Checking out this AI chatbot's new features? Make sure to keep these privacy tips in mind during your interactions.

With its most recent update, Google Bard can now sort through your trove of Google Docs, rediscover ancient Gmail messages, and search through every video on YouTube. Before experimenting too much with the new extensions available for Google’s chatbot, it's worth going over the steps you can take to protect your privacy (and the ones you can't).

Google Bard launched in March of this year, one month after OpenAI released ChatGPT to the public. You’re likely familiar with how chatbots are designed to mimic human conversation, but Google’s latest features are designed to give Bard more practical applications and uses.

But when every conversation you have with Bard is tracked, logged, and used again to train the AI, how can you trust it with your data? Here are some tips to protect your prompts and assert some control over what information you give Bard. Then we’ll discuss location data, for which Google sadly provides fewer privacy options.

The default Bard setting is to store every interaction you have with the chatbot for 18 months. In addition to your prompts, Bard stores your approximate location, IP address, and any physical addresses connected to your Google account for work or home. While the default settings are activated, any conversation you have with Bard could be selected for human review.

Want to turn this off? When you’re in the Bard Activity tab, you can stop it from autosaving your prompts and also delete any past interactions. “We give you this choice around Bard Activity, which you can turn on or off, if you want to keep your conversations \[from being\] human-reviewable,” says Jack Krawczyk, a product lead at Google for Bard.

After you turn off Bard Activity, your new chats are not submitted for human review, unless you report a specific interaction to Google. But there’s a catch: If you turn off Bard Activity, then you can’t use any of the chatbot's extensions connecting the AI tool to Gmail, YouTube, and Google Docs.

Yes, you can choose to delete interactions with Bard manually, but the data might not be removed from Google servers until some point later, when the company decides to delete it (if ever). “To help Bard improve while protecting your privacy, we select a subset of conversations and use automated tools to help remove personally identifiable information,” a Google support page reads. The conversations selected for human review are no longer tied to your personal account, and these interactions are stored by Google for up to three years, even if you clear it out of your Bard Activity.

It's also worth noting that any Bard conversation you want to share with friends or coworkers could potentially be indexed by Google Search. At the time of publication, multiple Bard interactions were accessible through Search, from a job hunter requesting advice when applying for a position at YouTube Music to someone asking for 50 different ingredients they could blend into protein powder.

To remove any Bard links you’ve shared, go to **Settings** in the top right corner, select **Your public links**, and click the trash icon to stop online sharing. Google posted on social media that it's taking steps to stop shared chats from being indexed by Search.

This may make you wonder: If I’m using Bard to find my ancient emails, do those conversations remain private? Maybe, maybe not. “With the ability to have Bard summarize and extract content from your Gmail and your Google Docs, we took it a step even further,” says Krawczyk. “Nothing from there is ever eligible. No matter what settings you have turned on. Your email will never be read by another human. Your Google Docs will never be read by another human.” Although no human readers may sound like a bit of relief, it remains unclear how Google uses your data and interactions to train their algorithm or future iterations of the chatbot.

OK, now what about your location data? Are there any tools to limit when Bard keeps track of where you are? In a pop-up, Bard users are given the option whether or not to share their precise location with the chatbot. Even if you opt out of precise location sharing, Bard will still know where you’re at.

“Location data is always collected if you use Bard so that Bard can provide you with a response that is relevant to your query,” reads a Google support page. The chatbot uses your IP address, a tag that reveals your general location, and any personal addresses saved to your Google account. The company claims to anonymize the location data you provide by storing it with at least 1,000 other people’s information in a tracking area that’s 2 miles or larger.

While location tracking may make you uncomfortable, companies keep track of IP addresses to know their users’ locations more commonly than you might realize. For example, Google Search uses your IP address (and other sources) to help answer all those “near me” queries: best takeout near me, used camping gear near me, movie theater tickets near me. Of course, just because it’s common doesn’t make it okay for everyone. Keep that in mind when you use products like Bard.

Even though Google does not provide an easy way for you to opt out of Bard’s location tracking, one method to mask your IP address is to use a virtual private network. These tools are available for your PC as well as your mobile device. To find the best VPN for your particular situation, check out WIRED’s roundup of the best options.

How to Stop Google Bard From Storing Your Data and Location

Every smartphone has an expiration date. Here’s when yours will probably come.

If you're shopping for a smartphone, you're probably weighing how powerful it is, how good the cameras are, and of course how much you're going to have to pay for it—but it's also worth considering how long the handset is going to last you.

A big part of that calculation comes down to the length of time that the phone will get updates. Apple just pushed out iOS 17, a software update that is heading to iPhones including the iPhone XR and the iPhone XS—handsets that launched in 2018.

For five-year-old phones to be getting (mostly) the same software features as the brand new iPhone 15 is something Apple can be proud of and that its users can be grateful for, but this kind of future-proofing isn't standard.

At the time of writing, Google promises Android updates for its Pixel phones for at least three years. For flagship Samsung Galaxy phones, the software update guarantee is for four years, and for the latest Fairphone 5, it's five years.

Pixel phones are covered for three years of software updates.

Courtesy of Google

There's another important time span to consider though, which is the one for security updates. These updates continue to be issued for older phones even after major software updates have finished, so important vulnerabilities can be patched and phones can be kept safe even if they're no longer getting new and improved features.

For Google and Samsung, security updates are provided for five years, while Fairphone is promising at least eight for the Fairphone 5, and possibly as many as 10. Apple doesn't have a fixed approach but tends to issue security updates for a year or two after software updates have finished—after seven years, Apple products are declared obsolete.

You may be planning to upgrade your smartphone before that happens, but not everyone will be—and knowing how long your device is going to be supported with updates from its manufacturer then becomes very important.

If you're struggling to find out this information about a particular gadget, the web can help—and specifically the endoflife.date site, which lists a whole host of hardware devices and software packages. You can see continually updated countdowns for manufacturer support for iPhones, Pixels, Galaxy phones, and more.

When Security Updates End

Software updates keep your phone properly patched up and supplied with the latest new features. In contrast, security updates make sure that a device stays secure and protected against evolving threats even after software updates have stopped. Which then prompts the question: What happens when security updates end?

To begin with, your device isn't going to suddenly stop working and become a useless brick of electronics. Assuming the components inside it are still functioning—which is by no means a given after five or six years—then you can continue to use the device in the same way that you always have.

As time goes on, you might start to notice a problem with some of your apps: Apps will often need the very latest versions of iOS or Android in order to run, and if you're not getting those updates, they may stop working or start misbehaving, or you may find yourself unable to update to the latest versions.

Security is a bigger problem. There will be some legacy protection in terms of the patches you've applied over the lifetime of the device, but your phone is no longer going to be prepared for newer exploits and malware attacks, and that puts your data at risk.

iOS 17 works on the iPhone 15 Pro—and on iPhones from 2018.

Courtesy of Apple

When mobile security vulnerabilities emerge, you'll find that many of them are aimed at older versions of operating systems, versions that don't have all of the necessary defense measures in place. The more time that goes by since the last security update, the bigger the risk you're running by still using your phone.

Apple, Google, and Samsung will often scramble to fix security issues as they're discovered, pushing out updates outside of the regular schedule in order to keep devices protected—and again, your phone is ineligible for these patches, except under rare circumstances, if you've reached the end-of-life stage.

You can choose to keep on using your phone: The usual practices of being careful with apps and websites, turning on two-factor authentication for your accounts, and keeping the lock screen securely locked all still apply, and offer some level of protection. However, your device is at significantly more risk of an attack.

As expensive as it may be, it might be time to think about upgrading your phone so you keep receiving updates—it doesn't have to be a brand-new one to get the latest iOS or Android software. When you do decide to say goodbye to your old handset, be sure to dispose of it responsibly.

How to Tell When Your Phone Will Stop Getting Security Updates

Plus: Stolen US State Department emails, $20 million zero-day flaws, and controversy over the EU’s message-scanning law.

WIRED broke the news on Wednesday that SoundThinking, the company behind the gunshot-detection system ShotSpotter, is acquiring some assets—including patents, customers, and employees—from the firm Geolitica, which developed the notorious predictive policing software PredPol. WIRED also exclusively reported this week that the nonprofit Electronic Privacy Information Center is calling on the US Justice Department to investigate potentially biased deployment of ShotSpotter in predominantly Black neighborhoods.

As the US federal government inches closer to a possible shutdown, we took a look at the sprawling conservative media apparatus and deep bench of right-wing hardliners in Congress that are exploiting their leverage to block a compromise in the House of Representatives.

Satellite imaging from the Conflict Observatory at Yale University is providing harrowing insight and crucial information about the devastation wrought in the city of Khartoum by Sudan’s civil war. Meanwhile, researchers from the cybersecurity firm eQualitie have developed a technique for hiding digital content in satellite TV signals—a method that could be used to circumvent censorship and internet shutdowns around the world. And the productivity data that corporations have increasingly been gathering about their employees using monitoring software could be mined in an additional way to train AI models and eventually automate entire jobs.

Plus, there's more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

A China-linked hacking group, dubbed BlackTech, is compromising routers in the US and Japan, secretly modifying their firmware and moving around company networks, according to a warning issued by cybersecurity officials this week. The United States Cybersecurity and Infrastructure Security Agency (CISA), the NSA, FBI, and Japan's National Police Agency and cybersecurity office issued the joint alert saying the BlackTech group was “hiding in router firmware.”

The officials said they had seen the Chinese-linked actors using their access to the routers to move from “global subsidiary companies” to the networks of companies’ headquarters in the US and Japan. BlackTech, which has been operating since around 2010, has targeted multiple router types, the officials said, but they highlighted that it compromised Cisco routers using a customized backdoor. “TTPs against routers enable the actors to conceal configuration changes, hide commands, and disable logging while BlackTech actors conduct operations,” the alert says.

Microsoft and US government officials said in July that Chinese government hackers had breached the cloud-based Outlook email systems of about 25 organizations, including the US State Department and Department of Commerce. On Wednesday, an anonymous staffer for Senator Eric Schmitt told Reuters that the State Department incident exposed 60,000 emails from 10 accounts. Nine of the accounts were used by State Department employees focused on East Asia and the Pacific, while one was focused on Europe. The Congressional staffer learned the information in a State Department IT briefing for legislators and shared the details with Reuters via email.

The zero-day market, where new vulnerabilities and the code needed to exploit them are traded for cash, is big business. And it is, maybe, getting more lucrative. Russian zero-day seller Operation Zero this week announced it would increase some of its payments from $200,000 to $20 million. “As always, the end user is a non-NATO country,” the group said, indicating it means Russian private and government organizations.

Unlike bug bounties, where security researchers find flaws in companies’ code and then disclose them to the firms to fix for payments, the zero-day market encourages the trade in flaws that can potentially be exploited by the purchasers. “Full chain exploits for mobile phones are the most expensive products right now and they’re used mostly by government actors," Operation Zero CEO Sergey Zelenyuk told TechCrunch. "When an actor needs a product, sometimes they’re ready to pay as much as possible to possess it before it gets into the hands of other parties.”

The European Union's proposed law to clamp down on child sexual abuse content—by scanning people’s messages and potentially compromising encryption—is one of the continent's most controversial laws of the last decade. This week, a series of revelations from a group of reporters has shown how the law’s main architect was heavily lobbied ahead of proposing the law and that police wanted access to the message data. First, an investigation revealed the close connections between the European Union’s home affairs commissioner, Ylva Johansson, and child protection groups. A second report shows the European police agency Europol pushed to get access to data collected under the proposed law. In response to the investigations, Europe's Committee on Civil Liberties, Justice, and Home Affairs has written to Johansson asking questions about the relationships.

Chinese Hackers Are Hiding in Routers in the US and Japan

Plus: Mozilla patches 10 Firefox bugs, Cisco fixes a vulnerability with a rare maximum severity score, and SAP releases updates to stamp out three highly critical flaws.

Fall is here, but hot zero-day summer shows no signs of cooling down, with the likes of Apple, Microsoft, and Google fixing flaws being used in real-life attacks.

Some major enterprise fixes were released during the month, including a Cisco patch for a vulnerability with a maximum CVSS score of 10.

Spyware has been a prominent trend over the past couple of months, and it’s a threat everyone should take seriously. Attacks can reach devices without any interaction from the user, so it’s important to keep your operating system up to date.

Here’s everything you need to know about the patches issued in September.

Apple iOS and iPad OS

Apple didn’t release any security updates in August, but the iPhone maker sure made up for it in September. First came iOS 16.6.1, an emergency security update released on September 9 to fix two flaws already being used in so-called “zero-click” attacks.

Reported by researchers at the University of Toronto’s Citizen Lab, the vulnerabilities were used to plant spyware via attachments containing malicious images in an iMessage, in an attack the researchers called BLASTPASS.

In mid-September, Apple released its major software upgrade, iOS 17, followed by iOS 17.0.1 a few days later. The surprise iOS 17.0.1 upgrade was important because it fixed another three iPhone flaws being used in spyware attacks.

Tracked as CVE-2023-41992 and reported by security researchers at Citizen Lab and Google, the first issue is a flaw in the kernel that could allow an attacker to escalate privileges. The other two vulnerabilities in WebKit and Security could potentially be chained together to take over a user’s device.

The flaws patched in iOS 17.0.1 were also fixed in the iOS 16.7 release for users of older iPhones or people who don’t want to upgrade to the latest software.

At the end of September, Apple released iOS 17.0.2 to fix some early iOS 17 bugs, and this is the latest version of the software, as of publication.

Apple has also released macOS Sonoma 14 to fix over 60 vulnerabilities.

Google Android

September was a big security month for Google’s Android users, with the monthly patch fixing 33 flaws, including one already being used in attacks. Tracked as CVE-2023-35674, the vulnerability in the framework could allow an adversary to elevate privileges without any interaction from the user. “There are indications that CVE-2023-35674 may be under limited, targeted exploitation,” Google said in its Android Security Bulletin.

Another severe issue is a critical security vulnerability in the system component that could lead to remote code execution with no additional execution privileges needed.

The Android security update has already reached Google’s own Pixel devices as well as Samsung devices, including the Galaxy S23 and S22 series.

Google Chrome

At the end of September, Google updated its Chrome browser after fixing 10 vulnerabilities, one of which was already being exploited by adversaries. Tracked as CVE-2023-5217 and rated as having a high impact, the already-exploited bug is a heap buffer overflow flaw in vp8 encoding in libvpx. “Google is aware that an exploit for CVE-2023-5217 exists in the wild,” the software giant said in an advisory.

The flaw was used in targeted spyware attacks, Google security researcher Maddie Stone later confirmed on Twitter.

Earlier in the month, Google fixed another zero-day flaw, a heap buffer overflow issue initially tracked as CVE-2023-4863, which it thought impacted only the Chrome browser. But two weeks after fixing the issue, researchers discovered it was worse than they thought, affecting the widely-used libwebp image library for rendering images in the WebP format.

Now tracked as CVE-2023-5129, it is thought the bug impacts every application that uses the libwebp library to process WebP images. “The scope of this vulnerability is much wider than initially assumed, affecting millions of different applications worldwide,” security firm Rezilion wrote in a blog.

The security outfit also thinks it is “highly likely” that the underlying issue in the libwebp library is the same issue resulting in CVE-2023-41064—one of the Apple flaws used as part of the BLASTPASS exploit chain to deploy the NSO Group’s Pegasus spyware.

Microsoft

Microsoft’s September Patch Tuesday is one to remember, as it fixed around 65 flaws, two of which are already being exploited by attackers. Tracked as CVE-2023-36761, the first is a Microsoft Word information disclosure vulnerability that could allow NTLM hashes to be exposed.

The second and most severe flaw is a privilege-escalation vulnerability in Microsoft Streaming Service Proxy tracked as CVE-2023-36802. An attacker who successfully exploited this vulnerability could gain system privileges, Microsoft said, adding that exploitation of the flaw has been detected.

Both flaws are marked as important, so it’s a good idea to update your devices as soon as you can.

Mozilla Firefox

Firefox has had a hectic month after Mozilla fixed 10 flaws in its privacy-conscious browser. CVE-2023-5168 is an out-of-bounds write bug in FilterNodeD2D1 affecting Firefox on Windows, rated as having a high impact.

CVE-2023-5170 is a flaw that could result in memory leak from a privileged process. This could be used to effect a sandbox escape if the correct data was leaked, Firefox owner Mozilla said in an advisory.

Meanwhile, CVE-2023-5176 covers memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. “Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code,” Mozilla said.

Cisco

At the start of the month, Cisco issued a patch for a vulnerability in the single sign-on implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform that could allow an unauthenticated, remote attacker to forge credentials to access an affected system. Tracked as CVE-2023-20238, the flaw has been given a maximum CVSS score of 10.

Also this month, Cisco patched a zero-day in Adaptive Security Appliance and Firepower Threat Defense software already exploited in Akira ransomware attacks. Tracked as CVE-2023-20269 and with a medium severity CVSS score of 5, the vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute-force attack to identify valid username and password combinations.

SAP

Enterprise software firm SAP has issued several important fixes as part of its September Security Patch Day. This includes a patch for CVE-2023-40622, an information disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform with a CVSS score of 9.9. “A successful exploit provides information that can be used in subsequent attacks, leading to a complete compromise of the application,” security firm Onapsis said.

CVE-2023-40309 is a missing authorization check issue in SAP CommonCryptoLib with a CVSS score of 9.8. The flaw can result in an escalation of privileges and in the worst case, attackers can compromise the affected application completely, Onapsis said.

Meanwhile, CVE-2023-42472 is an insufficient file type validation flaw in SAP BusinessObjects Business Intelligence Platform with a CVSS score of 8.7.

Apple, Microsoft, and Google Just Fixed Multiple Zero-Day Flaws

A civil liberties group has asked the DOJ to investigate deployment of the ShotSpotter gunfire-detection system, which research shows is often installed in predominantly Black neighborhoods.

The United States Justice Department (DOJ) is being asked to investigate whether a gunshot-detection system widely in use across the US is being selectively deployed to justify the over-policing of mainly Black neighborhoods, as critics of the technology claim.

Attorneys for the nonprofit Electronic Privacy Information Center—a leading US-based civil liberties group—argue that “substantial evidence” suggests American cities are disproportionately deploying an acoustic tool known as ShotSpotter in majority-minority neighborhoods. Citing past studies, EPIC alleges that data derived from these sensors has encouraged some police departments to spend more and more time patrolling areas where the fewest number of white residents live—an allegation disputed by SoundThinking, the system’s manufacturer.

In a letter today to Merrick Garland, the US attorney general, attorneys for EPIC call for an investigation into whether cities using ShotSpotter are running afoul of the Civil Rights Act—namely, Title VI, which forbids racial discrimination by anyone who receives federal funds.

“State and local police departments around the country have used federal financial assistance to facilitate the purchase of a slew of surveillance and automated decision-making technologies, including ShotSpotter,” EPIC says. Despite mounting evidence of ShotSpotter’s discriminatory impact, there is no indication that its Title VI compliance has ever been seriously assessed. 

A spokesperson for SoundThinking says a statement by the company is forthcoming.

ShotSpotter has been deployed in more than 150 cities in the US, according to the company. It relies on internet-connected acoustic sensors, often attached to utility poles, and aims to detect gunfire using machine algorithms. SoundThinking says “acoustic experts” are on staff around the clock to review alerts and “ensure and confirm that the events are indeed gunfire.” The company claims its sensors have a 97 percent accuracy rate, disputing reports that alerts triggered by fireworks and other high-impact sounds affect the system’s accuracy.

EPIC is urging the DOJ to consider research that suggests ShotSpotter has produced “tens of thousands of false alerts” while simultaneously being deployed “in predominantly Black neighborhoods.” One such study, launched by the city of Chicago’s inspector general in 2021, noted that the “frequency of ShotSpotter alerts in a given area may be substantively changing policing behavior.” The agency concluded that, despite the city’s investment of $23-33 million, ShotSpotter alerts “rarely produce evidence of a gun-related crime, rarely give rise to investigatory stops, and even less frequently lead to the recovery of gun crime-related evidence during an investigatory stop.”

News investigations in Ohio and Texas have similarly raised doubts about the system's effectiveness, revealing that in some cases its alerts have delayed responses to 911 calls. Working to expand the use of ShotSpotter in Houston in late 2020, the city also green-lit a pilot program that saw sensors deployed across two areas where communities are between 80 and 95 percent people of color.

EPIC is pressing Garland to investigate whether local law enforcement agencies have used federal grant money to buy ShotSpotter, and if so, ascertain whether those grants conformed with Title VI. Moreover, EPIC is seeking new guidelines for funding systems designed to automate police work: rules to ensure such arrangements are “transparent, accountable, and nondiscriminatory.” The attorney general should take additional steps, EPIC says, to ensure agencies dispersing federal funds are careful to assess whether tech companies meet “minimum standards of nondiscrimination” and that new police technologies are not only justified but necessary to achieve a “defined goal.”

The attorney general’s office did not immediately respond to a request for comment.

Ron Wyden, a leading privacy hawk in the US Senate, tells WIRED that he planned to urge Garland to adopt EPIC’s recommendations.

“There is more than enough evidence at this point to conclude that technologies like ShotSpotter do essentially nothing to stop crime,” Wyden says, “but instead have a well-documented discriminatory impact on marginalized and vulnerable communities.”

A spokesperson for SoundThinking told WIRED earlier this week that ShotSpotter has previously implemented safeguards meant to improve “impartiality” with regard to patrols, as well as other features designed to curb over-policing. The algorithms that drive patrol recommendations use “objective, noncrime data that mitigates potential bias,” the company said, adding that no personally identifiable information is used to determine where patrols are sent.

WIRED reported yesterday that SoundThinking has been quietly acquiring parts of Geolitica—formerly known as PredPol—the maker of an eponymous “predictive policing” tool. Researchers and critics have accused PredPol of perpetuating racial biases in policing by recycling historic crime data that was built on discriminatory police practices.

The danger, critics say, is that data- and AI-driven policing may prove an effective tool for “laundering” racist police conduct, granting it a veneer of scientific authority.

In 2021, Gizmodo and The Markup coauthored an investigation into PredPol and found that in many cases PredPol’s predictions predominantly targeted Black and Latinx residents. In a majority of the jurisdictions where the tool was being used, PredPol had urged police to mainly patrol neighborhoods in which the cities’ poorest people reside. ( The authors of this story were also members of the team that previously investigated PredPol, and EPIC cites the investigation and another Gizmodo report by an author of this story in its letter.)

“The possibility that ShotSpotter data would be an input for predictive policing tools raises yet another huge red flag,” says Chris Baumohl, an EPIC law fellow. “ShotSpotter has well-documented accuracy issues, and its sensors are placed based on historical crime data, baking in discriminatory policing patterns. Laundering this ‘dirty data’ through predictive policing tools only compounds this discriminatory impact.”

Following the Gizmodo-Markup investigation into PredPol, the Justice Department conceded in 2022 that it was unaware of how often the government was helping local police acquire “predictive policing” technology. For this purpose, it said, the DOJ has no “specific records” of how federal funding is used.

US Justice Department Urged to Investigate Gunshot Detector Purchases

SoundThinking is purchasing parts of Geolitica, the company that created PredPol. Experts say the acquisition marks a new era of companies dictating how police operate.

SoundThinking, the company behind the gunshot-detection system ShotSpotter, is quietly acquiring staff, patents, and customers of the firm that created the notorious predictive policing software PredPol, WIRED has learned.

In an August earnings call, SoundThinking CEO Ralph Clark announced to investors that the company was negotiating an agreement to acquire parts of Geolitica—formerly called PredPol—and transition its customers to SoundThinking’s own “patrol management” solution.

“We have already hired their engineering team,” Clark said during the call, a transcript of which is public. He added that the acquisition of patents and staff would “facilitate our application of AI and machine learning technology to public safety.”

SoundThinking’s absorption of Geolitica marks its latest step in becoming the Google of crime fighting—a one-stop shop for policing tools. Experts who study law enforcement use of technology say the bundling of two controversial technologies signals a new era for the cop-tech industry and has the potential to shape the future of policing in the United States. And while SoundThinking has rebranded “predictive policing” as resource management for police departments, a WIRED analysis of one of the company’s apps found that crime-forecasting technology remains one of its key offerings.

“As a moment of tech history, the purchase is significant,” Andrew Ferguson, an American University law professor and author of _The Rise of Big Data Policing_, tells WIRED. “We are in a consolidation moment with big police tech companies getting bigger, and this move is one step in that process.”

PredPol was one of the first, and perhaps the most widely used, predictive policing algorithms in the United States. Its name, a portmanteau of “predictive policing,” became synonymous with the practice.

The software was developed in 2011 and uses historical crime incident reports to produce daily predictions for where future crime is likely to occur. For years, critics and academics have argued that since the PredPol algorithm relies on historical and unreliable crime data, it reproduces and reinforces biased policing patterns. In December 2021, Gizmodo and The Markup analyzed millions of Geolitica’s crime predictions that were discovered on an unsecured server and found that the software disproportionately—and often relentlessly—targeted low-income communities of color for additional patrols.

In recent years, police departments have dropped PredPol after ultimately finding it ineffective. In 2019, a report by the Los Angeles Police Department’s inspector general found that it was unclear whether PredPol had any effect on crime trends. The LAPD, which was the earliest adopter of PredPol, and had even partnered with researchers to develop the technology, dropped the product in 2020, citing budget costs.

Brian MacDonald, the CEO of Geolitica, declined an interview and did not answer specific questions about the acquisitions. A third-party spokesperson for SoundThinking, Rob Merritt, tells WIRED that Geolitica is ceasing operations at the end of the year.

Consolidation Game

Founded in 1996, SoundThinking is now worth around $232 million. Its flagship product, ShotSpotter, is a gunshot-detection system that uses microphones mounted on traffic signals and light poles to detect and locate possible gunfire sounds. For years, activists and academics around the US have fought against the expansion of ShotSpotter, claiming that it is not only inaccurate but is deployed disproportionately in non-white neighborhoods.

Two investigations by local media—_The Houston Chronicle_ and Southwest Ohio’s WYSO—found that ShotSpotter alerts largely resulted in dead ends for police and, in some cases, delayed response times for other calls for service. In 2021, the MacArthur Justice Center at the Northwestern University School of Law analyzed records kept by Chicago’s Office of Emergency Management and Communications over a two-year period and found that 89 percent of ShotSpotter alerts in the city did not lead to police finding evidence of a gun-related crime.

SoundThinking, Maker of ShotSpotter, Is Buying Parts of PredPol Creator Geolitica

Egged on by a far-reaching conservative media ecosystem, right-wing hardliners are forcing Washington to bend to their reality as the federal government careens toward a possible shutdown.

washington’s biggest problem these days isn’t partisanship. It’s that far-right lawmakers are living in their own reality.

Extremist Republicans have broken off from the rest of their party to create an alternate universe in which they’re in charge, empowered by Donald Trump’s followers. This disconnect is fueling an internal GOP fight in the US House of Representatives that has the federal government careening toward a shutdown at midnight on Sunday, October 1. As he claws and scrapes in an attempt to negotiate federal spending legislation, House Speaker Kevin McCarthy seems to be realizing that his rank-and-file Republicans now occupy a different universe than everyone else.

“This is a whole new concept of individuals that just want to burn the whole place down,” an exasperated McCarthy told the congressional press corps last week. “That doesn’t work.”

McCarthy’s far-right foes say their bomb-throwing ways are working. They’re being rewarded in kind. With the fifth slimmest majority in history, McCarthy can afford to lose only four GOP votes. If he reaches across the aisle, his speakership will likely be challenged. While his Republican agitators don’t have any replacement waiting in the wings, the speaker hasn’t dared negotiate with Democrats.

The meme-centric culture that swept former president Donald Trump into power is now increasingly mainstream in the Republican Party. On the surface, McCarthy’s struggle is to persuade an estimated seven to 10 conservatives to avert a government shutdown. In reality, the speaker’s battling against a nameless army of tens of thousands of angry antiestablishment voices whose frustrations have increasingly become Republican orthodoxy and mirrored by the powerhouses of conservative media—many of whom remain niche figures, even as they’re followed by hundreds of thousands of fans.

“We’re beyond the alt-right and the fringe-right. The fantasy-right is making policy,” former Virginia congressman Denver Riggleman tells WIRED. “It’s the fantasy-right. It is a cult. It is a religious belief system. It is a way of living. It’s that simple. It is the party.”

McCarthy’s paradox is the same one facing the Republican Party and America’s two-party system as a whole: Which reality does he govern in? While he campaigned for Speaker of the House with Trump’s backing, will he—can he—govern from Planet Trump? Like all party leaders who preceded him, McCarthy is tasked with leading a diverse, divided, yet ultimately _United_ States. That’s dismissed as “normie” nonsense in Trump’s angry, amped, and very online GOP. A few of Trump’s biggest supporters in Congress, some of which have more social media followers than the speaker himself, are demanding McCarthy embrace their new minority-rule vision for America.

Under Trump, the far-right Freedom Caucus proved loyal lieutenants who held the line for his border wall funding for 34 days on Capitol Hill. That period stretched from the waning days of Paul Ryan’s speakership in December 2018 through the kickoff of Nancy Pelosi’s second act as speaker in January 2019—and holds the dubious record as the US’s longest shutdown in history. It ended without Trump getting his wall. But the former president has also remade the Republican Party in his own image, one that party leaders have tried to mirror, remaking themselves in the process. Since recapturing the House, Trump’s ranks of loyal soldiers in Congress have expanded. Still a relatively small band, they’re emboldened now, especially since Trump indictments stacked up this summer.

“Congress is in charge of money and everything for the government, and Congress should be in charge of funding special counsels. Those are my red lines,” Marjorie Taylor Greene, the Georgia Republican, told a group of congressional reporters.

Greene’s other top demand is impeaching President Joe Biden. McCarthy has already launched an inquiry. With Trump polling popularly in the GOP, McCarthy and other Republican leaders continue to float along as the party moves rightward.

“It’s polling. They’re willing to absolutely destroy their own integrity \[and\] have no moral baseline in order to spout cross-tabs from a poll,” says Riggleman, a former member of the Freedom Caucus.

McCarthy’s been trying to negotiate around the impasse using the traditional means of persuasion and promises. He may be negotiating with the wrong people, though, because today’s rank-and-file serve different masters. These days, what was once confined to 4chan has become normalized in the GOP, with some elected officials on the new right seemingly fine with torching the party as the internet has demanded. Social media screens have come to life on Capitol Hill in part because MAGAism is now packaged as a lifestyle.

There are right-wing alternatives to seemingly everything. Patriot Mobile boasts being “America's only Christian conservative wireless provider.” Tusk Search is an alternative to Google, labeling itself a “free speech web browser with \[an\] anti-censorship newsfeed.” Public Square directs conservatives to “patriotic businesses” and has become the go-to app for Republicans like Donald Trump Jr., who also launched MxM News, an alternative news aggregator for Republicans, earlier this year. The Right Stuff, a dating app, aims to Make Conservatives Sexy Again. Owning the libs, and the establishment, has morphed into an identity.

Those ventures are all pushed by the stars of today’s new conservative media universe, which includes the likes of anti-politically-correct online spaces, like Truth Social, Rumble, and Parlor. Elon Musk’s makeover of Twitter (now X) into his personal selective-free-speech-absolutist site has made it feel like a safe place for many of those who used to hide in the shadows.

Over the weekend, former Trump strategist Steve Bannon had Colorado congresswoman Lauren Boebert on his show _War Room_, which now airs live on Newsmax, and thanked his audience for empowering her and other Freedom Caucus members during their time on Capitol Hill.

“You are also part of this fight. You’re just not some passive person listening to talk radio or watching some TV or streaming,” Bannon encouraged his audience. “No, you’re actually part of this, and we know you are because you’re kind of the driving force in this. You’re the protagonist, this audience.”

With a supportive audience outside of Washington, DC, Boebert’s not looking for ways to help her party while she’s there. That was on display when she and other Freedom Caucus members held out their support for McCarthy’s speakership in January, gleefully turning the routine start of a Congress into a 15-round slugfest that ended with them obtaining a myriad of McCarthy promises—from a vote on term limits to releasing the January 6, 2021, Capitol footage publicly. The demands have only expanded since then.

“We were called domestic terrorists by members of our own party, simply by wanting reforms in Congress,” Boebert told Bannon. “No one likes the way Congress operates, and so my colleagues and I took a stand—a 15-round stand—to make fundamental historic changes to the way this place operates, and right now we are at the breaking point on one of those promises that we said needed to be kept.”

What “reality” means on the right largely depends on which social and media ecosystems one inhabits, even as the party is more unified than ever in its anti-Biden fever.

If you tuned in to most Fox News shows last week, the government funding battle probably seemed like an afterthought, if it made the cut at all. Instead, viewers were bombarded with stories of an “invasion” at the southern border.

Some Fox News hosts like Sean Hannity are pro-shutdown. “Take a stand,” he encouraged House Republicans on his radio show on September 19, while others, like host Laura Ingraham, make taking a stand against Biden and Senate majority leader Chuck Schumer the only moral option. As Ingraham casually told viewers last week, Democrats “hate America so much—our tradition, our history, our culture—that they prefer to start over with millions of poor migrants.”

The rightward shift has been decades in the making. Former congressman Tom Davis, a Republican from northern Virginia, was first sent to Washington in 1995. Then-speaker Newt Gingrich and the GOP had just recaptured the House for the first time in 40 years. “You didn’t even have Fox in 1995. It has fragmented everything. You’re in a world now where bad behavior gets rewarded, where Marjorie Taylor Greene raises more money than a committee chairman because she raises it online,” Davis tells WIRED. “That’s the problem, and it makes governance very hard.”

Republicans also controlled the Senate in 1995. The party was itching for a fight then, after having endured a political drought that stretched from 1955 through 1995. “It was unified at that point,” Davis says. “Everybody wanted the same thing, and Republicans decided to stay together, and that’s how we were.”

The tides turn quickly in today’s GOP. After he officiated a former staffer’s same-sex marriage, Riggleman, the libertarian-leaning former Freedom Caucus member from Virginia, lost his seat in a nationalized local primary that overflowed with distortions and lies. The vitriol was fueled, in part, by QAnon, whose members targeted Riggleman after he spoke out against far-right conspiracy theorists.

“Disinformation has a better return on investment than any other data-specific type of activity. I think it’s massive,” Riggleman says. “I experienced it. I mean, if you think about what happened to me, they won. QAnon beat me … Bad guys win, and they don’t think they’re the bad guys.”

A former US intelligence official, Riggleman was tapped by the special January 6 committee to be a senior technical adviser, helping to scour the recesses of the dark (and not-so-dark) web for any digital chatter the FBI might have missed in the lead-up to the attack on the Capitol. He has since launched the Riggleman Information and Intelligence Group, which advertises itself as a “boutique firm specializing in open source intelligence and e-discovery.”

One of Riggleman’s first clients was Hunter Biden, the president’s legally beleaguered son, whose team sought Riggleman’s services because they wanted to understand where the unrelenting streams of digital accusations, threats, memes, and falsehoods were coming from. Many of the same accounts hammering Hunter Biden have been encouraging this small band of House Republicans to go to war with their own party leaders.

“These people are nuts,” Riggleman says. “And, by the way, crazy has more energy than sanity.”

After losing his seat and watching the Capitol be overrun on January 6, Riggleman says there’s no time for passivity and patience.

“You need to go after the disinformation, and you need to have people brave enough to call it out,” Riggleman says. “Because I don't want to get rid of the First Amendment, but if people are using the First Amendment for danger, weaponization, and stupidity, the people who are sane need to use their First Amendment \[rights\] as a wrecking ball. You gotta destroy these people.”

Risk of a US Government Shutdown Is Fueled by Very Online Republicans

As civil conflict continues in and above the streets of Khartoum, satellite images from the Conflict Observatory at Yale University have captured the catastrophic damage.

On Thursday, the head of the Sudanese Army, Abdel Fattah al-Burhan, addressed the United Nations General Assembly in New York City, asking for increased aid from the international community for Sudan and condemning the paramilitary groups that he says “have killed, looted, raped, robbed, and seized citizens’ homes and properties, and destroyed infrastructure and government buildings.” Since April, the country has been gripped by a civil conflict between the government and the Rapid Support Forces (RSF), a rebel group backed by the Russian mercenary company, the Wagner Group. At the beginning of the week, ahead of the General Assembly, a group of 50 human rights and humanitarian organizations published an open letter urgently calling for the UN Security Council to address the crisis in Sudan.

A new report from the Conflict Observatory at Yale University has used satellite imagery and open source investigative tools to chart the catastrophic damage caused by fighting in the capital city of Khartoum. Open source imagery has been particularly hard to come by in Sudan, due in part to power and telecom blackouts, which makes it hard to assess the full extent of the damage caused by the conflict.

The Conflict Observatory, a US-government-backed initiative between Yale University’s Humanitarian Research Lab, the Smithsonian Cultural Rescue Initiative, PlanetScape AI, and the mapping software Esri, has identified at least five explosions that took place within the city, including attacks that damaged a market and a hospital and which researchers estimate have left hundreds of people dead. At least one of the explosions—the attack on the market—was most likely caused by a drone strike.

Photograph: Maxar Technologies

Government forces have acquired Turkish Bayraktar drones, while the RSF has been using commercial unmanned aerial vehicles (UAVs) likely sourced from Russia, according to Nathaniel Raymond, a coleader of the Humanitarian Research Lab and lecturer at Yale’s Jackson School of Global Affairs.

“Welcome to the new world order,” says Raymond. “All conflicts are now shaped by the use of UAVs by state and nonstate actors.”

Most of the aerial strike damage that the Conflict Observatory found appears to have been attributed to the Sudanese Armed Forces (SAF), though both sides have released statements accusing the other of attacks on various locations. The RSF, headed by Mohamed Hamdan Daglo, known as Hemedit, has also been receiving weapons, including drones, from Wagner for months. The mercenary group has forces stationed across the border in eastern Libya. Though technically a private company, Wagner has been an integral part of Russia’s assertion of military and foreign power overseas, particularly in Africa. A recent convoy carrying Russian weapons to the RSF crossed into Sudan via Chad on September 6.

Violence has been steadily worsening in Sudan since April, when negotiations meant to return the government to civilian rule broke down. Al-Burhan has been the country’s de facto ruler since a coup in 2021, following the ouster of the country’s president Omar al-Bashir in 2019. A key tension point was around whether and how quickly the RSF’s 100,000-person force would be absorbed into the Sudanese military. On April 15, the RSF launched an assault on Khartoum. Fighting escalated in Khartoum on September 16, with images of the city’s Greater Nile Petroleum Oil Company Tower skyscraper engulfed in flames circulating widely on X (formerly known as Twitter). But Raymond says that the attacks also seem to have hit two Ministry of Justice buildings, including the headquarters of the Internal Security Services.

Photograph: Maxar Technologies

“The fighting in Khartoum has significantly escalated, including indiscriminate bombardment,” says Raymond, who adds that drones have become “increasingly part of SAF’s element” and notes an official transfer of Turkish Bayraktars to the SAF. The human cost of the brutal conflict has only increased as more of the fighting—including airstrikes—has taken place in densely populated areas. The report estimates that at least 2,875,125 civilians from Khartoum State are now displaced.

Data from Action on Armed Violence (AOAV), a UK-based nonprofit that tracks armed violence against civilians around the world, found that markets and residential areas were particularly likely to be affected by explosive air strikes.

“The IED that haunted the battlefields of Afghanistan, Iraq, and Syria is now becoming airborne,” says Iain Overton, executive director at AOAV.

“When you begin to use … whether it’s Turkish drones or other aerial assaults that are promised in the halls of arms as being precise and proportionate, the end result is imprecision and disproportionate,” says Overton. “These weapons are then sold to militaries and groups that often have very poor human rights records in the first place. And then they go and use them in some scenarios that almost invariably will cause civilian casualties.”

Satellite Images Show the Devastating Cost of Sudan’s Aerial War

Corporations are using software to monitor employees on a large scale. Some experts fear the data these tools collect could be used to automate people out of their jobs.

You’ve probably heard the story: A young buck comes into a new job full of confidence, and the weathered older worker has to show them the ropes—only to find out they’ll be unemployed once the new employee is up to speed. This has been happening among humans for a long time—but it may soon start happening between humans and artificial intelligence.

Countless headlines over the years have warned that automation isn’t just coming for blue-collar jobs, but that AI would threaten scores of white-collar jobs as well. AI tools are becoming capable of automating tasks and sometimes entire jobs in the corporate world, especially when those jobs are repetitive and rely on processing data. This could affect everyone from workers at banks and insurance companies to paralegals and beyond.

Carl Frey, an economist at Oxford University, coauthored a landmark study in 2013 that claimed AI could threaten nearly 50 percent of US jobs in the coming decades. Frey says that he doesn’t think new AI tools like ChatGPT are going to automate jobs in this way because they still require human involvement and are often unreliable. Still, many of the underlying factors that were outlined in that paper remain pertinent today. Considering the rapid pace at which AI is advancing, it’s hard to predict how it could soon be utilized and what it will be capable of.

Then there’s the issue of how it’s being incorporated into daily work and how it’s being trained. Enter corporate spyware, invasive monitoring apps that allow bosses to keep close tabs on everything their employees are doing—collecting reams of data that could come into play here in interesting ways. Corporations, which are monitoring their employees on a large scale, are now having workers utilize AI tools more frequently, and many questions remain regarding how the many AI tools that are currently being developed are being trained.

Put all of this together and there’s the potential that companies could use data they’ve harvested from workers—by monitoring them and having them interact with AI that can learn from them—to develop new AI programs that could actually replace them. If your boss can figure out exactly how you do your job, and an AI program is learning from the data you’re producing, then eventually your boss might be able to just have the program do the job instead.

“When it comes to monitoring workflows, I do think that’s going to be a way we automate a lot of this stuff,” Frey says. “What you might be able to do is take some of those foundational models and train them on some of the data you have internally and fine-tune them, or you could train a model from scratch just with your internal data.”

David Autor, a professor of economics at MIT, says he also thinks AI could be trained in this way. While there is a lot of employee surveillance happening in the corporate world, and some of the data that’s collected from it could be used to help train AI programs, simply learning from how people are interacting with AI tools throughout the workday could help train those programs to replace workers.

“They will learn from the workflow in which they’re engaged,” Autor says. “Often people will be in the process of working with a tool, and the tool will be learning from that interaction.”

Whether you’re training an AI tool directly by interacting with it throughout the day, or the data you’re producing while you work is simply being used to create an AI program that can do the work you’re doing, there are multiple ways in which a worker could inadvertently end up training an AI program to replace them. Even if the program doesn’t end up being incredibly effective, a lot of companies might be happy with an AI program that’s good enough because it doesn’t require a salary and benefits.

“I think there are a lot of discretionary white-collar jobs where you’re kind of using a mixture of hard information and soft information and trying to make advanced decisions,” Autor says. “People aren’t that good at that, machines aren’t that good at that, but probably machines can be pretty much as good as people.”

Autor says he doesn’t see a “labor market apocalypse” coming. Many workers won’t be entirely replaced but will simply have their jobs changed by AI, Autor says, while some workers will certainly be made redundant by advancements in AI. The problem there, he says, is what happens to those workers after they’re no longer able to find a well-paying job with the education and skill sets they have.

“It’s not that we’re going to run out of work. It’s much more that people are doing something they’re good at, and that thing goes away. And then they end up doing a kind of generic activity that everybody’s good at, which means it pays very little—food service, cleaning, security, vehicle driving,” Autor says. “These are low-paying activities.”

Once someone’s automated out of a well-paying job, they can end up slipping through the cracks. Autor says we’ve seen this happen in the past.

“The hollowing out of manufacturing and office work over the past 40 years has definitely put downward pressure on the wages of people who would do that type of work, and it’s not because they’re doing it now at a lower rate of pay. It’s because they’re not doing it,” Autor says.

Frey says politicians will need to offer solutions to those who fall through the cracks to prevent the destabilization of the economy and society. That would likely include offering social safety net programs to those affected. Frey has written extensively on the effects of the first Industrial Revolution, and he says there are lessons to be learned there. In Britain, for example, there was a program called the Poor Laws, where people who were harmed by automation were given financial relief.

“What you see back then is a lot of social unrest. Wages are stagnant or falling for a large part of the population. You have riots,” Frey says. “If you look at the places where the Poor Laws were more generous, there was less social unrest and less upheaval. Using welfare systems to compensate people who lose out is something we’ve done for a long time and should continue to do.”

Many people would also benefit from being retrained for other work, but Autor says the US has never been very good at retraining people, so there’d have to be some work done to create effective retraining programs. He says technology might actually be able to help there because people could be retrained using helpful new digital tools.

There was a lot of hype surrounding ChatGPT and similar AI tools when they came out. That hype has since died down a bit, suggesting to some that maybe these tools won’t be as useful as they were promised to be. Perhaps they won’t be taking everybody’s jobs. However, at the rate at which AI is advancing, there’s no saying where things could be in five to 10 years—or even next year.

Vincent Conitzer, a professor of computer science at Carnegie Mellon University, says people shouldn’t underestimate what these AI tools may soon be capable of. They may be somewhat limited in their use now, but that could change relatively rapidly and end up being as disruptive as some have warned it could be.

“I worry about this being a ‘boiling frog’ kind of scenario, where we see amazing advances in AI but then don’t immediately see them take over people’s jobs, and \[people\] conclude there wasn’t all that much to worry about, and we accept the new technology as the new normal but not all that impressive after all,” Conitzer says. “Meanwhile, gradually but quickly, the world and the job market do adjust to the new technologies in complex ways, and at some point we realize large societal problems have emerged.”

Your Boss’s Spyware Could Train AI to Replace You

With the number of internet blackouts on the rise, cybersecurity firm eQualitie figured out how to hide censored online news in satellite TV signals.

All over the world, walls are going up around the internet.

For years, autocratic regimes have been in a race to heighten those walls, as their citizens develop taller and taller ladders. The more they filter and block, the more their citizens come up with clever technical solutions to access the uncensored truth. There is mounting evidence, however, that repressive regimes are opting to just shut down access to the open internet entirely—and that such blackouts could become permanent.

A team of cybersecurity researchers believe they have come up with a clever new way to fight back: a trojan horse. Specifically, a satellite feed designed to look like a television station, which actually carries a payload of uncensored news and information. It’s a particularly retro solution to a very modern problem.

The program, dubbed eQsat, has been tested and is ready to be put into action during the next internet shutdown—whether it’s in Russian-occupied Ukraine, Iran, or one of the many repressive regimes that regularly block internet access.

The cybersecurity firm behind the program, eQualitie, has spent years developing tools designed for civil society in countries with aggressive internet filtering. Its mobile browser, Ceno, connects users to the open internet and serves content peer-to-peer. When a particular website is blocked or throttled, Ceno grabs a copy of the website supplied by another user who can access the site normally.

Ceno’s weakness—like all peer-to-peer services—is that it still requires some connection to the outside world to deliver blocked content. During a total shutdown, Ceno’s peer-to-peer connections are severed as well.

There are some unreliable solutions to this problem. In some cases, mobile internet or Wi-Fi can be broadcast into an area experiencing an internet shutdown—there have been plans to try to broadcast a cellular or Wi-Fi signal from Finland into Russia, for example. In North Korea, balloons with USB keys attached bring news and entertainment into one of the most heavily censored countries in the world.

But cell signals can be jammed, Starlink terminals can be triangulated, and balloons can be intercepted. The best way to deliver information into a closed country without being caught or thwarted, Jason Roks tells WIRED, is steganography: the act of camouflaging information inside another message. And eQsat is the answer to the question “How do you blend in the most?”

Roks and the team at eQualitie rented space on commercial satellites and began broadcasting their own television channel to countless home satellite receivers throughout Asia and Africa. But should anyone be flipping through the channels, the eQualitie station will be static or color bars. Anyone who records the channel to a USB key, however, would discover that one of the audio tracks is, in fact, a compressed file. Extracted on a computer, it reveals a wealth of information.

“So this is a mechanism we developed to replenish from the outside,” Roks says. “We partnered with dozens of news organizations to, basically, take a snapshot of their websites and—very much like Internet Archive, the Wayback Machine—we keep a version of their site. And we update them daily, quarterly, whatever that basis is. And that works out to about, all those sites for Russia and Ukraine, about a gig and a half of data.” That data, once extracted, can be fed into the BitTorrent network, and can update the cache for their Ceno browser.

Source

Wired