In response to an EU proposal to scan private messages for illegal material, the country's officials said it is “imperative that we have access to the data.”

Spain has advocated banning encryption for hundreds of millions of people within the European Union, according to a leaked document obtained by WIRED that reveals strong support among EU member states for proposals to scan private messages for illegal content.

The document, a European Council survey of member countries’ views on encryption regulation, offered officials’ behind-the-scenes opinions on how to craft a highly controversial law to stop the spread of child sexual abuse material (CSAM) in Europe. The proposed law would require tech companies to scan their platforms, including users’ private messages, to find illegal material. However, the proposal from Ylva Johansson, the EU commissioner in charge of home affairs, has drawn ire from cryptographers, technologists, and privacy advocates for its potential impact on end-to-end encryption.

For years, EU states have debated whether end-to-end encrypted communication platforms, such as WhatsApp and Signal, should be protected as a way for Europeans to exercise a fundamental right to privacy—or weakened to keep criminals from being able to communicate outside the reach of law enforcement. Experts who reviewed the document at WIRED’s request say it provides important insight into which EU countries plan to support a proposal that threatens to reshape encryption and the future of online privacy.

Of the 20 EU countries represented in the document leaked to WIRED, the majority said they are in favor of some form of scanning of encrypted messages, with Spain’s position emerging as the most extreme. “Ideally, in our view, it would be desirable to legislatively prevent EU-based service providers from implementing end-to-end encryption,” Spanish representatives said in the document.

The source of the document declined to comment and requested anonymity because they were not authorized to share it.

“It is shocking to me to see Spain state outright that there should be legislation prohibiting EU-based service providers from implementing end-to-end encryption,” says Riana Pfefferkorn, a research scholar at Stanford University’s Internet Observatory in California who reviewed the document at WIRED’s request. “This document has many of the hallmarks of the eternal debate over encryption.”

End-to-end encryption is designed so only the sender and receiver of communications like messages can see their contents. This boxes out all other parties, from scammers to police and even the company providing the digital platform. Law enforcement advocates often propose creating technical mechanisms through which end-to-end encryption can be bypassed for investigations, but cryptographers and other technologists have long argued that this would introduce weaknesses that inherently undermine end-to-end encryption, putting users’ privacy at risk. Furthermore, they have repeatedly concluded that this expanded exposure would ultimately hurt the digital safety and security of vulnerable groups, including children, rather than defend them.

"Breaking end-to-end encryption for everyone would not only be disproportionate, it would be ineffective of achieving the goal to protect children,” says Iverna McGowan, the secretary general of the European branch of the Centre for Democracy and Technology, a digital rights nonprofit organization, who reviewed the document at WIRED’s request.

The leaked document contains the position of members of the police Law Enforcement Working Party, a group of the Council of the European Union that deals with law enforcement views on legislation. Dated April 12, 2023, the document contains 20 countries’ views on a series of questions, including whether they see end-to-end encryption as a hindrance to their work dealing with child sexual abuse and whether they would favor adding wording to the law to stipulate that encryption shouldn’t be weakened. The questions were first posed in January.

WIRED asked all 20 member states whose views are included in the document for comment. None denied its veracity, and Estonia confirmed that its position was compiled by experts working within related fields and at various ministries.

The document reveals strong support for Johansson’s proposal to scan private end-to-end encrypted communications for illegal content. Of the 20 countries included in the document, 15 expressed support for the idea of scanning end-to-end encrypted communications for CSAM. Many framed this type of scanning as a vital tool that would enable authorities to win the fight against child abuse.

“It is of utmost importance to provide clear wording in the CSA Regulation that end-to-end encryption is not a reason not to report CSA material,” Croatia’s representatives said in the document. “Detection orders must necessarily also apply to encrypted networks,” Slovenia said. “We don’t want E2EE encryption to become a ‘safe haven’ for malicious actors,” Romania added.

Denmark and Ireland expressed support for scanning encrypted messengers for child sexual abuse material while also endorsing the inclusion of wording in the law that protects end-to-end encryption from being weakened. The ability to do this would rely on the invention of technology that can scan encrypted messages for illegal content without altering or breaking the security features offered by encryption—a feat cryptographers and cybersecurity experts have said is technically impossible.

The Netherlands, however, stated that this would be possible through “on-device” scanning before the illegal material is encrypted and sent to its recipient. “There are … technologies which may allow for automatic detection of CSAM while at the same time leaving end-to-end encryption intact,” the country’s representatives stated in the document.

“They want to keep the security of encryption whilst being able to circumvent it,” says Ella Jakubowska, a senior policy advisor at European Digital Rights (EDRI). Jakubowska says she is “unsurprised but nevertheless shocked” to see that European countries have a “really shallow understanding” of encryption. “They want privacy but they also want to indiscriminately scan encrypted communications,” Jakubowska says.

In its response, Spain said it is “imperative that we have access to the data” and suggests that it should be possible for encrypted communications to be decrypted. Spain’s interior minister, Fernando Grande-Marlaska, has been outspoken about what he considers the threat posted by encryption. When reached for comment about the leaked document, Daniel Campos de Diego, a spokesperson for Spain’s Ministry of Interior, says the country’s position on this matter is widely known and has been publicly disseminated on several occasions. Edging close to Spain, Poland advocated in the leaked document for mechanisms through which encryption could be lifted by court order and for parents to have the power to decrypt children’s communications.

Jakubowska, who reviewed the document, says that several countries appear to say they would give police access to people’s encrypted messages and communications. Comments from Cyprus, for example, say it is “necessary” that law enforcement authorities have the ability to access encrypted communications to investigate online sexual abuse crimes and that the “impact of this regulation is significant because it will set a precedent for other sectors in the future.” Similarly, officials in Hungary say “new methods of data interception and access are needed” to help law enforcement.

“Cyprus, Hungary, and Spain very clearly see this law as their opportunity to get inside encryption to undermine encrypted communications, and that to me is huge,” Jakubowska says. “They are seeing this law is going far beyond what DG home is claiming that it’s there for.”

Officials in Belgium said in the document that they believe in the motto “security through encryption and despite encryption.” When approached by WIRED, a spokesperson from Belgium’s Ministry of Foreign Affairs initially shared a statement from the country’s federal police saying its position has evolved since it submitted comments for the document and that Belgium is adopting a position, alongside other “like-minded states,” that it wants encryption weakened. However, half an hour later, the spokesperson attempted to retract the statement, saying the country declined to comment.

Security experts have long said that any potential backdoors into encrypted communications or ways to decrypt services would undermine the overall security of the encryption. If law enforcement officials have a way to decipher messages, criminal hackers or those working on behalf of governments could exploit the same capabilities.

Despite the potential attack on encryption from some countries, many nations also appeared to strongly support end-to-end encryption and the protections it provides. Italy described the proposal for a new system as disproportionate. “It would represent a generalized control on all the encrypted correspondence sent through the web,” the country’s representatives said. Estonia cautioned that if the EU mandates the scanning of end-to-end encrypted messages, companies are likely to either redesign their systems so they can decrypt data or shut down in the EU. Triin Oppi, a spokesperson for Estonia’s Ministry of Foreign Affairs, says the country’s position had not changed.

Finland urged the EU Commission to provide more information about the technologies that can fight child sexual abuse without jeopardizing online security and warned that the proposal could conflict with the Finnish constitution.

Representatives from Germany—a country that has staunchly opposed the proposal—said the draft law needs to explicitly state that no technologies will be used that disrupt, circumvent, or modify encryption. “This means that the draft text must be revised before Germany can accept it,” the country said. Member states need to agree on the text for the draft bill before the negotiations can move forward.

“The responses from countries such as Finland, Estonia, and Germany demonstrate a more comprehensive understanding of the stakes in the CSA regulation discussions,” Stanford’s Pfefferkorn says. “The regulation will not only affect criminal investigations for a specific set of offenses; it affects governments’ own data security, national security, and the privacy and data protection rights of their citizens, as well as innovation and economic development.”

Read the full document below:

Leaked EU Document Shows Spain Wants to Ban End-to-End Encryption

The record-breaking GDPR penalty for data transfers to the US could upend Meta's business and spur regulators to finalize a new data-sharing agreement.

Europe’s GDPR has just dealt its biggest hammer blow yet. Almost exactly five years since the continent’s strict data rules came into force, Meta has been hit with a colossal €1.2 billion fine ($1.3 billion) for sending data about hundreds of millions of Europeans to the United States, where weaker privacy rules open it up to US snooping.

Ireland’s Data Protection Commission (DPC), the lead regulator for Meta in Europe, issued the fine after years of dispute about how data is transferred across the Atlantic. The decision says a complex legal mechanism, used by thousands of businesses for transferring data between the regions, was not lawful.

The fine is the biggest GDPR penalty ever issued, eclipsing Luxembourg's $833 million fine against Amazon. It brings the total amount of fines under the legislation to around €4 billion. However, it’s small change for Meta, which made $28 billion in the first three months of this year.

In addition to the fine, the DPC’s ruling gives Meta five months to stop sending data from Europe to the US and six months to stop handling data it previously collected, which could mean deleting photos, videos, and Facebook posts or moving them back to Europe. The decision is likely to bring into focus other GDPR powers, which can impact how companies handle data and arguably cut to the heart of Big Tech’s surveillance capitalism.

Meta says it is “disappointed” by the decision and will appeal. The decision is also likely to heap extra pressure on US and European negotiators who are scrambling to finalize a long-awaited new data-sharing agreement between the two regions that will limit what information US intelligence agencies can get their hands on. A draft decision was agreed to at the end of 2022, with a potential deal being finalized later this year.

“The entire commercial and trade relationship between the EU and the US underpinned by data exchanges may be affected,” says Gabriela Zanfir-Fortuna, vice president of global privacy at Future of Privacy Forum, a nonprofit think tank. “While this decision is addressed to Meta, it is about facts and situations that are identical for all American companies doing business in Europe offering online services, from payments, to cloud, to social media, to electronic communications, or software used in schools and public administrations.”

**‘Bittersweet Decision’**

The billion-euro fine against Meta has a long history. It stems back to 2013, long before GDPR was in place, when lawyer and privacy activist Max Schrems complained about US intelligence agencies’ ability to access data following the Edward Snowden revelations about the National Security Agency (NSA). Twice since then, Europe’s top courts have struck down US–EU data-sharing systems. The second of these rulings, in 2020, made the Privacy Shield agreement ineffective and also tightened rules around “standard contractual clauses (SSCs).”

The use of SCCs, a legal mechanism for transferring data, is at the center of the Meta case. In 2020, Schrems complained about Meta’s use of them to send data to the US. Today’s Irish decision, which is supported by other European regulators, found Meta’s use of the legal tool “did not address the risks to the fundamental rights and freedoms of data subjects.” In short, they were unlawful.

Ireland first decided the tool fell foul of GDPR in July 2022 and since then, the case has been wrapped up in European bureaucracy, with other countries having a say on the decision and deciding the penalties that should apply. Ultimately, through the European Data Protection Board (EDPB), other countries overruled the Irish regulator, which had argued Meta shouldn’t be fined.

“This is an absolutely significant fine and yet, the penalties may be inconsequential for people's rights as Meta can hold on to data it has moved unlawfully,” says Estelle Masse, the global data protection lead at European NGO Access Now. “It's a bittersweet decision.” Since GDPR came into force in May 2018, it has been criticized for not effectively curtailing the worst data practices of Big Tech. Masse argues that Meta should have been made to delete the data it collected unlawfully, and that GDPR enforcement needs to change companies business practices. (In the US, the Federal Trade Commission fined Meta $5 billion in 2019 and has previously ordered companies to delete algorithms created with improperly collected data.)

The new ruling stops short of forcing Meta to delete the data but says it should ensure that all stored data from Europeans be lawfully handled within six months. This could include deletion or moving the data back to Europe, the EDPB says, but could also include Meta using “other technical solutions.”

“One potential option moving forward would be a 'federated' social network, where European data stays in their data centers in Europe, unless users chat with a US friend, for example,” Schrems said in a statement. Zanfir-Fortuna says that data localization can be “very difficult to obtain in practice.”

It is likely, if Meta decides to move data back to Europe, that untangling it all from within its internal systems will be tricky, if not impossible. Previous reports have indicated that Meta doesn’t know where all its data goes, and court documents obtained by the Irish Council for Civil Liberties are said to show “data anarchy at Meta.”

Meta’s president of global affairs, Nick Clegg, said in a statement that the company is appealing the decisions with courts that will be able to “​​pause the implementation deadlines.” Clegg characterized the decision as a threat to the global internet: “Without the ability to transfer data across borders, the internet risks being carved up into national and regional silos, restricting the global economy and leaving citizens in different countries unable to access many of the shared services we have come to rely on.”

**The Simplest Fix**

Lurking behind the colossal fine is the underlying issue of how data is shared between the EU and the US. Europe’s GDPR sets out how companies and other organizations should collect, use, and store people’s data and also increases the rights given to individuals. People can ask what data is held about them or request that information be deleted, for instance.

The rules are stricter than protections put in place in the US, particularly against data collected about non-US citizens, which can be intercepted by intelligence agencies under Section 702 of the Foreign Intelligence Surveillance Act. In October 2022, US president Joe Biden signed an executive order that would introduce limits to what data security agencies can access under a proposed new EU–US Data Privacy Framework.

In Meta’s response to the GDPR decision, Clegg referenced the new international agreement and said that if it comes into force before the Irish deadlines, “our services can continue as they do today without any disruption or impact on users.”

The executive order would, among other things, create a Data Protection Review Court within the US Department of Justice that allows Europeans to challenge how American intelligence agencies use their data. Gloria González Fuster, a professor at the Vrije Universiteit Brussel, says there are “multiple tensions” between the proposed plans. “The very limited information given to complainants by the Data Protection Review Court (DPRC) is one of the major problems,” Fuster says, adding the approach doesn’t match those of Europe’s courts.

Since two previous data-sharing agreements have been struck down by Europe’s courts, it is likely that the new agreement, which could come into force before Meta has to deal with Ireland’s orders, may be challenged. “The framework from the get-go is an improvement from the two previous, but we don't think it gets us to a point where it would stand a legal challenge in the court,” Masse says.

Schrems, who made the original complaint against Meta and was responsible for the cases that destroyed the previous US–EU data-sharing agreements, believes there’s a 10 percent chance Europe’s courts will find the new agreement to be lawful. “The simplest fix,” Schrems said, “would be reasonable limitations in US surveillance law.”

Meta’s $1.3 Billion Fine Is a Strike Against Surveillance Capitalism

While the company’s new top-level domains could be used in phishing attacks, security researchers are divided on how big of a problem they really pose.

At the beginning of May, Google released eight new top-level domains (TLDs)—the suffixes at the end of URLs, like “.com” or “.uk.” These little addendums were developed decades ago to expand and organize URLs, and over the years, the nonprofit Internet Corporation for Assigned Names and Numbers (ICANN) has loosened restrictions on TLDs so organizations like Google can bid to sell access to more of them. But while Google's announcement included light-hearted offerings like “.dad” and “.nexus,” it also debuted a pair of TLDs that are uniquely poised to invite phishing and other types of online scamming: “.zip” and “.mov”.

The two stand out because they are also common file extension names. The former, .zip, is ubiquitous for data compression, while .mov is a video format developed by Apple. The concern, which is already starting to play out, is that URLs that look like file names will open up even more possibilities for digital scams like phishing that trick web users into clicking on malicious links that are masquerading as something legitimate. And the two domains could also expand the problem of programs mistakenly recognizing file names as URLs and automatically adding links to the file names. With this in mind, scammers could strategically buy .zip and .mov URLs that are also common file names—think, springbreak23.mov—so online references to a file with that name could automatically link to a malicious website.

“Attackers will use whatever they can to get inside an organization,” says Ronnie Tokazowski, a longtime phishing researcher and principal threat adviser at the cybersecurity firm Cofense. “Man, this all goes back a long time now. Nothing has changed.”

Researchers have already started seeing malicious actors buying up strategic .zip URLs and begin testing them in phishing campaigns. But reactions are mixed on how much of a negative impact .zip and .mov domains will have when scams that prey on URL confusion are already an inveterate threat. Additionally, proxies and other traffic management tools already deploy anti-phishing protections to cut down on the risks if users mis-click—and .zip and .mov will simply be incorporated into those defenses.

“The risk of confusion between domain names and file names is not a new one. For example, 3M’s Command products use the domain name command.com, which is also an important program on MS DOS and early versions of Windows,” Google told WIRED in a statement. “Applications have mitigations for this (such as Google Safe Browsing), and these mitigations will hold true for TLD’s such as .zip.” The company added that Google Registry already includes mechanisms to suspend or remove malicious domains across all of the company's top-level domains. “We will continue to monitor the usage of .zip and other TLDs, and if new threats emerge we will take appropriate action to protect users,” the company said.

Offering more TLDs broadens the number of URLs that are available to people. This means you have more choices and don't necessarily have to pay a premium to buy the site name you want from an existing owner or speculator who bought up a bunch of historic URLs. And some in the security community feel that, given the already extensive risk of phishing attacks, additions like .zip and .mov add negligible additional danger.

“I don't agree with the assertion that the new TLDs will increase the effectiveness of phishing in any meaningful way—primarily because people are already so easily fooled by URLs,” says security researcher Troy Hunt, who runs the breach-tracking service HaveIBeenPwned. “Not only can we, myself included, not tell the difference between so many ambiguous characters, we also usually have no idea what the correct URL is for many services. I bet you this all blows over before you know it with no incidents of consequence.”

Some researchers feel strongly, though, that a company like Google, which invests so much in anti-scam and anti-phishing work, could have simply opted not to offer these particular TLDs. Even if other top-level domains exist that are also file extensions, they argue that the world doesn't need more of these overlaps.

“Nobody said this was new. In fact, half the issue is that it’s not new,” says security researcher Marcus Hutchins. “We’ve had this issue in the past, and Google has just gone and caused the same problem again. It really seems like they created a big usability and security issue for downstream providers to clean up, all for no reason other than a low-effort money grab.”

The Real Risks in Google’s New .Zip and .Mov Domains

Plus: The FBI gets busted abusing a spy tool, an ex-Apple engineer is charged with corporate espionage, and collection of airborne DNA raises new privacy risks.

OpenAI’s new ChatGPT app for iOS couldn’t have arrived soon enough. Its absence left open a void in Google Play and Apple’s App Store, which have been quietly filling with scam apps that sucker users into paying for weekly or monthly subscriptions, according to research from security firm Sophos. The official ChatGPT app, meanwhile, is free, and an Android version is arriving soon.

But just because something is free doesn’t make it good. Telly TV is offering 55-inch televisions for $0 to the first 500,000 people who join its reservation list. Of course, “free” comes with a catch: The company reserves the right to collect heaps of data about your viewing habits, and the TV includes a built-in camera that can track your movements. Oh, and it has a second screen primarily for bombarding you with ads. But hey, nothing beats free, right?

Elsewhere in the world of tech that has people freaked out, Montana this week became the first state in the US to ban TikTok. The ban, which goes into effect in 2024, is already facing legal challenges on the grounds that it violates TikTok users’ First Amendment rights. Even if the ban remains, getting around it is trivial—just use a VPN.

The families of four people killed in a racism-fueled mass shooting at a grocery store in Buffalo, New York, are suing a slew of companies the plaintiffs say bear some responsibility for the massacre. The companies include Meta, Alphabet, Amazon, Snap, Reddit, and 4chan. Also on the list of defendants is Good Smile, a Japanese toy company that in 2015 purchased a 30 percent stake in 4chan, where the gunman sought advice on how to carry out his attack.

The United States Postal Service doesn’t just deliver mail—it also carries out warrantless mass surveillance. A bipartisan group of US senators this week launched an effort to curb the use of so-called mail covers, which USPS investigators use to gather the information on the outside of letters and packages. The senators say the practice, which does not require a court order, “threatens both our privacy and First Amendment rights.” 

In the UK, the government is working to expand a controversial surveillance program that collects web histories and other “internet connection records” on millions of people. The program began after the 2016 passage of the Investigatory Powers Act, often called the Snooper’s Charter by privacy advocates and other critics. Records show that the program appears to be moving out of its trial phase and may be rolled out nationally. 

Meanwhile, researchers at security firm Kaspersky released new details about a mysterious hacker group that has carried out operations in Ukraine for far longer than people realized. Dubbed Red Stinger by researchers at Malwarebytes, the group has targeted both pro-Ukraine and pro-Russian figures as part of apparent espionage operations. Initially linked to hacks dating back to 2020, researchers now believe Red Stinger has been active for at least 15 years.

But wait, there’s more. Each week we round up the security stories we didn’t cover in depth ourselves. Click on the headlines to read the full stories. And stay safe out there.

Most TikTok challenges you hear about are fake. This one, however, is deadly serious. Automaker Huyandai this week agreed to pay around $200 million to customers whose vehicles were stolen following a viral TikTok challenge that exposed a major security flaw in some Hyundai and Kia vehicles. 

The challenge began after the user “Kia Boys” posted a video to TikTok showing that it was possible to hot-wire the vulnerable vehicles using a USB cable. According to Engadget, at least 14 crashes and eight deaths have been linked to the challenge. Hyundai will pay affected customers up to $6,125 for stolen vehicles and up to $3,375 to cover the cost of damage caused by those who took advantage of the flaw. The company also has an “anti-theft update” available for affected vehicles. Check to see if your vehicle is impacted here.

The US Foreign Intelligence Surveillance Court yesterday unsealed an April 2022 opinion that exposes rampant FBI misuse of the so-called Section 702 database, a vast trove of electronic communication records used by the bureau and the National Security Agency. The court found that the FBI improperly queried the database, established under Section 702 of the Foreign Intelligence Surveillance Act, more than 287,000 times in 2020 and 2021. Targets of the FBI’s searches include January 6 demonstrators, people arrested while protesting the police murder of George Floyd in Minneapolis, and some 19,000 American political donors to an unidentified US congressional campaign. 

Section 702 gives the US government the authority to collect communications of targets overseas. Communications of Americans can get swept into the database when they communicate with someone outside the US. An audit released by the Office of the Director of National Intelligence late last year found several similar instances of the FBI misusing the Section 702 database to perform searches on American citizens, including US congressman Darin LaHood. Following both the ODNI audit and this week’s release of the court’s opinion, the FBI says the abuse was the result of a “misunderstanding” and vowed that it has fixed the problem. Regardless, Section 702 will expire at the end of the year without reauthorization from Congress, which the FBI’s repeated and widespread misuse could jeopardize.

The US Department of Justice on Tuesday announced charges against a former Apple engineer accused of stealing the company’s source code related to its self-driving-car technology. Weibao Wang allegedly stole the “sensitive” documents in the final days of his employment at Apple in April 2018. Wang left Apple five months after he signed an agreement to work for a US-based subsidiary of a company headquartered in China, according to the Justice Department. After US law enforcement searched his Mountain View, California, home in June 2018, 35-year-old Wang fled to China, the Justice Department says. If convicted, Wang faces up to 10 years in prison plus fines.

Everyone knows how much data can be collected about you anytime you’re online. But a bigger concern may be what someone can collect about you anytime you’re anywhere. That’s the warning in a new research paper, which found that it’s possible to collect “environmental DNA”—traces of genetic material floating in the air or liquids, also called eDNA—that can be linked to a person’s medical or ancestral details. Legal experts who spoke to the _The New York Times_ warn that if police or other government authorities begin collecting eDNA, as scientists studying animals have done for a decade, it could create widespread privacy and civil liberties abuses.

A TikTok ‘Car Theft’ Challenge Is Costing Hyundai $200 Million

From USB worms to satellite-based hacking, Russia’s FSB hackers, known as Turla, have spent 25 years distinguishing themselves as “adversary number one.”

Ask Western cybersecurity intelligence analysts who their "favorite" group of foreign state-sponsored hackers is—the adversary they can't help but grudgingly admire and obsessively study—and most won't name any of the multitudes of hacking groups working on behalf of China or North Korea. Not China's APT41, with its brazen sprees of supply chain attacks, nor the North Korean Lazarus hackers who pull off massive cryptocurrency heists. Most won't even point to Russia's notorious Sandworm hacker group, despite the military unit's unprecedented blackout cyberattacks against power grids or destructive self-replicating code.

Instead, connoisseurs of computer intrusion tend to name a far more subtle team of cyberspies that, in various forms, has silently penetrated networks across the West for far longer than any other: a group known as Turla.

Last week, the US Justice Department and the FBI announced that they had dismantled an operation by Turla—also known by names like Venomous Bear and Waterbug—that had infected computers in more than 50 countries with a piece of malware known as Snake, which the US agencies described as the "premiere espionage tool" of Russia's FSB intelligence agency. By infiltrating Turla's network of hacked machines and sending the malware a command to delete itself, the US government dealt a serious setback to Turla's global spying campaigns.

But in its announcement—and in court documents filed to carry out the operation—the FBI and DOJ went further, and officially confirmed for the first time the reporting from a group of German journalists last year which revealed that Turla works for the FSB's Center 16 group in Ryazan, outside Moscow. It also hinted at Turla's incredible longevity as a top cyberspying outfit: An affidavit filed by the FBI states that Turla's Snake malware had been in use for nearly 20 years.

In fact, Turla has arguably been operating for at least 25 years, says Thomas Rid, a professor of strategic studies and cybersecurity historian at Johns Hopkins University. He points to evidence that it was Turla—or at least a kind of proto-Turla that would become the group we know today—that carried out the first-ever cyberspying operation by an intelligence agency targeting the US, a multiyear hacking campaign known as Moonlight Maze.

Given that history, the group will absolutely be back, says Rid, even after the FBI's latest disruption of its toolkit. “Turla is really the quintessential APT,” says Rid, using the abbreviation for “advanced persistent threat,” a term the cybersecurity industry uses for elite state-sponsored hacking groups. “Its tooling is very sophisticated, it’s stealthy, and it’s persistent. A quarter-century speaks for itself. Really, it’s adversary number one.”

Throughout its history, Turla has repeatedly disappeared into the shadows for years, only to reappear inside well-protected networks including those of the US Pentagon, defense contractors, and European government agencies. But even more than its longevity, it's Turla's constantly evolving technical ingenuity—from USB worms, to satellite-based hacking, to hijacking other hackers' infrastructure—that's distinguished it over those 25 years, says Juan Andres Guerrero-Saade, a principal threat researcher at the security firm SentinelOne. “You look at Turla, and there are multiple phases where, oh my god, they did this amazing thing, they pioneered this other thing, they tried some clever technique that no one had done before and scaled it and implemented it,” says Guerrero-Saade. “They're both innovative and pragmatic, and it makes them a very special APT group to track.”

Here's a brief history of Turla's two-and-a-half decades of elite digital spying, stretching back to the very beginning of the state-sponsored espionage arms race.

1996: Moonlight Maze

By the time the Pentagon began investigating a series of intrusions of US government systems as a single, sprawling espionage operation, it had been going on for at least two years and was siphoning American secrets on a massive scale. In 1998, federal investigators discovered that a mysterious group of hackers had been prowling the networked computers of the US Navy and Air Force, as well as those of NASA, the Department of Energy, the Environment Protection Agency, the National Oceanic and Atmospheric Administration, a handful of US universities, and many others. One estimate would compare the hackers' total haul to a stack of papers three times the height of the Washington Monument.

From early on, counterintelligence analysts believed that the hackers were Russian in origin, based on their real-time monitoring of the hacking campaign and the types of documents they targeted, says Bob Gourley, a former US Defense Department intelligence officer who worked on the investigation. Gourley says that it was the hackers’ apparent organization and persistence that made the most lasting impression on him. “They’d reach a wall, and then someone with different skills and patterns would take over and break through that wall,” Gourley says. “This was not just a couple of kids. This was a well-resourced, state-sponsored organization. It was the first time, really, where a nation-state was doing this.”

Investigators found that when the Moonlight Maze hackers—a codename given to them by the FBI—exfiltrated data from their victims' systems, they used a customized version of a tool called Loki2, and would continually tweak that piece of code over the years. In 2016, a team of researchers including Rid and Guerrero-Saade would cite that tool and its evolution as evidence that Moonlight Maze was in fact the work of an ancestor of Turla: They pointed to cases where Turla's hackers had used a unique, similarly customized version of Loki2 in its targeting of Linux-based systems fully two decades later.

2008: Agent.btz

Ten years after Moonlight Maze, Turla shocked the Defense Department again. The NSA discovered in 2008 that a piece of malware was beaconing out from inside the classified network of the DOD's US Central Command. That network was “air-gapped”—physically isolated such that it had no connections to internet-connected networks. And yet someone had infected it with a piece of self-spreading malicious code, which had already copied itself to an untold number of machines. Nothing like it had ever been seen before on US systems.

The NSA came to believe that the code, which would later be dubbed Agent.btz by researchers at the Finnish cybersecurity firm F-Secure, had spread from USB thumb drives that someone had plugged into PCs on the air-gapped network. Exactly how the infected USB sticks got into the hands of DOD employees and penetrated the US military's digital inner sanctum has never been discovered, though some analysts speculated they may have simply been scattered in a parking lot and picked up by unsuspecting staffers.

The Agent.btz breach of Pentagon networks was pervasive enough that it sparked a multiyear initiative to revamp US military cybersecurity, a project called Buckshot Yankee. It also led to the creation of US Cyber Command, a sister organization of the NSA tasked with protecting DOD networks that today also serves as the home of the country's most cyberwar-oriented hackers.

Years later, in 2014, researchers at the Russian cybersecurity firm Kaspersky would point to technical connections between Agent.btz and Turla's malware that would come to be known as Snake. The espionage malware—which Kaspersky at the time called Uroburos, or simply Turla—used the same file names for its log files and some of the same private keys for encryption as Agent.btz, the first clues that the notorious USB worm had in fact been a Turla creation.

2015: Satellite Command-and-Control

By the mid-2010s, Turla was already known to have hacked into computer networks in dozens of countries around the world, often leaving a version of its Snake malware on victims' machines. It was revealed in 2014 to be using “watering-hole” attacks, which plant malware on websites with the goal of infecting their visitors. But in 2015, researchers at Kaspersky uncovered a Turla technique that would go much further toward cementing the group's reputation for sophistication and stealth: hijacking satellite communications to essentially steal victims' data via outer space.

In September of that year, Kaspersky researcher Stefan Tanase revealed that Turla's malware communicated with its command-and-control servers—the machines that send commands to infected computers and receive their stolen data—via hijacked satellite internet connections. As Tanase described it, Turla's hackers would spoof the IP address for a real satellite internet subscriber on a command-and-control server set up somewhere in the same region as that subscriber. Then they would send their stolen data from hacked computers to that IP so that it would be sent via satellite to the subscriber, but in a way that would cause it to be blocked by the recipient's firewall.

Because the satellite was broadcasting the data from the sky to the entire region, however, an antenna connected to Turla's command-and-control server would also be able to pick it up—and no one tracking Turla would have any way of knowing where in the region that computer might be located. The entire, brilliantly tough-to-trace system cost less than $1,000 a year to run, according to Tanase. He described it in a blog post as “exquisite.”

2019: Piggybacking on Iran

Plenty of hackers use “false flags,” deploying the tools or techniques of another hacker group to throw investigators off their trail. In 2019, the NSA, the Cybersecurity and Infrastructure Security Agency (CISA), and the UK's National Cybersecurity Center warned that Turla had gone much further: It had silently taken over another hacker group's infrastructure to commandeer their entire spying operation.

In a joint advisory, the US and UK agencies revealed that they'd seen Turla not only deploy malware used by an Iranian group known as APT34 (or Oilrig) to sow confusion, but that Turla had also managed to hijack the command-and-control of the Iranians in some cases, gaining the ability to intercept data that the Iranian hackers had been stealing and even sending their own commands to the victim computers the Iranians had hacked.

Those tricks significantly raised the bar for analysts seeking to pin any intrusion on a particular group of hackers, when in fact Turla or a similarly devious group might have been secretly pulling puppet strings from the shadows. “Avoid possible misattribution by being vigilant when examining activity that appears to originate from the Iranian APT,” the CISA advisory warned at the time. “It may be the Turla group in disguise.”

2022: Hijacking a Botnet

Cybersecurity firm Mandiant reported earlier this year that it had spotted Turla carrying out a different variant of that hacker-hijacking trick, this time taking over a cybercriminal botnet to sift through its victims.

In September 2022, Mandiant found that a user on a network in Ukraine had plugged a USB drive into their machine and infected it with the malware known as Andromeda, a decade-old banking trojan. But when Mandiant looked more closely, they found that that malware had subsequently downloaded and installed two tools Mandiant had previously tied to Turla. The Russian spies, Mandiant discovered, had registered expired domains that Andromeda's original cybercriminal administrators had used to control its malware, gaining the ability to control those infections, and then searched through hundreds of them for ones that might be of interest for espionage.

That clever hack had all the hallmarks of Turla: the use of USB drives to infect victims, as it had done with Agent.btz in 2008, but now combined with the trick of hijacking a different hacker group's USB malware to commandeer their control, as Turla had done with Iranian hackers a few years earlier. But researchers at Kaspersky nonetheless warned that the two tools found on the Ukrainian network that Mandiant had used to tie the operation to Turla may actually be signs of a different group it calls Tomiris—perhaps a sign that Turla shares tooling with another Russian state group, or that it's now evolving into multiple teams of hackers.

2023: Beheaded By Perseus

Last week, the FBI announced that it had struck back against Turla. By exploiting a weakness in the encryption used in Turla's Snake malware and remnants of code that the FBI had studied from infected machines, the bureau announced it had learned to not only identify computers infected with Snake, but also send a command to those machines that the malware would interpret as an instruction to delete itself. Using a tool it had developed, called Perseus, it had purged Snake from victims' machines around the world. Along with CISA, the FBI also released an advisory that details how Turla's Snake sends data through its own versions of the HTTP and TCP protocols to hide its communications with other Snake-infected machines and Turla's command-and-control servers.

That disruption will no doubt undo years of work for Turla's hackers, who have been using Snake to steal data from victims around the world since as early as 2003, even before the Pentagon discovered Agent.btz. The malware's ability to send well-concealed data covertly between victims in a peer-to-peer network made it a key tool for Turla's espionage operations.

But no one should deceive themselves that dismantling the Snake network—even if the malware could be wholly eradicated—would mean the end of one of Russia's most resilient hacker groups. “This is one of the best actors out there, and there’s no doubt in my mind that the cat-and-mouse game continues,” says Rid, of Johns Hopkins. “More than anyone else, they have a history of evolving. When you shine a light on their operations and tactics and techniques, they evolve and retool and try to become more stealthy again. That’s the historical pattern that began in the 1990s.”

“For them, those gaps in your timeline are a feature,” Rid adds, pointing to the sometimes-yearslong stretches when Turla's hacking techniques largely stayed out of news stories and security researchers' papers.

As for Gourley, who hunted Turla 25 years ago as an intelligence officer in the midst of Moonlight Maze, he applauds the FBI’s operation. But he also warns that killing some Snake infections is very different from defeating Russia’s oldest cyberspying team. “This is an infinite game. If they’re not already back in those systems, they will be soon,” Gourley says. “They’re not going away. This is not the end of cyberespionage history. They will definitely, definitely be back.”

The Underground History of Turla, Russia's Most Ingenious Hacker Group

Montana’s TikTok ban will be impossible to enforce. But it could encourage copycat crackdowns against the social media app.

Montana’s TikTok ban is a technological nightmare. Experts warn it will be incredibly difficult for officials to enforce and incredibly easy for almost anyone to get around. But more than that, it’s a move that undermines America’s history of fostering an open, democratic internet.

The law, which comes into effect at the start of 2024, will both block TikTok from mobile app stores in Montana while also banning TikTok from operating in the state. It’s a move that brings with it a host of First Amendment concerns, and may never be enacted if legal challenges block it. But, if it does go ahead, experts warn it is likely to be a mess.

“From a technical perspective, even if this was a national law, there would be challenges to try to make this work,” says John Morris, principal, US internet policy and advocacy at the Internet Society, a nonprofit that promotes an open internet. But because people can use VPNs to change their browsing location, it’s even harder to ensure a local ban will work. “State boundaries are not something that’s built into the internet.” 

The new law is the first on the books following years of anxiety in the US around TikTok as a national security risk. That perceived threat looms because TikTok’s parent company, ByteDance, is Chinese-owned. TikTok has also become one of the most popular apps in the world, with 150 million users in the US alone. 

The Montana law calls for $10,000 penalties to be levied on mobile app stores when they allow people to download or use TikTok. TikTok could also be fined for operating in the state. The fines would not apply to people who download the app. 

The US has historically advocated for an open internet and criticized countries that censor online access. China is successful in its mass censorship because of its Great Firewall—a system unlike anything in the US, and one that Montana could not build for itself. Other countries, including Indonesia and Pakistan, have banned TikTok and then rescinded the blocks. India’s TikTok ban, introduced in June 2020, is still in place. Montana, along with other states, and the US federal government have blocked TikTok from government devices, but geoblocking from specific regions within the US would prove much harder.

An older version of the Montana bill would have forced internet services providers to block TikTok in the state. But ISPs said it would be impossible to do so, and the requirement was removed. Mobile app providers like Apple and Google did not respond to requests for comment. And while Montana has now passed the law banning TikTok, it remains to be seen how it plans to do so.

Montana officials have suggested tech that restricts online sports gambling, which remains illegal in more than a dozen US states, could be employed to boot TikTok out of its borders. If anyone reports a violation, officials would investigate it, and if a breach was verified, cease-and-desist letters would be sent to the companies, the state attorney general’s office told the Associated Press. 

Such blocks are regularly circumvented using VPNs. And VPNs have their own security issues—people who use them can become targets for hackers. Some VPNs also keep logs of user data, which can be accessed by law enforcement with subpoenas. 

But there’s no way for TikTok to know whether people are using VPNs within Montana to access the social network, which makes this law “very complicated,” and “very difficult to enforce” if TikTok is the liable party rather than the service provider, says Kevin Du, a professor of electrical engineering and computer science at Syracuse University. 

In response to the ban, TikTok said it would “continue working to defend the rights” of users inside and outside Montana. The company has also called the ban unlawful. The law was also criticized by the American Civil Liberties Union, which says it violates “free speech rights under the guise of national security and lays the groundwork for excessive government control over the internet.” TikTok creators, who are often semipublic figures, have already sued the state of Montana, claiming the new law violates free speech rights.  

It might make up a tiny slice of TikTok’s global user base, but if Montana’s ban stands, it could influence legislation in other US states. A nationwide ban remains both complex and unlikely.

How You, or Anyone, Can Dodge Montana’s TikTok Ban

Kaspersky researchers have uncovered clues that further illuminate the hackers’ activities, which appear to have begun far earlier than originally believed.

Russian security firm Kaspersky today released new research that adds another piece to the puzzle of a hacker group whose operations appear to stretch back further than researchers previously realized.

Research published last week from the security firm Malwarebytes shed new light on a hacking group, Red Stinger, that has been carrying out espionage operations against both pro-Ukraine victims in central Ukraine and pro-Russia victims in eastern Ukraine. The findings were intriguing because of the ideological mix of the targets and the lack of connections to other known hacking groups. A few weeks before Malwarebytes released its report, Kaspersky had also published research about the group, which it calls Bad Magic, and similarly concluded that the malware used in the attacks didn't have connections to any other known hacking tools. The research Kaspersky released today finally links the group to past activity and provides some preliminary context for understanding the attackers' possible motivations.

Adding the Malwarebytes research to what they had found independently, Kaspersky researchers reviewed historic telemetry data to look for connections. Eventually, they discovered that some of the cloud infrastructure and malware the group was using had similarities to espionage campaigns in Ukraine that the security company ESET identified in 2016, as well as campaigns the firm CyberX discovered in 2017.

“Malwarebytes found out more about the initial infection stage, and then they found more about the installer” used in some of the group's attacks since 2020, says Georgy Kucherin, a Kaspersky malware researcher. “After publishing our report about the malware, we decided to view historical data about similar campaigns that have similar targets and that have occurred in the past. That’s how we discovered the two similar campaigns from ESET and CyberX, and we concluded with medium to high confidence that the campaigns are tied together and they are all likely to be executed by the same actor.”

The different activity through time has similar victimology, meaning the group focused on the same types of targets, including both officials working for pro-Russia factions within Ukraine and Ukrainian government officials, politicians, and institutions. Kucherin also notes that he and his colleagues found similarities and multiple overlaps in the code of the plugins used by the group's malware. Some code even appeared to be copied and pasted from one campaign to the next. And the researchers saw similar use of cloud storage and characteristic file formats on the files the group exported to their servers.

The Malwarebytes research published last week documented five campaigns since 2020 by the hacking group, including one that targeted a member of Ukraine's military who works on Ukrainian critical infrastructure. Another campaign targeted pro-Russia election officials in eastern Ukraine, an adviser to Russia's Central Election Commission, and one who works on transportation in the region. 

Back in 2016, ESET wrote of the activity it called “Operation Groundbait”: “The main point that sets Operation Groundbait apart from the other attacks is that it has mostly been targeting anti-government separatists in the self-declared Donetsk and Luhansk People’s Republics. While the attackers seem to be more interested in separatists and the self-declared governments in eastern Ukrainian war zones, there have also been a large number of other targets, including, among others, Ukrainian government officials, politicians, and journalists.”

Meanwhile, Malwarebytes had found that one particularly invasive tactic the group used in a more recent campaign was to record audio directly from the microphones of victims' compromised devices in addition to collecting other data like documents and screenshots. In 2017, CyberX named the campaign it was tracking “Operation BugDrop” because the espionage campaign targeting numerous Ukrainian victims “eavesdrops on sensitive conversations by remotely controlling PC microphones—in order to surreptitiously ‘bug’ its targets.”

In its work last week, Malwarebytes could not come to a conclusion about the actors behind the group and whether they are aligned with Russian or Ukrainian interests. In 2016, ESET found evidence that Operation Groundbait's malware had been in use all the way back to 2008 and attributed the activity to Ukraine.

“Our research into these attack campaigns and the \[Groundbait\] malware itself suggests that this threat is the first publicly known Ukrainian malware that is being used in targeted attacks,” ESET wrote in 2016.

Kaspersky cites this conclusion in its new research but notes that the firm does not engage in state attribution and did not investigate or verify ESET's findings.

Kucherin says that the group has been able to remain largely hidden for so long because their attacks are typically highly targeted, focusing on at most dozens of individuals at a time rather than launching mass exploitation. The group also rewrites its malware implants, which makes them difficult to connect until you have the full picture of multiple attack chains. And he adds that Ukraine has been such an intense digital battleground for so many years that other actors and activities seem to have distracted researchers.

“The most interesting thing, even shocking perhaps, is that the group has been acting for 15 years. That is a lot, and it's quite rare when you are able to attribute one campaign to another campaign that happened years and years ago,” Kucherin says. “We’ll see more activity from them in the future. In my opinion, it is unlikely that they will stop what they’re doing. They are very, very persistent.”

A Mysterious Group Has Ties to 15 Years of Ukraine-Russia Hacks

Your inactive profiles, like Gmail or Docs, could turn into digital dust later this year. A few clicks can save them.

On May 16, Google announced new plans to delete accounts that have been inactive for two years, as well as accounts that were created and never used (or used only briefly). Got an ancient Gmail account gathering cobwebs or a Google Photos account storing vacation pics from years past? It’s time to start looking around for those login credentials. If you haven't signed in within the past two years, your account and everything it contains could be deleted starting as soon as December.

This change impacts Google Calendar, Drive, Docs, Gmail, Meet, and Photos. Accounts with YouTube videos are a noteworthy exception from the new deletion policy, as are any accounts with active subscriptions (paying your bill counts as “activity”). Also, this change applies only to personal Google accounts, not profiles tied to companies or classrooms. (Hear that? It’s the collective sound of a thousand bosses and principals sighing in relief.) 

Worried about your personal Google account getting vaporized? Here’s how to make sure that your account is active, and a few quick tips in case you forgot your password. 

How to Keep Your Account from Getting Deleted

Stopping Google from deleting your account is straightforward, if you can remember the password. Just log in. That’s it! No further steps need to be taken. According to the Google blog post from Ruth Kricheli, vice president of product management, “if you have signed into your Google Account or any of our services recently, your account is considered active and will not be deleted.” OK, simple enough.

There’s no need to log out and log back in to accounts you’re using just to be safe. This change is for accounts with no “activity.” What’s that mean to Google? Basically, anything you do with the account is considered activity, from doing a search with Google, to reading an email in Gmail, to accessing a document with Google Drive. The goal here is to improve Google’s overall security by removing abandoned accounts, which are less likely to have strong, unique passwords or have two-factor authentication set up, Kricheli writes.

Wait, What’s My Password?

Whoops! Don’t give up yet. Maybe you forgot your password, but can you remember the username or phone number? Go here to begin the account recovery process for most Google accounts and here for Gmail.

Still encountering issues accessing your inactive account? Check out this article for advice from Google’s account safety team about what could be going on with your profile and a few potential remedies. Before it’s deleted, Google says it will send messages to the account’s main email and the recovery address. Similarly, if you’re the caretaker of someone’s account who can’t access it, or who has passed away and you’d like it memorialized, Google suggests using Google Takeout to download the data for safekeeping, or setting up the Inactive Account Manager to provide access so the account can stay accessible.

The first wave of deletions will wipe out accounts that were registered but subsequently unused. When will the second wave of inactive account deletions start? The exact day remains unclear, so it’s a good idea to try to log in before December rolls around.

After the new policy goes into effect, want to keep old Google accounts around that you just use sparingly? Try setting a reminder on your calendar to log in and click around every so often. Better yet, consider storing the data on a physical drive.

Google May Delete Your Old Accounts. Here’s How to Stop It

The USPS carries out warrantless surveillance on thousands of parcels every year. Lawmakers want it to end—right now.

Each year, at the request of police and intelligence agents across the country, the United States Postal Service conducts surveillance on physical pieces of mail going to and from the homes and businesses of tens of thousands of Americans, a group of United States senators says. 

To initiate this surveillance, the department or agency has at least one hurdle to climb. First, they must submit the request _in writing_. Then … well, nothing. That is the entire hurdle. 

In practice, this serves less as an evidentiary threshold than an IT ticketing system. For more than a handful of senators, that’s unacceptable. And in a letter today to the nation’s chief postal inspector, Gary Barksdale, the group explains why: “There is a long history of documented abuses of postal surveillance.”

The letter, first obtained by WIRED, is signed by an equal number of Republicans and Democrats, including senators Ron Wyden, Rand Paul, Edward Markey, Cynthia Lummis, Elizabeth Warren, Mike Lee, Cory Booker, and Steve Daines. It opens with a warning about a request devised by the postal service known as a “mail cover,” which the lawmakers say “threatens both our privacy and First Amendment rights.” The lawmakers equate mail covers with the “unchecked government monitoring” of Americans’ mail. Here’s how the Postal Service describes them: 

> A mail cover is an investigative tool used to record data appearing on the outside of a mailpiece. Law enforcement agencies use this information to protect national security; locate fugitives; obtain evidence; or help identify property, proceeds, or assets forfeitable under criminal law. A mail cover is justified when it will further an investigation or provide evidence of a crime.

The phrase “further an investigation” likely means little to the person whose mail is being surveilled. It doesn’t indicate that they’re the target of an investigation nor even suspected of doing anything illegal. It doesn’t necessarily mean that anyone in a position to charge someone with a crime knows for certain that a crime has occurred. And as the Postal Service itself says, a law enforcement agency can also freely use the data recorded from the outside of a piece of mail—commonly known as metadata in the context of digital communications—to “identify property” it intends to seize. 

In contrast, the senators note, the government can usually only monitor metadata associated with electronic messages (e.g., email or text messages) “with a court order.” 

Admittedly, expectations of privacy when it comes to email and written letters likely differ: People don’t ordinarily expect what they print on the outside of their letters and packages to have the same level of privacy as what’s inside. It’s understood that whatever is printed on a piece of mail will, at some point, be viewed by a stranger before it reaches its destination. But those people are also generally understood to be mail carriers, not intelligence agents. 

The notion that only a mail carrier will view a piece of mail is based on a quainter understanding of the mail handling process; a Norman Rockwell view of what a modern postal delivery system entails. In the US, the exterior of every piece of mail is photographed. And the information obtained from these photos, such as religious and political affiliations, is more intimate than people may realize. This data has been described by one former FBI agent as “easily abused” and a “treasure trove.” In comparing mail covers to the National Security Agency surveillance exposed during the Edward Snowden scandal, the renowned security technologist Bruce Schneier once called them “basically … the same thing.”

The letter to Barksdale is not merely aimed at telling the chief inspector—an official who oversees dozens of field offices and labs and an army of law enforcement agents and other technical resources—things that he already likely knows. Instead, they’d like him to simply end the process. 

The USPS declined to comment.

There is no federal statute requiring the post office to allow mail covers. The Postal Service authorizes this through its own regulations, conforming to interpretations of what is most permissive under the Fourth Amendment. Those protections were strengthened in 1967 as a result of a US Supreme Court ruling that established a legal test—which is still used—known as an “expectation of privacy.” And while intercepting electronic metadata, as the senators note, generally requires a court order—because the courts have decided Americans do _reasonably_ expect that information to be private—judges haven’t exactly ruled the same way in cases involving physical pieces of mail. There are many intricacies involved, but in at least one major case, judges pointed to another legal test, known as the “plain view doctrine,” which applies to evidence investigators can clearly see. 

“The risk of abuse of mail covers is not theoretical,” the lawmakers write in the letter. 

The history of abuse of mail covers, as the lawmakers note, is a long one. A famous incident occurred in the 1970s, when a 15-year-old girl mistakenly wrote to the Socialist Workers Party—a communist organization strongly supportive of Cuba—while researching a school assignment involving the Socialist Labor Party. The teenager was thoroughly investigated by the FBI, which even sent an agent into her school. 

The senators note that Church Committee, which was formed in 1975 to investigate US intelligence abuses, uncovered that the Central Intelligence Agency had photographed “the exteriors of over 2 million pieces of mail,” while opening hundreds of thousands of others, that belonged to “prominent activists and authors.” 

Indeed, the senators say, modern fears of postal abuse hearken back to the Founding Fathers themselves, who decried what Thomas Jefferson called the “infidelities of the post office,” surveillance that broadly forced those at odds with the British occupation to resort to encrypting messages they wished to keep private. These messages include, the lawmakers note, “an early proposal for the Bill of Rights.”

The lawmakers ask that Barksdale cease allowing mail covers without the permission of a federal judge, “except in emergencies.” And to increase transparency, they say, the post office should begin publishing annual statistics on the mail covers it does allow. It has not done so since at least 2014 (in conjunction with an Inspector General report). 

“While mail covers do not reveal the contents of correspondence, they can reveal deeply personal information about Americans’ political leanings, religious beliefs, or causes they support,” the senators write. Consequently, any such abuses are a threat, they say, to not only Americans’ right to associate politically and religiously, but to assemble “without the government watching."

The US Post Office Is Spying on the Mail. Senators Want to Stop It

Telly TV tracks you and bombards you with ads on a dedicated second screen. It could help normalize smartphone-style surveillance in your living room.

There’s no such thing as a free lunch. Nor is there such a thing as a free TV.

But Telly TV is offering just that. Its 55-inch smart TV is free to the first 500,000 people who put their name on a reservation list. At a glance, it looks like any other TV worth hundreds of dollars. But below the screen, separated by a sound bar, sits a second, smaller screen. Here, people will see weather and stock market updates alongside ads—lots and lots of ads.

This is what Telly’s CEO and founder, Ilya Pozin, describes as the “biggest innovation in television since color.” That innovation? Rather than pay for the big screen you’re force-fed advertising through, Telly is giving you the TV free of charge. So instead of paying for a TV and a bunch of channels or streaming services while companies make money from advertising and selling personal data, people can at least get the TV for free, the logic goes. 

But this is no ordinary TV—and it comes with no ordinary set of terms and conditions. Telly’s data policy says that it may “collect information about the audio and video content you watch, the channels you view, and the duration of your viewing sessions.” Telly also has a built-in microphone camera that can track motion and be used for video calling, fitness, or video games—although the camera does come with a shutter that someone must open and can close, according to the company.

The TV also tracks a customer’s queries, settings, preferences, applications, purchases, and the buttons they click; the time, frequency, and duration of their viewing or activities, and the physical presence of people using the TV. The company even collects what it calls cultural and social identifiers, giving the example of whether someone is a fan of a specific sports team, a skateboarder, or an environmental activist. 

Viewing and activity data is anonymized and shared with third-party data partners and advertisers, according to Telly. And if people opt out of sharing their data, they lose Telly services and must return the free TV—or be charged for it.    

Telly’s business model assumes people are ultimately resigned to giving away their data and complacently trading it for convenience, or in this case, a new screen. But the full consequences of sharing personal data from the living room have yet to be realized. 

“What this product does is lean into the idea that all of this is going to happen anyway, so you might as well get free hardware out of it,” says Nathalie Maréchal, codirector of the Privacy and Data Project at the nonprofit Center for Technology and Democracy. “But for me, the point is that a different world is possible.” 

Telly doesn’t view its methods as novel. “Nearly all smart TVs today collect data on consumption and viewership,” says Dallas Lawrence, chief strategy officer at Telly. Lawrence explains that people complete a five minute survey when joining, where they disclose brand preferences, household demographics, and interests. The only difference between Telly and other TVs, Lawrence claims, is that the company asks people to share their data up front, and they get a free TV in return.

Source

Wired