The gray market for abortifacient sales to the US is evolving alongside a shifting legal landscape.

If you search for the phrase “abortion pills” on the messaging service Telegram, an array of public channels and groups pop up. Some have names like “Buy Abortion Pills” or “Abortion pills Mifepristone Misoprostol” while others offer advice on symptoms and best practices “after the pregnancy comes out.” On May 3, a post on “ABORTION PILLS MARKET” included a photo of a blister pack labeled as abortion pills, alongside the caption, “We are legit.”

There are currently more than 200 public groups and channels on Telegram that explicitly mention selling abortion pills in their name or description, a WIRED investigation found. At the end of May, the last month for which we have complete data, 57 of the 211 groups we uncovered were active, with at least one message sent in that month.

Activity found on the platform related to selling abortion pills traces back to at least 2016, and many of the channels and groups cater to customers around the world. In the year since the US Supreme Court overturned _Roe v. Wade_ in June 2022, though, there’s a new focus on marketing to people in the United States, according to WIRED’s review of roughly 47,000 public messages scraped from these channels. And in general, public activity on Telegram related to abortion pills has been exploding since last summer.

Telegram did not immediately return WIRED's request for comment about the sale of abortifacients or other drugs on the platform.

Shady drug sellers and scams are nothing new on digital platforms. A nearly universal experience of the early consumer internet, after all, was receiving spam emails claiming to offer penis enlargement pills. And in the decades since, dark web markets have fueled illegal distribution of drugs globally. Like other prescription drugs, though, abortifacients are legal in some countries but not others. Furthermore, in some places they can be prescribed for certain purposes but not others, leaving patients to potentially seek ways to fill in the gaps for their own care. In the US, access to reproductive care, including abortifacients, varies widely from state to state.

Despite the clear uptick in activity on Telegram related to abortion pills, researchers say that they don’t see evidence of a massive new movement to illegally sell abortifacients to Americans. Kat Green, an abortion access researcher and founder of the online data analysis platform Endora, says that illegal sales of abortifacients, and corresponding questions about legitimacy and safety, aren’t currently central topics in US abortion access work. In part, this is likely because it’s still legal in many US states for patients to get abortion pills by mail. And prescribed use of these pills, also known as medication abortion, is markedly on the rise in the US. But as new and pending legal challenges threaten to further curtail access, illicit sales could eventually expand.

Analysis of frequently used phrases in the Telegram message trove WIRED collected shows that a large number of these groups and channels don’t just claim to sell abortion pills. Phrases like “weight loss,” “muscle mass,” and “erection pill” were among the 10 most popular two-word phrases that appeared in the data set. And thousands of additional messages mentioned “benzos,” “painkillers,” “Xanax,” “weed,” “coke,” and “guns.” In all, at least a quarter of the channels appear to be hawking more than just abortifacients.

Hundreds of messages from the data that contained pricing information indicate that the average cost of purchasing a purported pack of abortion pills on Telegram is currently $135.

WIRED’s investigation also indicates that the abortion pill ecosystem on Telegram is likely a small world. Analysis of the members and administrators who send messages in the groups and channels shows that many of the accounts are likely controlled by the same individuals. For example, a user going by the name Dr. Pooja Gupta has sent 1,500 messages across nine channels or groups advertising the sale of abortion pills. Dr. Pooja uses a WhatsApp number that is referenced by administrators in 14 additional channels. And some of them use similar names like Doctor Jain and Doctor Reenu. Many of these messages also referenced the same website.

After joining several of Dr. Pooja Gupta’s channels, WIRED reporters received a private Telegram message from a user known as Manisha Gupta offering medication abortion for $90. When WIRED reporters expressed interest in making a purchase, a person prepared the order and sent an image showing a blister pack of pills, and an envelope with that day's date as well as the address WIRED provided for shipment. The return address written on the envelope was a location in Mumbai, India.

Still messaging on Telegram, a person then sent account information for Punjab National Bank and directed WIRED to submit payment through a service called Remitly. WIRED reporters did not complete the transaction. When asked whether they have had more US-based customers in recent months, the person said, “since new laws I am send to America much more.”

Some groups on Telegram have US-specific names or descriptions, like “Abortion Pills in Republican States,” but most have more generic names and claim to deliver to dozens of countries. For instance, one of the largest and most active channels in the data set dates from August 2021 and is apparently specifically geared toward delivering abortion pills to Dubai, Kuwait, Qatar, and the Philippines—all countries where legal access to abortion is restricted.

Last June, researchers from the security firm DarkOwl noticed a sharp increase in discussions on the dark web about connecting abortion-seekers in the US with abortifacients and other resources. Some vendors that already sold illegal drugs said they would begin selling medication abortion as well. At the time, though, the researchers said that they didn’t actually see abortion pills widely available for sale on most dark web markets, but that “they are available for purchase via threads in discussion forums, as well as classified-style advertisements on transient paste services.”

Ian Gray, director of analysis and research at the security firm Flashpoint, says that turning points like the Covid-19 pandemic or the fall of _Roe_ for the US can spark trends in digital scams and illicit online sales. But a survey Gray conducted for WIRED of dark web advertising targeted at the US over the last year did not reveal a dramatic spike in content related to abortifacients.

“At a high level, it's difficult to identify a significant increase in chatter related to abortion pills due to _Roe v Wade_ being overturned last year,” Gray says. He notes, though, that “there are a limited number of posts within the past year in marketplaces, which may indicate demand. Most posts, at least on Twitter and some within Telegram, are in Brazilian Portuguese, likely due to a ban on abortion pills.”

As with many medical procedures, the stakes are extremely high in medication abortion. But the patchwork of laws and access in the US could make the landscape particularly fraught for patients in need who may eventually turn to illicit markets out of desperation.

Inside the Illicit Market for Abortion Pills on Telegram

Newly released documents highlight the bureau's continued secrecy around cell-site simulators—spying tech that everyone already assumes exists.

United States government records recently obtained by the American Civil Liberties Union show that state and local police authorities are continuing to trade silence for access to sophisticated phone-tracking technologies loaned out by the Federal Bureau of Investigation. To protect the secrets of the technology, documents show, police departments will routinely agree, if necessary, to drop charges against suspects who've been accused of violent crimes.

The documents, handed over by the FBI under the Freedom of Information Act, include copies of nondisclosure agreements signed by police departments requesting access to portable devices known as cell-site simulators, otherwise known by the generic trademark “Stingray” after an early model developed by the Harris Corporation. The FBI requires the NDAs to be signed before agreeing to aid police in tracking suspects using the devices. Stipulations in the contracts include withholding information about the devices, they're functionality, and deployment from defendants and their lawyers in the event the cases prove justiciable.

Legal experts at the ACLU, Laura Moraff and Nathan Wessler, say the secrecy requirements interfere with the ability of defendants to challenge the legality of surveillance and keep judges in the dark as to how the cases before their court unfold. “We deserve to know when the government is using invasive surveillance technologies that sweep up information about suspects and bystanders alike," Moraff says. “The FBI needs to stop forcing law enforcement agencies to hide these practices.”

A key function of cell-site simulators is to masquerade as a cell tower in order to identify nearby networked devices. This hack works by weaponizing a common power-saving feature of most phones: connecting by default to the closest cell tower emitting the strongest signal. Once the “handshake” between the device and a phone begins, there are a variety of authentication protocols the device must overcome. Tricking modern phones into connecting with the simulator has grown increasingly complicated since the earliest versions of the device were strapped to planes and used to intercept communications on US battlefields.

Cell-site simulators used by police today come with additional modes and equipment to target individual phones in an area and can be used narrow their locations to a single home or apartment. 

Multiple variants of the device are known to exist and some are capable of launching attacks more sophisticated and invasive than others. Some allow operators to eavesdrop on calls, or will force devices to execute unauthenticated commands that disable encryption or downgrade the connection to a lower and less secure network. One command sent by a phone, for example, can cause nearby cell towers to reject the device, rendering it incapable of network use. 

Whether US government entities have ever employed some of these advanced features domestically is unknown. Certain models used by the federal government are known to come with software capable of intercepting communications; a mode in which the device executes a man-in-the-middle attack on an individual phone rather than be used to identify crowds of them. Manufacturers internationally have marketed newer simulators capable of being concealed on the body and have advertised its use for public events and demonstrations. It is widely assumed the most invasive features remains off-limits to local police departments. Hackers, meanwhile, have proven its possible to assemble devices capable of these feats for under $1,000. 

Contractual language obtained by the ACLU shows police are required to use any “reasonably available” means to restrict the device from doing anything more than “recording or decoding electronic or other impulse to the dialing, routing, addressing and signaling information utilized in the processing and transmitting of wire or electronic communications.”

Other records show cell-site simulators are listed as defense articles on the United States Munitions List, meaning trade in the technology is ultimately regulated by the State Department. This designation is used by the FBI, however, in order to compel secrecy from state and local agencies requesting its aid, as unauthorized disclosures about defense technology is considered an arms control violation punishable by up to 20 years in prison and $1 million in fines. 

Due to their interference with domestic cellular networks, use of the device for law enforcement purposes is authorized by the Federal Communications Commission.

Since the _US v. Carpenter_ decision, in which the Supreme Court held that cellular data containing location data is shielded by the Fourth Amendment, the Department of Justice (DOJ) has required federal agencies to obtain warrants before activating cell-site simulators. This extends to police departments borrowing the technology from the FBI. The DOJ crafts the language used by police in these interactions with courts to control the amount of legal scrutiny that falls on the device. It does this by conflating cell-site simulators with decades-old police technologies like the “trap and trace” and “pen registers,” names for devices and programs capable of identifying incoming and outgoing calls, respectively, but which do not gather location data. 

When police use the devices to locate a suspect on the loose or gather evidence of a crime, they are generally required by the FBI not to disclose it in court. In some cases, this leads police to launder evidence using a technique known as parallel construction, whereby the method used to collect evidence is concealed by using a different method to collect the same information again after the fact. The practice is legally controversial, particularly when undisclosed in court, as it prevents evidentiary hearings from weighing the legality of actual police conduct. 

Documents show police are advised to pursue “additional and independent investigative means and methods” to obtain evidence collected through use of a cell-site simulator, though suggestions provided by the FBI on how this could be accomplished were redacted by the bureau. 

The power of judges to toss evidence seized in contravention of a defendant’s rights is, the Supreme Court wrote in 1968, the only true defense Americans have against police misconduct. Without it, then-chief justice Earl Warren wrote, “the constitutional guarantee against unreasonable searches and seizures would be a mere ‘form of words.’”

Under the US system, Warren wrote,  “evidentiary rulings provide the context in which the judicial process of inclusion and exclusion approves some conduct as comporting with constitutional guarantees and disapproves other actions by state agents.” Allowing police and prosecutors to authenticate their own evidence, he added, would make the courts essentially party to “lawless invasions” of American's privacy. Withholding information from judges about the ways in which evidence is collected, therefore, may easily interfere with one of the court’s most sacred duties; forestalling at the same time any scrutiny as to the constitutionality of the state’s conduct.

The FBI, meanwhile, argues that secrecy is necessary, as revealing information about such devices would enable criminals to “diminish or thwart law enforcement efforts.” Information about them is therefore designated “law enforcement sensitive” or “protected homeland security information,” terms that describe unclassified information the government deems “for official use only.” These designations generally prevent documents from being disclosed to the public and may exempt from use in legal proceedings.

The FBI employs a “jigsaw” or patchwork theory of disclosure, documents show, to keep even minor details about cell-site simulators hidden from the public. It argues that details, no matter how small, may “like a jigsaw puzzle,” eventually combine to reveal critical information about the technology. Because the devices are used in counterterrorism cases and in a counterintelligence capacity, the FBI further argues that revealing information about cell-site simulators would have a “significant detrimental impact on the national security of the United States.”

The idea of prosecutors dropping cases merely to protect word from spreading about the use of an already well-known device is particularly concerning due to the gravity of crimes typically involved in cases where police bother to deploy them. Documents obtained by the ACLU show, for example, that police requested technical assistance from the FBI in May 2020 during a manhunt for a gang-affiliated suspect wanted of multiple murders. “This is a serious crime and a good use of our assistance abilities,” an FBI official wrote in response to the request. Though redacted to protect the privacy of the individuals involved,  the document indicates the suspect had recently attacked a female victim leaving her greatly injured. 

The arguments compelling all this secrecy is difficult to square with the reality that, in the year 2023, both innocent people and criminals alike are far from naïve about how much like a tracking device cell phones actually are. The controversy around “stingrays” is so old that the tactical advantage they once offered exclusively to military spies works far more efficiently today as a commercial capability. To wit, finding a phone is now a standard feature on nearly all phones.

Whether everyday people comprehend that their phones are constantly broadcasting their locations is a question best answered by the man who was caught stowing his phone in a potato chip bag so he could play golf instead of work—a trick so effective (or possibly unnecessary) that, in the end, it took an office snitch to bring him down. It’s hard to imagine the crime spree the man might’ve pulled off had he only applied this advanced telecommunications mastery toward some more felonious endeavor.

While the golfer was hailed widely as a “MacGyver” in the press, the trick he used to deceive his employer was first popularized in the 1998 thriller _Enemy of the State._ Early in the film, Gene Hackman’s character grabs and stuffs Will Smith’s phone into a potato chip bag (screaming at him, meanwhile, that the NSA can “read the time off your fucking watch.”) The film is worth mentioning because cell phones were essentially new at the time—which is to say, the knowledge, or belief, that law enforcement can track people’s movements based on their cellphones entered the mainstream back when fewer than 25 percent of Americans owned one.

A man buying his counter surveillance from a snack machine to avoid work doesn't care how the trick works, though anybody who has ever lost a radio signal in parking garage is equipped to solve that mystery. The FBI can track cell phones. Unscrupulous golfers know it. Bank robbers and terrorists are presumably also clued in on this now. And no amount of silence that police or prosecutors ever agree to is going to diminish that.

Docs Show FBI Pressures Cops to Keep Phone Surveillance Secrets

Vehicles from Toyota, Honda, Ford, and more can collect huge volumes of data. Here’s what the companies can access.

Privacy4Cars results say it is unclear how Honda uses biometric data, which is information about your body. Honda’s Martin says no Acura or Honda models in the US have systems that transfer biometrics to the company. The airbag system within the car may collect weight and body position information, Martin says, but this is stored on the onboard computer and is only accessible by a physical connection, with state and federal laws outlining who can access it.

Honda’s connected product privacy notice says it is possible to opt out of many forms of data collection, pointing to its apps and owners manuals.

Ford (F150)

Only one Ford model, the F150 truck, appears in recent lists of best-sellers, but it's often the most popular across all categories. Like most manufacturers, Ford collects information about who owns the vehicle, including names, location details, and driving license data. Privacy4Cars analyzed four Ford documents, which run to around 50,000 words, when looking at the data the company can collect.

Alan Hall, director of technology communications at Ford, says its Connected Vehicle Privacy Notice provides people with the most information about what its cars collect. This includes vehicle data, such as tire pressure, information about how parts are performing, and vehicle charging information if a vehicle is electric.

The company also can collect driving data and characteristics, such as your speed, how you push the pedals, and seat-belt-related data. Information about your travel direction, precise location, speed, and local weather can be gathered from the vehicle.

Voice recognition systems in some of its vehicles can gather information when they are listening. Its “media analytics” involves capturing information about what you listen to in your car, including “radio presets, volume, channels, media sources, title, artist, and genre.”

The section of Ford’s privacy policy that is specific to California, which has stricter data laws than across the US, also provides extra data about what can be collected. “We utilize connected vehicle data to improve quality, minimize environmental impact, and make our vehicles safer and more enjoyable to drive and own,” Hall says.

Chevrolet (Silverado)

Chevrolet, which is owned by General Motors, collects both information about you and what you do with your vehicle, as all manufacturers we analyzed do. A company spokesperson says its privacy statement is the fullest documentation of what the company collects. This document also links to its specific privacy document for connected services, including its cars. We ran the Chevrolet Silverado through the privacy tool.

As a starter, GM collects people’s identifiers, such as names, postal addresses, and email addresses. Chevrolet’s documents say it can collect information about your vehicle, such as its battery, ignition, and window data, gear status, and diagnostic information. It can also collect, among other things, your location, route history, your speed, and “braking and swerving/cornering events.”

The documents also say data “from camera images and sensor data, voice command information, stability control or anti-lock events, security/theft alerts, and infotainment (including radio and rear-seat infotainment) system and Wi-Fi data usage” can be collected. The company can also receive “information about your home energy usage,” which relates to the charging and discharging of electric vehicles.

Jeep and Ram (Grand Cherokee and Ram Pickups)

The Jeep Grand Cherokee and the Ram Pickup are two of the most popular vehicles in the US. Both the Jeep and Ram brands are owned by Stellantis, a firm that was created when Fiat Chrysler Automobiles and the Peugeot group merged in 2021. As a result, they largely use the same connected services privacy policy and terms of service, which can also cover Chrysler, Dodge, and Fiat. (Ram was a line of Dodge trucks until it became its own brand starting in 2010.)

Stellantis can collect your name, address, phone number, email, Social Security number, and driving license number. The driving data the company collects, according to its documents, includes the dates and times you use it, your speed, acceleration and braking data, details of the trip (including location, weather, route taken), and, among other things, cruise control data. Like other manufacturers, it also collects data about the status of your car, including “refueling activity,” battery levels, images from cameras, and error codes that are generated. Your face and fingerprint data may be collected if you use services, such as digital keys, that need this kind of information to operate, the documents say.

Privacy4Cars tool says the company is “silent” in its documents on whether data from synched phones is collected. Mark Silk, the head of software data analytics at Stellantis, says data is not collected from synched phones in vehicles, but the company does collect data from its “branded mobile remote apps.”

Silk says that for the majority of its new vehicles, there are three ways for people to manage their personal data. “The ability to turn off and on the collection of geo-location data at any time from within the vehicle, the ability to opt-in/out and consent to specific uses of their personal data via our digital channels, and the ability to request the ‘right to be forgotten’ at any time—again this can be requested via digital channels,” Silk says, adding the company is rolling out more privacy tools in the future.

How the Most Popular Cars in the US Track Drivers

The AI era promises a flood of disinformation, deepfakes, and hallucinated “facts.” Psychologists are only beginning to grapple with the implications.

Artificial intelligence is arguably the most rapidly advancing technology humans have ever developed. A year ago you wouldn’t often hear AI come up in a regular conversation, but today it seems there’s constant talk about how generative AI tools like ChatGPT and DALL-E will affect the future of work, the spread of information, and more. A major question that has thus far been almost entirely unexamined is how this AI-dominated future will affect people’s minds.

There’s been some research into how using AI in their jobs will affect people mentally, but there isn’t yet an understanding of how simply living amongst so much AI-generated content and systems will affect people’s sense of the world. How is AI going to change individuals and society in the not-too-distant future?

AI will obviously make it easier to produce disinformation—from fake images to deepfakes to fake news. That will affect people’s sense of trust as they’re scrolling on social media. AI can also allow someone to imitate your loved ones, which further erodes people’s general ability to trust what was once unquestionable. That may also affect how they think about identity.

Your own identity can be threatened by deepfakes, too, if people are creating images or videos of you doing things you never actually did. In the US, people often identify with their jobs, and those could soon be threatened. Will AI make people more reliant on and distracted by technology at a time when that’s already a major issue? There are countless ways AI could reshape how people operate in the world. But researchers are only just beginning to grapple with the implications of an AI-saturated existence.

Larry Rosen, a professor emeritus of psychology at California State University, Dominguez Hills, says he worries that AI will make people more reliant on technology. Humans like things to be as simple and easy as possible, to avoid stress, he says, so people might start automating every aspect of their life that they can.

In the same way you might use Google Maps to get everywhere and not know how to get there otherwise, AI might cause people to stop learning things they would have otherwise had to learn. Ironically, though, Rosen thinks this could cause _more_ stress as people are inundated with AI and constantly shifting gears and not seeing anything quite clearly.

“I get concerned about the fact that we just blindly believe the GPS. We don’t question it. Are we just going to blindly believe the AI?” Rosen says. “As it is, we’re overwhelmed. We’re so overwhelmed that we can’t make ourselves do a simple task and see it to completion. Anxiety is just going to ratchet up as we’re faced with this unknown thing in our world.”

Michael Graziano, a professor of psychology and neuroscience at Princeton University, says he thinks AI could create a “post-truth world.” He says it will likely make it significantly easier to convince people of false narratives, which will be disruptive in many ways.

“Reality has become pixels, and pixels are now infinitely inventable,” Graziano says. “We can create them any way we want to.”

That being said, Graziano also wonders if AI could help us with the loneliness epidemic, which is a big strain on mental health. Perhaps people will think of AI as a friend? But what happens then? We don’t yet know, Graziano says.

“We don’t actually know what kind of impact this technology will have,” Graziano says.

Michal Kosinski, a computational psychologist and associate professor of organizational behavior at Stanford University, says AI could have an interesting impact on how people think about their work. He says AI will be better at doing many tasks that humans do today, so people will rely on it, and they could essentially become the human face of the work the AI is doing.

“Increasingly, not only medical doctors but politicians and judges and teachers will become interfaces for algorithms,” Kosinki says. “When you go to a doctor, a doctor will still give you a diagnosis, but this diagnosis will just be printed out of a computer that analyzed your vital signs and symptoms and told the doctor to give you this medicine.”

AI is going to have an impact on almost every aspect of human life, and Graziano says much more research is needed into how this will affect people’s minds. If social media can have such a major impact on society, there’s no telling what consequences a rapidly advancing technology like AI could precipitate.

“I would like to see people collect actual data on people’s psychological state, personalities, their mental health as a function of their engagement with AI,” Graziano says. “What does that do? Does it actually improve things in some ways and harm things in other ways? Is it dependent on the particular personality or particular socio-economic status of a person? There’s this giant area that isn’t studied.”

Kosinki says people are just starting to see how quickly these AI systems are advancing, and they’re just going to keep becoming more complex and capable of more things. The world might look a lot different in just a year, and there’s no saying what it will look like further down the road.

“We are sliding, very quickly, towards an AI-controlled and AI-dominated world,” Kosinki says.

Humans Aren’t Mentally Ready for an AI-Saturated ‘Post-Truth World’

Plus: The arrest of an alleged Lockbit ransomware hacker, the wild tale of a problematic FBI informant, and one of North Korea’s biggest crypto heists.

Prison surveillance is now much more than skin deep. A jail in Atlanta, Georgia, has begun rolling out a new tracking system that monitors everything from inmates’ locations to their literal heartbeats, according to documents WIRED obtained through a public records request. Made by Talitrix, the system uses hundreds of sensors installed around a jail that link to a Fitbit-like wristband worn by inmates. Georgia prison officials say the surveillance tech will improve safety inside and help mitigate the impacts of staffing shortages. Privacy experts say it’s the latest erosion of inmates’ rights.

If privacy is virtually nonexistent in jail, it may not be much better before you’re even convicted of a crime. Just ask a family in Indiana’s Monroe County, who are being monitored by probation officers through an app called Covenant Eyes. The app records everything a person does on their device, taking screenshots at least once per minute as well as monitoring network requests, all of which are sent to an “ally.” (The allies, in this case, are two probation officers.) The father, who has been charged with possession of child sexual abuse material, is in jail awaiting trial after the app alerted officers that someone had attempted to visit Pornhub, which would have been a violation of his bond. But thanks to shortcomings in the app, the whole thing may have been a mistake.

Beyond potentially unconstitutional surveillance, there are many other ways government data collection can hurt your privacy. Millions of people in India may have had their data exposed thanks to an alleged breach of CoWIN, India’s vaccination-tracking app. The Indian health ministry says reports of a breach are “without any basis,” and independent security researchers say the breach may not be as widespread as some believed. The government is now investigating.

In the US, a newly declassified report commissioned by the Office of the Director of National Intelligence reveals that spy agencies have been compiling a “large” trove of data about virtually every American simply by purchasing the information from commercial sources, like data brokers. Privacy advocates say the practice is a potential end run around constitutional protections.

Earlier this month, a former intelligence officer publicly claimed the US government has an “intact” craft made by a “non-human” entity, among other extraterrestrial allegations. The claims have caught the attention US Congress members, several of whom are planning investigations. Given the openness some lawmakers have to conspiratorial thinking, this issue may finally fly out of the shadows.

A more pressing concern for the US government may come from right here on Earth. Encryption chips made by a subsidiary of a company on the US Commerce Department’s so-called Entity List are being used by a slew of government bodies, including the US Navy, NATO, and NASA. The company, Hualan, landed on the Entity List thanks to its close ties to China’s military. But this “red flag” hasn’t stopped these agencies and others from purchasing the encryption chips from Initio, a Hualan subsidiary, raising concerns over a potential backdoor. Initio says it doesn’t have the ability to implement a backdoor in its chips, and several agencies told WIRED that they take the necessary precautions to ensure the security of the tech they use. Given how difficult it is to find a backdoor in these chips, however, these assurances may do little to assuage experts’ fears.

Finally, the Russia-based ransomware gang Clop went on a hacking spree that hit US government agencies and international companies including Shell and British Airways. Clop hackers carried out their cybercriminal campaign by exploiting a vulnerability in the file-transfer service MOVEit. The flaw has since been patched, but the full extent of the stolen data and list of targets remains unclear.

But that's not all. Each week, we round up the biggest security and privacy stories we weren't able to cover in depth ourselves. Click on the headlines to read the full stories, and stay safe out there.

As Russia has carried out its unprecedented cyberwar in Ukraine over nearly a decade, its GRU military intelligence hackers have taken center stage. The notorious GRU hacker groups Sandworm and APT28 have triggered blackouts, launched countless destructive cyberattacks, released the NotPetya malware, and even attempted to spoof results in Ukraine’s 2014 presidential election. Now, according to Microsoft, there’s a new addition to that hyper-aggressive agency’s cyberwar-focused bench.

Microsoft this week named a new group of GRU hackers that it’s calling Cadet Blizzard, and has been tracking since just before Russia’s full-scale invasion of Ukraine in February 2022. Redmond’s cybersecurity analysts now blame Cadet Blizzard for the destructive malware known as WhisperGate, which hit an array of government agencies, nonprofits, IT organizations, and emergency services in Ukraine in January 2022, just a month before Russia’s invasion began. Microsoft also attributes to Cadet Blizzard a series of web defacements and a hack-and-leak operation known as Free Civilian that dumped the data of several Ukrainian hacking victim organizations online while loosely impersonating hacktivists, another of the GRU’s trademarks.

Microsoft assesses that Cadet Blizzard appears to have the help of at least one private sector Russian firm in its hacking campaign but that it’s neither as prolific nor as sophisticated as previously known GRU groups plaguing Ukraine. But as Russia has switched up the tempo of its cyberwar, focusing on quantity rather than quality of attacks, Cadet Blizzard may play a key role in that brutal cadence of chaos.

You might think that in 2023, Russian hackers would have learned not to travel to countries with US extradition treaties—not to mention a US state. But one allegedly prolific ransomware extortionist associated with the notorious Lockbit group was arrested this week in Arizona, the Department of Justice announced. Ruslan Magomedovich Astamirov, a 20-year-old man living in Russia’s Chechen Republic, carried out at least five ransomware attacks against victims in Florida, Tokyo, Virginia, France, and Kenya, according to prosecutors. And in one case, he allegedly pocketed 80 of the bitcoin ransom personally. Astamirov’s arrest represents a relatively rare instance of US officials laying hands on a ransomware hacker, most of whom typically stay on Russian soil and evade arrest. It’s not yet clear why Astamirov made the mistake of traveling, but here’s hoping it’s a trend. Lots of other US-extradition countries are lovely this time of year.

File this one under “complicated headlines”: According to a search warrant unearthed by _Forbes_, the FBI used information stolen by a hacker from a dark-web assassination market to investigate a person going by the pseudonym Bonfire—whom the FBI believes is a Louisiana hairdresser named Julie Coda—to commission the murder of her niece’s father. In fact, Bonfire was being scammed by a fake murder-for-hire service, as is almost always the case with such dark-web deals. And to compound her problems, her alleged attempted murder-for-hire was revealed to the FBI by a hacker working as an informant to the US Department of Homeland Security. To further complicate this dark, strange story, that hacker appears to have been a foreign national flipped by the DHS and convicted of possessing child sexual abuse materials.

Last week it came to light that Estonia-based cryptocurrency wallet service Atomic Wallet had been breached by hackers apparently based in North Korea who stole tens of millions of dollars. Crypto analysts at Elliptic have now uncovered the larger picture of that heist and found that the hackers’ haul was in fact in the nine figures, making it one of North Korea’s biggest crypto heists in recent years. According to Elliptic, a large tranche of the funds have flowed to the Russian exchange Garantex, which was sanctioned by the US Treasury Department last year but continues to operate.

A Newly Named Group of GRU Hackers is Wreaking Havoc in Ukraine

The ransomware gang Clop exploited a vulnerability in a file transfer service. The flaw is now patched, but the damage is still coming into focus.

United States cybersecurity officials said yesterday that a “small number” of government agencies have suffered data breaches as part of a broad hacking campaign that is likely being carried out by the Russia-based ransomware gang Clop. The cybercriminal group has been on a tear in exploiting a vulnerability in the file transfer service MOVEit to grab valuable data from victims including Shell, British Airways, and the BBC. But hitting US government targets will only increase global law enforcement's scrutiny of the cybercriminals in the already high-profile hacking spree.

Progress Software, which owns MOVEit, patched the vulnerability at the end of May, and the US Cybersecurity and Infrastructure Security Agency released an advisory with the Federal Bureau of Investigation on June 7 warning about Clop's exploitation and the urgent need for all organizations, both public and private, to patch the flaw. A senior CISA official told reporters yesterday that all US government MOVEit instances have now been updated. 

CISA officials declined to say which US agencies are victims of the spree, but they confirmed that the Department of Energy notified CISA that it is among them. CNN, which first reported the attacks on US government agencies, further reported today that the hacking spree impacted Louisiana and Oregon state driver's license and identification data for millions of residents. Clop has previously also claimed credit for attacks on the state governments of Minnesota and Illinois.

“We are currently providing support to several federal agencies that have experienced intrusions affecting their MOVEit applications,” CISA director Jen Easterly told reporters on Thursday. “Based on discussions we have had with industry partners in the Joint Cyber Defense Collaborative, these intrusions are not being leveraged to gain broader access, to gain persistence into targeted systems, or to steal specific high-value information—in sum, as we understand it, this attack is largely an opportunistic one.”

Easterly added that CISA has not seen Clop threaten to release any data stolen from the US government. And the senior CISA official, who spoke to reporters on the condition that they not be named, said that CISA and its partners do not currently see evidence that Clop is coordinating with the Russian government. For its part, Clop has maintained that it is focused on targeting businesses and will delete any data from governments or law enforcement.

Clop emerged in 2018 as a standard ransomware actor that would encrypt a victim's systems and then demand payment to provide the decryption key. The ransomware gang is also known for finding and exploiting vulnerabilities in widely used software and equipment to steal information from a variety of businesses and institutions and then launch data extortion campaigns against them. 

Allan Liska, an analyst for the security firm Recorded Future who specializes in ransomware, says that Clop was “moderately successful” with the ransomware approach. It eventually differentiated itself, though, by moving away from encryption-based ransomware and toward its current model of developing exploits for vulnerabilities in enterprise software and then using them to carry out mass data theft.

And while there may not be direct coordination between the Kremlin and Clop, research has repeatedly shown ties between the Russian government and ransomware groups. Under the arrangement, these syndicates can operate from Russia with impunity so long as they don't target victims within the country and defer to the Kremlin's influence. So is Clop really deleting data it gathers, even incidentally, from government victims?

“We don’t think US government agencies were specifically targeted. Clop simply hit any vulnerable server running the software,” Liska says of the MOVEit campaign. “But it is highly likely that any information Clop collected from the US government or other interesting targets was shared with the Kremlin.”

Clop Hacking Rampage Hits US Agencies and Exposes Data of Millions

The US government warns encryption chipmaker Hualan has suspicious ties to China’s military. Yet US agencies still use one of its subsidiary’s chips, raising fears of a backdoor.

From TikTok to Huawei routers to DJI drones, rising tensions between China and the US have made Americans—and the US government—increasingly wary of Chinese-owned technologies. But thanks to the complexity of the hardware supply chain, encryption chips **sold by the subsidiary of** a company specifically flagged in warnings from the US Department of Commerce for its ties to the Chinese military have found their way into the storage hardware of military and intelligence networks across the West.

In July of 2021, the Commerce Department's Bureau of Industry and Security added the Hangzhou, China-based encryption chip manufacturer Hualan Microelectronics, also known as Sage Microelectronics, to its so-called “Entity List,” a vaguely named trade restrictions list that highlights companies “acting contrary to the foreign policy interests of the United States.” Specifically, the bureau noted that Hualan had been added to the list for “acquiring and ... attempting to acquire US-origin items in support of military modernization for \[China's\] People's Liberation Army.”

Yet nearly two years later, Hualan—and in particular its subsidiary known as Initio, a company originally headquartered in Taiwan that it acquired in 2016—still supplies encryption microcontroller chips to Western manufacturers of encrypted hard drives, including several that list as customers on their websites Western governments' aerospace, military, and intelligence agencies: NASA, NATO, and the US and UK militaries. Federal procurement records show that US government agencies from the Federal Aviation Administration to the Drug Enforcement Administration to the US Navy have bought encrypted hard drives that use the chips, too.

The disconnect between the Commerce Department’s warnings and Western government customers means that chips sold by Hualan’s subsidiary have ended up deep inside sensitive Western information networks, perhaps due to the ambiguity of their Initio branding and its Taiwanese origin prior to 2016. The chip vendor’s Chinese ownership has raised fears among security researchers and China-focused national security analysts that they could have a hidden backdoor that would allow China’s government to stealthily decrypt Western agencies’ secrets.

“If a company is on the Entity List, it’s because the US government says this company is actively supporting another country’s military development,” says Dakota Cary, a China-focused research fellow at the Atlantic Council, a Washington, DC-based think tank. “It's saying you should not be purchasing from them, not just because the money you’re spending is going to a company that will use those proceeds in the furtherance of another country’s military objectives, but because you can’t trust the product.”

Technically, the Entity List is an “export control” list, says Emily Weinstein, a researcher at Georgetown University's Center for Security and Emerging Technology. That means US organizations are forbidden from exporting components _to_ companies on the list, rather than importing components _from_ them. But Cary, Weinstein, and the Commerce Department note that it's often used as a de facto warning to US customers not to buy from a listed foreign company, either. Both networking firm Huawei and drone-maker DJI have been added to the list, for instance, for their alleged ties to the Chinese military. “It’s used somewhat as a blacklist,” says Weinstein. “The Entity List should be a red or maybe a yellow alert to anyone in the US government who’s working with this company to take a second look at this.”

When WIRED reached out to the Commerce Department's Bureau of Industry and Security, a spokesperson responded that the BIS is restricted by law from commenting to the press on specific companies and that a company's unlisted subsidiary—like Initio—isn't technically affected by the Entity List's legal restrictions. But the spokesperson added that “as a general matter, affiliation with an Entity Listed party should be considered a ‘red flag.’”

Hualan's Initio chips are used in encrypted storage devices as so-called bridge controllers, sitting between the USB connection in a storage device and memory chips or magnetic drive to encrypt and decrypt data on a USB thumbdrive or external hard drive. Security researchers' teardowns have shown that storage device manufacturers including Lenovo, Western Digital, Verbatim, and Zalman have all at times used encryption chips sold by Initio.

But three lesser-known hard drive manufacturers, in particular, also integrate the Initio chips and list Western government, military, and intelligence agencies as customers. The Middlesex, UK-based hard drive maker iStorage lists on its website customers including NATO and the UK Ministry of Defence. South Pasadena, California-based SecureDrive lists as customers the US Army and NASA. And US federal procurement records show that Poway, California-based Apricorn has sold its encrypted storage products—which use Initio chips—to NASA, the Navy, the FAA, and the DEA, among many others.

The encryption features enabled by Initio chips in those drives are designed to protect their data against compromise if the drives are physically accessed, lost, or stolen. But the security of that encryption feature essentially depends on trusting the chip's designer, cryptography experts warn. If there were a secret vulnerability or intentional backdoor in the chips, it would allow anyone who lays hands on any drives that use them—drives are often marketed for use “in the field”—to defeat that feature. And that backdoor could be very, very difficult to detect, cryptographers note, even on the closest inspection.

“In the end, it's a matter of trust, whether you actually trust this vendor and its components with all your sensitive data,” says Matthias Deeg, a security researcher at German cybersecurity firm Syss, who has analyzed the Initio chips. “These kinds of microcontrollers are a black box to me and every other researcher trying to understand how this device is working.”

Last year, Deeg analyzed the first firmware of a Verbatim secure USB thumbdrive that uses an Initio chip and found multiple security vulnerabilities: One allowed him to quickly bypass a fingerprint reader or PIN on the drives and access any “administrative” password that had been set for the drives, a master password feature designed to allow IT administrators to decrypt users' devices. Another flaw allowed him to “brute-force” the decryption key for the drives, deriving the key to access their contents in at most 36 hours.

Deeg says that Initio has since fixed those vulnerabilities. But more troubling, he says, was how tough it was to do that analysis of the devices' firmware. The code had no public documentation, and Hualan didn't respond to his requests for more information. Deeg says the lack of transparency points to how difficult it would be to find a hardware-based backdoor in the chips, such as a minuscule component hidden in their physical design to allow for surreptitious decryption.

He notes, too, that there's no way of knowing whether the vulnerabilities he found were accidental. “Is it better to have a hidden backdoor,” Deeg asks, “or one that is more visible but can be attributed to negligence by the developer?”

Hualan didn't respond to WIRED's multiple requests for comment. But iStorage, the UK-based encrypted hard drive maker that uses Initio chips, told WIRED that its storage devices' architecture means that users don't have to trust Hualan or its Initio subsidiary because the private keys used to encrypt and decrypt data stored on them are generated and stored by a separate chip that comes from a different, France-based manufacturer, and the Initio chip never stores that key. “I appreciate concerns with using Chinese technology, but we’re very confident that even though we’re using these chips, our products cannot be hacked, even by Initio or Hualan,” iStorage's CEO John Michael says. (Michael also noted that some of iStorage products use a chip sold by Taiwanese firm Phison instead of Hualan or Initio, but didn't specify which products.)

Even if a bridge controller chip doesn't create a secret key and isn't intended to store it, however, it still has enough access to it to enable a backdoor, says Matthew Green, a cryptography-focused computer science professor at Johns Hopkins University. After all, a bridge controller performs the encryption and decryption using that secret key, and so could either secretly exfiltrate and store it or furtively encrypt the data with its own, different key. “If the chip has the key and does the encryption, there is a possibility of malfeasance,” Green says.

iStorage also passed on a statement from Initio pointing out that Initio isn't specifically named on Commerce's Entity List, and arguing that Hualan's inclusion on the list doesn't apply to Initio. But the Atlantic Council's Cary argues—echoing the Commerce spokesperson's “red flag” comment to WIRED—that wholly owned subsidiaries of companies on the list are generally considered to effectively be on the list, too. “I don’t buy that line of argument,” Cary says of Initio's claim to not be affected by the Entity List, pointing out that otherwise the list's restrictions could be easily circumvented through the use of subsidiary companies. “If the company that owns you is on the Entity List, you’re included.”

WIRED also reached out to Hualan and Initio customers including NATO, NASA, the US Navy and Army, the DEA, and the FAA. Of those that responded, none would comment on what hardware they buy. But statements from NATO, the US Navy, and the UK Ministry of Defence all repeated that they carefully vet the security of the technology they use. “We have policies in place to address supply chain risk management, as well as established security standards to ensure all procured commercial products and services are inspected for security vulnerabilities,” read a statement from the US Navy, for instance. An FAA spokesperson said the agency complies with government regulations like the National Defense Authorization Act related to the purchase of hardware, but didn't answer questions about purchasing components from companies on Commerce's Entity List.

In fact, several of the encrypted hard drives that use Hualan's and Initio's chips tout that they do have cybersecurity certification from the National Institute of Standards and Technology such as the FIPS 140-2 standard. But Johns Hopkins' Green notes that for that level of certification, NIST generally only checks for accidental vulnerabilities in cryptographic products, not intentionally hidden ones created by a determined adversary.

“These backdoors can be so subtle and clever, and there’s so many ways to do them that you may not even see in the code,” Green says. “It would really shock me if any of these tests are assuming an untrusted manufacturer.”

The mere fact that so many Western government agencies are buying products that include chips **sold by the subsidiary of** a company on the Commerce Department's trade restrictions list points to the complexities of navigating the computing hardware supply chain, says the Atlantic Council's Cary. “At minimum, it's a real oversight. Organizations that should be prioritizing this level of security are apparently not able to do so, or are making mistakes that have allowed for these products to get into their environments,” he says. “It seems very significant. And it’s probably not a one-off mistake.”

How Shady Chinese Encryption Chips Got Into the Navy, NATO, and NASA

Fresh claims from a former US intelligence officer about an “intact” alien craft may get traction on Capitol Hill, where some lawmakers want to believe.

The United States Congress is strange enough without aliens, but here we are. Or is it, here they are?

Over a span of several months, members of the 118th Congress have gone from being transfixed by wind-propelled spy balloons to being mesmerized by a whistleblower’s claims that US intelligence officials possess “intact and partially intact non-human aircraft.” The whistleblower, former intelligence officer David Grusch, also claims that this and other evidence are being withheld from Congress.

“The allegations themselves are breathtaking,” says Senator Brian Schatz, a Hawaii Democrat. “It could be a game changer, or it could be a crank. I just don't know.”

Whether Grusch proves to be a crank or a game changer will likely soon be investigated by lawmakers from both parties and in both chambers of Congress. Skeptics abound, but there are also lawmakers who are curious and open to proof. Then there are the believers. 

In our strange new political universe of alternative facts turned dystopian reality, once-fringe notions have built-in fan bases in today’s Capitol. And in the House of Representatives, party leaders tapped Grusch’s allies to lead their chamber’s investigation.

On one level, it’s fitting that today’s conspiracy-laced Congress—where anti-vaxxers berate scientists, Election 2020 remains disputed, and January 6 rioters are praised as victims—is now tasked with tackling arguably the nation’s most long-standing conspiracy. But many senators fear their House counterpart’s melding of “deep state” with deep space will only sow more confusion into an electorate hungry for answers, which hearings about unidentified aircraft in recent years have failed to satisfactorily answer.

The Rank and File Are Flying the UAP

The sensational details of Grusch’s claims about so-called unidentified anomalous phenomena (or UAPs—NASA’s new name for UFOs) spread rapidly through the Capitol last week, along with much derision and mockery. Some congressional leaders laughed them off. "This is not a question I had on my bingo card,” House Democratic Caucus chair Pete Aguilar told the press corps. Or they slid these latest ET allegations right into their old talking points. "Obviously, we're concerned about Congress being kept in the dark from a lot of these agencies,” House majority leader Steve Scalise replied before even seeing the whistleblower’s claims.

The response was different among rank-and-file lawmakers, especially in the House, where the Grusch’s unvetted claims were seen as vindication by a small but vocal—and increasingly powerful—faction of far-right lawmakers who are heading up the inquiry ahead of a planned but still unscheduled hearing.

“I think it’s a little bit of madness and a whole lot of reality. I do believe we’ve recovered a craft at some point,” Representative Tim Burchett, a Tennessee Republican, told Steve Bannon on his podcast Wednesday. Burchett believes that the Pentagon’s budget is bloated, in part, because it’s funding secret UAP programs. His personal belief in UAPs stems from the 1947 incident in Roswell, New Mexico.  

When Grusch’s report dropped, some members of today’s far-right immediately suspected it was a false flag planted by the deep state. “We kind of felt, with everything going on, this is like the biggest misdirection play in history,” Bannon told Burchett. Their fears appear to have largely dissipated, however, with Burchett and his far-right allies now all-in on the investigation.  

Burchett told Bannon he “has a commitment” from both House speaker Kevin McCarthy and House Oversight Committee chair James Comer to hold a hearing on UAPs, though he says it’s not a top priority for party leaders. “We’re only going to get about one bite at the apple,” Burchett said.

If the Pentagon—which vigorously denies the whistleblower’s charges of a secret UAP program—or NASA officials ask to brief lawmakers behind closed doors, which is common when classified information is discussed, Burchett’s not interested. “I'm not gonna be a part of it if it's classified. That's ridiculous,” Burchett said on the podcast. “That's just more of the same and creates more myths and rumors than it creates facts.”

Burchett is joined by two Florida Republican representatives: Matt Gaetz—“I have seen evidence of craft that I am not familiar with any of our allies or adversaries or even our country possessing”—and Anna Paulina Luna, who believes the government has been lying to the public about UAP’s “for decades.”

While Luna and Burchett will likely head up the House inquiry and eventual hearing, it’s not just fringe-right members whose ears perked up over these allegations. This includes Representative Mike McCaul, a Texas Republican and chair of the House Foreign Affairs Committee. “It’s a legitimate issue. On both sides, we just want to know if we've been seeing \[UAPs\] that are not man-made—is what the article said, but I don't know,” he says. “But that's a good question for the chairman” of the House Permanent Select Committee on Intelligence.

That’s why one of McCaul’s first reactions to the article was to forward it to the House Intelligence Committee chair, Mike Turner, whose office didn’t reply to multiple requests for comment.

The Senate Has Questions  

The Senate has also shown interest in UAPs in recent years, and the increased pressure on federal officials has produced results—including a massive spike in the number of UAPs the government monitors.   

In its June 2021 report, the Office of the Director of National Intelligence disclosed 144 UAP sightings stretching back nearly two decades. After years of mounting smartphone evidence, unanswered questions, and frustrated lawmakers, the military unveiled its newly rebooted and renamed All-Domain Anomaly Resolution Office (AARO; pronounced “arrow”). 

With a department mandated with tracking secrets in the skies, sightings skyrocketed. Last August, AARO officials disclosed more than 500 reports of UAPs. By this April, there were some 650 cases. And just last month, the Pentagon, which oversees AARO, hiked the number to roughly 800 mysterious flying objects. 

While Grusch’s claims of alien life and recovered craft have made headlines, senators are alarmed by accusations that the federal government is hiding Special Access Programs from Congress.

“We need to just look into whether there are rogue SAP programs that no one is providing oversight for,” says Senator Kirsten Gillibrand, a New York Democrat who led the Senate’s April UAP hearing. “The goal for me will be to have a hearing on that at some point so that we can assess if these SAP’s actually exist.”

Gillibrand is sponsoring an amendment she hopes to attach to this year’s must-pass National Defense Authorization Act to mandate that no money can be spent on SAP’s unless it's been reported to Congress. “So if there are SAPs out there that are somehow outside of the normal chain of command and outside the normal appropriations process, they have to divulge that to Congress,” Gilibrand says.

As for whether she thinks there’s any veracity to the whistleblower’s claims? “I have no idea,” Gillibrand says. “So I'm going to do the work and analyze it and figure it out.”

Other senators say there isn’t much to figure out. “Generally, I would look skeptically at many of these reports,” says Senator Martin Heinrich, a New Mexico Democrat who serves on the Intelligence Committee. While Heinrich remains dubious of the whistleblower, he says UAPs are a conundrum the federal government must address.

“What I take seriously is sometimes we just have these really good, decorated pilots and navigating officers who are experiencing things that we can't explain, so we need to collect data so that we can figure out what is going on,” Heinrich says.

Still, among other senators, radio silence. WIRED sent an inquiry to Senate Intelligence Committee chair Mark Warner; in less than a minute, the Virginia Democrat’s staff replied, “We’re a no comment on this—thank you!”

When we caught the senator in the Capitol’s marble halls, Warner kept tripping over his own thoughts. “There's been a lot of incoming. Frankly, I just need to find out more information on this,” Warner says.

As for the accusation that the federal government has lied to Congress and hidden some SAPs for decades?  “We've heard these accusations before,” Warner says, before stopping himself, again. “Let me get some information first.”

“None of It’s Good”

Lawmakers are still awaiting more answers on the spy balloons that dominated the news—and American air space—at the start of the year, especially in regard to the four objects the Air Force shot down within an eight-day period this February. In the wake of those military engagements, the Biden administration held closed-door classified briefings for members of Congress, but they were less than straightforward, at least initially, until lawmakers pushed officials on UAPs.

“They were talking about the balloons, and then several senators pointed out, ‘Now hold on: We’ve had a lot of unidentified anomalous phenomenon for years now,’ and that’s when the military briefer was like, ‘True. True,’” says Senator Josh Hawley, a Missouri Republican. “The takeaway from that is, they had thousands of sightings of these things over the years, which was news to me. So I'm not surprised, necessarily, by these latest allegations, because it sounds pretty close to what they kind of grudgingly admitted to us in the briefing.”

While not necessarily surprised by Grusch’s claims, lawmakers of all stripes are disturbed by reports of UAPs hovering over US military sites.

“It’s not good. None of it’s good,” Hawley says. “I think we want to get to the bottom of this. I think it’s disturbing.”

UFO Whistleblower, Meet a Conspiracy-Loving Congress

A newly declassified report from the Office of the Director of National Intelligence reveals that the federal government is buying troves of data about Americans.

The United States government has been secretly amassing a “large amount” of “sensitive and intimate information” on its own citizens, a group of senior advisers informed Avril Haines, the director of national intelligence, more than a year ago. 

The size and scope of the government effort to accumulate data revealing the minute details of Americans' lives are described soberly and at length by the director's own panel of experts in a newly declassified report. Haines had first tasked her advisers in late 2021 with untangling a web of secretive business arrangements between commercial data brokers and US intelligence community members. 

What that report ended up saying constitutes a nightmare scenario for privacy defenders. 

“This report reveals what we feared most,” says Sean Vitka, a policy attorney at the nonprofit Demand Progress. “Intelligence agencies are flouting the law and buying information about Americans that Congress and the Supreme Court have made clear the government should not have.” 

In the shadow of years of inaction by the US Congress on comprehensive privacy reform, a surveillance state has been quietly growing in the legal system's cracks. Little deference is paid by prosecutors to the purpose or intent behind limits traditionally imposed on domestic surveillance activities. More craven interpretations of aging laws are widely used to ignore them. As the framework guarding what privacy Americans do have grows increasingly frail, opportunities abound to split hairs in court over whether such rights are even enjoyed by our digital counterparts.

“I’ve been warning for years that if using a credit card to buy an American’s personal information voids their Fourth Amendment rights, then traditional checks and balances for government surveillance will crumble,” Ron Wyden, a US senator from Oregon, says. 

The Office of the Director of National Intelligence (ODNI) did not immediately respond to a request for comment. WIRED was unable to reach any members of the senior advisory panel, whose names have been redacted in the report. Former members have included ex-CIA officials of note and top defense industry leaders.

Wyden had pressed Haines, previously the number two at the Central Intelligence Agency, to release the panel's report during a March 8 hearing. Haines replied at the time that she believed it “absolutely” should be read by the public. On Friday, the report was declassified and released by the ODNI, which has been embroiled in a legal fight with the digital rights nonprofit the Electronic Privacy Information Center (EPIC) over a host of related documents. 

“This report makes it clear that the government continues to think it can buy its way out of constitutional protections using taxpayers’ own money," says Chris Baumohl, a law fellow at EPIC. “Congress must tackle the government’s data broker pipeline this year, before it considers any reauthorization of Section 702 of the Foreign Intelligence Surveillance Act,” he said (referring to the ongoing political fight over the so-called “crown jewel” of US surveillance). 

The ODNI's own panel of advisers makes clear that the government’s static interpretations of what constitutes “publicly available information” poses a significant threat to the public. The advisers decry existing policies that automatically conflate, in the first place, being able to buy information with it being considered “public.” The information being commercially sold about Americans today is “more revealing, available on more people (in bulk), less possible to avoid, and less well understood” than that which is traditionally thought of as being “publicly available.”

Perhaps most controversially, the report states that the government believes it can “persistently” track the phones of “millions of Americans” without a warrant, so long as it pays for the information. Were the government to simply demand access to a device's location instead, it would be considered a Fourth Amendment “search” and would require a judge's sign-off. But because companies are willing to sell the information—not only to the US government but to other companies as well—the government considers it “publicly available” and therefore asserts that it “can purchase it.”

It is no secret, the report adds, that it is often trivial “to deanonymize and identify individuals” from data that was packaged as ethically fine for commercial use because it had been “anonymized” first. Such data may be useful, it says, to “identify every person who attended a protest or rally based on their smartphone location or ad-tracking records.” Such civil liberties concerns are prime examples of how “large quantities of nominally ‘public’ information can result in sensitive aggregations.” What's more, information collected for one purpose “may be reused for other purposes,” which may “raise risks beyond those originally calculated,” an effect called “mission creep.” 

Most Americans have at least some idea of how a law enforcement investigation unfolds (if only from watching years of police procedurals). This idea imagines a cop whose ability to surveil them, turn their phone into a tracking device, or start squeezing records out of businesses they frequent, are all gated behind evidentiary thresholds, like reasonable doubt and probable cause. 

These are legal hurdles that no longer bother an increasing number of government agencies. 

Access to the most sensitive information about a person was once usually obtained in the course of a “targeted” and “predicated” investigation, the report says. Not anymore. “Today, in a way that far fewer Americans seem to understand, and even fewer of them can avoid, \[commercially available information\] includes information on nearly everyone,” it says. Both the “volume and sensitivity” of information the government can purchase has exploded in recent years due to “location-tracking and other features of smartphones,” and the “advertising-based monetization model” that underlies much of the internet, the report says. 

“In the wrong hands,” the ODNI’s advisers warn, the same mountain of data the government is quietly accumulating could be turned against Americans to “facilitate blackmail, stalking, harassment, and public shaming.” Notably, these are all offenses that have been committed by intelligence agencies and White House administrations in the past. What constraints do exist on domestic surveillance activities are all a direct response to that history of political sabotage, disinformation, and abusive violations of Americans' rights. 

The report notes: “The government would never have been permitted to compel billions of people to carry location tracking devices on their persons at all times, to log and track most of their social interactions, or to keep flawless records of all their reading habits. Yet smartphones, connected cars, web tracking technologies, the Internet of Things, and other innovations have had this effect without government participation.”

The government must appreciate that all of this unfettered access can quickly increase its own power “to peer into private lives to levels that may exceed our constitutional traditions or other social expectations,” the advisers say, even if it can't blind itself to the fact that all this information exists and is readily sold for a buck.

The US Is Openly Stockpiling Dirt on All Its Citizens

Personal information, including ID documents and phone numbers, have been released on Telegram.

On the evening of June 11, a journalist from the Kerala-based news portal The Fourth reported that a Telegram bot in a channel called “hak4learn” was offering access to the private data of millions of Indians. All a user had to do was put in a phone number or Aadhaar (India’s national ID) number, and it would return details including their name, passport number, and date of birth. The data appears to have come from India’s CoWIN vaccination tracking app, which has more than 1 billion registered users.

“The scale of the data breach is what makes it hard to guess the repercussions,” says Srikanth Lakshmanan, a researcher who runs the digital payments collective Cashless Consumer. “Conservative estimates mean at least personal data of several hundred million users was exposed.”

Local news outlets have been able to use the bot to access the personal information of politicians. WIRED couldn’t independently verify their reporting; by the morning of June 12 the bot was inactive. The fact that it has shut down doesn’t mean the breach is over, Lakshmanan says, since the bot was likely just a shop window for whoever accessed the database.

“Usually, hackers reveal a slice of data publicly via a bot or web page to prove to the world they have said data and then sell it on the dark web,” Lakshmanan says. “While the bot is down now, we don't know where all the data is being traded."

India’s digital public infrastructure has expanded massively over the past several  years, with the growing popularity of the Aadhaar identity system, the proliferation of the digital payments system United Payments Interface, and the launch of CoWIN.

This growth has meant that there is a vast amount of public data on file, but digital rights experts worry that cybersecurity and legal frameworks around data storage haven’t kept pace with the growth.

“The data involved with government entities is organically very large,” says Tejasi Panjiar, an associate counsel at the Internet Freedom Foundation, an organization that advocates for digital rights. “Which is why there needs to be very strict data-security standards for government-based entities.”

Panjiar further said that the concern is that India doesn’t have a cybersecurity policy and that even the current data-protection framework “takes away that aspect of compensation that affected users would get,” making such leaks an even bigger cause for concern. “I think it's a time for worry for everyone who's been vaccinated through CoWIN,” added Panjiar.

The health ministry has said that claims that the CoWIN portal has been breached are “without any basis” and that the Computer Emergency Response Team, the agency responsible for responding to cybersecurity incidents, has been asked to investigate.

India’s IT minister, Rajeev Chandrasekhar, tweeted that the data accessed by the bot is from a “threat actor database” and that “it does not appear that CoWIN app or database has been directly breached.”

An independent report by digital risk monitoring platform CloudSEK seems to validate this to some extent. The company’s research suggests that rather than having access to the entire CoWIN database or backend, the hackers may have instead gotten hold of multiple credentials from health workers, allowing them more limited access to records.

“What CloudSEK knows with high confidence is that threat actors have access to multiple credentials that belong to health workers that could be used to access the CoWIN portal for those individual health workers and the data they have access to,” says Rahul Sasi, chief executive of CloudSEK. “What we also speculate is some sort of unauthenticated API that would have allowed attackers to query specific user details. But there is no proof at this point of time.”

CoWIN was launched in January 2021 as the foundation of India’s vaccination drive. The platform, which was also available as a mobile app, was used by people to book their vaccination slots and generate a vaccination certificate for themselves and their family members. The government at the time was criticized for making CoWIN the only way for Indians to book a vaccination appointment, excluding millions who didn’t have access to a smartphone or the internet.

This isn’t the first time the news of a CoWIN database has surfaced. In 2021, Dark Leak Market, a hacker group, said it had access to the data of 150 million Indians registered on CoWIN. The health ministry denied the claims, saying the platform stores “all the data in a safe and secure digital environment.” At the time, cybersecurity researchers said they suspected the “leak” was a scam.

Source

Wired