Hackers can use Microsoft’s Power Automate to push out ransomware and key loggers—if they get machine access first.

Automating mundane work tasks has become easier over the past few years. Using drag-and-drop automation software, you can track your working hours in a spreadsheet or automatically create a to-do list item when someone mentions you in an email. The tools can make your life easier, but they carry risks.

One security researcher has found a way to hijack Microsoft’s software automation tool to send ransomware to connected machines and steal data from devices. The attack uses the automation tool as it was designed, but instead of sending legitimate actions, it can be used to deploy malware, says Michael Bargury, the cofounder and CTO of security firm Zenity, which is behind the work.

“My research showed that you can very easily, as an attacker, take advantage of all of this infrastructure to do exactly what it is supposed to do,” Bargury says. “You \[then\] use it to run your own payloads instead of the enterprise payloads.” The researcher documented his work at the DefCon hacker conference last month and has since released the code.

The attack is based on Microsoft’s Power Automate, an automation tool that was built into Windows 11. Power Automate uses a form of robotic process automation, also known as RPA, in which a computer mimics a human’s actions to complete tasks. If you want to get a notification each time an RSS feed is updated, you can build a custom RPA process to make that happen. Thousands of these automations exist, and Microsoft’s software can link up Outlook, Teams, Dropbox, and other apps.

The software is part of a broader low-code/no-code movement that aims to create tools people can use to create things without having any coding knowledge. “Every business user now has the power that the developer used to have,” Bargury says. His company exists to help secure low-code/no-code apps.

Bargury’s research starts from a position in which a hacker has already gained access to someone’s computer—whether through phishing or an insider threat. (While computers within businesses are frequently insecure—from a lack of patching and updates, for example—starting at this point means an attacker would have already gotten into a corporate network.)

Once an attacker has access to a computer, they need to take a few additional steps to abuse the RPA setup, but these are relatively simple. “There’s not a lot of hacking here,” says Bargury, who dubbed the whole process Power Pwn and is documenting it on GitHub.

First, an attacker needs to set up a Microsoft cloud account, known as a tenant, and set it to have admin controls over any machines that are assigned to it. This essentially allows the malicious account to run RPA processes on an end user’s device. On the previously compromised machine, all a hack has to do now is assign it to the new admin account—this is done using a simple command line, called silent registration.

“Once you do that, you will get a URL that would allow you, as an attacker, to send payloads to the machine,” Bargury says. Ahead of his DefCon talk, he created multiple demos showing how it is possible to use Power Automate to push out ransomware to impacted machines. Other demos show how an attacker can steal authentication tokens from a machine. “You can exfiltrate data outside of the corporate networks through this trusted tunnel, you can build keyloggers, you can take information from the clipboard, you can control the browser,” Bargury says.

A Windows 11 Automation Tool Can Easily Be Hijacked

The California Age-Appropriate Design Code would launch a huge online privacy experiment. And it won’t just affect children.

No one would describe the internet as “kid-friendly.” Parents fret over how to keep their kids safe from the internet’s myriad dangers, from bullies to predators to surreptitious surveillance. A new California bill is poised to remove some of the burden from parents—and force tech companies to take more responsibility to protect kids online.

This week, the California legislature voted unanimously to pass the California Age-Appropriate Design Code Act. Once Governor Gavin Newsom signs the bill into law, the code will require sites and apps that serve users under 18 to “consider the best interests of children when designing, developing, and providing” their products. The ADCA could be the United States’ biggest step toward comprehensive online protections for kid users yet.

The ADCA comes amid growing scrutiny of the time kids spend online, what kind of data is collected about them, and how all that screen time might cause harm. Buffy Wicks, a Democrat spearheading the bill and parent of two young children, says the bill isn’t meant to clamp down on young people’s internet experience. “I am raising digital natives and children who are comfortable being online,” she says. “I feel it’s our moral obligation to keep them safe as they learn and grow.” Tech companies, on the other hand, are not financially incentivized to design a healthy, data-protective internet for kids.

The ADCA’s main pillars regulate the privacy policies of any company whose web products serve users under 18. These companies would be required to offer a high level of privacy for child users by default. If parents, say, don’t want their children to receive messages from a stranger over a social media platform, they shouldn’t have to click around for a tiny “settings” tab; that option should already be turned on. It also aims to give kids more digital agency over their internet exploration. Companies would be required to offer transparent information on their privacy policy in kid-friendly language and allow kids to log their privacy concerns with the company.

If enacted, the law would also impose stricter rules around what companies can and can’t do with kids’ personal information. Under the legislation, companies wouldn’t be able to collect or share data beyond what’s strictly necessary for the site to function. They would have to complete a “Data Protection Impact Assessment,” a survey that would basically force them to detail how kids’ data will be used. They would also have to disclose whether the product uses addictive design mechanisms, like autoplay or gamified nudges that reward spending more time on an app.

Most notably, the bill would apply to sites and apps that aren’t specifically directed at children, but are “likely to be accessed by” them. That means the regulatory controls will extend beyond the usual suspects of mobile games or teen social media hubs. The rules could apply to, among other sites, Google Search, retail sites, and news websites like this one. If a company violates the ADCA, they have 90 days to come up with a fix, or the California Attorney General’s office could exact a fine of up to $7,500 per affected child.

Supporters say that the ADCA would compel tech firms to proactively design products that protect children, rather than reacting to harms they’ve already inflicted. “It’s not meant to fix a problem after the fact,” says Nicole Gill, cofounder and executive director of the nonprofit Accountable Tech. “It’s meant to encourage design that is safe and healthy and fosters a safe experience online for kids.” Accountable Tech supports the bill, along with organizations like Common Sense, Fairplay, and the American Academy of Pediatrics, California.

The status quo for kid safety on the internet is universally disappointing. A recent study by software company Pixalate found that thousands of kid-directed apps transmit users’ GPS data and residential IP addresses to ad companies. The habit-forming nature of social media apps has raised concerns about the relationship between social media and teens’ mental health. The primary law governing kids’ privacy online is COPPA, the federal Children’s Online Privacy Protection Rule. But COPPA, which Congress has updated only a handful of times since 1998, has a limited reach: It applies only to sites and apps directed to children under the age of 13. The ADCA, which applies both to anyone under 18 _and_ to online products that are “likely to be accessed by children” but may not be specifically directed to children, would be far more expansive.

Some of the bill’s critics argue that the ADCA’s scope is overinclusive. Opponents include the video game trade group Entertainment Software Association and Technet, a group whose members include Google, Meta, and Snap. The News/Media Alliance has also lobbied against the bill, citing concerns that it would raise the cost of publishing news online. (Condé Nast, WIRED’s parent company, is a member, and its CEO sits on News/Media Alliance’s board.)

The bill outlines several indicators for what might constitute a site’s “likelihood” of being accessed by children, including some clear-cut indicators, such as whether a site features advertisements targeted to kids. But other indicators are ambiguous, like whether a site is “routinely assessed by a significant number of children.” (How often is “routine,” and what number is “significant”?)

Critics have particularly seized on the ADCA’s requirement that companies “estimate the age of child users with a reasonable level of certainty.” The bill itself does not lay out how companies ought to estimate the age of child users. So how could that work? Will online services start asking users to furnish driver's licenses or credit cards, as some critics have stated? Doesn’t estimating age invite _more_ data collection, not less?

Supporters of the bill say that age estimation methods don’t have to be invasive. A report from the 5Rights Foundation, which sponsored both the California and UK Design Codes, suggests that users could, for example, self-report birthdays, use a third-party age assurance provider, or complete a “capacity test” (solving a puzzle that helps indicate an age range). Companies that absolutely need to verify that their users are adults, like dating sites, would ask for hard identifiers like driver's licenses. Under the ADCA, companies will also be allowed to build a profile of all users’ online activity or keep the online profiles of users they already have—but these data profiles can be used only to estimate a user’s age. The age estimation profile cannot be kept longer than necessary or used in any other way. But it’s unclear how regulators would enforce these aspects of the statute.

The ADCA does include a carve-out, stipulating that if a site or app affords a high level of data protections (e.g., it doesn’t sell user data, doesn’t use targeted ads), it doesn’t need an age-estimation mechanism at all.

Let’s say there’s a website called Fake-website.com. If Fake-website.com is found to have a “significant” number of routine visitors who are teenagers, then it would be subject to regulatory control under the ADCA. At this point, Fake-website.com has two options: If it uses targeted ads or sells users data, then it would have to install an age estimation mechanism, like a prompt for users to enter their birthday, so that it does not offer targeted ads to users who identify themselves as under 18. Fake-website.com then can’t use the user data point (their birthday) in any other way, and must delete it as soon as possible. If it does not use targeted ads or sell users’ data, then there’s nothing more to be done. Supporters say that the relevant clause (”apply the privacy and data protections afforded to all children to all consumers”) is the heart of the bill, and the mechanism by which the ADCA could actually incentivize making the internet safer for all users.

That is, if it can be enforced. Others worry that the bill’s ambiguities, including the age estimation clause, are too vague to be implemented at all. “My guess is it will probably just be ignored by tech companies,” says Justin Brookman, the director of technology policy at nonprofit Consumer Reports. “It feels like sloppy policymaking.”

Supporters, however, say that the ambiguity is purposeful. The law will create a new regulatory agency tasked with hammering out the bill’s specifics, including the age-estimation requirement. It’s meant to work with companies on a case-by-case basis to determine how they might comply with the law, which would go into effect in July 2024.

The ADCA is not without precedent—the bill is modeled after similar UK legislation that went into effect in 2021. It’s unclear whether the UK Design Code has had much impact. It has yet to be enforced, despite being enforceable for a year. The country’s information commissioner, John Edwards, told Bloomberg that his office is “looking into how over 50 different online services are complying with the code.”

While Governor Newsom has not yet given a public stance on the ADCA, he’s expected to sign it, which he must do by the end of September. Once enacted, the bill could have further-reaching consequences than just the kids of California. Although the law is enforceable only for users and businesses based in California, companies might opt to offer higher data privacy protections for all kids, rather than geofencing protections for California. For example, when Europe passed GDPR, Microsoft chose to extend GDPR’s protections to all users.

As Wicks put it in a press conference on Tuesday: “It is my absolute hope that if this bill gets signed into law, it will become, effectively, the law of the land.”

The US May Soon Learn What a ‘Kid-Friendly’ Internet Looks Like

Researchers found that mobile applications contain keys that could provide access to both user information and private files from unconnected apps.

As with any piece of software, mobile apps can create an array of security issues and exposures, from rogue programs that are intentionally malicious to apps that contain an obscure but significant flaw. Now, new research is shedding light on systemic oversights in mobile app cloud infrastructure that are all too common and create the risk that users' data could leak where it shouldn't or be compromised.

Researchers from Broadcom's Symantec Threat Hunter team published findings on Thursday about the prevalence of hard-coded authentication credentials lurking in the cloud services that underlie hundreds of mainstream apps. These login credentials are often meant to give the app access to a single file or service, like a mechanism for an app to display public images from a company's website or run text through a translation service at a user's request. But in practice, the researchers found, these same credentials often grant access to all files stored in a cloud service, like company data, database backups, and system control components. And when multiple apps have been created by the same third-party development firm or incorporate the same publicly available software development kits (SDKs), these static authentication tokens may even grant access to the infrastructure and user data of multiple, unconnected apps.

All of this means that if an attacker discovered these access tokens, they could potentially unlock massive and disparate troves of sensitive data all by finding one key under one doormat.

“The cloud is still kind of a new frontier. And sometimes when you hear about the practices being used, you realize that a lot of organizations may not be where they are with security on other fronts,” says Symantec's Dick O’Brien. “It’s hard to say whether it’s people cutting corners or whether it’s just an ignorance of what you’re exposing by putting those credentials out there, but it’s certainly obvious that data isn’t being ring-fenced anywhere near the way it should be."

The researchers found 1,859 publicly available apps on both Android and iOS that contained hard-coded Amazon Web Services credentials. The vast majority were iOS apps, a discrepancy Symantec says it has tracked for years but hasn't fully explained. The credentials present in more than three-quarters of the apps granted access to private cloud services, and nearly half of those additionally gave access to private files. Fifty-three percent of the apps contained access tokens that were also found in other, often totally unrelated, apps.

“Initially it was very surprising, but this is a systemic thing,” O’Brien says. “People need to do a complete audit of what they’re using and realize that there are multiple layers there. The practice of implementing hard coded access keys is not great. Temporary credentials that expire after a short period of time are probably the way to go, and also there needs to be greater awareness that you need to silo information.” 

Symantec says it has notified the developers of the apps where it sees the most pressing issues and hopes to raise awareness about how insecure development practices and shared resources can create exposures without careful consideration and segmentation. 

In one case, the researchers realized that several mainstream iOS banking apps were all using the same third-party AI digital identity software development kit that exposed cloud credentials of the shared service. While none of the banking apps themselves created the SDK, the credentials exposed its server structure and infrastructure blueprints, source code, and the AI models underlying the identity service. And more than 300,000 biometric fingerprint files from users of five of the mobile banking apps were leaking and potentially exposed.

In another case, the researchers noticed what it calls a large hospitality and entertainment company working with a technology company on sports betting apps. In total, hard-coded credentials gave infrastructure access to 16 online gambling apps, exposing their cloud services and even granting root access to take control of this backend platform. 

Symantec's O’Brien emphasizes that while the company isn't naming the impacted apps, it hopes the findings will raise awareness about these common pitfalls and their potentially outsize impact on users. “The things we found—it illustrates the significance of what we’re dealing with here,” he says.

Careless Errors in Hundreds of Apps Could Expose Troves of Data

Prepaid phones are looking good as privacy worries peak.

Even if surveillance overreach (abortion bounty-hunting, police use of face recognition) doesn't make you want to ditch your smartphone for something less connected, you could still consider a burner phone, a practically disposable prepaid mobile device that's not under contract with a wireless carrier.

Yep, prepaid cell phones that were popularized by brands like Boost Mobile and Cricket in the mid-aughts, and in pop culture by their frequent use in TV's _The Wire__,_ are still around. In fact, tens of millions of customers still go for burner phones, whether they're flip phones or smartphones on Android or iOS from providers such as Verizon-owned TracFone, Simple Mobile, or Total Wireless.

What's the appeal? The idea is that a cheap phone with prepaid calling minutes and data is disposable, free of any contract commitment, and more private. For someone who uses a cell phone or data plan infrequently, it could be much cheaper than a typical mobile phone plan.

Prabhat Agarwal, senior director of research and trends at the Consumer Electronics Association, says that while wireless companies steer customers to post-paid plans with higher-margin 5G data plans and longer commitments, prepaid phones “are not going away anytime soon. There's a lot of groups for which prepaid makes a lot of sense,” he explains.

If you pay cash for the hardware and the service, you are theoretically untethered from being traced to the phone with your bank account, credit card, or home address. Of course, that anonymity vanishes the moment you start using a burner phone to log in to your Facebook account or you commit a crime serious enough to warrant the authorities investigating who used a burner phone to, say, plan an _Ocean's 11_\-style casino heist.

Going off-grid isn't the only reason to get a prepaid phone, though. Maybe you want a dedicated second phone for a side hustle like Lyft driving that doesn't get used all the time, since it won't be subject to use-it-or-lose-it monthly fees. You might be someone who wants to keep your online dating or personal email completely separate from the premium smartphone you use for work. Or you could use a cheap, locked-down phone that allows your kids to call friends and grandparents and play games. A cheap prepaid device won't cause as much stress if the screen gets cracked or the handset ends up in the toilet.

In all these cases, a burner phone can allow you to be accessible by phone but with a different phone number than your main one. If you value keeping your main cell number nonpublic, but you still need to be reachable to a large number of people, a prepaid phone may be simpler than getting a second line or using a service like Google Voice.

How to Choose a Burner Phone

If that sounds interesting, the first thing you need to decide is _how_ _much_ burner phone you actually need. If it's just for phone calls and light data communication, you could go retro with a flip phone and hope you remember how to use T9 texting.

Especially for smartphones, depending on the model, there might be limited built-in memory for apps, video, and other data. You may also need to supply your own SIM and SD cards to use the mobile network and expand the phone's memory. Make sure you remove both of those cards before you get rid of the phone, or at least wipe the memory on the SD card first.

Expect to pay anywhere from $20 for a cheap flip phone to $300 or more for something like a fully loaded prepaid iPhone 11. If being untrackable is your primary goal, paying with a credit card or online account might defeat the purpose. Go to a store. Pay cash or use a gift card. Burn the receipt, or, better yet, don't ask for one.

Prepaid phone plans that include voice, text, and data might be sold in time increments from a month at a time up to a year. Some may offer “unlimited” usage, but be sure to read the fine print on what that actually means. One thing to watch out for, Agarwal says, is that some prepaid data plans have much lower data allotments and may throttle the speed of the network even before you hit your data limit. You should also be aware of what wireless network the prepaid provider uses. For instance, Cricket uses AT&T's mobile network, and TracFone is on Verizon's. That matters less for privacy, but more for understanding where you’ll have service and what speed of wireless service will be available.

If you don't want new hardware in your life, you could look for a software solution such as the aptly named Burner app, available for iOS and Android that promises to give you a second phone line and more privacy for $3.99 to $4.99 a month, depending on your plan.

How to Use a Burner Phone

First, as with any device, you'll need to activate the phone. (There's usually easy-to-follow instructions in the phone packaging.) You can keep buying additional data and voice minutes with prepaid cards you buy in stores or online.

Depending on the phone, you might have access to apps you're already familiar with that offer good privacy and encryption options, such as Telegram or Signal. You could also use VPN apps to further anonymize your online activity.

However, you should understand that no matter how careful you are to protect your privacy, any login to a website from a burner phone or even hopping onto a Wi-Fi network could expose your location data and other private information. The Intercept has a good video guide geared toward protestors with tips to keep some of that data private.

Once you're done with a burner phone, you can erase the data on it with a factory reset (don't forget to wipe the SD card if one is in use). Then stash it away, throw it away, or resell it on the secondary market to a site such as Gazelle or Swappa. You may even be able to trade it in with a wireless carrier.

You’re Not Stringer Bell, but You May Still Need a Burner Phone

Plus: Chrome patches another zero-day flaw, Microsoft closes up 100 vulnerabilities, Android gets a significant patch, and more.

August was a bumper month for security patches, with Apple, Google, and Microsoft among the firms issuing emergency fixes for already exploited vulnerabilities. The month also saw some big fixes arriving from the likes of VMWare, Cisco, IBM, and Zimbra.

Here’s everything you need to know about the important security fixes issued in August.

Apple iOS 15.6.1

After a two-month patch hiatus, followed by multiple fixes in July, Apple released an emergency security update in August with iOS 15.6.1. The iOS update fixed two flaws, both of which were being used by attackers in the wild.

It is thought that the vulnerabilities in WebKit (CVE-2022-32893) and the Kernel (CVE-2022-32894) were being chained together in attacks, with serious consequences. A successful attack could allow an adversary to take control of your iPhone and access your sensitive files and banking details.

Combining the two flaws “typically provides all the functionality needed to mount a device jailbreak,” bypassing almost all Apple-imposed security restrictions, Paul Ducklin, a principal research scientist at Sophos, wrote in a blog analyzing the vulnerabilities. This would potentially allow adversaries to “install background spyware and keep you under comprehensive surveillance,” Ducklin explained.

Apple always avoids giving out details about vulnerabilities until most people have updated, so it’s hard to know who the attack targets were. To ensure you are safe, you should update your devices to iOS 15.6.1 without delay.

Apple also released iPadOS 15.6.1, watchOS 8.7.1, and macOS Monterey 12.5.1, all of which you should update at the next opportunity.

Google Chrome

Google released a security update in August to fix its fifth zero-day flaw this year. In an advisory, Google listed 11 vulnerabilities fixed in August. The patches include a use-after-free flaw in FedCM—tracked as CVE-2022-2852 and rated as critical—as well as six highly rated issues and three classed as having a medium impact. One of the highly rated vulnerabilities has been exploited by attackers, CVE-2022-2856.

Google hasn’t provided any detail about the exploited flaw, but since attackers have gotten ahold of the details, it’s a good idea to update Chrome now.

Earlier in August, Google released Chrome 104, fixing 27 vulnerabilities, seven of which were rated as having a high impact.

Google Android

The August Android security patch was a hefty one, with dozens of fixes for serious vulnerabilities, including a flaw in the framework that could lead to local privilege escalation with no additional privileges needed. Meanwhile, an issue in the media framework could lead to remote information disclosure, and a flaw in the system could lead to remote code execution over Bluetooth. A vulnerability in kernel components could also lead to local escalation of privileges.

The Android security patch was late in August, but it’s now available on such devices as Google’s Pixel range, the Nokia T20, and Samsung Galaxy devices (including the Galaxy S series, Galaxy Note series, Galaxy Fold series, and Galaxy Flip series).

Microsoft

Microsoft’s August Patch Tuesday fixed over 100 security flaws, of which 17 are rated as critical. Among the fixes was a patch for an already exploited flaw tracked as CVE-2022-34713, also known as DogWalk.

The remote code execution (RCE) flaw in the Windows Support Diagnostic Tool (MDST) is rated as having a high impact because exploiting it can result in a system compromise. The vulnerability, which affects all users of Windows and Windows Server, was first exposed over two years ago in January 2020, but Microsoft didn’t consider it a security issue at the time.

VMWare

VMWare fixed a bunch of flaws in August, including a critical authentication bypass bug tracked as CVE-2022-31656. On releasing the patch, the software firm warned that public exploit code is available.

VMWare also fixed an RCE vulnerability in VMware Workspace ONE Access, Identity Manager, and Aria Automation (formerly vRealize Automation), tracked as CVE-2022-31658 with a CVSS score of eight. Meanwhile, a SQL injection RCE vulnerability found in VMware Workspace ONE Access and Identity Manager also got a CVSS score of eight. Both require an attacker to have administrator and network access before they can trigger remote code execution.

Apple Fixed a Serious iOS Security Flaw—Have You Updated Yet?

In the last two weeks of the war, an ad hoc team armed with group chats, QR codes, and satellite maps launched a mad dash to save imperiled Afghan allies.

Inside the Shadow Evacuation of Kabul

Anti-Putin media network February Morning has become a central player in the underground fight against the Kremlin.

On the evening of August 20, Russian TV pundit and conspiracy theorist Darya Dugina was killed on the outskirts of Moscow when a powerful explosion ripped apart her Toyota Land Cruiser. Dugina was a vocal supporter of Russia's invasion of Ukraine and the daughter of fascist philosopher and writer Alexander Dugin, nicknamed “Putin’s brain” thanks to his perceived ties to Russian president Vladimir Putin. According to Russian authorities, a remote-controlled “explosive device,” presumably installed in her car, went off at around 9 pm local time.

News of Dugina’s assassination spread like wildfire through social media, most notably on the instant messaging service Telegram, where it was shared approvingly by a vast network of Russian and Ukrainian channels. But in the hours that followed, it became clear that one channel, operated by the media outlet Utro Fevralya, or February Morning, is more than just a place to share the news. It aims to play a key role in the story.

Created by exiled former Russian MP and dissident Ilya Ponomarev, February Morning was the first to report on a group claiming responsibility for Dugina’s death. Ponomarev himself took to YouTube, where February Morning airs its shows, claiming that the perpetrators were a little-known Russian resistance group called the National Republican Army. According to Ponomarev, an all-out war against “Putinism” had just begun.

While the National Republican Army’s involvement remains unconfirmed, Ponomarev’s announcement crystallized February Morning’s role as the center of gravity of a growing guerilla movement to spark revolution in Russia. The movement’s ecosystem includes activists and saboteurs of all types, from anarchists to fascists, connected through a network of Telegram channels and a singular goal: overthrowing Vladimir Putin.

Making History

On a sun-drenched balcony overlooking a busy street in downtown Kyiv, 48-year-old Evgeni Lesnoy smokes a final cigarette before going back on the air. The seasoned journalist is one of the faces of February Morning, which he joined shortly after its creation following Russia’s invasion of Ukraine in the early hours of February 24. “Because of my friends and relatives who stayed in Russia, I had been closely following the events there prior to February 24,” Lesnoy says in Russian. After his outspoken condemnation of the war in Donbas and the annexation of Crimea cost him his friends and, ultimately, his job, the journalist left Russia for Ukraine in 2015 and has been living with his husband in Kyiv ever since.

“When I was told that this project existed, I figured that this is where I needed to be,” he says, gesturing towards the TV studio in the next room. “Because I understand the context of what is happening inside Russia: I was born there, and I understand how people there think.”

Ponomarev, February Morning’s founder, is the only member of the Russian Duma to have voted against the 2014 annexation of Crimea. After the vote, he became persona non grata in Putin’s Russia, so he and his family fled to Ukraine’s capital city and started a new life. “For quite a long time, I had wanted to create a media aimed at a Russian audience, and that would broadcast from Kyiv,” he tells WIRED over Signal. “I tried to raise money for what I thought would be a Russian-language Al-Jazeera for maybe a year._”_ The venture was unsuccessful. But when Russian tanks crossed into Ukraine, the former MP and father of two joined the Territorial Defense in Kyiv, and the project took on new urgency. “After the first couple of days, many of my friends started telling me that now might be the time to revisit the idea of a media targeting Russians.”

The living room of the 18th-century apartment in which February Morning has taken residence is home to its television studio with a semicircular stage lit with a bluish light. Two screens broadcast in the background. When presenting the day’s show, Lesnoy sits before a small table draped with a white and blue tricolor flag—the symbol of the Russian opposition to the invasion—and that of Ukraine.

Broadcast on YouTube, the professionally produced daily programs try to counter the official Russian narrative surrounding the war, reporting on the atrocities committed by the “occupiers” against the Ukrainian population. “Putin’s supporters and apologists have big media organizations and prime-time news shows,'' says Lesnoy. “We want to give a voice to those who oppose the war.”

Which is what Ponomarev did on August 21, when he claimed on air that the National Republican Army assassinated Dugina—an act he described as “legitimate.” He also read the group’s purported manifesto, which called on all Russians to join the ranks of the National Republican Army and vow to destroy all those who have “usurped their power.”

February Morning’s insights into the domestic resistance movement in Russia stem from its 27 regional outlets, each with its own Telegram channel where activists and journalists mingle to gather and share news of anti-Putin actions. A binational team of around 70 journalists, technicians, and activists operates covertly in the far-flung regions of Russia and in Kyiv. In addition to its studio in Ukraine’s capital, the network brazenly broadcasts from Moscow. “I don't know how long the studio there will be able to operate, but even if the FSB shows up at the door and shuts us down, there will be another one,” says Ponomarev.

Whereas most media outlets only report the story, February Morning intends to be part of it. “We are referring to ourselves as the Russian ‘NEXTA,’ the Belarusian resource that played a key role in the protests two years ago following the reelection of Alexander Lukashenko,” says Ponomarev, referring to Belarus’ autocratic leader. “We want to be the resource that will play a critical role in the future revolutionary changes in the country.”

To this end, Ponomarev and his team have set up a Telegram channel known as Rospartizan, which has become an aggregator for information pertaining to the resistance to Putin and the war in Ukraine as well as a key recruitment tool. Every day, Rospartizan relays the latest developments across Russia, from the torching of a military recruitment office to the unfurling of an antiwar banner in front of the Russian Ministry of Defense building in Moscow.

According to Ponomarev, representatives of the National Republican Army first made contact with him through Rospartizan, a testament to the channel’s growing notoriety. “We are providing, in my opinion, the most comprehensive news stream on what is going on in Russian regions, in terms of acts of sabotage and the actual resistance,” says Ponomarev. The National Republican Army’s manifesto concludes, “stay in contact with us through the Rospartizan Telegram channel.”

With more than 26,000 followers, Rospartizan embraces anyone who’s anti-Putin, no matter their political ideology—a feature, not a bug, according to Ponomarev, a former Communist Party member and self-described “social globalist.”

“I am right now not only reaching out, but very actively interacting with not only my friends on the left side of the political spectrum,” he says, “but also with people on the far-right, who we are usually fighting with.”

The Enemy of My Enemy

Roman Popkov, the former head of the Moscow branch of the National-Bolshevik party, falls into that far-right camp. Popkov used to be a member of the influential Russian National Unity, a now-defunct neo-Nazi group responsible for a string of racist crimes, before joining the political party founded by controversial Russian writer, poet, and dissident Eduard Limonov, who sought to unite far-left and far-right radicals on the same platform.

In 2006, after years of harassment by Russian security forces, Popkov was arrested and spent more than two years in pretrial detention in the infamous Butyrka prison. The European Court of Human Rights ruled that his detention was illegal, and his arrest is widely considered to have been motivated by his political activism.

Popkov, now residing in Ukraine, works as a journalist for a number of independent media outlets, and is the head of a recently launched media project called Poslezavtra, or “The Day After Tomorrow.” An “old friend” of Ponomarev, Popkov has featured extensively on February Morning’s shows and took part in the broadcast that followed Dugina’s assassination.

“We are covering direct actions targeting the military and the apparatus of political repression of Putin's regime,'' Popkov says over the phone. “First of all, we are trying to inspire people, to get them to act, and second, we inform and report on what is being done.”

Like Ponomarev, Popkov stresses that activists’ ideologies are not as important as a willingness to defy Putin’s regime and to oppose the war in Ukraine.

“Our collective unites people opposed to Putin's regime, with different political views and ideologies,” says Popkov. “At the moment, it's not that important if one is an anarchist, a nationalist, or a liberal as, since Russia is not a democracy, we have no representation in parliament, and can't vote for our candidates.”

According to Popkov, acts of sabotage in Russia are mostly the work of small-scale far-right and far-left groups, the most famous of those being the Anarcho-Communist Combat Organization, or BO-AK. The organization rose to prominence after it sabotaged the railway leading to a Russian military arsenal in the small town of Kirzach, 100 km east of Moscow. The group shared photos of the sabotage on their own Telegram channel, which quickly spread to other anti-Putin channels, including Rospartizan, and was soon featured on February Morning’s broadcast.

Yet even the staunch anarchists of the BO-AK acknowledge the need to reach out to the other side of the political spectrum. “Most of our contacts are from our ideological camp, but not all,” an anonymous representative of the group tells WIRED. “We believe that alliances with different forces are necessary in our struggle.”

The anarchists of the BO-AK consider direct actions and acts of sabotage as the best way to kickstart the social revolution, a view shared by many members of Rospartizan. In addition to two sabotage operations targeting military railways, the BO-AK claims to have set fire to a cell phone tower in the Belgorod region “in order to damage Putin’s army communications in Ukraine.”

“Only those who can back it with their actions can call themselves the opposition,” an anonymous contributor to Rospartizan says over Telegram, “be them a Molotov cocktail thrown at a military recruitment office, a wire strung across train tracks, or a gas canister taken to the car of a regime collaborator.”

Dangerous Cocktails

Inspired by the Belarusian resistance to Lukashenko and the protestors’ innovative use of Telegram, Popkov, Ponomarev, and activists like the anarchists of BO-AK have turned to social media to organize, recruit, and incite people to act against the war and Putin’s increasingly authoritarian regime.

“Telegram is a less censored, more intelligent, and politicized social network. A large part of our immediate target audience is present here—people who are potentially interested in radical politics,_”_ says the BO-AK. “This is where lies the usefulness of social networks for campaigning and education—they are an excellent channel for broadcasting and communicating.”

Antiwar activists in Ukraine and in Russia have taken full advantage of the relative anonymity Telegram provides. A website known as Ostanovi Vagony, or “Stop the Wagon,” and its associated Telegram channel aim to educate Russian would-be partisans on the safest, most effective ways to sabotage the railway system. Meanwhile, a Telegram channel created in late May called Gromko (“loud” in Russian) creates sleek infographics explaining how to make a Molotov cocktail—described as the best way to disable the car of a Putin sympathizer—or how to deface the regime’s propaganda posters.

This material is regularly shared by Ponomarev's Rospartizan, which has become a central conduit for guerrilla efforts to rally new recruits, spread information and news, and, purportedly, to facilitate the assassination of a high-profile regime collaborator. In an interview with Russian independent media Meduza, Ponomarev claimed to have known in advance that “something was going to happen” ahead of Dugina’s assassination. He further claimed that he helped the National Republican Army exfiltrate Natalya Volk, the woman whom Russian security services named as the main suspect in her death: “Sometimes people need to be saved from FSB persecution, they need to be pulled out of Russia—we pull them out.”

Telegram did not respond to WIRED's request for comment.

While unconfirmed, the number of acts of sabotage targeting military and state infrastructure in Russia appears to grow weekly. According to Russian independent media Insider, there have been more than 20 attacks on military registration and enlistment offices in Russia (which were reported by the media and Telegram channels), most of which were arson. “There were no similar incidents last year,” notes Insider journalist Alisa Zemlyanskaya, writing under a pseudonym. Meanwhile, an estimated 63 freight trains derailed in Russia between March and June, a significant increase compared to the same period last year.

Russian authorities, eager to downplay the significance of the apparent sabotage efforts, have blamed those incidents on the poor condition of the railway system. The scale of guerrilla attacks on Russian entities remains, therefore, difficult to assess.

“When it comes to railway sabotage especially, it's difficult, or even impossible, to tell if it’s sabotage, or if it’s an accident due to a technical problem, or to the incompetence of the authorities,” says Popkov.

According to the BO-AK—whose members signed the sabotaged section of rail in Kirzach with the name of their group and the link to its Telegram channel—“that’s because many guerrilla groups do not leave any message or position themselves in the media in any way.”

“In any case, every week there are several reports of railway sabotage, the destruction of power lines, and other acts of resistance,” says the group. “This suggests that the guerrilla movement is not a mass movement, but a fairly large-scale one.”

Russian security services are quick to blame infiltrated Ukrainian saboteurs for these attacks. Regardless of who’s behind them, acts of sabotage continue unabated: On August 17, yet another freight train derailed near Mogilev, in Belarus, while last Wednesday, a man threw two Molotov cocktails at the regional administration building in Oryol, in western Russia.

Fire-bombing a car or derailing a Russian train can, of course, carry significant penalties. But even less extreme activities are dangerous, especially in light of a slew of new repressive Russian laws. In July, lawmakers updated Russia’s Criminal Code to crack down on working with “foreign states and organizations,” public activities “directed against the security of the state,” and the production and public display of “Nazi paraphernalia or symbols.” Because Putin has repeatedly claimed, baselessly, that Ukraine was run by a clique of drug addicts and Nazis and cited “denazification” as one of the primary motivators of his invasion, this last amendment could potentially land an antiwar protestor waving a Ukrainian flag in prison.

According to Russian independent media OVD-Info, authorities in Russia detained some 16,500 people between February and July for having taken part in protests or actions against the war.

Activists and dissidents both in Russia and abroad expose themselves to retaliation from Putin’s regime—a fact that they are acutely aware of. “I'm a reasonable person, I don’t think I'm invulnerable or immortal,” Ponomarev says. “So I do understand that there are issues with security and everything. But I have done a lot of effort to protect myself and the place where I live, as well as the way I move across the city.” Those concerns have been heightened following Dugina’s assassination and Ponomarev’s subsequent declarations. On August 21, a member of the Russian government proposed a contest for the best video or photo of the dissident politician “crawling on broken legs and apologizing while spitting his teeth.”

“I’m not going to pretend that I am not scared at all,” says February Morning’s Lesnoy after his last interview of the day had ended. “But I live in Ukraine, where Putin is waging war. Everybody here is at risk.”

When asked about their motivation for joining the resistance and potentially exposing themselves to repression, an anonymous contributor to Rospartizan summed it up simply: “Let us use the platitude, ‘who else if not us?’”

The Telegram-Powered News Outlet Waging Guerrilla War on Russia

Plus: An Iranian hacking tool steals inboxes, LastPass gets hacked, and a deepfake scammer targets the crypto world.

This week, former Twitter chief security officer Peiter “Mudge” Zatko filed an explosive whistleblower complaint against the company. The allegations, which Twitter contests, claim the social media firm has multiple security flaws that it hasn’t taken seriously. Zatko alleges Twitter put an Indian government agent on its payroll and failed to patch servers and company laptops. Among the claims, however, one stands out: the suggestion that Twitter engineers could access live software and had virtually untracked access to its system.

In a privacy win for students across the US, an Ohio judge has ruled that it is unconstitutional to scan students’ homes while they are taking remote tests. We also detailed the privacy flaw that is threatening US democracy—a lack of federal privacy protections means mass surveillance systems could be used against citizens in new ways.

Elsewhere, as Russia’s full-scale invasion of Ukraine passes six months, military forces are increasingly turning to open source data to back their efforts. Police in India are using facial recognition with very low accuracy rates—the technology is being widely used in Delhi but could be throwing up plenty of false positives. And we dived deeply (perhaps too deeply) into how four high school students hacked 500 of their schools’ cameras, across six locations, and rickrolled thousands of students and teachers. It’s one elaborate graduation prank.

And there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

Since Russia-backed trolls flooded Facebook and Twitter with disinformation around the 2016 US elections, the social media firms have improved their ability to bust disinformation networks. The companies frequently take down propaganda accounts linked to authoritarian states, such as Iran, Russia, and China. But it’s rare that Western disinformation efforts are discovered and exposed. This week, the Stanford Internet Observatory and social media analysis firm Graphika detailed a five-year operation that was pushing pro-Western narratives. (The research follows Twitter, Facebook, and Instagram as they remove a series of accounts from their platforms for “coordinated inauthentic behavior.”)

The propaganda accounts used memes, fake news websites, online petitions, and various hashtags in an attempt to push pro-Western views and were linked to both overt and covert influence operations. The accounts, some of which appear to use AI-generated profile pictures, targeted internet users in Russia, China, and Iran, among other countries. The researchers say the accounts “heavily criticized” Russia following its full-scale invasion of Ukraine in February and also “promoted anti-extremism messaging.” Twitter said the activity it saw is likely to have originated in the US and the UK, while Meta said it was the US.

Many of the techniques used by the online influence operation appear to mimic those the Russia-backed accounts used in the buildup to the 2016 elections. It’s likely, however, that the Western influence operations weren’t that successful. “The vast majority of posts and tweets we reviewed received no more than a handful of likes or retweets, and only 19 percent of the covert assets we identified had more than 1,000 followers,” the researchers say.

In recent years, Charming Kitten, a hacking group linked to Iran, has been known for its “aggressive, targeted phishing campaigns.” These phishing efforts aim to gather the usernames and passwords of people’s online accounts. This week, Google’s Threat Analysis Group (TAG) detailed a new hacking tool Charming Kitten is using that’s capable of downloading people’s entire email inboxes. Dubbed Hyperscrape, the tool can steal people’s details from Gmail, Yahoo, and Microsoft Outlook. “The attacker runs Hyperscrape on their own machine to download victims’ inboxes using previously acquired credentials,” TAG says in a blog post. The tool can also open new emails, download their contents, and then mark them as unread, so as not to raise suspicions. So far, Google says it has seen the tool used against fewer than two dozen accounts belonging to people based in Iran.

Password management company LastPass says it has been hacked. “Two weeks ago, we detected some unusual activity within portions of the LastPass development environment,” the company wrote in a statement this week. LastPass says an “unauthorized party” was able to gain access to its development environment through a compromised developer account. While the hacker (or hackers) were within LastPass’s systems, they took some of its source code and “proprietary LastPass technical information,” the company says in its statement. It has not detailed which elements of its source code were taken, making it difficult to assess the seriousness of the breach. However, the company does say that customer passwords and data have not been accessed—there’s nothing LastPass users need to do in response to the hack. Despite this, the indictment is still likely to be a headache for the LastPass technical teams. (It’s not the first time LastPass has been targeted by hackers either.)

The chief communications officer of crypto exchange Binance claims scammers created a deepfake version of him and tricked people into attending business meetings on Zoom calls with his fake. In a blog post on the company’s website, Binance’s Patrick Hillmann said that several people had messaged him for his time. “It turns out that a sophisticated hacking team used previous news interviews and TV appearances over the years to create a ‘deepfake’ of me,” Hillmann wrote, adding that the alleged deepfake was “refined enough to fool several highly intelligent crypto community members.” Neither Hillmann nor Binance has posted any images showing the claimed deepfake. Since deepfakes first emerged in 2017, there have been relatively few incidents of faked video or audio scams impersonating people. (The vast majority of deepfakes have been used to create nonconsensual pornographic images). However, recent reports say deepfake scams are on the rise, and in March of last year the FBI warned that it anticipated a rise in malicious deepfakes within the next 12 to 18 months.

A US Propaganda Operation Hit Russia and China With Memes

The phishing attack on the SMS giant exposes the dangers of B2B companies to the entire tech ecosystem.

The communication company Twilio suffered a breach at the beginning of August that it says impacted 163 of its customer organizations. Out of Twilio's 270,000 clients, 0.06 percent might seem trivial, but the company's particular role in the digital ecosystem means that that fractional slice of victims had an outsized value and influence. The secure messaging app Signal, two-factor authentication app Authy, and authentication firm Okta are all Twilio customers that were secondary victims of the breach.

Twilio provides application programming interfaces through which companies can automate call and texting services. This could mean a system a barber uses to remind customers about haircuts and have them text back “Confirm” or “Cancel.” But it can also be the platform through which organizations manage their two-factor authentication text messaging systems for sending one-time authentication codes. Though it's long been known that SMS is an insecure way to receive these codes, it's definitely better than nothing, and organizations haven't been able to move away from the practice completely. Even a company like Authy, whose core product is an authentication code-generating app, uses some of Twilio's services.

The Twilio hacking campaign, by an actor that has been called “0ktapus” and “Scatter Swine,” is significant because it illustrates that phishing attacks can not only provide attackers valuable access into a target network, but they can even kick off supply chain attacks in which access to one company's systems provides a window into those of their clients.

“I think this will go down as one of the more sophisticated long-form hacks in history,” said one security engineer who asked not to be named because their employer has contracts with Twilio. “It was a patient hack that was super-targeted yet broad. Pwn the multi-factor authentication, pwn the world.”

Attackers compromised Twilio as part of a massive, yet tailored phishing campaign against more than 130 organizations in which attackers sent phishing SMS text messages to employees at the target companies. The texts often claimed to come from a company's IT department or logistics team and urged recipients to click a link and update their password or log in to review a scheduling change. Twilio says that the malicious URLs contained words like "Twilio," "Okta," or "SSO" to make the URL and the malicious landing page it linked to seem more legitimate. Attackers also targeted the internet infrastructure company Cloudflare in their campaign, but the company said at the beginning of August that it wasn't compromised because of its limits on employee access and use of physical authentication keys for logins. 

“The biggest point here is the fact that SMS was used as the initial attack vector in this campaign instead of email,” says Crane Hassold, director of threat intelligence at Abnormal Security and a former digital behavior analyst for the FBI. “We’ve started to see more actors pivoting away from email as initial targeting and as text message alerts become more common within organizations it’s going to make these types of phishing messages more successful. Anecdotally, I get text messages from different companies I do business with all the time now, and that wasn’t the case a year ago.”

The hackers used their Twilio access to compromise 93 Authy accounts and authorize additional devices that the attacker controlled instead of the account owner. Authy has roughly 75 million users in all. Meanwhile, the Twilio breach potentially exposed 1,900 accounts on the encrypted communication app Signal, and attackers seem to have actually used the access to initiate takeovers of as many as three accounts. Because of how Signal is designed, attackers wouldn't have gotten access to a user's message history or contact list but would have been able to impersonate the user and send messages while in control of the account.

On Thursday, the online food delivery service DoorDash announced that it suffered a breach of some internal systems and user data because one of its third-party service providers was compromised. “Based on our investigation, we determined the vendor was compromised by a sophisticated phishing attack,” DoorDash wrote in a statement. “The unauthorized party used the stolen credentials of vendor employees to gain access to some of our internal tools.” The marketing automation platform Mailchimp said earlier this month that it was breached in a phishing attack on its employees as well.

Researchers from the cybersecurity firm Group-IB said in a report on Thursday that it had identified and notified 136 organizations that seemed to be victims of the phishing campaign. Of those, 114 victim companies are based in the United States. And the researchers found that the majority of targets are cloud services, software development companies, or IT management firms. The findings underscore the seemingly thoughtful and targeted nature of the campaign to maximize impact by focusing on internet infrastructure and business management services that provide crucial support, including components of login authentication, for large clients.

“We are very disappointed and frustrated about this incident,” Twilio wrote in an update on August 10. “Trust is paramount at Twilio, and we recognize that the security of our systems and network is an important part of earning and keeping our customers' trust.”

Phishing has been an inveterate and consequential threat for years, playing a role in many impactful breaches around the world, including Russia's attack on the Democratic National Committee in 2016. But if the next phase of the trend is phishing-fueled supply chain attacks, the scale of the collateral damage will magnify in an unprecedented way.

Why the Twilio Breach Cuts So Deep

An attack on Russian mercenaries shows how militaries are increasingly using open source data—with sometimes deadly consequences.

The shadowy Russian Wagner paramilitary group has been responsible for atrocities around the world. After first surfacing during Russia’s 2014 annexation of Crimea, Wagner mercenaries have been spotted across Central Africa, Syria, and Libya. Since March, according to British intelligence, Wagner forces have been operating in Ukraine, directly alongside Russia’s official military forces.

One part of the Wagner group was attacked in the city of Popasna, Ukraine, earlier this month. On August 8, a pro-Russian journalist in the area shared photos on the Telegram messaging app that allegedly showed the local Wagner headquarters. In doing so, they exposed the location of the group. One photo, which has since been deleted, included a sign revealing the base’s address. Ukrainian forces put the data to work.

A few days after the photos were posted online, Ukraine’s military turned the base to rubble, claiming they hit it using American-made rocket systems. A Ukrainian government official said that it “seems” the Wagner-operated location was found using the photos shared on Telegram. The strike appears to be one of the latest incidents in Russia’s full-scale invasion of Ukraine where open source intelligence—knowledge gained from publicly available information—has been used to target military attacks or inform tactical operations.

Analysts and online sleuths, such as journalists at the investigative news outlet Bellingcat, have developed and professionalized open source investigation techniques for years. Open source intelligence, also known as OSINT, involves the use of public data—such as social media posts, flight tracking data, and satellite images, among other sources—to let anyone investigate events worldwide, from potential war crimes to human rights violations.

Piecing together small details from multiple sources of information can allow investigators to understand a clearer picture of events on the ground. For instance, comparing features in a photograph, such as a row of trees, and matching them to satellite images can reveal a real-world location. OSINT investigations have previously uncovered Russia’s involvement in the downing of flight MH17; tracked down soldiers in Cameroon who allegedly killed children; and tackled human rights violations around the world.

Many of these investigations often take place online, far from events and often months or years after the events that have taken place. Throughout Russia’s invasion of Ukraine, OSINT has played a big role and changed many of the rules of conventional war. Satellite images have shown Russian troop buildups around Ukraine’s borders, identified Russian army commanders, and tracked those alleged to have killed Ukrainian prisoners of war.

“What you’re now seeing in Russia and Ukraine is a lot more of open source investigations geolocating targets, bases, military equipment,” says Jack McDonald, a senior lecturer in war studies at King’s College London, who studies information and privacy in war. OSINT has the potential to provide crucial intelligence to military forces defending Ukraine and launching counterattacks. McDonald says one of the biggest changes during this conflict has been the Ukraine government’s repurposing of the Diia public services app, which includes an “e-Enemy” feature allowing people to report the movements of Russian troops.

When it comes to militaries launching attacks using open source intelligence (including in the Wagner incident), it is unlikely that they will do so solely based on data gleaned from social media. While Ukrainian officials have said the photos of the Wagner base were useful, it is not clear whether they combined this with existing information before they launched their attack. Ukraine’s Ministry of Defence did not respond to questions about how it is using open source intelligence. However, it did recently share a photo online claiming that a Russian tourist posed for holiday photos in front of Russian air defense systems.

“Militaries like to have fidelity if they’re going to do a kinetic strike or target something—they have to justify their targeting,” says Maggie Smith, an assistant professor at the Army Cyber Institute at West Point, adding that her views do not represent those of the US military. Smith says OSINT can “show you where activity may be so that you can point more exquisite intelligence assets to focus on that area and get better visibility, better granularity, learn more about it.”

The Wagner attack is not the only instance of military action based (at least in part) on information published online. In June, the Centre for Information Resilience (CIR), a nonprofit organization that counters influence operations, published a report saying a pro-Russian OSINT group used footage from a Ukrainian news channel to locate a munitions factory in Kyiv. The building was then hit by Russian missiles, and three civilians were killed. People in Ukraine have also faced criticism for sharing social media footage of their locations.

Anything that is posted online can be used by military forces for their planning or operations. “As a commander on the ground, you have to be aware that so much data is being produced about every single one of your soldiers at any given time,” Smith says. “The signals that are emitted from cell phones or any of anybody’s web presence, anything like that, can send signals to your adversary about your location, potential training cycles, all those types of things. Any sort of photo that is posted by anybody in your ranks can probably be used to help identify where you’re located, what assets you may have.” (In the past, public data from fitness app Strava exposed military bases, as well as the names and heart rates of soldiers on them.)

Giangiuseppe Pili, an open source intelligence research fellow at the Royal United Services Institute for Defence and Security Studies, says that OSINT has been used by militaries and intelligence for years, but there has recently been an acceleration in what is possible. “The big change is the data fusion capability of open source intelligence now—so to combine different sources into one product that really brings a picture of the reality in a realistic sense,” Pili says. The speed of analyzing open source data has also increased, Pili says.

In addition to ensuring that data is accurate before it is acted on, McDonald says that there may be privacy questions of militaries using open source data that they scrape from social media. “We don’t really have a good understanding of what the limits should be or whether there should be any limits,” McDonald says, adding that if citizens send in information they have taken, this could make them military targets, further blurring the line between civilian and combatant.

While OSINT is being used on the ground for military purposes, it’s also being used in Ukraine to clean up after battles have taken place. Andro Mathewson, a research officer at the HALO Trust, is using open source data in Ukraine to help clear landmines and understand what weapons are being used. This largely comes from social media posts. “Our analysis helps us to plan our operations, tailor our demining training, and know what to educate people about in our risk education outreach,” Mathewson says.

In April, HALO Trust relocated its headquarters to the Kyiv region to focus on “clearing the contamination from the occupation” in the area, Mathewson says. “During our open source data trawling, I spotted a cluster of tractor and combine harvester accidents caused by antitank mines in Makarov,” they say. “Things like videos of burning tractors or photographs of large craters, or destroyed vehicles missing wheels.” As a result of the social posts and the open source data, the group was able to deploy its teams to the area and start clearing the destruction.

Source

Wired