The notorious Russian-speaking cybercriminals grew successful by keeping a low profile. But now they have a target on their backs.

High-profile ransomware attacks have become a fact of life in recent years, and it’s not unusual to hear about major monthly attacks perpetrated by Russia-based gangs and their affiliates. But since late 2019, one group has been steadily making a name for itself on a multi-year rampage that has impacted hundreds of organizations around the world. The LockBit ransomware gang may not be the most wildly unhinged of these criminal groups, but its callous persistence, effectiveness, and professionalism make it sinister in its own way.

One of the most prolific ransomware groups ever, the LockBit collective has attempted to maintain a low profile in spite of its volume of attacks. But as it has grown, the group has gotten more aggressive and perhaps careless. Earlier this month, the LockBit malware was notably used in an attack on the United Kingdom’s Royal Mail that hobbled operations. After other recent visible attacks, like one on a Canadian children’s hospital, all eyes are now on LockBit.   

“They are the most notorious ransomware group, because of sheer volume. And the reason for their success is that the leader is a good businessman,” says Jon DiMaggio, chief security strategist at Analyst1 who has studied LockBit’s operations extensively. “It’s not that he’s got this great leadership capability. They made a point-and-click ransomware that anyone could use, they update their software, they’re constantly looking for user feedback, they care about their user experience, they poach people from rival gangs. He runs it like a business, and because of that, it is very, very attractive to criminals.”

Keep It Professional

For the Royal Mail, LockBit was a chaos agent. On January 11, the UK postal service’s international shipping ground to a halt after being hit with a cyberattack. For more than a week, the company has told customers not to send new international parcels—adding further disorganization after workers went on strike over pay and conditions. The attack was later linked to LockBit.

Just before Christmas, a LockBit member attacked the SickKids hospital in Canada, impacting its internal systems and phone lines, causing delays to medical images and lab tests. The group quickly backtracked after the attack, providing a free decryptor and saying it had blocked the member responsible. In October, LockBit also demanded an unusually high $60 million payment from a UK car dealership chain. 

Adding to its infamy, LockBit is also one of the most prolific and aggressive ransomware groups when it comes to targeting manufacturing and industrial control systems. Security firm Dragos estimated in October that in the second and third quarters of 2022, the LockBit malware was used in 33 percent of ransomware attacks on industrial organizations and 35 percent of those against infrastructure.

In November, the US Department of Justice reported that LockBit’s ransomware has been used against at least 1,000 victims worldwide, including in the United States. “LockBit members have made at least $100 million in ransom demands and have extracted tens of millions of dollars in actual ransom payments from their victims,” the Justice Department wrote. The FBI first began investigating the group in early 2020. In February 2022, the agency released an alert warning that LockBit “employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense.”

LockBit emerged at the end of 2019, first calling itself “ABCD ransomware.” Since then, it has grown rapidly. The group is a “ransomware-as-a-service” operation, meaning that a core team creates its malware and runs its website while licensing out its code to “affiliates” who launch attacks.

Typically, when ransomware-as-a-service groups successfully attack a business and get paid, they’ll share a cut of the profits with the affiliates. In the case of LockBit, Jérôme Segura, senior director of threat intelligence at Malwarebytes, says the affiliate model is flipped on its head. Affiliates collect payment from their victims directly and then pay a fee to the core LockBit team. The structure seemingly works well and is reliable for LockBit. “The affiliate model was really well ironed out,” Segura says.

Though researchers have repeatedly seen cybercriminals of all sorts professionalizing and streamlining their operations over the past decade, many prominent and prolific ransomware groups adopt flamboyant and unpredictable public personas to garner notoriety and intimidate victims. In contrast, LockBit is known for being relatively consistent, focused, and organized. 

“Of all the groups, I think they have probably been the most businesslike, and that is part of the reason for their longevity,” says Brett Callow, a threat analyst at the antivirus company Emsisoft. “But the fact that they post a lot of victims on their site doesn’t necessarily equate to them being the most prolific ransomware group of all, as some would claim. They are probably quite happy with being described that way, though. That’s just good for recruitment of new affiliates.”

The group certainly isn’t all hype, though. LockBit seems to invest in both technical and logistical innovations in an attempt to maximize profits. Peter Mackenzie, director of incident response at security firm Sophos, says, for example, that the group has experimented with new methods for pressuring its victims into paying ransoms. 

“They've got different ways of paying,” Mackenzie says. “You could pay to have your data deleted, pay to have it released early, pay to extend your deadline,” Mackenzie says, adding that LockBit opened its payment options to anyone. This could, theoretically at least, result in a rival company buying a ransomware victim’s data. “From the victim's perspective, it's extra pressure on them, which is what helps make people pay,” Mackenzie says.

Since LockBit debuted, its creators have spent significant time and effort developing its malware. The group has issued two big updates to the code—LockBit 2.0, released in mid-2021, and LockBit 3.0, released in June 2022. The two versions are also known as LockBit Red and LockBit Black, respectively. Researchers say the technical evolution has paralleled changes in how LockBit works with affiliates. Prior to the release of LockBit Black, the group worked with an exclusive group of 25 to 50 affiliates at most. Since the 3.0 release, though, the gang has opened up significantly, making it harder to keep tabs on the number of affiliates involved and also making it more difficult for LockBit to exercise control over the collective.

LockBit frequently expands its malware with new features, but above all, the malware’s characteristic trait is that it's simple and easy to use. At its core, the ransomware has always offered anti-detection capabilities, tools for circumventing Microsoft Windows defenses, and features for privilege escalation within a compromised device. LockBit uses publicly available hacking tools when it can, but it also develops custom capabilities. The 2022 FBI report noted that the group sometimes uses previously unknown or zero day vulnerabilities in its attacks. And the group has the capability to target many different types of systems.

“It's not just Windows. They'll attack Linux, they'll go after your virtual host machines,” Mackenzie says. “They offer a solid payment system. There's a lot of backend infrastructure that comes with this. It's just a well-made product, unfortunately.” In October, it was reported that LockBit’s malware was deployed after a zero day was used to hack Microsoft Exchange servers—a relatively rare occurrence when it comes to ransomware gangs.

“Theer are additional features that make the ransomware more dangerous—for example, having worm components to it,” Segura adds. “They've also discussed things like doing denial-of-service attacks against victims, in addition to the extortion.”  

With the release of LockBit 3.0, the group also signaled its intention to evolve. It introduced the first ransomware bug bounty scheme, promising to pay legitimate security researchers or criminals who could identify flaws in its website or encryption software. LockBit said it would pay anyone $1 million if they could name who is behind LockBitSupp, the public persona of the group.

The core members at the top of LockBit seem to include its leader and one or two other trusted partners. Analyst1’s DiMaggio, who has tracked the actors for years, notes that the group claims to be based in the Netherlands. Its leader has said at various times that he personally operates out of China or even the United States, where he has said he is a part owner of two restaurants in New York City. LockBit members all seem to be Russian-speaking, though, and DiMaggio says that while he cannot be certain, he believes the group is based in Russia.

“The leader doesn’t seem to have any concern about being arrested. He thinks he’s a supervillain, and he plays the part well,” DiMaggio says. “But I do believe he has a healthy concern that if the Russian government were to get their hooks in him, he would have to make the decision to turn over most of his money to them or do work for them like helping them with the Ukraine war.”

Beware the Spotlight

Despite LockBit’s relative professionalism, the group has, at times, slipped into showboating and bizarre behavior. During desperate efforts to get attention—and attract affiliates—in its early months, the criminal group held an essay-writing competition and paid prizes to the winners. And in September 2022, the group memorably posted a message on a cybercrime forum claiming it would pay anyone $1,000 if they got the LockBit logo tattooed on themselves. Around 20 people shared photos and videos with their feet, wrists, arms, and chests all branded with the cybercrime gang’s logo.

LockBit’s meteoric rise and recent attacks against high-profile targets could ultimately be its downfall, though. Notorious ransomware groups have been infiltrated, exposed, and disrupted in recent years. Before Russia’s full-scale invasion of Ukraine in February 2022, the Russian Federal Security Service (FSB) arrested high-profile REvil hackers, although the group has since returned. Meanwhile, the US military hacking unit Cyber Command has admitted to disrupting some ransomware groups. And a Ukrainian cybersecurity researcher contributed to the downfall of the Conti ransomware brand last year after infiltrating the group and publishing more than 60,000 of the group’s internal chat messages.

These deterrent actions appear to be having some impact on the overall ransomware ecosystem. While it is difficult to determine real totals of how much money ransomware actors take in, researchers who track cybercriminal groups and those who specialize in cryptocurrency tracing have noticed that ransomware gangs seem to be taking in less money as government enforcement actions impede their operations and more victims refuse to pay. 

The screws are already turning on LockBit. An apparently disgruntled LockBit developer leaked its 3.0 code in September, and Japanese law enforcement has claimed it can decrypt the ransomware. US law enforcement is closely watching the group as well, and its recent attacks can only have raised its profile. In November 2022, the FBI revealed that an alleged LockBit affiliate, Mikhail Vasiliev, 33, had been arrested in Canada and would be extradited to the US. At the time, deputy attorney general Lisa O. Monaco said officials had been investigating LockBit for more than two and a half years.

“I think LockBit is going to have a rough year this year and potentially see their numbers go down,” Analyst1’s DiMaggio says. “They are under a lot of scrutiny now, and they also may have lost their main developer, so they could have development issues that bite them in the ass. It’ll be interesting to see. These guys don’t care about anyone or anything.”

LockBit has seemingly been so dangerous and prolific because it maintained standards for the types of targets its affiliates could hit and avoided attracting too much attention while casting a wide net. But times have changed, and shutting down the UK’s international mail exports for more than a week isn’t exactly keeping a low profile.

“They do have a bit of a PR problem when it comes to their affiliates at this point, because they obviously can't seem to handle them very well,” Malwarebytes’ Segura says. “The bragging, hitting some pretty critical infrastructure, and high-visibility targets is a very dangerous game they're playing. LockBit has a big target on its back right now.”

The Unrelenting Menace of the LockBit Ransomware Gang

A mandatory app exposed the personal information of students and teachers across the country for over a year.

A security lapse in an app operated by India’s Education Ministry exposed the personally identifying information of millions of students and teachers for over a year. 

The data was stored by the Digital Infrastructure for Knowledge Sharing app, or Diksha, a public education app launched in 2017. At the height of the Covid-19 pandemic, when the government was forced to shutter schools across the country, Diksha became a primary tool for allowing students to access materials and coursework from home. 

But a cloud server storing Diksha’s data was left unprotected, exposing millions of individuals’ data to hackers, scammers, and virtually anyone who knew where to look.

Files stored on the unsecured server contained the full names, phone numbers, and email addresses of more than 1 million teachers. According to data in the files, verified by WIRED, the teachers worked for hundreds of thousands of schools located in every state in India. Another file contained information about nearly 600,000 students. While the students’ email addresses and phone numbers were partially obscured, the data included the students’ full names and information about where they went to school, when they enrolled in a course through the app, and how much of the course they completed.  

According to a UK-based security researcher who identified the exposure, there were thousands of files like this on the server. (The researcher asked not to be named because they were not authorized to speak to the media.) 

After initially discovering the exposure in June, the researcher contacted the Diksha support email, alerting them to the data breach, identifying the source, and offering to share more information. They received no response. “There's zero chance that it hasn't been accessed and downloaded by a bunch of other people,” the employee says of the exposed data.

WIRED reached out to the Ministry of Education and did not receive a response. 

Diksha was developed by EkStep, a foundation cofounded by Nandan Nilekani, who helped develop Aadhar, the country’s national identification system. According to Deepika Mogilishetty, the chief of policy and partnerships at EkStep, while the foundation had been supporting Diksha for many years, India’s Ministry of Education ultimately implements the security and policies for how data is managed on Diksha. However, after WIRED sent Mogilishetty links to the unsecured server, it was quickly taken offline. 

This isn’t the first time Diksha has potentially mishandled sensitive information. A 2022 report from Human Rights Watch found that Diksha not only was able to track the location of students, but also shared data with Google. In many cases, the Indian government mandated that teachers and students use Diksha, and Hye Jung Han, a researcher at Human Rights Watch who authored the 2022 report, says that the government provided no alternative methods for those who may not have wanted to use the app.

“What's happening there from a child-rights lens is, you are fulfilling your responsibility to provide free education to every child, but the only type of state education that you're making available is one that inherently violates kids' rights,” says Han.

The unsecured storage server was hosted on Azure, Microsoft’s cloud storage service. It’s unknown how long the data was left unprotected, but Google indexed more than 100 files from this server as early as October 2018. In other words, information stored on this vulnerable server was likely findable through a simple Google search for at least four years. While WIRED could not find instances of sensitive student and teacher data through a Google search, files with sensitive data were available for download through Grayhat Warfare, a searchable database of unsecured servers popular with security researchers and hackers.

“If you have information about children's names, contact details, and what schools they attend, that tells you about the neighborhood where they live. This raises what we call traditional children's protection concerns,” says Han. “They can also use children as a way to get to their parents—blackmail and harassment being fairly common, unfortunately, in India, specifically around education data.”

The market for student data in India appears to be thriving. In 2020, security researchers at CloudSEK, an India-based security firm, found that personally identifying information of hundreds of thousands of students who took India’s Common Aptitude Test Exam was for sale on a forum for leaked data. A year later, India Times reported that confidential data of millions of students was for sale on a website called “studentdatabase.in.”

Han also says that in India’s burgeoning data-broker market, education data like that available via the exposed Diksha server, which can be particularly appealing for prep schools to purchase, can go for as little as 2 to 5 rupees for a single child’s data.

Flaw in Diksha App Exposed the Data of Millions of Indian Students

Encrypting files, folders, and drives on your computer means that no one else can make sense of the data they contain without a particular decryption key—which in most cases is a password known only to you. 

So while someone could get at your files if they know your password (the decryption key), they won't be able to take out a drive from your system and access what's on it, or use a second computer to read your data—it'll all be gibberish. It means that if your Windows or macOS machine gets lost or stolen, you don't have to worry about someone using the data on it.

How the most popular operating systems have handled encryption has changed over the years, and there are third-party tools that give you more encryption options to choose from. We'll guide you through everything you need to know about these options to help you pick the right one.

Built-in Options for Windows

Device encryption is available in the Home versions of Windows.

Windows via David Nield

Encryption on Windows is a little more complicated than perhaps it should be. First of all, there are differences between the Windows Home and Windows Pro editions: Pro users get a powerful tool called BitLocker for encryption, but with the Home edition, there's a more basic alternative. It's simply referred to as device encryption, and you can find it by choosing **Privacy & security** and then **Device encryption** from the Settings panel in Windows.

Not so fast though, as this option won't appear for everyone: It requires a certain level of hardware security support from your desktop or laptop computer. It's all rather complex, and we don't have room to go into everything in detail here, but The Windows Club has an excellent explainer. If you search the Start menu for a tool called "system information," then right-click and run it as an administrator, you can see why your computer does or doesn't support this feature via the Device Encryption Support entry.

Assuming your hardware does meet all of the requirements, and the **Device encryption** entry is visible, you can click through it to see if your system drives are encrypted—they should be, by default, if you log in to your computer with a Microsoft account. It means that anyone who accesses your hard drives without that authorization won't be able to see the data on them, because it'll be encrypted and protected. If encryption isn't enabled for whatever reason, you can turn the toggle switch to **On**.

When it comes to external drives and USB sticks, if you have the Pro version of Windows you can use BitLocker: Just right-click on the drive in File Explorer, pick **Show more options** and **Turn on BitLocker**, and set a password. For those on the Home edition though, this option isn't available—you're going to have to use a third-party tool for the job of encrypting external drives, and we'll get on to those later on in this article.

Built-in Options for macOS

Use FileVault for maximum protection on a Mac.

Apple via David Nield

Encryption on macOS isn't quite as confusing as it is on Windows, but it still needs some explaining. If you have a Mac with a T2 security chip or Apple silicon inside (so one from late 2017 or later), then the contents of your system disk are encrypted by default. Your account password is required to get into the computer and at all of the data secured on the drive.

However, without getting into too much technical detail (which you can access here if you want to dive deeper), you can add an extra layer of encryption protection by enabling a tool called FileVault. Enabling FileVault means the information required to decrypt your Mac drive is harder to get at—if, for example, someone steals your computer and connects a second computer to it. Traditionally, this could impact speed and performance, but in recent years that's become less and less of a problem and is practically unnoticeable on the newest Macs.

You'll be asked to enable FileVault when you first set up macOS on a new machine, and it's something we'd recommend. You can also turn FileVault on (or off) whenever you like by opening the **Apple** menu and choosing **System Settings** then **Privacy & Security**. There's a FileVault option there, together with some details about what it does. You'll also need to specify your preferred way of unlocking the system disk if you ever forget your password, either through iCloud or through a dedicated recovery key.

You can encrypt external drives with a password from Finder: Just right-click on them and choose **Encrypt**. If the encryption option doesn't appear, the drive needs to be wiped and reformatted to be compatible—open the Disk Utility tool in macOS, click **View** and **Show All Devices**, then select the relevant external drive and click **Erase**. Give the drive a name, choose an encrypted option under **Format** (the options are explained here) and choose **GUID Partition Map** under **Scheme**. Pick your password, then click **Erase**, and the drive is ready to go.

Third-party Options for Windows and macOS

VeraCrypt makes it simple to encrypt an external drive.

VeraCrypt via David Nield

There are a variety of free and paid third-party encryption tools available if the options built into Windows and macOS don't suit your needs, including Cryptomator, NordLocker, and AxCrypt. However, we recommend one in particular, VeraCrypt: It's available for Windows and macOS (and indeed Linux,) it's not difficult to use, and it's free.

We also recommend reading through the online documentation that accompanies the program, but getting started is quite straightforward. Say you're encrypting an external drive, for example: With the drive plugged in and formatted, open VeraCrypt and choose **Create Volume**. Next, select **Encrypt a non-system partition/drive** and select **Next**. Select the drive you want to encrypt and follow the instructions on the screen.

During the configuration process, you'll be asked whether you want to encrypt the existing data already on the drive, or format it ready for files to be added—if you already have files on the drive that you don't want to be wiped, make sure you pick the former option. You'll also be asked to specify a password to lock the drive, which you should make sure you won't forget (you won't be able to access the drive without it).

VeraCrypt also lets you create containers, or sections of a drive that are encrypted. If you need to lock up specific files and folders without encrypting an entire disk for whatever reason, then this is one of the ways of going about it. From the main VeraCrypt screen, click **Create Volume**, then **Create an encrypted file container**. You'll be asked to specify a file on disk that then acts as the encrypted container for other files and folders.

How to Encrypt any File, Folder, or Drive on Your System

Plus: A leaked US “no fly” list, the SCOTUS leaker slips investigators, and PayPal gets stuffed.

“Ordinary people’s private financial records are being siphoned indiscriminately into a massive database, with access given to virtually any cop who wants it,” Nathan Freed Wessler, deputy director of the ACLU’s Speech, Privacy, and Technology Project, told the _WSJ_. “This program should never have been launched, and it must be shut down now.”

A security researcher discovered a version of the United States’ controversial “no fly list” on an unsecured server run by CommuteAir, a regional airline based out of Ohio. The list, which contains more than 1.5 million entries, is far larger than previously reported and includes the names of individuals who are barred from flying to the United States.

CommuteAir confirmed the authenticity of the document to the Daily Dot, which was first to report about the leaked list.

According to the Daily Dot, the list contains the names of several notable figures, including the convicted Russian arms dealer Viktor Bout. The Biden administration sent Bout back to Russia in a prisoner exchange for WNBA star Brittney Griner, who returned to the US in December. In the data, which was shared with WIRED on Thursday evening, there were nearly 30 entries for individuals who were born after 2010. 

According to CNN, the US Transportation Security Administration is investigating the incident. 

After an eight-month investigation, the US Supreme Court has failed to discover who leaked the draft decision overturning _Roe v. Wade_, according to a report released by the court on Thursday. The unprecedented leak to _Politico_ last spring came more than a month before the final opinion was released and sparked nationwide protests.

Over the course of the leak investigation, the court interviewed 97 court employees and brought in forensic experts to examine call logs, printer logs, and fingerprints. According to the report, 80 people besides the nine justices had access to the draft opinion. 

“No one confessed to publicly disclosing the document, and none of the available forensic and other evidence provided a basis for identifying any individual as the source of the document,” the report states. “It is not possible to determine the identity of any individual who may have disclosed the document or how the draft opinion ended up with _Politico_.”

The report did not say whether the justices were interviewed.

According to a PayPal notice of security incident, attackers gained unauthorized access to the accounts of thousands of users between December 6 and December 8, 2022, using a credential-stuffing attack. Credential stuffing is when hackers, typically using a bot, attempt to access accounts using lists of leaked password and username pairs.

Over two days, hackers had access to account holders’ full names, dates of birth, postal addresses, Social Security numbers, and individual tax identification numbers. According to PayPal, 34,942 of its users have been impacted by the incident.

The affected users will get a free two-year identity monitoring service from Equifax.

The Biggest US Surveillance Program You Didn’t Know About

The mobile operator just suffered at least its fifth data breach since 2018, despite promising to spend a fortune shoring up its systems.

Yesterday, mobile giant T-Mobile said that it suffered a data breach beginning on November 26 that impacts 37 million current customers on both prepaid and postpay accounts. The company said in a US Securities and Exchange Commission filing that a “bad actor” manipulated one of the company's application programming interfaces (APIs) to steal customers' names, email addresses, phone numbers, billing addresses, dates of birth, account numbers, and service plan details. The initial intrusion occurred at the end of November, and T-Mobile discovered the activity on January 5.  

T-Mobile is one of the US's largest mobile carriers and is estimated to have more than 100 million customers. But in the past 10 years, the company has developed a reputation for suffering repeated data breaches alongside other security incidents. The company had a mega breach in 2021, two breaches in 2020, one in 2019, and another in 2018. Most large companies struggle with digital security, and no one is immune to data breaches, but T-Mobile seems to be approaching companies like Yahoo in the pantheon of repeated compromises.

“I'm certainly disappointed to hear that, after as many breaches as they've had, they still haven't been able to shore up their leaky ship,” says Chester Wisniewski, field chief technical officer of applied research at the security firm Sophos. “It is also concerning that the criminals were in T-Mobile's system for more than a month before being discovered. This suggests T-Mobile's defenses do not utilize modern security monitoring and threat hunting teams, as you might expect to find in a large enterprise like a mobile network operator.”

Because of limits on the API (an interface that facilitates communication between two software programs), the attacker did not gain access to Social Security numbers or tax IDs, driver's license data, passwords and PINs, or financial information like payment card data. Such data has been compromised in other recent T-Mobile breaches, though, including one in August 2021. In July 2022, T-Mobile agreed to settle a class action suit about that breach in a deal that included $350 million to customers. At the time, the company also committed to a two-year, $150 million initiative to improve its digital security and data defenses.

T-Mobile, which did not respond to multiple requests for comment from WIRED, wrote in its SEC disclosure that in 2021, “We commenced a substantial multi-year investment working with leading external cybersecurity experts to enhance our cybersecurity capabilities and transform our approach to cybersecurity. We have made substantial progress to date, and protecting our customers’ data remains a top priority.”

It clearly hasn't been enough, given the recent incident, which exposed data for roughly a third of the company's US-based customers. 

“How many of these does T-Mobile have to have?” wondered Jake Williams, a longtime incident responder and an analyst at the Institute for Applied Network Security. “API security is just starting to be something people are really focusing on, which was a mistake. Detecting API abuse is not easy, especially if the threat actor is moving low and slow. I suspect there's a large number of these in general that simply go undetected. But the bottom line is that T-Mobile's API security clearly needs work. You shouldn't be having mass API abuse for more than six weeks.”

At this point in the saga, customers may be wondering whether it even matters if T-Mobile has more customer data breaches, given that they've already had so many. But every new compromise exposes more people and potentially expands the data that cybercriminals have available to launch phishing attacks and other targeted scams. The information involved in the new breach could be especially useful to attackers for SIM swap attacks, in which they take control of victims' phone numbers and then abuse the access to take over accounts, including by capturing two-factor authentication codes sent over SMS. 

“The information stolen in this breach is ideal for SIM swapping attacks and other forms of identity theft,” Sophos's Wisniewski says. It “should be another reason for T-Mobile customers to lock down their accounts and move away from SMS-based multifactor authentication for banks, cryptocurrency wallets, etc.”

If you're a T-Mobile customer, or just looking to improve your digital security, make sure you're using an authenticator app or hardware token for two-factor on as many accounts as possible. And add a PIN to your wireless account so attackers need that additional authentication mechanism before they can attempt to compromise your SIM card.

On January 6, the US Federal Communication Commission proposed more stringent data-breach reporting criteria for the telecom industry.

“The law requires carriers to protect sensitive consumer information but, given the increase in frequency, sophistication, and scale of data leaks, we must update our rules to protect consumers and strengthen reporting requirements,” FCC chair Jessica Rosenworcel wrote. “This new proceeding will take a much-needed, fresh look at our data breach reporting rules to better protect consumers, increase security, and reduce the impact of future breaches.”

At this point, T-Mobile is undoubtedly a big driver of the telecom industry's data-breach Groundhog Day. Of the latest incident, Sophos' Wisniewski  laments, “Another day, another T-Mobile breach.”

T-Mobile's New Data Breach Shows Its $150 Million Security Investment Isn't Cutting It

Research shows that relatively few people exist in perfectly sealed-off media bubbles—but they’re still having an outsize impact on US politics.

One of the top concerns when it comes to the harms of social media and political polarization in the United States is the fear of echo chambers or people operating in media bubbles. If people are only hearing opinions they already agree with or seeing stories that align with their worldview, they may become more entrenched in their beliefs, whether or not their beliefs reflect the real world. They may also become easier to manipulate and more extreme.

Interestingly, research largely shows the vast majority of people don’t inhabit perfectly sealed-off echo chambers. It’s been found that only about 4 percent of people operate in online echo chambers, and most people on Twitter, for example, don’t follow any political accounts. Essentially, most people aren’t following politics, and a lot of people who do are getting at least a little bit of information from different sides of the political spectrum. That said, echo chambers and media bubbles are an issue because they can radicalize people, negatively affect the people who inhabit them, and distort the broader political landscape.

“The subset of the population that does consume hyper-partisan media and inhabit echo chambers on social platforms is very consequential,” says Magdalena Wojcieszak, a professor of communication at the University of California, Davis. “They’re more politically interested, more participatory, more strongly partisan, and more polarized. Because of all these things, they’re more likely to take part in politics.”

Wojcieszak says because these people are so politically involved, they have a disproportionate influence on American politics. They’re often the loudest voices in the room. She says people who are politically active like to have their views confirmed, so they can end up following accounts that align with their views and end up in echo chambers. Social media makes it easier to find people who align with them politically, and algorithms often feed them the content they’re going to like. All of this can ultimately lead to people going down rabbit holes and becoming more politically extreme.

“It makes you more extreme or polarized. It reinforces your attitudes. It also reinforces your sense of belonging to this group, and it reinforces your negativity and hostility toward other groups,” Wojcieszak says. “You think you’re the legitimate one, the good one, the virtuous one. The others are evil.”

People can start to believe they’re the only ones with the facts and that the other side is illegitimate. (Perhaps you’ve seen this in a person who paid tens of billions of dollars for a social media company not long ago.) Wojcieszak says the process of people becoming radicalized can start with them having just a few political views in common with those who are more extreme than they are. Having a few stances that align with these extreme actors online can be the snare that pulls them into the rabbit hole.

“In order to enter that process of this individual psychological and algorithmic confirmation, you do need to have some extent of susceptibility to some sort of narratives from the left or the right,” Wojcieszak says. “If there are some social or political issues in which you have some views, that can start the process.”

You can imagine someone who isn’t particularly politically extreme but does harbor certain fears about ways the country is changing being pulled in by extremists and becoming extreme themselves as they get increasingly embedded in that community. People need community, and extremists can give them that. They’ll be welcomed by this community, Wojcieszak says, and they’ll feel the psychological need to start going along with whatever that community’s narrative is on any number of issues. 

Mike Gruszczynski, an assistant professor of communication science at Indiana University, says a distrust in institutions, such as news media and the government, can lead to people creating echo chambers and often falling for disinformation because it appeals to their political beliefs. He says this has been found to be more common on the political right than the political left.

“You have a lot of people on the right wing of the political spectrum who have been highly distrustful of traditional journalism for quite a while,” Gruszczynski says. “Not only are they distrustful of it, but they exist in a kind of feedback loop where their chosen leaders tell them that the things that come out of the media are false or biased.”

One of the ways society can help prevent people from going down these rabbit holes and becoming more extreme is by teaching them media literacy. Gruszczynski says it won’t necessarily be easy to do, especially because there’s so much disinformation out there and it’s often quite convincing. But it’d be worth the effort. “Everyone kind of has to be their own detective in a way now,” Gruszczynski says.

It often feels like an insurmountable challenge, Wojcieszak says, because those who have become politically extreme are living in such a different reality than the rest of the populace. If someone is spending most of their time on extremist forums or in extreme groups on social media, for example, it’s hard to reach them and bring them back to reality. She says improving social media algorithms so these platforms are less likely to make people more extreme in the first place could be a good place to start when it comes to attacking this problem.

“In the US, things have gotten so deeply bad for some groups. The people who are, say, true Trump believers or who are convinced Covid was a hoax—I’m not sure if you can deprogram them,” Wojcieszak says.

Society may not be able to pull everyone out of these rabbit holes, but increased media literacy and social media platforms that aren’t designed to confirm people’s existing beliefs and make them more extreme could help fewer people become radicalized. It’s a widespread problem that will take time to address, but the status quo does not seem sustainable.

The Small but Mighty Danger of Echo Chamber Extremism

New research from Cloudflare shows that connectivity disruptions are becoming a problem around the globe, pointing toward a troubling new normal.

The Iranian government’s latest attempts in recent months to stifle protests through internet blackouts, digital curfews, and content blocking have presented a particularly extreme example of how far regimes can go in restricting digital access. But a new report from the internet infrastructure company Cloudflare, released today, highlights the stunning global prevalence of connectivity disruptions and their increasing relevance to people and organizations all around the world.

In 2022, Cloudflare began publishing reports that compile its internal observations about government internet blackouts and notable outages worldwide. As a content delivery network that also provides digital resiliency services, the company sees an array of signals when a chunk of the internet goes dark. For example, Cloudflare can assess internet protocol requests, like those for the routing system Border Gateway Protocol or the internet address book Domain Name System, to get insight into how a government executed a shutdown and where in the internet backbone it implemented the connectivity blocking.

The specific geopolitical context and technical nuances of different digital disruptions can make it difficult, or unhelpful, to make granular comparisons of disparate incidents. But Cloudflare, which operates in more than 100 countries and interconnects with more than 10,000 network providers, is using its vantage point and visibility into the global internet to track broader trends and offer a sense of scale about how pervasive internet shutdowns have become.

“There's an increasing use of shutdowns as a means of controlling communication,” says David Belson, Cloudflare's head of data insight and a longtime researcher of internet disruptions. “There are single points of failure for internet connectivity, and things that are outside of your control can impact your business, your organization, your individual collaborations. So if you are someone in a position of responsibility, you may have to start factoring that into your risk matrix and thinking about particular steps to ensure that your presence on the internet and the work you do on the internet remains uninterrupted.”

The new report, which looks at incidents from the fourth quarter of 2022, concluded that activity related to internet disruptions was actually lower, or “a little bit less active,” as Belson puts it, than previous quarters of last year. Still, the report listed intentional shutdowns and disruptions in Bangladesh, Cuba, Iran, Kenya, Pakistan, Sudan, and Ukraine, along with the United states, where Moore County, North Carolina, dealt with multiday internet outages thanks to assailants who shot at two electrical substations, causing power outages. In Ukraine and Iran particularly, Cloudflare's reporting was a continuation of ongoing monitoring and incidents.

An internet shutdown imposed by the Cuban government on October 1 was a continuation of shutdowns that began at the end of September in an attempt to curtail protests. The uprisings came in response to a hurricane that caused power outages on the island nation and a widespread feeling among the public that the Cuban government botched the recovery.

The report also highlights an accidental October cable cut in the UK’s Shetland Islands as well as technical failures in Australian, Haiti, and Kyrgyzstan.

“The interesting thing about internet shutdowns is that we typically don't see governments shutting down electricity or water or gas. They target the internet because they see shutting down the flow of information as a vital thing to do,” says John Graham-Cumming, Cloudflare's chief technical officer. “For a lot of us the internet is an essential utility that we can’t live without. These things really do have an impact, including an economic impact.”

Graham-Cumming and Belson note that they see increasing government reliance in many places on digital curfews and intermittent, recurring shutdowns—a trend that seems very likely to continue. It has even become common in some countries to impose connectivity blackouts for a few hours a day during university exams, purportedly to reduce the possibility of students cheating. And in places like Ukraine, where connectivity outages are driven by persistent, wartime attacks on critical infrastructure, the impacts are unrelenting and serve as a particularly sobering illustration of this new digital normal.

Welcome to the Era of Internet Blackouts

Some 1,700 spoofed apps, 120 targeted publishers, 12 billion false ad requests per day—Vastflux is one of the biggest ad frauds ever discovered.

Every time you open an app or website, a flurry of invisible processes takes place without you knowing. Behind the scenes, dozens of advertising companies are jostling for your attention: They want their ads in front of your eyeballs. For each ad, a series of instant auctions often determines which ads you see. This automated advertising, often known as programmatic advertising, is big business, with $418 billion spent on it last year. But it’s also ripe for abuse.

Security researchers today revealed a new widespread attack on the online advertising ecosystem that has impacted millions of people, defrauded hundreds of companies, and potentially netted its creators some serious profits. The attack, dubbed Vastflux, was discovered by researchers at Human Security, a firm focusing on fraud and bot activity. The attack impacted 11 million phones, with the attackers spoofing 1,700 app and targeting 120 publishers. At its peak, the attackers were making 12 billion requests for ads per day.

“When I first got the results for the volume of the attack, I had to run the numbers multiple times,” says Marion Habiby, a data scientist at Human Security and the lead researcher on the case. Habiby describes the attack as both one of the most sophisticated the company has seen and the largest. “It is clear the bad actors were well organized and went to great lengths to avoid detection, making sure the attack would run as long as possible—making as much money as possible,” Habiby says. 

Online and mobile advertising is a complex, often murky business. But it generates piles of money for those involved. Every day billions of ads are placed on websites and in apps—advertisers or ad networks pay to have their ads displayed and make money when people click on them or see them—and much of this is done as you open a website or an app.

Vastflux was first detected by Human Security researcher Vikas Parthasarathy in the summer of 2022 while he was investigating a different threat. Habiby says operating the fraud involved multiple steps, and the attackers behind it took a range of measures to avoid being caught out.

First, the group behind the attack—which Human Security hasn’t named due to ongoing investigations—would target popular apps and try to buy an advertising slot within them. “They were not trying to hijack an entire phone, or an entire app, they were literally going through one ad slot,” Habiby says. 

Once Vastflux won the auction for an ad, the group would insert some malicious JavaScript code into that ad to stealthily allow multiple video ads to be stacked on top of each other. 

Put simply, the attackers were able to hijack the advertising system so that when a phone was displaying an ad within an affected app, there would actually be up to 25 ads placed on top of each other. The attackers would get paid for each ad, and you would only see one ad on your phone. However, your phone battery would drain faster than usual as it processed all the fraudulent ads.

“It’s quite genius because the minute the ad disappears, your attack stops, which means that you’re not going to be found easily,” Habiby explains. 

The scale of this was colossal: In June 2022, at the peak of the group’s activity, it made 12 billion ad requests per day. Human Security says the attack primarily impacted iOS devices, although Android phones were also hit. In total, the fraud is estimated to have involved 11 million devices. There is little device owners could have done about the attack, as legitimate apps and advertising processes were impacted. 

Google spokesperson Michael Aciman says the company has strict policies against “invalid traffic” and there was limited Vastflux “exposure” on its networks. “Our team thoroughly evaluated the report’s findings and took prompt enforcement action,” Aciman says. Apple did not respond to WIRED's request for comment.

Mobile ad fraud can take many different forms. This can range, as with Vastflux, from types of ad stacking and phone farms to click farms and SDK spoofing. For phone owners, batteries dying quickly, large jumps in data use, or screens turning on at random times could be signs a device is being impacted by ad fraud. In November 2018, the FBI’s biggest ad fraud investigation charged eight men with running two notorious ad fraud schemes. (Human Security and other technology companies were involved in the investigation.) And in 2020, Uber won an ad fraud lawsuit after a company it hired to get more people to install its app did so through “click flooding.”

In the case of Vastflux, the biggest impact of the attack was arguably on those involved in the sprawling advertising industry itself. The fraud affected both advertising companies and apps that show ads. “They were trying to defraud all these different groups along the supply chain, with different tactics against very different ones,” says Zach Edwards, a senior manager of threat insights at Human Security. 

To avoid being detected—up to 25 simultaneous ad requests from one phone would look suspicious—the group used multiple tactics. They spoofed the advertising details of 1,700 apps, making it look like lots of different apps were involved in showing the ads, when only one was being used. Vastflux also modified its ads to only allow certain tags to be attached to adverts, helping it avoid detection. 

Matthew Katz, head of marketplace quality at FreeWheel, a Comcast-owned ad tech company that was partly involved in the investigation, says attackers in the space are becoming increasingly sophisticated. “Vastflux was an especially complicated scheme,” Katz says. 

The attack involved some significant infrastructure and planning, the researchers say. Edwards says Vastflux used multiple domains to launch its attack. The name Vastflux is based on “fast flux”—an attack type hackers use that involves linking multiple IP addresses to one domain name—and VAST, a template for video advertising, developed by a working group within the  Interactive Advertising Bureau (IAB), that was abused in the attack. (Shailley Singh, executive vice president, product and chief operating officer at IAB Tech Lab, says using the VAST 4 version of its template can help prevent attacks like Vastflux, and other technical measures from publishers and ad networks would help reduce its effectiveness.) “It’s not the very simple kind of fraud scheme that we see all the time,” Habiby says.

The researchers refused to reveal who may be behind the Vastflux—or how much money they potentially made—citing ongoing investigations. However, they say they’ve seen the same criminals running advertising fraud efforts as far back as 2020. In that instance, the ad fraud scheme was targeting US swing states and allegedly collecting users’ data.

For now, at least, Vastflux has been stopped. In June of last year, Human Security and several companies it has partnered with to take action against ad fraud began actively combating the group and the attack. Three separate disruptions of Vastflux took place during June and July 2022, dropping the number of ad requests from the attack to under a billion per day. “We identified the bad actors behind the operation and worked closely with abused organizations to mitigate the fraud,” the company said in a blog post.

In December, the actors behind the attack took down the servers, and Human Security hasn’t seen any activity from the group since then. Tamer Hassan, the firm’s CEO, says there are multiple actions people can take against criminal actors, some of which may lead to law enforcement action. However, money matters. Stopping attackers from profiting will reduce the attacks. “Winning the economic game is how we win as an industry against cybercriminals,” Hassan says.

_Update 11:55 am ET, January 19, 2023: Added comment from an IAB representative._

A Sneaky Ad Scam Tore Through 11 Million Phones

Animal rights activists have captured the first hidden-camera video from inside a carbon dioxide “stunning chamber” in a US meatpacking plant.

At 4 am one morning in October of last year, animal rights activist Raven Deerbrook sat on a bed in a cheap hotel in East Los Angeles, looking at a live video feed on her phone. She’d barely slept that night, waking every hour or two to check that the feed was transmitting from three pinhole infrared cameras she’d hidden in the Farmer John meatpacking plant 20 miles away. The facility, located in the LA suburb of Vernon, is owned by Smithfield Foods, the largest pork producer in the world. She waited, both anticipating and dreading what her cameras were about to reveal.

A day earlier, Deerbrook had snuck into the slaughterhouse with a fake uniform and badge and climbed 26 feet underground into a “stunning chamber”—essentially a three-story-deep elevator shaft designed to be filled with carbon dioxide. Here, pigs in cages are lowered into the shaft’s invisible swimming pool of suffocating, heavier-than-air CO2, where the animals asphyxiate over a matter of minutes before being dumped out of the chamber onto a conveyor belt, hung up, drained of blood, and butchered.

Deerbrook had hidden one camera pointed at that chamber from the plant’s wall. She’d mounted two more with microphones on the car-sized cages within. When she’d tried to descend further down the shaft’s ladder, a burning “air hunger” from residual CO2 in the chamber had forced her to climb out again, gasping for breath, unable to plant her remaining cameras.

Safely back in her hotel room across the city, Deerbrook hoped to record the slaughterhouse gas chamber, inside and out, for the first time in a US meat plant. In doing so, she aimed to disprove claims from the pork industry and the gas chamber manufacturer that this form of suffocation represents a humane—even “painless”—form of killing.

At 5:25 am, as the plant’s operations began for the morning, she saw the first half-dozen pigs herded into the chamber. Deerbrook’s first thoughts were a mix of excitement and practical anxieties: Were the camera angles right? Was the frame rate high enough?

Then the light in the video began to dim as the cage lowered into the carbon dioxide below. As Deerbrook watched, the pigs began to squeal and thrash violently around in the cage, struggling to escape and convulsing for nearly a minute before finally laying still. “Pigs are very human-like in their screaming. And I wasn’t expecting to see them suffer for so long,” she says. “I knew it was going to be bad. But I wasn’t really prepared for the screaming.”

Deerbrook, still in her pajamas, sat on the hotel bed, staring at her phone screen in horror. The images and audio that she recorded would haunt her nightmares for months to come. “The only silver lining was the fact that I was able to download the footage,” she says. “Because once I started getting those first video clips, I knew: At least this is going to be documented.”

_**Warning: The following video depicts the killing of pigs in a CO2 gas chamber. Viewer discretion is advised.**_

Today, Direct Action Everywhere, the group of animal rights activists Deerbrook belongs to, released the footage on a new website, StopGasChambers.org, after providing the videos to WIRED in advance. The recordings are the first to reveal what really happens inside a US pig slaughterhouse gas chamber: They capture the truth of a method of animal slaughter that already dominates the meat industry in many countries around the world and is quickly growing among large-scale American meatpacking plants.

The videos also show how repurposed surveillance technology is making it harder than ever for the meat industry to hide the details of its animal slaughter from the public: Direct Action Everywhere’s activists used tiny spy cameras smaller than a coin to capture the footage. The entire setup—including enough batteries for days of recording, an infrared LED, a microphone, and a radio chip for transmitting the video in real time—is smaller than a credit card.

Direct Action Everywhere, or DxE, says its latest videos contradict claims from the animal agriculture industry and the Iceland-based gas chamber manufacturer Marel—which sold the system used in the Farmer John meatpacking plant—that CO2 asphyxiation of pigs improves animal welfare and reduces suffering. A group of 10 veterinarians who have seen DxE’s recordings have also signed an open letter to the American Veterinary Medicine Association, published today, that argues based on the footage that the chambers likely violate US state and federal law governing animal slaughter.

Direct Action Everywhere’s 3D reconstruction of a Marel “stunning chamber” of the kind used in pig slaughterhouses.Courtesy of Direct Action Everywhere

CO2 “stunning chambers”—a euphemism, perhaps, given that some experts say pigs usually die in them—have become increasingly commonplace in slaughterhouses around the world. They’re widespread in Europe and Australia and increasingly used in large US slaughterhouses, due to both their efficiency and their claimed benefits for animal welfare. Marel states on its website that its gas chambers can “stun” as many as 1,600 pigs an hour, and that the “stress-free” experience for animals improves the quality of their meat compared with older methods, such as the stunning by electrocution that was previously used in many US slaughterhouses. On its website, Smithfield Foods claims that its CO2 chambers lead to “painless loss of consciousness and death.”

Deerbrook argues that her video of pigs squealing and fighting for air entirely contradicts any such claim. “It’s an incredibly cruel and inhumane way to kill,” she says, adding, “When you see cows shot in the head or chickens being cut open while they’re still conscious, it’s really bad. But they don’t scream.”

DxE’s footage isn’t the first time that the inside of a slaughterhouse’s CO2 stunning chamber has been captured on video. In 2014, the Australian animal rights group Aussie Farms was the first to use hidden cameras to capture similar footage of pigs squealing and thrashing before collapsing inside a smaller gas chamber in a slaughterhouse in New South Wales. But DxE’s videos represent the first time such footage has been captured inside the US—evidence DxE hopes to use to make the case that the CO2 chambers violate US law.

Comparing the hidden cameras DxE used in its new investigation to those of Australian activists nearly nine years earlier also shows the evolution of the cat-and-mouse game between animal rights activists and the animal agriculture industry. Aussie Farms used pinhole cameras, like DxE, but had to connect them to digital video recorders nearly the size of a laptop—and then, because the cameras didn’t transmit the footage wirelessly, had to sneak back into the slaughterhouses to retrieve the devices that stored their recordings.

A tiny infrared spy camera of the kind Direct Action Everywhere hid inside the Farm John slaughterhouse, complete with a microphone, infrared LED, and battery pack.

Photograph: Direct Action Everywhere

Deerbrook also used tiny cameras, specifically ones produced by Sony that are sometimes sold to law enforcement for hidden camera surveillance. But she was able to power them for days with small lithium-ion batteries and connected them via Wi-Fi to a hotspot generated by an Android phone that she hid on the top of the Marel gas chamber. That allowed her to both miniaturize her setup—hiding it in a small box that looked like a part of Marel’s equipment—and remotely connect to the cameras from another phone, miles away, downloading the footage with no need to retrieve her devices.

That improved operational stealth is increasingly necessary, Deerbrook says, as slaughterhouses have become warier of activists, improving their physical security, tightening their access controls, and searching out hidden surveillance devices. In an earlier attempt in 2020, in fact, Deerbrook hid cameras without remote connectivity in a slaughterhouse gas chamber, but those were discovered before she could retrieve any footage.

When WIRED reached out to Smithfield Foods and shared DxE’s videos with the company, it responded in a statement that “Smithfield is committed to the safety, health, and comfort of our animals and strictly follows approved laws, regulations and best practices for humane animal stunning prior to harvest. We adhere to all humane handling and stunning regulations for livestock with the oversight of the United States Department of Agriculture Food Safety and Inspection Service.” The company pointed out that organizations like the USDA and the American Veterinary Medicine Association have recognized carbon dioxide gas chambers as complying with humane slaughter laws for years. It argued that “carbon dioxide stunning quickly renders hogs into a state of analgesia,” adding that its programs were “created in consultation with two of the world’s foremost experts in animal behavior and handling.” Gas chamber manufacturing firm Marel didn’t respond to WIRED’s request for comment.

Counter to Smithfield’s claims, several veterinarians, animal agriculture experts, and an animal welfare law professor who watched DxE’s videos and others from research studies agree that the kind of reaction captured in the footage represents an inhumane and even illegal degree of pain.

“Those animals suffered terribly. They suffered horribly,” says Jim Reynolds, a vet and professor at Western University’s College of Veterinary Medicine who has served on the American Veterinary Medicine Association’s panel for euthanasia guidelines. “It was absolutely a violation of federal law. They were not stunned. It was inhumane.”

Reynolds says he watched at least 10 of DxE’s clips from its investigation, and they left him disturbed for days. “I’ve actually seen a lot of horrible videos. This is the worst I’ve ever seen,” he says. “I’m not eating pork from the United States anymore until somebody fixes these problems.”

The Humane Methods of Slaughter Act states that any technique for stunning animals that’s “rapid and effective” is legal, says Justin Marceau, a professor focused on animal law at the University of Denver’s Sturm School of Law. But “it is difficult to believe that anyone could watch these videos and conclude that the method being used is either rapid or effective,” says Marceau, who watched clips of DxE’s footage. “You need to have methods that are reliable and rapid, and that is not what I see in these videos.”

The veterinarians’ letter to the AVMA that was sent to coincide with the release of DxE’s footage echoes this view, arguing that the “extreme distress experienced by the pigs highlights the company’s failure to comply with the Humane Slaughter Act and California law.”

The US Department of Agriculture, which regulates the meatpacking industry in the country, didn’t respond to WIRED’s request for comment about the legality of Smithfield Foods’ use of CO2 stunning chambers in its slaughterhouses.

Veterinarians disagree on what exactly to _do_ about gas chambers. Most agree that compared with electrocution, which has to be performed on pigs one at a time, gas chambers are actually preferable in that they allow pigs to stay in groups, which reduces their stress. But the gas chambers also obscure what happens to the pigs after the chamber closes—including suffering that lasts far longer than electrocution. Temple Grandin, a renowned animal welfare expert and professor of animal science at Colorado State University, writes that “if the pigs violently attempt to escape when they first inhale the gas, this is not acceptable.”

Some prominent researchers, like Cambridge University neuroscientist and animal welfare expert Donald Broom, have argued that argon gas puts pigs to sleep without the same degree of suffering as CO2. But Grandin counters that using argon is more expensive and so unlikely to be adopted by the pork industry. Instead, she suggests pigs could be genetically bred to have a less violent reaction to CO2. She says she’s seen firsthand that some breeds of pigs die without showing signs of struggle inside CO2 gas chambers.

Three years ago, Grandin says, she and one of her students had planned to carry out a study in one meatpacking plant, owned by a major pig-rearing and slaughterhouse company, to put cameras inside a CO2 gas chamber and observe its effects on different breeds of pigs. Just days before the study was set to begin, according to Grandin, the company canceled the project. “I was furious,” she says.

“I wanted to try to fix this problem,” Grandin adds. “They didn’t want to look inside the box.”

DxE’s Deerbrook says the first step toward any solution is for meatpacking plants and the USDA to use their own cameras to monitor what happens to animals inside slaughterhouse gas chambers. (She says she saw none during her climb into Farmer John’s pit.) She doesn’t want to prescribe a fix or tweak for those machines but rather to expose the cruelty they hide—and expose regulators’ unwillingness to enforce the animal welfare laws she says they violate.

“We’re saying, ‘You’re not looking in here because you _know_ this is inhumane,’” says Deerbrook. “You need to witness what you’re doing. You need to look inside.”

Spy Cams Reveal the Grim Reality of Slaughterhouse Gas Chambers

Cupertino puts privacy first in a lot of its products. But the company still gathers a bunch of your information.

When I turned on personalized ads (I had previously turned them off), Apple’s ad targeting information says I am included in segments based on my age (from my date of birth), my gender (which may be inferred if I have not told Apple), and location (based on my registered postcode). Apple also listed my interests broadly as 10 different categories for apps—including productivity, sport, news, and business. For movies, I am included in the Action and Adventure category, as well as Sci-Fi and Fantasy.

The company’s documentation also says that App Store “browsing activity” is also used to help determine ads that can be shown to you. “App Store browsing activity includes the content and apps you tap and view while browsing the App Store. This information is aggregated across users so that it does not identify you,” the company’s documents say.

This data has the potential to be extensive. “Everything is monitored and sent to Apple almost in real time,” says Tommy Mysk, an app developer and security researcher who runs the software company Mysk with fellow developer Talal Haj Bakry. In November, the Mysk researchers demonstrated how taps on the screen were logged when using the App Store. Their follow-up research demonstrated that analytics data could be used to identify people. 

“The App Store is special because there’s no other option,” Mysk says. “There is no other choice. If you don’t like the privacy statement of Apple Music, fine. You can use Spotify—there are alternatives. To the App Store, there is nothing.”  

The research has resulted in two class actions against Apple. Separately, France’s data regulator has fined Apple for its advertising practices. Apple spokesperson Shane Bauer says the company was “disappointed” with the French decision and plans to appeal. “Apple Search Ads goes further than any other digital advertising platform we are aware of by providing users with a clear choice as to whether or not they would like personalized ads,” Bauer says. “Additionally, Apple Search Ads never tracks users across 3rd party apps and websites, and only uses first-party data to personalize ads.”

Bauer adds that privacy protections are built into all its apps. “Identifiable information is never shared with third parties and is not used to track users across apps and websites,” Bauer says. “All data used for advertising purposes is disassociated from personal identifiers, and Apple Advertising operates on the basis of de-identified data.”

Apple says that during the first quarter of last year, 78 percent of searches in the App Store where people could have been shown ads were from devices that had personalized ads turned off—the “conversion rate” for advertisers is basically the same for personalized ads and contextual ads, it says.

Apple’s policy for Siri says that if you use the service, your requests are associated with a random identifier and not your Apple ID. Apple also produces “computer-generated transcripts of your Siri requests” to understand you better. The company says the random identifier it uses isn’t linked to any of your other Apple data, isn’t sold, and isn’t used to build a “marketing profile.”

How To Limit The Data Apple Collects

It’s possible to opt out of Apple showing you personalized ads in the App Stores, News, TV, and Stocks apps. If you want to turn off Apple’s personalized ads on iOS, you can do so by going to **Settings** > **Privacy & Security** > **Apple Advertising** and toggling off **Personalized Ads**. In this menu it's also possible, if you have personalization on, to view the ad targeting information that Apple uses to show certain ads to you. 

Two places where Apple uses your data for ads—the Apple News and Stocks apps—can have their individual settings tweaked to change the identifiers that are linked to you. Within **Settings** and then each app’s details, you can toggle on the option to reset identifiers that are reported to publishers. 

In the **Privacy & Security** section of Apple’s settings, it may also be worth considering **Analytics & Improvements**. Within this setting, you can stop Apple's collection of iPhone and iCloud analytics data, which it says are used to help it improve its products and services. If you want to get the data that Apple has on you, it can be accessed through the company’s download tool.

Albert Fox Cahn, the executive director of the civil rights and privacy group Surveillance Technology Oversight Project, says Apple should do more to highlight its recently announced encrypted iCloud backups. “Many users don’t realize just how vulnerable iCloud data (including device backups and messages) are by default,” Cahn says.

Equally, it’s worth taking some time to review the permissions for your other apps and devices’ sensors in the **Privacy & Security** section. It’s possible to change your location settings, reviewing what apps can see your location and when; stop third-party apps, such as Facebook, from tracking you across your iPhone; and see what permissions you’ve given to which apps.

Source

Wired