Plus: US government cybersecurity staffers get reassigned to do immigration work, a hack exposes sensitive age-verification data of Discord users, and more.

Research published this week indicates that North Korean scammers are trying to trick US companies into hiring them for architectural design work, using fake profiles, résumés, and Social Security numbers to pose as legitimate workers. The hustle fits into longstanding campaigns by the hermit kingdom to steal billions of dollars from organizations around the world using careful planning and coordination to pose as professionals in all different fields.

Under pressure from the Department of Justice, Apple removed a series of apps from its iOS App Store this month related to monitoring US Immigration and Customs Enforcement activity and archiving content related to ICE's actions. As more apps are removed, multiple developers told WIRED this week that they aren't giving up on fighting Apple over the decisions—and many are still distributing their apps on other platforms in the meantime.

WIRED examined increasing warnings from software supply chain security researchers that the proliferation of AI-generated software in codebases will create an even more extreme version of the code transparency and accountability issues that have come up with widespread integration of open source software components. And Apple announced expansions of its bug bounty program this week, including a maximum $2 million payout for certain exploit chains that could be abused to distribute spyware, and additional bonuses for exploits found in Apple's Lockdown Mode or in beta versions of new software.

But wait, there's more! Each week, we round up the security and privacy news we didn’t report in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

The notorious spyware vendor NSO Group, known for developing the Pegasus malware, has faced financial issues since losing a long legal battle against the secure messaging platform WhatsApp as well as a lawsuit filed by Apple. Now, the company, which has long had Israeli ownership, has been purchased by a group of US-based investors led by movie producer Robert Simonds, who helped finance _Happy Gilmore_, _Billy Madison_, _The Pink Panther_, _Hustlers_, and _Ferrari_, among many other films. The deal is reportedly worth “several tens of millions of dollars” and is close to completion. Israel’s Defense Export Control Agency (DECA) within the Ministry of Defense will need to approve the sale. Use of mercenary spyware has increased within some US federal government agencies since the beginning of the Trump administration.

**Top US Cybersecurity Workers Reassigned to Immigration Roles**

Hundreds of national security and cybersecurity specialists who work in the US Department of Homeland Security have faced mandatory reassignment in recent weeks to roles related to President Donald Trump’s mass deportation agenda. Bloomberg reports that affected workers are largely senior staffers who are not union eligible. Workers who refuse to move roles will reportedly be dismissed. Members of DHS’s Cybersecurity and Infrastructure Security Agency (CISA) who have faced reassignment reportedly worked on “issuing alerts about threats against US agencies and critical infrastructure.” For example, CISA’s Capacity Building team has faced a number of reassignments, which could hinder access to emergency recommendations and directives for high-value federal government assets. Workers have been moved to agencies including Immigration and Customs Enforcement, Customs and Border Protection, and the Federal Protective Service.

**Hack Exposes Sensitive Discord User Data**

A recent breach of a third-party customer service provider used by the communication platform Discord included a trove of data from more than 70,000 Discord users that contained identification documents as well as selfies, email addresses, phone numbers, some home location information, and more. The data was collected as part of age verification checks, a mechanism that has long been criticized for centralizing users’ sensitive information. 404 Media reports that the breach was perpetrated by attackers who are attempting to extort Discord. “This is about to get really ugly,” the hackers wrote in a Telegram channel on Wednesday while posting the stolen data.

**ICE Buys Vehicles That Use Fake Cell Towers for Phone Surveillance**

US Immigration and Customs Enforcement inked a $825,000 contract in May with TechOps Specialty Vehicles (TOSV), a Maryland-based company that manufactures equipment and vehicles for law enforcement. The company provides products including rogue cellphone towers that are used for phone surveillance and sometimes called “stingrays” or “cell-site simulators.” Public records reviewed by TechCrunch show that the agreement describes how the company “provides Cell Site Simulator (CSS) Vehicles to support the Homeland Security Technical Operations program” and is a modification for “additional CSS Vehicles.” TOSV also began a similar $818,000 contract with ICE in September 2024, prior to the start of the Trump administration. In an email to TechCrunch, TOSV president Jon Brianas declined to share details about the contracts but confirmed that the company does provide cell-site simulators. The company does not manufacture them itself, he said.

'Happy Gilmore' Producer Buys Spyware Maker NSO Group

With the mercenary spyware industry booming, Apple VP Ivan Krstić tells WIRED that the company is also offering bonuses that could bring the max total reward for iPhone exploits to $5 million.

Since launching its bug bounty program nearly a decade ago, Apple has always touted notable maximum payouts—$200,000 in 2016 and $1 million in 2019. Now the company is upping the stakes again. At the Hexacon offensive security conference in Paris on Friday, Apple vice president of security engineering and architecture Ivan Krstić announced a new maximum payout of $2 million for a chain of software exploits that could be abused for spyware.

The move reflects how valuable exploitable vulnerabilities can be within Apple's highly protected mobile environment—and the lengths the company will go to to keep such discoveries from falling into the wrong hands. In addition to individual payouts, the company's bug bounty also includes a bonus structure, adding additional awards for exploits that can bypass its extra secure Lockdown Mode as well as those discovered while Apple software is still in its beta testing phase. Taken together, the maximum award for what would otherwise be a potentially catastrophic exploit chain will now be $5 million. The changes take effect next month.

“We are lining up to pay many millions of dollars here, and there’s a reason,” Krstić tells WIRED. “We want to make sure that for the hardest categories, the hardest problems, the things that most closely mirror the kinds of attacks that we see with mercenary spyware—that the researchers who have those skills and abilities and put in that effort and time can get a tremendous reward."

Apple says that there are more than 2.35 billion of its devices active around the world. The company's bug bounty was originally an invite-only program for prominent researchers, but since opening to the public in 2020, Apple says that it has awarded more than $35 million to more than 800 security researchers. Top-dollar payouts are very rare, but Krstić says that the company has made multiple $500,000 payouts in recent years.

In addition to higher potential rewards, Apple is also expanding the bug bounty's categories to include certain types of one-click “WebKit” browser infrastructure exploits as well as wireless proximity exploits carried out with any type of radio. And there is even a new offering known as “Target Flags” that puts the concept of capture the flag hacking competitions into real-world testing of Apple's software to help researchers demonstrate the capabilities of their exploits quickly and definitively.

Apple's bug bounty is just one of many long-term investments aimed at reducing the prevalence of dangerous vulnerabilities or blocking their exploitation. For example, after more than five years of work, the company announced a security protection last month in the new iPhone 17 lineup that aims to nullify the most frequently exploited class of iOS bugs. Known as Memory Integrity Enforcement, the feature is a big swing aimed at protecting a small minority of the most vulnerable and highly targeted groups around the world—including activists, journalists, and politicians—while also adding defense for all users of new devices. To that end, the company announced on Friday that it will donate a thousand iPhone 17s to rights groups that work with people at risk of facing targeted digital attacks.

“You can say, well, that seems like a very large effort to protect only that very small number of users that are being targeted by mercenary spyware, but there is just this incontrovertible track record described by journalists, tech companies, and civil society organizations that these technologies are constantly being abused,” Krstić says. “And we feel a great moral obligation to defend those users. Despite the fact that the vast majority of our users will never be targeted by anything like this, this work that we did will end up increasing protection for everyone.”

Apple Announces $2 Million Bug Bounty Reward for the Most Dangerous Exploits

New research shows that North Koreans appear to be trying to trick US companies into hiring them to develop architectural designs using fake profiles, résumés, and Social Security numbers.

Talented North Korean coders and developers have, for years, been getting hired for remote jobs at Western tech firms. Thousands of these so-called IT workers have earned billions for North Korea’s authoritarian regime by developing apps, working on cryptocurrency projects, and infiltrating Fortune 500 companies—when they get paid, they send their earnings home. But the scale and scope of these fraudulent job schemes likely extends beyond most people’s understanding.

New analysis of exposed online accounts and files linked to suspected Democratic People's Republic of Korea (DPRK) digital laborers shows that at least one group has been working in a very different field: architecture and civil engineering. Over recent years, the cluster of workers has been masquerading as freelance structural engineers and architects, according to a report shared with WIRED by cybersecurity firm Kela, which dug into one network it links to North Korea.

Files linked to the alleged North Korean operatives show 2D architectural drawings and some 3D CAD files for properties in the United States, Kela researchers say. In addition to the plans, the scammers were also seen claiming to advertise a range of architectural services and using, or creating, architectural stamps or seals, which can act as legal certification that drawings follow local building regulations.

“These operatives are active not only in technology and cybersecurity but also in industrial design, architecture, and interior design, accessing sensitive infrastructure and client projects under fabricated identities,” Kela writes in a blog post. The United Nations estimates that thousands of IT workers raise between $250 million and $600 million for North Korea each year, with money being used to support the country’s nuclear weapons programs and sanctions evasion efforts.

Kela’s security researchers focused on a GitHub account linked to one suspected North Korean IT network, before analyzing further accounts and profiles. The GitHub profile, plus some connected personas and some architectural work, was first identified by DPRK researchers on X earlier this year. Github, which is owned by Microsoft, did not respond to WIRED’s request for comment about the account or suspected links to North Korea.

The GitHub account publicly listed a series of Google Drive files that could be downloaded by anyone and contained a treasure trove of information linked to the potential scammers. The files included details of work being pursued by the DPRK-linked accounts, duplicate and false CVs, images that could be used as profile pictures, and details of the personas used to find work.

“There were so many emails, data, and profiles that we saw,” says a Kela researcher who asked not to be named due to the sensitivity of the findings. “It was really massive,” they add, saying some spreadsheets appeared to show hundreds of email addresses that may have been used by the scammers. (Google had not responded to a request for comment at the time of writing).

Publicly available files reviewed by WIRED show the breadth—and productivity—of the suspected DPRK scammers and the links to potential architectural work. In most cases, the scammers appear to have been using freelance work websites to solicit potential jobs. Numerous text files within the documents—which sit alongside CVs—advertise the potential architectural services that people could purchase, with documents claiming architects are licensed across multiple (or sometimes all) states across the US. “We can provide you with all construction docs (site plan, structural analysis report, stamp) and we can help you to get permission for construction docs,” one text file says. Some files appear to show correspondence with people potentially seeking the work.

Files seen by WIRED also include floor plans and designs for a deck, a farm house, a custom tree house, swimming pools, and more. One text file appears to include a request asking if existing plans for a restaurant patio could be redrawn. WIRED could not immediately verify whether these plans had physically been drawn up by the alleged North Korean accounts or if any work was completed. However, previous reporting and other researchers indicate this could be possible.

The Kela researchers say that they reported their findings to the FBI and other law enforcement bodies. The FBI did not immediately respond to WIRED’s request for comment.

In July, Canadian public broadcaster CBC reported that the seal of one architect in Toronto had likely been altered and impersonated by North Korean IT workers and the details were included on plans not worked on by that architect. The architect told CBC that the signature used did not match his own and the seal contained differences to his official version. One document seen by WIRED in the cache of files listed websites for generating engineer and architect seals.

“The plans are being used and being built,” says Michael “Barni” Barnhart, a leading authority in North Korean hacking and cyber threats, who works for insider threat security firm DTEX. Along with other DPRK researchers, who call themselves a “Misfit” alliance, Barnhart has seen this cluster of workers conducting architectural work and says similar other efforts have been detected. “They will do the CAD renderings, they’ll do the drawings,” he says. “It’s not like a hypothetical—those physical things do exist out there.”

Barnhart—who previously found North Korean animators appearing to work on Amazon and Max shows—says that he has also seen potential front companies set up to help run the operations and provide a veneer of legitimacy. The findings raise questions about the quality of the structural work and concerns about safety, if structures are created in the physical world. “In some of our investigations, these plans and these products that they’re making for these remodels and renderings, they’re not getting good reviews,” Barnhart says. “We do have indications that also they’re being hired to do critical infrastructure.”

One 24-minute long screen recording seen by WIRED shows how the freelance operation could work. In the video, a person signs up to a freelance work website and sets up a new profile where they write that they are a “licensed structural engineer/architect in the USA.” They pick a profile image from a folder of potentially downloaded files, translate text between English and Korean, and access a Social Security number generator website during the sign-up process.

When their account is created, the video shows them start to message online requests for work, with one message saying: “I can provide you \[sic\] permit drawing plan set for your residential home design within a few days.”

Other screen recordings show the workers having conversations with potential clients, and in at least one instance there is a recording of an online call discussing possible work. The Kela researcher, who asked not be named for security reasons, says it appeared some prospective customers returned to the scammers after likely having work completed. The researchers say some kinds of work appeared to be priced from a few hundred dollars up to around $1,000 per job.

“This is an opportunistic nation,” DTEX’s Barnhart says. While many companies have started to figure out that North Korea’s IT workers are often applying for remote tech jobs, using false identities, deepfakes on video calls, and local workers to run their operations, they are consistently changing their approaches. Barnhart says it appears that architectural work has been successful for the alleged DPRK workers and that evidence shows the IT workers program can be more subtle than trying to get hired at companies.

“They’re moving to places where we're not looking,” Barnhart says. “They're also doing things like call centers. They're doing HR and payroll and accounting. Things that are just remote roles and not necessarily remote hires.”

North Korean Scammers Are Doing Architectural Design Now

“We are going to do everything in our power to fight this,” says ICEBlock developer Joshua Aaron after Apple removed his app from the App Store.

The developer behind Eyes Up, one of the many Immigration and Customs Enforcement-related apps removed by Apple in recent days, was busy on Wednesday evening at a local planning session for the nationwide “No Kings” protest, scheduled for later this month. When WIRED eventually reached him by phone, he asked to be only identified by his first name, Mark, for safety reasons. “The administration will act on their grudges,” he says. “And they are not afraid to do so, frequently.”

He should know.

Mark’s app, a platform built to serve as a repository for videos and other materials documenting ICE activity, is not alone in getting kicked off Apple’s App Store. Earlier in October, ICEBlock was among the first ICE-related apps Apple removed. The decision followed claims from US attorney general Pam Bondi that such tools endanger ICE officers. Apple has also removed other tracking apps—including Red Dot and DEICER—as well as Eyes Up.

Like Mark, ICEBlock’s developer, Joshua Aaron, is determined to reverse the app store bans. “While I cannot speak to specifics right now, I can tell you that ICEBlock has an incredible legal team behind it and we are going to do everything in our power to fight this,” Aaron tells WIRED.

Apple did not respond to WIRED’s requests for comment.

Regarding Eyes Up, Mark says he has already appealed Apple’s decision to delist the app, twice.“I will appeal every single time they reject me, until it's back in the App Store,” he says. “Because it's pure cowardice, what they're doing. I'm not gonna let off the gas with Apple.”

The ban ignited a fire under Mark, who’s performing more community outreach to let people know about Eyes Up and encouraging them to upload publicly documented encounters with ICE agents to the app, which is still currently available on the Google Play store and the Eyes Up website.

Rafael Concepcion, who was previously a professor at Syracuse University, first designed DEICER to be a “rights app,” with the ICE-location map added on as an accountability tool. Concepcion was heavily inspired by musician Peter Gabriel and his WITNESS organization, started in the 1990s, that documented human rights violations. While gone from Apple’s App Store, DEICER is also still available via Google Play and a website.

While Apple has not yet commented on its decisions to remove ICE monitoring apps from the App Store, Migrant Insider reported this week that in the case of the DEICER iOS app, the company justified removal under a developer guideline that prohibits “defamatory, discriminatory, or mean-spirited content” toward “religion, race, sexual orientation, gender, national/ethnic origin, or other targeted groups.” Google, which has also removed ICE monitoring apps in recent days, told 404 Media last week that it also considers ICE officers to be a vulnerable group.

Google did not immediately respond to a request for comment.

Tools that include a law enforcement monitoring or transparency mechanism are not unprecedented in mobile apps, though. In fact, Apple and Google both develop apps with these features. The driving directions and traffic app Waze—which is owned by Google and can also be downloaded for iOS—has long offered a crowdsourced tool for reporting and receiving alerts about police sightings on public roads. Apple Maps and Google Maps offer similar features.

“I am not in favor of Apple removing ICE-tracking apps from the App Store, nor the app that simply let users archive videos of ICE,” says Riana Pfefferkorn, a policy researcher at Stanford University. “This seems like more needless kowtowing by Tim Cook.” The Apple CEO has appeared at several events with President Donald Trump and reportedly donated $1 million to attend his inauguration.

Legal experts WIRED spoke with say that the ICE monitoring and documentation apps that Apple has removed from its App Store are clear examples of protected speech under the US Constitution’s First Amendment. “These apps are publishing constitutionally protected speech. They're publishing truthful information about matters of public interest that people obtained just by witnessing public events,” says David Greene, a civil liberties director at the Electronic Frontier Foundation.

This hasn’t stopped the Trump administration from attacking the developers behind these ICE-related apps. When ICEBlock first rose to a top spot in Apple’s App Store in April, the Trump administration responded by threatening to prosecute the developer. “We are looking at him,” Bondi said on Fox News of ICEBlock’s Aaron. “And he better watch out.”

Neither the White House nor ICE immediately responded to requests for comment.

Digital rights researchers say that the situation illustrates the dangers when key platforms and communication channels are centrally controlled—whether directly by governments or by other powerful entities like big tech companies. Regardless of what is officially available through the Google Play store, Android users can sideload apps of their choosing. But Apple’s ecosystem has always been a walled garden, an approach that the company has long touted for its security advantages, including the ability to screen more heavily for malicious apps.

For years, a group of researchers and enthusiasts have tried to create “jailbreaks” for iPhones to essentially hack their own devices as a way around Apple’s closed ecosystem. Recently, though, jailbreaking has become less common. This is partly the result of advances in iPhone security, but partly related to the trend in recent years of attackers exploiting complex chains of vulnerabilities that could potentially be used for jailbreaking for malware instead, particularly mercenary spyware.

"The closed ecosystem motivation sort of dwindled as Apple added capabilities that previously required a jailbreak—like wallpapers, tethering, better notifications, and private mode in Safari," says longtime iOS security and jailbreak researcher Will Strafach. “But this situation with ICE apps highlights the issue with Apple being the arbiter and single point of failure.”

Stanford’s Pfefferkorn warns that while US tech companies are not state-controlled, they have in her view become “happy handmaidens” when it comes to “repressing free speech and dissent.”

“It’s especially disappointing,” Pfefferkorn says, “coming from the company that brought us the Think Different ad campaign, which invoked MLK, Gandhi, and Muhammad Ali—none of whom would likely be big fans of ICE today.”

Apple Took Down These ICE-Tracking Apps. The Developers Aren't Giving Up

As developers increasingly lean on AI-generated code to build out their software—as they have with open source in the past—they risk introducing critical security failures along the way.

Just like you probably don't grow and grind wheat to make flour for your bread, most software developers don't write every line of code in a new project from scratch. Doing so would be extremely slow and could create more security issues than it solves. So developers draw on existing libraries—often open source projects—to get various basic software components in place.

While this approach is efficient, it can create exposure and lack of visibility into software. Increasingly, however, the rise of vibe coding is being used in a similar way, allowing developers to quickly spin up code that they can simply adapt rather than writing from scratch. Security researchers warn, though, that this new genre of plug-and-play code is making software-supply-chain security even more complicated—and dangerous.

“We're hitting the point right now where AI is about to lose its grace period on security,” says Alex Zenla, chief technology officer of the cloud security firm Edera. “And AI is its own worst enemy in terms of generating code that’s insecure. If AI is being trained in part on old, vulnerable, or low-quality software that's available out there, then all the vulnerabilities that have existed can reoccur and be introduced again, not to mention new issues.”

In addition to sucking up potentially insecure training data, the reality of vibe coding is that it produces a rough draft of code that may not fully take into account all of the specific context and considerations around a given product or service. In other words, even if a company trains a local model on a project's source code and a natural language description of goals, the production process is still relying on human reviewers' ability to spot any and every possible flaw or incongruity in code originally generated by AI.

“Engineering groups need to think about the development lifecycle in the era of vibe coding,” says Eran Kinsbruner, a researcher at the application security firm Checkmarx. “If you ask the exact same LLM model to write for your specific source code, every single time it will have a slightly different output. One developer within the team will generate one output and the other developer is going to get a different output. So that introduces an additional complication beyond open source.”

In a Checkmarx survey of chief information security officers, application security managers, and heads of development, a third of respondents said that more than 60 percent of their organization’s code was generated by AI in 2024. But only 18 percent of respondents said that their organization has a list of approved tools for vibe coding. Checkmarx polled thousands of professionals and published the findings in August—emphasizing, too, that AI development is making it harder to trace “ownership” of code.

Open source projects can be inherently insecure, outdated, or at risk of malicious takeover. And they can be incorporated into codebases without adequate transparency or documentation. But researchers point out that some of fundamental backstops and accountability mechanisms that have always existed in open source are missing or severely fragmented by AI-driven development.

“AI code is not very transparent,” says Dan Fernandez, Edera's head of AI products. “In repositories like Github you can at least see things like pull requests and commit messages to understand who did what to the code, and there's a way to trace back who contributed. But with AI code, there isn't that same accountability of what went into it and whether it's been audited by a human. And lines of code coming from a human could be part of the problem as well.”

Edera’s Zenla also points out that while vibe coding may seem like a low-cost way to create bare-bones applications and tools that might not otherwise exist for low-resource groups like small businesses or vulnerable populations, the ease of use comes with the danger of creating security exposure in these most at-risk and sensitive situations.

“There's a whole lot of talk about using AI to help vulnerable populations, because it uses less effort to get to something usable,” Zenla says. “And I think these tools can help people in need, but I also think that the security implications of vibe coding will disproportionately impact people who can least afford it.”

Even in enterprise, where financial risk largely falls to the company, the personal fallout of a widespread vulnerability introduced as a result of vibe coding should weigh heavily.

“The fact is that AI-generated material is already starting to exist in code bases,” says Jake Williams, a former NSA hacker and current vice president of research and development at Hunter Strategy. “We can learn from advances in open source software-supply-chain security—or we just won't, and it will suck.”

Vibe Coding Is the New Open Source—in the Worst Way Possible

Plus: China sentences scam bosses to death, Europe is ramping up its plans to build a “drone wall” to protect against Russian airspace violations, and more.

If you’re traveling to a country and, once you arrive, realize it’s in the midst of a Gen Z-fueled revolution, what do you do? If you’re Harry Jackson, a travel vlogger, you run straight into the action. This week, WIRED spoke with Jackson, who recounted his time documenting the overthrow of Nepal’s government for his social media channels and the millions of people who watched his videos.

Tile tracking tags can be a useful way to find your lost keys, wallet, or pets. But be careful: Researchers say the Bluetooth-enabled tags can broadcast unencrypted data that could allow a tech-savvy stalker—or the company itself—to spy on your movements. Not only that, but an attacker could use an anti-theft feature to spoof your Tile device and make it seem like you (or at least your belongings) were in a location you never visited.

Immigration and Customs Enforcement has been busy purchasing social media surveillance tools as it wages a nationwide crackdown on immigrants across the United States. Now, the agency is staffing up to make use of these tools, WIRED first reported. ICE plans to hire nearly 30 contract workers to build dossiers on people based on what they post online, then share that intel with ICE agents for the purposes of arrest and deportation.

Password managers are one of the best tools available for keeping your online accounts properly protected—and that extends into the afterline. We’ve put together a guide for sharing your logins with loved ones in the event you pass away.

And that’s not all. Each week, we round up the security and privacy news we didn’t report in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

**Apple Pulls ICEBlock Amid DOJ Pressure**

In April, developer Joshua Aaron created the ICEBlock app to allow people to anonymously report nearby sightings of immigration enforcement officials and help protect at-risk communities. Hundreds of thousands of people quickly flocked to download Aaron’s app, which was only available on iPhones. That is no longer an option.

Apple has now removed ICEBlock from its App Store—as well as other similar services—after US attorney general Pam Bondi claimed officials had “reached out” to Apple and were “demanding” it take down the app. Apple staff had previously reviewed and approved ICEBlock’s inclusion on the App Store. The company claims it has now removed the app and others based on “information we’ve received from law enforcement about the safety risks.”

“We are determined to fight this with everything we have,” Aaron told 404 Media after the app was pulled. “Our mission has always been to protect our neighbors from the terror this administration continues to reign down on the people of this nation.” An email from Apple shared with the publication says the app was removed due to violating Apple’s policies on “objectionable content” and that “its purpose is to provide location information about law enforcement officers that can be used to harm such officers individually or as a group.”

Since Aaron launched the app, it has provoked a ferocious backlash from Trump administration officials, who have led an unprecedented expansion of ICE agency. Earlier this year, Bondi said officials were “looking at” Aaron and that he “better watch out.” The attorney general has also said officials were considering prosecuting CNN for reporting about ICEBlock. Legal experts, however, have told WIRED that ICEBlock clearly falls under protected free speech under the First Amendment and that prosecuting the creator would be illegal.

ICEBlock isn’t the only app to be censored by mobile platforms this week. The ICE-tracking app Red Dot was also pulled from Apple’s App Store and Google Play following ICEBlock’s removal by Apple. 404 Media, which was first to report on Red Dot’s removal, spoke to at least one immigration support group in Chicago, a current target of ICE’s deportation efforts, that has used the app.

In explaining its takedown decision, Google went so far as to tell 404 Media that it had removed the app because ICE is considered a vulnerable group that had been targeted in recent violence—an ironic description for an agency whose mission has become the indiscriminate, forcible, often warrantless, mass deportation of undocumented immigrants.

**11 Chinese Scam Compound Bosses Sentenced to Death**

Giant modern slavery compounds within Southeast Asia are a scourge on the world. Over the last decade, hundreds of thousands of people have been trafficked, from more than 60 countries, to Myanmar, Cambodia, and Laos, where they are then forced to run online scams and steal victims’ money. People around the globe have lost billions to the operations, which serve as a major revenue stream for the organized crime gangs that operate in the region and are also heavily involved in illegal online gambling operations.

While some law enforcement efforts have tried to dismantle several of the compounds, their impact has been limited, and many sites continue to flourish. This week, however, a court in Eastern China handed down severe sentences to members of the Ming crime family, for their roles in setting up and running several barbaric compounds. In total, 11 members of the Ming family and their associates were sentenced to death, five others were given suspended death penalties, 11 others were sentenced to life in jail, while another dozen received prison sentences, according to a statement from the court.

The family, according to CNN reporting, was linked to a notorious compound near the Chinese-Myanmar border area and at one point had 10,000 people conducting scams. The court statement alleges that, as well as committing fraud, opening casinos and selling drugs, the criminal group and others “killed and injured fraudsters who tried to escape or disobeyed management,” which resulted in 10 deaths.

**Europe Accelerates Plans for a “Drone Wall” to Counter Russian Airspace Violations**

Germany’s Munich airport briefly shut down this week—with 17 flights cancelled and more than 3,000 people disrupted—after suspected drone sightings forced air traffic controllers to take precautionary measures. Some passengers were given camp beds and food during the shutdown. While officials have not pointed the finger at anyone who may be responsible in Germany, the incident follows a wave of drone disruptions at airports around Europe and Russian incursions into European countries’ airspace.

In recent weeks, Russian drones have entered Polish and Romanian airspace, while NATO has also said Finland, Latvia, Lithuania, and Norway have experienced “airspace violations by Russia.” In response to the increasing number of incidents—which experts believe signals Russia testing NATO and European countries—the European Union is working to create a “drone wall.” Details are, so far, scant, but the concept could see anti-drone technologies, as well as better detection systems and information sharing, being more widely deployed along Europe’s borders with Russia. “We need to act now—Europe must deliver a strong and united response to Russia’s drone incursions at our borders,” Ursula von der Leyen, the president of the European Commission, said.

**Comms System Built by Anduril and Palantir Are Deeply Flawed, Army Memo Says**

When the defense tech firm Anduril, along with a group of partners including Palantir and Microsoft, won a $100 million contract to rebuild the US Army’s battlefield communications network system, the companies’ involvement might have been seen as a project by agile tech firms to carry out needed reform of antiquated military systems. Instead, the system suffers from “fundamental security” problems and should be treated as “very high risk,” according to an Army internal assessment of the system. The system, for instance, allows users to access any data or application regardless of their clearance level or operational requirements, according to the memo obtained by Reuters and first reported by military news outlet Breaking Defense. As a result, there’s a high “likelihood of an adversary gaining persistent undetectable access," wrote Gabrielle Chiulli, the Army chief technology officer authorizing official. The assessment noted that third-party applications that would be hosted on the system also haven’t undergone Army security assessments, and one contained 25 high severity security flaws in its code.

Apple and Google Pull ICE-Tracking Apps, Bowing to DOJ Pressure

Documents show that ICE plans to hire dozens of contractors to scan X, Facebook, TikTok, and other platforms to target people for deportation.

Documents show that ICE plans to hire dozens of contractors to scan X, Facebook, TikTok, and other platforms to target people for deportation.

Photograph: Lawrey/ Getty Images

United States immigration authorities are moving to dramatically expand their social media surveillance, with plans to hire nearly 30 contractors to sift through posts, photos, and messages—raw material to be transformed into intelligence for deportation raids and arrests.

Federal contracting records reviewed by WIRED show that the agency is seeking private vendors to run a multiyear surveillance program out of two of its little-known targeting centers. The program envisions stationing nearly 30 private analysts at Immigration and Customs Enforcement facilities in Vermont and Southern California. Their job: Scour Facebook, TikTok, Instagram, YouTube, and other platforms, converting posts and profiles into fresh leads for enforcement raids.

The initiative is still at the request-for-information stage, a step agencies use to gauge interest from contractors before an official bidding process. But draft planning documents show the scheme is ambitious: ICE wants a contractor capable of staffing the centers around the clock, constantly processing cases on tight deadlines, and supplying the agency with the latest and greatest subscription-based surveillance software.

The facilities at the heart of this plan are two of ICE’s three targeting centers, responsible for producing leads that feed directly into the agency’s enforcement operations. The National Criminal Analysis and Targeting Center sits in Williston, Vermont. It handles cases across much of the eastern US. The Pacific Enforcement Response Center, based in Santa Ana, California, oversees the western region and is designed to run 24 hours a day, seven days a week.

Internal planning documents show that each site would be staffed with a mix of senior analysts, shift leads, and rank-and-file researchers. Vermont would see a team of a dozen contractors, including a program manager and 10 analysts. California would host a larger, nonstop watch floor with 16 staff. At all times, at least one senior analyst and three researchers would be on duty at the Santa Ana site.

Together, these teams would operate as intelligence arms of ICE’s Enforcement and Removal Operations division. They will receive tips and incoming cases, research individuals online, and package the results into dossiers that could be used by field offices to plan arrests.

The scope of information contractors are expected to collect is broad. Draft instructions specify open-source intelligence: public posts, photos, and messages on platforms from Facebook to Reddit to TikTok. Analysts may also be tasked with checking more obscure or foreign-based sites, such as Russia’s VKontakte.

They would also be armed with powerful commercial databases such as LexisNexis Accurint and Thomson Reuters CLEAR, which knit together property records, phone bills, utilities, vehicle registrations, and other personal details into searchable files.

The plan calls for strict turnaround times. Urgent cases, such as suspected national security threats or people on ICE’s Top Ten Most Wanted list, must be researched within 30 minutes. High-priority cases get one hour; lower-priority leads must be completed within the workday. ICE expects at least three-quarters of all cases to meet those deadlines, with top contractors hitting closer to 95 percent.

The plan goes beyond staffing. ICE also wants algorithms, asking contractors to spell out how they might weave artificial intelligence into the hunt—a solicitation that mirrors other recent proposals. The agency has also set aside more than a million dollars a year to arm analysts with the latest surveillance tools.

ICE did not immediately respond to a request for comment.

Earlier this year, The Intercept revealed that ICE had floated plans for a system that could automatically scan social media for “negative sentiment” toward the agency and flag users thought to show a “proclivity for violence.” Procurement records previously reviewed by 404 Media identified software used by the agency to build dossiers on flagged individuals, compiling personal details, family links, and even using facial recognition to connect images across the web. Observers warned it was unclear how such technology could distinguish genuine threats from political speech.

ICE’s main investigative database, built by Palantir Technologies, already uses algorithmic analysis to filter huge populations and generate leads. The new contract would funnel fresh social media and open-source inputs directly into that system, further automating the process.

Planning documents say some restrictions are necessary to head off abuse. Contractors are barred from creating fake profiles, interacting with people online, or storing personal data on their own networks. All analysis must remain on ICE servers. Past experience, however, shows such guardrails can be flimsy, honored more in paperwork than in practice. Other documents obtained by 404 Media this summer revealed that police in Medford, Oregon, performed license plate reader searches for ICE’s Homeland Security Investigations division, while HSI agents later ran searches in federal databases at the request of local police—an informal back-and=forth that effectively gave ICE access to tools it wasn’t authorized to use.

Other surveillance contracts have raised similar alarms. In September 2024, ICE signed a $2 million contract with Paragon, an Israeli spyware company whose flagship product, Graphite, can allegedly remotely hack messaging apps like WhatsApp and Signal. The Biden White House quickly froze the deal under an executive order restricting spyware use, but ICE reactivated it in August 2025 under the Trump administration. Last month, 404 Media filed a freedom of information lawsuit demanding ICE release the contract and related records, citing widespread concern that the tool could be used to target immigrants, journalists, and activists.

The Electronic Privacy Information Center has similarly sued ICE, calling its reliance on data brokers a “significant threat to privacy and liberty.” The American Civil Liberties Union has argued that buying bulk datasets—such as smartphone location trails gathered from ordinary apps—helps ICE sidestep warrant requirements and helps it pull in vast amounts of data with no clear link to its enforcement mandate.

The newly proposed social media program is only the latest in a string of surveillance contracts ICE has pursued over the past few years.

In 2020 and 2021, ICE bought access to ShadowDragon’s SocialNet, a tool that aggregates data from more than 200 social networks and services into searchable maps of a person’s connections. Around the same time, the agency contracted with Babel Street for Locate X, which supplies location histories from ordinary smartphone apps, letting investigators reconstruct people’s movements without a warrant. ICE also adopted LexisNexis Accurint, used by agents to look up addresses, vehicles, and associates, though the scale of spending on that service is unclear. In September, ICE signed a multimillion-dollar contract with Clearview AI, a facial recognition company that built its database by scraping billions of images from social media and the public web.

Throughout, ICE has leaned on Palantir’s Investigative Case Management system to combine disparate streams of data into a single investigative platform. Recent contract updates show the system lets agents search people using hundreds of categories, from immigration status and country of origin to scars, tattoos, and license-plate reader data. Each surveillance contract ICE signs adds another layer—location trails, social networks, financial records, biometric identifiers—feeding into Palantir’s hub. ICE’s new initiative is about scaling up the human side of the equation, stationing analysts around the clock to convert the firehose of data into raid-ready leads.

ICE argues it needs these tools to modernize enforcement. Its planning documents note that “previous approaches … which have not incorporated open web sources and social media information, have had limited success.” The agency suggests that tapping social media and open web data helps identify aliases, track movements, and detect patterns that traditional methods often miss.

With plenty of historical analogs to choose from, privacy advocates warn that any surveillance that starts as a method of capturing immigrants could soon be deployed for ulterior purposes. ICE’s proposal to track “negative sentiment” is a clear example of how the agency’s threat monitoring bleeds into the policing of dissent. By drawing in the online activity of not only its targets but also friends, family, and community members, ICE is certain to collect far more information outside its mandate than it is likely to publicly concede.

*   **In your inbox:** Our biggest stories, handpicked for you each day
    

Dell Cameron is an investigative reporter from Texas covering privacy and national security. He's the recipient of multiple Society of Professional Journalists awards and is co-recipient of an Edward R. Murrow Award for Investigative Reporting. Previously, he was a senior reporter at Gizmodo and a staff writer for the Daily ... Read More

ICE Wants to Build Out a 24/7 Social Media Surveillance Team

Google has launched a new AI-based protection in Drive for desktop that can shut down an attack before it spreads—but its benefits have their limits.

Ransomware attacks have loomed for years as an urgent digital threat with no easy solution—especially as they have evolved to include data grab-and-leak attacks that may not even involve data-encrypting malware at all. Traditional ransomware that locks up files and systems is still rampant, though, and Google on Tuesday launched a new defense for its Google Drive for desktop apps that aims to quickly detect ransomware activity and halt cloud syncing before an infection can spread.

While antivirus scanners monitor for signs of malware across a system, the new ransomware protections in Drive for desktop are meant to act as an additional line of defense. The detection capability is built on an AI model that Google trained using millions of real victims’ files that had been encrypted with various strains of ransomware. And the feature is designed to detect and contain suspected ransomware in desktop Drive very quickly. For enterprise Google Workspace customers, the feature is an asset, protecting files of any format that are stored in Drive for desktop and allowing users to easily restore any data that is encrypted or corrupted by malware. But like other ransomware detection and data-backup features, the tool is a treatment not a cure.

“The innovative part is doing that real-time detection and quickly stopping the sync to minimize the damage. That was what our customers were telling us they really wanted,” says Jason James, a product manager for Google Workspace. “You’ve got hundreds, millions, billions of users—and so to check every file quickly and accurately and wherever the user is around the world were all challenges.”

A warning that Drive for desktop has detected ransomware and paused cloud syncing.

Courtesy of Google

Designed to work in tandem with the malware monitoring tools that Google already builds into Drive, Chrome, and Gmail, the protection was built using the expertise of Google's core antivirus software development team, James notes.

“For me, the coolest part is that we can take this AI-based way of detecting ransomware behavior and then we can pair it with protecting the user’s data so we minimize the damage,” James says. “We see it as a missing safety net.”

The feature has some straightforward limitations, though. It is only relevant at all, of course, if a business or institution uses Drive for desktop in the first place—a not insignificant caveat when so much of enterprise software is still dominated by Microsoft. Additionally, Drive for desktop is an app for Windows PCs and Macs. If ransomware is tearing through digital files that aren't stored in Drive, Google has no ability to detect the infection.

Other cloud storage platforms, including Microsoft's OneDrive and Dropbox, offer features with similarities to the new Drive for desktop ransomware protection. And while detection and response are crucial components as defenders work to deter cybercriminals and empower victims to withhold ransom payments, the benefits and limitations of each individual tool serve as a reminder that there is still no panacea for the threat of ransomware.

Google’s Latest AI Ransomware Defense Only Goes So Far

Google can create and manage passkeys from your browser, but the process is more involved than it suggests.

All products featured on WIRED are independently selected by our editors. However, we may receive compensation from retailers and/or from purchases of products through these links. Learn more.

Google wants you to start using passkeys. Its vision is to “progress toward a passwordless future," allowing you to store passkeys in the Google Password Manager service. For websites that support the login method, Google now allows you to generate, store, and sync passkeys. The problem is actually finding a consistent way to do it.

It’s easy to change your password, but it’s not so easy to add passkeys to an account you’ve already created, much less manage them solely in your browser. Still, you can use passkeys with the Google Password Manager on supported websites; you'll just need to jump through a few hoops first.

*   **How to Set Up a Passkey for Your Google Account**
*   **How to Use Passkeys With Google Password Manager**
*   **What to Do if You Lose Your Google Passkeys**
*   **Why Passkeys Are Easier With a Password Manager**

**How to Set Up a Passkey for Your Google Account**

You can learn more about passkeys here, but in short, they're a method to confirm you are who you say you are so that you don't have to remember a long password for every app and website you log in to. You can use a passkey for your Google account, but you can also store passkeys for other websites with the Google Password Manager, which is available on Chrome or directly through Android.

To use a passkey with your Google account, go to g.co/passkeys and follow the prompts. You’ll log in to your Google account and create a passkey, either bound to your device or stored in a third-party password manager. If you aren’t using a third-party password manager, your Google passkey will be bound to the device you’re using. Apple devices sync your passkeys across other Apple devices with iCloud Keychain, but otherwise you’ll need the device you created the passkey on to log in.

Creating a passkey for your Google account is simple. What’s important is that you’re doing it on a device that supports passkeys. Here’s what you need:

*   A computer with Windows 10, macOS Ventura, ChromeOS 109, or newer; or a phone with iOS 16 or Android 9, or newer;
*   A supported browser (Chrome 109, Safari 16, Edge 109, Firefox 122, or newer).

Once you’ve made a passkey, you can manage it at myaccount.google.com. There, select **Security,** and then choose **Passkeys and Security Keys** to see the passkeys you have. You can—and likely will, if you aren’t using a third-party password manager—have multiple passkeys for different devices, even if they’re used to log in to the same account.

How Safe Are Google Passkeys?

A passkey for your Google account is generally safer than using a password. Passkeys rely on asymmetric encryption with a public-private key pair, and only you have access to your private key. Even in the event of a breach or phishing scheme, an attacker can't access your account without your private key, which never leaves your device.

A password uses symmetric encryption, and it's what you'd call a “shared secret” in the world of cybersecurity. With a password, Google needs to store an encrypted copy on its servers, opening up the potential of a breach. Further, you need to remember your password, which opens the door for phishing and social engineering attacks.

Is It Safe to Store Passkeys in Google Password Manager?

The Google Password Manager available through Chrome stores your logins locally on your device. It can sync your logins across devices, but an encrypted copy is kept locally. A file containing your encryption key is also available locally, and combining the two files with a Python script and a little know-how can expose your passwords on Windows.

Someone would need access to your device for this kind of attack, which isn't likely on a desktop, but it's worth keeping the risk in mind. If you travel often or could have your device easily lost or stolen, it's a good idea to store passkeys elsewhere, such as in a password manager.

Should I Use a Password Manager for Passkeys?

You can create and manage passkeys on Windows through Windows Hello, on macOS and iOS through iCloud Keychain, and on Android or in your browser through Google Password Manager. However, using a third-party password manager like Proton Pass or 1Password makes things a lot easier.

An external password manager allows you to sync your passkeys across devices, and they're bound to the password manager itself, rather than your device. If you have a device that's authenticated with your password manager, you can access your passkeys, too.

**How to Use Passkeys With Google Password Manager**

Google would like you to believe that saving passkeys in the Google Password Manager happens almost magically. You sign in to or sign up for an account, Google steps in and asks if you want to save a passkey, and you’re done. Google even says it can upgrade accounts stored in Google Password Manager automatically with passkeys.

The process, unfortunately, is more involved. First, you need to enable passkeys for the Google Password Manager. They're enabled by default, but to double check, open Chrome, and follow these steps:

1.  Click the three dots in the upper right corner;
2.  Hover over **Passwords and Autofill** and choose **Google Password Manager** from the menu;
3.  In the tab that opens, choose **Settings**;
4.  Ensure the **Offer to Save Passwords and Passkeys** setting is turned on.

Google via Jacob Roach

Now, we need a website that supports passkeys. There are a handful of different directories online—Hanko’s directory is the easiest, but this community directory is more comprehensive. I’ll use Best Buy for this example, which supports passkeys.

To set up a passkey with Google Password Manager, you need your credentials for the service in question already stored. For Best Buy, go to the website and log in. When the Google Password Manager prompts you, choose to save your username and password in Google Password Manager.

With that done, follow these steps on the Best Buy website:

1.  Select the drop-down for your account name, and choose **Account Settings**;
2.  Under the **Account Security** box, choose **Passkey (Face or Fingerprint Sign-In)**;
3.  Select **Create a Passkey**.

Google via Jacob Roach

Once you create a passkey, a pop-up will appear asking you to verify your identity with another device logged in to your Google account. If this is the first passkey you’re creating with Google Password Manager, you’ll also need to set up a PIN.

Every service is a bit different, but you need to initiate the passkey creation from the service you want a passkey for, not from Google Password Manager. Once the passkey is stored, you’ll see it alongside your normal login credentials in Google Password Manager.

Google via Jacob Roach

**What to Do if You Lose Your Google Passkeys**

There’s an obvious issue with passkeys, and that’s account recovery. Passkeys are tied to a particular device, so if that device is lost or stolen, you won’t be able to sign in to your account. Google, thankfully, syncs your passkeys across devices with access to your Google account, but you may still need to do some clean-up. There are two steps you need to take if you no longer have access to a device that holds your passkey.

First, you need to remove the passkey from that device. For your Google account, that’s simple enough:

1.  Go to myaccount.google.com;
2.  Select the **Security** tab from the left menu;
3.  Choose **Passkeys and Security Keys** under the **How You Sign In To Google** section;
4.  Remove the passkey you created;
5.  If you have a device-bound key, such as on an Android device, signing out of that device will remove the passkey. The link next to these devices will take you to the right page, but you can navigate to **Your Devices** in the **Security** section, as well.

Other websites that support passkeys allow you to remove them, as well. In our Best Buy example, for instance, you’ll find a **Remove All Passkeys** button in the same place you created the passkey. After that’s done, you can regenerate a passkey following the steps above on a new device you have access to. In the event you can’t access a new device, Google and other services that support passkeys have fallback options, including a recovery code or your standard password.

**Why Passkeys Are Easier With a Password Manager**

The problem with using your Google for passkey storage is, well, Google.

Apple, Microsoft, and Google have all been quick to adopt passkeys as an alternative form of authentication, and they’ve been just as quick to place restrictions on where you can and can’t save or use passkeys. It’s a mess. For instance, when you log in to iCloud, Apple says you can use a passkey but only with a device running iOS. Google automatically generated a passkey for my account when I recently switched my phone to the OnePlus 13R, and yet it doesn’t work, no matter how many QR codes I scan on a device that, supposedly, holds my Google passkey. Then there’s Windows and Microsoft. Those keys don’t even work across devices.

To avoid the platform-locked squabble of multibillion-dollar corporations, I recommend using a third-party password manager. Most of the best password managers come with passkey support, and you’ll be able to save and sync your passkeys across devices.

I use Proton Pass, but 1Password, NordPass, and others also support passkeys. You can save passkeys in Chromium-based browsers with your password manager’s extension, and both Android and iOS now allow third-party apps to store and manage passkeys.

There’s no nonsense about which devices support which passkeys, and you don’t need to tap dance around your devices just to save one. Most importantly, storing your passkeys in a password manager gives you flexibility. If you want to switch from Android to iPhone, or from macOS to Windows, or try out some new, hot browser, you can. Some services, such as Proton Pass, even allow you to share and export passkeys.

How to Use Passkeys With Google Password Manager (2025)

Your logins will live on after you pass on. Make sure they end up in the right hands.

It’s not fun to talk about, but there’s only one thing certain in life. You need to have a plan for your digital legacy, just like you make a plan for your physical assets; otherwise, your accounts, services, and logins will rot away in a data center before they’re inevitably erased by a data retention policy.

Some services recognize how important digital legacy is. Apple and Facebook have legacy contacts that can gain access to your accounts, and the American Bar Association is still grappling with the legalities of accessing online accounts when someone passes away. Most online services don't.

Recognition of digital legacy is still spotty, and without dedicated legacy contacts, accessing the deceased’s online accounts often involves court orders or legal documentation (and plenty of time). Digital legacy doesn’t need to have so many hurdles, though. Password managers have digital legacy features built in that can unlock your digital life in the event of an emergency.

*   **Defining a Digital Legacy**
*   **Password Managers With Digital Legacy Features**
*   **What You Should Store Beyond Passwords**
*   **Pass on Your Passwords When You Pass**

**Defining a Digital Legacy**

There’s a lot that goes into your digital legacy, from your online banking login to any digital assets you own, but even a seemingly straightforward online life can quickly snowball into a mess. Does the Netflix account just keep draining the checking account until you can break in and change the payment option? Are photos that have been uploaded to the cloud now lost in a data center, never to be recovered? Add some passkeys, maybe some social sign-on features, and you have a complex web of data that’s almost impossible to untangle.

So-called digital executors exist, operating in the same way as the executor of the will, just for digital assets. It’s a good idea to set up a digital executor to ensure your digital assets are handled properly, but that doesn’t help in the immediate aftermath of someone passing away. The probate process can take at least a few months, and sometimes several years.

Password managers like Bitwarden offer a shortcut. You can transfer access to a trusted relative, spouse, or even your closest friend, along with a rundown of what to do with your accounts.

The legality of this is a little murky, with the American Bar Association noting that accessing someone else’s account, even with their username and password, isn’t legal if it violates the platform’s terms of service. The law regarding digital assets varies from state to state, so it’s still a good idea to consult an attorney for long-term access.

Here's the advice NordPass gave: “For anyone thinking about digital legacy, the best step is to set up Emergency Access in advance, clearly communicate the use cases of the credentials with your trusted contacts, and follow the terms of service of respective platforms.”

Immediate access is still important, not only in the event of death but also in the event of incapacitation. If you, for whatever reason, can’t access your online accounts, you can transfer those accounts easily using an emergency contact feature available in a password manager.

**Password Managers With Digital Legacy Features**

There are some excellent password managers, and most of them have some way to unlock your account in the event of an emergency. They go about it in different ways, however. Here are the three I recommend for most people. (Read more in our Best Password Managers guide.)

Proton Pass

Proton recently added an emergency access feature, and it’s not just restricted to Proton Pass. Unlike most password managers, Proton Pass is just one app available in the Proton suite. Proton also makes our favorite VPN, and it offers an encrypted crypto wallet, cloud storage, and even a calendar.

Emergency access isn’t restricted to one app with Proton. Rather, it’s access to your entire account, so if you have multiple Proton apps, you can pass them along. It’s not hard to see where this could be useful, especially if you have a lot of data stored in Proton Drive or money in your crypto wallet.

Although Proton’s emergency access is bound to your overall Proton account, you need to set it up through Proton Pass or another Proton app. For Proton Pass, open the app in your browser at account.proton.me. Once you’re in, select the cog icon next to your name in the bottom left corner and choose **Account.**

Proton via Jacob Roach

This will open a new tab. In the new window, select **Recovery** from the menu on the left and scroll down to the **Emergency Access** section. Choose **Add Emergency Contact** and enter the email address you want to share access with. They’ll need a Proton account to accept the invitation. Emergency access is only available for paid Proton members, though you can share access with someone who has a free Proton account.

One of the upsides of Proton compared to 1Password and NordPass (my other two recommendations) is the wait-time setting. When you add an emergency contact, they can request access to your Proton account at any time. After the wait time has passed without a response, however, Proton will automatically give your emergency contacts access. The default time is seven days, but you can set it for as long as 30 days, as well as remove the wait time completely.

1Password

1Password via Jacob Roach

**1Password**

1Password doesn’t have a dedicated digital legacy feature, and if you understand how its security architecture is designed, it’s easy to see why. 1Password has a true zero-knowledge security architecture. Even if 1Password wanted to, and even in the event of a catastrophic emergency, it can’t decrypt someone’s vault. That’s great for security but bad for passing along your passwords.

Instead, 1Password offers an emergency kit, which you can generate and download from my.1password.com. On a device where you’re signed into 1Password, go to that address, select your name in the upper right corner, and choose **Manage Account.** On the next page, select **Save Emergency Kit.**

1Password via Jacob Roach

Your 1Password Emergency Kit is a PDF that includes instructions for logging in, along with your email address, secret key, and a space for you to write (or type) your master password. It also includes a QR code for easy setup, automatically copying your details over, short of your master password.

The Emergency Kit is useful for account recovery, but it’s also one of the more secure options for digital legacy. You can print off a physical copy of your Emergency Kit before wiping any trace of it digitally. I recommend including it as part of your will or trust and storing it somewhere secure, like a safe-deposit box.

Unfortunately, you need to jump through these hoops with 1Password due to how it works. And whoever ends up with your Emergency Kit will have full access to your account, while Proton Pass and NordPass (my next recommendation) provide read-only access. If you use 1Password’s Families plan, however, it’s easy to share vault access with the family members on your account—and you don’t even need to contemplate death to do it.

NordPass

Photograph: Nordpass

NordPass introduced its emergency access feature a few years ago, and it’s simple. You can send invites to one (or more) trusted contacts. They don’t get access to your vault immediately. Instead, they can request access at any time. In the event you don’t deny one of these requests within seven days, Nord automatically unlocks the account for the contact that requested access.

Setting it up is easy. Once you have the NordPass extension installed, open it and select the cog icon near the top left of the window. That will open your settings view in a new tab. All the way at the bottom of the page, you’ll find the **Emergency Access** setting under the **Other** category. Like with Proton Pass, your trusted contact will need a NordPass account to see and accept the invitation.

Nordpass via Jacob Roach

That’s it. Once they accept the invitation, your contact can request access at any time, which you can accept or deny within that seven-day window before your vault is unlocked. Regardless of the situation, if someone gets emergency access to your account, they can only view what’s inside. NordPass locks them out of editing, deleting, sharing, or doing anything else inside your vault.

The obvious downside with NordPass is that you can’t change the amount of time before access is handed over to your emergency contacts. If you, for whatever reason, can’t deny the request within seven days, NordPass unlocks your vault. You can dream up some scenarios where that could become a problem, but it shouldn’t, especially considering you can revoke access for your emergency contacts at any time.

**What You Should Store Beyond Passwords**

Proton Pass, 1Password, and NordPass are my personal favorite password managers, which is why I recommend them over options like Keeper, which also has a digital legacy feature. I also recommend them because they come with additional storage space. 1Password includes 1 GB, NordPass includes 3 GB, and Proton Pass comes with a whopping 10 GB—and that doesn’t include any storage through Proton Drive.

Storing your logins is important, but you can also store a lot of important documents in your password manager. That’s certainly more secure than throwing them in a shared Google Drive folder. If you want to do a digital inventory, here are a few things you should store in your password manager alongside your logins.

**Vehicle information.** You can wrap all of your vehicle information up into a single entry in your password manager. Scan your license and title, add insurance and vehicle information, and maybe loop in personal property tax receipts. NordPass, 1Password, and Proton Pass all allow you to add attachments to entries, as well as notes.

**Software licenses.** Most software today is sold with a software-as-a-service model, so accessing someone’s login is most important. If you have perpetual software licenses, though, you’ll probably want to add them to your vault as an encrypted note.

**Non-account secrets.** This is probably the most practical thing to store in your password manager in the event you need to transfer access. There are a ton of secrets you need to remember that aren’t tied to an online account. I’m talking about gate codes, PINs, and patterns for your devices, recovery codes, lock combinations; the list goes on. Store them in your vault as encrypted notes.

**2FA/MFA details.** A lot of password managers allow you to store 2FA codes, including Proton Pass and 1Password (though not NordPass). It’s not the best idea for security, but in the context of digital legacy, you should store some information about accounts that have 2FA enabled. Add a note to logins that have 2FA enabled, along with recovery information for those accounts.

**Pass on Your Passwords When You Pass**

Death isn’t fun to think about, no, but setting up your digital legacy is only becoming more important. Today, precious little exists only in the physical world; nearly everything is tied to an online account or service in some way. Dealing with who owns your digital assets is something you can define in a will or trust. But that doesn’t always account for the unexpected.

Emergency access is important if you pass away, but it’s also important if you can’t get access to your account for any reason, especially in the aftermath of an emergency.

Source

Wired