A court used an app called Covenant Eyes to surveil the family of a man released on bond. Now he’s back in jail, and tech misuse may be to blame.

On a Wednesday morning in May, Hannah got a call from her lawyer—there was a warrant out for her husband’s arrest. Her thoughts went straight to her kids. They were going to come home from school and their father would be gone. “It burned me,” Hannah says, her voice breaking. “He hasn’t done anything to get his bond revoked, and they couldn’t prove he had.”

Hannah’s husband is now awaiting trial in jail, in part because of an anti-pornography app called Covenant Eyes. The company explicitly says the app is not meant for use in criminal proceedings, but the probation department in Indiana’s Monroe County has been using it for the past month to surveil not only Hannah’s husband but also the devices of everyone in their family. To protect their privacy, WIRED is not disclosing their surname or the names of individual family members. Hannah agreed to use her nickname.

Prosecutors in Monroe County this spring charged Hannah’s husband with possession of child sexual abuse material—a serious crime that she says he did not commit and to which he pleaded not guilty. Given the nature of the charges, the court ordered that he not have access to any electronic devices as a condition of his pretrial release from jail. To ensure he complied with those terms, the probation department installed Covenant Eyes on Hannah’s phone, as well as those of her two children and her mother-in-law. 

In near real time, probation officers are being fed screenshots of everything Hannah’s family views on their devices. From images of YouTube videos watched by her 14-year-old daughter to online underwear purchases made by her 80-year-old mother-in-law, the family’s entire digital life is scrutinized by county authorities. “I’m afraid to even communicate with our lawyer,” Hannah says. “If I mention anything about our case, I’m worried they are going to see it and use it against us.”

Covenant Eyes is part of a multimillion-dollar market of “accountability” apps sold to churches and parents as a tool to police online activity. For a monthly fee, the app monitors every single thing a user does on their devices, then sends the data it collects, including screenshots, to an “ally” or “accountability partner,” who can review the user’s online activities.

For Hannah’s family, their Covenant Eyes “allies” are two probation officers in Monroe County’s Pretrial Services Program charged with scrutinizing their web activity and ensuring that Hannah’s husband does not violate the terms of his bond while using one of his family members’ devices.

Covenant Eyes doesn’t permit its software to be used in a “premeditated legal setting,” such as monitoring people on probation, according to its terms of service. But public spending documents, court records, and interviews show that courts in at least five US states have used Covenant Eyes to surveil the devices of people who are awaiting trial or released on parole.  

Neither Covenant Eyes nor multiple officials in Monroe County responded to repeated requests for comment and detailed questions about the app’s monitoring.

While the use of Covenant Eyes in a criminal-legal setting likely only represents a tiny fraction of the hundreds of thousands of people under court-ordered electronic surveillance, the stakes are still high for those required to use it. The app’s accuracy could determine whether a loved one lives at home or behind bars. Legal experts say that its use raises serious constitutional and due process concerns.  

“This is the most extreme type of monitoring that I’ve seen,” says Pilar Weiss, founder of the National Bail Fund Network, a network of over 90 community bail and bond funds across the United States. “It’s part of a disturbing trend where deep surveillance and social control applications are used pretrial with little oversight.”

“It Felt Like Entrapment”

The Covenant Eyes app was developed by Michael Holm, a former National Security Agency mathematician who now works as a data scientist for the company. It captures everything visible on a device’s screen, taking at least one screenshot per minute.  It then analyzes the screenshots locally before slightly blurring them and saving them on a server. Images the system marks as possibly “explicit” are flagged for further review. For example, one Covenant Eyes report sent to Hannah’s probation officer, which WIRED reviewed, flagged an online advertisement for a back brace that included a woman in a tank top as “potentially concerning.” 

The app also monitors every network request a device makes, blocking allegedly pornographic content and alerting allies about requests the software deems suspicious.

The day her husband was released on bond, Hannah sat down with their kids and tried to explain how all of their devices were going to be monitored: The probation department would see anything they looked at on their phones and assume it was their father using the device. The constant surveillance had an immediate impact on the family, Hannah says.

Hannah began skipping her online therapy sessions, fearing that the probation officers would snoop on what she told her doctor. She says her 12-year-old son approached her a half-dozen times to ask things like, “Mom, will Pocket Mortys get dad in trouble?” Her daughter was afraid to text with her friends, worrying that if she used bad language, her father could end up in jail. “It was like the family was being charged with a crime,” Hannah says. “It felt like entrapment.” 

While the images in the Covenant Eyes reports that WIRED reviewed are partially blurred, it is sometimes possible to discern sensitive information from them. For instance, one Covenant Eyes report shows a screenshot of Hannah’s mother-in-law’s device while a phone call was in progress. The report clearly shows the name of the person being contacted. Another shows screenshots of Hannah’s mother-in-law’s bank statements and her Gmail inbox, although the sensitive details in both are unreadable.

Covenant Eyes doesn’t just block pornography. Though the app is designed to block traffic to adult sites, Hannah shared reports that show she was unable to access The Appeal, a nonprofit news organization that focuses on injustice in the criminal-legal system. 

Molly Greene, The Appeal’s strategy and legal director, calls the censorship alarming. “It’s incredibly concerning to hear readers say they can no longer access our website as a result of this app,” she says. ​​“This kind of abuse of judicial power to restrict people’s autonomy and ability to access critical information on the criminal legal system is exactly why The Appeal exists.”

Less than a week after Covenant Eyes was installed on the four phones in her household, Hannah got a call from her husband’s probation officer saying that her husband had violated the terms of his bond. According to Hannah, the officer said Covenant Eyes detected that her phone had visited Pornhub. Court records WIRED reviewed cite a visit to the adult website as the reason for revoking his bond.

But Hannah claims that her husband didn’t touch her phone and that no one had visited Pornhub. Instead, she says, her phone had made a network request to the website’s servers as part of a background app refresh from a frequently visited tab on her Chrome browser.

WIRED tested Hannah’s claims that Covenant Eyes flags background network activity from websites that aren’t intentionally viewed. Using an iPhone, we visited Pornhub enough times that it was a frequently visited tab on Google Chrome. We then installed Covenant Eyes and restarted our phone. Within minutes, Covenant Eyes alerted our designated accountability partner that a request to Pornhub was made from our test device, even though we never touched it. 

This is a known issue with Covenant Eyes. The alert Covenant Eyes sent when it detected a network request to Pornhub explicitly stated that the software cannot determine if the user “intentionally viewed” the webpage because “some apps generate activity in the background without the member’s consent.” The company has public documentation about the shortcoming. 

This limitation in Covenant Eyes means it’s possible Hannah’s husband did not violate the terms of his bond. Moreover, the terms of her husband’s bond don’t prohibit Hannah from looking at pornography, and it would be impossible for probation officers to know who was using the device from Covenant Eyes reports alone. Yet, in the motion to revoke Hannah’s husband’s bond, the only evidence prosecutors presented was information from the Covenant Eyes report.

According to Kate Weisburd, an associate professor at George Washington University School of Law, challenging probation and parole violations is difficult, particularly when they’re based on electronic evidence. Courts are largely reluctant to find due process problems with electronic surveillance, she says, and overworked defense attorneys often lack the capacity to bring a challenge.

Hannah printed the Covenant Eyes documentation and hand-delivered it to the prosecutors, the judge, and the probation department. She never heard back. As a last resort, Hannah emailed Covenant Eyes CEO Ron DeHaas. In an email exchange Hannah shared with WIRED, DeHaas was apologetic. “Hannah, I’m sorry that you are going through this,” DeHaas wrote. “I will have our legal department follow up with you.”

Hannah says the legal department never reached out.

Constitutional Wrongs

Jonathan Manes, an attorney at the MacArthur Justice Center’s Illinois office, says the surveillance Hannah’s family faces likely violates several of their constitutional rights. “This feels like an extraordinarily intrusive violation of the family’s First Amendment rights to be able to access the internet and communicate without being monitored,” he says. Manes adds that because the software effectively enables continuous and suspicionless searches of the devices of people who haven’t been charged with a crime, the family’s Fourth Amendment rights were potentially violated. 

Lastly, Manes points out that by indiscriminately surveilling whatever the phone is displaying, the app could collect sensitive data that includes the family’s communications with their lawyers, as Hannah feared. “It’s interfering with his right to speak in confidence with his attorney,” he says of Hannah’s husband. “It’s impeding his ability to prepare a defense and exercise that Sixth Amendment right.”

“This strikes me as quite chilling,” Manes adds. “It’s what happens when someone’s home becomes their jail cell, and now everyone they live with is subject to the same kind of surveillance as the person who is charged.”

Several legal experts expressed concern about the monitoring conditions imposed by the judge in Hannah’s husband’s case. But Phyllis Emerick, the chief deputy public defender in Monroe County, argues that because Hannah’s husband and his family consented to the surveillance, they gave up their rights to privacy. “He agreed that he would not access electronic devices in his household in exchange for release,” she says. “It was the family’s choice to continue living with him.”

Weiss, of the National Bail Fund Network, disagrees with the idea that any type of surveillance is permissible so long as a person agrees to it to avoid jail time. “Sure, they consented to this, but it’s at the barrel of a gun,” she says. 

The exact number of individuals or families in Monroe County who have been required to use Covenant Eyes as part of their pretrial release is unclear. In the county’s annual report from 2021, the Probation Department stated that they provided pretrial monitoring for 618 individuals; however, the report does not provide details about the specific type of monitoring involved. The number of individuals who were assigned to be monitored by Covenant Eyes is likely a small percentage of that.

Deputy probation officer Troy Hatfield would not answer specific questions about either Covenant Eyes or Hannah’s husband’s case, but he says the conditions of any defendant’s supervision are ultimately decided by the judge based on the specific facts of each case and department policy.  

Neither Monroe’s chief probation officer, Linda Brady, nor the judge in Hannah’s husband’s case, Mary Ellen Diekhoff, responded to repeated requests for interviews.

It’s also unclear exactly how many jurisdictions in the US  have used Covenant Eyes. Court records WIRED reviewed show that courts in Washington, Montana, and Ohio have each ordered a defendant to use the software at least once. In all of these cases, the defendant faced charges related to child sexual abuse material or child exploitation. In Colorado, spending records show that the State Judicial Branch has purchased services from Covenant Eyes 60 times since 2017. 

Multiple probation officer associations, public defense organizations, and bail funds WIRED contacted had never heard of the software and were unfamiliar with any screen-monitoring software being used for pretrial monitoring.

Independent legal experts who spoke to WIRED say that the use of an app like Covenant Eyes stems from a lack of oversight over how courts deploy punitive surveillance technology and judges’ broad authority to impose monitoring conditions without real accountability. 

“There’s a black box around how all of this technology works and is deployed,” says Weisburd, of George Washington University. “We don’t know error rates, how the technology operates, or even if it’s reliable.” This leaves people vulnerable to faulty technology in high-stakes situations where their freedom hinges on the word of an app. 

This includes Hannah’s husband, who remains in jail based on an automated report from an app that is not meant to be used in criminal proceedings and is known to produce false positives. Hannah, meanwhile, is afraid to stop paying $18.99 a month for a subscription with Covenant Eyes, which is still installed on some of her family’s devices, recording everything they do.

An Anti-Porn App Put Him in Jail and His Family Under Surveillance

Documents WIRED obtained detail new prison-monitoring technology that keeps tabs on inmates' location, heartbeats, and more.

The conditions inside the Fulton County Jail system are dire. Inmates at one of the jails in Atlanta, Georgia, are sleeping on the floor in plastic trays. Cell doors hang off hinges, footage from one local news report shows, and leaked water pools on the floor in some areas. Last September, one person was found dead and covered in bed bugs.

The Fulton County Sheriff’s Office, which runs multiple jails around Atlanta and has been granted more funding to fix the problems, is also in the process of rolling out a new surveillance system that can track inmates to precise levels. Across the region’s jails, hundreds of sensors are being embedded into the walls. Using radio frequencies, these communicate with wristbands issued to inmates.

The system, which was created by Georgia-based firm Talitrix, can track an inmate’s heartbeat, determine their location every 30 seconds, and create 3D images showing who comes into contact with whom. Documents WIRED obtained through a public record request, including a legal agreement, statements of work, and internal PowerPoint presentations, describe how the monitoring system operates and provide a glimpse into its inner workings.

The Fulton County Sheriff’s Office and Talitrix claim the system can help make understaffed jails more efficient and increase overall safety, while monitoring heart rates can alert staff to an inmate’s potential health problems or suicide attempts. Critics, meanwhile, say monitoring technologies subject inmates to more surveillance and fail to address deeper issues with the criminal justice system.

The Talitrix system is one of a number of electronic monitoring devices being deployed in the sprawling web of local jails in the United States—and it may be one of the most sophisticated. Some appear to focus on suicide risk, while others have used RFID chips that are manually scanned. As jails and prisons face staffing shortages, they’ve increasingly turned to automation to monitor and control people caught up in the system. At the same time, academic researchers have said inmates are “one of the best surveilled, data-fied and documented populations,” without a choice to opt out.

“Inside the Walls”

Talitrix’s tracking system is made up of two parts: the physical infrastructure—sensors embedded in the jail and Fitbit-like wearables—and its software that allows corrections officers to monitor data being collected and receive alerts.

Talitrix first started working with Fulton County Sheriff’s Office in September 2021, company documents show. The firm initially ran a trial of its system within one of the region’s jails while it was developing the technology, and it has been expanding its use since February of this year. In total, the documents show, 750 sensors (costing $350 each) are to be installed and 1,000 wristbands (at $130 each) provided. The sensors are being placed around the jail but not within cells, those involved say. Use of the software costs hundreds of thousands of dollars per year.

The plan is for around 450 inmates to wear the wristbands as part of a deal at the region’s main Rice Street jail, says Justin Hawkins, CEO of Talitrix. This includes the psychiatric and acute medical wards. (Lt Col Jarrett Gorlin, from the Sheriff’s Office, confirms that the department has been trialing the wristbands and is planning to further roll out the technology, although a “timeline for the full deployment is yet to be determined.”)

The biometric wristbands are not unlike sports watches, but they have been developed specifically for use in jails and prisons. Hawkins says the wristbands, which don’t have screens or GPS, can track people’s heart rate—oxygen tracking is coming to a future version—and communicate with the sensors in the walls. Hawkins says “several different radio frequencies” have been combined with the company’s algorithm to create the system.

Each band has a battery life of 30 days and a locking mechanism that inmates cannot undo, the CEO says. If a band is cut, it will alert prison staff within 15 seconds, he says. The documents say the system can track where inmates are, recording how long they spend in cells or in specific areas of the jail, such as visitation rooms. A statement of work between the company and the Fulton County Sheriff’s Office from January 2023 says the software should include the ability to “maintain spacing between designated inmates” and “create and archive inmate movement.” It also says the devices are not certified as medical products.

Screenshots of a dashboard of Talitrix’s software, which is called Inside the Walls, show correction officers can see how many inmates are within each area of the jail at any time, names of inmates, their jail-cell numbers, and heart rate details—including the last recorded rate and a graph over time. It shows the number of hours an inmate has been in their cell, compared to outside of it. A tab within the software lists alerts that have issued for inmates when their heart rate has dropped or spiked.

One option within the system is a 3D reconstruction of the jail facility, dubbed a “facility replay.” This shows where inmates, represented by generic human characters, are standing at a given time. Screenshots in a Powerpoint slide show inmates standing near each other.

“I think it’s a terrifying leap forward in terms of using technology to manage the jail population,” says James Kilgore, a media fellow at nonprofit MediaJustice, who has written about electronic monitoring and spent six years incarcerated. “It’s just legitimizing gathering all kinds of biometric data on people that really had nothing to do with people being in jail,” says Kilgore, who reviewed the documents at WIRED’s request. “I just fear what can happen if all of a sudden, the Talitrix says that your heartbeat is going 140 beats per minute, when it isn’t,” Kilgore adds. “And what they’re going to do to you, in response to all that data that they used.”

“The heart rate data is used as a predictor of a potential serious health issue,” says Gorlin from Fulton County Sheriff’s Office. “If the individual falls outside of the prescribed levels, then the facility personnel are alerted. Further, the heart rate is not used in any algorithm that would impact personal privacy.” Gorlin says the location and movement of inmates can help “ensure proper count” and could eventually be used for “alerting jail personnel of two individuals coming into proximity with each other where a violent act could be perpetuated.”

Hawkins says the company’s software takes an average heart rate over an entire minute and uses “predictive analytics” to take into account what a person’s heart rate usually looks like. Both the CEO and Sheriff’s Office official say biometric and location data is “view-only” and that correctional officers are not allowed to edit or export information. “Data is not used or released beyond the application in any fashion, and the application does not integrate with any other state, local, federal, or private application for the purpose of data transmission,” a statement says.

Nicol Turner Lee, director at the Center for Technology Innovation at the Brookings Institution, says the system suggests an “additional layer of surveillance” for those who are incarcerated and that it is crucial this comes with “appropriate privacy protections,” including rules around how collected information can be used. “It’s very important for law enforcement and correctional institutions to ensure the protection of the data being collected so that it’s not straying from its intended purposes,” says Turner Lee, who also reviewed the documents.

“Smart Prisons”

Surveillance and monitoring are intrinsic to prisons and jails around the world. Anne Kaun, a media and communication studies professor at Södertörn University, Sweden, has written a book on technology and prisons and says institutions have been used as testing grounds for surveillance technologies before they are further rolled out. In Sweden during the 1950s, prisons were one of the first places CCTV was used, Kaun says. “There was no discussion about privacy issues at all,” Kaun says. This is being replicated, at least to some extent, Kaun says, with new technological developments.

Recent years have seen an uptick in the use of monitoring technologies within criminal justice systems and immigration enforcement. Hong Kong officials have suggested using facial recognition and robot wardens within prisons to help deal with staff shortages, while GPS ankle monitors and tracking apps are increasingly being used to monitor those who are released. Face recognition smartwatches have been proposed for use in the UK, and Chinese prisons are using “emotion-tracking” technology. Many of the systems have been error-prone, are unproven, or produce inaccurate results for individuals with darker skin tones.

“There’s been this constant iteration of these different monitoring systems,” says Pilar Weiss, the director of the Community Justice Exchange, an NGO that works to end criminalization and incarceration. Weiss says that across the sprawling, largely privatized US prison system, which involves more than 4,000 suppliers providing services, there is little standardization of the systems that are used within jails.

There is likely to be an expansion of monitoring systems across the United States, Turner Less says, because technology can be seen as a quick fix. With the patchwork of state-level privacy laws in place, there is not likely to be the “guidance and guardrails” in place to protect people’s data, Turner Lee adds. “When it comes to those impacted by the criminal justice system and those who are sitting within prisons, there is an implicit assumption that their rights do not matter.”

Hawkins, the Talitrix CEO, says his company is on the verge of signing up more facilities to use its tool and is talking with other state-level correction facilities. He says the ways inmates are treated across the country is not acceptable because there is an over-incarceration rate within the United States, failing infrastructure within prisons, corruption among some officials, and staffing shortages that impact how inmates are treated. “Getting folks out of jail faster, who are not a threat to society, is the best thing that I think the United States could do,” he says.

Ultimately, Kilgore says, putting technology into a system isn’t likely to improve the quality of life within a prison. “We need human solutions,” he says, such as policy changes and programs that address issues with the justice system. “You can’t put this technology into a punitive system and have it be anything but punitive.”

Talitrix Prison-Monitoring System Tracks Inmates Down to Their Heart Rate

Plus: Instagram’s CSAM network gets exposed, Clop hackers claim credit for MOVEit Transfer exploit, and a $35 million crypto heist has North Korean ties.

Apple's Worldwide Developer's Conference this week included an array of announcements about operating system releases and, of course, the company's anticipated mixed-reality headset, Vision Pro. Apple also announced that it is expanding on-device nudity detection for children's accounts as part of its efforts to combat the creation and distribution of child sexual abuse material. The company also debuted more flexible nudity detection for adults.

Internal documents obtained by WIRED revealed new details this week about how the imageboard platform 4chan does, and does not, moderate content—resulting in a violent and bigoted morass. Researchers like a group at the University of Texas, Austin, are increasingly developing support resources and clinics that institutions like local governments and small businesses can lean on for critical cybersecurity advice and assistance. Meanwhile, cybercriminals are expanding their use of artificial intelligence tools to generate content for scams, but defenders are also incorporating AI into their detection strategies.

The US Department of Justice on Friday indicted two Russian men, Alexey Bilyuchenko and Aleksandr Verner, for the 650,000-bitcoin hack of Mt. Gox. The two appear to have been charged in absentia while evading arrest in Russia—unlike one of their alleged accomplices, Alexander Vinnik, who was previously convicted in 2020.

Bilyuchenko and Verner are accused of breaching Mt. Gox in 2011, in the earliest days of that original bitcoin exchange's founding. The DOJ says they slowly siphoned out coins from the exchange for three years until Mt. Gox revealed the theft and declared bankruptcy in February 2014. In the meantime, Bilyuchenko and Vinnik allegedly created an entire _other_ exchange, BTC-e, to launder the proceeds of this massive hack. In the years that followed, BTC-e became a giant cash-out point for criminal cryptocurrency of every kind.

The new indictment against Bilyuchenko and Verner offers only a mixed resolution to the case of one of the biggest-ever cybercriminal thefts. By unsealing the new indictment, the DOJ may be tacitly acknowledging that it won't ever have a chance to lay hands on the two men. The indictment against Vinnik, by contrast, was kept sealed for years until he made the mistake of going on vacation to Greece in 2017. After years in prison in France, Vinnik has now been extradited to face charges in the US, where he's lobbying to be swapped for imprisoned _Wall Street Journal_ reporter Evan Gershkovich.

Critics of end-to-end encryption tools and anonymous networks like the dark web often point to the creation and sharing of child sexual abuse material, or CSAM, as the worst consequence of those tools' privacy. But a new study from _The Wall Street Journal_, the Stanford Internet Observatory, and the University of Massachusetts at Amherst found a vast network of child exploitation images and videos being sold and even commissioned on Instagram's open, public network. And in some cases, its automated recommendation algorithms even promoted more CSAM materials to users who sought that horrific content.

The researchers discovered that certain hashtags on Instagram such as #pedobait and #mnsfw (or "minor not-safe-for-work") led users to hidden—but fully public—groups of hundreds of accounts where CSAM was freely advertised, and where users could commission images and videos of sexual acts and self-harm. In some cases, the accounts even offered to sell in-person sexual encounters with children. And when users sought those vile materials, Instagram's algorithms actively promoted more to them, the researchers found, even as it also posted interstitial warnings to the users that the content was illegal and causes “extreme harm” to children. In response to the study, Instagram has changed those interstitials to block CSAM content rather than merely warn users about its consequences, and Instagram's parent company, Meta, says it's created a new task force to address the problem.

The researchers found that Twitter, too, hosted 128 accounts selling CSAM materials. But that number was less than a third of the 408 accounts selling CSAM on Instagram's much larger network.

The notorious Russia-linked ransomware gang known as Clop took responsibility on Monday for stealing data from what it claims amounts to “hundreds of companies” through a vulnerability in the file-transfer service MOVEit Transfer. Microsoft first attributed the activity to the group on Sunday. Clop is known for exploiting vulnerabilities in popular enterprise web services or equipment to steal data and launch extortion campaigns against a number of organizations at once. The group began attacking the MOVEit Transfer vulnerability at the end of May. 

Another week, another massive crypto heist linked to the Hermit Kingdom's hackers. Last weekend, the independent blockchain analysis sleuth who goes by the name ZachXBT on Twitter posted evidence of $35 million being siphoned out of the addresses of the cryptocurrency firm Atomic Wallet. He found that just five users of the hosted cryptocurrency wallet service had lost $17 million, and one had lost $8 million. “Unfortunately, with the occurrence of this terrifying hack, my life has been disrupted,” one Turkish user who lost their life savings told _Fortune_. Cryptocurrency tracing firm Elliptic quickly found blockchain evidence tying the hack to North Korean state-sponsored hackers. The funds had flowed into Sinbad.io, a cryptocurrency “mixing” service that has quickly become the Kim regime's preferred crypto laundering tool. If the Atomic Wallet was indeed carried out by North Korea—as all signs indicate—it would be the biggest crypto theft the country's hackers have pulled off since the $100 million pillaging of Horizon Bridge a year ago.

9 Years After the Mt. Gox Hack, Feds Indict Alleged Culprits

New testimony from defectors reveals pervasive surveillance and monitoring of limited internet connections. For millions of others, the internet simply doesn't exist.

For 25 million North Koreans, the internet is an impossibility. Only a few thousand privileged members of the hermit kingdom’s society can access the global internet, while even the country’s heavily censored internal intranet is out of reach for the majority of the population. Getting access to free and open information isn’t an option.

New research from South Korea-based human rights organization People for Successful Corean Reunification (Pscore) details the reality for those who—in very limited circumstances—manage to get online in North Korea. The report reveals a days-long approval process to gain internet access, after which monitors sit next to people while they browse and approve their activities every five minutes. Even then, what can be accessed reveals little about the world outside North Korea’s borders.

Documentation from the NGO is being presented today at the human rights conference RightsCon and sheds light on the regime with the most limited internet freedoms, which fall far below the restrictive and surveilled internet access in China and Iran. For millions of people in North Korea, the internet simply doesn’t exist.

“I was taught about the World Wide Web, and even had to memorize it for an exam, but I only knew about the internet in theory,” one North Korean defector who left the country told Pscore researchers. “I knew it was a sort of network where you can search but didn’t actually know what it was.” Another said they didn’t “know the concept of Wi-Fi,” let alone have any clue about Google.

Getting an accurate picture of what happens within Kim Jong Un’s sealed-off state is incredibly challenging. Officials control all information flows and present state propaganda to the world. Analysts turn to those who escape and defect, at great personal risk, for a glimpse of North Korean reality. Pscore’s internet freedom report is based on 24 face-to-face interviews with defectors and a survey of 158 others. All left North Korea between 2012 and 2022.

The report says North Korean researcher Kim Suk-Han—all defector names within the research are pseudonyms for safety reasons—used the internet five times when they were living in the country. They had used the internet while on a trip to China and so had high expectations, they told the researchers. Instead, they faced limited access and constant surveillance.

“A librarian sits between two internet users and continuously monitors what people on both sides are searching up,” Kim said in testimony to the researchers. “Every five minutes, the screen freezes automatically, and the librarian must do a fingerprint authentication to allow further internet use.” A state security officer was also always nearby, they said.

People were allowed to use the internet for an hour, and if someone wanted more time, they would need to obtain new permission, Kim said. It took around two days to get permission from authorities to use the internet, a task requiring approvals from various officials. If someone applied too often, they would be made to wait, Kim said. “Every Korean website is blocked, and only Chinese or English websites are available.”

Over the past decade, there has been an increased number of digital devices in North Korea. Around 50 to 80 percent of adults may now have mobile phones, allowing them to text and call family members. Yet the use of these phones is highly controlled—data speeds are low, with devices capturing screenshots every few minutes and code that only allows government-approved content to be shown. And internet penetration is at nowhere near the same level.

“North Korean people cannot use it, not because of the infrastructure or not because of the country’s poor conditions,” says Nam Bada, the secretary general of Pscore and editor of the report. “It is only because of the governmental policy.”

A few dozen families with connections to Kim Jong-Un and some foreigners have unrestricted access to the global internet, while a “few thousand” people—including government officials, researchers, and students studying IT—can access a surveillance-heavy version of it, according to the report and previous research. North Koreans like Kim who are allowed some foreign travel, usually for business, can sometimes access the global web while abroad.

Mitch Haszard, a senior threat intelligence analyst at security firm Recorded Future, which has previously analyzed North Korean internet traffic, says Chinese and Russian internet service providers hook the country up to the global network, and access by foreign visitors makes up some of what can be seen externally. This may have changed during the Covid-19 pandemic when there were fewer foreigners in North Korea and its borders were closed.

According to multiple defectors quoted in the Pscore report, global internet access is only available in certain locations and buildings within North Korea. One person claimed internet connections at the National Academy of Sciences in Pyongyang, North Korea’s capital, were only available on the second floor, and just eight computers were connected. Around five people were granted use, they said.

Another defector told the Pscore researchers that when they got permission to travel to Pyongyang to use the internet, they tried to download medical research papers but could only access the titles of the papers and the author names. “I knew the concept of the global internet when I was in North Korea, but I didn’t know that so much information was exchanged through it,” said Shin Yong-Rok, another defector.

Martyn Williams is a senior fellow with the Stimson Center and 38 North project who has extensively studied technology in North Korea but was not involved with the report. Williams says the testimonies track with those of other defectors but add new details about the levels of surveillance people face. In general, Williams says, internet access “appears to be available for officially sanctioned uses, such as some universities, research establishments, and likely some trade organizations and other establishments.” University students Williams spoke to have previously said that they are required to state why they need to use the internet and are monitored when they get online.

Williams points to a 2020 North Korean law that has ramped up the country’s efforts to stop foreign information from being accessed in the country. In recent years, outside information—including TV shows and South Korean content—has been smuggled across the border using USB drives, giving people a glimpse of the outside world. “The new law levies harsh penalties, up to and including death, on people caught with foreign information,” Williams says. (In 2021 it was reported that a man who smuggled copies of the dystopian Netflix thriller _Squid Game_ into North Korea and sold them was sentenced to death.)

While tightly controlled access to the internet is available for a few thousand “elites,” the local intranet is marginally more accessible—in theory, at least. Known as Kwangmyong, the intranet offers only a handful of websites. “Citizens can access \[the intranet\] from their phones or from computers,” Williams says. “Over the years, we’ve seen lots of websites shown and offered, and it appears that many major sectors of the government have their own sites with official information.” Some online shopping has recently become available, according to reports.

Defectors told Pscore that intranet prices were generally too high for most people, meaning a lot of access happens at official buildings, such as universities and libraries, where surveillance levels are high. People willing to take the risk can try to get around the system. “I’ve secretly played the game \[_Dota_\] twice through the intranet with people in another region,” said one defector, given the pseudonym Jung Woo-Jin. “I’ve only played three times. If you play more, your IP will be exposed by using more than a certain time, then your place will be recorded.” Most people included in the study said intranet use is impractical.

Pscore’s report lists around two dozen recommendations, addressed to both North Korea and international countries, for improving internet freedom. The report pushes for more connectivity within the country, advising North Korea to stop monitoring people and to connect the intranet to the global internet. If a full internet connection cannot be provided, a censored model like China’s would be a better last resort, the report says.

The report adds that countries should work to create a “legal framework” for international access and recognize internet access as a law-backed human right. Nam, the Pscore secretary general, says increasing internet access could benefit health care and education and improve people’s human rights, such as freedom of expression, association, and peaceful assembly.

Globally, 5.3 billion people regularly use the internet, or around 66 percent of Earth’s population. For years, official bodies have declared internet access to be a human right—with the United Nations saying there should be full connectivity by 2030. “The real problem is how to translate these commitments into reality,” says Barbora Bukovská, senior director of law and policy at human rights organization Article 19. “This includes issues such as making the internet affordable, getting people online, acquiring minimum digital skills and literacy, or achieving equality in access for marginalized groups and those at risk of discrimination.”

Bukovská says North Korea’s human rights record indicates that mandating internet access at a global level would likely not make much difference—bigger change within the country would be needed to implement such changes. But for those who have managed to leave the country, the difference is stark. “People will long for any new information, such as science and technology information,” defector Kim Suk-Han told researchers, “which are accessible through the internet.”

The Bizarre Reality of Getting Online in North Korea

UT-Austin will join a growing movement to launch cybersecurity clinics for cities and small businesses that often fall through the cracks.

The idea for the UT-Austin project emerged from discussions in CISA’s Cybersecurity Advisory Committee, a group of experts from the private sector, academia, civil society, and local government. During conversations about a university running a municipal cyber helpline, Austin quickly emerged as the ideal candidate, thanks to its already popular 311 service and the support of two committee members: Steve Adler, who was then Austin’s mayor, and Chesney, an influential UT faculty member.

CISA director Jen Easterly has championed the project and recently told the advisory committee that her agency will consider launching a nationwide cyber 311 system after evaluating Austin’s new clinic and similar efforts.

“The UT-Austin pilot is helping us better understand how we can provide cybersecurity services for small and medium-size businesses across our nation,” Easterly says in a statement, adding that she is “truly excited” about it.

Building a Clinic

UT-Austin’s clinic will take the form of a two-semester course. In the fall, Francesca Lockhart, a former top Texas homeland security official Chesney recruited to lead the project, will teach students cybersecurity skills and partner them with local organizations and businesses, giving students time to learn how those organizations operate and what they need. In the spring, teams of students will then create and implement cybersecurity improvement plans for their clients.

Lockhart’s curriculum will cover lessons like inventorying the devices on a network, scanning for and fixing known vulnerabilities, configuring a firewall, conducting penetration testing, and understanding the Linux operating system and the Python programming language, which are widely used in diagnosing and fixing security issues. 

The 20 people in the inaugural class include students majoring in business and computer science, but also those studying biochemistry and international relations. Lockhart is still evaluating a variety of potential clients, including small businesses; nonprofits serving vulnerable populations in Austin; neighboring school districts and city governments; and startups focused on fighting hunger, disease, and other social ills.

Lockhart says the clinic represents “a great opportunity to get students real-world career experience and fill the cybersecurity workforce gap while also serving the needs of some of these under-resourced organizations.”

Any expansion to a 311-type service is far off. “You need to walk before you run,” Chesney says.

Expanding the Scope

To Steve Adler, Austin’s former mayor, a cyber helpline would be a natural extension of the UT-Austin project.

Austin’s 311 service already gets calls from people worried about phishing scams and other low-level cyberattacks. The next step would be to create a referral system so 311 operators could turn certain calls over to UT-Austin students trained to handle a wide range of common incidents. “It might expand the scope of what people think would be covered by a 311 call,” says Adler, who served as mayor from 2015 to 2023.

Another state is already forging ahead with this idea. Later this year, Bridgewater State University in Massachusetts will launch a security operations center (SOC) to answer emergency calls from the community. The 24/7 SOC, created in partnership with a state-funded consortium, will be staffed by professional cyber experts, but students will be able to observe and participate in their work.

The Bold Plan to Create Cyber 311 Hotlines

Instead of scanning iCloud for illegal content, Apple's tech will locally flag inappropriate images for kids. And adults are getting an opt-in nudes filter, too.

In December, Apple announced that it was killing a controversial iCloud photo-scanning tool the company had devised to combat child sexual abuse material (CSAM) in what it said was a privacy-preserving way. Apple then said that its anti-CSAM efforts would instead center around its “Communication Safety” features for children, initially announced in August 2021. And at the company's Worldwide Developers Conference in Cupertino today, Apple debuted expansions to the mechanism, including an additional feature tailored to adults.

Communication Safety scans messages locally on young users' devices to flag content that children are receiving or sending in messages on iOS that contain nudity. Apple announced today that the feature is also expanding to FaceTime video messages, Contact Posters in the Phone app, the Photos picker tool where users choose photos or videos to send, and AirDrop. The feature's on-device processing means that Apple never sees the content being flagged, but beginning this fall, Communication Safety will be turned on by default for all child accounts—kids under 13—in a Family Sharing plan. Parents can elect to disable to feature if they choose.

“The Communication Safety feature is one where we really want to give the child a moment to pause and hopefully get disrupted out what might be a grooming conversation,” says Apple's head of user privacy Erik Neuenschwander. “So it’s meant to be high friction. It’s meant to be that there is an answer which we think is likely right in that child’s situation, which is not to move forward, and we really want to make sure they’re educated.”

Apple said in December that it planned to make an application programming interface (API) available so third-party developers could easily integrate Communication Safety into their apps and use it to detect child sexual abuse material, or CSAM. The API, known as the Sensitive Content Analysis framework, is available now for developers. Platforms like Discord have already said that they plan to incorporate it into their iOS apps.

A Communication Safety prompt for a child's account.

Photograph: Apple

One criticism of anti-CSAM initiatives like Communication Safety is that they don't have full coverage across apps and services to flag content and protect children everywhere, potentially allowing communications with abusers to slip through. And this is precisely why Apple says it invested heavily to develop a robust API that app makers can easily incorporate into their software.

“There was a lot of work that we had to do to create this model,” Neuenschwander says. “We can make that investment once and then have that be leveraged across the platform for potentially all of the applications our users use.”

An opt-in Sensitive Content Warning for an adult's account.

Photograph: Apple

On top of Communication Safety, Apple says that it has also received feedback about interest in a version of the feature for adults. So today, the company also launched “Sensitive Content Warning,” which similarly uses local scanning to flag and blur images and videos that contain nudity. The feature is optional and controlled in the iOS “Privacy & Security” settings menu. And it's designed to be more subtle than Communication Safety. The goal is to protect adult users from content they don't want to see without being intrusive or unhelpful.

Meaningfully addressing and reducing child sexual abuse online is a complicated and difficult problem. And Apple says that it isn't done exploring and investing in new solutions. But with such high stakes, there's a real urgency for a company like Apple to roll out features that will have an impact and promote their adoption as widely as possible.

Apple Expands Its On-Device Nudity Detection to Combat CSAM

Data from Cloudflare's free digital defense service, Project Galileo, illuminates new links between online and offline attacks.

internet infrastructure company Cloudflare has offered the free web security service Project Galileo for nearly a decade, giving human rights and public interest organizations around the world access to defenses against DDoS attacks and other common online hacking techniques. More than 2,271 websites in 111 countries now use the service, including 81 Ukrainian organizations, the majority of which joined after the Russian invasion in February 2022. The main aim of Project Galileo is simply to utilize Cloudflare’s products and scale for organizations that might not otherwise have any web defenses at all. By examining the threats that different participants are facing, the company hopes to also raise awareness about what could be coming next.

In Ukraine, for example, Cloudflare found that emergency response services in numerous cities that are enrolled in Project Galileo—including those that perform search and rescue; offer medical care; and distribute supplies like food, water, and medicine—face spikes of malicious traffic concurrent with Russian bombings. Many of the other Ukrainian organizations that use Project Galileo are human rights groups or work in independent media and journalism. They often see increases in attacks around moments of international controversy, like when Russia assumed the presidency of the United Nations Security Council on April 1.

In a report released today, Cloudflare delved into data on attack trends across Project Galileo participants, including those in Ukraine, abortion and reproductive rights organizations, and LGBTQ+ groups. The company says that between July 1, 2022 and May 5, 2023, it mitigated 20 billion attacks against Project Galileo enrollees.

“We’re not specifically placing blame for the sources of the attacks,” says David Belson, Cloudflare’s head of data insight. “But we’re seeing things play out in new and unique ways. In Ukraine, if Russia is trying to attack them physically, and then an actor is trying to prevent them from getting access to the sites that provide emergency resources on the digital side, it’s a new facet in warfare.”

Since last summer, Project Galileo mitigated an average of 790,000 attacks per day against LGBTQ+ organizations and an average of 1.52 million per day against reproductive rights groups, Cloudflare says. In addition to defending against DDoS attacks—firehoses of junk traffic meant to deluge a site and take it down—more and more of the defense Project Galileo provides comes from Cloudflare’s Web Application Firewall. The service helps defend sites against actual web application vulnerability exploitation, including hackers’ attempts to launch common attacks like injecting malicious scripts and manipulating databases.

“In those cases, it means that the attacks were less brute force—‘I’m going to try to knock this site down by throwing a load of garbage traffic at it’—and maybe a slightly more mature type of attack, probing to try to find a way in,” Belson says. “The intent then is not to take them down, but to do something arguably more malicious, like exfiltrate data.”

Defending small or under-resourced sites against DDoS attacks is still a key component of Project Galileo’s offering, though. And Cloudflare researchers emphasize that it’s important for sites to have some sort of protection in place, even if they’ve never been targeted before, because sites with low daily traffic, like those that provide resources to small or regional audiences, can so easily be overwhelmed by an unexpected DDoS attack.

“The goal is to provide some background for civil society groups to make them think about what they should be protecting against and show that these threats are real,” says Alissa Starzak, Cloudflare’s vice president and global head of public policy. “We often see attacks against websites if there are things happening in the physical world—controversy about a subject, focus on a particular topic. The organizations that are targeted are the ones that are navigating that.”

Hacks Against Ukraine's Emergency Response Services Rise During Bombings

Internal company documents reveal how the imageboard’s chaotic moderation allowed racism and violence to take over.

On May 14, 2022, 18-year-old Payton Gendron sent out a link to a select group of online friends. It was an invite to a private Twitch stream, access to his running online diary, and an upload of his 180-page manifesto.

Those who clicked the link saw Gendron sitting in his car, in the parking lot of the Tops supermarket in Buffalo, New York. They watched as he lifted his AR-15-style rifle, equipped with a high-capacity magazine, and opened fire. He killed 10 people in just six minutes.

Even before police stopped the massacre and arrested Gendron, the link was being posted to the anonymous imageboard 4chan. On /pol/, the site’s “politically incorrect” board, people commented in real time on the mass shooting. “Why not shoot up the abortion rallys? What a faggot,” one user wrote. Another chimed in: “The kids manifesto is actually pretty good.” Dozens of people who missed the livestream demanded a recording. Others declared it a deep-state false flag operation.

One poster, however, was imploring the site’s users to accept responsibility. “Why is this place so full of hate and anger?” they asked. “It's like a den of inequity \[sic\]. Why don't you people ever express love or compassion?” They uploaded a photo of Payton Gendron, and named the file “the 4chan killer.”

“You made Payton Gentron \[sic\], a sociopathic mass murderer,” they wrote. 

4chan’s moderators soon jumped in and banned the user's account, deleting their comment. The reason for the ban: “Complaining about 4chan.”

The way in which 4chan is managed and moderated is of growing interest among US government officials. The US House of Representatives' January 6 committee subpoenaed 4chan over its role in facilitating the assault on the US Capitol, while investigators with the New York Attorney General’s Office ordered the company to turn over thousands of records to better understand its role in Gendron’s terrorist attack. WIRED obtained a number of internal 4chan documents through a public records request. 

Those documents show how 4chan’s team of moderators—janitors, in their own nomenclature—manage the site. Internal emails, chat logs, and moderation decisions reveal how the site’s janitors have helped shape it in their own image, using their moderation powers to engender 4chan’s particular brand of edgelord white supremacy. In particular, the documents show how the site’s moderators responded to a wave of attention as their website had, once more, been cited as an ideological driver for an act of mass murder. 

More than that, the documents lay bare the degree to which 4chan’s toxic influence is a design, not a bug.

In his manifesto, Gendron credited 4chan with showing him “the truth”—that is, a deeply paranoid and racist belief that “the White race is dying out.” He selected the Tops supermarket specifically because it was in a predominantly Black neighborhood. 4chan, too, told him what to do about it. Years earlier, browsing the site, he had come across a video of 28-year-old Brenton Tarrant stalking through the Al Noor mosque in Christchurch, New Zealand, in 2019, murdering 51 people.

In launching the attack in Buffalo, Gendron was following in Tarrant’s footsteps. He even liberally plagiarized Tarrant’s manifesto. And he made regular use of 4chan’s insular, hateful lexicon of memes and in-jokes.

While Gendron has pled guilty to murder, domestic terrorism, and hate crimes charges, and is awaiting trial on additional federal charges, the families of some of the victims have filed a lawsuit against a number of social media companies, including 4chan, Discord, Reddit, Snapchat, Alphabet, Meta, and Amazon. They allege that Gendron’s radicalization was caused by an inability, or outright refusal, by these companies to stem the flow of violent conspiracy theories online.

Many of the companies named, however, do make a concerted effort to remove extremist content. But 4chan is markedly different. Its rules and moderation practices entrench its politics and culture in a major way. What is and isn’t allowed on the imageboard helps explain how it has become a website where racial slurs are used like commas, and where users frequently counsel each other to die by suicide and take as many people with them as they can.

Its rules are simultaneously more onerous and more permissive than other social media sites. 4chan has 17 “Global Rules.” The first forbids any content that violates US law. “Any sort of threat of violence or terroristic acts would violate Global Rule #1,” the 4chan administrators wrote to the New York attorney general.

Another rule, technically, bans racism—except on /b/, 4chan’s “random” board. There, racism is both allowed and encouraged. 4chan leadership confessed to the New York Attorney General’s Office that they take a permissive attitude towards racism on the /pol/ board as well. It is a similar approach to how 4chan handles “My Little Pony” content. (“All pony/brony threads, images, Flashes, and avatars belong on /mlp/,” the rules read.)

The site’s Global Rules are augmented by hundreds of other board-specific rules. In practice, however, 4chan users know that the application of these rules is often arbitrary and that much depends on the moderator enforcing them. The janitors are free to deem just about anything “off-topic,” or to just make up their own rules as they go.

According to 4chan’s filings to the New York Attorney General’s Office, the website regularly issues between 5,000 and 7,000 bans per day. That doesn’t include post deletions that do not result in an IP address ban. The website’s paid administrators submitted over 500 ban records to the state of New York, all of which touched—at least tangentially—on Gendron’s massacre in Buffalo.

Roughly 60 percent of those bans were because posts were off-topic, or on the wrong board. One person, for example, was banned for posting in /k/, the weapons board used by Gendron to pick his gear and prepare for his attack, to ask, “At what point do you people acknowledge we need some sort of restrictions or controls in this country?” The board’s rules state that “All images and discussion should pertain to firearms, military vehicles, knives, realistic mil-sim games, and other weapons.” (/k/ has just one board-specific rule: “All weaponry is welcome.”)

According to the cross-section of bans provided to New York, which were issued in the days after the Buffalo mass shooting, 21 bans were imposed for violating US law. Some of those were, as 4chan pointed out to the Attorney General’s Office, for counseling for further terror attacks. The posts encouraged fellow 4chan users to kill politicians, journalists, law enforcement officials, Jewish and Black people, and to target Pride events. 

In practice, however, the majority of calls for violence on 4chan do not result in bans. Users frequently make calls to instigate a race war—a “boogaloo,” in far-right parlance—or make threats against individuals or whole classes of people. Their vitriol is particularly vile when it comes to Black, queer, and Jewish people.

Users counsel each other to “go full ER”—a reference to Elliot Rodger, who, aged 22, murdered six people at his university in Isla Vista, California, in 2014 before dying by suicide. That kind of encouragement has been reflected back to 4chan by those who follow through on acts of violence. When 25-year-old Alek Minassian rammed a van through a crowd  of people in Toronto, Canada, in 2018, killing 11 and injuring 15, some critically, he uploaded a post to Facebook immediately beforehand, making a convoluted reference to “Sgt 4chan” and the “Supreme Gentleman Elliot Rodger!”

Mike Chitwood, the sheriff of Florida’s Volusia County, has gone out of his way to underscore just how prevalent these violent threats are on 4chan. His office has arrested multiple 4chan users for issuing specific threats against the sheriff himself. Users, undeterred and without reprimand from moderators, have responded with posts like: “Kill Sheriff Shitwood.” “Behead Sheriff Shitwood.” “Roundhouse kick Sheriff Shitwood into the concrete.”

One particularly conspiratorial and racist poster, who sported a Nazi flag icon, was more blunt than many of their fellow users about 4chan’s toxic impact: “Hoping some kid reads this.. kinda keeps it in the back of his mind.. then if all things and chances fall in place then those kids may start a boogaloo in the future.”

4chan wasn’t always a hotbed of racial animus and hatred. When its founder, Chris Poole, ran the site, he was locked in a constant effort to keep it from sliding into racist chaos. Right until he quit the site in 2015, Poole actively resisted its emerging political streak. Initially, the imageboard trended towards a progressive libertarianism epitomized by the hacktivist group Anonymous. With time, however, it developed a harder edge.

At one point, 4chan had been organizing raids on the notorious neo-Nazi forum Stormfront. But around 2010, Poole was reckoning with the fact that some of the boards on his website had essentially “become Stormfront,” as Dale Beran writes in _It Came From Something Awful._

In 2011, Poole created /pol/ explicitly to contain this growing far-right attitude, hoping it would spread no further. It didn’t work. “Rather, 4chan’s new neo-Nazi section thrived,” Beran writes.

Poole would keep trying, in vain, to stem the growing vitriol. In 2014, the anti-feminist Gamergate movement took hold on 4chan. Poole tried to ban all discussions of Gamergate, but the reactionary ethos of the movement seeped into the website just the same.

Soon after, Poole lost his stomach for the fight. In 2015 he sold the site to Hiroyuki Nishimura, a Japanese internet tycoon and founder of 2channel, on which 4chan is based. Nishimura, backed by millions of dollars in investment from Japanese toy company Good Smile, became the sole owner of 4chan. But his involvement has been largely hands-off. To help manage, moderate, and cultivate the imageboard, he enlisted the help of one of its most senior janitors: RapeApe.

The senior moderator, sometimes referred to as “GrapeApe,” has exercised an enormous influence on 4chan over the past decade. As one former moderator told Motherboard in 2020, “RapeApe has an agenda: He wants /pol/ to have an influence on the rest of the site and \[its\] politics.”

Documents turned over to New York investigators reveal that 4chan signed an agreement to pay RapeApe $3,000 a month for their services in 2015. By May 2022, that fee had risen to $4,400 a month. (RapeApe is one of very few 4chan staff who receive a salary.)

Tasked with compiling these records for the New York attorney general, Nishimura offered them some overtime. “Could you add $1000 with an invoice for next month?” Nishimura wrote to RapeApe in 2022. “New York Attorney General paper works takes so much \[of\] your time. Thank you so much for you work!”

After the Buffalo terrorist attack, one user posted a link to the Motherboard story to multiple sections of 4chan and laid the carnage at RapeApe’s feet. “I’ve been saying for years that rapeape’s /pol/tardation would result in severe consequences, and the mass shooting in Buffalo has proven me right,” they wrote. “Therefore, the only possible way to save this website is to have him doxxed, hunted down, and murdered.”

The user was banned for violating US law.

In the hour after Gendron’s attack, 4chan’s moderators congregated in a chat room.

“Apparently today's mass shooter makes 4chan responsible in his manifesto,” one janitor, Astria, wrote. “4chan being associated with such an atrocity is the last thing I wanted.” The moderators hoped it was fake. “You couldn’t do a better job at making 4chan look bad.” 

Another janitor, Troid, wondered why they should bother discussing the mass murder. “What's the point of even mentioning it? unless we plan to do something about it, which we don't.”

“Be easy on him troid, its his first 4chan mass shooter as a mod ;^),” wrote a third janitor, yournamehere.

Janitor Aeolian jumped in to insist it wasn’t their fault. “IMO this guy is an 8chan user, not really a 4chan user. I also think we do a really good job moderating potential threats. I don’t feel we’re lacking anywhere on the site in that regard.”

In his manifesto, however, Gendron credits 4chan with his radicalization. While he credits 8chan as well, Gendron heaps praise on /pol/ and /k/, the guns board, for showing him the “truth” and helping him maximize his chances of carnage.

“I got a lot of information from Plateland; a discord I found on 4chan’s /k/ board (love you guys),” Gendron wrote.

Troid wasn’t as quick to dismiss 4chan’s role. “There are in fact threads about the great replacement on /pol/,” they wrote. “Let's not pretend we don't know what the connection is and why people would question 4chan in this instance.”

The other janitors—whose display names in the chat do not necessarily correspond to their 4chan usernames—agreed. But in the ensuing hours and days, the conversation in the chat room drifted away from self-reflection. The moderators shifted blame onto other websites (“If he was on 4chan he wasn’t ‘from’ here.”), mocked federal agencies trying to investigate the litany of threats posted to the website (“We get tons of emails about each moron who makes one of those troll posts”), and lauded their own moderation efforts.

In the chat room, set up to help janitors discuss their moderation practices, a junior janitor asked if requesting or sharing the video of the massacre violated the rules. “It’s prolly fine,” replied CIAeolian, a more senior moderator. (It’s unclear from the documents whether Aeolian and CIAeolian are the same person.) The debate turned toward which channel was the best placed to host recordings of the livestream.

CIAeolian replied later with a clarification on 4chan’s first rule. Violating US law, they said, is “serious” and comes with “a long ban duration.” So it should be reserved for the most obvious violations, they added. ”E.g. ‘I’m going to commit a crime at date, time, place, location’ or ‘How do I acquire \[illegal thing\]?’” 

Nearly a week after the Buffalo terrorist attack, RapeApe and dsw—two moderators on 4chan’s payroll—had a conversation about the fallout. They had just received notice from their advertising platform, Bid.Glass, that 4chan was being dropped.

“We just got a termination notice from Bid.Glass. I'm going to try to talk him out of it (it's basically one dude running the company), but in the likely event that fails we are going to need some kind of replacement,” RapeApe wrote. They continued: “So far neither the FBI nor the local police have any evidence that the shooter posted on 4chan at all.” 

RapeApe lamented that 4chan was “getting the shaft” as other websites, like Reddit and Discord, were being let off “scot free.” 

Reddit, however, aggressively moderates communities known to be advocating racism and violence—and it has outright banned a litany of far-right and incel communities. In his diary, Gendron wrote, “Many subreddits I joined have been banned.” Discord, meanwhile, took a number of steps to improve moderation in the wake of the Buffalo shooting, including banning the community where Gendron got tactical advice and partnering with the Global Internet Forum to Counter Terrorism. While it remains to be seen how effective those kinds of tactics are, Reddit and Discord can claim they are taking some action.

4chan, meanwhile, seems determined to change as little as possible, even if it could mean more acts of domestic terrorism carried out by its users.

“This will never change unfortunately,” dsw wrote. “Unless we do soemthing \[sic\] drastic like removing pol and all other random boards,” they wrote. RapeApe dismissed the suggestion less than 20 seconds later. “Even if we do none of these companies are going to accept us.”

“They might, if 4chan rebrands itself,” dsw replied. But RapeApe wasn’t swayed.

“That’s naive.”

Inside 4chan’s Top-Secret Moderation Machine

Plus: Amazon’s Ring was ordered to delete algorithms, North Korea’s failed spy satellite, and a rogue drone “attack” isn’t what it seems.

Code hidden inside PC motherboards left millions of machines vulnerable to malicious updates, researchers revealed this week. Staff at security firm Eclypsium found code within hundreds of models of motherboards created by Taiwanese manufacturer Gigabyte that allowed an updater program to download and run another piece of software. While the system was intended to keep the motherboard updated, the researchers found that the mechanism was implemented insecurely, potentially allowing attackers to hijack the backdoor and install malware.

Elsewhere, Moscow-based cybersecurity firm Kaspersky revealed that its staff had been targeted by newly discovered zero-click malware impacting iPhones. Victims were sent a malicious message, including an attachment, on Apple’s iMessage. The attack automatically started exploiting multiple vulnerabilities to give the attackers access to devices, before the message deleted itself. Kaspersky says it believes the attack impacted more people than just its own staff. On the same day as Kaspersky revealed the iOS attack, Russia’s Federal Security Service, also known as the FSB, claimed thousands of Russians had been targeted by new iOS malware and accused the US National Security Agency (NSA) of conducting the attack. The Russian intelligence agency also claimed Apple had helped the NSA. The FSB did not publish technical details to support its claims, and Apple said it has never inserted a backdoor into its devices.

If that’s not enough encouragement to keep your devices updated, we’ve rounded up all the security patches issued in May. Apple, Google, and Microsoft all released important patches last month—go and make sure you're up to date.

And there’s more. Each week we round up the security stories we didn’t cover in depth ourselves. Click on the headlines to read the full stories. And stay safe out there.

Lina Khan, the chair of the US Federal Trade Commission, warned this week that the agency is seeing criminals using artificial intelligence tools to “turbocharge” fraud and scams. The comments, which were made in New York and first reported by Bloomberg, cited examples of voice-cloning technology where AI was being used to trick people into thinking they were hearing a family member’s voice.

Recent machine-learning advances have made it possible for people’s voices to be imitated with only a few short clips of training data—although experts say AI-generated voice clips can vary widely in quality. In recent months, however, there has been a reported rise in the number of scam attempts apparently involving generated audio clips. Khan said that officials and lawmakers “need to be vigilant early” and that while new laws governing AI are being considered, existing laws still apply to many cases.

In a rare admission of failure, North Korean leaders said that the hermit nation’s attempt to put a spy satellite into orbit didn’t go as planned this week. They also said the country would attempt another launch in the future. On May 31, the Chollima-1 rocket, which was carrying the satellite, launched successfully, but its second stage failed to operate, causing the rocket to plunge into the sea. The launch triggered an emergency evacuation alert in South Korea, but this was later retracted by officials.

The satellite would have been North Korea’s first official spy satellite, which experts say would give it the ability to monitor the Korean Peninsula. The country has previously launched satellites, but experts believe they have not sent images back to North Korea. The failed launch comes at a time of high tensions on the peninsula, as North Korea continues to try to develop high-tech weapons and rockets. In response to the launch, South Korea announced new sanctions against the Kimsuky hacking group, which is linked to North Korea and is said to have stolen secret information linked to space development.

In recent years, Amazon has come under scrutiny for lax controls on people’s data. This week the US Federal Trade Commission, with the support of the Department of Justice, hit the tech giant with two settlements for a litany of failings concerning children’s data and its Ring smart home cameras.

In one instance, officials say, a former Ring employee spied on female customers in 2017—Amazon purchased Ring in 2018—viewing videos of them in their bedrooms and bathrooms. The FTC says Ring had given staff “dangerously overbroad access” to videos and had a “lax attitude toward privacy and security.” In a separate statement, the FTC said Amazon kept recordings of kids using its voice assistant Alexa and did not delete data when parents requested it.

The FTC ordered Amazon to pay around $30 million in response to the two settlements and introduce some new privacy measures. Perhaps more consequentially, the FTC said that Amazon should delete or destroy Ring recordings from before March 2018 as well as any “models or algorithms” that were developed from the data that was improperly collected. The order has to be approved by a judge before it is implemented. Amazon has said it disagrees with the FTC, and it denies “violating the law,” but it added that the “settlements put these matters behind us.”

As companies around the world race to build generative AI systems into their products, the cybersecurity industry is getting in on the action. This week OpenAI, the creator of text- and image-generating systems ChatGPT and Dall-E, opened a new program to work out how AI can best be used by cybersecurity professionals. The project is offering grants to those developing new systems.

OpenAI has proposed a number of potential projects, ranging from using machine learning to detect social engineering efforts and producing threat intelligence to inspecting source code for vulnerabilities and developing honeypots to trap hackers. While recent AI developments have been faster than many experts predicted, AI has been used in the cybersecurity industry for several years—although many claims don’t necessarily live up to the hype.

The US Air Force is moving quickly on testing artificial intelligence in flying machines—in January, it tested a tactical aircraft being flown by AI. However, this week, a new claim started circulating: that during a simulated test, a drone controlled by AI started to “attack” and “killed” a human operator overseeing it, because they were stopping it from accomplishing its objectives.

“The system started realizing that while they did identify the threat, at times the human operator would tell it not to kill that threat, but it got its points by killing that threat,” said Colnel Tucker Hamilton, according to a summary of an event at the Royal Aeronautical Society, in London. Hamilton continued to say that when the system was trained to not kill the operator, it started to target the communications tower the operator was using to communicate with the drone, stopping its messages from being sent.

However, the US Air Force says the simulation never took place. Spokesperson Ann Stefanek said the comments were “taken out of context and were meant to be anecdotal.” Hamilton has also clarified that he “misspoke” and he was talking about a “thought experiment.”

Despite this, the described scenario highlights the unintended ways that automated systems could bend rules imposed on them to achieve the goals they have been set to achieve. Called specification gaming by researchers, other instances have seen a simulated version of _Tetris_ pause the game to avoid losing, and an AI game character killed itself on level one to avoid dying on the next level.

AI Is Being Used to ‘Turbocharge’ Scams

Criminals may use artificial intelligence to scam you. Companies, like Google, are looking for ways AI and machine learning can help prevent phishing.

When Aparna Pappu, vice president and general manager of Google Workspace, spoke at Google I/O on May 10, she laid out a vision for artificial intelligence that helps users wade through their inbox. Pappu showed how generative AI can whisper summaries of long email threads in your ear, pull in relevant data from local files as you salsa together through unread messages, and dip you low to the ground as it suggests insertable text. Welcome to the inbox of the future. 

While the specifics of how it’ll arrive remain unclear, generative AI is poised to fundamentally alter how people communicate over email.  A broader subset of AI, called machine learning, already performs a kind of safety dance long after you've logged off. “Machine learning has been a critical part of what we’ve used to secure Gmail,” Pappu tells WIRED.

A few, errant clicks on a suspicious email can wreak havoc on your security, so how does machine learning help deflect phishing attacks? Neil Kumaran, a product lead at Google who focuses on security, explains that machine learning can look at the phrasing of incoming emails and compare it to past attacks. It can also flag unusual message patterns and sniff out any weirdness emanating from the metadata.

Machine learning can do more than just flag dangerous messages as they pop up. Kumaran points out that it also can be used to track the people responsible for phishing attacks. He says, “At the time of account creation, we do evaluations. We try to figure out, ‘Does it look like this account is going to be used for malicious purposes?’” In the event of a successful phishing attack on your Google account, AI is involved with the recovery process as well. The company uses machine learning to help decide which login attempts are legit.

“How do we extrapolate intelligence from user reports to identify attacks that we may not know about, or at least start to model the impact on our users?” asks Kumaran. The answer from Google, like the answer to many questions in 2023, is more AI. This instance of AI is not a flirty chatbot teasing you with long exchanges late into the night; it’s a burly bouncer kicking out the rabble-rousers with its algorithmic arms crossed.

On the reverse side, what’s instigating even more phishing attacks on your email inbox? I’ll give you one guess. First letter “A,” last letter “I.” For years, security experts have warned about the potential for AI-generated phishing attacks to overwhelm your inbox. “It’s very, very hard to detect AI with the naked eye, either through the dialect or through the URL,” says Patrick Harr, CEO of SlashNext, a messaging security company. Just like when people use AI-generated images and videos to create fairly convincing deepfakes, attackers may use AI-generated text to personalize phishing attempts in a way that’s difficult for users to detect.

Multiple companies focused on email security are working on models and using machine-learning techniques in an effort to further protect your inbox. “We take the corpus of data that’s coming in and do what’s called supervised learning,” says Hatem Naguib, CEO of Barracuda Networks, an IT security firm. In supervised learning, someone adds labels to a portion of the email data. Which messages are likely to be safe? Which ones are suspicious? This data is extrapolated to help a company flag phishing attacks with machine learning.

It's a valuable aspect of phishing detection, but attackers remain on the prowl for ways to circumvent protections. A persistent scam about a made-up Yeti Cooler giveaway evaded filters last year with an unexpected kind of HTML anchoring. 

Cybercriminals will remain intent on hacking your online accounts, especially your business email. Those who utilize generative AI may be able to better translate their phishing attacks into multiple languages, and chatbot-style applications can automate parts of the back-and-forth messages with potential victims.

Despite all of the possible phishing attacks enabled by AI, Aparna Pappu remains optimistic about the continued development of better, more refined security protections. “You’ve lowered the cost of what it takes to potentially lure someone,” she says. “But, on the flip side, we’ve built up greater detection capabilities as a result of these technologies.”

Source

Wired