LGBTIQ+ organizations in El Salvador are using technology to protect themselves and create a record of the country’s ongoing authoritarian escalations against their community. It’s not without risks.

Steven Rodríguez traveled more than 40 miles from his home in Santa Ana, in western El Salvador, to attend the Pride march in the capital on June 28. It is the second time he has attended. There, some 20,000 people gathered in a mix of celebration and protest for the rights of sexual diversity. But this year, joy was replaced by fear.

“Maybe it won't escalate, but there is a fear that what happened to the El Bosque cooperative will happen. But, from deep down I believe that, as people, we have the right to a dignified life. If it's not me, who else is going to defend my experiences,” says Rodríguez about his decision to attend in the midst of the authoritarian escalation that the country is experiencing.

When Nayib Bukele assumed power in 2019, one of his first actions was to eliminate the Directorate of Sexual Diversity. In February 2024, during his participation in the Conservative Political Action Conference in the US, he made his position clear: “We do not allow those ideologies in schools and colleges. I think it is also important that the curriculum does not include gender ideology and such things.”

Natalia Alberto

Rodríguez's main fear is that the march will serve as an excuse to criminalize its attendees. Earlier this year, on May 12, a hundred members of the El Bosque cooperative held a peaceful protest to avoid being evicted. This was repressed by the military police and ended with the arrest of community leader José Ángel Pérez and lawyer Alejandro Henríquez for public disorder. Both are serving provisional detention in a penal center. In the past four months, at least six human rights defenders have been arrested in the country for political reasons.

On the afternoon of June 28, the march ended peacefully and, at least on the ground, no arrests were recorded.

**Training Day**

Rodríguez is part of a collective called Pedrina, which focuses on community articulation for LGBTIQ+ rights in the West. His approach to digital security began when members of the organization started receiving insults, threats, and hate messages on social networks.

Natalia Alberto

Rodríguez and his collective received digital security training from Amate, another LGBTIQ+ organization that advocates nationally. Since May, Amate has trained 60 people on issues including digital rights, risk analysis, extortion, phishing, outing, surveillance, and revenge porn. It also includes the implementation of tools such as the use of VPN and encrypted messaging platforms, such as Signal and Proton.

“Something that activists were telling us \[that\] is very common is that people take their Facebook photos and impersonate them on social networks, either to attack other collectives or to undermine personal aspects. So it's a very interesting experience. People are not aware of the exposure we have in the digital world,” says Fernando Paz, who is in charge of teaching these courses.

Natalia Alberto

For Rodríguez, these tools are a way of confronting a country that, with government support, is becoming increasingly violent towards those who represent diversity.

“At the university, we have had experiences of hate speech in classes. Professors have said that they share Bukele's thinking on gender ideology and that this has to disappear because it poisons the youth,” Rodríguez says.

One way the government has used to hide violence against the LGBTIQ+ community is the lack of accounting of hate crimes committed in El Salvador. In recent years, the country’s Attorney General's Office, also known as FGR, has used the categories “murder due to social intolerance” and “murder due to family intolerance” to count homicides that it cannot attribute to what it calls “general crime” (mostly, according to the government's narrative, perpetrated by gangs). There is no clarity about what falls into these categories, which are not official, are not defined, and are only used publicly—not within administrative reports. Between 2023 and 2024, the FGR counted 182 of these cases.

Natalia Alberto

**Hit Record**

In the face of statistical obscurity, the exercise of documenting and archiving hate crimes has been taken up by organizations. The Passionist Social Service, an anti-violence group, found that 154 LGBTIQ+ people have been detained during El Salvador's emergency regime, which began in March 2022 and has been extended 39 times to date. Following this, Nicola Chávez and her team saw the need to record cases of violence against members of the LGBTIQ+ population.

“We had always intended to start an observatory, but with the start of the exception regime everyone knows that police violence and military harassment have a disproportionate impact on the LGBT community. Obviously that hurts us, and I don't know who else they count on to be able to denounce,” Chávez says.

To date, Chávez's team has registered 68 incidents of violence against LGBTIQ+ people, although they believe there could be more. One of the main challenges has been to create a centralized database of the information that each member had kept on their own.

Natalia Alberto

“One of the big frustrations has always been that we don't have consistency when it comes to storing information,” Chávez says. “To make this database, I had to go from computer to computer, collecting information in emails and loose files.”

Chávez, a doctoral student in American Studies and archivist, applied her knowledge to compile and organize the information. For her, it's crucial to secure the databases that contain sensitive information related to the victims' allegations under the emergency regime. One of the keys is to protect the data with multiple layers of security and to use encrypted platforms with automatic self-destruct functions, such as CryptPad.

The authoritarian escalation in El Salvador has forced organizations to be more cautious with their public work. For this reason, Chávez requested that her organization not be mentioned for fear of reprisals following the recent approval of the Foreign Agents Law, which requires those receiving international funds to register as “foreign agents.” If authorized, they would be subject to a 30 percent tax on all foreign funding, a measure that opponents of the legislation say seeks to economically stifle dissenting voices.

Natalia Alberto

El Salvador's political situation has forced them to contemplate several scenarios on how to safeguard information. The most critical implies that the government may consider the activities of their organization as a direct contravention of the law and raid their offices. Another concern is that, at the time of registration, they will be required to hand over the contents of the devices.

“The registry is designed as an all-powerful entity. There are minimum requirements to be able to register, but they have the power to demand whatever they want,” says Chávez. “There are no limits in the regulations on what they can request. What worries us is that, as part of a routine process, they want to seize computers, hard disks, etc.”

Natalia Alberto

The passage of this law to control speech and information is not an isolated case. In November 2024, El Salvador's Congress passed laws establishing the creation of the State Cybersecurity Agency, whose powers include managing cyber threats and overseeing data protection compliance.

“The government of El Salvador has created an entire infrastructure to have not only social, but also digital control of the citizenry. With the creation of this agency, an oversight tool is enabled for issues related to information, the use of technology and our digital identity,” explains Joshi Leban, a specialist in advocacy and digital literacy.

The records that Chávez is so keenly guarding also have a vision in which this hope for justice persists.

“At some point, perhaps this will become an international litigation, or it may be that this government ends and a process of oversight of what has happened begins. In that scenario, it will serve that the organizations have put these facts on record as documentation.”

_This story originally appeared on WIRED en Español and has been translated from Spanish._

The Promise and Peril of Digital Security in the Age of Dictatorship

The Scattered Spider hacking group has caused chaos among retailers, insurers, and airlines in recent months. Researchers warn that its flexible structure poses challenges for defense.

Empty grocery store shelves and grounded planes tend to signal a crisis, whether it’s an extreme weather event, public health crisis, or geopolitical emergency. But these scenes of chaos in recent weeks in the United Kingdom, United States, and Canada were caused instead by financially motivated cyberattacks—seemingly perpetrated by a collective of joyriding teens.

A notorious cybercriminal group often called Scattered Spider is known for using social engineering techniques to infiltrate target companies by tricking IT help desk workers into granting them system access. Researchers say that the group seems to gain expertise about the backend systems commonly used by businesses in a particular industry and then uses this knowledge to hit a cluster of targets before moving on to another sector. The group often deploys ransomware or conducts data extortion attacks once it has compromised its victims.

Amid increasing pressure from law enforcement last year, which culminated in charges and arrests of five suspects allegedly linked to Scattered Spider, researchers say that the group was less active in 2024 and seemed to be attempting to lay low. The group’s escalating attacks in recent weeks, though, have shown that, far from being defeated, Scattered Spider is emboldened once again.

“There are some uniquely skilled actors in Scattered Spider when it comes to social engineering, and they have identified a major gap in our security systems that they’re successfully taking advantage of,” says John Hultquist, chief analyst in Google’s threat intelligence group. “This group is carrying out serious attacks on our critical infrastructure, and I hope that we’re not missing the opportunity to address the most imminent threat.”

Though a number of incidents have not been publicly attributed, an overwhelming spree of recent attacks on UK grocery store chains, North American insurers, and international airlines has broadly been tied to Scattered Spider. In May, the UK’s National Crime Agency confirmed it was looking at Scattered Spider in connection to the attacks on British retailers. And the FBI warned in an alert on Friday that it has observed “the cybercriminal group Scattered Spider expanding its targeting to include the airline sector.” The warning came as North American airlines Westjet and Hawaii Airlines said they had been victims of cybercriminal hacks. On Wednesday, the Australian airline Qantas also said it had been hit with a cyberattack, though it was not immediately clear if this attack was part of the group’s campaign.

“They slowed down, and we saw them dissipate for a while throughout 2024,” says Adam Meyers, a senior vice president for counter-adversary operations at the security company CrowdStrike. “Then they’ve roared back in the last couple of months, first hitting retail and then hitting insurance companies and most recently targeting airlines.”

Scattered Spider first emerged as a high-profile group toward the end of 2023 as its members moved from SIM swapping attacks to launching crippling ransomware attacks on Caesar’s Entertainment and MGM Resorts. The latter cost MGM around $100 million to recover from. Researchers emphasize that the collective is financially motivated, made up of mostly English-speaking teenagers and young men who are often based in the US or UK. The Scattered Spider hackers are considered an offshoot of the Com, an amorphous network of potentially thousands of trolls and criminals, many of whom engage in harassment, extortion, and child exploitation.

Scattered Spider members have increasingly coalesced around a tactic of using targeted social engineering to get a foothold inside company networks. Attackers may impersonate a staff member who is locked out of their company email account and contact the firm’s IT help desk to get access, before resetting multifactor authentication credentials. Researchers say that the group has also used a tactic of creating convincing phishing websites where the URLs often include the name of the target organization along with words like “okta,” “vpn” or “helpdesk.” Once inside networks, the hackers deploy various types of ransomware or steal data that is used to extort companies.

Meyers says Crowdstrike believes that Scattered Spider has roughly four core members, which drive the targeting of potential victims and “leverage” resources from the wider Com ecosystem as needed. The exact structure and size of Scattered Spider is unclear, but researchers agree that the group relies on an array of third-party services to carry out its attacks.

“Deterrence is extremely difficult because we’re essentially fighting a marketplace where a lot of the actors are replaceable,” Google’s Hultquist says. “For instance, Scattered Spider has worked with multiple ransomware services, so if one goes down there’s always someone to replace them.”

Aiden Sinnott, a senior threat researcher at cybersecurity company Sophos’ Counter Threat Unit, says that Scattered Spider and the Com more broadly are connected through relationships and communities on Discord servers or Telegram groups. “It’s this kind of evolving group where maybe new younger threat actors are coming in,” Sinnott says. “You can see this natural escalation progression as they learn skills of each other, and they're very big on sharing their wins as well.”

Some Scattered Spider members may target big-name companies, while others are involved in less high-profile activity. “There are groups, or individuals, who are really focused on hacking Coinbase accounts and stealing crypto and things like that,” Sinnott says. “So they’re not even focused on these big corporate organizations.”

As Hultquist puts it, "the activity is extremely resilient, because instead of fighting a single actor, we’re really fighting a marketplace.”

A Group of Young Cybercriminals Poses the ‘Most Imminent Threat’ of Cyberattacks Right Now

The US Justice Department revealed the identity theft number along with one arrest and a crackdown on “laptop farms” that allegedly facilitate North Korean tech worker impersonators across the US.

For years, the North Korean government has found a burgeoning source of sanctions-evading revenue by tasking its citizens with secretly applying for remote tech jobs in the West. A newly revealed takedown operation by American law enforcement makes clear just how much of the infrastructure used to pull off those schemes has been based in the United States—and just how many Americans' identities were stolen by the North Korean impersonators to carry them out.

On Monday, the Department of Justice announced a sweeping operation to crack down on US-based elements of the North Korean remote IT workers scheme, including indictments against two Americans who the government says were involved in the operations—one of whom the FBI has arrested. Authorities also searched 29 “laptop farms” across 16 states allegedly used to receive and host the PCs the North Korean workers remotely access, and seized around 200 of those computers as well as 21 web domains and 29 financial accounts that had received the revenue the operation generated. The DOJ’s announcement and indictments also reveal how the North Koreans didn’t merely create fake IDs to insinuate themselves into Western tech firms, according to authorities, but allegedly stole the identities of “more than 80 US persons” to impersonate them in jobs at more than a hundred US companies and funnel money to the Kim regime.

“It's huge,” says Michael Barnhart, an investigator focused on North Korean hacking and espionage at DTEX, a security firm focused on insider threats. “Whenever you have a laptop farm like this, that's the soft underbelly of these operations. Shutting them down across so many states, that's massive.”

In total, the DOJ says it's identified six Americans it believes were involved in a scheme to enable the North Korean tech worker impersonators, though only two have been named and criminally charged—Kejia Wang and Zhenxing Wang, both based in New Jersey—and only Zhenxing Wang has been arrested. Prosecutors accuse the two men of helping to steal the identities of scores of Americans for the North Koreans to assume, receiving laptops sent to them by their employers, setting up remote access for North Koreans to control those machines from across the world—often enabling that remote access using a hardware device called a “keyboard-video-mouse switch” or KVM—and creating shell companies and bank accounts that allowed the North Korean government to receive the salaries they allegedly earned. The DOJ says the two American men also worked with six named Chinese coconspirators, according to the charging documents, as well as two Taiwanese nationals.

To create the cover identities for the North Korean workers, prosecutors say the two Wangs accessed the personal details of more than 700 Americans in searches of private records. But for the individuals the North Koreans impersonated, they allegedly went far further, using scans of the identity theft victims' drivers' licenses and Social Security cards to enable the North Koreans to apply for jobs under their names, according to the DOJ.

It's not clear from the charging documents just how those personal documents were allegedly obtained. But DTEX's Barnhart says North Korean impersonation operations typically obtain Americans' identifying documents from dark web cybercriminal forums or data leak sites. In fact, he says the 80-plus stolen identities cited by the DOJ represent a tiny sample of thousands of US IDs he's seen pulled in some cases from North Korean hacking operations' infrastructure.

“They have a stable of these,” says Barnhart. “Any place a criminal is going to get an ID, they're just going to piggyback, because then they don't even have to carry out the breach. It's already out there.” Barnhart says he's seen North Korean impersonators go so far as to screen their stolen identities for criminal backgrounds and even choose to impersonate Americans who are based in states without income tax to maximize their earnings.

Distinct from the DOJ's charges against Kejia Wang and Zhenxing Wang, prosecutors also announced that the FBI had carried out searches of 21 other suspected laptop farms across 14 US states and seized approximately 137 PCs that prosecutors say were used in North Korean remote worker schemes. In two other cases, prosecutors say that North Koreans used the insider access they gained through impersonating Western tech workers at crypto firms to steal more than $900,000 worth of funds, including around $740,000 stolen from one Atlanta-based company.

While most of the North Korean impersonation schemes the DOJ sought to disrupt appeared to be focused on money, prosecutors also note that one of the companies the North Korean workers penetrated in the operation allegedly facilitated by the two Wangs was a California-based defense contractor focused on AI-related technology. In that instance, the government claims the North Korean impersonators also accessed and likely stole technical data, including some information sensitive enough to be protected under the export controls known as the International Trafficking in Arms Regulations, or ITAR.

While the raids, indictments, and arrests carried out by the DOJ and FBI are significant, DTEX's Barnhart says, they're far from the end of North Korea's attempts to infiltrate Western and, specifically, US companies, both for profit and for espionage. Only one suspect, after all, is in custody even among the individuals the DOJ has named—and countless more North Koreans involved in these types of schemes remain untouched within the regime's borders and in the neighboring regions of China where they operate.

“This is going to put a heavy dent in what they're doing,” says Barnhart. “But as we adapt, they adapt.”

Identities of More Than 80 Americans Stolen for North Korean IT Worker Scams

Plus: US feds charge alleged masterminds behind infamous forum, Scattered Spider targets airlines, and hackers open a valve at a Norwegian dam.

WIRED published a shocking investigation this week based on records, including audio recordings, of hundreds of emergency calls from United States Immigration and Customs Enforcement (ICE) detention centers. The calls—which include reports of incidents of staff sexual assaults, suicide attempts, and head injuries—indicate a system inundated by life-threatening incidents, delayed treatment, and overcrowding.

In a 6-3 decision on Friday, the US Supreme Court upheld a Texas porn ID law, finding that age verification for explicit sites is constitutional. In a dissent, Justice Elena Kagan warned that this determination ignores First Amendment precedent and will have privacy implications for adults.

Looking at the US bombing of Iranian nuclear sites last weekend, President Donald Trump posted initial announcements of the strikes on the social Network Truth Social, which then began suffering intermittent outages. And WIRED reported on assessments of the damage to the nuclear sites based on satellite photos taken before and after the bombing.

Meanwhile, Taiwan is scrambling to make its own unmanned aerial vehicles domestically as drones increasingly become a crucial weapon of war. The urgency comes as a potential conflict with China looms. And Telegram launched a purge of Chinese cryptocurrency markets last month, banning black markets that sold tens of billions of dollars in crypto-scam-related services. Now, though, the markets are rebranding and bouncing back with no further action from the communication platform.

But wait, there’s more! Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

Immigration and Customs Enforcement (ICE) is now using a mobile app called Mobile Fortify that allegedly allows agents to identify individuals by pointing a smartphone at their face or capturing contactless fingerprints, 404 Media reports. The app reportedly taps into government databases, including Customs and Border Protection’s Traveler Verification Service and a DHS biometric intelligence system, in an attempt to match facial images taken in the field against prior government-collected records. ICE says the tool is intended to help officers identify “unknown subjects,” but civil liberties advocates tell 404 Media that it may open the door to surveillance-driven profiling and wrongful arrests.

Nathan Freed Wessler of the ACLU told the site, “Face recognition technology is notoriously unreliable, frequently generating false matches and resulting in a number of known wrongful arrests across the country. Immigration agents relying on this technology to try to identify people on the street is a recipe for disaster. Congress has never authorized DHS to use face recognition technology in this way, and the agency should shut this dangerous experiment down."

**US Feds Charge Group of Alleged Hackers Behind a Notorious Cybercrime Forum**

Global law enforcement this week announced the bust of a group of alleged cybercriminal hackers accused of carrying out years of profit-focused data breaches and running a notorious cybercriminal forum and market known as Breachforums. French authorities arrested four members of the group who went by the names “ShinyHunters,” “Hollow,” “Noct,” and “Depressed,” though the police sources who shared the news with the French newspaper Le Parisien didn’t reveal the suspects’ real names. The US Justice Department, meanwhile, criminally charged Kai West, a young British man, with carrying out a broad, years-long hacking spree under the handle “Intelbroker” that inflicted $25 million total damage against victims before he was arrested in February. In addition to hacking and selling vast troves of stolen data, the group—or at least some subset of its members—appears to have served as administrators for Breachforums, a notorious sales forum for cybercriminal information and tools that was shut down in a law enforcement operation in 2023 but was later relaunched by its staff.

**Scattered Spider Hackers Shift Their Targeting to the Airline Industry**

The loose cybercriminal gang known as Scattered Spider has carried out data theft and ransomware incidents for years, most recently targeting the grocery industry, other retailers, and the insurance industry in the US and the UK. Now cybersecurity analysts at Mandiant and Palo Alto Networks say the group is turning their attention to the aviation and transportation sector. Specifically, hackers were behind a cybersecurity incident last week that took down some IT systems and the mobile app for Canadian airline WestJet, Axios reports. Now Hawaiian Airlines has said it’s experiencing a “cybersecurity incident” affecting its network, though it hasn’t yet revealed more details or any evidence that Scattered Spider is responsible. Cybersecurity firms tracking the group warn that other potential aviation and transportation industry targets should be on the lookout for the group, which often uses sophisticated social engineering to trick staff into letting them bypass multi-factor authentication and gain a foothold on target systems.

**Hackers Breach a Norwegian Dam to Open Valve**

Here’s a curiosity that we missed a couple weeks ago: A rare industrial control system hijacking incident in which an unknown hacker appears to have messed with the computer systems that control the Lake Risevatnet dam in southwest Norway, opening a valve to its maximum setting. The tampering, the motivation for which was far from clear, increased the dam’s water flow by nearly 500 liters a second, but didn’t come close to approaching a dangerous level. No one appears to have spotted the change for close to four hours. Officials told the Norwegian energy news outlet Energiteknikk, which broke the story, that a weak password on a web-accessible control panel allowed the unauthorized access.

ICE Rolls Facial Recognition Tools Out to Officers' Phones

In a 6-3 decision, the Supreme Court held that age verification for explicit sites is constitutional. In a dissent, Justice Elena Kagan warned it burdens adults and ignores First Amendment precedent.

If you try to access Pornhub, one of the world’s biggest websites, from any of 17 US states, you’ll be blocked. Pornhub’s parent company, Aylo Holdings, has restricted access in response to a slew of laws that says Pornhub itself should be responsible for checking that every visitor is over 18. Now, the United States Supreme Court has made a decision on a key age verification law, which could have ramifications for the entire country and the wider internet as a whole.

On Friday, in a 6–3 decision that could reshape the landscape of online privacy and free speech, the Supreme Court upheld in full the Texas age verification law—one of the first passed in the country—requiring many websites publishing pornographic content to check that all visitors are over 18. The law, TX HB1181, says sites that are “more than one-third sexual material” can face fines of up to $10,000 per day if they don’t put in place age verification systems, plus extra penalties of up to $250,000. It also states websites should display health warnings about the potential health risks of pornography.

Writing for the majority, Justice Clarence Thomas said that because the law "simply requires proof of age to access content that is obscene to minors, it does not directly regulate adults’ protected speech," adding, "adults have no First Amendment right to avoid age verification."

In her dissent, Justice Elena Kagan argued that the Texas law imposes a direct and unconstitutional burden on adults’ access to protected speech. “A State may not care much about safeguarding adults’ access to sexually explicit speech; a State may even prefer to curtail those materials for everyone,” she wrote, “but the First Amendment protects those sexually explicit materials, for every adult.”

The ruling marks a major victory for Texas attorney general Ken Paxton, who defended the law amid fierce opposition from digital rights groups and the adult entertainment industry.

Legislators in Texas passed HB1181 in early 2023, but it was struck down in the US District Court for the Western District of Texas for potentially being unconstitutional before the law went into effect. Adult industry group the Free Speech Coalition, among others, challenged the Texas law on the grounds that it violates the First Amendment by restricting adults’ access to constitutionally protected speech. In March last year, a Fifth Circuit appeals court upheld the Texas law before the Free Speech Coalition took the case to the Supreme Court in a January hearing.

In recent years, a wave of age verification laws have been proposed in states across the country. More than half of US states have passed or have tried to pass age verification laws, according to a tracker published by the Free Speech Coalition.

“Efforts to regulate online pornography are often the opening move in broader campaigns to censor the internet,” Jess Miers, a visiting assistant professor of law at the University of Akron School of Law, said before the decision. “While this case focuses on mandatory age verification for adult content, state lawmakers are hoping it provides a legal foundation to impose sweeping restrictions on a wide range of online material.”

Attempts to get pornographic websites to implement age checks—more than just clicking a button saying you are over 18—have been accelerating over the past decade, since government officials in the UK passed laws on age verification checks only to delay and abandon them in 2019. Since then, though, a wave of companies and technologies selling age-checking software has rapidly expanded and matured. Adult websites and pornographers aren’t against introducing robust age checks; they say they don’t want children to be exposed to illicit content.

Multiple methods of age verification, which is often called age assurance, have been proposed or developed in recent years, with regulators and governments around the world pushing for them to be used to stop children accessing content that may not be suitable for them. These age verification methods can include, but aren’t limited to, checking someone’s identity against government ID, providing banking details, or using face-checking systems that can predict someone’s age.

Typically, third-party companies are developing the age-checking methods, with adult websites paying to use their services. This can mean people do not directly share their ID documents or other details used to verify their age directly with pornography websites or the companies that own them. Some companies, including Pornhub owner Aylo Holdings and Meta, have argued that age checks should happen by Google and Apple on their respective app stores. Those companies don’t agree.

Repeatedly, privacy and civil liberties experts have stated that any data collection or understanding of how people consume pornography could have devastating consequences if there’s a data breach or information is leaked. (One ID verification company suffered a data breach last year.) Unscrupulous companies could also sell or share data, privacy advocates say.

Last week, the preliminary results of an age checking trial in Australia, which has passed laws to ban under-16s from social media apps, found such systems may not be effective. Plus, age checks can often be easily circumvented by using a VPN. Aylo has claimed that current age verification proposals aren’t effective and push people to smaller websites, which may have fewer safety tools in place to moderate images and videos.

Despite potential concerns, laws mandating companies use age verification systems are being introduced around the world, and multiple companies are adopting the systems. Since 2022, Instagram has been using facial age estimation software to check people’s ages. In April, chat app Discord announced it is testing face scans in the UK and Australia. Regulators in Germany have been pursuing age checks—going as far as to fine individuals posting on X (then Twitter) in 2023—for years. Last week, Pornhub returned to France—it pulled services relating to the country’s age checking at the start of June—after a court ruling limited the law. And by July this year, porn sites and social media platforms operating in the UK are required to introduce “robust” age checks. Pornhub owner Aylo announced on Thursday that it would adopt "government approved age assurance methods” to comply with the law.

With the Supreme Court’s Friday decision, the threat to pornography and sexual expression in the country may be more grave. The Heritage Foundation’s Project 2025 plan, which has been partially followed by the US government, has suggested criminalizing pornography and shutting down its producers. Earlier this year, Senator Mike Lee of Utah proposed the Interstate Obscenity Definition Act, which could redefine what’s considered “obscene” content and potentially ban pornography entirely.

“Once the state has the authority to restrict access to adult content, it will almost certainly broaden the definition of ‘material harmful to minors,’” Miers says. “This could include reproductive health information, LGBTQ+ resources, and educational content related to race, gender, or diversity.”

_Additional reporting by Dell Cameron._

US Supreme Court Upholds Texas Porn ID Law

Records of hundreds of emergency calls from ICE detention centers obtained by WIRED—including audio recordings—show a system inundated by life-threatening incidents, delayed treatment, and overcrowding.

‘They're Not Breathing’: Inside the Chaos of ICE Detention Center 911 Calls

Last month, Telegram banned black markets that sold tens of billions of dollars in crypto scam-related services. Now, as those markets rebrand and bounce back, it’s done nothing to stop them.

One month ago, the messaging app Telegram summarily beheaded the online industry of Chinese-language crypto scam services: It banned virtually all accounts related to the first and second most popular marketplaces for vendors offering money laundering, stolen data, and a variety of other illicit wares to the vast criminal enterprises carrying out investment scams from compounds across Southeast Asia.

Then, Telegram watched impassively as those black marketeers rebranded, rebuilt, and returned to business as usual on the messaging service's platform.

On Monday, crypto tracing firm Elliptic published a new report showing how the industry of Telegram-based Chinese-language black markets for crypto scammers has bounced back in the wake of Telegram's takedown last month of the two biggest of those bazaars, known as Haowang Guarantee and Xinbi Guarantee. Before Telegram banned the two markets' channels and usernames on May 13, they had together enabled a staggering $35 billion in transactions, much of which represented money laundering by crypto scam operations that steal billions from Western victims and force tens of thousands of people to carry out scams in forced labor compounds across Cambodia, Myanmar, and Laos. Since Telegram's purge, however, Elliptic has found that other smaller markets have now grown to almost entirely fill the vacuum those two key marketplaces left behind—and Telegram appears to have no plans to stop them.

In particular, one market called Tudou Guarantee, partially owned by Huione Group, the same parent company as the now-defunct Haowang Guarantee, has more than doubled in size, likely taking in many of the scammer-friendly services displaced by Telegram's bans and again enabling those fraudsters' billions of dollars a year in illicit revenue. Its main channel now has 289,000 users by Elliptic's count, close to the 296,000 users that Haowang Guarantee had at the time Telegram banned it. Xinbi Guarantee, too, has relaunched on new channels and regained hundreds of thousands of users, Elliptic says. In terms of sales, Tudou is now enabling around $15 million a day in crypto payments, close to the $16.4 million Haowang was facilitating daily, according to Elliptic.

“Telegram recognized this was illicit activity and the kind they didn't want to be hosting, and so they deleted the channels and banned the associated usernames. But it was clear that these people wouldn't just give up, that they would transfer to different marketplaces,” says Tom Robinson, Elliptic's cofounder. “These scammers have inflicted misery on millions of victims around the world, stealing billions of dollars. Unless these marketplaces are actively pursued, they will continue to flourish.”

Elliptic shared posts with WIRED from Tudou Guarantee—now by some measures the biggest black market on the internet—which show examples of money laundering services, offers of scam website development, and vendors selling stolen personal data that scammers use for targeting. Another Tudou post explicitly offers prostitution, including references to possible minors: “Students, queens, lolita,” the post states next to pictures of young women. “All available!!”

WIRED reached out to Tudou Guarantee for comment via an administrator's Telegram account but didn't receive a response.

Before they were taken down by Telegram, Xinbi Guarantee and Haowang Guarantee displayed similar posts offering explicitly illegal services in all those categories and more. Like the newly ascendant Tudou Guarantee, those other “Guarantee” marketplaces didn't directly sell services, but instead offered escrow and deposit features that prevent vendors from defrauding customers.

When WIRED asked Telegram in May about a report from Elliptic that focused on Xinbi Guarantee's criminal offerings, Telegram responded with a broad purge: It banned not only Xinbi's accounts but also those of Haowang Guarantee, the much larger market that had persisted for three years, enabled around $27 billion in transactions, and sold scam industry services as explicit as the batons and shackles used to imprison forced laborers in scam compounds.

In a statement sent to WIRED at the time, Telegram spokesperson Remi Vaughn wrote that “communities previously reported to us by WIRED or included in reports published by Elliptic have all been taken down,” and added that “criminal activities like scamming or money laundering are forbidden by Telegram's terms of service and are always removed whenever discovered.”

Since then, however, Elliptic has continued to share its findings about apparent money laundering activity on ten other markets, including Tudou Guarantee, in a Telegram group that included a WIRED reporter and a Telegram spokesperson. Yet Telegram didn't take down any of the accounts related to the black markets Elliptic highlighted. Xinbi Guarantee has, in fact, rebuilt at new accounts without even rebranding. It still hasn't faced new account bans, despite Telegram itself stating that the market's content violated its terms of service.

In a statement to WIRED, a Telegram spokesperson defended the company's apparent decision not to ban the rebounding black markets. “The channels in question predominantly involve users from China, where rigid capital controls often leave citizens with little choice but to seek alternative avenues for moving funds internationally,” the statement reads. "We assess reports on a case-by-case basis and categorically reject blanket bans—particularly when users are attempting to circumvent oppressive restrictions imposed by authoritarian regimes. We remain unwavering in our commitment to safeguarding user privacy and defending fundamental freedoms, including the right to financial autonomy.”

Elliptic's Robinson rejects that argument. “We've been researching these marketplaces for nearly two years now, and they're not about helping people achieve financial autonomy,” Robinson says. “These are marketplaces that primarily facilitate money laundering for the proceeds of fraud and other illicit activity."

Erin West, a former prosecutor who now leads the nonprofit Operation Shamrock, an organization focused on disrupting crypto scam operations, states her accusation against Telegram more simply. “These are bad guys, enabling bad-guy business on their bad-guy platform,” West argues. “They have the ability to shut down a scam economy and the trafficking of human beings. Instead, they’re hosting Craigslist for crypto scammers.”

Telegram's seemingly inconsistent approach to banning crypto-scam black markets may have less to do with its principles of “financial autonomy” than with trying not to run afoul of the US government, says Jacob Sims, a visiting fellow at Harvard University's Asia Center. In early May, the US Treasury's Financial Crimes Enforcement Network officially labeled Huione Group a “primary money laundering concern.” Sims argues that designation, which referred directly to Haowang Guarantee but not Tudou Guarantee, may have spurred Telegram to take action—and that it may take another similar move at the government level to push Telegram to act again.

“Ultimately, last month's crackdown shows how disruptive Telegram can be when it does cooperate, but it also shows how fast the scammers are going to adapt,” Sims says. “There's no real legal culpability that tech companies have for what happens on their platform unless there's a specific case brought to their attention by law enforcement. And so, until that changes, I just don't know what incentive they have to be proactive.”

_Updated at 2:30 pm ET, June 23, 2025: Clarified the period during which Haowang Guarantee had approximately 296,000 users._

Telegram Purged Chinese Crypto Scam Markets—Then Watched as They Rebuilt

Unmanned vehicles are increasingly becoming essential weapons of war. But with a potential conflict with China looming large, Taiwan is scrambling to build a domestic drone industry from scratch.

In the span of just a few years, drones have become instrumental in warfare. Conflicts in Ukraine, Iran, Nagorno-Karabakh, Sudan, and elsewhere have shown how autonomous vehicles have become a quintessential part of modern combat.

It’s a fact that Taiwan knows all too well. The island nation, fearing imminent invasion from China, has both the need, know-how, and industry necessary to build a robust and advanced drone program.

Yet Taiwan, which has set an ambitious target of producing 180,000 drones per year by 2028, is struggling to create this industry from scratch. Last year, it produced fewer than 10,000.

“Taiwan definitely has the ability to make the best drones in the world,” says Cathy Fang, a policy analyst at the Research Institute for Democracy, Society, and Emerging Technology (DSET).

So why doesn’t it?

**Designing a Hellscape**

Fang and her colleagues published a lengthy report on June 16 that reveals just how sluggish Taiwan’s drone industry has been. According to their research, the country has produced between 8,000 and 10,000 unmanned aerial vehicles (UAVs) over the past year, with “structural challenges” standing in the way of the current rate and the ambitious goal. Their study found that Taiwan’s drone production has been stymied by “high manufacturing costs, low domestic procurement, and minimal foreign government orders.”

Fang and other DSET researchers briefed WIRED on the details of their report in their Taipei offices in May.

Taiwan has lived under the threat of Chinese invasion for decades, but recent years have turned it into a more immediate possibility. Beijing has made clear that it intends to complete its aggressive modernization of the People’s Liberation Army by 2027; Taiwanese officials say invasion could come that early but almost certainly before Premier Xi Jinping’s current term in office ends in 2029.

While there are competing views about what form, exactly, Chinese military aggression could take, military analysts in Taiwan fear it could be a full combined arms onslaught: From air and sea at first, followed by a full land invasion.

That means Taiwan has an imperative to come up with innovative solutions to defend itself, and fast. As one American commander remarked in 2023, Taiwan’s self-defense will mean turning the Taiwan Strait into a “hellscape”—bombarding incoming Chinese ships and planes with swarms of uncrewed aerial and naval vehicles. This strategy doesn’t need to destroy the considerable Chinese navy and air force outright, but it does need to frustrate Beijing’s advances long enough for Taiwan’s allies to rally to its defense.

Taipei is already doing some of this right. In 2022, the government launched the Drone National Team, a program meant to match government and industry to scale up the nascent field. In particular, the team was dispatched to learn lessons from Ukraine, whose defensive strategy has relied heavily on small, tactical, cheap UAVs capable of carrying out multiple missions and integrating closely with ground units. Today, the country boasts a massive domestic drone industry, with Kyiv planning to buy 4.5 million small drones this year, on top of its long-range uncrewed missile program, its autonomous land vehicles, and its uncrewed naval drones.

But Ukraine also shows the disadvantage at which Taiwan finds itself. In a secret workshop in Kyiv, a Ukrainian drone maker told WIRED that he had no choice but to source his antennas and chips from China. Taiwanese chips were too expensive.

**Competing With DJI**

“We are not able to compete with DJI,” Fang says, referring to the massive Chinese drone manufacturer.

Other countries that have scaled up their drone programs recently have accepted Chinese technology in their supply chain—either as an asset or a necessary evil. But Taiwan, for obvious reasons, is leery of including any Chinese tech.

That makes drone manufacturing hard. China maintains a massive advantage in producing certain critical pieces of these UAVs—including the gimbals, optical sensors, and antennas. To buy that equipment, Taiwan needs to find allied suppliers, often at considerable cost.

Taiwan has even had difficulty leveraging its advantages. The country has an advanced battery industry, for example—but it’s heavily reliant on Chinese critical minerals. The island nation also boasts the world’s most impressive semiconductor industry: It produces 60 percent of the world’s semiconductors and 90 percent of the advanced semiconductors. But, Fang says, Taiwan does not produce any chips specifically for use on drones.

“Taiwanese drone makers are buying chips from Qualcomm and Nvidia, but those chips are not specifically for drones,” she says. “Those are communication chips, sensor chips, those are for more general use.” And even those general chips are significantly more expensive than their Chinese competitors, sometimes by a factor of 10.

“We definitely have the ability to make them,” Fang adds. “But the reason why these companies are not involved in this market is because the scale is just too small.”

It’s a catch-22: Taiwanese companies can’t increase production and reduce costs until they get more orders, but they can’t get more orders because their costs are too high.

“We need more government procurement from Taiwan itself,” Fang says. Thus far, the nation’s defense ministry has ordered fewer than 4,000 drones, although it plans to purchase tens of thousands more in the years to come. It owes to the fact, analysts say, that financing the kind of defense spending that Taiwan needs remains politically difficult. Earlier this year, opposition lawmakers in the Legislative Yuan passed a budget that slashed planned defense spending.

If Taiwan’s industry has any hope of growing by the scale the country needs, Fang says there’s a clear answer: America.

**Building an Army of Drones**

DSET has a number of recommendations, both for Taiwan and America, on how to establish this ambitious new industry. For starters, they argue, America needs to start actually supporting Taiwan’s local industry.

To date, no Taiwanese drone manufacturer has secured access to the Department of Defense’s “blue list”—its roster of trusted drone suppliers. Earning a spot on that list could mean millions or billions of dollars in orders from the Pentagon.

There has been some trade in the other direction. The US has supplied Taiwan with about 1,000 drones, mostly the smaller AeroVironment Switchblade loitering munition as well as a small number of the MQ-9 Reaper long-range drones.

The US has also been shipping some novel technology to Taiwan, including access to its Replicator Initiative: an autonomous drone swarm capability designed to find and destroy targets at sea.

But, DSET argues, some of these capabilities have been more a product of what the US thinks Taiwan needs. Washington could be more effective if it developed partnerships with Taiwanese industry, DSET contends, and make longer-term decisions about what Taipei needs for its self-defense. Finally, DSET writes, Washington should drop its tariffs—on Taiwanese UAVs, at the very least.

Taiwan itself has even more work to do. DSET recommends establishing a more detailed roadmap for what capabilities it wants and needs and how it intends to get there. While plenty of focus will be on the small, first-person-view drones—the kind increasingly ubiquitous in conflicts worldwide—Taiwan will need to expand into other kinds of technology.

While Taipei has identified a wide range of capabilities it hopes to acquire, DSET found it has been mostly procuring smaller surveillance drones.

Both Russia and Iran have recently shown how long-range uncrewed vehicles can be made at scale and significantly cheaper than traditional missiles. Perhaps more importantly, the DSET report argues, Taiwan needs to be able to plug into American needs and procurement programs—and America prioritizes longer-range systems.

The preponderance of these drones has also heightened the need for defenses, particularly around electronic warfare. Taipei is investing in anti-drone systems, Fang says, but it remains an “emerging concept.” (A defense analyst told WIRED that Taiwan is simply “not prepared to fight in a complex electromagnetic environment.”)

One of the weak points in China’s invasion will be its landing crafts. Beijing has been feverishly building a fleet of barges that would be able to transport troops and tanks across the Taiwan Strait. Taiwan has been developing domestically made submarines with the hope of sinking those barges before they arrive—that capability would be augmented significantly by autonomous or uncrewed submersibles.

Ukraine has pioneered its own models of semiautonomous uncrewed naval vehicles, which have successfully sunk Russian warships and damaged the Kerch Bridge in Crimea.

As Western nations get ambitious about how to mass-produce cost-effective and high-impact defense strategies, many are looking toward uncrewed vehicles as a silver bullet. But, as Taiwan shows, this is all easier said than done.

If Taiwan gets this wrong, DSET argues, “Taiwan risks falling into a gray zone of limited interoperability and unscalable production.” Meanwhile, “the US risks failing to develop trusted regional manufacturing capacity at the speed required to compete with China's drone diplomacy and defense exports.”

It may seem like an insurmountable challenge, especially for a nation facing an existential threat from a much bigger neighbor. But, as Fang points out, Ukraine was in the same situation. “Ukraine? They didn’t even imagine that kind of capacity three years ago,” she says. But a “sense of survival” kicked in, and Kyiv stood up the world’s most impressive indigenous drone manufacturing industry.

Taipei “is, right now, in low mode,” Fang says. “Because we are still not at war. But I don't want to underestimate our capacity, even though we are in a peacetime.”

Taiwan Is Rushing to Make Its Own Drones Before It's Too Late

The US concentrated its attack on Fordow, an enrichment plant built hundreds of feet underground. Aerial photos give important clues about what damage the “bunker-buster” bombs may have caused.

When the United States bombed Iran in the early hours of Sunday local time, it targeted three facilities central to the country’s nuclear ambitions: the Fordow uranium enrichment plant, the Natanz nuclear facility, and the Isfahan nuclear technology center. Newly released satellite images show the impact of the attack—at least, what can be seen on the ground.

The brunt of the bombing focused on Fordow, where US forces dropped a dozen GBU-57 massive ordnance penetrators as part of its “Midnight Hammer” operation. These 30,000-pound “bunker-buster” bombs are designed to penetrate as deep as 200 feet into the earth before detonating. The Fordow complex is approximately 260 feet underground.

That gap accounts for some of the uncertainty over exactly how much damage the Fordow site sustained. President Donald Trump shared a post on his Truth Social platform following the attack that declared “Fordow is gone,” and later said in a televised address that “Iran’s key nuclear enrichment facilities have been completely and totally obliterated.” His own military, however, was slightly more circumspect about the outcome in a Sunday morning briefing. “It would be way too early for me to comment on what may or may not still be there,” said general Dan Caine, chairman of the Joint Chiefs of Staff.

Satellite imagery can inherently only tell you so much about a structure that is situated so far below the surface of the earth. But before and after imagery is the best publicly available information about the bombing’s impact.

A satellite image from before the US bombing of Fordow.

Photo: MAXAR Technologies/Handout via Reuters

A satellite image from after the US bombing of Fordow.

Photo: MAXAR Technologies/Handout via Reuters

“What we see are six craters, two clusters of three, where there were 12 massive ordnance penetrators dropped,” says Jeffrey Lewis, director of the East Asia Nonproliferation Program at the Middlebury Institute's James Martin Center for Nonproliferation Studies. “The idea is you hit the same spot over and over again to kind of dig down.”

The specific locations of those craters matter as well, says Joseph Rodgers, deputy director and fellow at the Center for Strategic and International Studies’ Project on Nuclear Issues. While the entrance tunnels to the Fordow complex appear not to have been targeted, US bombs fell on what are likely ventilation shafts, based on satellite images of early construction at the site.

“The reason that you’d want to target a ventilation shaft is that it’s a more direct route to the core components of the underground facility,” says Rodgers.

That direct route is especially important given how deep underground Fordow was built. The US military relies on “basically a computer model” of the facility, says Lewis, which tells them “how much pressure it could take before it would severely damage everything inside and maybe even collapse the facility.” By bombarding specific targeted areas with multiple munitions, the US didn’t need bombs capable of penetrating the full 260 feet to cause substantial damage.

“They’re probably not trying to get all the way into the facility. They’re probably just trying to get close enough to it and crush it with a shockwave,” Lewis says. “If you send a big enough shockwave through that facility, it’s going to kill people, break stuff, damage the integrity of it.”

A closer satellite view shows the impact craters and a nearby support structure.

Photo: MAXAR Technologies/Handout via Reuters

It’s also notable what US bombs didn’t hit. The oblong white building in satellite images of Fordow is likely key support infrastructure for the facility, potentially providing everything from air-conditioning to backup power generation. “The US didn’t even bother targeting it. That clearly indicates to me that they weren’t trying to temporarily shut down the facility,” Rodgers says. “We targeted these apparent ventilation shafts so that we could structurally destroy or do as much damage as we could rather than temporarily try to shut down Fordow.”

Once a long-held secret, Fordow's existence was first officially acknowledged by the Iranian government in 2009. The facility is believed to be capable of enriching uranium to 60 percent. From there, experts say, it can relatively quickly be further enriched to 90 percent, the level needed for constructing nuclear weapons.

The US bombing came more than a week after Israel launched a series of attacks on Iran with the stated goal of stopping Tehran’s nuclear program. Israel lacks munitions capable of reaching deeply buried facilities like Fordow, which appears to be why the US entered the fray.

It is currently unclear how impactful this weekend’s bombing campaign will be on Iran’s long-term nuclear ambitions. Lewis says the strike was “tactically brilliant, but strategically incomplete,” because Iranians still have nuclear material that can be enriched to weapons-grade levels. “They still have underground facilities where they could do that, and they still have the ability to produce centrifuge components, so they can still make the centrifuges for the facilities.”

Further complicating the assessment of the Fordow damage is that satellite images from earlier last week show a significant amount of activity at the site, including more than a dozen trucks going to and from it. “I think there were some defense operations going on,” says Rodgers. “They probably brought those dump trucks in to try to seal off the tunnel entrances, to help protect against attacks.” There’s also the possibility that Iran was able to move nuclear material out of the facility before the attack, limiting the bombing’s usefulness.

Ultimately, Iran’s nuclear program has likely “been damaged,” Lewis says. “It has not been eliminated.”

What Satellite Images Reveal About the US Bombing of Iran's Nuclear Sites

The social network started experiencing global outages within minutes of Donald Trump posting details of a US military strike on Iran.

Truth Social malfunctioned on Saturday night amid President Donald Trump’s announcement that the United States had bombed Iran’s nuclear facilities.

Starting around 8 pm ET on Saturday, attempts to load the social network, which is owned by Trump Media & Technology Group (TMTG), displayed error messages. “Network failed,” a message on Truth Social reads. “Please try again.”

Trump’s initial Truth Social announcement that the United States had entered Israel’s war against Iran posted at 7:46 pm ET, stating that the US had waged a “very successful attack on the three Nuclear sites in Iran, including Fordow, Natanz, and Esfahan.” Trump’s account on the social media platform X posted a screenshot of the bombing announcement at 7:53 pm ET.

“All planes are now outside of Iran air space. A full payload of BOMBS was dropped on the primary site, Fordow,” Trump continued. “All planes are safely on their way home. Congratulations to our great American Warriors. There is not another military in the World that could have done this. NOW IS THE TIME FOR PEACE! Thank you for your attention to this matter.”

Trump frequently shares posts to Truth Social about issues of national and international importance. The president appeared to post multiple times after news of the US bombings against Iran were first announced. Trump’s stake in Truth Social’s parent company, TMTG, is currently worth more than $2 billion.

DownDetector, a website that crowdsources service outages, saw an influx of reports of Truth Social going down around 8 pm. The reason for the apparent outage was not immediately clear. NetBlocks, which monitors internet accessibility, posted on BlueSky just before 9 pm ET: “Truth Social is experiencing international outages for many users after US President Donald Trump announces strikes on three nuclear sites in Iran; incident not related to country-level internet disruptions or filtering.”

Truth Social did not immediately respond to WIRED’s requests for comment.

US and Iranian officials, speaking on the condition of anonymity, confirmed to The New York Times that US forces had conducted airstrikes on the Fordo and Natanz facilities. The condition of the US targets were not yet confirmed as of just before 9 pm ET.

Israel first began bombing targets in Iran on June 13. The two countries have repeatedly targeted each other since.

On Wednesday, Truth Social reportedly sent an email to at least some users encouraging them to follow Trump’s account. The email read in part, “If you aren’t following President Donald J. Trump on Truth Social, you’re missing an essential resource for navigating world affairs today.”

Trump will hold a televised address at 10 pm ET, according to the White House press secretary, Karoline Leavitt.

Source

Wired