tel Rumeida, Hebron, the most tightly controlled neighborhood in the West Bank. Since 1997, Tel Rumeida has formed part of H2, a section of Hebron controlled by the Israeli government. Around 35,000 Palestinians and 850 Israeli settlers live in this area, where Israeli soldiers impose a system of segregation that heavily restricts the movement of Palestinians. It’s enforced with a network of surveillance that includes at least 21 manned checkpoints, on-the-spot searches, and watchtowers, plus a vast array of CCTV cameras dubbed “Hebron Smart City.” According to critics, the aim of this system is to make life as difficult as possible for Palestinians, slowly forcing them to leave their homes and make way for Israeli settlers.

The West Bank has long been seen as a testing ground for Israeli surveillance technology and tactics. Its defense exports have doubled in the past decade, partially thanks to the success of companies producing surveillance systems, like Elbit, Candiru, and Rafael, as well as NSO Group, which produces the Pegasus spyware. But on October 7, on the other side of Israel, the country’s famed surveillance network apparently failed. Hamas gunmen breached the high-tech border separating Gaza from Israel and murdered 1,400 people, taking more than 200 hostages. Since then, a growing sense of paranoia has given Israel’s government the impetus to ramp up restrictions and surveillance in the West Bank, according to analysts and activists working in the region.

“We’re rats in a lab,” says Azza, over a cup of tea at his workplace in Hebron. “I want to go to the beach, I want to see the sea, I want to taste the water. Here, we don't have this freedom.”

The flagship component of the West Bank’s surveillance infrastructure is known as “Wolf Pack.” According to Amnesty International, its purpose is to create a database featuring profiles of every Palestinian in the region. One strand of this software, known as Red Wolf, uses facial recognition cameras placed at checkpoints to inform Israeli soldiers via a color-coded system whether to arrest, detain, or allow through Palestinians who approach. If the system doesn’t recognize an individual, it will automatically enroll their biometric data into Red Wolf, without their knowledge.

Another strand, known as Blue Wolf, has been described as “Facebook for Palestinians.” It requires Israeli soldiers to photograph Palestinians individually via a smartphone app in order to record them in the database. According to Breaking the Silence, an NGO made up of former Israeli soldiers that opposes Israeli military occupation of Palestinian territories, prizes were offered to different units based on how many Palestinians they could photograph within a week.

A person crossing the street in Huwara, West Bank on November 04, 2023.Photograph: Dan Kitwood/Getty Images

“There are indications that the data gathered by this software impacts whether a person can get a work permit, whether a person can move from place to place within the West Bank, whether a person can get into Israel and work there or leave the country via Ben Gurion Airport, and a whole range of other things,” says Antony Loewenstein, author of _The Palestine Laboratory_, a book investigating the links between Israel’s military and technology sector.

According to Azza, as he approaches a checkpoint and is picked up by a facial recognition camera, Israeli soldiers can see his profile from up to 100 meters away. They know who he is, who his family members are, where he lives, and his entire history of interactions with them. When he was 16, Azza was arrested for allegedly having a knife, but he denied the allegations and was later found to be innocent. He says this data is displayed every time he passes a checkpoint, meaning he is unfairly targeted and sometimes detained for up to three hours at a time. In recent years, he’s begun pre-emptively stripping to his underwear each time he enters a checkpoint, to avoid the lengthy process of being searched multiple times. “It’s a violation of our privacy,” he says.

Israeli officials claim the rollout of surveillance technology helps contribute to a "frictionless" occupation, reducing contact between Palestinians and Israeli soldiers. Instead of troops frisking every Palestinian who passes a checkpoint, this tech allows them to target only those who have a “negative” history. Instead of conducting night raids to gain intelligence, Israeli soldiers can simply use drones to spy on the specific people they are interested in.

The Israeli Defense Force declined to provide an attributable comment.

Many of Israel’s key surveillance technologies have been developed and tested in the West Bank. Israel’s military has promoted close collaboration with the private tech sector, meaning that military-trained engineers are able to learn new skills from private companies. After leaving the military, they are often headhunted by the private sector.

“That’s a key aspect of the Israeli defense sector, showing that it’s possible to maintain and manage a brutal occupation for over half a century, which can then be exported like flat-pack repression to other nations across the globe,” says Loewenstein.

Since the war began on October 7, restrictions for Palestinians living in the West Bank have risen to unseen levels. Residents told me that now they are allowed to leave the neighborhood just three days per week. In addition to the curfew imposed in Tel Rumeida, raids against Palestinian militia groups have ramped up, and the number of Israeli soldiers on the streets has increased, due to the call-up of the army reserve. It's also meant some Israeli settlers are now donning their army reserve uniforms, blurring the contours of the state. Across the wider West Bank, at least 121 Palestinians have been killed by Israeli forces or settlers, according to the United Nations Office for the Coordination of Humanitarian Affairs.

“We are not just numbers,” says a doctor from Hebron, whose name has been withheld to protect his identity. During a break from his shift at Ramallah Hospital, he explains that he now lives locally, but his parents and siblings still live in Hebron. Normally, he’d spend his weekends visiting them, but in recent weeks he has been unable to travel due to delays caused by the closure of checkpoints across the region. Since October 7, he says, he’s treated two Palestinians who have been shot by Israeli forces. Three others who were also shot arrived at the emergency reception but were soon pronounced dead. “There’s a tragedy inside every single one of us in the medical team,” he says.

The task of investigating and documenting the killings of Palestinians in the West Bank has become more challenging in recent weeks. Normally carried out by NGOs such as Al-Haq—one of the key human rights organizations in the region—these groups have been unable to work properly due to the closure of checkpoints and the fear of violence enacted by Israeli settlers.

“Since the 7th of October, our field researchers have not been able to meet directly with victims or eyewitnesses because of the situation. They cannot move freely,” says Tahseen Elayyan, a legal researcher at Al-Haq, over a cup of coffee in their modest office in Ramallah’s Old Town. “Even before, they didn’t have full freedom, but now there are more restrictions on their movement and they’re sometimes afraid to go to areas because of settler attacks. We know about the killings, but we cannot document them properly.”

In October 2021, Al-Haq and a number of other human rights groups were controversially labeled terrorist organizations by the Israeli government. Weeks later, it was revealed by the NGO Front Line Defenders that six of them had previously had their devices hacked by Pegasus software. “They used technology and surveillance to control our work,” says Elayyan.

A question eliciting both fear and hope is whether surveillance technologies are even effective. Despite employing many of these systems across Gaza, Israeli security services were caught off guard by Hamas’ surprise attack on October 7. “On the one hand, we can talk about facial recognition technologies and how bad they are and how harmful they are for democracy, but on the other hand, you say to yourself, who wants to use them? What help did it give?” says Tehilla Shwartz Altshuler, a senior fellow at the Israel Democracy Institute think tank.

Ori Givati, a former Israeli soldier and advocacy director for Breaking the Silence, says the surveillance program is now out of control. “We have to differentiate between securing Israel, which is Israel’s duty and responsibility, and expanding the occupation. There is a huge difference. Occupying more doesn’t mean more security for Israel,” Givati says, “I don’t think that in the long term, if we now use more systems of surveillance against Palestinians, this is what brings us security. We cannot accept this because it doesn’t work.’

Intensified Israeli Surveillance Has Put the West Bank on Lockdown

Plus: SolarWinds is charged with fraud, New Orleans police face recognition has flaws, and new details about Okta’s October data breach emerge.

As the Israel-Hamas war continues, with Israeli troops moving into the Gaza Strip and encircling Gaza City, one piece of technology is having an outsized impact on how we see and understand the war. Messaging app Telegram, which has a history of lax moderation, has been used by Hamas to share gruesome images and videos. The information has then spread to other social networks and millions more eyeballs. Sources tell WIRED that Telegram has been weaponized to spread horrific propaganda.

Microsoft has had a hard few months when it comes to the company’s own security, with Chinese-backed hackers stealing its cryptographic signing key, continued issues with Microsoft Exchange Servers, and its customers being impacted by failings. The company has now unveiled a plan to deal with the ever-growing range of threats. It’s the Secure Future Initiative, which plans, among multiple elements, to use AI-driven tools, improve its software development, and shorten its response time to vulnerabilities.

Also this week, we’ve looked at the privacy practices of Bluesky, Mastodon, and Meta’s Threads as all of the social media platforms jostle for space in a world where X, formerly known as Twitter, continues to implode. And things aren’t exactly great with this next generation of social media. With November arriving, we now have a detailed breakdown of the security vulnerabilities and patches issued last month. Microsoft, Google, Apple, and enterprise firms Cisco, VMWare, and Citrix all fixed major security flaws in October.

And there's more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

The Flipper Zero is a versatile hacking tool designed for security researchers. The pocket-size pen-testing device can intercept and replay all kinds of wireless signals—including NFC, infrared, RFID, Bluetooth, and Wi-Fi. That means it's possible to read microchips and inspect signals being admitted from devices. Slightly more nefariously, we've found it can easily clone building-entry cards and read credit card details through people's clothes.

Over the last few weeks, the Flipper Zero, which costs around $170, has been gaining some traction for its ability to disrupt iPhones, particularly by sending them into denial of service (DoS) loops. As Ars Technica reported this week, the Flipper Zero, with some custom firmware, is able to send “a constant stream of messages” asking iPhones to connect via Bluetooth devices such as an Apple TV or AirPods. The barrage of notifications, which is sent by a nearby Flipper Zero, can overwhelm an iPhone and make it virtually unusable.

“My phone was getting these pop-ups every few minutes, and then my phone would reboot,” security researcher Jeroen van der Ham told Ars about a DoS attack he experienced while commuting in the Netherlands. He later replicated the attack in a lab environment, while other security researchers have also demonstrated the spamming ability in recent weeks. In van der Ham’s tests, the attack only worked on devices running iOS 17—and at the moment, the only way to prevent the attack is by turning off Bluetooth.

In 2019, hackers linked to Russia’s intelligence service broke into the network of software firm SolarWinds, planting a backdoor and ultimately finding their way into thousands of systems. This week, the US Securities and Exchange Commission charged Tim Brown, the CISO of SolarWinds, and the company with fraud and “internal control failures.” The SEC alleges that Brown and the company overstated SolarWinds’ cybersecurity practices while “understating or failing to disclose known risks.” The SEC claims that SolarWinds knew of “specific deficiencies” in the company’s security practices and made public claims that weren’t reflected in its own internal assessments.

“Rather than address these vulnerabilities, SolarWinds and Brown engaged in a campaign to paint a false picture of the company’s cyber controls environment, thereby depriving investors of accurate material information,” Gurbir S. Grewal, director of the SEC’s Division of Enforcement said in a statement. In response, Sudhakar Ramakrishna, the CEO of SolarWinds, said in a blog post that the allegations are part of a “misguided and improper enforcement action.”

For years, researchers have shown that face recognition systems, trained on millions of pictures of people, can misidentify women and people of color at disproportionate rates. The systems have led to wrongful arrests. A new investigation from Politico, focusing on a year’s worth of face recognition requests made by police in New Orleans, has found that the technology was almost exclusively used to try to identify Black people. The system also “failed to identify suspects a majority of the time,” the report says. Analysis of 15 requests for the use of face recognition technology found that only one of them was for a white suspect, and in nine cases the technology failed to find a match. Three of the six matches were also incorrect. “The data has pretty much proven that \[anti-face-recognition\] advocates were mostly correct,” one city councilor said.

Identity management company Okta has revealed more details about an intrusion into its systems, which it first disclosed on October 20. The company said the attackers, who had accessed its customer support system, accessed files belonging to 134 customers. (In these instances, customers are individual companies that subscribe to Okta’s services). “Some of these files were HAR files that contained session tokens which could in turn be used for session hijacking attacks,” the company disclosed in a blog post. These session tokens were used to “hijack” the Okta sessions of five separate companies. 1Password, BeyondTrust, and Cloudflare have all previously disclosed they detected suspicious activity, but it is not clear who the two remaining companies are.

This Cheap Hacking Device Can Crash Your iPhone With Pop-Ups

Following a string of serious security incidents, Microsoft says it has a plan to deal with escalating threats from cybercriminals and state-backed hackers.

Today, in a blog post and email to employees, Microsoft is announcing a broad vision for tackling the cybersecurity challenges that have increasingly plagued the company and its customers in recent years. Known as the Secure Future Initiative, the plan leans heavily on artificial intelligence tools as a “game changer” and also includes a call for international cyberspace norms, an expansion of the company's 2017 Digital Geneva Convention.

The most tangible and immediately applicable component of the strategy, though, relates to improvements in Microsoft's software development and engineering approach. In Thursday's email, executive vice president for Microsoft security Charlie Bell and colleagues Scott Guthrie and Rajesh Jha lay out a plan to further safeguard identity management systems in Microsoft products, improve security software development, and shorten response and patch release times for addressing vulnerabilities, specifically those in the cloud.

The announcement comes as Microsoft has faced scrutiny over situations where vulnerabilities in its products have enabled attackers—both financially-motivated cybercriminals and state-backed hackers—to rampage through the company's own systems and those of customers. And the climate around accountability is evolving as regulators and law enforcement look for new paths to deterring, but also preventing, damaging hacks. On Monday, for example, the United States Securities and Exchange Commission (SEC) announced charges against the IT management company SolarWinds and its chief information security officer over “cybersecurity risks and vulnerabilities” that the SEC alleges were known and should have been addressed.

Microsoft said on Thursday that its Secure Future Initiative comes in response to wildly escalating threats from attackers. “In recent months, we’ve concluded within Microsoft that the increasing speed, scale, and sophistication of cyberattacks call for a new response," company vice chair and president Brad Smith wrote.

In an interview with WIRED, Microsoft's Bell emphasized that both cybercriminal and state-backed actors are professionalizing and homing in on phishing and creative approaches to credential theft as the most direct and effective method for infiltrating organizations of all sorts. He noted that while it is difficult to get an accurate accounting of total global economic losses due to cybercrime and cyberattacks, Microsoft believes that total losses have been greater than $6 trillion and could close in on $10 trillion by 2025.

“The threat is growing,” he tells WIRED. “It's a huge drag on the world. So when you look at all of this going on and you say well what can we do? Microsoft is in the center of much of the ability to defend. It caused us to step back.”

Speeding vulnerability response times by 50 percent and moving toward mandating secure default settings for customers are two aggressive steps Microsoft says it plans to take to make a tangible impact on customer security. Bell says that multi-factor authentication adoption among Microsoft customers is at roughly 34 percent, but “it should be 100 percent.”

The changes come as other giants across the industry, including Google, are acknowledging the need to push secure defaults, particularly around authentication. The software development platform GitHub, which Microsoft owns, has been working on rolling out mandatory two-factor for months. Apple has long mandated two-factor for most accounts, and Google has been publicly working toward the goal for years.

On many components of the Secure Future Initiative, Microsoft is not exactly late to the party on hardline changes, but is noticeably behind the early advocates. And in general, concepts of engineering software to be secure by design or building system architecture to be zero trust were prominent features of the past decade. Yet, between cloud services and all of the legacy Windows systems around the world, Microsoft is at the very heart of IT infrastructure, and in many ways, global cybersecurity moves at Microsoft’s pace.

“It’s an absolutely terrible world if we don’t get ahead of it,” Bell says. “We have all the data right now that the threat actors—they’re poking from the outside, they see a little bit. We know everything because we’re on the inside. If we’re gonna tackle the security problem we’ve got to be real about the fact that you’re not going to flip a light switch and everybody’s running in the cloud. There’s a lot of operational ground to cover between here and there. And Microsoft is the company that supports that world, that critical infrastructure that’s out there.”

Microsoft Does Damage Control With Its New 'Secure Future Initiative'

CulturePulse's AI model promises to create a realistic virtual simulation of every Israeli and Palestinian citizen. But don't roll your eyes: It's already been put to the test in other conflict zones.

Training artificial intelligence models does not typically involve coming face-to-face with an armed soldier who is pointing a gun at you and shouting at your driver to get out of the car. But the system that F. LeRon Shults and Justin Lane, cofounders of CulturePulse, are developing for the United Nations is not a typical AI model.

“I got pulled over by the \[Israeli\] military, by a guy holding \[a military rifle\] because we had a Palestinian taxi driver who drove past a line he wasn't supposed to,” Shults tells WIRED. “So that was an adventure.”

Shults and Lane were in the West Bank in September, just weeks before Hamas attacked Israel on October 7, sparking what has become one of the worst periods of violence in the region in at least 50 years.

Shults and Lane—both Americans who are now based in Europe—were on the ground as part of a contract they signed with the UN in August to develop a first-of-its-kind AI model that they hope will help analyze solutions to the Israel-Palestinian conflict.

Shults and Lane are aware that claiming that AI could “solve the crisis” between Israelis and Palestinians is likely to result in a lot of eye-rolling if not outright hostility, especially given the horrific scenes coming out of Gaza daily. So they are quick to dispel that this is what they are trying to do.

“Quite frankly, if I were to phrase it that way, I'd roll my eyes too,” Shults says. “The key is that the model is not designed to resolve the situation; it's to understand, analyze, and get insights into implementing policies and communication strategies.”

The conflict in the region is centuries old and deeply complex, and it's made even more complicated by the current crisis. Countless efforts at finding a political solution have failed, and any eventual end to the crisis will need support not just from the two sides involved, but likely the wider international community. All of this makes it impossible for an AI system to simply spit out a fully formed solution. Instead, CulturePulse aims to pinpoint the underlying causes of the conflict.

“We know that you can't solve a problem this complex with a single AI system. That's not ever going to be feasible in my opinion,” Lane tells WIRED. “What is feasible is using an intelligent AI system—using a digital twin of a conflict—to explore the potential solutions that are there.”

The digital twin Lane is speaking of is CulturePulse’s multi-agent AI model that they are currently building for the UN. The model will ultimately create a virtual version of each and every one of the 15 million people who live in Israel and the Palestinian territories, each imbued with demographics, religious beliefs, and moral values that echo their real-world counterparts, according to Shults and Lane.

In total, CulturePulse’s model can factor in over 80 categories to each “agent,” including traits like anger, anxiety, personality, morality, family, friends, finances, inclusivity, racism, and hate speech.

“These models are entire artificial societies, with thousands or millions of simulated adaptive artificially intelligent agents that are networked with each other, and they're designed in a way that is more psychologically realistic and more sociologically realistic,” Shults says. “Basically you have a laboratory, an artificial laboratory, that you can play with on your PC in ways that you could never do ethically, certainly, in the real world.”

The system will allow the UN to see how the virtual society would react to changes in economic prosperity, heightened security, changing political influences, and a range of other parameters. Shults and Lane claim their model predicts outcomes with clinical accuracy of over 95 percent correlation to real-world outcomes.

“It goes beyond just learning randomly and finding patterns like machine learning, and it goes beyond statistics, which gives you correlations,” Shults says. “It actually gets to a causality, because of the multi-agent AI system which grows the conflict, or the polarization, or the peaceful immigration policy from the ground up. So it shows you what you want to create before you try it out in the real world.”

Discussions around AI and the Israel-Hamas war have so far been focused on the threat posed by generative AI to push disinformation. While those threats have yet to materialize, news cycles have been clouded by disinformation and misinformation being shared by all sides. Rather than trying to eliminate this disruptive element, CulturePulse’s model will factor it into its analysis.

“We actually deliberately want to make sure that those materials that are biased are being put into these models. They just need to be put into the model in a psychologically real way,” Lane says.

The horrific massacres and humanitarian crises happening in Israel and Gaza over the past month have brought home the pressing need for a solution to the deeply rooted conflict. But before the latest outbreak in violence in the region, the UN Development Program (UNDP) was already exploring new options in trying to find a resolution, signing an initial five-month contact with CulturePulse in August.

The application of artificial intelligence technologies to conflict situations has been around since at least 1996, with machine learning being used to predict where conflicts may occur. The use of AI in this area has expanded in the intervening years, being used to improve logistics, training, and other aspects of peacekeeping missions. Lane and Shults believe they could use artificial intelligence to dig deeper and find the root causes of conflicts.

Their idea for an AI program that models the belief systems that drive human behavior first began when Lane moved to Northern Ireland a decade ago to study whether computation modeling and cognition could be used to understand issues around religious violence.

In Belfast, Lane figured out that by modeling aspects of identity and social cohesion, and identifying the factors that make people motivated to fight and die for a particular cause, he could accurately predict what was going to happen next.

“We set out to try and come up with something that could help us better understand what it is about human nature that sometimes results in conflict, and then how can we use that tool to try and get a better handle or understanding on these deeper, more psychological issues at really large scales,” Lane says.

The result of their work was a study published in 2018 in _The Journal for Artificial Societies and Social Simulation,_ which found that people are typically peaceful but will engage in violence when an outside group threatens the core principles of their religious identity.

A year later, Lane wrote that the model he had developed predicted that measures introduced by Brexit—the UK’s departure from the European Union that included the introduction of a hard border in the Irish Sea between Northern Ireland and the rest of the UK—would result in a rise in paramilitary activity. Months later, the model was proved right.

The multi-agent model developed by Lane and Shults relied on distilling more than 50 million articles from GDelt, a project that ​​monitors “the world's broadcast, print, and web news from nearly every corner of every country in over 100 languages.” But feeding the AI millions of articles and documents was not enough, the researchers realized. In order to fully understand what was driving the people of Northern Ireland to engage in violence against their neighbors, they would need to conduct their own research.

Lane spent months finding and speaking to those directly involved in the violence, such as members of the Ulster Volunteer Force (UVF), a paramilitary group loyal to the British crown, and the Irish Republican Army (IRA), a paramilitary group seeking the end of British rule on the island of Ireland. The information that Lane gathered in these interviews was fed into his model in order to give a more complete understanding of the psychology behind the violence that had riven the country for three decades.

While Lane is now based in Slovakia, he maintains the links he built up while in Northern Ireland, returning at least once a year to speak to the people again, and update his model with the latest information. If during these conversations Lane hears about a particular issue or a reason why someone took a particular action that’s not present in the AI model, the team will see if there is lab data to back it up before putting it into his model.

“And if the data doesn’t exist, we'll go out and we'll do our own experimentation with universities to see if there is evidence, and then we will build that into our project,” Lane says.

In recent years, Lane and Shults have worked with a number of groups and governments to apply their model to better understand situations across the globe, including the conflicts in South Sudan and the Balkans. The model has also been used in the Syrian Refugee Crisis, where Lane and Shults traveled to the Greek island of Lesbos to gather firsthand information to help their system integrate refugees with host families. CulturePulse has also worked with the Norwegian government to tackle the spread of Covid-19 misinformation by better understanding the reasons why someone is sharing inaccurate information.

Key to the success of all of these efforts is the collection of firsthand information about what’s happening on the ground. And so, when they signed the contract with the UNDP in August, the first thing Shults and Lane wanted to arrange was a visit to Israel and the West Bank, where they spent “about a week” gathering data. “We met with the UN and different NGOs going out to the villages, seeing firsthand what it looks like with the settler dynamics that are there,” Shults says. The pair attempted to go to Gaza but were refused entry.

The trip to Israel also included time speaking to their employers to find out exactly what it is they are hoping to get from this project.

“We spent a whole week extracting from the UN officials we met information that's relevant, that we need to know for the model, getting a sense of their understanding of the dynamics, the data that they might have that could inform the model's calibration and final validation,” Shults says.

Shults would not discuss the detailed parameters the UN had specified be built into the model, but his team gives the UN team regular updates over Zoom on the construction of the model and “the simulation experiments that are being run to test out the conditions and mechanisms that might lead to outcomes that they desire,” he says.

The UNDP has not yet responded to WIRED’s request for comment.

CulturePulse’s contract with the UNDP runs out in January, but they are hopeful of signing a phase-two contract that would see them build out a fully functional model. CulturePulse this month also signed a nine-month contract with UNDP to work on a system that would help resolve cultural and religious issues still causing conflict in Bosnia and Herzegovina since the end of the Bosnian War in 1995.

The reason the UN is turning to AI in the Israeli-Palestinian conflict, according to Lane, is that it simply has nowhere else to turn. “The way that the UN phrased it to us is that there's no more low-hanging fruit in that situation,” Lane says. “They needed to try something that was new and innovative, something that was really thinking outside of the box yet still really addressing the root issues of the problem.”

The UN Hired an AI Company to Untangle the Israeli-Palestinian Crisis

The slow-motion implosion of Elon Musk’s X has given rise to a slew of competitors, where privacy invasions that ran rampant over the past decade still largely persist.

When Elon Musk took over Twitter in October 2022, experts warned that his proposed changes—including less content moderation and a subscription-based verification system—would lead to an exodus of users and advertisers. A year later, those predictions have largely borne out. Advertising revenue on the platform has declined 55 percent since Musk’s takeover, and the number of daily active users fell from 140 million to 121 million in the same time period, according to third-party analyses.

As users moved to other online spaces, the past year could have marked a moment for other social platforms to change the way they collect and protect user data. “Unfortunately, it just feels like no matter what their interest or cultural tone is from the outset of founding their company, it's just not enough to move an entire field further from a maximalist, voracious approach to our data,” says Jenna Ruddock, policy council at Free Press, a nonprofit media watchdog organization, and a lead author on a new report examining Bluesky, Mastodon, and Meta’s Threads, all of which have jockeyed to fill the void left by Twitter, which is now named X.

Companies like Google, X, and Meta collect vast amounts of user data, in part to better understand and improve their platforms but largely to be able to sell targeted advertising. But collection of sensitive information around users’ race, ethnicity, sexuality, or other identifiers can put people at risk. For instance, earlier this year, Meta and the US Department of Justice reached a settlement after it was found that the company’s algorithm allowed advertisers to exclude certain racial groups from seeing ads for things like housing, jobs, and financial services. In 2018, the company was slapped with a $5 billion fine—one of the largest in history—after a Federal Trade Commission probe found multiple instances of the company failing to protect user data, triggered by an investigation into data shared with British consulting firm Cambridge Analytica. (Meta has since made changes to some of these ad targeting options.)

“There’s a very strong corollary between the data that's collected about us and then the automated tools that platforms and other services use, which often produce discriminatory results,” says Nora Benavidez, director of digital justice and civil rights at Free Press. “And when that happens, there's really no recourse other than litigation.”

Even for users who want to opt out of ravenous data collection, privacy policies remain complicated and vague, and many users don’t have the time or knowledge of legalese to parse through them. At best, says Benavidez, users can figure out what data won’t be collected, “but either way, the onus is really on the users to sift through policies, trying to make sense of what's really happening with their data,” she says. “I worry these corporate practices and policies are nefarious enough and befuddling enough that people really don't understand the stakes.”

Mastodon, according to the report, offers users the most protection, because it doesn’t collect sensitive personal information or geo-location data and doesn’t track user activity off the platform, at least not on the platform’s default server. Other servers—or “instances,” in Mastodon parlance—can set their own privacy and moderation policies. Bluesky, founded by Twitter cofounder and former CEO Jack Dorsey, also doesn’t collect sensitive data but does track user behavior across other platforms. But there are no laws that require platforms like Bluesky and Mastodon to keep their privacy policies this way. “Folks can sign on with particular privacy expectations that they might feel satisfied by a privacy policy or disclosures,” says Ruddock. “And that can still change over time. And I think that's what we're going to see with some of these emerging platforms.”

Mastodon spokesperson Renaud Chaput told WIRED that the platform does not have any plans to change its privacy policies and noted that user data is only available on the server where a user’s account is hosted. Bluesky and Meta did not immediately respond to requests for comment. Meta spokesperson Emil Vazquez directed WIRED to a thread from the company’s deputy chief privacy officer, Rob Sherman, in which he said, “Meta’s privacy policy, and the Threads supplementary privacy policy, are the best resources to understand how Threads uses and collects data.”

Nazanin Andalibi, assistant professor of information at the University of Michigan, says that while privacy can be a competitive advantage for a newer platform, “people might still use a platform that they believe will not respect their privacy,” even if they have concerns. Mastodon has fewer than 3 million users, and Bluesky, which remains in beta, has just over 1 million. And greater privacy may not be enough to shift users’ behaviors away from bigger platforms like X and Meta’s Threads.

Unlike Bluesky and Mastodon, Threads largely abides by the same wide-reaching data collection policies as its parent company, which also owns Facebook and Instagram. Launched in July off the back of Instagram, the platform saw an initial spike in growth, followed by a plateau. But in its quarterly earnings call last week, Meta CEO Mark Zuckerberg said that Threads now has over 100 million monthly active users. “I’ve thought for a long time there should be a billion-person public conversations app that is a bit more positive,” Zuckerberg said. “I think that if we keep at this for a few more years, then I think we have a good chance of achieving our vision there.”

“Threads looks like they're collecting much more information than they actually need in order for the service to function. And some of the information they're collecting is pretty sensitive,” says Calli Schroeder, global privacy counsel at the Electronic Privacy Information Center, a nonprofit focused on privacy and free speech online. “I think this is just inextricably tied to the fact that behind Threads, Meta already holds just an absolutely obscene amount of information on individuals.”

Twitter, prior to Musk’s takeover, has had its own spotty history of protecting user data. In 2009, hackers compromised the platform twice, accessing users’ private information and, in some cases, taking over accounts. In 2011, the FTC issued a consent decree—a threat of legal action—against Twitter for failing to protect user data in relation to the 2009 hacks. As part of the settlement, “Twitter will be barred for 20 years from misleading consumers about the extent to which it protects the security, privacy, and confidentiality of nonpublic consumer information,” according to the FTC, with each violation carrying a $16,000 penalty.

So far, attempts to curtail the collection of users’ data has been piecemeal, largely driven by state-level laws and individual enforcement actions. The American Data Privacy and Protection Act, proposed in 2022, remains in congressional limbo.

“Regulation continues to be extraordinarily behind,” says Ruddock. “The companies are not going to change on their own.”

The New Era of Social Media Looks as Bad for Privacy as the Last One

Hamas posted gruesome images and videos that were designed to go viral. Sources argue that Telegram’s lax moderation ensured they were seen around the world.

Source

Wired