An agency database WIRED obtained reveals widespread use of so-called 1509 summonses that experts say raises the specter of potential abuse.

US Immigration and Customs Enforcement agents are using an obscure legal tool to demand data from elementary schools, news organizations, and abortion clinics in ways that, some experts say, may be illegal. 

While these administrative subpoenas, known as 1509 custom summonses, are meant to be used only in criminal investigations about illegal imports or unpaid customs duties, WIRED found that the agency has deployed them to seek records that seemingly have little or nothing to do with customs violations, according to legal experts and several recipients of the 1509 summonses. 

A WIRED analysis of an Immigration and Customs Enforcement (ICE) subpoena tracking database, obtained through a Freedom of Information Act request, found that agents issued custom summons more than 170,000 times from the beginning of 2016 through mid-August 2022. The primary recipients of 1509s include telecommunications companies, major tech firms, money transfer services, airlines, and even utility companies. But it’s the edge cases that have drawn the most concern among legal experts, 

The outlier cases include custom summonses that sought records from a youth soccer league in Texas; surveillance video from a major abortion provider in Illinois; student records from an elementary school in Georgia; health records from a major state university’s student health services; data from three boards of elections or election departments; and data from a Lutheran organization that provides refugees with humanitarian and housing support.

In at least two instances, agents at ICE used the custom summons to pressure news organizations to reveal information about their sources. 

All of this is done without judicial oversight. 

“This is really dangerous,” says Matthew Guariglia, a policy analyst at the Electronic Frontier Foundation, a digital rights nonprofit. He adds that the frequent and apparently widespread use of 1509 summonses creates “a situation where this agency can fully go rogue” by using this tool in investigations that fall outside the scope of the law.

Two current agents from ICE’s Homeland Security Investigations (HSI) arm cautioned against drawing conclusions about potential abuse of the summons without additional context about each investigation referenced in the database. The agents, who asked not to be named because they are unauthorized to speak to the media, argue that because the agency is responsible for enforcing hundreds of laws pertaining to customs—including the distribution of child sexual abuse material (CSAM)—it’s possible that each summons was issued for a permissible investigation under the law. 

However, a former high-level Department of Homeland Security (DHS) official, who spoke on the condition of anonymity because their current employer forbids them from speaking to the press, expressed serious concern about many of the summonses. “It seems reasonable that ICE should be able to inspect records from a company like Amazon for customs investigations,” they say. “But what possible use or authority would ICE have for subpoenaing records from an abortion clinic?”

“It's like all power,” the official adds. “If it's not controlled, it gets abused.”

Casting a Wide Net

The 1509 customs summons is an administrative subpoena explicitly and exclusively meant for use in investigations of illegal imports or unpaid customs duties under a law known as Title 19 US Code 1509. Its goal is to provide agencies like ICE with a way to obtain business records from companies without having to go to a judge for a warrant. 

The subpoena-tracking database that WIRED obtained offers the most detailed breakdown of how ICE has been using the customs summons to date. The data shows that between January 4, 2016, and August 22, 2022, ICE issued 172,679 summonses, averaging more than 70 per day. Half of these were sent to telecommunications companies like AT&T, T-Mobile, and Comcast. Big technology companies like Google, Meta, and Microsoft collectively received nearly 15,000 summonses. Of the thousands of summonses sent to social media companies, Meta and Snapchat make up the vast majority.

ICE Is Grabbing Data From Schools and Abortion Clinics

Mullvad Browser, a collaboration between the nonprofit and Mullvad VPN, offers an anti-tracking browser designed to be used with a VPN.

The easiest way to use the digital anonymity service Tor is through the Tor Browser. You download and use it like a regular browser, and it covers your digital footprints as you go, making it very difficult for anyone to track your online activity. On top of that, the Tor Browser is designed with countersurveillance measures that block trackers and stymie device fingerprinting methods. But you might not want to use the Tor Browser all the time, because it has relatively slow page load times and can be a bit cumbersome. But launching today, a new browser developed by the Tor Project's user experience and applications teams offers the same privacy focus built with different infrastructure to incorporate VPN support instead of Tor.

Known as the Mullvad Browser, the tool comes out of a collaboration between the Tor Project and the VPN maker Mullvad. The free, open source browser is available now for download. The VPN space is crowded and has some problematic players, but Mullvad has consistently been a well-regarded and trusted VPN because it's open source, doesn't monetize user data, and provides independent third-party audits of its systems and infrastructure. Nonetheless, the Mullvad Browser can be used with any VPN you trust or can be used without a VPN as simply a privacy-focused browser.

“We’re not here to compete and to win browser market share; we are here because our mission is to advance human rights with technology,” says Isabela Bagueros, executive director of the Tor Project. “So we want to provide alternatives for people who need privacy and censorship bypassing."

Photograph: Tor Project

Both the Tor Network and virtual private networks encrypt your web traffic and tunnel it through an intermediary, but Tor is focused on the anonymity that comes from a specific scheme of sending your traffic through a series of “hops” or special servers. VPNs, in contrast, don't take such great pains to anonymize your traffic and instead focus on offering privacy protections by creating a system in which only you and the VPN provider can see your web activity. As a result, VPNs have a complicated reputation, because they are only as private as the VPN provider is trustworthy. Depending on your use case and circumstances, though, they can be a valuable tool.

“Mullvad’s mission is to make mass surveillance impractical, and a VPN alone is not enough for achieving online privacy—you also need a privacy-focused web browser,” says Mullvad CEO Jan Jonsson. “We wanted to offer a privacy-focused browser as good as the Tor Browser but for those who want to connect to the internet through a VPN instead of the Tor Network. The collaboration is all about providing more privacy alternatives for people.”

The Tor Project and Mullvad both said of each other that they were attracted to the collaboration by the other's record on human rights and digital privacy initiatives. And Mullvad has been a longtime financial supporter of the Tor Project, which is a nonprofit.  

There are other well-regarded privacy browsers, like Brave, and they can also be used with a VPN or even have built-in VPN capabilities. But the Tor Project says that their years of experience pioneering antitracking techniques like cookie isolation and other anti-surveillance technologies means that Mullvad Browser is launching at a very high quality. Tor Project's Bagueros adds that, while developing Mullvad Browser, the team made some discoveries and improvements that have now been incorporated back into the Tor Browser.

“Maybe this new browser will reach an audience that we’re not reaching right now,” Bagueros says. “Multiple alternatives can coexist and support each other. We're into building alternatives in collaboration, in solidarity with other organizations, because this is a big fight. We’re going against big players, so we need to work together.”

Mullvad VPN and Tor Project Create New Privacy-Focused Mullvad Browser

Plus: A major new supply chain attack, Biden’s spyware executive order, and a hacking campaign against Exxon’s critics.

Did you hear that Donald Trump got indicted this week? Of course you did. Ridiculous question. The first-ever indictment of a former US president had been looming for weeks. And now that it's happened, the move by a Manhattan grand jury is deepening fissures in America's already-fraught political divide. But while Trump headlines flood your feeds, there were plenty of other big stories this week, none of which have anything to do with any of _that_. 

In Germany, police are cracking down on people who post adult content to websites and platforms that lack age-verification checks, like Twitter. This has resulted in fines and threats of jail time, while some performers are deleting their accounts—or fleeing the country. This is just one of the impacts of a wave of age-verification laws sweeping the global internet.

Meanwhile, in darker corners of the internet, North Korea–backed hackers are using a rare technique to launder their stolen cryptocurrencies: paying to mine clean crypto with loot taken from their victims. The tactic is meant to throw blockchain detectives off the trail of swiped funds. Speaking of ill-gotten gains, Costa Rica is still reeling from a series of ransomware attacks last spring that left swaths of the country's infrastructure devastated. As a result, the US government is sending $25 million in aid to help it recover. 

Most victims of cyberattacks don't get help from the US government, however. Fortunately for them, this week Microsoft announced its new system, Security Copilot, which integrates OpenAI's ChatGPT and home-grown artificial intelligence to help incident responders managed breaches. Of course, the best way to protect yourself from getting hacked is to make sure all your systems are fully patched and up to date.

To top it all off, this week we revealed new documents obtained through a public records request which show that Good Smile, a major toy company that creates figurines for companies like Disney, invested $2.4 million in the toxic imageboard 4chan, helping to keep the company online.

But that's not all. Each week, we dive into the stories we weren't able to report on ourselves. Click on the headlines to read the full stories. And stay safe out there.

The Russian government and military remain the most aggressive in the world when it comes to disruptive acts of cyber-sabotage against civilian infrastructure. But documents leaked by a whistleblower inside a Russian intelligence contractor seem to reveal some new and alarming pages of the Kremlin’s hybrid war playbook.

A consortium of investigative journalists at 11 news outlets including Paper Trail Media, _The Guardian_, and _The Washington Post_ obtained a leak of secret documents from a Russian cybersecurity contractor firm called Vulkan, the Russian word for _volcano_. The documents, which were also analyzed by cybersecurity firm Mandiant, reveal that Vulkan sold software tools to Russian intelligence agencies like the KGB-successor FSB and the GRU military intelligence agency, including its notorious cyberattack-focused team known as Sandworm. 

The tools include one piece of software for scanning the internet for security vulnerabilities and another that seemed designed to organize disinformation campaigns and coordinate offensive hacking operations. Perhaps most disturbing of all was a proposal for a third tool that appeared to be designed to allow hackers to train in simulated networks of infrastructure systems like railways and pipelines, with specific references to methods to sabotage those systems with catastrophic effects. But it’s not clear whether that last tool was ever built, and if so, whether it was used primarily for offensive hacking or “red team” defensive training, or whether it led to the development of any actual hacking capabilities targeting critical infrastructure.

Security experts say North Korea–linked hackers have successfully carried out a supply chain attack through compromised versions of 3CX, a video and voice communications platform used by high-profile companies including American Express and Mercedes-Benz. 3CX says it has more than 600,000 customers. The hackers were able to install malware within the Mac and Windows versions of 3CX, which were signed with the company's keys, thus allowing the Trojanized apps to go undetected. The attack is being compared to Russian hackers' SolarWinds supply chain attack, which wrought havoc around the world for months. 

As hacker-for-hire firms' tools proliferate to governments around the world, the Biden administration has made clear: The US will not be one of that industry's customers. A new executive order bans US agencies from buying access to that commercial spyware, a key step in a growing effort to curb companies like NSO Group, Cytrox, and Candiru, which have enabled surveillance and human rights abuses from Spain to Mexico to Saudi Arabia. US agencies haven't been confirmed to be past customers of any of those companies, though the FBI did at one point test NSO's Phantom spyware before ultimately walking away from a deal with the company. But the order nonetheless sets a precedent for governments worldwide, assuring that US taxpayer funds won't flow to a dangerous industry whose tools have offered intrusive hacking techniques to repressive regimes targeting activists, journalists, and human rights defenders.

While we're on the subject of dangerous hacker-for-hire firms targeting vulnerable activists: The _Wall Street Journal_ reported this week that Indian hacker-for-hire firm BellTroX targeted climate change activists campaigning against Exxon, including Greenpeace, Public Citizen, 350.org, and the Rockefeller Family Fund. The firm was hired by Israeli private detective Aviram Azari, who has since pleaded guilty to hacking conspiracy charges. Exactly who hired Azari remains unclear, and Exxon denies having any connection to Azari or the hacking campaign. The hackers successfully accessed email accounts for Greenpeace, Public Citizen, and 350.org, but it's not yet clear whether they successfully penetrated the Rockefeller Family Fund, an organization created by Rockefeller heirs that has worked to combat the oil industry's efforts to lobby against climate change solutions.

‘Vulkan’ Leak Offers a Peek at Russia’s Cyberwar Playbook

Plus: Microsoft Outlook and Android patch serious flaws, Chrome and Firefox get fixes, and much more.

Meanwhile, researchers at Google’s Project Zero have reported 18 zero-day vulnerabilities in Exynos Modems made by Samsung. The four most severe—CVE-2023-24033, CVE-2023-26496, CVE-2023-26497, and CVE-2023-26498—allow internet-to-baseband remote code execution, the researchers wrote in a blog. “Tests conducted by Project Zero confirm that the four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim’s phone number,” they wrote. 

Affected devices include those in the S22, M33, M13, M12, A71, A53, A33, A21s, A13, A12, and A04 series, as well as Google’s Pixel 6 and Pixel 7 series.

Patch timelines will vary per manufacturer, but affected Pixel devices have received a fix for all four of the severe internet-to-baseband remote code execution vulnerabilities. In the meantime, users with affected devices can protect themselves by turning off Wi-Fi calling and Voice-over-LTE (VoLTE) in their device settings, Google said.

Google Chrome 

Google has released Chrome 111 of its popular browser, fixing eight security flaws, seven of which are memory safety bugs with a high severity rating. Four use-after-free vulnerabilities include a high-severity issue tracked as CVE-2023-1528 in Passwords and CVE-2023-1529, an out-of-bounds memory access flaw in WebHID.

Meanwhile, CVE-2023-1530 is a use-after-free bug in PDF reported by the UK’s National Cyber Security Centre, and CVE-2023-1531 is a high-severity use-after-free vulnerability in ANGLE.

None of the issues are known by Google to have been used in attacks, but given their impact, it makes sense to update Chrome when you can.

Cisco

Enterprise software giant Cisco has published the twice-yearly security bundle for its IOS and IOS XE Software, fixing 10 vulnerabilities. Six of the issues fixed by Cisco are rated as having a high impact, including CVE-2023-20080, a denial of service flaw, and CVE-2023-20065, a privilege escalation bug.

At the start of the month, Cisco fixed multiple vulnerabilities in the web-based management interface of some Cisco IP Phones that could allow an unauthenticated, remote attacker to execute arbitrary code or cause denial of service. With a CVSS score of 9.8, the worst is CVE-2023-20078, a vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 series multiplatform phones. 

An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface, Cisco said, adding, “A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system of an affected device.”

Firefox

Privacy-conscious developer Mozilla has released Firefox 111, fixing 13 vulnerabilities, seven of which are rated as having a high impact. These include three flaws in Firefox for Android, including CVE-2023-25749, which may have resulted in third-party apps opening without a prompt.

Meanwhile, two memory safety bugs, CVE-2023-28176 and CVE-2023-28177, have been fixed in Firefox 111. “Some of these bugs showed evidence of memory corruption, and we presume that with enough effort some of these could have been exploited to run arbitrary code,” Mozilla said.

SAP

It’s another month of big updates for software maker SAP, which has released 19 new security notes in its March Security Patch Day guidance. Issues fixed during the month include four with a CVSS score of over 9. 

One of the worst of these is CVE-2023-25616, a code injection vulnerability in SAP Business Objects Business Intelligence Platform. This vulnerability in the Central Management Console allows an attacker to inject arbitrary code with a “strong negative impact” on the integrity, confidentiality, and availability of the system, security firm Onapsis said.

Finally, with a CVSS score of 9.9, CVE-2023-23857 is an improper access control bug in SAP NetWeaver AS for Java. “The vulnerability allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services,” Onapsis said.

Apple's iOS 16.4: Security Updates Are Better Than a Goose Emoji

A Manhattan grand jury has issued the first-ever indictment of a former US president. Buckle up for whatever happens next.

The literally unprecedented indictment against Donald Trump marks an outright dangerous—and politically fraught—moment for the United States and serves as a reminder of the unparalleled level of criminality and conspiracy that surrounded the 2016 election.

It’s easy to look back at the 2016 election as though its outcome was inevitable—that Hillary Clinton was too weak of a candidate, one whose years of high-priced speeches had made her lose touch with the working-class voters of Wisconsin and Pennsylvania; that “but her emails” and Jim Comey’s repeated, inappropriate, and misguided meddling in the election turned the tide. But the new indictment of Trump is an important historical corrective, a moment that makes clear how the US, as a country, must reckon with the fact that Trump’s surprise victory was aided by not one but _two_ separate criminal conspiracies.

In the 2016 race’s final push, in an election that came down to incredibly narrow victories in just three states—10,704 voters in Michigan, 46,765 in Pennsylvania, and 22,177 in Wisconsin—and where Trump lost the overall popular vote by some 3 million votes, he was helped along by a massive and wide-ranging official Russian government operation. That effort was funded in part by oligarch Yevgeny Prigozhin, who is now behind the brutal combat of his Wagner Group mercenary army in Ukraine, which targeted US social media companies and activists on the ground. According to the US Department of Justice’s exhaustive report, in the second arm of the Russian operation, the military intelligence service GRU hacked top Democratic officials, leaked their emails, and shifted the national narrative around Clinton and other Democrats. (Not to mention that this gave rise to the Pizzagate conspiracy theory and, arguably, QAnon.) 

Then there was the separate criminal conspiracy that was the subject of today’s new indictment in New York: the plot in the final weeks of the 2016 election by Trump’s campaign, Trump family fixer Michael Cohen, and the _National Enquirer_ to pay hush money to bury stories of two of the candidate’s affairs, including infamously one with porn star Stormy Daniels. 

While it may seem like news of such an affair would have ended up being a nothingburger amid the campaign’s final weeks, it’s worth remembering the specific context that Cohen and the Trump orbit faced in those finals hours of the campaign. They were performing a fraught and knife’s-edge balancing act to hold onto support from conservatives and evangelicals in the wake of the devastating _Access Hollywood_ tape, a moment where vice presidential nominee Mike Pence seriously considered throwing in the towel himself. The follow-on of more non-family-values-friendly stories might well have begun an unrecoverable spiral. (It’s also worth remembering the still-suspicious interplay of these two threads: how, on a single Friday in October 2016, US intelligence leaders announced publicly for the first time that Russia was behind the election meddling, the _Washington Post_ scooped the existence of the lewd _Access Hollywood_ tape. And then, hours later, Wikileaks began dumping a fresh set of stolen emails from Clinton campaign chair John Podesta.)

The new criminal case related to that second Stormy Daniels conspiracy, brought by Manhattan district attorney Alvin Bragg, also is a reminder of the historic mistake by the US Justice Department to not pursue its own charges against Trump in the same matter. This was a mind-boggling abdication of responsibility given that the Justice Department—in the midst of Donald Trump’s own presidency, no less!—prosecuted Cohen for the same conspiracy, naming Trump in the charges against Cohen as “Individual 1” and, according to a new book by Elie Honig, outlined in a draft indictment Trump’s personal direction and involvement in the case.

According to the book by Honig, himself a former prosecutor, the Southern District of New York ultimately decided to drop any case against Trump after the president left office in January 2021 because, in part, they figured that bigger, more serious investigations were ahead stemming from the January 6 insurrection, which “made the campaign finance violations seem somehow trivial and outdated by comparison.” It was then, and stands now, a serious miscalculation, one that will currently contribute to the democratically untenable “Ford Principle” that presidents stand outside the law both while in office and after. 

Of course, it’s here that we come to what a fraught moment, politically and for American democracy, the historically novel indictment of a former president presents for us in the weeks and months ahead: The true test for Donald Trump and our country is not this particular case but whatever might come next. The New York charges might be the start of multiple criminal cases that would burden Trump even as he begins his phoenix-like presidential reelection bid.

There are signs that Georgia’s Fulton County district attorney is weighing “imminent” charges against Trump, potentially as part of a larger conspiracy, for his well-documented efforts to overturn the state’s election results in 2020. Meanwhile, Justice Department special counsel Jack Smith is zeroing in on potential charges surrounding Trump’s involvement in the January 6 insurrection and related election-meddling schemes, as well as Trump’s attempts to purloin and retain classified documents in Mar-a-Lago after his presidency. Just in recent days, in the classified documents case, a federal judge ruled that there was evidence of a crime that would allow Smith to pierce normal attorney-client privilege and force one of Trump’s lawyers to testify amid evidence that the lawyer participated in that potential crime.

The specter of these indictments has made Trump fire up his always-overheated rhetoric, threatening “death and destruction” if he’s indicted, posting a photo of Bragg and Trump holding a baseball bat, and generally sashaying around the country like a mafioso saying, “Nice country you have here, shame if something happened to it.” His opening campaign rally was in Waco, Texas, amid the 30th anniversary of a 51-day federal siege of a religious cult after the largest shoot-out in US law enforcement history. That standoff left four ATF agents dead and, following the horrific fiery end of the siege, more than 80 members of the Branch Davidian sect dead too. The event helped inspire the bombing of the Alfred P. Murrah Federal Building in Oklahoma City just two years later by a white supremacist, far-right extremist. 

It’s hard not to read Trump’s rally as anything less than a call to arms for his supporters amid the government’s moves against him.

For now, though, the country will wait—and wonder whether the next shoe to drop is more criminal charges or the beginnings of more Trump-inspired violence.

Trump’s Indictment Marks a Historic Reckoning

An increasing number of states are passing age-verification laws. It’s not clear how they’ll work.

For the past three months, anyone who lives in Louisiana and opens up Pornhub has been met with a new prompt. The state’s laws, it says, require people who want to watch pornography to prove they are over 18. People seeking to access Pornhub are directed to a government-linked site where they can provide their ID. The move is the result of new laws designed to stop children from seeing explicit content. But it is just the beginning—the online age-verification industry is heating up.

Since January, three other states across the US—Mississippi, Virginia, and Utah—have copied Louisiana’s approach, passing their own versions of age-verification laws. Another 11 states, from Virginia to California, have proposed laws that will require users to confirm their age before they can view pornography, according to recent analysis. Some of these regulations are slated to take effect in the coming months.

It’s not just a US phenomenon either. Across the Western world, efforts are underway to introduce more age checks online. Since 2020, regulators in Germany and France have pushed porn sites to check people’s ages, and the UK and Australia are developing their own laws. These follow the introduction of more stringent safety rules that protect children online. 

The internet isn’t a child-friendly place. However, introducing age verification across the web is technical and complex. (In 2019, the UK ditched a multiyear plan to introduce age checks after encountering myriad problems). The porn we watch is also highly sensitive—kinks are incredibly personal, and leaks of data online can be devastating. Privacy advocates, porn companies, and some regulators say the move to introduce age verification introduces significant problems.

“The concerns about young people accessing adult websites are real and widespread; less widespread is the understanding of limitations of various age-verification tools, and of the new dangers they might pose,” says Irina Raicu, director of the Internet Ethics Program at Santa Clara University’s Markkula Center. “Many regulators and others seem to think of age verification as a solved problem; technologists and privacy activists, including activists focused on protecting children, are trying to explain that’s not the case.”

For years, the only thing stopping people from accessing porn online has been small checkboxes: Are you over 18? Yes or No? However, legislation proposed around the world would add more robust checks. Dozens of online age-verification companies have cropped up, with multiple ways to prove you’re old enough to access sites.

Your age can be confirmed by credit card details, scans of your face, or, as is often proposed, checks of government ID documents, such as passports or driver’s licenses. The checks can be carried out by third-party companies, without sensitive information being passed directly to porn sites. One briefing from the European Commission details nine different methods of age verification—some sophisticated, some very low tech.

“A lot of stuff is being passed,” says Mike Stabile, director of public affairs at the adult industry trade body the Free Speech Coalition. “In terms of the actual implementation and how it’s going to work—that’s much more mysterious.” The porn industry isn’t against age-checking everyone who visits its websites, Stabile says, but some laws are vague and don’t say how age verification should be implemented or whether all companies would be required to introduce the technology.

Take Louisiana. The state law requires websites with 33 percent or more adult content to check visitors’ ages when they access the sites from within that state. Stabile says some porn sites have introduced age checks, while “most have just blocked the state.” In both France and Germany, regulators have asked the biggest pornography websites to implement age verification in recent years and taken them to court when they haven’t done so. Germany has tried to block porn site xHamster and is now taking individual porn creators to court when they post adult content on sites that don’t have age verification, like Twitter.

“While there are multiple proposed laws on age verification throughout the world, we are not aware of any, thus far, that achieve their aim of protecting children from age-inappropriate material online,” says a spokesperson for MindGeek, the owner of Pornhub and other giant adult sites YouPorn and Redtube. They say that within Louisiana, MindGeek is one of a “small handful” following the laws and claim it has “pushed traffic to adult platforms with far fewer safety measures in place.”

“In order to achieve tangible outcomes and safeguard the interests of young people, it is imperative to regulate not just individual websites but the industry as a whole,” says Alex Hawkins, vice president of porn website xHamster. “Ensuring global standards uniformity is of vital importance, as applying varying regulations to each country or state would prove extremely difficult to implement and maintain.”

While lawmakers and regulators are pushing for age verification, that doesn’t mean people will use it. For widespread adoption, people wiould have to trust the systems. “Mandating that users must hand over more sensitive information about themselves than they previously did is fundamentally anti-private,” says Daly Barnett, a staff technologist at the Electronic Frontier Foundation. “Even if these systems were to work flawlessly and their security were perfect—which is never a safe assumption to make—it still goes against the basic privacy needs of the everyday internet user.”

Some regulators agree. France’s data regulator, CNIL, which is regarded as one of the most effective in Europe, has looked at the privacy of current age-verification systems and found them lacking. In July 2022, CNIL reviewed existing age verification measures and said they are “circumventable and intrusive.” 

Instead, it is trialing a system in which a third party, such as a bank or energy supplier, authenticates a person’s identity and age. (This is not dissimilar to some efforts from third-party companies themselves.) Using cryptographic concepts, the system creates a digital signature that says someone is over 18, and this is then shared with the porn website. French officials said they plan to introduce a government app that allows this to work.

Simone van der Hof is a professor of law and digital technologies at Leiden University in the Netherlands and has studied age-verification systems under Europe’s GDPR and found that they do not meet data rules. Van der Hof says all an age-verification system needs to do is say whether you are over 18. It doesn’t need all the details on your passport. Van der Hof points to a system in the Netherlands that works similarly to the one CNIL suggested and communicates whether you’re old enough to access a site.

“You then have an app on your phone that allows you to retrieve attributes from a trusted party,” van der Hof says. “You can then decide which attributes you share with which party (or which yes or no verification questions you answer with it).” Although, van der Hof points out, this still requires trusted third parties that can prove your identity. “Ideally, you would want to have a system where you can choose from a menu of age-verification providers like you can choose a bank when making an online payment,” van der Hof says.

But many people may not want their bank to confirm to a porn site that they’re over 18, even if it isn’t sharing personal information and is just providing approval—or they may not have the patience to go through that process when they’re in the mood to access adult content. And even if age-checking systems can be successfully introduced, finding ways around them isn’t necessarily difficult. Reddit, Twitter, and other social media sites are often not included in laws mandating age verification on porn sites, despite porn being readily available on them. VPNs and the anonymity service Tor can help people get around one state or country’s specific rules. Research from the University of Munich has found that while young people regularly access porn, they are also very aware of VPNs and know how to use them.

Whatever tech issues the porn industry encounters, the rest of the internet usually follows. As governments around the world look to improve safety online, ID walls are popping up elsewhere. The UK’s controversial online safety bill may require social media companies to verify people’s ages, and France’s age-verification measures also sweep up social media. Google can require age verification to use YouTube and its other services. In Japan, people are required to provide documents showing they are old enough to use Tinder. Instagram is using age estimation based on video selfies, the word of your friends, and ID documents. On the internet, nobody knows you’re a dog—but your age is about to become another story.

Porn ID Laws: Your State or Country May Soon Require Age Verification

The White House is providing $25 million to Costa Rica, after giving Albania similar aid following aggression by hackers linked to Iran.

Last spring, the Costa Rican government suffered a series of ransomware attacks that hobbled critical systems around the country. As imports and exports, health care, and other public services were disrupted, Costa Rican president Rodrigo Chaves Robles declared a state of emergency, and the recovery has been a months-long ordeal. Almost a year after the crisis began, a senior White House official told reporters today that the United States plans to provide $25 million in cybersecurity assistance to help Costa Rica strengthen its digital infrastructure. 

The grant will include funding to establish a security operations center within Costa Rica's Ministry of Science, Innovation, Technology, and Communications. This will expand the country's ability to systematically improve its critical infrastructure defenses, detect intrusions, and coordinate incident response across the government. The funding will also include cybersecurity training as well as secure equipment, including hardware and licenses for software. 

The senior Biden administration official, who spoke to reporters on the condition that they not me named, is in Costa Rica to meet with Chaves about the aid, which will come from the US State Department. Costa Rica is cohosting the State Department's 2023 Summit for Democracy this week. 

The official also told reporters that in February the US government provided a similar $25 million grant to Albania in the wake of a destructive attack on that country’s government last summer that has been attributed to Iranian hackers. 

“At the time \[of the ransomware attacks\], we immediately deployed a team of US experts to assist in Costa Rica's recovery and have been working closely with the country since then—and have recognized that this further stability, this further assistance is needed," the US official told reporters.

The official said that the Biden administration has been choosing cybersecurity funding recipients “based on the significance of the attacks that occurred.” Iran's cyberattack on Albania was noteworthy for its targeting of a NATO member. Meanwhile, Chaves and other members of the Costa Rican government have suggested that the attacks on their networks, which were perpetrated by notorious Russia-based cybercriminal gangs, may have been in response to Costa Rica’s outspoken support of Ukraine.

The attacks on Costa Rica were led by the prolific, now disbanded, cybercriminal gang Conti and its affiliates. The group demanded a $20 million ransom and uploaded hundreds of gigabytes of data stolen in the attacks to its dark-web site. And the group was explicit about its destructive intentions. “We are determined to overthrow the government by means of a cyberattack,” it wrote in a post addressed to Costa Rica and “US terrorists (Biden and his administration).” At the time of the attacks, the US State Department offered rewards totaling $15 million for information about Conti that leads to an arrest.

In recent years, as digital threats have escalated, the US has been focused on launching initiatives to bring the global community together against ransomware and other cybercrime.

“In the current context, we recognize that supporting our allies’ and partners’ security is important,” the senior official said today, citing collaboration with European allies, Russian cyberattacks, and “broader competition with China” as the general geopolitical backdrop for the move.

The US Is Sending Money to Countries Devastated by Cyberattacks

Documents obtained by WIRED confirm that Good Smile, which licenses toy production for Disney, was an investor in the controversial image board.

Toxic image board 4chan has managed to stay online for the past seven years—amid boycotts and advertiser flight, after being implicated in several mass shootings, even as it was identified as a source of the conspiracy theories that inspired the January 6 insurrection—thanks, in part, to a $2.4 million investment from a major Japanese toy company.

A partnership agreement, obtained exclusively by WIRED, shows not only how current site owner Hiroyuki Nishimura acquired the far-right message board but also how Japanese industry helped finance the deal.

The text of the deal shows that Nishimura invested $800,000 of his own money, plus $4.8 million from his company—using cash from a major Japanese telecommunications company. But the most surprising part of the deal came from Good Smile Company, which acquired a 30 percent share in 4chan for its $2.4 million investment.

This contract was filed by 4chan to investigators with the New York Attorney General’s office, as part of that agency’s now-closed investigation into the May 2022 mass shooting in Buffalo, New York. WIRED obtained the documents through a Freedom of Information Act request.

These documents for the first time confirm the opaque corporate partnership that has run 4chan since its 2015 acquisition, just as scrutiny increases on the money behind the long-running website.

That scrutiny may be weakening the resolve to keep 4chan going. According to Nishimura, Good Smile is in the process of ending its partnership with 4chan—this comes as the company’s lucrative deal with The Walt Disney Company is set to be terminated.

The investigation was opened by request from Governor Kathy Hochul, who asked her attorney general to probe whether 4chan could face civil or criminal liability for "promoting, facilitating, or providing a platform to plan and promote violence." While the New York Attorney General’s office has declined to pursue criminal charges against the website and its owners, a spokesperson told WIRED that at least one other law enforcement agency is still investigating the website. 

The New York attorney general is also calling for new legal tools to stop 4chan from promoting domestic terror attacks. Understanding the website’s corporate structure will be necessary to hold them to any US law.

Good Smile, Bad Times

For years, Good Smile has been effective at hiding its role at 4chan. While the company may not be a household name in the United States, its Nendoroid collectable figurines are a big deal for anime enthusiasts. According to the company’s website, it had nearly 4 billion yen ($27 million) in sales in 2021, mostly driven by those small figurines.

Good Smile produces licensed content for a variety of major brands, from major manga series like _Attack on Titan_ to video games like _Assassin’s Creed_ and movies like _The Matrix_. But Good Smile’s largest licensor is, without a doubt, Disney. The company markets dozens of toys and figurines from Disney properties, like Spider-Man, Buzz Lightyear, and Mickey Mouse.

In recent years, Good Smile has branched out into content creation, working with various animation and film studios, has opened online wholesale companies in China and elsewhere, and has even sponsored a Super GT racing team.

In 2021, former employees of Good Smile’s Los Angeles office—embroiled in a legal dispute about the future of their employment—countersued the company. In legal filings, they allege Good Smile was responsible for the distribution of potentially obscene sexually explicit anime products and merchandise ("lolicon") and that it, unbeknownst to its family-friendly corporate partners, was funding 4chan.

The accusations were picked up in The Ankler and _The Hollywood Reporter_, which cited a Good Smile representative admitting a passive investment in 4chan. The lawsuit was settled out of court, and the allegations were never proven.

Last year, WIRED obtained documents detailing a nondisclosure agreement involving Nishimura, Good Smile, and Tokyo-based telecommunications firm Dwango. The three parties, the document said, were in talks to acquire 4chan. In December, _The New York Times_ confirmed that Nishimura purchased 4chan with funding from three unnamed Japanese partners.

When asked about Good Smile’s involvement in 4chan last December in an interview with publisher Shueisha, Nishimura confirmed the relationship. He and Good Smile’s president, Takanori Aki, had met at an anime convention and become friends, Nishimura said. “However, Good Smile Company is in the process of leaving.”

Good Smile did not respond to WIRED’s request for comment.

As details of Good Smile’s contribution to 4chan have emerged, some of its partners have become anxious. A Disney spokesperson declined to comment about Good Smile on the record. However, a source at the Disney Company, who asked not to be named because they are not authorized to speak about internal business decisions, confirmed that they have a licensing arrangement with Good Smile that expires in May. Disney, the source said, had been unaware of Good Smile’s relationship with 4chan. After being alerted to those ties by WIRED, they said, Disney has opted not to renew its deal with Good Smile. 

From Future Search Brazil to 4chan’s Future

As Good Smile’s involvement in 4chan has become clearer, more questions have swirled about Nishimura’s other partner.

Nishimura founded the image board 2channel in 1999 and quickly cemented himself as a cult figure in Japanese culture. Even before he inspired Chris Poole, 4chan’s founder, to start the English-language knockoff, Nishimura had given millions of Japanese—particularly young men—the freedom to speak anonymously, candidly, and bluntly. That, in turn, generated an ironic, anime-obsessed subculture that traded in a particular brand of hard-right, anti-feminist, anti-Korean, and “identitarian” politics.

That disruptive talent made Nishimura an attractive figure in Japan’s otherwise conservative media culture. In the early 2000s, Nishimura forged a partnership with another young entrepreneur who had risen to become chair of telecommunications firm Dwango: Nobuo Kawakami.

Kawakami and Dwango had set up a Japanese rival to YouTube and were trying to figure out how to grow it beyond just a platform to upload videos ripped from their American competitor. So they brought on Nishimura to apply 2channel’s charm to their new platform, Niconico.

Nishimura’s own company, Future Search Brazil, joined forces with Dwango—journalist Yoshiaki Sei reported that Nishimura took a 20 percent stake in Niconico. And in a matter of years, Niconico became the biggest video streaming platform in Japan.

Niconico had one particular feature that, at least at the time, made it unique: Viewers could comment, in real time, via a text overlay on the stream.

“With Niconico, you could participate and comment and keep up with the TV show by having conversations with your fellow viewers,” says Liz Rodwell, an assistant professor of digital media at Rice University and author of the upcoming book _Push the Button: Interactive Television and Collaborative Journalism in Japan_. When Rodwell grew interested in the platform, around 2011, it had become a significant force in Japanese media.

Nishimura was the ideal figurehead for such an operation, she says. “He was, by himself, a good figure to have associated with anything internet-related, because he represented a kind of fantasy of freedom, success, nerd heroism.” Through Niconico, Nishimura gave users this powerful anonymity right at a time when trust in the state was falling.

“This was like right after the Fukushima disaster, and there was a lot of activism happening around Niconico,” Rodwell says. “Because people felt like the mainstream media was not being transparent or honest. There wasn't enough public safety information being disseminated. People were unclear whether food from that part of Japan was safe and whether it was in their grocery stores.”

Niconico had, like 2channel, transferred power to the masses in a rather unprecedented way. But with that came 2channel’s notoriously toxic culture.

Around 2011, Rodwell began interning for the Free Press Association, a journalism organization that leased office space from Dwango and used Niconico to stream press conferences. “It was responsible really for the Free Press Association going down,” Rodwell says.

The anonymous commenters on Niconico and 2channel “really mobilized and ganged up on” the FPA’s founder, she says. “They were constantly sort of bombarding the livestreams for the press conferences … I struggled to find screen captures for my book that didn't involve anything racist or sexist.”

The promise and peril of Niconico seemed to be exactly what Nishimura wanted. A perverse synergy had cropped up between Niconico and 2channel: One would drive traffic and engagement toward the other, then back again. 

This emergence of identitarian troll culture dovetailed with a rise of the Japanese right. The right-wing Liberal Democratic Party made particular use of Niconico to reach Nishimura’s angry and disenchanted userbase.

At the height of Niconico’s success, Dwango and Nishimura began contemplating a North American conquest. Dwango was keen to expand internationally and saw Nishimura’s libertarian experiment in broadcasting as a way to do that. Dwango dispatched Nishimura to explore how to make Niconico an American success story. It was, according to Nishimura, during this period that he first met Aki, Good Smile’s CEO.

Those plans fell apart when Nishimura and Future Search Brazil were raided by Tokyo police in 2012. Investigators alleged that Nishimura had aided and abetted the drug trade by failing to police drug transactions on 2channel. Prosecutors did not pursue the case, but it cast a pall around Nishimura in a way that 2channel’s content had not.

Kawakami “was afraid that Nishimura could be arrested by the police,” says Sei, author of the upcoming book _The World of 2 Channel_. Sei recently interviewed Kawakami. “So he dismissed Nishimura as a director.” The two, however, remained friends, he says.

In November 2014, according to Sei’s reporting, Dwango bought out Nishimura’s stake in Niconico for an undisclosed amount. In January 2015, Poole announced his retirement from 4chan. By July, Nishimura was in talks to buy the website. In those conversations was Good Smile and, despite its corporate divorce with Future Search Brazil, Dwango. The three parties signed a nondisclosure agreement to cover those discussions.

Kawakami, Sei says, “wanted the opportunity, through the 4chan business, to make inroads into the US and world markets. He had a special interest in this business.” Those discussions, according to Kawakami, went on to a “very late stage.” 

Ultimately, Dwango’s involvement fell through because Kawakami “was afraid of taking the legal risk,” Sei says. Nevertheless, Dwango’s money almost certainly found its way into 4chan. “It's very obvious that Future Such Brazil received a very large amount of money \[from Dwango\], and then those funds were used to buy 4chan,” Sei says.

Nishimura did not respond to WIRED’s request for comment, and we were unable to reach Kawakami.

After the divorce from Dwango, Future Search Brazil tried to expand its media presence, including a short-lived attempt to launch a Japanese version of the entertainment news publication _Variety_ in September 2015, the same month the 4chan deal was announced.

Eiichiro Fukami, president of Future Search Brazil subsidiary Tokyo Sangyo Shimbun, signed the 4chan partnership agreement. He confirmed to WIRED that he “was an executive officer of a related company” in the 4chan deal but declined to answer further questions, citing professional ethics.

Holding 4chan Accountable

While 4chan’s growing infamy was apparent in 2015, its penchant for extremism has become increasingly clear in the years that followed.

It birthed QAnon, grew the incel movement, and was cited by multiple mass shooters around the world as a direct source of inspiration. Its users generated a dizzying amount of disinformation around the 2020 presidential election, deployed swattings to go after their detractors, and produced an enormous amount of far-right, racist, anti-Semitic, misogynistic, and queerphobic memes. 4chan users consider the site an American political kingmaker, and it has helped corrode the political culture of Canada, Australia, and Europe.

While it has been suggested that Nishimura is working to boost the right-wing Liberal Democratic Party in Japan, it’s more difficult to ascribe any kind of American political ambition to 4chan's owner. Apart from his posts on 4chan, which tend to be administrative, he rarely even comments in English. According to documents filed to the New York investigators, Nishimura actually lives in Paris.

The fact that 4chan became both more hateful and more prominent after 2015 is a feature, not a bug, says Mitsuwo, a former 2channel user and moderator of the rival 5channel: It was all business. “I personally think that Nishimura and his moderators intentionally encouraged hate speech on 2channel in order to heighten the influence of the site,” Mitsuwo says.

Nishimura has escaped this kind of scrutiny for years, even as other major platforms have been put under the microscope. Jim Watkins—who, through his hosting company, effectively stole 2channel from Nishimura before becoming administrator of 8chan—has been hauled before Congress to testify about his site’s role in inspiring mass shootings. There have been rounds of hearings and investigations into the role that Facebook, Google, and Twitter play in political extremism, misinformation, and censorship. The US Congress’ January 6 committee had also requested similar documents from 4chan.

New York attorney general Letitia James launched her investigation after a mass shooting targeted a grocery store in a predominantly Black neighborhood of Buffalo. The alleged shooter, according to investigators, uploaded a white supremacist, neo-Nazi manifesto to 4chan and posted a link to a Twitch livestream of the deadly assault. After the attack, the video was reposted multiple times to the platform.

“I was not born racist nor grew up to be racist,” the alleged shooter’s manifesto reads. “I simply became racist after I learned the truth.” He credits 4chan as the source of that truth.

Late last year, Nishimura was asked about 4chan’s role in inspiring the attack. The site owner brushed aside the connection, suggesting that 4chan’s promotion of violent white supremacist ideology was no different than former president Donald Trump’s rhetoric.

James has called for new laws to hold platforms like 4chan accountable for hosting videos of mass shootings and murder. In a report published in October, James recommended “imposing civil liability for the distribution and transmission of this content, including making liable online platforms that fail to take reasonable steps to prevent unlawful violent criminal content from appearing on the platform.”

New York isn’t alone. The European Union’s Digital Services Act aims to fine sites that host anti-Semitism, in addition to other types of hate. Given 4chan’s rampant hate speech, it’s a move that could hit them particularly hard. But any action against 4chan requires, or is at least enormously helped by, knowing who actually owns and runs the site. Now that 4chan’s ownership and funding is in the public record, the temperature may start to increase on Nishimura.

“I think Mr. Kawakami’s description of Mr. Nishimura is fair and quite accurate,” Sei says. “Kawakami described Nishimura as a child who tears the legs off from a bug. And that he enjoys that.”

How Good Smile, a Major Toy Company, Kept 4chan Online

The new tool aims to deliver the network insights and coordination that “AI” security systems have long promised.

For years now, “artificial intelligence” has been a hot buzzword in the cybersecurity industry, promising tools that spot suspicious behavior on a network, quickly figure out what's going on, and guide incident response if there's an intrusion. The most credible and useful of services, though, have actually been machine learning algorithms trained to spot characteristics of malware and other dubious network activity. Now, as generative AI tools proliferate, Microsoft says it has finally built a service for defenders that's worthy of all the hype.

Two weeks ago, the company launched Microsoft 365 Copilot, which builds on a partnership with OpenAI along with Microsoft's own work on large language models. The company is now rolling out Security Copilot, a sort of security field notebook that integrates system data and network monitoring from security tools like Microsoft Sentinel and Defender and even third-party services. 

Security Copilot can surface alerts, map out in both words and charts what may be going on within a network, and provide steps for a potential investigation. As a human user works with Copilot to map out a possible security incident, the platform tracks history and generates summaries, so if colleagues get added to the project, they can quickly come up to speed and see what's been done so far. The system will also automatically produce slides and other presentation tools about an investigation to help security teams communicate the facts of a situation to people outside their department, and particularly executives who may not have security experience but need to stay informed.   

“Over the past few years, what we’ve seen is this absolute escalation in the frequency of attacks, in the sophistication of attacks, as well as in the intensity of attacks,” says Vasu Jakkal, Microsoft’s chief vice president of security. “And there is not a lot of time for a defender to contain the escalation of an attack. The balance is right now shifted in the direction of attackers.” 

Courtesy of Microsoft

Jakkal says that while machine learning security tools have been effective in specific domains, like monitoring email or activity on individual devices—known as endpoint security—Security Copilot brings all of those separate streams together and extrapolates a bigger picture. “With Security Copilot you can catch what others may have missed because it forms that connective tissue,” she says.

Security Copilot is largely powered by OpenAI's ChatGPT-4, but Microsoft emphasizes that it also integrates a proprietary Microsoft security-specific model. The system tracks everything that's done during an investigation. The resulting record can be audited, and the materials it produces for distribution can all be edited for accuracy and clarity. If something Copilot is suggesting during an investigation is wrong or irrelevant, users can click the “Off Target” button to further train the system.

The platform offers access controls so certain colleagues can be shared on particular projects and not others, which is especially important for investigating possible insider threats. And Security Copilot allows for a sort of backstop for 24/7 monitoring. That way, even if someone with a specific skillset isn't working on a given shift or a given day, the system can offer basic analysis and suggestions to help plug gaps. For example, if a team wants to quickly analyze a script or software binary that may be malicious, Security Copilot can start that work and contextualize how the software has been behaving and what its goals may be.

Microsoft emphasizes that customer data is not shared with others and is “not used to train or enrich foundation AI models.” Microsoft does pride itself, though, on using “65 trillion daily signals” from its massive customer base around the world to inform its threat detection and defense products. But Jakkal and her colleague, Chang Kawaguchi, Microsoft's vice president and AI security architect, emphasize that Security Copilot is subject to the same data-sharing restrictions and regulations as any of the security products it integrates with. So if you already use Microsoft Sentinel or Defender, Security Copilot must comply with the privacy policies of those services.

Kawaguchi says that Security Copilot has been built to be as flexible and open-ended as possible, and that customer reactions will inform future feature additions and improvements. The system's usefulness will ultimately come down to how insightful and accurate it can be about each customer’s network and the threats they face. But Kawaguchi says that the most important thing is for defenders to start benefiting from generative AI as quickly as possible.

As he puts it: “We need to equip defenders with AI given that attackers are going to use it regardless of what we do.”

Microsoft's ‘Security Copilot’ Sics ChatGPT on Security Breaches

A spy group working for the Kim regime has been feeding stolen coins into crypto mining services in an effort to throw tracers off their trail.

In the cryptocurrency ecosystem, coins have a story, tracked in the unchangeable blockchains underpinning their economy. The only exception, in some sense, is cryptocurrency that's been freshly generated by its owner's computational power. So it figures that North Korean hackers have begun adopting a new trick to launder the coins they steal from victims around the world: pay their dirty, stolen coins into services that allow them to mine innocent new ones.

Today, cybersecurity firm Mandiant published a report on a prolific North Korean state-sponsored hacking group it's now calling APT43, sometimes known by the names Kimsuky and Thallium. The group, whose activities suggest its members work in the service of North Korea's Reconnaissance General Bureau spy agency, has been primarily focused on espionage, hacking think tanks, academics, and private industry from the US to Europe, South Korea, and Japan since at least 2018, mostly with phishing campaigns designed to harvest credentials from victims and plant malware on their machines.

Like many North Korean hacker groups, APT43 also maintains a sideline in profit-focused cybercrime, according to Mandiant, stealing any cryptocurrency that can enrich the North Korean regime or even just fund the hackers' own operations. And as regulators worldwide have tightened their grip on exchanges and laundering services that thieves and hackers use to cash out criminally tainted coins, APT43 appears to be trying out a new method to cash out the funds it steals while preventing them from being seized or frozen: It pays that stolen cryptocurrency into “hashing services” that allow anyone to rent time on computers used to mine cryptocurrency, harvesting newly mined coins that have no apparent ties to criminal activity.

That mining trick allows APT43 to take advantage of the fact that cryptocurrency is relatively easy to steal while avoiding the forensic trail of evidence that it leaves on blockchains, which can make it difficult for thieves to cash out. “It breaks the chain,” says Joe Dobson, a Mandiant threat intelligence analyst. “This is like a bank robber stealing silver from a bank vault and then going to a gold miner and paying the miner in stolen silver. Everyone's looking for the silver while the bank robber's walking around with fresh, newly mined gold.”

Mandiant says it first began seeing signs of APT43's mining-based laundry technique in August of 2022. It's since seen tens of thousands of dollars worth of crypto flow into hashing services—services like NiceHash and Hashing24, which allow anyone to buy and sell computing power to calculate the mathematical strings known as “hashes” that are necessary to mine most cryptocurrencies—from what it believes are APT43 crypto wallets. Mandiant says it has also seen similar amounts flow to APT43 wallets from mining “pools,” services that allow miners to contribute their hashing resources to a group that pays out a share of any cryptocurrency the group collectively mines. (Mandiant declined to name either the hashing services or the mining pools that APT43 participated in.)

In theory, the payouts from those pools should be clean, with no ties to APT43's hackers—that seems, after all, to be the point of the group's laundering exercise. But in some cases of operational sloppiness, Mandiant says it found that the funds were nonetheless commingled with crypto in wallets it had previously identified from its years-long tracking of APT43 hacking campaigns.

The five-figure sums Mandiant saw laundered through this mining process, the company's analysts concede, are nowhere near the size of the massive crypto heists North Korean hackers have pulled off in recent years, stealing hundreds of millions of dollars in cases like the breaches of the Harmony Bridge or Ronin Bridge services. That may be because only a small fraction of North Korea's mining-based laundering has been detected.

But it may also be because APT43 isn't primarily tasked with stealing cryptocurrency, says Mandiant analyst Michael Barnhart. Instead, the group appears to have been ordered to generate enough profits through cybercrime to fund its espionage work. As a result, it has sought to steal smaller sums of crypto from a broad number of victims, he says, with the goal of subsisting independently. “They're not going for a cash grab,” says Barnhart. “They're trying just to make ends meet.”

Cryptocurrency tracing firms, including Chainalysis and Elliptic, say they've seen criminal actors seek freshly mined cryptocurrency to fund their activities or dilute and obfuscate their profits. Elliptic says, for instance, that it's seen a group affiliated with the militant organization Hamas mine cryptocurrency as a means of what it describes as terrorist financing. But Arda Akartuna, a threat analyst at Elliptic, says paying dirty cryptocurrency into a hashing service to mine clean crypto is a particularly troubling phenomenon.

Akartuna points out that mining pools are not as regulated and scrutinized as other crypto players that are sometimes used for money laundering, such as cryptocurrency exchanges, “mixing” services designed to obfuscate the trail of users' coins, and NFT marketplaces. “But they probably should be,” he says.

“It's quite concerning that a lot of mining pools don't actually screen who participates in them,” says Akartuna. “So you could potentially have illicit actors that are contributing computing power to the mining pools, and those mining pools don't have the tools to identify them.”

That suggests government authorities seeking money launderers and criminal financiers may have to shift some of their focus away from the intermediaries of the crypto economy toward the miners that serve as the original wellspring. Not all of that fresh digital cash is quite as innocent as it might seem.

_Update 2 pm ET, March 28, 2023: Clarified the views of Eliptic's Arda Akartuna regarding APT23's crypto-laundering tactics._

Source

Wired