Stefan Thomas lost the password to an encrypted USB drive holding 7,002 bitcoins. One team of hackers believes they can unlock it—if they can get Thomas to let them.

At 9:30 am on a Wednesday in late September, a hacker who asked to be called Tom Smith sent me a nonsensical text message: “query voltage recurrence.”

Those three words were proof of a remarkable feat—and potentially an extremely valuable one. A few days earlier, I had randomly generated those terms, set them as the passphrase on a certain model of encrypted USB thumb drive known as an IronKey S200, and shipped the drive across the country to Smith and his teammates in the Seattle lab of a startup called Unciphered.

Unciphered’s staff in the company’s Seattle lab.

Photograph: Meron Menghistab

Smith had told me that guessing my passphrase might take several days. Guessing it at all, in fact, should have been impossible: IronKeys are designed to permanently erase their contents if someone tries just 10 incorrect password guesses. But Unciphered's hackers had developed a secret IronKey password-cracking technique—one that they've still declined to fully describe to me or anyone else outside their company—that gave them essentially infinite tries. My USB stick had reached Unciphered’s lab on Tuesday, and I was somewhat surprised to see my three-word passphrase texted back to me the very next morning. With the help of a high-performance computer, Smith told me, the process had taken only 200 trillion tries.

Smith’s demonstration was not merely a hacker party trick. He and Unciphered’s team have spent close to eight months developing a capability to crack this specific, decade-old model of IronKey for a very particular reason: They believe that in a vault in a Swiss bank 5,000 miles to the east of their Seattle lab, an IronKey that's just as vulnerable to this cracking technique holds the keys to 7,002 bitcoins, worth close to $235 million at current exchange rates.

For years, Unciphered's hackers and many others in the crypto community have followed the story of a Swiss crypto entrepreneur living in San Francisco named Stefan Thomas, who owns this 2011-era IronKey, and who has lost the password to unlock it and access the nine-figure fortune it contains. Thomas has said in interviews that he's already tried eight incorrect guesses, leaving only two more tries before the IronKey erases the keys stored on it and he loses access to his bitcoins forever.

Screens in Unciphered’s lab show a microscopic image of the layout of the IronKey’s controller chip (left) and a CT scan of the drive.

Photograph: Meron Menghistab

Now, after months of work, Unciphered's hackers believe they can open Thomas' locked treasure chest, and they're ready to use their secret cracking technique to do it. “We were hesitant to reach out to him until we had a full, provable, reliable attack,” says Smith, who asked WIRED not to reveal his real name due to the sensitivities of working with secret hacking techniques and very large sums of cryptocurrency. “Now we’re in that place.”

The only problem: Thomas doesn't seem to want their help.

Earlier this month, not long after performing their USB-decrypting demonstration for me, Unciphered reached out to Thomas through a mutual associate who could vouch for the company’s new IronKey-unlocking abilities and offer assistance. The call didn't even get as far as discussing Unciphered's commission or fee before Thomas politely declined.

Thomas had already made a “handshake deal” with two other cracking teams a year earlier, he explained. In an effort to prevent the two teams from competing, he had offered each a portion of the proceeds if either one could unlock the drive. And he remains committed, even a year later, to giving those teams more time to work on the problem before he brings in anyone else—even though neither of the teams has shown any sign of pulling off the decryption trick that Unciphered has already accomplished.

That has left Unciphered in a strange situation: It holds what is potentially one of the most valuable lockpicking tools in the cryptocurrency world, but with no lock to pick. “We cracked the IronKey,” says Nick Federoff, Unciphered's director of operations. “Now we have to crack Stefan. This is turning out to be the hardest part.”

In an email to WIRED, Thomas confirmed that he had turned down Unciphered's offer to unlock his encrypted fortune. “I have already been working with a different set of experts on the recovery so I'm no longer free to negotiate with someone new,” Thomas wrote. “It's possible that the current team could decide to subcontract Unciphered if they feel that's the best option. We'll have to wait and see.” Thomas declined to be interviewed or to comment further.

A Very Valuable, Worthless USB Stick

In past interviews, Thomas has said that his 7,002 bitcoins were left over from a payment he received for making a video titled “What is Bitcoin?” that published on YouTube in early 2011, when a bitcoin was worth less than a dollar. Later that year, he told WIRED that he'd inadvertently erased two backup copies of the wallet that held those thousands of coins, and then lost the piece of paper with the password to decrypt the third copy, stored on the IronKey. By then, his lost coins were worth close to $140,000. “I spent a week trying to recover it,” he said at the time. “It was pretty painful.”

In the 12 years since, the value of the inaccessible coins on Thomas' IronKey has at times swelled to be worth nearly half a billion dollars, before settling to its current, still-staggering price. In January 2021, as Bitcoin began to approach its peak exchange rate, Thomas described to _The New York Times_ the angst that his long-lost hoard had caused him over the years. “I would just lay in bed and think about it,” he said. “Then I would go to the computer with some new strategy, and it wouldn’t work, and I would be desperate again.”

Around that same time in 2021, a team of cryptographers and white-hat hackers founded Unciphered with the goal of unlocking exactly the sort of vast, frozen funds that many unlucky crypto holders like Thomas have long since given up on. At the time of Unciphered’s official launch, the cryptocurrency tracing firm Chainalysis estimated the total sum of those forgotten wallets across blockchains to be worth $140 billion. Unciphered says it has since successfully helped clients open locked wallets worth “many millions” of dollars—often through novel cryptographic vulnerabilities or software flaws it has discovered in cryptocurrency wallets—though nothing close to the size of Thomas' IronKey stash.

A deconstructed IronKey inside of Unciphered’s laser cutting tool.

Photograph: Meron Menghistab

Only around the beginning of 2023 did Unciphered begin to hunt for potential avenues to unlock Thomas' IronKey prize. Smith says that they quickly started to see hints that the IronKey's manufacturer, which was sold to storage hardware firm iMation in 2011, had left them some potential openings. “We were seeing little bits and pieces,” Smith says. “Like, this looks a little sloppy, or this looks not quite like how someone should be doing things.” (Kingston Storage, which now owns IronKey, didn’t respond to WIRED’s request for comment.)

Even a decade-old IronKey is a daunting target for hackers. The USB stick, whose development was funded in part by the United States Department of Homeland Security, is FIPS-140-2 Level 3 certified, meaning it's tamper-resistant and its encryption is secure enough for use by military and intelligence agencies for classified information. But emboldened by the few hints of security flaws they'd found—and still with no participation from Thomas—Unciphered's founders decided to take on the project of cracking it. “If there is an Everest to attempt, this is it,” Federoff remembers telling the team. The company's founders would eventually pull together a group of around 10 staffers and outside consultants, several of whom had backgrounds at the National Security Agency or other three-letter government agencies. They called it Project Everest.

A $235 Million Treasure Hunt

One of their first moves was to determine the exact model of IronKey that Thomas must have used, based on timing and a process of elimination. Then they bought the entire supply of that decade-plus-old model that they could find available for sale online, eventually amassing hundreds of them in their lab.

To fully reverse engineer the device, Unciphered scanned an IronKey with a CT scanner, then began the elaborate surgery necessary to deconstruct it. Using a precise laser cutting tool, they carved out the Atmel chip that serves as the USB stick's “secure enclave” holding its cryptographic secrets. They bathed that chip in nitric acid to “decap” it, removing the layers of epoxy designed to prevent tampering. They then began to polish down the chip, layer by layer, with an abrasive silica solution and a tiny spinning felt pad, removing a fraction of a micron of material from its surface at a time, taking photos of each layer with either optical microscopes or scanning electron microscopes, and repeating the process until they could build a full 3D model of the processor.

Because the chip's read-only memory, or ROM, is built into the layout of its physical wiring for better efficiency, Unciphered's visual model gave it a head start toward deciphering much of the logic of the IronKey's cryptographic algorithm. But the team went much further, attaching tenth-of-a-millimeter gauge wires to the secure element’s connections to “wiretap” the communications going into and out of it. They even tracked down engineers who had worked on the Atmel chip and another microcontroller in the IronKey that dated back to the 1990s to quiz them for details about the hardware. “It felt very much like a treasure hunt," says Federoff. “You’re following a map that’s faded and coffee-stained, and you know there’s a pot of gold at the end of a rainbow, but you have no idea where that rainbow’s leading.”

That cracking process culminated in July, when Unciphered's team gathered at an Airbnb in San Francisco. They describe standing around a table covered with millions of dollars’ worth of lab equipment when a member of the team read out the contents of a decrypted IronKey for the first time. “What just happened?” Federoff asked the room. “We just summited Everest,” said Unciphered's CEO, Eric Michaud.

Unciphered still won't reveal its full research process, or any details of the technique it ultimately found for cracking the IronKey and defeating its “counter” that limits password guesses. The company argues that the vulnerabilities they discovered are still potentially too dangerous to be made public, given that the model of IronKeys it cracked are too old to be patched with a software update, and some may still store classified information. “If this were to leak somehow, there would be much bigger national security implications than a cryptocurrency wallet,” Federoff says.

The team notes that the final method they developed doesn't require any of the invasive or destructive tactics that they used in their initial research. They've now unlocked 2011-era IronKeys—without destroying them—more than a thousand times, they say, and unlocked three IronKeys in demonstrations for WIRED.

Cryptic Contracts

None of that, however, has gotten them any closer to persuading Stefan Thomas to let them crack _his_ IronKey. Unciphered’s hackers say they learned from the intermediary who contacted Thomas on their behalf that Thomas has already been in touch with two other potential players in the crypto- and hardware-hacking world to help unlock his USB stick: the cybersecurity forensics and investigations firm Naxo, and the independent security researcher Chris Tarnovsky.

Naxo declined WIRED’s request to comment. But Chris Tarnovsky, a renowned chip reverse engineer, confirmed to WIRED that he had a “meet-and-greet” call with Thomas in May of last year. Tarnovsky says that, in the meeting, Thomas had told him that if he could successfully unlock the IronKey, he would be "generous," but didn't specify a fee or commission. Since then, Tarnovsky says that he has done very little work on the project, and that he has essentially been waiting for Thomas to start paying him on a monthly basis for initial research. "I want Stefan to cough up some money up front," says Tarnovsky. “It's a lot of work, and I need to worry about my mortgage and my bills.”

But Tarnovsky says he hasn't heard from Thomas since that first call. “Nothing came out of it,” he says. “It's weird.”

Unciphered’s director of operations Nick Federoff.

Photograph: Meron Menghistab

Unciphered's team remains skeptical about Naxo’s progress and whether it’s any further along than Tarnovsky. There are only a small number of hardware hackers capable of the reverse engineering necessary to crack the IronKey, they argue, and none appear to be working with Naxo. As for Thomas' suggestion that they could subcontract to Naxo or another team working on the project, Unciphered's Federoff says he won't rule it out, but argues it doesn't make sense when Unciphered alone can crack the IronKey. “Based on what we know, we don't see any benefit to anyone in going that route,” Federoff says.

Thomas, meanwhile, seems to display an unusual lack of urgency in unlocking his $235 million, and has offered only vague hints about why he has yet to reveal any progress toward that goal. “When you're dealing with so much money, everything takes forever,” he told the _Thinking Crypto_ podcast in an interview over the summer. “The person you're working with, you need some contract with them, and that contract needs to be rock solid, because if there's some issue with the contract, there's suddenly hundreds of millions of dollars at stake.”

To potentially accelerate that cryptic contract process, Unciphered plans to publish an open letter to Thomas and a video in the coming days designed to persuade—or pressure—Thomas into working with them. But Federoff concedes that it's possible Thomas doesn't actually care about the money: In its piece about his locked coins in 2021, _The New York Times_ wrote that Thomas already had “more riches than he knows what to do with,” thanks to other crypto ventures.

Federoff notes that it's impossible to know for certain what Thomas' IronKey holds. Maybe the keys to the 7,002 bitcoins are held elsewhere, or gone altogether.

He says Unciphered is still hopeful. But the team is also ready to move on if Thomas won't work with them. There are, after all, other locked wallets out there for the company to crack. And the decision of whether and how to unlock this particular USB drive's riches will ultimately fall to its owner alone. “It's incredibly frustrating,” says Federoff. “But when you're dealing with people, that's always the most complex part. Code doesn't change unless you tell it to. Circuitry doesn't either. But humans are incredibly unpredictable creatures.”

They Cracked the Code to a Locked USB Drive Worth $235 Million in Bitcoin. Then It Got Weird

Hamas has threatened to broadcast videos of hostage executions. With the war between Israel and Hamas poised to enter a new phase, are social platforms ready?

For the past decade, social media platforms have struggled to stop the spread of extremist violence livestreamed on their platforms. Now they face a much different problem: This time, they know what’s coming.

In the days after Hamas attacked Israel on October 7, the group’s military wing said it would kill an Israeli hostage every time Israel launched an attack on Gaza. Abu Obeida, a spokesperson for the al-Qassam Brigades, added that these executions would be broadcast “in audio and video.” As of today, Hamas is holding 220 people hostage, according to the Israel Defense Forces.

Amid the October 7 attack, one person livestreamed footage showing Hamas fighters murdering Israeli citizens—a clip of which was later shared by Donald Trump Jr. on X. And in the days after the attack, Hamas hijacked the accounts of those hostages on platforms like Facebook and Instagram to livestream attacks and issue death threats.

In response, tech companies appeared to take things seriously.

Meta launched a “special operations center” to track content on Facebook, Instagram, and Threads. TikTok activated its “command center.” X (formerly Twitter) mobilized its “cross-company leadership group.” YouTube activated its “intelligence desk.” And Reddit tells WIRED its “safety team” is on alert.

But when WIRED asked for specific details about how they are going to prevent bad actors from weaponizing the platforms’ livestreaming capabilities, none of the companies offered any specific details, instead pointing to their general online guidance about livestreaming policies, if they responded at all. For example, Meta directed WIRED to a 2019 blog post from chief information security officer Guy Rosen about how the company was planning to curb the use of its livestream products in the wake of the Christchurch massacre, during which a gunman killed 51 people at a mosque in New Zealand in March of that year.

Despite the press releases indicating all-hands-on-deck attention to the livestreaming problem, industry experts say social media companies are showing a lack of transparency and an unwillingness to take the measures needed to prevent execution videos from spreading on their platforms, such as suspending livestreaming capabilities completely during the Israel-Hamas war.

“Hamas’ threats to execute these people on livestreams is happening because it’s possible for them to broadcast it,” Imran Ahmed, the founder and CEO of Center for Countering Digital Hate, a nonprofit that tracks hate speech on social platforms, tells WIRED. “They’re doing this for the spectacle because it terrorizes us. If we took away their ability to generate that spectacle, would they be doing this? What comes first, the livestream or the execution?”

Ahmed alleges that the companies are failing to implement systems that automatically detect violent extremist content as effectively as they detect some other kinds of content. “If you have a snatch of copyrighted music in your video, their systems will detect it within a microsecond and take it down,” Ahmed says, adding that “the fundamental human rights of the victims of terrorist attacks” should carry as much urgency as the “property rights of music artists and entertainers.”

The lack of details about how social platforms plan to curb the use of livestreams is, in part, because they are concerned about giving away too much information, which may allow Hamas, Palestinian Islamic Jihad (PIJ), and other militant groups or their supporters to circumvent the measures that are in place, an employee of a major platform who was granted anonymity because they are not authorized to speak publicly claimed in a communication with WIRED.

Adam Hadley, founder and executive director of Tech Against Terrorism, a United Nations-affiliated nonprofit that tracks extremist activity online, tells WIRED that while maintaining secrecy around content moderation methods is important during a sensitive and volatile conflict, tech companies should be more transparent about how they work.

“There has to be some degree of caution in terms of sharing the details of how this material is discovered and analyzed,” Hadley says. “But I would hope there are ways of communicating this ethically that don’t tip off terrorists to detection methods, and we would always encourage platforms to be transparent about what they’re doing.”

The social media companies say their dedicated teams are working around the clock right now as they await the launch of Israel’s expected ground assault in Gaza, which Hadley believes could trigger a spate of hostage executions.

And yet, for all of the time, money, and resources these multibillion-dollar companies appear to be putting into tackling this potential crisis, they are still reliant on Tech Against Terrorism, a tiny nonprofit, to alert them when new content from Hamas or PIJ, another paramilitary group based in Gaza, is posted online.

Hadley says his team of 20 typically knows about new terrorist content before any of the big platforms. So far, while tracking verified content from Hamas’ military wing or the PIJ, Hadey says the volume of content on the major social platforms is “very low.”

“Examples that we can find on large platforms of that official content are in the thousands, so not a lot of examples, compared with significantly more on Telegram,” Hadley says. “We are sharing alerts to 60 platforms who have been implicated with \[Hamas\] and PIJ content to date, but very low volumes are present.”

Hamas is banned on Facebook, Instagram, YouTube, and TikTok, so it has typically not used these mainstream platforms to any great extent, though X said earlier this month that it had removed hundreds of Hamas-affiliated accounts. Instead, Hamas prefers to use Telegram.

“Because the use of Telegram is so widespread and simple, we will assume they will continue to do this because terrorists prioritize platforms they can use most easily,” Hadley says, “and why would they bother with anything other than Telegram?”

Meta, X, and YouTube collaborate to share information about what they are seeing on the platforms. Telegram does not take part in such partnerships. While it has blocked some channels in certain jurisdictions, Telegram has typically taken a hands-off approach to content moderation, meaning Hamas and related groups have been mostly free to post whatever content they like on its platform.

Telegram did not respond to WIRED’s questions about how it would deal with execution videos on its platform, nor did X or Twitch. Discord declined to provide an on-the-record comment.

While Hadley sees Telegram as the primary concern, mainstream platforms are still at risk of facilitating the spread of this content. Videos can easily be downloaded from Telegram and reposted on any other platform, which is where the mainstream social media networks face the challenge of stopping them.

When asked to provide more details about their efforts, Meta and TikTok directed WIRED to their policy pages outlining the work they are doing to prevent the spread of these videos. YouTube spokesperson Jack Malon tells WIRED that “our teams are working around the clock to monitor for harmful footage across languages and locales.” A Reddit spokesperson says the company has “dedicated teams with linguistic and subject-matter expertise actively monitoring the conflict and continuing to enforce Reddit’s Content Policy across the site.”

One of the key ways that tech companies try to keep violent extremist content from going viral on their platforms is by using what are known as hashing databases. When content from a terrorist organization is identified, it is “hashed” to create a unique identifier that can then be shared among all companies to automatically prevent that video or image from being reshared elsewhere.

The sharing of these hashes and communication around incidents like the Israel-Hamas war are coordinated by the Global Internet Forum to Counter Terrorism (GIFCT), a small team of experts whose mission is to stop tech platforms from being exploited by violent extremists. The group was founded in 2017 by Facebook, Microsoft, X (then Twitter), and YouTube as a way of centralizing and coordinating the sharing of information. Companies like Dropbox, Amazon, Pinterest, and Zoom also provide funding to the group.

GIFCT did not provide a spokesperson to answer WIRED’s questions, but a statement on the group’s website says it is “providing regular situational awareness across member companies and support in addressing content relating to this conflict that violates their platform policies.”

Even when mainstream platforms have access to a shared database of verified terrorist content and centralized communications with experts who are tracking this content closely, they still have a lot of work to do in order to prevent violent videos from spreading on their platforms.

“This will be a big litmus test for the mainstream platforms,” Hadley says. “We would expect their algorithmic systems to be able to detect the \[Hamas\] logo, for instance, and respond accordingly. So actually, we’re quietly confident that those platforms will be alright to handle it. And I would hope that they’ve been training their algorithms in anticipation of this, based on the very large amounts of existing content from \[Hamas and PIJ\]. But unfortunately, we have no insight into that at all.”

The Hamas Threat of Hostage Execution Videos Looms Large Over Social Media

Plus: IT workers secretly funnel money to North Korea, a court in the US upholds keyword search warrants, and WhatsApp gets a passwordless upgrade on Android

With the Israel-Hamas war intensifying by the day, many people are desperate for accurate information about the conflict. Getting it has proven difficult. This has been most apparent on Elon Musk’s X, formerly Twitter, where insiders say even the company’s primary fact-checking tool, Community Notes, has been a source of disinformation and is at risk of coordinated manipulation.

Case in point: An explosion at a hospital in Gaza on Tuesday was followed by a wave of mis- and disinformation around the cause. In the hours following the explosion, Hamas blamed Israel, Israel blamed militants in Gaza, mainstream media outlets repeated both sides’ claims without confirmation either way, and people posing as open source intelligence experts rushed out dubious analyses. The result was a toxic mix of information that made it harder than ever to know what’s real.

On Thursday, the United States Department of the Treasury proposed plans to treat foreign-based cryptocurrency “mixers”—services that obscure who owns which specific coins—as suspected money laundering operations, citing as justification crypto donations to Hamas and the Palestinian Islamic Jihad, a Gaza-based militant group with ties to Hamas that Israel blamed for the hospital explosion. While these types of entities do use mixers, experts say they do so far less than criminal groups linked to North Korea and Russia—likely the real targets of the Treasury’s proposed crackdown.

In Myanmar, where a military junta has been in power for two years, people who speak out against deadly air strikes on social media are being systematically doxed on pro-junta Telegram channels. Some were later tracked down and arrested.

Finally, the online ecosystem of AI-generated deepfake pornography is quickly spiraling out of control. The number of websites specializing in and hosting these faked, nonconsensual images and videos has greatly increased in recent years. With the rise of generative AI tools, creating these images is quick and dangerously easy. And finding them is trivial, researchers say. All you have to do is a quick Google or Bing search, and this invasive content is a click away.

That’s not all. Each week, we round up the security and privacy stories we didn’t cover in-depth ourselves. Click the headlines to read the full stories, and stay safe out there.

The recent theft of user data from genetics testing giant 23andMe may be more expansive than previously thought. On October 6, the company confirmed a trove of user data had been stolen from its website, including names, years of birth, and general descriptions of genetic data. The data related to hundreds of thousands of users of Chinese descent and primarily targeted Ashkenazi Jews. This week, a hacker claiming to have stolen the data posted millions of more records for sale on the platform BreachForums, TechCrunch reports. This time, the hacker claimed, the records pertained to people from the United Kingdom, including “the wealthiest people living in the US and Western Europe on this list.” A 23andMe spokesperson tells The Verge that the company is “currently reviewing the data to determine if it is legitimate.”

According to 23andMe, its systems were not breached. Instead, it said, the data theft was likely due to people reusing passwords on their 23andMe accounts that were exposed in past breaches and then used to access their accounts. If you need some motivation to stop recycling passwords, this is it.

The US Department of Justice on Wednesday said it had uncovered a vast network of IT workers who were collecting paychecks from US-based companies then sending that money to North Korea. The freelance IT workers are accused of sending millions of dollars to Pyongyang, which used the funds to help build its ballistic missile program. While the workers allegedly pretended to live and work in the US, the DOJ says they often lived in China and Russia and took steps to obscure their real identities. According to an FBI official involved in the case, it’s “more than likely” that any freelance IT worker a US company hired was part of the plot.

Searching online may have just gotten a little bit more dangerous. On Monday, a Colorado Supreme Court upheld police use of a so-called keyword search warrant. Using this type of warrant, law enforcement demands companies like Google hand over the identities of anyone who searched for specific information. This is the opposite of how traditional search warrants work, where cops identify a suspect and then use search warrants to obtain information about them.

Keyword search warrants have long been criticized as “fishing expeditions” that violate the US Constitution’s Fourth Amendment rights against unreasonable searches and seizures, because it potentially hands police information about innocent people who searched for a specific term but were not involved in any related crime.

The 23andMe User Data Leak May Be Far Worse Than Believed

Hamas has long touted its military drones, but little is known about the true scale of the threat. The answer may have consequences for people on both sides of the Israel-Gaza border.

When Hamas launched its attacks against Israel on October 7, it unleashed a flood of rockets as cover, while militants streamed through holes in the fence surrounding the Gaza strip. One particular clip released by Hamas, played on news stations the world over, provoked a particular bit of paranoia: video of balaclava-clad Hamas fighters standing in a desert landscape, launching a line of suicide drones.

Amid the terror and chaos, the video seems to underscore a long-held fear that Hamas—with the help of Iranian technology—had developed the ability to conduct air strikes on Israel. What’s more, these drones may prove more adept than Hamas’ supply of rockets at thwarting Israel’s sophisticated Iron Dome air defense system.

Hamas had been building this capacity for some time. In 2022, it touted its drone program with an ominous warning: Israel no longer had a monopoly on its skies. According to Hamas Telegram channels, roughly 40 suicide drones have been fired toward Israel since the war began earlier this month. Yet, besides some undated propaganda videos, there is scant evidence that these drones have actually been deployed against Israel—and, if they have, they don’t appear to have done much damage.

Drone warfare has dramatically altered the dynamics in a number of recent conflicts—from Ukraine to Nagorno-Karabakh to Yemen—but not in the war between Hamas and Israel.

Why? The answer could have significant implications for people on both sides of the Israel-Gaza border.

Since the early 2000s, Hamas, which was elected to lead Gaza’s government in 2006 and has held power ever since, has drastically scaled up its ability to hit targets inside Israel.

The earliest versions of its Qassam rocket were rudimentary: lightweight and capable of traveling just a few miles. In each successive generation of the missile, however, they became bigger, capable of flying farther, and equipped with larger warheads.

Over the past two decades, Hamas and Israel have engaged in a race—Hamas, to develop its offensive capabilities and extend its reach; and Israel, to frustrate those efforts as much as possible.

Like more than 20 non-state actors in conflict zones around the world, Hamas recognized that the drones could substantially upgrade its ability to wage war. Unlike its unguided missiles, which are designed to beat Israel’s air defenses simply by overwhelming them, drones are considerably harder to intercept. They fly low and don’t travel in a predictable, parabolic arch. As a number of countries have recently learned, thwarting an advancing drone—much less a number of them—is a tricky problem to solve.

Unlike Russia or Ukraine, Hamas couldn’t source military drones through an open tender. So it tapped Tunisian-born aerospace engineer Mohamed Zouari to, in the early 2010s, design Hamas’ first fleet of operational drones and stand up an industry to produce them. They called the first model Ababeel1, which was very similar to an Iranian drone and had three different models. One version was designed to conduct surveillance, one to deliver small munitions, and the third was a suicide drone.

Israel began targeting Hamas’ drone program before it even produced results, striking a production facility in 2012. But the program continued.

Around that time, there were ample signs that Hamas’ domestic production capacity had not grown as it had hoped. Small—probably commercial—drones were dispatched into Israel from Gaza in 2012 and 2013, according to reports of a talk by an Israeli air defense official. Israeli jets and anti-air systems soon began to intercept the drones over Israeli airspace. Around 2014, Hamas made headlines after claiming it had penetrated deep into Israeli airspace, flying over Tel Aviv. But analysts say, despite Hamas’ insistence, the drones were not locally made in the Gaza strip: They were likely the Ababil-1, a product of the Iranian drone program.

In 2016, Zouari was assassinated in his hometown of Sfax, Tunisia, in what has been described by Tunisian investigators as a multiyear operation. While Israel did not admit responsibility for the killing, then-defense minister Avigdor Lieberman said only that Israel “will continue to do in the best possible way what we know how to do—that is to protect our interests.” Fadi al-Batsh, who had written papers on drone technology and who Israeli media alleged was part of Hamas’ drone program, was assassinated in 2018. Lieberman suggested that al-Batsh was killed as part of a “settling of scores among terrorist organizations.” In January 2022, the Hamas-led Gaza Interior Ministry arrested a Gaza resident for al-Batsh’s death and alleged the man worked for Mossad, Israel’s intelligence agency.

As Hamas seemed to struggle to establish its own domestic drone industry, other non-state actors began showing just how devastating these unmanned aerial vehicles (UAVs) could be. The Islamic State leveraged a huge number of commercial and hobbyist drones to conduct reconnaissance and drop grenades on advancing forces. Houthi rebels in Yemen began deploying sophisticated attack drones in its fight against the state military—analysts noted that, despite claims that these drones were locally made, they bore striking similarities to Iranian attack drones.

Faced with the looming possibility that Hamas could leverage some of the same techniques, Israel began running drills, practicing with fighter jets to intercept UAVs. In February 2014, it announced a prototype of a new air defense system: The “Iron Beam”—a directed energy weapon which, it hoped, will be able to track and destroy incoming drones.

In 2021, Hamas again sounded the trumpets over its supposedly game-changing drone program. This time it unveiled a whole new model: the Shehab. The suicide drones starred in slickly made propaganda videos and have been lionized for years in Hamas communiques. Yet they proved woefully ineffective in the field. Some were intercepted by the Iron Dome (as was one Israeli reconnaissance UAV) while others were shot down by F-16 jets. Video footage and unverified claims from Hamas suggest that one drone may have exploded near an Israeli chemical plant in May 2014—but appeared to do little to no damage.

Despite the program’s Iranian influence, Hamas claimed some of its drones were “locally made.” It said in a May 2022 press release that its drone program had made major progress, and it touted these new drones as a “turning point” for its fight against Israel. In September 2022, Hamas inaugurated “Shehab Square,” a public square featuring a model of the suicide drone on a pillar.

Despite all this fanfare, a December 2022 report from the International Center for Counter-Terrorism (ICCT) took a dim view of Hamas’ drone program. “Hamas has not demonstrated any ability to regularly use drones successfully,” the researchers wrote. As to why Hamas would continue investing in a capability that has such a poor record, the ICCT surmised that “the association of drone technology with military status may explain the group’s continued employment of drones.”

What’s more, the ICCT noted that Hamas’ technical failures seemed to be compounded by a lack of strategy or plan for what to do with these drones. The paper suggested that Hamas may lack the technical know-how to use these drones effectively, that it may be ineffective against Israel’s defenses, or possibly that “the group is more concerned about being seen using drones than using them effectively.”

“I think it’s surprising that Hamas didn’t use more commercial and tactical drones in its invasion,” Paul Lushenko wrote on Twitter in the hours after Hamas’ October 7 assault on Israel. “For all the concern of an Israeli intelligence failure, I think the lack of Hamas’ use of drones suggests poor organizational learning.”

Lushenko is a faculty professor at the United States Army War College and an expert in the emerging field of drone warfare. Speaking with WIRED, Lushenko says there’s little sign that Hamas, despite their usual bragging, actually managed to put its drone program into action. “We haven’t seen the evidence.”

Certainly, Hamas made some targeted use of several over-the-counter drones and quadcopters—similar to how the Islamic State deployed the UAVs during its brief control of a proclaimed caliphate. Videos reportedly released by Hamas purportedly showed drones dropping explosive devices on Israeli communications towers and machine gun positions near the Gaza border. These UAVs pose a particular challenge because they are often too small and too nimble to be successfully intercepted. Instead, Israel says it is stepping up jamming efforts to break the link between those drones and their controllers within Gaza.

Beyond those short-range and lightweight UAVs, however, Hamas’ use of its homemade, Iranian-inspired suicide drones seems to be not much more than bluster.

The much-broadcast Hamas propaganda video of its fixed-wing UAVs being fired does not, in fact, show part of the assault on Israel. It was filmed before the attack—the full video shows the suicide drones crashing into a fake Israeli outpost—the explosion knocking over cardboard cutouts, as a blue-and-white Israeli flag flaps nearby.

Hamas Telegram channels have claimed repeatedly in recent weeks that their drones struck positions in Israel but offered little in the way of visual evidence or specifics. One supposed strike was conducted on “a parking lot for vehicles and personnel east of Gaza.” There has been no confirmation of any of these strikes or claims of any damage inflicted.

The Israel Defense Forces declined WIRED’s request to comment on whether it had intercepted any of these drones, writing that “the IDF is currently focused on eliminating the threat from the terrorist organization Hamas.”

There may be two possible explanations for this apparent lack of impact. One is that Hamas has opted to stockpile these drones, saving them for an anticipated Israeli ground operation. The other is that, like past attempts, Hamas’ drone program has simply failed to launch.

The first possibility could pose an enormous challenge for Israel. As we’ve seen on both sides of the Ukraine-Russia war, drones have substantially changed the reality on the ground. While analysts say Russia has used Iranian-made kamikaze drones to attack Ukrainian critical infrastructure, Ukraine has responded with Turkish-made Bayraktar TB2 drones to hammer Russian convoys and defensive positions. Smaller quadcopters have given both sides unparalleled visibility behind enemy lines and have proved remarkably deadly in urban warfare. If Hamas is sitting on a reserve of these drones, to be used if Israeli forces cross into Gaza—where they will not have the protection of the Iron Dome—it could be highly effective at frustrating a possible ground assault.

“It's not uncommon for non-states \[actors\] and states to not use all of their decisive weapons all at once,” James Patton Rogers, executive director of the Cornell Brooks Tech Policy Institute, tells WIRED. “Will this be something that happens in the coming days and weeks? Is this something that was deliberately held back en masse from being launched against Israel?”

The fact that Hamas has, on dozens of occasions over the past two years, fired these drones toward Israel with little to no effect suggests that its reach may have extended its grasp. “We don't know the full impact of those yet, if there wasn't much impact,” Rogers says. “Did they do anything more than the rockets or the mortars would do? Were they able to penetrate the Iron Dome more than a mortar or a rocket?”

Normally, these loitering munitions are more effective at beating missile defense systems, as they tend to fly low and slow, hugging the ground. But given that Israel has one of the most advanced air-defense systems in the world, Hamas may simply not have had the time, capacity, or skill to adequately learn how to overcome the Iron Dome.

“I do think it's a bit too early to tell in this one,” Rogers says.

Lushenko adds that, even if these drones do very little physical damage, the threat they pose will still loom large. “They really have a psychological effect.”

The Dangerous Mystery of Hamas’ Missing ‘Suicide Drones’

With a new emphasis on the Hamas attacks on Israel, the US Treasury has proposed designating foreign cryptocurrency “mixer” services as money launderers and national security threats.

Hamas’ attacks Against Israel on October 7 have shifted the geopolitical landscape and triggered a looming Israeli ground assault in the Gaza Strip. Now the ripple effects are reaching the cryptocurrency industry, where they’ve become the United States Department of the Treasury’s rallying cry for a crackdown on cryptocurrency anonymity services.

The US Treasury’s Financial Crimes Enforcement Network (FinCEN) today released a set of proposed rules that would designate foreign cryptocurrency “mixers”—services that blend users’ digital funds to offer more anonymity and make them harder to trace—as money laundering tools that pose a threat to national security and would thus face new sanctions and regulations. The new rules, if adopted following a 90-day period of public comment and debate, would potentially represent the broadest restrictions imposed yet on the mixing services and could make it far harder for cryptocurrency holders to put their money through the services before cashing it out at a US cryptocurrency exchange, or even at a foreign exchange that accepts US customers.

While the proposed rules were almost certainly in the works long before October 7, the Treasury’s announcement of the proposed rules tied the push for a change in policy directly to the use of cryptocurrency by Hamas and militant groups in Gaza. “The Treasury Department is aggressively combatting illicit use of all aspects of the CVC ecosystem by terrorist groups,” Wally Adeyemo, deputy secretary of the Treasury, wrote in a statement, using the term “CVC” to mean convertible virtual currency. Adeyemo says that this includes Hamas and Palestinian Islamic Jihad, a militant group that often aligns with Hamas, which Israel blamed for an explosion at a hospital in Gaza earlier this week.

Cryptocurrency mixers have existed almost as long as Bitcoin itself. They offer to take in a user’s cryptocurrency, blend it with that of other users, and return the funds so that they are harder to follow from their origin to destination on blockchains, which generally record every transaction in full public view. The Treasury’s rule change would designate those cryptocurrency-mixing services—or at least the majority of them that are based outside the US—as a “primary money laundering concern.” They would thus be considered a threat to US national security as defined by section 311 of the Patriot Act, a section of the law designed to restrict how domestic financial institutions interact with potential sources of terrorist financing.

The rule change would mean that US financial services, as well foreign ones with US customers—including cryptocurrency exchanges—would have to go through extra record-keeping and reporting requirements for funds that have touched a foreign cryptocurrency mixer, and it might even allow the Treasury to block US exchanges from handling those funds. “We’ve never seen anything like this before,” says Ari Redbord, the head of global policy for TRM Labs, a blockchain analysis firm. Redbord notes that the rule change isn’t proposing a blanket ban on foreign mixing services, only new rules for interacting with them. “The reality, however, is that 311 actions oftentimes have a sort of name-and-shame effect, where people are just not wanting to engage with these platforms out of fear of being caught up in money laundering or other type of illicit activity.”

Redbord, who previously served as an advisor to the Treasury’s undersecretary for Terrorism and Financial Intelligence, also notes that the proposal was no doubt being considered prior to the latest Hamas attacks and that the Treasury must have changed the proposal’s focus from the use of cryptocurrency by other national security threats, like North Korea and Russia, to Hamas and militant groups in recent days. “Having been at Treasury for a number of years, you don’t just roll out an action like this out over the course of 10 days,” says Redbord. “They’ve kind of shifted the narrative toward Hamas because that’s the news.”

Hamas and militant groups’ use of cryptocurrency, while significant, pales in comparison to the amount of cryptocurrency used by other illicit actors. Hamas, for instance, raised $41 million in cryptocurrency over the past two years, and Palestinian Islamic Jihad raised $91 million, according to a report last week in the _Wall Street Journal_ that cited analyses by cryptocurrency tracing firms and seizures by the Israeli government.

It’s not clear, however, how much of those funds actually made it to these groups before being seized. In fact, Hamas asked its donors to stop using cryptocurrency in April of 2023, due to the public nature of the transactions on blockchains and the risk of prosecution. Cryptocurrency tracing firm Chainalysis, which frequently works with government and law enforcement customers, went so far as to publish a blog post yesterday cautioning against mistaken analyses that overestimate the role of cryptocurrency in financing entities like Hamas and the Palestinian Islamic Jihad.

North Korean state-sponsored cybercriminals, Russian ransomware gangs, and other criminal groups, by contrast, have pocketed billions of dollars through their theft of cryptocurrency or use of the technology as a means of demanding extortion payments from victims. Thieves stole $3.8 billion in crypto last year—much of which went to the North Korean regime—and ransomware hackers extorted close to $450 million in just the first half of 2023, according to Chainalysis.

Those criminals often use cryptocurrency mixing services, funneling hundreds of millions of dollars into mixing services like ChipMixer and Sinbad.io. In fact, US law enforcement and the Treasury Department have aggressively sanctioned or shut down one mixer service after another in recent years, including Blender, TornadoCash, and Bitzlato, often citing their use in laundering the profits of those North Korean and Russian hackers.

The new FinCEN rules would be less severe than those sanctions, indictments, and busts—a new regulatory process rather than a ban—but also far wider in scope, says Jason Somensatto, Chainalysis’ head of North America public policy. “The impact can be much broader,” says Somensatto. “They can say that this applies to _all_ mixing services that people are interacting with.”

As the Treasury doubles down on its push to cut off crypto-based money laundering—and now points to Hamas as a new impetus for that crackdown—TRM Labs’ Redbord cautions that US regulators shouldn’t go too far in censuring services that do, in some cases, offer financial privacy to legitimate users. After all, without mixers, most cryptocurrency transactions are fully public in nature. “I think the challenge for regulators is, how do we thread the needle between stopping illicit actors from using these platforms but at the same time allow regular users to enable some degree of privacy?” Redbord says. “I think the concern is that this could very much be throwing the baby out with the bathwater.”

Citing Hamas, the US Wants to Treat Crypto "Mixers" as Suspected Money Launderers

A flood of false information, partisan narratives, and weaponized “fact-checking" has obscured efforts to find out who’s responsible for an explosion at a hospital in Gaza.

Yesterday evening around 7 pm local time, an explosion rocked the Al-Ahli Baptist Hospital in Gaza City. Within minutes, information about what had happened was distorted by partisan narratives, disinformation, and a rush to be first to post about the blast. Add in mainstream media outlets parroting official statements without verifying their veracity, and the result was a chaotic information environment in which no one was sure what had happened or how.

“There’s just been this massive sort of pressure to get videos out there, get your take, get your analysis, and it’s like a perfect storm for chaos,” Kolina Koltai, a senior researcher at open source intelligence (OSINT) news outlet Bellingcat, tells WIRED.

Moments after the explosion was reported, Gaza’s health ministry claimed the blast was caused by an Israeli rocket attack and that hundreds of people had died, marking what would be among the deadliest attacks of the current conflict between Israel and Hamas, which controls the Palestinian territory of Gaza. News organizations such as _The_ _New York Times_ and Reuters ran with the claim, pushing notification alerts to people’s phones with the news that Israeli rockets had killed Palestinians sheltering in a hospital in Gaza. “Breaking news: Israeli strike on hospitals kill hundreds, Palestinian officials say,” _The_ _New York Times_ alert read.

Soon after those push notifications went out, the Israeli military said its intelligence officers had tracked rockets fired by the Palestinian Islamic Jihad, an armed militant group in Gaza that is aligned with Hamas against Israel but often acts independently. Israeli military officials said they observed Islamic Jihad rockets passing the hospital at the time of the strike, adding that it was these projectiles—not an Israeli rocket—that hit the facility’s parking lot.

News organizations quickly changed their headlines to reflect the counterclaim from Israel and pushed out more notifications to their audiences. The updated headline from _The_ _New York Times_ read: “At least 500 dead in blast at Gaza hospital, Palestinians say.”

This was only the beginning of the confusion.

In the hours after the attack, @Israel, the official Israeli account on X (formerly Twitter), posted a video it claimed was proof that the explosion was the result of a misguided rocket launched by Islamic Jihad militants. But within minutes, Aric Toler, a former Bellingcat researcher who now works for _The_ _New York Times_, pointed out that the time stamp on the video showed 8 pm local time, a full hour after the explosion took place.

“When you see people in such a capacity putting out a claim, walking it back, putting out a video, deleting the video, it makes it tough, not just for us to do our job, but even for the public to find out what’s going on,” Koltai says.

The post on Israel’s official account was subsequently edited to remove the video while maintaining its claim that the attack was not the result of an Israeli strike.

Meanwhile, social media was flooded with videos and images that claimed to provide proof of the origin of the attacks, with many accounts making definitive judgments about those they claimed were responsible for the attack, all without any actual proof.

For experts in the OSINT community who have spent years working on incidents just like this, the confusion and misinformation were frustrating. Figuring out what happened takes time, and the deluge of misinformation only made that work more difficult.

“It’s because we are trying to track a rocket, at night, via a couple of livestreams, a security camera, and a phone camera,” an OSINT researcher, who posts anonymously on social media using the handle OSINTtechnical, tells WIRED. “Oh, and there are bad actors purposely trying to muddy the waters. I would say we still have an acceptable number of resources to see into Gaza, but it takes some time to parse everything to a complete degree.”

The researcher adds that their job was made infinitely more difficult by media outlets running with the claim that Israel was responsible. “That blows everything out of the water,” OSINTtechnical says.

Koltai says she began trying to figure out what had happened within hours of the incident, before her colleagues in Europe took over today. Despite being among the first to begin investigating the incident, as of this afternoon Bellingcat had still not confirmed how the attack happened or who was responsible.

Similarly, the BBC Verify team published its analysis of the explosion based on the available information but has been unable to conclude what exactly happened. A number of videos captured with mobile phones and circulated on social media appear to show the moment of the explosion from different angles. A livestream operated by Al Jazeera shows two flashes, one further away from the camera and one much closer, which some claim shows the rocket launching, followed by the explosion. Footage captured this morning shows the hospital’s parking lot, and what appears to be a small impact crater. Footage shows damage to a number of cars, but only minor damage to the exterior of the hospital building.

Today, _The New York Times_ reported that US officials said they have “multiple strands of intelligence,” including infrared satellite imagery, indicating that the deadly blast was caused by the Islamic Jihad group, though that evidence has not been released publicly. US president Joe Biden, who is meeting with officials in Israel today, echoed Israel’s claim that its military did not fire the rocket that hit the hospital. “Based on the information we have seen today, it appears the result of an errant rocket fired by a terrorist group in Gaza,” he said.

In the days since Hamas attacked Israel on October 7, people claiming to be OSINT practitioners have emerged on social media who are much more willing to make conclusive findings almost immediately than people who have a long history of conducting OSINT work.

This new group is “publishing analysis as quickly as possible when events are taking place, in an attempt to compete for public attention,” ​​Francesco Sebregondi, a forensic architect who helps investigate human rights abuses through a technique known as forensic architecture, tells WIRED. “This is of course detrimental to the fundamental goal of citizen-led open source investigations.”

The purpose of OSINT investigations is to independently verify information “and to enable counter-investigations of authoritative arguments and sometimes misleading official accounts,” Sebregondi says.

Sebregondi says OSINT accounts that rush to post analyses prematurely not only mislead their followers but help bolster the narrative of political actors who may be “counting on the eagerness of some OSINT actors to use any image, material, or data to quickly publish new content or ‘analysis’—and thereby more or less directly support its version of the events.”

Aside from the apparent bragging rights of being first, there is also now a financial incentive to post updates before anyone else because if you’re “first and put out a hot take even if you’re maybe not correct you can actually get paid out for it,” Koltai says, referring to X’s revenue-sharing program.

Fact-checking and open source investigations have long been seen as a way to hold platforms accountable by debunking disinformation that spreads unchecked on social media, but the Israel-Hamas war has shown how the language of OSINT investigators has been co-opted by self-interested parties, says Caroline Orr, a behavioral scientist and postdoctoral researcher at the University of Maryland who tracks disinformation online.

“I think one of the most disturbing aspects of studying disinfo is when you realize that even fact-checking has become weaponized,” Orr wrote on X. “Most people don’t care about the truth about the hospital being bombed; they just care about finding a truth to use against the other side.”

Who’s Responsible for the Gaza Hospital Explosion? Here’s Why It’s Hard to Know What’s Real

X is promoting Community Notes to solve its disinformation problems, but some former employees and people who currently contribute notes say it’s not fit for that purpose.

Community Notes, the crowdsourced fact-checking program launched a year ago to tackle disinformation on X (formerly Twitter), has flown under the radar for much of its existence. But in the past week it has been heralded by Elon Musk and X CEO Linda Yaccarino as a key tool in tackling the toxic deluge of disinformation that has flooded social media, and in particular X, during the ongoing Israel-Hamas war.

On Saturday, the company wrote on its own platform that “notes across the platform are now being seen tens of millions of times per day, generating north of 85 million impressions in the last week.” It added that thousands of new contributors had been enrolled in the system. However, a WIRED investigation found that Community Notes appears to be not functioning as designed, may be vulnerable to coordinated manipulation by outside groups, and lacks transparency about how notes are approved. Sources also claim that it is filled with in-fighting and disinformation, and there appears to be no real oversight from the company itself.

“I understand why they do it, but it doesn't do anything like what they say it does,” one Community Notes contributor tells WIRED. “It is prone to manipulation, and it is far too slow and cumbersome. It serves no purpose as far as I can see. I think it's probably making the disinformation worse, to be honest.”

This contributor, who was granted anonymity for this story because of concerns about retaliation from Musk or his supporters, should know about platform manipulation, because he is one of those engaging in it.

He is one member of a group of about 25 Community Notes contributors who actively coordinate on a daily basis in order to upvote or downvote particular notes. He is a member of the North Atlantic Fella Organization (NAFO), a decentralized online volunteer movement that emerged following Russia’s invasion of Ukraine and uses humor to counter Russian disinformation and propaganda while raising funds in support of Ukraine.

“We have a group so we can coordinate who writes what Community Notes, and if you write one, you can coordinate so you get one voted as helpful, and there's no validation on any of that,” the contributor says. The contributor claims that Russian embassies have engaged in similar tactics and alleges that they “will downvote anything that's anti-Russian.” A WIRED review of unpublished notes accompanying contested Russian embassy posts written by NAFO members shows they have all been repeatedly downvoted.

A contributor based in the southern hemisphere tells WIRED that he has two accounts on X, and he alleges that both of them have been approved for access to the Community Notes system—evidence that the program may be vulnerable to even broader manipulation, just as Kremlin trolls were able to operate multiple Twitter accounts impersonating US citizens and influence the 2016 election.

Community Notes began life as Birdwatch, first announced in October 2020 before going live in a pilot project in January 2021, weeks after Donald Trump supporters attacked the United States Capitol. Envisioned as a way of harnessing the power of the crowd to debunk misinformation in near real time, Birdwatch was never fully embraced by the company, which was criticized in March last year, soon after the Russian invasion of Ukraine, for failing to roll it out more broadly.

At the time, there was trepidation within the company about how effective the tool would be at controlling the quality of information on the platform, Yoel Roth, Twitter's former head of Trust and Safety, tells WIRED.

“There was a belief amongst the Trust and Safety team that people would not do uncompensated labor at scale, and that the things that would attract attention in a Birdwatch format didn't necessarily correspond with the harmful things that constituted violations of policies,” says Roth.

This truth was later borne out, at least in part. A study presented at a conference in April 2022 by researchers at MIT found that Birdwatch users were much more likely to fact-check posts expressing political views that differ from their own. David Rand, the study’s lead researcher and a professor at MIT’s Sloan School of Management, says that while around 80 percent of the tweets that users chose to annotate were, in fact, misleading, users overwhelmingly tended to prioritize political content. Users were also likely to flag a piece of content based on whether it seemed “reasonable.” It is unclear whether these users had the knowledge and skills to debunk misinformation or offer alternative, correct information.

“In a situation like what is happening in Israel and Gaza right now, where there's a massive amount of unknowns, that gut-check of ‘Does this seem reasonable?’ is not great. Even professional journalists, as I understand it, are having a lot of trouble understanding what's true and what's not true,” says Rand. With such a fast-moving and volatile situation, “what I expect the crowd to produce is a lot of noise,” he says.

Almost immediately after Musk took control of the company in late October 2022, he renamed Birdwatch “Community Notes,” claiming that the system had “incredible potential for improving information accuracy.” In the months that followed, X systematically eradicated almost all of the teams and individuals overseeing content moderation and trust and safety at the company, putting even greater emphasis on the role of Community Notes.

Joe Benarroch, head of business operations at X, tells WIRED that the company has contributors across 44 countries, and while he would not give an exact number, he noted that more than 10,000 people had joined the program in the past week. Alongside contributors who volunteer for the program, some contributors are invited by X itself, WIRED has learned, according to one contributor we spoke to and a search of X, where contributors say X invited them to join.

Benarroch did not address whether there is any form of moderation for Community Notes. And while Benarroch says “Community Notes were designed to tackle misinformation on X,” Roth says their original intention was not to perform that task alone.

“The intention of Birdwatch was always to be a complement to, rather than a replacement for, Twitter's other misinformation methods,” says Roth. “The company fired the entire curation team, without whom misinformation enforcement can't operate, even if the policies are still on the books,” he says, referring to the former employees who would create the collections of tweets for corrections or produce the labels to let users know if something was misinformative.

“Community Notes is an imperfect replacement for Trust and Safety staff,” says one former Twitter Trust and Safety employee who spoke to WIRED on the condition of anonymity for fear of retaliation. “You can’t just outsource that work to the community.”

While X claims Community Notes is having a significant impact on tackling disinformation on the platform, the notes system itself can also spread disinformation. Last week WIRED revealed that a note appended to a post from Donald Trump Jr. wrongly claimed a video he posted about the Hamas attack on Israel was fake. The original note has since been replaced with one citing WIRED’s report.

Many notes written by contributors are never seen by the public. A WIRED examination of these unpublished notes shows that just like the main X platform, the Community Notes community is similarly riven by in-fighting and misinformation.

On Saturday, the official Israel account on X posted a picture of what looks like a child’s bedroom with blood covering the floor. “This could be your child’s bedroom. No words,” the post reads. There is no suggestion the picture is fake, and publicly there are no notes on the post. However, in the Community Notes backend, viewed by WIRED, multiple contributors are engaging in a conspiracy-fueled back-and-forth.

“Deoxygenated blood has a shade of dark red, therefore this is staged,” one contributor wrote. “Post with manipulative intent that tries to create an emotional reaction in the reader by relating words and pictures in a decontextualized way,” another writes.

“There is no evidence that this picture is staged. A Wikipedia article about blood is not evidence that this is staged,” another contributor writes.

“There is no evidence this photo is from the October 7th attacks,” another claims.

These types of exchanges raise questions about how X approves contributors for the program, but this, along with precisely what factors are considered before each note is approved, remains unknown. X’s Benarroch did not respond to questions about how contributors are chosen.

None of those approved for the system are given any training, according to all contributors WIRED spoke to, and the only limitation placed on the contributors initially is an inability to write new notes until they have rated a number of other notes first. One contributor claims this approval process can take fewer than six hours.

In order for notes to become attached to a post publicly, they need to be approved as “helpful” by a certain number of contributors, though how many is unclear. X describes “helpful” notes as ones that get “enough contributors from different perspectives.” Benarroch did not say how X evaluates a user’s political leanings. However, the system at least previously employed a technique known as bridge-based ranking to favor notes that receive positive interactions from users estimated to hold differing viewpoints. Still, how this works is not clear to at least some Community Notes contributors. 

“I don't see any mechanism by which they can know what perspective people hold,” Anna, a UK-based former journalist whom X invited to become a Community Notes contributor, tells WIRED. “I really don't see how that would work, to be honest, because new topics come up that one could not possibly have been rated on.” Anna asked only to be identified by her first name for fear of backlash from other X users.

For all the notes that do become public, there are many more that remain unseen, either because they are deemed unhelpful, or in the majority of cases reviewed by WIRED, they simply didn’t get enough votes from other contributors. One contributor tells WIRED that 503 notes he had rated in the last week remained in limbo because not enough people had voted on them.

“I think one of the issues with Community Notes at its core, it's not really scalable for the amount of media that's being consumed or posted in any given day,” the contributor, who is known online as Investigator515, tells WIRED. They asked to only be identified by their handle because of fears of damage to their professional reputation.

All of the contributors who spoke to WIRED feel that Community Notes is not up to the task of policing the platform for misinformation, and none of them believed that the program would improve at all in the coming months if it remains in its current form.

“It's much harder to deal with misinformation when there isn't the top-down moderation that Twitter used to have, because accounts willfully spreading misinformation would get suspended before they could really do a lot of harm,” the longtime contributor says. “So a reliance on Community Notes is not good. It's not a replacement for proper content moderation.”

_Updated at 7:10 pm ET, October 17, 2023, to add further context about how the Community Notes system may gauge the viewpoint diversity of contributors._

Insiders Say X’s Crowdsourced Anti-Disinformation Tool Is Making the Problem Worse

Myanmar’s military junta is increasing surveillance and violating basic human rights. The combination of physical and digital surveillance is reaching dangerous new levels.

Since taking power in a coup two years ago, Myanmar’s military junta has suppressed people's rights, cracked down on opposition, and used deadly force against civilians. To enable this, officials have clamped down on people’s communications and rolled out extensive digital surveillance systems. Now, new evidence shows how people are being tracked online and offline simultaneously.

In April this year, the military junta launched one of its deadliest air strikes—killing more than 160 people in the Kanbalu region in a single day. Following the strike, pro-junta Telegram channels systematically doxed people who showed support for the victims on social media, new research shared with WIRED shows. Their names, photos, and other personal information were all shared. Days after the doxing, which also revealed the real-world movements of some of the individuals, people were arrested and imprisoned.

The revelations from Myanmar Witness, a project run by the digital investigations group Centre for Information Resilience, demonstrates how oppressive forces can use people’s social media posts against them. It also shows the intense surveillance faced by people living under Myanmar’s military junta, which includes rolling internet shutdowns and increasing CCTV.

“The military regime and their supporters in Myanmar have weaponized the internet, and doxing has become the tip of the spear—the most aggressive way of intimidating people into silence, online and offline,” says Lu Aye, the lead investigator at Myanmar Witness. The group investigated the incident using open source intelligence techniques, comparing on-the-ground reports with digital evidence.

The air strike hit the village of Pa Zi Gyi, in central Myanmar, on the morning of April 11 as hundreds of people celebrated the opening of a new village building, which had been backed by Myanmar’s pro-democratic National Unity Government. More than 160 people, including women and children, died in the air strike, with reports from CNN and the _Guardian_ describing bodies burning on the ground and medical teams not immediately able to access the site due to planes flying overhead. (A military spokesperson told local press it was targeting “terrorists.”)

In the days following the incident, locals changed their Facebook profile pictures to black images and shared messages of support for the victims. According to reports in the state-owned Myanmar Alin newspaper that were analyzed by Myanmar Witness, 68 people were arrested. (One other arrest was reported by the BBC.) People were arrested for spreading propaganda, cooperating with the pro-democracy government, and public disturbance, according to the analysis. All the of arrests mention people’s social media profiles.

A series of 19 Telegram channels that appear to support the State Administration Council, the official name of the military junta, shared the personal details and Facebook posts of 20 people who supported air strike victims, the Myanmar Witness research says. Of these, 11 were arrested after being doxed. “Revealing the identities, addresses, and other details of dissenters online is a powerful weapon of suppression,” Lu Aye says. “It leaves individuals vulnerable and intimidated and scares off many more from calling out the military and standing up for democracy.”

It is “highly likely” that the doxing and subsequent arrests are related, Lu Aye says. Messages sent alongside the doxing posts were often similar to the published reasons for the arrest, and the timelines overlap, Lu Aye says. On average, according to the analysis, an arrest happened six and a half days after the doxing post appeared—and in all the instances, the doxing happened at least one day before the arrest. Some people were doxed multiple times, with a total of 59 doxing posts for the 20 people targeted.

Lu Aye says that the researchers have, for the “first time,” found evidence to show the “coordination of online and offline surveillance and suppression.” “We found a shop owner who was named and targeted by seven different pro-junta Telegram channels in one day,” Lu Aye says. “The victim fled her home and shop, movements which were reported on by two of the channels who also called for the shop owner’s arrest and \[said\] they would continue to report on the individual.”

Myanmar’s embassy in Washington, DC did not respond to WIRED’s request for comment about the arrests and doxing. Telegram has also not responded to a request for comment at the time of writing. Doxing on Telegram isn’t new. As WIRED has previously reported, politically motivated doxing is now rife across the Middle East, Southeast Asia, and Eastern Europe. Telegram previously said it moderates the publication of private information on its platform.

Of the 19 Telegram channels highlighted by Myanmar Witness, five no longer appear to exist. The largest has 112,000 followers, while others have more than 10,000. Several seem to still be posting screenshots of people’s Facebook profiles and other personal information, a WIRED review of the channels found.

Manny Maung, a Myanmar researcher at nongovernmental organization Human Rights Watch, says that while doxing has been increasing in the country in the past two years, it is hard to document. Maung says she has seen lawyers “go to ground” after having their personal details, as well as their home address and details about family members, spread online. “That is enough to scare people right now,” she says.

Since the military junta took power, people’s digital and physical rights have been eroded, Maung says. There have been frequent internet shutdowns, which keep people from organizing and prevent information from getting out of Myanmar. Several laws have also been amended, giving authorities greater powers, such as the ability to clamp down on civil society and snoop on people’s communications.

Andrea Calderaro, a senior lecturer in international relations at Cardiff University who has worked on Myanmar’s internet connectivity, says the digital activists he knows have had to flee. “All the telecom operators are under the control of the military junta,” he says. “The connectivity that has been built over the years is clearly now being turned against the population. It’s now a tool that the government is using to control and repress populations.”

Myanmar Witness has verified and mapped more than 750 incidents in the three years from October 2020 to this month. Each one is based on photos or videos that have come out of the country, and researchers have checked their location and the events recorded. These include houses being destroyed and burnt, bombs caught exploding on CCTV footage, and dead bodies on the street.

“Among the litany of atrocities and abuses, the military is abusing their own people’s rights: rights to access of information, the right to organize, the right to live without fear of being attacked or killed,” Maung says. “All of this is happening in a widespread context where the military is clamping down on all aspects of life.”

Myanmar Witness’s Lu Aye says that since the doxing and the wider arrests, at least five of the people apprehended were released within four months of their arrest. These individuals were mostly well-known in local communities, and their release was reported by people on the ground, Lu Aye says. “We do not know the fate of the more than 60 other people who were arrested.”

They Supported Air Strike Victims. Then They Were Doxed and Arrested

New research shows the number of deepfake videos is skyrocketing—and the world's biggest search engines are funneling clicks to dozens of sites dedicated to the nonconsensual fakes.

Google’s and Microsoft’s search engines have a problem with deepfake porn videos. Since deepfakes emerged half a decade ago, the technology has consistently been used to abuse and harass women—using machine learning to morph someone’s head into pornography without their permission. Now the number of nonconsensual deepfake porn videos is growing at an exponential rate, fueled by the advancement of AI technologies and an expanding deepfake ecosystem.

A new analysis of nonconsensual deepfake porn videos, conducted by an independent researcher and shared with WIRED, shows how pervasive the videos have become. At least 244,625 videos have been uploaded to the top 35 websites set up either exclusively or partially to host deepfake porn videos in the past seven years, according to the researcher, who requested anonymity to avoid being targeted online.

Over the first nine months of this year, 113,000 videos were uploaded to the websites—a 54 percent increase on the 73,000 videos uploaded in all of 2022. By the end of this year, the analysis forecasts, more videos will have been produced in 2023 than the total number of every other year combined.

These startling figures are just a snapshot of how colossal the issues with nonconsensual deepfakes has become—the full scale of the problem is much larger and encompasses other types of manipulated imagery. A whole industry of deepfake abuse, which predominantly targets women and is produced without people’s consent or knowledge, has emerged in recent years. Face-swapping apps that work on still images and apps where clothes can be “stripped off a person” in a photo with just a few clicks are also highly prominent. There are likely millions of images being created with these apps.

“This is something that targets everyday people, everyday high school students, everyday adults—it's become a daily occurrence,” says Sophie Maddocks, who conducts research on digital rights and cyber-sexual violence at the University of Pennsylvania. “It would make a lot of difference if we were able to make these technologies harder to access. It shouldn't take two seconds to potentially incite a sex crime.”

The new research highlights 35 different websites, which exist to exclusively host deepfake pornography videos or incorporate the videos alongside other adult material. (It does not encompass videos posted on social media, those shared privately, or manipulated photos.) WIRED is not naming or directly linking to the websites, so as not to further increase their visibility. The researcher scraped the websites to analyze the number and duration of deepfake videos, and they looked at how people find the websites using the analytics service SimilarWeb.

Many of the websites make it clear they host or spread deepfake porn videos—often featuring the word _deepfakes_ or derivatives of it in their name. The top two websites contain 44,000 videos each, while five others host more than 10,000 deepfake videos. Most of them have several thousand videos, while some only list a few hundred. Some videos the researcher analyzed have been watched millions of times.

The research also identified an additional 300 general pornography websites that incorporate nonconsensual deepfake pornography in some way. The researcher says “leak” websites and websites that exist to repost people’s social media pictures are also incorporating deepfake images. One website dealing in photographs claims it has “undressed” people in 350,000 photos.

Measuring the full scale of deepfake videos and images online is incredibly difficult. Tracking where the content is shared on social media is challenging, while abusive content is also shared in private messaging groups or closed channels, often by people known to the victims. In September, more than 20 girls aged 11 to 17 came forward in the Spanish town of Almendralejo after AI tools were used to generate naked photos of them without their knowledge.

“There has been significant growth in the availability of AI tools for creating deepfake nonconsensual pornographic imagery, and an increase in demand for this type of content on pornography platforms and illicit online networks,” says Asher Flynn, an associate professor at Monash University, Australia, who focuses on AI and technology-facilitated abuse. This is only likely to increase with new generative AI tools.

The gateway to many of the websites and tools to create deepfake videos or images is through search. Millions of people are directed to the websites analyzed by the researcher, with 50 to 80 percent of people finding their way to the websites via search. Finding deepfake videos through search is trivial and does not require a person to have any special knowledge about what to search for.

The issue is global. Using a VPN, the researcher tested Google searches in Canada, Germany, Japan, the US, Brazil, South Africa, and Australia. In all the tests, deepfake websites were prominently displayed in search results. Celebrities, streamers, and content creators are often targeted in the videos. Maddocks says the spread of deepfakes has become “endemic” and is what many researchers first feared when the first deepfake videos rose to prominence in December 2017.

Since the tools needed to create deepfake videos emerged, they’ve become easier to use, and the quality of the videos being produced has improved. The wave of image-generation tools also offers the potential for higher-quality abusive images and, eventually, video to be created. And five years after the first deepfakes started to appear, the first laws are just emerging that criminalize the sharing of faked images.

The proliferation of these deepfake apps combined with a greater reliance on digital communications in the Covid-19 era and a "failure of laws and policies to keep pace" has created a “perfect storm,” Flynn says.

Experts say that alongside new laws, better education about the technologies is needed, as well as measures to stop the spread of tools created to cause harm. This includes action by firms that host the websites and also search engines, including Google and Microsoft’s Bing. Currently, Digital Millennium Copyright Act (DMCA) complaints are the primary legal mechanism that women have to get videos removed from websites.

Henry Ajder, a deepfake and generative AI expert who has monitored the spread of the technologies, says adding more “friction” to the process of people finding deepfake porn videos, apps to change people’s faces, and tools that specifically allow the creation of nonconsensual images can reduce the spread. “It's about trying to make it as hard as possible for someone to find,” he says. This could be search engines down-ranking results for harmful websites or internet service providers blocking sites, he says. “It's hard to feel really optimistic, given the volume and scale of these operations, and the need for platforms—which historically have not taken these issues seriously—to suddenly do so,” Ajder says.

“Like any search engine, Google indexes content that exists on the web, but we actively design our ranking systems to avoid shocking people with unexpected harmful or explicit content they don't want to see,” says Google spokesperson Ned Adriance, pointing to its page on when it removes search results. Google’s support pages say it is possible for people to request that “involuntary fake pornography” be removed. Its removal form requires people to manually submit URLs and the search terms that were used to find the content. “As this space evolves, we're actively working to add more safeguards to help protect people, based on systems we've built for other types of nonconsensual explicit imagery,” Adriance says.

Courtney Gregoire, chief digital safety officer at Microsoft, says it does not allow deepfakes, and they can be reported through its web forms. “The distribution of nonconsensual intimate imagery (NCII) is a gross violation of personal privacy and dignity with devastating effects for victims,” Gregoire says. “Microsoft prohibits NCII on our platforms and services, including the soliciting of NCII or advocating for the production or redistribution of intimate imagery without a victim’s consent.”

While the number of videos and pictures continues to skyrocket, the impact on victims can be long-lasting. “Gender-based online harassment is having an enormous chilling effect on free speech for women,” Maddocks says. As reported by WIRED, female Twitch streamers targeted by deepfakes have detailed feeling violated, being exposed to more harassment, and losing time, and some said the nonconsensual content found its way to family members.

Flynn, the Monash University professor, says her research has found “high rates” of mental health concerns—such as anxiety, depression, self-injury, and suicide—as a result of digital abuse. “The potential impacts on a person’s mental and physical health, as well as impacts on their employment, family, and social lives can be immense,” Flynn says, “regardless of whether the image is deepfaked or ‘real.’”

Deepfake Porn Is Out of Control

Plus: Hamas raised millions in crypto, Exxon used hacked data, and more.

The media consortium, along with security researchers from Amnesty International and Google’s Threat Analysis Group, were able to show Vietnam’s connection to the Predator hacking campaign through documents they obtained that detail the Vietnamese government’s contract with Intellexa in 2020, and later an extension of the deal to allow the use of the Predator software. The internal documents went so far as to capture the response of Intellexa’s founder, Israeli former military hacker turned entrepreneur Tal Dilian, when the deal was announced: “Wooow!!!!” Vietnam’s government would later target French officials with Predator before this year’s campaign targeting US congressmen.

Despite efforts by Israel and other nations to cut off funding to Hamas in recent years, the group raised millions of dollars worth of cryptocurrency before the past weekend’s attack that killed more than a thousand Israelis. An analysis by _The Wall Street Journal_ found that Hamas, Palestinian Islamic Jihad, and Hezbollah had collectively raised hundreds of millions in crypto over the past several years, with $41 million going to Hamas specifically. Given that the _Journal_ learned of that funding in part through Israeli seizures of crypto accounts, however, it’s not clear how much of that money was frozen or seized versus how much might have actually been successfully laundered or liquidated by Hamas and other groups. 

In response to the weekend’s attacks, the Israeli government and the world’s largest crypto exchange, Binance, both announced that a new round of Hamas crypto accounts had been frozen. Though crypto has helped Hamas and other groups move funds across borders, its traceability on blockchains has presented a challenge for designated terrorist groups. In 2021, for instance, Hamas asked its supporters to stop making donations via cryptocurrency, due to the ease of tracking those transactions and unmasking contributors.

Last year, _Reuters_ reporters Chris Bing and Raphael Satter published an investigation into Aviram Azari, an Israeli private investigator who is accused of using mercenary hackers to gather intelligence on the critics of major corporations involved in lawsuits against them. 

Now, prosecutors in the Southern District of New York, where Azari has been convicted on criminal charges, have filed a sentencing memo that notes that activists’ communications stolen by Azari’s hackers were later used by Exxon in the company’s attempts to head off investigations and lawsuits by state attorneys general. The memo still doesn’t name Exxon as Azari’s client, but it implicitly suggests a link between the company and Azari: Prosecutors point in their memo to leaks of climate activists’ private emails to media, which were later cited by Exxon in their responses to state attorney generals as evidence of underhanded tactics by activists as they tried to prove that Exxon knew and covered up the role of fossil fuels in climate change. A Massachusetts lawsuit against Exxon that resulted from the state’s investigation is ongoing.

Internet giant Akamai warned this week that the infamous Magecart hacker crew, long focused on credit card fraud, has developed a clever new technique for spoofing credit card payment fields. The hackers managed to hide their malicious scripts in the 404 “page not found” error pages of ecommerce sites, then trigger those pages to load a spoofed payment field that impersonates a checkout page to steal credit card information. “The idea of manipulating the default 404 error page of a targeted website can offer Magecart actors various creative options for improved hiding and evasion,” warned Akamai researcher Roman Lvovsky. Akamai noted that the technique was used on the website of significant brands in the food and retail industries but declined to name them.

Source

Wired