An increasing number of states are passing age-verification laws. It’s not clear how they’ll work.

For the past three months, anyone who lives in Louisiana and opens up Pornhub has been met with a new prompt. The state’s laws, it says, require people who want to watch pornography to prove they are over 18. People seeking to access Pornhub are directed to a government-linked site where they can provide their ID. The move is the result of new laws designed to stop children from seeing explicit content. But it is just the beginning—the online age-verification industry is heating up.

Since January, three other states across the US—Mississippi, Virginia, and Utah—have copied Louisiana’s approach, passing their own versions of age-verification laws. Another 11 states, from Virginia to California, have proposed laws that will require users to confirm their age before they can view pornography, according to recent analysis. Some of these regulations are slated to take effect in the coming months.

It’s not just a US phenomenon either. Across the Western world, efforts are underway to introduce more age checks online. Since 2020, regulators in Germany and France have pushed porn sites to check people’s ages, and the UK and Australia are developing their own laws. These follow the introduction of more stringent safety rules that protect children online. 

The internet isn’t a child-friendly place. However, introducing age verification across the web is technical and complex. (In 2019, the UK ditched a multiyear plan to introduce age checks after encountering myriad problems). The porn we watch is also highly sensitive—kinks are incredibly personal, and leaks of data online can be devastating. Privacy advocates, porn companies, and some regulators say the move to introduce age verification introduces significant problems.

“The concerns about young people accessing adult websites are real and widespread; less widespread is the understanding of limitations of various age-verification tools, and of the new dangers they might pose,” says Irina Raicu, director of the Internet Ethics Program at Santa Clara University’s Markkula Center. “Many regulators and others seem to think of age verification as a solved problem; technologists and privacy activists, including activists focused on protecting children, are trying to explain that’s not the case.”

For years, the only thing stopping people from accessing porn online has been small checkboxes: Are you over 18? Yes or No? However, legislation proposed around the world would add more robust checks. Dozens of online age-verification companies have cropped up, with multiple ways to prove you’re old enough to access sites.

Your age can be confirmed by credit card details, scans of your face, or, as is often proposed, checks of government ID documents, such as passports or driver’s licenses. The checks can be carried out by third-party companies, without sensitive information being passed directly to porn sites. One briefing from the European Commission details nine different methods of age verification—some sophisticated, some very low tech.

“A lot of stuff is being passed,” says Mike Stabile, director of public affairs at the adult industry trade body the Free Speech Coalition. “In terms of the actual implementation and how it’s going to work—that’s much more mysterious.” The porn industry isn’t against age-checking everyone who visits its websites, Stabile says, but some laws are vague and don’t say how age verification should be implemented or whether all companies would be required to introduce the technology.

Take Louisiana. The state law requires websites with 33 percent or more adult content to check visitors’ ages when they access the sites from within that state. Stabile says some porn sites have introduced age checks, while “most have just blocked the state.” In both France and Germany, regulators have asked the biggest pornography websites to implement age verification in recent years and taken them to court when they haven’t done so. Germany has tried to block porn site xHamster and is now taking individual porn creators to court when they post adult content on sites that don’t have age verification, like Twitter.

“While there are multiple proposed laws on age verification throughout the world, we are not aware of any, thus far, that achieve their aim of protecting children from age-inappropriate material online,” says a spokesperson for MindGeek, the owner of Pornhub and other giant adult sites YouPorn and Redtube. They say that within Louisiana, MindGeek is one of a “small handful” following the laws and claim it has “pushed traffic to adult platforms with far fewer safety measures in place.”

“In order to achieve tangible outcomes and safeguard the interests of young people, it is imperative to regulate not just individual websites but the industry as a whole,” says Alex Hawkins, vice president of porn website xHamster. “Ensuring global standards uniformity is of vital importance, as applying varying regulations to each country or state would prove extremely difficult to implement and maintain.”

While lawmakers and regulators are pushing for age verification, that doesn’t mean people will use it. For widespread adoption, people wiould have to trust the systems. “Mandating that users must hand over more sensitive information about themselves than they previously did is fundamentally anti-private,” says Daly Barnett, a staff technologist at the Electronic Frontier Foundation. “Even if these systems were to work flawlessly and their security were perfect—which is never a safe assumption to make—it still goes against the basic privacy needs of the everyday internet user.”

Some regulators agree. France’s data regulator, CNIL, which is regarded as one of the most effective in Europe, has looked at the privacy of current age-verification systems and found them lacking. In July 2022, CNIL reviewed existing age verification measures and said they are “circumventable and intrusive.” 

Instead, it is trialing a system in which a third party, such as a bank or energy supplier, authenticates a person’s identity and age. (This is not dissimilar to some efforts from third-party companies themselves.) Using cryptographic concepts, the system creates a digital signature that says someone is over 18, and this is then shared with the porn website. French officials said they plan to introduce a government app that allows this to work.

Simone van der Hof is a professor of law and digital technologies at Leiden University in the Netherlands and has studied age-verification systems under Europe’s GDPR and found that they do not meet data rules. Van der Hof says all an age-verification system needs to do is say whether you are over 18. It doesn’t need all the details on your passport. Van der Hof points to a system in the Netherlands that works similarly to the one CNIL suggested and communicates whether you’re old enough to access a site.

“You then have an app on your phone that allows you to retrieve attributes from a trusted party,” van der Hof says. “You can then decide which attributes you share with which party (or which yes or no verification questions you answer with it).” Although, van der Hof points out, this still requires trusted third parties that can prove your identity. “Ideally, you would want to have a system where you can choose from a menu of age-verification providers like you can choose a bank when making an online payment,” van der Hof says.

But many people may not want their bank to confirm to a porn site that they’re over 18, even if it isn’t sharing personal information and is just providing approval—or they may not have the patience to go through that process when they’re in the mood to access adult content. And even if age-checking systems can be successfully introduced, finding ways around them isn’t necessarily difficult. Reddit, Twitter, and other social media sites are often not included in laws mandating age verification on porn sites, despite porn being readily available on them. VPNs and the anonymity service Tor can help people get around one state or country’s specific rules. Research from the University of Munich has found that while young people regularly access porn, they are also very aware of VPNs and know how to use them.

Whatever tech issues the porn industry encounters, the rest of the internet usually follows. As governments around the world look to improve safety online, ID walls are popping up elsewhere. The UK’s controversial online safety bill may require social media companies to verify people’s ages, and France’s age-verification measures also sweep up social media. Google can require age verification to use YouTube and its other services. In Japan, people are required to provide documents showing they are old enough to use Tinder. Instagram is using age estimation based on video selfies, the word of your friends, and ID documents. On the internet, nobody knows you’re a dog—but your age is about to become another story.

Porn ID Laws: Your State or Country May Soon Require Age Verification

The White House is providing $25 million to Costa Rica, after giving Albania similar aid following aggression by hackers linked to Iran.

Last spring, the Costa Rican government suffered a series of ransomware attacks that hobbled critical systems around the country. As imports and exports, health care, and other public services were disrupted, Costa Rican president Rodrigo Chaves Robles declared a state of emergency, and the recovery has been a months-long ordeal. Almost a year after the crisis began, a senior White House official told reporters today that the United States plans to provide $25 million in cybersecurity assistance to help Costa Rica strengthen its digital infrastructure. 

The grant will include funding to establish a security operations center within Costa Rica's Ministry of Science, Innovation, Technology, and Communications. This will expand the country's ability to systematically improve its critical infrastructure defenses, detect intrusions, and coordinate incident response across the government. The funding will also include cybersecurity training as well as secure equipment, including hardware and licenses for software. 

The senior Biden administration official, who spoke to reporters on the condition that they not me named, is in Costa Rica to meet with Chaves about the aid, which will come from the US State Department. Costa Rica is cohosting the State Department's 2023 Summit for Democracy this week. 

The official also told reporters that in February the US government provided a similar $25 million grant to Albania in the wake of a destructive attack on that country’s government last summer that has been attributed to Iranian hackers. 

“At the time \[of the ransomware attacks\], we immediately deployed a team of US experts to assist in Costa Rica's recovery and have been working closely with the country since then—and have recognized that this further stability, this further assistance is needed," the US official told reporters.

The official said that the Biden administration has been choosing cybersecurity funding recipients “based on the significance of the attacks that occurred.” Iran's cyberattack on Albania was noteworthy for its targeting of a NATO member. Meanwhile, Chaves and other members of the Costa Rican government have suggested that the attacks on their networks, which were perpetrated by notorious Russia-based cybercriminal gangs, may have been in response to Costa Rica’s outspoken support of Ukraine.

The attacks on Costa Rica were led by the prolific, now disbanded, cybercriminal gang Conti and its affiliates. The group demanded a $20 million ransom and uploaded hundreds of gigabytes of data stolen in the attacks to its dark-web site. And the group was explicit about its destructive intentions. “We are determined to overthrow the government by means of a cyberattack,” it wrote in a post addressed to Costa Rica and “US terrorists (Biden and his administration).” At the time of the attacks, the US State Department offered rewards totaling $15 million for information about Conti that leads to an arrest.

In recent years, as digital threats have escalated, the US has been focused on launching initiatives to bring the global community together against ransomware and other cybercrime.

“In the current context, we recognize that supporting our allies’ and partners’ security is important,” the senior official said today, citing collaboration with European allies, Russian cyberattacks, and “broader competition with China” as the general geopolitical backdrop for the move.

The US Is Sending Money to Countries Devastated by Cyberattacks

Documents obtained by WIRED confirm that Good Smile, which licenses toy production for Disney, was an investor in the controversial image board.

Toxic image board 4chan has managed to stay online for the past seven years—amid boycotts and advertiser flight, after being implicated in several mass shootings, even as it was identified as a source of the conspiracy theories that inspired the January 6 insurrection—thanks, in part, to a $2.4 million investment from a major Japanese toy company.

A partnership agreement, obtained exclusively by WIRED, shows not only how current site owner Hiroyuki Nishimura acquired the far-right message board but also how Japanese industry helped finance the deal.

The text of the deal shows that Nishimura invested $800,000 of his own money, plus $4.8 million from his company—using cash from a major Japanese telecommunications company. But the most surprising part of the deal came from Good Smile Company, which acquired a 30 percent share in 4chan for its $2.4 million investment.

This contract was filed by 4chan to investigators with the New York Attorney General’s office, as part of that agency’s now-closed investigation into the May 2022 mass shooting in Buffalo, New York. WIRED obtained the documents through a Freedom of Information Act request.

These documents for the first time confirm the opaque corporate partnership that has run 4chan since its 2015 acquisition, just as scrutiny increases on the money behind the long-running website.

That scrutiny may be weakening the resolve to keep 4chan going. According to Nishimura, Good Smile is in the process of ending its partnership with 4chan—this comes as the company’s lucrative deal with The Walt Disney Company is set to be terminated.

The investigation was opened by request from Governor Kathy Hochul, who asked her attorney general to probe whether 4chan could face civil or criminal liability for "promoting, facilitating, or providing a platform to plan and promote violence." While the New York Attorney General’s office has declined to pursue criminal charges against the website and its owners, a spokesperson told WIRED that at least one other law enforcement agency is still investigating the website. 

The New York attorney general is also calling for new legal tools to stop 4chan from promoting domestic terror attacks. Understanding the website’s corporate structure will be necessary to hold them to any US law.

Good Smile, Bad Times

For years, Good Smile has been effective at hiding its role at 4chan. While the company may not be a household name in the United States, its Nendoroid collectable figurines are a big deal for anime enthusiasts. According to the company’s website, it had nearly 4 billion yen ($27 million) in sales in 2021, mostly driven by those small figurines.

Good Smile produces licensed content for a variety of major brands, from major manga series like _Attack on Titan_ to video games like _Assassin’s Creed_ and movies like _The Matrix_. But Good Smile’s largest licensor is, without a doubt, Disney. The company markets dozens of toys and figurines from Disney properties, like Spider-Man, Buzz Lightyear, and Mickey Mouse.

In recent years, Good Smile has branched out into content creation, working with various animation and film studios, has opened online wholesale companies in China and elsewhere, and has even sponsored a Super GT racing team.

In 2021, former employees of Good Smile’s Los Angeles office—embroiled in a legal dispute about the future of their employment—countersued the company. In legal filings, they allege Good Smile was responsible for the distribution of potentially obscene sexually explicit anime products and merchandise ("lolicon") and that it, unbeknownst to its family-friendly corporate partners, was funding 4chan.

The accusations were picked up in The Ankler and _The Hollywood Reporter_, which cited a Good Smile representative admitting a passive investment in 4chan. The lawsuit was settled out of court, and the allegations were never proven.

Last year, WIRED obtained documents detailing a nondisclosure agreement involving Nishimura, Good Smile, and Tokyo-based telecommunications firm Dwango. The three parties, the document said, were in talks to acquire 4chan. In December, _The New York Times_ confirmed that Nishimura purchased 4chan with funding from three unnamed Japanese partners.

When asked about Good Smile’s involvement in 4chan last December in an interview with publisher Shueisha, Nishimura confirmed the relationship. He and Good Smile’s president, Takanori Aki, had met at an anime convention and become friends, Nishimura said. “However, Good Smile Company is in the process of leaving.”

Good Smile did not respond to WIRED’s request for comment.

As details of Good Smile’s contribution to 4chan have emerged, some of its partners have become anxious. A Disney spokesperson declined to comment about Good Smile on the record. However, a source at the Disney Company, who asked not to be named because they are not authorized to speak about internal business decisions, confirmed that they have a licensing arrangement with Good Smile that expires in May. Disney, the source said, had been unaware of Good Smile’s relationship with 4chan. After being alerted to those ties by WIRED, they said, Disney has opted not to renew its deal with Good Smile. 

From Future Search Brazil to 4chan’s Future

As Good Smile’s involvement in 4chan has become clearer, more questions have swirled about Nishimura’s other partner.

Nishimura founded the image board 2channel in 1999 and quickly cemented himself as a cult figure in Japanese culture. Even before he inspired Chris Poole, 4chan’s founder, to start the English-language knockoff, Nishimura had given millions of Japanese—particularly young men—the freedom to speak anonymously, candidly, and bluntly. That, in turn, generated an ironic, anime-obsessed subculture that traded in a particular brand of hard-right, anti-feminist, anti-Korean, and “identitarian” politics.

That disruptive talent made Nishimura an attractive figure in Japan’s otherwise conservative media culture. In the early 2000s, Nishimura forged a partnership with another young entrepreneur who had risen to become chair of telecommunications firm Dwango: Nobuo Kawakami.

Kawakami and Dwango had set up a Japanese rival to YouTube and were trying to figure out how to grow it beyond just a platform to upload videos ripped from their American competitor. So they brought on Nishimura to apply 2channel’s charm to their new platform, Niconico.

Nishimura’s own company, Future Search Brazil, joined forces with Dwango—journalist Yoshiaki Sei reported that Nishimura took a 20 percent stake in Niconico. And in a matter of years, Niconico became the biggest video streaming platform in Japan.

Niconico had one particular feature that, at least at the time, made it unique: Viewers could comment, in real time, via a text overlay on the stream.

“With Niconico, you could participate and comment and keep up with the TV show by having conversations with your fellow viewers,” says Liz Rodwell, an assistant professor of digital media at Rice University and author of the upcoming book _Push the Button: Interactive Television and Collaborative Journalism in Japan_. When Rodwell grew interested in the platform, around 2011, it had become a significant force in Japanese media.

Nishimura was the ideal figurehead for such an operation, she says. “He was, by himself, a good figure to have associated with anything internet-related, because he represented a kind of fantasy of freedom, success, nerd heroism.” Through Niconico, Nishimura gave users this powerful anonymity right at a time when trust in the state was falling.

“This was like right after the Fukushima disaster, and there was a lot of activism happening around Niconico,” Rodwell says. “Because people felt like the mainstream media was not being transparent or honest. There wasn't enough public safety information being disseminated. People were unclear whether food from that part of Japan was safe and whether it was in their grocery stores.”

Niconico had, like 2channel, transferred power to the masses in a rather unprecedented way. But with that came 2channel’s notoriously toxic culture.

Around 2011, Rodwell began interning for the Free Press Association, a journalism organization that leased office space from Dwango and used Niconico to stream press conferences. “It was responsible really for the Free Press Association going down,” Rodwell says.

The anonymous commenters on Niconico and 2channel “really mobilized and ganged up on” the FPA’s founder, she says. “They were constantly sort of bombarding the livestreams for the press conferences … I struggled to find screen captures for my book that didn't involve anything racist or sexist.”

The promise and peril of Niconico seemed to be exactly what Nishimura wanted. A perverse synergy had cropped up between Niconico and 2channel: One would drive traffic and engagement toward the other, then back again. 

This emergence of identitarian troll culture dovetailed with a rise of the Japanese right. The right-wing Liberal Democratic Party made particular use of Niconico to reach Nishimura’s angry and disenchanted userbase.

At the height of Niconico’s success, Dwango and Nishimura began contemplating a North American conquest. Dwango was keen to expand internationally and saw Nishimura’s libertarian experiment in broadcasting as a way to do that. Dwango dispatched Nishimura to explore how to make Niconico an American success story. It was, according to Nishimura, during this period that he first met Aki, Good Smile’s CEO.

Those plans fell apart when Nishimura and Future Search Brazil were raided by Tokyo police in 2012. Investigators alleged that Nishimura had aided and abetted the drug trade by failing to police drug transactions on 2channel. Prosecutors did not pursue the case, but it cast a pall around Nishimura in a way that 2channel’s content had not.

Kawakami “was afraid that Nishimura could be arrested by the police,” says Sei, author of the upcoming book _The World of 2 Channel_. Sei recently interviewed Kawakami. “So he dismissed Nishimura as a director.” The two, however, remained friends, he says.

In November 2014, according to Sei’s reporting, Dwango bought out Nishimura’s stake in Niconico for an undisclosed amount. In January 2015, Poole announced his retirement from 4chan. By July, Nishimura was in talks to buy the website. In those conversations was Good Smile and, despite its corporate divorce with Future Search Brazil, Dwango. The three parties signed a nondisclosure agreement to cover those discussions.

Kawakami, Sei says, “wanted the opportunity, through the 4chan business, to make inroads into the US and world markets. He had a special interest in this business.” Those discussions, according to Kawakami, went on to a “very late stage.” 

Ultimately, Dwango’s involvement fell through because Kawakami “was afraid of taking the legal risk,” Sei says. Nevertheless, Dwango’s money almost certainly found its way into 4chan. “It's very obvious that Future Such Brazil received a very large amount of money \[from Dwango\], and then those funds were used to buy 4chan,” Sei says.

Nishimura did not respond to WIRED’s request for comment, and we were unable to reach Kawakami.

After the divorce from Dwango, Future Search Brazil tried to expand its media presence, including a short-lived attempt to launch a Japanese version of the entertainment news publication _Variety_ in September 2015, the same month the 4chan deal was announced.

Eiichiro Fukami, president of Future Search Brazil subsidiary Tokyo Sangyo Shimbun, signed the 4chan partnership agreement. He confirmed to WIRED that he “was an executive officer of a related company” in the 4chan deal but declined to answer further questions, citing professional ethics.

Holding 4chan Accountable

While 4chan’s growing infamy was apparent in 2015, its penchant for extremism has become increasingly clear in the years that followed.

It birthed QAnon, grew the incel movement, and was cited by multiple mass shooters around the world as a direct source of inspiration. Its users generated a dizzying amount of disinformation around the 2020 presidential election, deployed swattings to go after their detractors, and produced an enormous amount of far-right, racist, anti-Semitic, misogynistic, and queerphobic memes. 4chan users consider the site an American political kingmaker, and it has helped corrode the political culture of Canada, Australia, and Europe.

While it has been suggested that Nishimura is working to boost the right-wing Liberal Democratic Party in Japan, it’s more difficult to ascribe any kind of American political ambition to 4chan's owner. Apart from his posts on 4chan, which tend to be administrative, he rarely even comments in English. According to documents filed to the New York investigators, Nishimura actually lives in Paris.

The fact that 4chan became both more hateful and more prominent after 2015 is a feature, not a bug, says Mitsuwo, a former 2channel user and moderator of the rival 5channel: It was all business. “I personally think that Nishimura and his moderators intentionally encouraged hate speech on 2channel in order to heighten the influence of the site,” Mitsuwo says.

Nishimura has escaped this kind of scrutiny for years, even as other major platforms have been put under the microscope. Jim Watkins—who, through his hosting company, effectively stole 2channel from Nishimura before becoming administrator of 8chan—has been hauled before Congress to testify about his site’s role in inspiring mass shootings. There have been rounds of hearings and investigations into the role that Facebook, Google, and Twitter play in political extremism, misinformation, and censorship. The US Congress’ January 6 committee had also requested similar documents from 4chan.

New York attorney general Letitia James launched her investigation after a mass shooting targeted a grocery store in a predominantly Black neighborhood of Buffalo. The alleged shooter, according to investigators, uploaded a white supremacist, neo-Nazi manifesto to 4chan and posted a link to a Twitch livestream of the deadly assault. After the attack, the video was reposted multiple times to the platform.

“I was not born racist nor grew up to be racist,” the alleged shooter’s manifesto reads. “I simply became racist after I learned the truth.” He credits 4chan as the source of that truth.

Late last year, Nishimura was asked about 4chan’s role in inspiring the attack. The site owner brushed aside the connection, suggesting that 4chan’s promotion of violent white supremacist ideology was no different than former president Donald Trump’s rhetoric.

James has called for new laws to hold platforms like 4chan accountable for hosting videos of mass shootings and murder. In a report published in October, James recommended “imposing civil liability for the distribution and transmission of this content, including making liable online platforms that fail to take reasonable steps to prevent unlawful violent criminal content from appearing on the platform.”

New York isn’t alone. The European Union’s Digital Services Act aims to fine sites that host anti-Semitism, in addition to other types of hate. Given 4chan’s rampant hate speech, it’s a move that could hit them particularly hard. But any action against 4chan requires, or is at least enormously helped by, knowing who actually owns and runs the site. Now that 4chan’s ownership and funding is in the public record, the temperature may start to increase on Nishimura.

“I think Mr. Kawakami’s description of Mr. Nishimura is fair and quite accurate,” Sei says. “Kawakami described Nishimura as a child who tears the legs off from a bug. And that he enjoys that.”

How Good Smile, a Major Toy Company, Kept 4chan Online

The new tool aims to deliver the network insights and coordination that “AI” security systems have long promised.

For years now, “artificial intelligence” has been a hot buzzword in the cybersecurity industry, promising tools that spot suspicious behavior on a network, quickly figure out what's going on, and guide incident response if there's an intrusion. The most credible and useful of services, though, have actually been machine learning algorithms trained to spot characteristics of malware and other dubious network activity. Now, as generative AI tools proliferate, Microsoft says it has finally built a service for defenders that's worthy of all the hype.

Two weeks ago, the company launched Microsoft 365 Copilot, which builds on a partnership with OpenAI along with Microsoft's own work on large language models. The company is now rolling out Security Copilot, a sort of security field notebook that integrates system data and network monitoring from security tools like Microsoft Sentinel and Defender and even third-party services. 

Security Copilot can surface alerts, map out in both words and charts what may be going on within a network, and provide steps for a potential investigation. As a human user works with Copilot to map out a possible security incident, the platform tracks history and generates summaries, so if colleagues get added to the project, they can quickly come up to speed and see what's been done so far. The system will also automatically produce slides and other presentation tools about an investigation to help security teams communicate the facts of a situation to people outside their department, and particularly executives who may not have security experience but need to stay informed.   

“Over the past few years, what we’ve seen is this absolute escalation in the frequency of attacks, in the sophistication of attacks, as well as in the intensity of attacks,” says Vasu Jakkal, Microsoft’s chief vice president of security. “And there is not a lot of time for a defender to contain the escalation of an attack. The balance is right now shifted in the direction of attackers.” 

Courtesy of Microsoft

Jakkal says that while machine learning security tools have been effective in specific domains, like monitoring email or activity on individual devices—known as endpoint security—Security Copilot brings all of those separate streams together and extrapolates a bigger picture. “With Security Copilot you can catch what others may have missed because it forms that connective tissue,” she says.

Security Copilot is largely powered by OpenAI's ChatGPT-4, but Microsoft emphasizes that it also integrates a proprietary Microsoft security-specific model. The system tracks everything that's done during an investigation. The resulting record can be audited, and the materials it produces for distribution can all be edited for accuracy and clarity. If something Copilot is suggesting during an investigation is wrong or irrelevant, users can click the “Off Target” button to further train the system.

The platform offers access controls so certain colleagues can be shared on particular projects and not others, which is especially important for investigating possible insider threats. And Security Copilot allows for a sort of backstop for 24/7 monitoring. That way, even if someone with a specific skillset isn't working on a given shift or a given day, the system can offer basic analysis and suggestions to help plug gaps. For example, if a team wants to quickly analyze a script or software binary that may be malicious, Security Copilot can start that work and contextualize how the software has been behaving and what its goals may be.

Microsoft emphasizes that customer data is not shared with others and is “not used to train or enrich foundation AI models.” Microsoft does pride itself, though, on using “65 trillion daily signals” from its massive customer base around the world to inform its threat detection and defense products. But Jakkal and her colleague, Chang Kawaguchi, Microsoft's vice president and AI security architect, emphasize that Security Copilot is subject to the same data-sharing restrictions and regulations as any of the security products it integrates with. So if you already use Microsoft Sentinel or Defender, Security Copilot must comply with the privacy policies of those services.

Kawaguchi says that Security Copilot has been built to be as flexible and open-ended as possible, and that customer reactions will inform future feature additions and improvements. The system's usefulness will ultimately come down to how insightful and accurate it can be about each customer’s network and the threats they face. But Kawaguchi says that the most important thing is for defenders to start benefiting from generative AI as quickly as possible.

As he puts it: “We need to equip defenders with AI given that attackers are going to use it regardless of what we do.”

Microsoft's ‘Security Copilot’ Sics ChatGPT on Security Breaches

A spy group working for the Kim regime has been feeding stolen coins into crypto mining services in an effort to throw tracers off their trail.

In the cryptocurrency ecosystem, coins have a story, tracked in the unchangeable blockchains underpinning their economy. The only exception, in some sense, is cryptocurrency that's been freshly generated by its owner's computational power. So it figures that North Korean hackers have begun adopting a new trick to launder the coins they steal from victims around the world: pay their dirty, stolen coins into services that allow them to mine innocent new ones.

Today, cybersecurity firm Mandiant published a report on a prolific North Korean state-sponsored hacking group it's now calling APT43, sometimes known by the names Kimsuky and Thallium. The group, whose activities suggest its members work in the service of North Korea's Reconnaissance General Bureau spy agency, has been primarily focused on espionage, hacking think tanks, academics, and private industry from the US to Europe, South Korea, and Japan since at least 2018, mostly with phishing campaigns designed to harvest credentials from victims and plant malware on their machines.

Like many North Korean hacker groups, APT43 also maintains a sideline in profit-focused cybercrime, according to Mandiant, stealing any cryptocurrency that can enrich the North Korean regime or even just fund the hackers' own operations. And as regulators worldwide have tightened their grip on exchanges and laundering services that thieves and hackers use to cash out criminally tainted coins, APT43 appears to be trying out a new method to cash out the funds it steals while preventing them from being seized or frozen: It pays that stolen cryptocurrency into “hashing services” that allow anyone to rent time on computers used to mine cryptocurrency, harvesting newly mined coins that have no apparent ties to criminal activity.

That mining trick allows APT43 to take advantage of the fact that cryptocurrency is relatively easy to steal while avoiding the forensic trail of evidence that it leaves on blockchains, which can make it difficult for thieves to cash out. “It breaks the chain,” says Joe Dobson, a Mandiant threat intelligence analyst. “This is like a bank robber stealing silver from a bank vault and then going to a gold miner and paying the miner in stolen silver. Everyone's looking for the silver while the bank robber's walking around with fresh, newly mined gold.”

Mandiant says it first began seeing signs of APT43's mining-based laundry technique in August of 2022. It's since seen tens of thousands of dollars worth of crypto flow into hashing services—services like NiceHash and Hashing24, which allow anyone to buy and sell computing power to calculate the mathematical strings known as “hashes” that are necessary to mine most cryptocurrencies—from what it believes are APT43 crypto wallets. Mandiant says it has also seen similar amounts flow to APT43 wallets from mining “pools,” services that allow miners to contribute their hashing resources to a group that pays out a share of any cryptocurrency the group collectively mines. (Mandiant declined to name either the hashing services or the mining pools that APT43 participated in.)

In theory, the payouts from those pools should be clean, with no ties to APT43's hackers—that seems, after all, to be the point of the group's laundering exercise. But in some cases of operational sloppiness, Mandiant says it found that the funds were nonetheless commingled with crypto in wallets it had previously identified from its years-long tracking of APT43 hacking campaigns.

The five-figure sums Mandiant saw laundered through this mining process, the company's analysts concede, are nowhere near the size of the massive crypto heists North Korean hackers have pulled off in recent years, stealing hundreds of millions of dollars in cases like the breaches of the Harmony Bridge or Ronin Bridge services. That may be because only a small fraction of North Korea's mining-based laundering has been detected.

But it may also be because APT43 isn't primarily tasked with stealing cryptocurrency, says Mandiant analyst Michael Barnhart. Instead, the group appears to have been ordered to generate enough profits through cybercrime to fund its espionage work. As a result, it has sought to steal smaller sums of crypto from a broad number of victims, he says, with the goal of subsisting independently. “They're not going for a cash grab,” says Barnhart. “They're trying just to make ends meet.”

Cryptocurrency tracing firms, including Chainalysis and Elliptic, say they've seen criminal actors seek freshly mined cryptocurrency to fund their activities or dilute and obfuscate their profits. Elliptic says, for instance, that it's seen a group affiliated with the militant organization Hamas mine cryptocurrency as a means of what it describes as terrorist financing. But Arda Akartuna, a threat analyst at Elliptic, says paying dirty cryptocurrency into a hashing service to mine clean crypto is a particularly troubling phenomenon.

Akartuna points out that mining pools are not as regulated and scrutinized as other crypto players that are sometimes used for money laundering, such as cryptocurrency exchanges, “mixing” services designed to obfuscate the trail of users' coins, and NFT marketplaces. “But they probably should be,” he says.

“It's quite concerning that a lot of mining pools don't actually screen who participates in them,” says Akartuna. “So you could potentially have illicit actors that are contributing computing power to the mining pools, and those mining pools don't have the tools to identify them.”

That suggests government authorities seeking money launderers and criminal financiers may have to shift some of their focus away from the intermediaries of the crypto economy toward the miners that serve as the original wellspring. Not all of that fresh digital cash is quite as innocent as it might seem.

_Update 2 pm ET, March 28, 2023: Clarified the views of Eliptic's Arda Akartuna regarding APT23's crypto-laundering tactics._

North Korea Is Now Mining Crypto to Launder Its Stolen Loot

Regulators are using an AI system to scan websites and messaging apps to find pornography. Creators face fines and potential prison sentences.

Paulita Paupel, who runs the European branch of the adult industry trade body the Free Speech Coalition, says the crackdowns are having worrying impacts on people and their ability to share content online. “People are fleeing the country,” Paupel says. “Most major content creators have already changed their residence to other European countries, mostly Austria, Switzerland, and Cyprus.” Others have changed their marketing strategies to avoid Twitter (impacting how much money they can make), and people new to the industry may be discouraged from starting a career, Paupel says. “This is mostly affecting LGBTQI+ and BIPOC creators.”

The internet is, of course, awash with porn—from Reddit, Snapchat, and Twitter to OnlyFans, PornHub, and xVideos—with millions of people around the world involved in the industry. Globally, it is big business, generating billions of dollars every year. While there are crackdowns on pornography all around the world, Germany appears to have a particularly strong brand of enforcement in the Western world, despite being one of the highest consumers of pornography.

“Germany has been the most aggressive about suppressing speech,” says Mike Stabile, a spokesperson for the US-based Free Speech Coalition. “I think that Germany has been the most aggressive in this in its pursuit, both in terms of the scope of its laws, and then also the enforcement.” 

AI Surveillance

Since 2019, Germany’s media regulators have been developing and then using an AI system to detect online content that may run foul of the country’s laws. The artificial intelligence system, called KIVI, was developed by the North Rhine-Westphalia media authority, along with a Berlin-based private company, and is now being used by all the media authorities around Germany. 

KIVI is touted as being able to scan public posts on seven social media and messaging apps—including Twitter, YouTube, TikTok, Telegram, and VK (Russia’s version of Facebook)—as well as websites on the open internet. Meta’s Facebook and Instagram, which forbid nudity, are currently not being scanned. According to North Rhine-Westphalia’s description of the tool, it can check 10,000 pages per day. Shortly after the authority started using KIVI, it said the authority’s detections “skyrocketed.”

The spokesperson for the North Rhine-Westphalia media authority says that since 2021 the authority has detected almost 5,000 “violations.” The system searches for problematic content by looking for predetermined German keywords and links, and the authority says it uses a combination of image recognition and text recognition to detect “positive” results.

Ella Jakubowska, a senior policy adviser at the civil rights nonprofit European Digital Rights (EDRi), says people’s human rights are put at risk when Big Tech companies or governments handle content moderation. “But the idea of state entities controlling what we do and do not see online seems in itself very concerning,” Jakubowska says. 

KIVI looks for multiple types of content, including political extremism and Holocaust denial, violence, and pornography. However, porn “violations” top the list, with 1,944 incidents being flagged in the past two years, according to figures shared by the North Rhine-Westphalia media authority. The spokesperson says the system flags potential violations of laws and then human investigators examine the results and decide whether any action should be taken. “KIVI protects employees from being suddenly and unexpectedly exposed to stressful content,” Plass from the Berlin authority says.

They Posted Porn on Twitter. German Authorities Called the Cops

The GOP-fueled far right differs from similar movements around the globe, thanks to the country’s politics, electoral system, and changing demographics.

The US Republican Party has become increasingly authoritarian and extreme in recent years, and it doesn’t seem likely to moderate that in the foreseeable future. Despite performing poorly in the 2022 midterms after running many candidates the public saw as too extreme, the GOP has decided to elevate and empower far-right lawmakers like representatives Marjorie Taylor Greene and Matt Gaetz. 

In Florida, books have been removed from school shelves as governor Ron DeSantis tries to reshape the public education system in his own image. Republican lawmakers around the US have passed abortion bans that put pregnant women’s lives in danger. The rights of transgender people are under attack throughout the country. 

Nearly half of Republicans say they would prefer “strong, unelected leaders” over “weak elected ones,” according to a September Axios-Ipsos poll, and around 55 percent of Republicans say defending the “traditional” way of life by force may soon become necessary. About 61 percent of Republicans don’t believe the results of the 2020 presidential election. 

Finding examples of extremism, a lust for authoritarian leaders, and general antidemocratic beliefs in America is not difficult these days—just spend a few minutes online. The question is how far down the rabbit hole the United States has gone and where it may end up in the not-too-distant future. 

“To call a party democratic—committed to democracy—they’ve got to do three basic things: They have to unambiguously accept election results, they have to unambiguously renounce violence, and they have to consistently and unambiguously break with extremists or antidemocratic forces,” says Steve Levitsky, a professor of government at Harvard University. “I think the Republican Party now fails these three basic tests.”

Levitsky says far too many Republican leaders have flirted with using violence to achieve their political goals and spread lies about the most recent presidential election. He says politicians like DeSantis appear to be experimenting with an authoritarian way of governing in their own states that could be applied at the national level should they successfully run for president. 

It’s difficult to find an apt comparison between the Republican Party and authoritarian movements that have risen elsewhere for a variety of reasons. One, Levitsky says, is that Donald Trump took over a party that has existed for nearly 170 years and made it more authoritarian. Historically, authoritarians tend to start their own parties. Another is that a relatively small percentage of the populace was able to wield such great power under Trump.

“There’s a minority of the population that’s pretty reactionary and, by a bunch of measures, fairly authoritarian in really all Western democracies,” Levitsky says. “The question is, how are they channeled into politics? What’s exceptional about the United States is that 25 percent or so was actually able to wield national power. Is MAGA comparable to far-right parties in Europe? Yeah. With the exception of maybe Golden Dawn in Greece, though, probably more openly authoritarian.”

Authoritarian movements of the past share characteristics with what we’re seeing in the US today—from Turkey and Hungary more recently to the rise of fascism in the 1920s—but the US governmental system and political parties present particular hurdles and windows of opportunity. 

Assuming democracy remains intact in the years to come, Levitsky thinks the GOP will have to eventually moderate its stance in response to changing demographics. The current extremism will not be sustainable if the party hopes to win enough elections to wield power in the future. However, Levitsky thinks any adjustments could take longer than one would hope.

“The problem is our incentives—the Electoral College, the Supreme Court, the fact that sparsely populated territories are dramatically overrepresented in our electoral system—allows the Republicans to wield a lot of power without winning national majorities,” Levitsky says. “If the Republican Party actually had to win over 50 percent of the national vote to control the Senate, to control the presidency, to control the Supreme Court, you would not see them behaving the way they’re behaving. They would never win.”

It remains to be seen whether Trump will be the Republican nominee in the 2024 presidential election, but there’s clear evidence that the effects of his actions wouldn’t simply disappear if he wasn’t controlling the party. A lot of Americans have been radicalized since he first took office, and it’s not easy to roll that back.

“I think the consensus is that democracy is not in the clear, and that’s because the rhetoric and actions of the GOP have emboldened their supporters to sort of accept certain behaviors that we wouldn’t have thought were in line with democracy,” says Erica Frantz, an associate professor of political science at Michigan State University. “Suddenly it’s OK to question if our elections are free and fair. Suddenly it’s OK to be provocative and suggest you might use violence if the election doesn’t go your way.”

Frantz says large sectors of the US population accept the authoritarian messaging Trump spearheaded, and that is likely going to have lasting effects. She says the fact that Trump was successfully removed from office despite his attempts to overturn the election in 2020 is a big deal, but there’s still a lot of work to be done to protect American democracy.

“I don’t think we’re going to backslide to dictatorship. The probability is higher than before Trump, but it’s still low compared to many other countries,” Frantz says. “It is very possible that we’ll muddle along for quite some time in this situation where undemocratic norms are being spouted and perpetuated by one of our main parties.”

In terms of what supporters of democracy can do in the face of an authoritarian movement, there’s no silver bullet—but there are ways to push back. Levitsky says it’s important to form large coalitions to “isolate and defeat” authoritarians, which means uniting democracy supporters on the left and the right. 

A. James McAdams, a professor of international affairs at the University of Notre Dame, says those who oppose authoritarianism need a strong message that will appeal to people who might be pulled in by authoritarian leaders. 

“If you look back historically, one of the big problems in democracies has always been that the forces of reason can’t figure out what they stand for,” McAdams says. “We’re at a point in history today in the United States and Europe where moderate parties aren’t sure what to say.”

You also need to support and strengthen democratic institutions like the courts, McAdams says. He says this is particularly important because weak courts are often part of the reason authoritarians are able to take power and chip away at democracy, such as in Latin America in the 1970s. 

“If you do have stable democratic institutions—particularly viable courts—then there’s a lot of bullshit that you can overcome,” McAdams says. “Perhaps the greatest victory for American institutions in the Trump age was that the courts weren’t overpowered.”

The Uniquely American Future of US Authoritarianism

Any mention of crypto was deliberately veiled at this year’s festival. And that strategy might catch on.

In 2022, I attended my first SXSW, and I couldn’t escape the suffocating atmosphere of crypto evangelism. A convention that touts itself as the nexus of art and technology, it seemed fertile ground for the seemingly growing NFT community. This year? I could barely find a mention of crypto. And the few who did bring it up seemed embarrassed to do so.

That strategy of non-acknowledgment might just be the future of crypto.

For the uninitiated, SXSW is an event that takes over nearly the whole city of Austin. There’s the main convention center, panels at different hotels, and concerts at the biggest stadiums. But almost every bar, club, and venue also has some tie-in party or concert. And those that don’t host official SXSW events hold unofficial ones to at least catch some of the hype.

All of that is to say, if you want to set up shop during SXSW, you can probably find a place to do so. This is what made it so bizarre that I was able to go most of the week with scarcely a hint of words like crypto, blockchain, or NFT.

In 2022, crypto blew the doors off the entire city. An outdoor venue with giant domes housed bombastic raves celebrating some little-known bunny NFTs called Flufs. (Incidentally, I attended the event last year, and the 3D images of crudely rendered rotting rabbits still occasionally haunt me.)

Blockchain Creative Labs—a division of Fox Entertainment—was a key sponsor of SXSW 2022. In 2023, BCL was nowhere to be found. Last year, there were dozens of panels advocating crypto’s benefits. This year, the word “crypto” only appears a dozen times in the SXSW event schedule. (Both “AI” and “metaverse” clocked at least 30 mentions.) Four of those were showings of a documentary about (among other things) “WallStreetBets and crypto fanatics,” and one was a panel with prominent crypto skeptic Molly White.

The minimal crypto presence at SXSW isn’t terribly surprising. Despite claims to the contrary, NFTs don’t actually work the way a lot of their advocates say they do. Many artists have rejected NFTs entirely and find them to be an external headache, rather than a useful business tool.

It’s not the first time tech has promised to revolutionize an industry only to fundamentally misunderstand the field it’s entering. (Just ask Stadia how easy it is to build a gaming platform.) But what’s notable is that crypto didn’t abandon SXSW entirely. 

Instead, it simply came in disguise.

On the expo floor, I saw a few companies that were still proud to admit they used crypto tech to insert a financial layer into an otherwise existing product. I saw a blockchain-based camera and a crypto streaming platform—both with names I’d never heard of—in tiny booths. The largest booth that prominently announced its crypto affiliation was Polkadot, a startup that “unites and secures a growing ecosystem of specialized blockchains called parachains.”

For every one of these companies, however, I saw just as many (if not more) that employed crypto while trying very hard to avoid mentioning that fact. Two companies claimed to be building the future of social media. Dig deep enough into their websites and they both offered users crypto-based incentives, but neither chose to feature crypto or blockchain tech as a selling point.

One of them, Ascend, had flyers all over the city. These made lofty—arguably impossible—promises, such as “no misinformation” (who defines what counts as misinformation?). Some of these promises were fundamentally contradictory, such as “no toxicity” and “no hate speech” but also “no centralized censorship.” It’s unclear how the company expects to reconcile many of these competing priorities, but according to its site the solution somehow involves earning “Ascend credits,” which are only described as crypto in a chart.

Another company, Arkive, launched a DAO in 2022 aimed at creating a community of members that would use NFTs and the blockchain to form a museum curated by the internet, rather than a central organization. The group met at SXSW 2023 and even put on a panel about the decentralization of art, but they downplayed the DAO and the crypto angle. Even Arkive’s own coverage of its SXSW 2023 presence barely mentions crypto.

In some cases, it’s unclear whether companies have abandoned their crypto plans or would simply prefer not to highlight them. Even expo booths for companies that are widely known for their work in crypto seemed hesitant to use any of the keywords closely associated with it. A display for _The Sandbox_—sharing a small booth with some other developers in the space—proudly touted the “metaverse” game and occasionally mentioned being a “Web3” platform. But the fact that much of the game is built around NFTs on the blockchain was somewhat obscured. 

It’s a dynamic I started to internally refer to as crypto-obfuscation. It’s not that any of these companies would refuse to acknowledge crypto, per se. When asked, many were all too happy to discuss their vision of a blockchain-based future. But they seemed to operate as though calling attention to it unprovoked was, at best, a little uncouth. At worst? An active deterrent.

Crypto has often been compared to the early internet, where the tech is exciting but not ready for normies yet. Still, no matter how cringey the internet was in its youth, there was never a time when companies avoided saying they were building a product on “the web” or “online.”

I’ll openly admit that I was deeply skeptical of crypto, even in 2022. There was already enough evidence of scams, rugpulls, disinformation, and fraud to make anyone wary of the blockchain for the next decade at least. But I felt compelled to keep my opinions a little quiet. At one crypto-themed party that year, a friend shouted quite loudly, “_NFTs SUCK!!_” And while I aspire to her energy, I also lightly shushed her for fear someone would take offense. 

This year, I felt like my skepticism had become the norm, or at least mainstream enough to express openly. Out of nearly everyone I spoke to, the few with any opinions about crypto seemed eager to share their doubts. Most simply hadn’t thought about the technology. And besides, generative AI was much more interesting to discuss.

I doubt any of this means crypto is dead or dying. The tech has been around in some form or another for over a decade, and public interest in it comes in waves. However, its subdued presence at SXSW suggests its advocates had learned a powerful lesson from the previous year: The best way to evangelize crypto outside the tech bubble is to hope you can convince people to pay no attention to the blockchain behind the curtain.

Crypto Was Afraid to Show Its Face at SXSW 2023

Plus: The “Clop” gang's ransomware spree, the DC Health Link breach comes into focus, and more.

A US House of Representatives hearing this week about the social media app TikTok did little to clarify lawmaker's specific concerns about the potential national security risks associated with the wildly popular app, but it did vividly underscore the country’s lack of federal data privacy legislation. WIRED also discovered that TikTok paid for influencers popular on its platform to attend a DC rally in support of the service ahead of the hearing. 

Meanwhile, as a possible indictment of former US president Donald Trump looms in New York state, internet users began generating AI images of Trump being arrested, but there are ways to tell that they're fake. WIRED examined the increasingly aggressive and desperate tactics of Iran's government-backed hackers amid mass protest and unrest in the country. Citizen sleuths around the world are using open source intelligence to separate fact from fiction in the mystery of who sabotaged the Nord Stream pipeline. And vulnerabilities keep showing up in ultra-popular photo cropping tools, exposing a host of cropped images all over the world where some or all of the original image can be recovered.

Plus, if you want to know what it's like to be investigated by the US Secret Service—and how to avoid that particular pleasure—we have a full account.

And there's more. Each week, we round up the security news we didn’t cover in-depth ourselves. Click the headlines to read the full stories, and stay safe out there.

People living in the Indian state of Punjab grappled with an internet shutdown for days after police imposed a connectivity blackout while searching for the Sikh activist Amritpal Singh. Singh is a member of the Sikh Waris Punjab De movement and recently evaded arrest. More than 100 of his supporters have been arrested. Punjab's 27 million inhabitants faced mobile data and SMS blocking as well as traffic filtering on certain websites and services. For example, the government appeared to have blocked access to prominent Sikh Twitter accounts, including that of poet Rupi Kaur and the nonprofit United Sikhs. “Punjab Police India continued its crackdown on Waris Punjab De elements wanted on criminal charges,” the government of Punjab said in a Facebook post on Monday. “Amritpal Singh remains a fugitive, and efforts are being made to arrest him.” Protests have erupted in Punjab and around the world over law enforcement treatment of Sikh Waris Punjab De and the internet shutdown.

A vulnerability in file transfer software from Fortra known as GoAnywhere has been repeatedly exploited by the notorious, Russia-based Clop ransomware group to target dozens or possibly more than a hundred victims in recent days. The cybercrminal group has added entries on numerous organizations to its dark web site, where Clop attempts to extort money from victims by publishing samples of data they've stolen and threatening to leak more if targets don't pay. TechCrunch confirmed on Thursday that the City of Toronto is one of the victims of the spree. “Today, the City of Toronto has confirmed that unauthorized access to City data did occur through a third-party vendor. The access is limited to files that were unable to be processed through the third-party secure file transfer system," officials said in a statement. TechCrunch has also uncovered details about problems with Fortra's response to the discovery of the vulnerability.

The company that runs the Washington DC health insurance marketplace DC Health Link suffered a breach earlier this month that exposed sensitive and personal data from tens of thousands of area customers, including from some US lawmakers and congressional staff. The information included names, email addresses, dates of birth, mail addresses, Social Security numbers, and policy details. The DC Health Benefit Exchange Authority acknowledged the breach on March 7. The entity that has claimed credit for the breach, who goes by the handle “Denfur,” posted samples of data from the attack on BreachForums. Denfur subsequently posted “Glory to Russia!” and that the “intended target was US politicians and members of US government." In an interview with CyberScoop on an encrypted chat service, Denfur claimed not to be concerned about suffering repercussions from law enforcement. “If anything, I’m more worried about my country trying to do a favour for the US and myself or group becoming a sort of bargaining chip,” Denfur said. “The current time brings uncertainty.”

The alleged “pompompurin” administrator of the popular cybercriminal public square BreachForums—the same site Denfur used against DC Health Link—was arrested in New York state earlier this month, but a new leader known as “Baphomet” had come forward, claiming to have a plan to keep the platform going. On Tuesday, though, Baphomet changed course, claiming that someone had gained access to the BreachForums backend and that law enforcement may now control pompompurin's privileged administrator accounts. “This will be my final update on Breached, as I've decided to shut it down,” Baphomet wrote. “I'm aware this news will not please anyone, but it's the only safe decision now that I've confirmed that the glowies likely have access to Poms machine.”

India Shut Down Mobile Internet in Punjab Amid Manhunt for Amritpal Singh

The interrogation of CEO Shou Zi Chew highlighted US lawmakers’ own failure to pass privacy legislation.

In one sense, today’s US congressional hearing on TikTok was a big success: It revealed, over five hours, how desperately the United States needs national data-privacy protections—and how lawmakers believe, somehow, that taking swipes at China is a suitable alternative. 

For some, the job on Thursday was casting the hearing's only witness, TikTok CEO Shou Zi Chew, as a stand-in for the Chinese government—in some cases, for communism itself—and then belting him like a side of beef. More than a few of the questions lawmakers put to Chew were vague, speculative, and immaterial to the allegations against his company. But the members of Congress asking those questions feigned little interest in Chew’s responses anyway. 

Attempts by Chew, a 40-year-old former Goldman Sachs banker, to elaborate on TikTok’s business practices were frequently interrupted, and his requests to remark on matters supposedly of considerable interest to members of Congress were blocked and occasionally ignored. These opportunities to get the CEO on record, while under oath, were repeatedly blown in the name of expediency and for mostly theatrical reasons. Chew, in contrast, was the portrait of patience, even when he was being talked over. Even when some lawmakers began asking and, without pause, answering their own questions.

The hearing might’ve been a flop, had lawmakers planned to dig up new dirt on TikTok, which is owned by China-based ByteDance, or even hash out what the company could do next to allay their concerns. But that wasn't the aim. The House Energy and Commerce Committee was gathered, it said, to investigate “how Congress can safeguard American data privacy and protect children from online harms.” And on that, the hearing revealed plenty.

For one thing, it’s clear that the attempts to isolate TikTok from its competitors—to treat it differently than dozens of other companies with atrocious records of endangering kids and abusing private data—is a pointless exercise. Asking about TikTok's propensity for surveilling its own users, Chicago congresswoman Jan Schakowsky warned Chew against using legal, typical industry practices as a defense against these wrongs. “You might say, ‘not more than other companies,’” she said, adding that she preferred not to “go by that standard.” 

OK. But why not? 

The truth is that if TikTok were to vanish tomorrow, its users would simply flock to any number of other apps that have no qualms about surveilling the most private moments of their lives and amassing, manipulating, and selling off sensitive information about them. Excluding the most serious but largely unsubstantiated allegations leveled at TikTok—that it is acting or will act in coordination with Chinese intelligence services—there wasn’t a concern about privacy raised by lawmakers Thursday that couldn't be addressed by existing legislation supporting a national privacy law. 

Ensuring that companies and the data brokers they enrich face swift reprisals for blatantly abusing user trust would have the benefit of addressing not only the accusations levied against TikTok, but deceitful practices common across the entire social media industry. 

The irony of US lawmakers pursuing a solution to a problem that’s already been solved by draft legislation—but not actually fixed due to its own inaction—wasn’t entirely lost on the members. While primarily focused on a single company, the hearing, Florida congresswoman Kathy Castor said, should really serve as a broader call to action. “From surveillance, tracking, personal data gathering, and addictive algorithmic operations that serve up harmful content and have a corrosive effect on our kids’ mental and physical well-being,” she said, Americans deserve protection, no matter the source.

Source

Wired