There is no evidence the footage was deceptively manipulated, but ambiguities around how the video was processed may further fuel conspiracy theories about Epstein’s death.

The United States Department of Justice this week released nearly 11 hours of what it described as “full raw” surveillance footage from a camera positioned near Jeffrey Epstein’s prison cell the night before he was found dead. The release was intended to address conspiracy theories about Epstein’s apparent suicide in federal custody. But instead of putting those suspicions to rest, it may fuel them further.

Metadata embedded in the video and analyzed by WIRED and independent video forensics experts shows that rather than being a direct export from the prison’s surveillance system, the footage was modified, likely using the professional editing tool Adobe Premiere Pro. The file appears to have been assembled from at least two source clips, saved multiple times, exported, and then uploaded to the DOJ’s website, where it was presented as “raw” footage.

Experts caution that it’s unclear what exactly was changed, and that the metadata does not prove deceptive manipulation. The video may have simply been processed for public release using available software, with no modifications beyond stitching together two clips. But the absence of a clear explanation for the processing of the file using professional editing software complicates the Justice Department’s narrative. In a case already clouded by suspicion, the ambiguity surrounding how the file was processed is likely to provide fresh fodder for conspiracy theories.

Any aspect of the official story that isn’t fully explained will be co-opted by conspiracy theorists, says Mike Rothschild, an author who writes about conspiracy theories and extremists. “So whatever your flavor of Epstein conspiracy is, the video will help bolster it.”

For months leading up to the joint memo the DOJ and FBI published Monday, attorney general Pam Bondi had promised the release of records related to Epstein, raising expectations that new, potentially incriminating details might surface about the disgraced financier’s death and his ties to powerful individuals. However, rather than revealing new information, the memo largely confirmed conclusions reached years earlier: that Epstein was found in a Manhattan prison cell on August 10, 2019, and died by suicide while awaiting trial on sex trafficking charges.

To support its conclusion, the FBI reviewed surveillance footage overlooking the common area of the Special Housing Unit (SHU) at the Metropolitan Correctional Center (MCC), where Epstein was held. The FBI enhanced the footage by adjusting contrast, color, and sharpness, and released both the enhanced and what it described as the “raw” version. Both versions of the video appear to have been processed using Premiere and include much of the same metadata. According to the FBI, anyone entering the area containing Epstein’s cell during the relevant time frame would have been visible on that camera.

Working with two independent video forensics experts, WIRED examined the 21-gigabyte files released by the DOJ. Using a metadata tool, reporters analyzed both Exchangeable Image File Format (EXIF) and Extensible Metadata Platform (XMP) data to identify signs of postprocessing.

The “raw” file shows clear signs of having been processed using an Adobe product, most likely Premiere, based on metadata that specifically references file extensions used by the video editing software. According to experts, Adobe software, including Premiere and Photoshop, leaves traces in exported files, often embedding metadata that logs which assets were used and what actions were taken during editing. In this case, the metadata indicates the file was saved at least four times over a 23-minute span on May 23, 2025, by a Windows user account called “MJCOLE~1.” The metadata does not show whether the footage was modified before each time it was saved.

The embedded data suggest the video is not a continuous, unaltered export from a surveillance system, but a composite assembled from at least two separate MP4 files. The metadata includes references to Premiere project files and two specific source clips—2025-05-22 21-12-48.mp4 and 2025-05-22 16-35-21.mp4. These entries appear under a metadata section labeled “Ingredients,” part of Adobe’s internal schema for tracking source material used in edited exports. The metadata does not make clear where in the video the two clips were spliced together.

Hany Farid, a professor at UC Berkeley whose research focuses on digital forensics and misinformation, reviewed the metadata at WIRED’s request. Farid is a recognized expert in the analysis of digital images and the detection of manipulated media, including deepfakes. He has testified in numerous court cases involving digital evidence.

Farid says the metadata raises immediate concerns about chain of custody—the documented handling of digital evidence from collection to presentation in a courtroom. Just like physical evidence, he explains, digital evidence must be handled in a way that preserves its integrity; metadata, while not always precise, can provide important clues about whether that integrity has been compromised.

“If a lawyer brought me this file and asked if it was suitable for court, I’d say no. Go back to the source. Do it right,” Farid says. “Do a direct export from the original system—no monkey business.”

Farid points to another anomaly: The video’s aspect ratio shifts noticeably at several points. “Why am I suddenly seeing a different aspect ratio?” he asks.

Farid cautions that while the metadata clearly shows the video was modified, the changes could be benign—for example, converting footage from a proprietary surveillance format to a standard MP4.

While there may be uncontroversial explanations for the metadata artifacts, such as stitching together multiple days of footage during compilation, or the routine export of surveillance footage to an mp4 format, the FBI did not respond to specific questions about the file’s processing, instead referring WIRED to the DOJ. The DOJ in turn referred inquiries back to the FBI and the Bureau of Prisons. The BOP did not respond to a request for comment.

According to a 2023 report from the DOJ Office of the Inspector General (OIG), MCC, the detention facility where Epstein was found hanged, had around 150 analog surveillance cameras—but starting on July 29, 2019, a technical error prevented roughly half of them from recording, including most inside the SHU.

The system was scheduled for repairs on August 9, the night before Epstein was found dead. But the technician assigned to fix it couldn’t access the necessary equipment because the corrections officer required to escort him was nearing the end of their shift.

As a result, only two cameras were operational near the SHU at the time MCC staff found Epstein hanging in his cell: one covering the common area and stairwells near the entrance to the adjacent 10 South Unit, and another monitoring a ninth-floor elevator bay. Neither captured Epstein’s cell door.

According to the DOJ’s memo, the footage confirms that from the time Epstein was locked in his cell at approximately 8 pm on August 9, 2019, and between around 10:40 pm and 6:30 am the next morning, no one entered the tier where his cell was located. However, the recording includes a notable gap: Approximately one minute of footage is missing, from 11:58:58 pm to 12:00:00 am. The video resumes immediately afterward.

The OIG’s report found no evidence of a conspiracy to kill Epstein. Instead, it documented years of chronic staffing failures and system breakdowns at MCC. The facility was temporarily closed in 2021 after the DOJ essentially deemed conditions unfit for incarceration.

At a press conference on Tuesday, Bondi attributed the missing minute to a flaw in the surveillance system’s daily cycle, claiming that one minute is missing from every night’s recording.

Given the years of high-profile conspiracy theories surrounding Epstein, any perceived inconsistency in the official narrative is likely to draw intense scrutiny. Conspiracy theorist Alex Jones called the DOJ memo “sickening.” “Next the DOJ will say, ‘Actually, Jeffrey Epstein never even existed,’” he wrote in a post on X.

“In the world of conspiracy theories, evidence that disproves something happened becomes proof that something happened,” says Rothschild. He explains that the case of Epstein's death is a good example of this phenomenon. “Every piece of evidence that points to him taking his own life—the negligence of the prison staff, the disrepair of the cameras, the coroner's report—is turned into evidence that he was killed by powerful figures who weren't competent enough to cover up the crime correctly.”

The apparent gaps in the video, Rothschild says, will naturally inflame these suspicions.

One media forensics expert, who reviewed the metadata and agreed with WIRED’s analysis but requested anonymity due to privacy concerns and a desire to avoid having their name publicly associated with anything related to the Epstein case, put it bluntly: “It looks suspicious—but not as suspicious as the DOJ refusing to answer basic questions about it.”

Metadata Shows the FBI’s ‘Raw’ Jeffrey Epstein Prison Video Was Likely Modified

DHS is urging law enforcement to treat even skateboarding and livestreaming as signs of violent intent during a protest, turning everyday behavior into a pretext for police action.

The Department of Homeland Security is urging local police to consider a wide range of protest activity as violent tactics, including mundane acts like riding a bike or livestreaming a police encounter, WIRED has learned.

Threat bulletins issued during last month’s “No Kings” protests warn that the US government’s aggressive immigration raids are almost certain to accelerate domestic unrest, with DHS saying there’s a “high likeliness” more Americans will soon turn against the agency, which could trigger confrontations near federal sites.

Blaming intense media coverage and backlash to the US military deployment in Los Angeles, DHS expects the demonstrations to “continue and grow across the nation” as protesters focused on other issues shift to immigration, following a broad “embracement of anti-ICE messaging.”

The bulletins—first obtained by the national security nonprofit Property of the People through public records requests—warn that officers could face assaults with fireworks and improvised weapons: paint-filled fire extinguishers, smoke grenades, and projectiles like bottles and rocks.

At the same time, the guidance urges officers to consider a range of nonviolent behavior and common protest gear—like masks, flashlights, and cameras—as potential precursors to violence, telling officers to prepare “from the point of view of an adversary.”

Protesters on bicycles, skateboards, or even “on foot” are framed as potential “scouts” conducting reconnaissance or searching for “items to be used as weapons.” Livestreaming is listed alongside “doxxing” as a “tactic” for “threatening” police. Online posters are cast as ideological recruiters—or as participants in “surveillance sharing.”

One list of “violent tactics” shared by the Los Angeles–based Joint Regional Intelligence Center—part of a post-9/11 fusion network—includes both protesters’ attempts to avoid identification and efforts to identify police. The memo also alleges that face recognition, normally a tool of law enforcement, was used against officers.

Vera Eidelman, a senior staff attorney with the American Civil Liberties Union, says the government has no business treating constitutionally protected activities—like observing or documenting police—as threats.

DHS did not respond to a request for comment.

“Exercising those rights shouldn't be justification for adverse action or suspicion by the government,” Eidelman says. Labeling something as harmless as skateboarding at a protest as a violent threat is “disturbing and dangerous,” she adds, and could “easily lead to excessive force against people who are simply exercising their First Amendment rights.”

“The DHS report repeatedly conflates basic protest, organizing, and journalism with terroristic violence, thereby justifying ever more authoritarian measures by law enforcement,” says Ryan Shapiro, executive director of Property of the People. “It should be sobering, if unsurprising, that the Trump regime’s response to mass criticism of its police state tactics is to escalate those tactics.”

Fusion centers like JRIC play a central role in how police understand protest movements. The intelligence they produce is rapidly disseminated and draws heavily on open-source data. It often reflects broad, risk-averse assumptions and includes fragmentary and unverified information. In the absence of concrete threats, bulletins often turn to ideological language and social media activity as evidence of emerging risks, even when tied to lawful expression.

DHS’s risk-based approach reflects a broader shift in US law enforcement shaped by post-9/11 security priorities—one that elevates perceived intent over demonstrable wrongdoing and uses behavior cues, affiliations, and other potentially predictive indicators to justify early intervention and expanded surveillance.

A year ago, DHS warned that immigration-related grievances were driving a spike in threats against judges, migrants, and law enforcement, predicting that new laws and high-profile crackdowns would further radicalize individuals. In February, another fusion center reported renewed calls for violence against police and government officials, citing backlash to perceived federal overreach and identifying then-upcoming protests and court rulings as likely triggers.

At times, the sprawling predictions may appear prescient, echoing real-world flashpoints: In Alvarado, Texas, an alleged coordinated ambush at a detention center this week drew ICE agents out with fireworks before gunfire erupted on July 4, leaving a police officer shot in the neck. (Nearly a dozen arrests have been made, at least 10 on charges of attempted murder.)

In advance of protests, agencies increasingly rely on intelligence forecasting to identify groups seen as ideologically subversive or tactically unpredictable. Demonstrators labeled “transgressive” may be monitored, detained without charges, or met with force.

Social movement scholars widely recognize the introduction of preemptive protest policing as a departure from late-20th century approaches that prioritized de-escalation, communication, and facilitation. In its place, authorities have increasingly emphasized control of demonstrations through early intervention, surveillance, and disruption—monitoring organizers, restricting public space, and responding proactively based on perceived risks rather than actual conduct.

Infrastructure initially designed to combat terrorism now often serves to monitor street-level protests, with virtual investigations units targeting demonstrators for scrutiny based on online expression. Fusion centers, funded through DHS grants, have increasingly issued bulletins flagging protest slogans, references to police brutality, and solidarity events as signs of possible violence—disseminating these assessments to law enforcement absent clear evidence of criminal intent.

Surveillance of protesters has included the construction of dossiers (known as “baseball cards”) with analysts using high-tech tools to compile subjects’ social media posts, affiliations, personal networks, and public statements critical of government policy.

Obtained exclusively by WIRED, a DHS dossier on Mahmoud Khalil, the former Columbia graduate student and anti-war activist, shows that analysts drew information from Canary Mission, a shadowy blacklist that anonymously profiles critics of Israeli military action and supporters of Palestinian rights.

In federal court Wednesday, a senior DHS official acknowledged that material from Canary Mission had been used to compile more than 100 dossiers on students and scholars, despite the site's ideological slant, mysterious funding, and unverifiable sourcing.

Threat bulletins can also prime officers to anticipate conflict, shaping their posture and decisions on the ground. In the wake of violent 2020 protests, the San Jose Police Department in California cited the “numerous intelligence bulletins” it received from its local regional fusion center, DHS, and the FBI, among others, as central to understanding “the mindset of the officers in the days leading up to and throughout the civil unrest.”

Specific bulletins cited by the SJPD—whose protest response prompted a $620,000 settlement this month—framed the demonstrations as possible cover for “domestic terrorists,” warned of opportunistic attacks on law enforcement and promoted an “unconfirmed report” of U-Haul vans purportedly being used to ferry weapons and explosives.

Subsequent reporting in the wake of BlueLeaks—a 269-gigabyte dump of internal police documents obtained by a source identifying as the hacktivist group Anonymous and published by transparency group Distributed Denial of Secrets—found federal bulletins riddled with unverified claims, vague threat language, and outright misinformation, including alerts about a parody website that supposedly paid protesters and accepted bitcoin to set cars on fire, despite a clear banner labeling the site “FAKE.”

Threat alerts—unclassified and routinely accessible to the press—can help law enforcement shape public perception of protests before they begin, laying the groundwork to legitimize aggressive police responses. Unverified DHS warnings about domestic terrorists infiltrating demonstrations in 2020, publicly echoed by the agency’s acting secretary on Twitter, were widely circulated and amplified in media coverage.

Americans are generally opposed to aggressive protest crackdowns, but when they do support them, fear is often the driving force. Experimental research suggests that support for the use of coercive tactics hinges less on what protesters actually do than on how they’re portrayed—by officials, the media, and through racial and ideological frames.

DHS Tells Police That Common Protest Activities Are ‘Violent Tactics’

Basic security flaws left the personal info of tens of millions of McDonald’s job-seekers vulnerable on the “McHire” site built by AI software firm Paradox.ai.

If you want a job at McDonald’s today, there’s a good chance you'll have to talk to Olivia. Olivia is not, in fact, a human being, but instead an AI chatbot that screens applicants, asks for their contact information and résumé, directs them to a personality test, and occasionally makes them “go insane” by repeatedly misunderstanding their most basic questions.

Until last week, the platform that runs the Olivia chatbot, built by artificial intelligence software firm Paradox.ai, also suffered from absurdly basic security flaws. As a result, virtually any hacker could have accessed the records of every chat Olivia had ever had with McDonald's applicants—including all the personal information they shared in those conversations—with tricks as straightforward as guessing the username and password “123456."

On Wednesday, security researchers Ian Carroll and Sam Curry revealed that they found simple methods to hack into the backend of the AI chatbot platform on McHire.com, McDonald's website that many of its franchisees use to handle job applications. Carroll and Curry, hackers with a long track record of independent security testing, discovered that simple web-based vulnerabilities—including guessing one laughably weak password—allowed them to access a Paradox.ai account and query the company's databases that held every McHire user's chats with Olivia. The data appears to include as many as 64 million records, including applicants' names, email addresses, and phone numbers.

Carroll says he only discovered that appalling lack of security around applicants' information because he was intrigued by McDonald's decision to subject potential new hires to an AI chatbot screener and personality test. “I just thought it was pretty uniquely dystopian compared to a normal hiring process, right? And that's what made me want to look into it more,” says Carroll. “So I started applying for a job, and then after 30 minutes, we had full access to virtually every application that's ever been made to McDonald's going back years.”

When WIRED reached out to McDonald’s and Paradox.ai for comment, a spokesperson for Paradox.ai shared a blog post the company planned to publish that confirmed Carroll and Curry’s findings. The company noted that only a fraction of the records Carroll and Curry accessed contained personal information, and said it had verified that the account with the “123456” password that exposed the information “was not accessed by any third party” other than the researchers. The company also added that it’s instituting a bug bounty program to better catch security vulnerabilities in the future. “We do not take this matter lightly, even though it was resolved swiftly and effectively,” Paradox.ai’s chief legal officer, Stephanie King, told WIRED in an interview. “We own this.”

In its own statement to WIRED, McDonald’s agreed that Paradox.ai was to blame. “We’re disappointed by this unacceptable vulnerability from a third-party provider, Paradox.ai. As soon as we learned of the issue, we mandated Paradox.ai to remediate the issue immediately, and it was resolved on the same day it was reported to us,” the statement reads. “We take our commitment to cyber security seriously and will continue to hold our third-party providers accountable to meeting our standards of data protection.”

One of the exposed interactions between a job applicant and “Olivia.”

Courtesy of Ian Carroll and Sam Curry

Carroll says he became interested in the security of the McHire website after spotting a Reddit post complaining about McDonald's hiring chatbot wasting applicants' time with nonsense responses and misunderstandings. He and Curry started talking to the chatbot themselves, testing it for “prompt injection” vulnerabilities that can enable someone to hijack a large language model and bypass its safeguards by sending it certain commands. When they couldn't find any such flaws, they decided to see what would happen if they signed up as a McDonald's franchisee to get access to the backend of the site, but instead spotted a curious login link on McHire.com for staff at Paradox.ai, the company that built the site.

On a whim, Carroll says he tried two of the most common sets of login credentials: The username and password “admin," and then the username and password “123456.” The second of those two tries worked. “It's more common than you'd think,” Carroll says. There appeared to be no multifactor authentication for that Paradox.ai login page.

With those credentials, Carroll and Curry could see they now had administrator access to a test McDonald's “restaurant” on McHire, and they figured out all the employees listed there appeared to be Paradox.ai developers, seemingly based in Vietnam. They found a link within the platform to apparent test job postings for that nonexistent McDonald's location, clicked on one posting, applied to it, and could see their own application on the backend system they now had access to. (In its blog post, Paradox.ai notes that the test account had “not been logged into since 2019 and frankly, should have been decommissioned.”)

That's when Carroll and Curry discovered the second critical vulnerability in McHire: When they started messing with the applicant ID number for their application—a number somewhere above 64 million—they found that they could increment it down to a smaller number and see someone _else_'s chat logs and contact information.

The two security researchers hesitated to access too many applicants' records for fear of privacy violations or hacking charges, but when they spot-checked a handful of the 64-million-plus IDs, all of them showed very real applicant information. (Paradox.ai says that the researchers accessed seven records in total, and five contained personal information of people who had interacted with the McHire site.) Carroll and Curry also shared with WIRED a small sample of the applicants' names, contact information, and the date of their applications. WIRED got in touch with two applicants via their exposed contact information, and they confirmed they had applied for jobs at McDonald's on the specified dates.

The personal information exposed by Paradox.ai's security lapses isn't the most sensitive, Carroll and Curry note. But the risk for the applicants, they argue, was heightened by the fact that the data is associated with the knowledge of their employment at McDonald's—or their intention to get a job there. “Had someone exploited this, the phishing risk would have actually been massive,” says Curry. “It's not just people's personally identifiable information and résumé. It's that information for people who are looking for a job at McDonald's, people who are eager and waiting for emails back.”

That means the data could have been used by fraudsters impersonating McDonald's recruiters and asking for financial information to set up a direct deposit, for instance. “If you wanted to do some sort of payroll scam, this is a good approach,” Curry says.

The exposure of applicants' attempts—and in some cases failures—to get what is often a minimum-wage job could also be a source of embarrassment, the two hackers point out. But Carroll notes that he would never suggest that anyone should be ashamed of working under the Golden Arches.

“I have nothing but respect for McDonald’s workers,” he says. “I go to McDonald's all the time.”

_Updated at 5 pm ET, July 9, 2025 to make clear that the phishing risks would only be possible if someone had the opportunity to exploit the data._

McDonald’s AI Hiring Bot Exposed Millions of Applicants' Data to Hackers Using the Password ‘123456’

Plus: Iran-linked hackers threaten to release Trump campaign emails, Chinese hackers still in US telecoms networks, and an abusive deepfake website plans an expansion.

In recent years, North Korea has deployed thousands of so-called IT workers to infiltrate Western businesses, get paid salaries, and send money back to support the regime. As the schemes have become more successful, they have grown increasingly elaborate and employed new tactics to evade detection.

But this week, the United States Justice Department revealed one of its biggest operations to tackle IT workers to date. The DOJ says it has identified six Americans who allegedly helped enable the schemes and has arrested one of them. Law enforcement officials searched 29 “laptop farms” in 16 states and seized more than 200 computers, as well as web domains and financial accounts.

Meanwhile, a group of young cybercriminals has been causing chaos around the world, leaving grocery stores empty and temporarily grounding some flights in the wake of their crippling cyberattacks. After a quiet period in 2024, the Scattered Spider hackers have returned this year and are ruthlessly targeting retailers, insurers, and airlines.

Also this week, we’ve detailed how LGBTIQ+ organizations in El Salvador are helping activists chronicle attacks against their community and better protect themselves against state surveillance.

And there’s more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

Cell-site simulators, often known as stingrays or IMSI catchers, are some of the most stealthy and powerful surveillance tools in operation today. The devices, which impersonate cell towers and intercept communications, can collect call metadata, location information, and other traffic about what you do on your devices. They’ve increasingly been used by law enforcement and immigration officials.

However, according to reporting from Android Authority and Ars Technica, upcoming hardware advances has led to Google upping its efforts to combat the potential snooping. Starting in Android 16, compatible devices will be able to identify when networks request device identifiers, such as device or SIM IDs, and issue alerts when you are connecting to a non-encrypted cell network. Examples of alerts show warnings that “calls, messages, and data are vulnerable to interception” when connected to insecure networks. There will also be notifications when you move back to an encrypted network. An option to turn on these notifications appears on a mobile network security settings page alongside the option to avoid 2G networks, which could help block some IMSI catchers from connecting to your device. However, while the settings will reportedly be available in Android 16, it may take some time for Android devices to widely use the required hardware.

**Iran-Linked Hackers Threaten to Release 100 GB of Trump Campaign Emails**

Ahead of the presidential election last November, Iran-linked hackers attacked Donald Trump’s presidential campaign and stole scores of emails in an apparent bid to influence the election results. Some of the emails were distributed to journalists and the Biden campaign. This week, following the Israel-Iran conflict and US intervention with “bunker-buster” bombs, the hackers behind the email compromise reemerged, telling Reuters that they may disclose or sell more of the stolen emails.

The cybercriminals claimed they had stolen 100 GB of emails, including some from Susie Wiles, the White House chief of staff. The cache of emails also allegedly includes those from Lindsey Halligan, a Trump lawyer, adviser Roger Stone, and adult film star Stormy Daniels. The hackers, who have used the name Robert, told Reuters they wanted to “broadcast this matter.” It is unclear whether they will act upon the threats.

In response, US officials claimed that the threat from the hackers was a “calculated smear campaign” by a foreign power. “A hostile foreign adversary is threatening to illegally exploit purportedly stolen and unverified material in an effort to distract, discredit, and divide,” Marci McCarthy, a spokesperson for the Cybersecurity and Infrastructure Security Agency, said in a statement.

**Chinese Hackers Lay “Dormant” in US Telecoms Networks, FBI Says**

Over the past few years, Chinese hacker group Salt Typhoon has been on a hacking rampage against US telecoms networks, successfully breaking into at least nine firms and gaining access to Americans’ texts and calls. Brett Leatherman, the recently appointed leader of the FBI’s cyber division, tells Cyberscoop that the Chinese hackers are now “largely contained” and lying “dormant” in the networks. The groups have not been kicked out of networks, Leatherman said, since the longer they are in the systems there are more ways they can find to “create points of persistence.” “Right now, we’re very focused on resilience and deterrence and providing significant support to victims,” Leatherman said.

**Explicit Deepfake Website Leaks User Information, Has Expansion Plans Revealed**

Deepfake platforms that allow people to create nonconsensual, often illegal, harmful images of women without clothes on have boomed in recent years. Now a former whistleblower and leaked documents from one of the largest so-called “nudify” apps, Clothoff, claims the service has a multimillion-euro budget and is planning an aggressive expansion where it will create nonconsensual explicit images of celebrities and influencers, according to reporting by German publication Der Spiegel. The alleged expansion has a marketing budget of €150,000 (around $176,000) per country to promote the images of celebrities and influencers, according to the report. It says more than “three dozen people” work for Clothoff, and the publication identified some of the potential key operators of the platform. Documents exposed online also revealed customer email addresses. A spokesperson who claimed to represent Clothoff denied there were more than 30 people as part of the central team and told Der Spiegel it does not have a multimillion-euro budget.

Android May Soon Warn You About Fake Cell Towers

IARPA director Rick Muller is departing after just over a year at the R&D unit that invests in emerging technologies of potential interest to agencies like the NSA and the CIA, WIRED has learned.

The head of the US government’s Intelligence Advanced Research Projects Activity (IARPA) is leaving the unit this month to take a job with a quantum computing company, WIRED has learned.

Rick Muller’s pending departure from IARPA comes amid broader efforts to downsize the United States intelligence community, including the Office of the Director of National Intelligence (ODNI), which oversees IARPA. A person familiar with Muller’s plans confirmed to WIRED his departure from IARPA.

Born during the aftermath of the September 11, 2001, terrorist attacks, IARPA is tasked with testing AI, quantum computing, and other emerging technologies that could aid the missions of spy agencies including the Central Intelligence Agency and National Security Agency.

The Trump administration reportedly has been moving to cut the workforces of intelligence agencies as part of the president’s broad efforts to dismantle diversity programs and streamline government operations. Influential Republicans in the US Senate also recently have proposed legislation that would cut several programs from the ODNI, though IARPA isn’t among listed targets.

Muller, a chemist and long-time computer science researcher, had overseen some quantum computing programs at the Department of Energy before taking the reins of IARPA in April 2024. His final day at IARPA will be July 11, according to the person familiar with his plans. He is joining IonQ, which is part of a race to commercialize quantum computing. IonQ declined to comment.

The technologies used by spy agencies are often shrouded in secrecy. But much of IARPA’s work is public. It has funded dozens of research projects at universities and other labs across the country, including efforts to improve systems for face and speech recognition. In April, Muller told Federal News Network that the cybersecurity risks of large language models would be a priority for upcoming research.

The Trump administration has fired workers and slashed government grants for research at several other agencies, sparking nationwide protests and jeopardizing the future of science. The ODNI is seeking a budget of about $82 billion for the coming year, an increase of about 11.5 percent over the amount requested for 2025. But Tulsi Gabbard, the director of national intelligence, has touted cutting her workforce by 25 percent this year.

Last week, Senator Tom Cotton, who chairs the Senate Select Committee on Intelligence, described Gabbard’s agency as an “overstaffed and bureaucratic behemoth” at which “coordinators coordinate with other coordinators.” He called for cuts and other changes that he characterized as “vital to keeping our country safe from the wide range of threats that we continue to face.”

Spokespeople for Cotton didn’t immediately respond to a request for comment about the senator’s views on IARPA. The White House also didn’t immediately respond to a request for comment.

IARPA was modeled on the Defense Advanced Research Projects Agency, or Darpa, which has long been considered one of the federal government’s most advanced research and development units with successful bets on technologies for vaccines, location tracking, and language translation.

The Person in Charge of Testing Tech for US Spies Has Resigned

The platform, which allows users to anonymously share the locations of ICE agents, is currently the third-most-downloaded iPhone app.

As the popularity of ICEBlock, an app where people can share sightings of immigration enforcement officials, has soared in recent days, Trump administration officials have threatened to prosecute its developer and CNN for reporting on the platform. But legal experts tell WIRED that there is nothing illegal about the app and prosecuting its creator would be unconstitutional.

The app, which launched in April, allows users to anonymously share the locations of ICE agents within a 5-mile radius. Joshua Aaron, the app’s developer, says ICEBlock is quickly growing, with more than 241,000 users. As of this writing, it’s the third-most-downloaded free iPhone app in the United States, after the Love Island app and ChatGPT.

US attorney general Pam Bondi was on Fox News Monday talking about ICEBlock, when she spoke directly about Aaron, the app’s sole developer. “We are looking at him,” she said. “And he better watch out.” Speaking alongside President Donald Trump outside a migrant detention center known as “Alligator Alcatraz” in Florida on Tuesday, Homeland Security secretary Kristi Noem said the government was looking into prosecuting CNN.

“What they’re doing is actively encouraging people to avoid law enforcement activities and operations and we’re going to actually go after them and prosecute them,” she said. “What they’re doing, we believe, is illegal.”

ICEBlock allows users to alert each other when ICE agents are nearby.

Photograph Courtesy of ICEBlock

But legal experts tell WIRED that ICEBlock falls under protected speech. “That is as basic and uncontroversial a First Amendment principle as they come,” says Alex Abdo, the litigation director at the Knight First Amendment Institute at Columbia University. “So, it's pretty shocking to see federal law enforcement officials suggesting that there's anything here to investigate.”

Scott Hechinger, a civil rights attorney, says prosecuting the app’s creator would be illegal.

“Threatening people, in this case companies and projects, with arrest and retaliation for exercising their First Amendment rights is profoundly illegal and unconstitutional,” he says. He points to past media appearances from border czar Tom Homan, where Homan condemned congresswoman Alexandria Ocasio-Cortez for sharing information about the immigrants’ legal rights, as emblematic of the administration’s lack of respect for constitutionality.

A spokesperson using ICE's general press email referred WIRED to a statement issued by acting director Todd M. Lyons on June 30, but did not provide further comment. The White House did not immediately respond to WIRED’s request for comment.

In the statement, Lyons called CNN’s coverage of the app “reckless and irresponsible.” When reached for comment, Emily Kuhn, senior vice president of communications at CNN, pointed WIRED to a statement from the network saying that reporting on the existence of an app is neither illegal nor an endorsement.

The Trump administration’s rebukes of the app have also focused on the idea that it’s placing ICE agents in danger. Responding to a question about a CNN report on ICEBlock Monday, White House press secretary Karoline Leavitt said, “Surely, it sounds like this would be an incitement of further violence against our ICE officers.” She went on to say, “there’s been a 500 percent increase in violence against ICE agents, law enforcement officers across the country who are just simply trying to do their jobs and remove public safety threats from our communities.”

On June 20, the Department of Homeland Security put out a press release citing the purported 500 percent increase, however its link for the statistic directs users to a Breitbart article that just quotes the DHS without providing in-depth details to support the number.

“ICE and the Trump administration are under the misimpression that law enforcement in the United States is entitled to operate in secret,” says Seth Stern, director of advocacy at Freedom of the Press Foundation. Stern points to ICE agents wearing masks while operating in public and accusations by the administration targeted at journalists who report on ICE as examples of this “misimpression.”

Aaron tells WIRED the app is about “informing, not obstructing.” He describes a potential user interaction as someone walking around their neighborhood, then getting an alert on their phone saying that ICE has been spotted a few blocks away—with directions for safely getting home. By tapping the plus button in the ICEBlock app, anyone can report a new sighting.

“We're pushing back against authoritarianism. We're pushing back against fascism,” he says. “They're gonna fire off hate rhetoric at you. They're gonna demonize everything you're doing. They're gonna threaten you.”

The app is part of a larger trend of people using social media and apps to resist the Trump administration’s ramping up of immigration arrests. In early June, as protests began to swell in Los Angeles, multiple grassroots groups shared emergency alerts to local residents as ICE raids were happening across the city.

According to the Apple listing for ICEBlock, the app does not store any data on its users. Since it does not collect user data, Aaron doesn’t know how many people have used the app in Los Angeles, for example, or even where past sightings have been posted. Individual users can only see what’s been reported within a 5-mile radius and the sightings auto-delete after four hours.

The app is currently only available on iPhones. Based on his past interactions with Apple during ICEBlock’s approval process, Aaron feels confident that it will remain available in the app store. “They've already reviewed it,” he says. “That's why they approved it.” Apple did not respond to requests for comment.

Aaron says ICEBlock will never have ads or a button asking for donations. For him, the simplicity of the app’s interface is an intentional choice. “This is literally an early-warning system,” he says. “So, how much do you want going on in that early-warning system? Except to say, ‘Hey, something's coming up within your 5-mile radius. Get the fuck out.’”

Trump Officials Want to Prosecute Over the ICEBlock App. Lawyers Say That’s Unconstitutional

Customs and Border Protection is asking companies to pitch tools for performing deep analysis on the contents of devices seized at the US border.

United States Customs and Border Protection (CBP) is asking tech companies to pitch digital forensics tools that are designed to process and analyze text messages, pictures, videos, and contacts from seized phones, laptops, and other devices at the United States border, according to documents reviewed by WIRED.

The agency said in a federal registry listing that the tools it’s seeking must have very specific capabilities, such as the ability to find a “hidden language” in a person’s text messages; identify specific objects, “like a red tricycle,” across different videos; access chats in encrypted messaging apps; and “find patterns” in large datasets for “intel generation.” The listing was first posted on June 20 and updated on July 1.

CBP has been using Cellebrite to extract and analyze data from devices since 2008. But the agency said that it wants to “expand” and modernize its digital forensics program. Last year, CBP claims, it did searches on more than 47,000 electronic devices—which is slightly higher than the approximately 41,500 devices it searched in 2023 but a dramatic rise from 2015, when it searched just more than 8,500 devices.

The so-called request for information (RFI) comes amid a string of reports of CBP detaining people entering the US, sometimes questioning them about their travel plans or political beliefs, and at times collecting and searching their phones. In one high-profile incident in March, a Lebanese professor at Brown University’s medical school was sent back to Lebanon after authorities searched her phone and alleged she was “sympathetic” to the former Hezbollah leader Hassan Nasrallah, who was assassinated in September 2024.

In the RFI, CBP said that the digital forensics vendor it chooses will sign a contract in the third fiscal quarter of 2026, which runs from April through June. CBP has eight active contracts for Cellebrite software, licenses, equipment, and training—worth more than $1.3 million in total—that will end between July 2025 and April 2026. CBP appears to use tools other than Cellebrite. The agency said in the recent listing that it uses “a wide variety of digital data extraction tools,” but it doesn’t name these tools.

CBP did not respond to requests for comment. Cellebrite spokesperson Victor Cooper tells WIRED that the company is “unable to comment on active requests for information proposals.”

Three federal contract listings mention that CBP pays for Cellebrite’s Universal Forensic Extraction Device 4PC, software designed to analyze data on a user’s existing PC or laptop. The listing for the “license renewal” doesn’t mention a specific product but may be referring to the Investigative Digital Intelligence Platform, which is Cellebrite’s “end-to-end” suite of tools of analyzing data from devices.

Across Cellebrite’s intelligence platform, users have a wide range of capabilities. It can sort images based on whether they contain certain elements, like jewelry, handwriting, or documents. It can also go through text messages, as well as direct messages on apps like TikTok, and filter out messages that mention certain topics, like evidence obstruction, family, or the police. Users can also unveil photos “hidden” by a device owner, make social maps of friends and contacts, and plot the locations where a person sent text messages.

A blog on Cellebrite’s website about the January 6 insurrection cites a Washington Post report claiming that Cellebrite produced “more than 12,000 pages of data,” “2,600 pages of Facebook records,” and 800 photos and videos from a single person. (On his first day in office, President Trump gave clemency to every person who was charged in connection to actions on January 6, which amounted to nearly 1,600 people.)

Cellebrite also has a controversial history. The company launched a tool in February that lets customers use AI to summarize chat logs and audio from phones. In December, Amnesty International claimed in a report that Serbian police had confiscated a journalist’s phone, used Cellebrite to extract data from it, and then used it to infect the phone with malware. Cellebrite said in February it would limit the use of some of its technology in Serbia.

For its part, Cellebrite says in a “fact” page on its website that it “has strict licensing policies and restrictions” for customers, and that before it sells to anyone, it considers “a potential customer’s human rights record and anti-corruption policies.” The company also says that it “vigorously supports the democratic ideals of freedom of speech and freedom of the press.”

“We do not condone the use of Cellebrite’s solutions to access the personal information of journalists, activists or others who are working against the interests of repressive regimes and doing so outside the bounds of a legally sanctioned investigation expressly violates the terms of our licensing agreements,” Cellebrite says on the fact page.

Legally, CBP has the authority to search anyone’s phone at the US border without a warrant. If a person refuses to hand over their password, US citizens can remain in custody temporarily, but can’t be denied entry. However, non-citizens may be denied entry if they refuse.

If border patrol officers have the password to someone’s phone, they can conduct a “basic search” and manually scroll through the phone on the spot. However, officers may then choose to download the entirety of a phone's data, or keep it to conduct an “advanced search,” at which point digital forensic tools like Cellebrite may be used. Of the approximately 47,000 device searches Customs and Border Patrol conducted in 2024, about 4,200 of them were advanced searches.

CBP has the right to keep a phone for several days to conduct an advanced search, but if the agency cites “extenuating circumstances,” it could have the phone for weeks or months. CBP says that when it takes data from a device, it may be shared with “other agencies” or with “other federal, state, local, and foreign law enforcement agencies.” CBP also has the right to store the data in its Automated Targeting System, which it uses to determine if someone presents a risk of terrorism or criminal activity, for up to 15 years.

CBP Wants New Tech to Search for Hidden Data on Seized Phones

LGBTIQ+ organizations in El Salvador are using technology to protect themselves and create a record of the country’s ongoing authoritarian escalations against their community. It’s not without risks.

Steven Rodríguez traveled more than 40 miles from his home in Santa Ana, in western El Salvador, to attend the Pride march in the capital on June 28. It is the second time he has attended. There, some 20,000 people gathered in a mix of celebration and protest for the rights of sexual diversity. But this year, joy was replaced by fear.

“Maybe it won't escalate, but there is a fear that what happened to the El Bosque cooperative will happen. But, from deep down I believe that, as people, we have the right to a dignified life. If it's not me, who else is going to defend my experiences,” says Rodríguez about his decision to attend in the midst of the authoritarian escalation that the country is experiencing.

When Nayib Bukele assumed power in 2019, one of his first actions was to eliminate the Directorate of Sexual Diversity. In February 2024, during his participation in the Conservative Political Action Conference in the US, he made his position clear: “We do not allow those ideologies in schools and colleges. I think it is also important that the curriculum does not include gender ideology and such things.”

Natalia Alberto

Rodríguez's main fear is that the march will serve as an excuse to criminalize its attendees. Earlier this year, on May 12, a hundred members of the El Bosque cooperative held a peaceful protest to avoid being evicted. This was repressed by the military police and ended with the arrest of community leader José Ángel Pérez and lawyer Alejandro Henríquez for public disorder. Both are serving provisional detention in a penal center. In the past four months, at least six human rights defenders have been arrested in the country for political reasons.

On the afternoon of June 28, the march ended peacefully and, at least on the ground, no arrests were recorded.

**Training Day**

Rodríguez is part of a collective called Pedrina, which focuses on community articulation for LGBTIQ+ rights in the West. His approach to digital security began when members of the organization started receiving insults, threats, and hate messages on social networks.

Natalia Alberto

Rodríguez and his collective received digital security training from Amate, another LGBTIQ+ organization that advocates nationally. Since May, Amate has trained 60 people on issues including digital rights, risk analysis, extortion, phishing, outing, surveillance, and revenge porn. It also includes the implementation of tools such as the use of VPN and encrypted messaging platforms, such as Signal and Proton.

“Something that activists were telling us \[that\] is very common is that people take their Facebook photos and impersonate them on social networks, either to attack other collectives or to undermine personal aspects. So it's a very interesting experience. People are not aware of the exposure we have in the digital world,” says Fernando Paz, who is in charge of teaching these courses.

Natalia Alberto

For Rodríguez, these tools are a way of confronting a country that, with government support, is becoming increasingly violent towards those who represent diversity.

“At the university, we have had experiences of hate speech in classes. Professors have said that they share Bukele's thinking on gender ideology and that this has to disappear because it poisons the youth,” Rodríguez says.

One way the government has used to hide violence against the LGBTIQ+ community is the lack of accounting of hate crimes committed in El Salvador. In recent years, the country’s Attorney General's Office, also known as FGR, has used the categories “murder due to social intolerance” and “murder due to family intolerance” to count homicides that it cannot attribute to what it calls “general crime” (mostly, according to the government's narrative, perpetrated by gangs). There is no clarity about what falls into these categories, which are not official, are not defined, and are only used publicly—not within administrative reports. Between 2023 and 2024, the FGR counted 182 of these cases.

Natalia Alberto

**Hit Record**

In the face of statistical obscurity, the exercise of documenting and archiving hate crimes has been taken up by organizations. The Passionist Social Service, an anti-violence group, found that 154 LGBTIQ+ people have been detained during El Salvador's emergency regime, which began in March 2022 and has been extended 39 times to date. Following this, Nicola Chávez and her team saw the need to record cases of violence against members of the LGBTIQ+ population.

“We had always intended to start an observatory, but with the start of the exception regime everyone knows that police violence and military harassment have a disproportionate impact on the LGBT community. Obviously that hurts us, and I don't know who else they count on to be able to denounce,” Chávez says.

To date, Chávez's team has registered 68 incidents of violence against LGBTIQ+ people, although they believe there could be more. One of the main challenges has been to create a centralized database of the information that each member had kept on their own.

Natalia Alberto

“One of the big frustrations has always been that we don't have consistency when it comes to storing information,” Chávez says. “To make this database, I had to go from computer to computer, collecting information in emails and loose files.”

Chávez, a doctoral student in American Studies and archivist, applied her knowledge to compile and organize the information. For her, it's crucial to secure the databases that contain sensitive information related to the victims' allegations under the emergency regime. One of the keys is to protect the data with multiple layers of security and to use encrypted platforms with automatic self-destruct functions, such as CryptPad.

The authoritarian escalation in El Salvador has forced organizations to be more cautious with their public work. For this reason, Chávez requested that her organization not be mentioned for fear of reprisals following the recent approval of the Foreign Agents Law, which requires those receiving international funds to register as “foreign agents.” If authorized, they would be subject to a 30 percent tax on all foreign funding, a measure that opponents of the legislation say seeks to economically stifle dissenting voices.

Natalia Alberto

El Salvador's political situation has forced them to contemplate several scenarios on how to safeguard information. The most critical implies that the government may consider the activities of their organization as a direct contravention of the law and raid their offices. Another concern is that, at the time of registration, they will be required to hand over the contents of the devices.

“The registry is designed as an all-powerful entity. There are minimum requirements to be able to register, but they have the power to demand whatever they want,” says Chávez. “There are no limits in the regulations on what they can request. What worries us is that, as part of a routine process, they want to seize computers, hard disks, etc.”

Natalia Alberto

The passage of this law to control speech and information is not an isolated case. In November 2024, El Salvador's Congress passed laws establishing the creation of the State Cybersecurity Agency, whose powers include managing cyber threats and overseeing data protection compliance.

“The government of El Salvador has created an entire infrastructure to have not only social, but also digital control of the citizenry. With the creation of this agency, an oversight tool is enabled for issues related to information, the use of technology and our digital identity,” explains Joshi Leban, a specialist in advocacy and digital literacy.

The records that Chávez is so keenly guarding also have a vision in which this hope for justice persists.

“At some point, perhaps this will become an international litigation, or it may be that this government ends and a process of oversight of what has happened begins. In that scenario, it will serve that the organizations have put these facts on record as documentation.”

_This story originally appeared on WIRED en Español and has been translated from Spanish._

The Promise and Peril of Digital Security in the Age of Dictatorship

The Scattered Spider hacking group has caused chaos among retailers, insurers, and airlines in recent months. Researchers warn that its flexible structure poses challenges for defense.

Empty grocery store shelves and grounded planes tend to signal a crisis, whether it’s an extreme weather event, public health crisis, or geopolitical emergency. But these scenes of chaos in recent weeks in the United Kingdom, United States, and Canada were caused instead by financially motivated cyberattacks—seemingly perpetrated by a collective of joyriding teens.

A notorious cybercriminal group often called Scattered Spider is known for using social engineering techniques to infiltrate target companies by tricking IT help desk workers into granting them system access. Researchers say that the group seems to gain expertise about the backend systems commonly used by businesses in a particular industry and then uses this knowledge to hit a cluster of targets before moving on to another sector. The group often deploys ransomware or conducts data extortion attacks once it has compromised its victims.

Amid increasing pressure from law enforcement last year, which culminated in charges and arrests of five suspects allegedly linked to Scattered Spider, researchers say that the group was less active in 2024 and seemed to be attempting to lay low. The group’s escalating attacks in recent weeks, though, have shown that, far from being defeated, Scattered Spider is emboldened once again.

“There are some uniquely skilled actors in Scattered Spider when it comes to social engineering, and they have identified a major gap in our security systems that they’re successfully taking advantage of,” says John Hultquist, chief analyst in Google’s threat intelligence group. “This group is carrying out serious attacks on our critical infrastructure, and I hope that we’re not missing the opportunity to address the most imminent threat.”

Though a number of incidents have not been publicly attributed, an overwhelming spree of recent attacks on UK grocery store chains, North American insurers, and international airlines has broadly been tied to Scattered Spider. In May, the UK’s National Crime Agency confirmed it was looking at Scattered Spider in connection to the attacks on British retailers. And the FBI warned in an alert on Friday that it has observed “the cybercriminal group Scattered Spider expanding its targeting to include the airline sector.” The warning came as North American airlines Westjet and Hawaii Airlines said they had been victims of cybercriminal hacks. On Wednesday, the Australian airline Qantas also said it had been hit with a cyberattack, though it was not immediately clear if this attack was part of the group’s campaign.

“They slowed down, and we saw them dissipate for a while throughout 2024,” says Adam Meyers, a senior vice president for counter-adversary operations at the security company CrowdStrike. “Then they’ve roared back in the last couple of months, first hitting retail and then hitting insurance companies and most recently targeting airlines.”

Scattered Spider first emerged as a high-profile group toward the end of 2023 as its members moved from SIM swapping attacks to launching crippling ransomware attacks on Caesar’s Entertainment and MGM Resorts. The latter cost MGM around $100 million to recover from. Researchers emphasize that the collective is financially motivated, made up of mostly English-speaking teenagers and young men who are often based in the US or UK. The Scattered Spider hackers are considered an offshoot of the Com, an amorphous network of potentially thousands of trolls and criminals, many of whom engage in harassment, extortion, and child exploitation.

Scattered Spider members have increasingly coalesced around a tactic of using targeted social engineering to get a foothold inside company networks. Attackers may impersonate a staff member who is locked out of their company email account and contact the firm’s IT help desk to get access, before resetting multifactor authentication credentials. Researchers say that the group has also used a tactic of creating convincing phishing websites where the URLs often include the name of the target organization along with words like “okta,” “vpn” or “helpdesk.” Once inside networks, the hackers deploy various types of ransomware or steal data that is used to extort companies.

Meyers says Crowdstrike believes that Scattered Spider has roughly four core members, which drive the targeting of potential victims and “leverage” resources from the wider Com ecosystem as needed. The exact structure and size of Scattered Spider is unclear, but researchers agree that the group relies on an array of third-party services to carry out its attacks.

“Deterrence is extremely difficult because we’re essentially fighting a marketplace where a lot of the actors are replaceable,” Google’s Hultquist says. “For instance, Scattered Spider has worked with multiple ransomware services, so if one goes down there’s always someone to replace them.”

Aiden Sinnott, a senior threat researcher at cybersecurity company Sophos’ Counter Threat Unit, says that Scattered Spider and the Com more broadly are connected through relationships and communities on Discord servers or Telegram groups. “It’s this kind of evolving group where maybe new younger threat actors are coming in,” Sinnott says. “You can see this natural escalation progression as they learn skills of each other, and they're very big on sharing their wins as well.”

Some Scattered Spider members may target big-name companies, while others are involved in less high-profile activity. “There are groups, or individuals, who are really focused on hacking Coinbase accounts and stealing crypto and things like that,” Sinnott says. “So they’re not even focused on these big corporate organizations.”

As Hultquist puts it, "the activity is extremely resilient, because instead of fighting a single actor, we’re really fighting a marketplace.”

A Group of Young Cybercriminals Poses the ‘Most Imminent Threat’ of Cyberattacks Right Now

The US Justice Department revealed the identity theft number along with one arrest and a crackdown on “laptop farms” that allegedly facilitate North Korean tech worker impersonators across the US.

For years, the North Korean government has found a burgeoning source of sanctions-evading revenue by tasking its citizens with secretly applying for remote tech jobs in the West. A newly revealed takedown operation by American law enforcement makes clear just how much of the infrastructure used to pull off those schemes has been based in the United States—and just how many Americans' identities were stolen by the North Korean impersonators to carry them out.

On Monday, the Department of Justice announced a sweeping operation to crack down on US-based elements of the North Korean remote IT workers scheme, including indictments against two Americans who the government says were involved in the operations—one of whom the FBI has arrested. Authorities also searched 29 “laptop farms” across 16 states allegedly used to receive and host the PCs the North Korean workers remotely access, and seized around 200 of those computers as well as 21 web domains and 29 financial accounts that had received the revenue the operation generated. The DOJ’s announcement and indictments also reveal how the North Koreans didn’t merely create fake IDs to insinuate themselves into Western tech firms, according to authorities, but allegedly stole the identities of “more than 80 US persons” to impersonate them in jobs at more than a hundred US companies and funnel money to the Kim regime.

“It's huge,” says Michael Barnhart, an investigator focused on North Korean hacking and espionage at DTEX, a security firm focused on insider threats. “Whenever you have a laptop farm like this, that's the soft underbelly of these operations. Shutting them down across so many states, that's massive.”

In total, the DOJ says it's identified six Americans it believes were involved in a scheme to enable the North Korean tech worker impersonators, though only two have been named and criminally charged—Kejia Wang and Zhenxing Wang, both based in New Jersey—and only Zhenxing Wang has been arrested. Prosecutors accuse the two men of helping to steal the identities of scores of Americans for the North Koreans to assume, receiving laptops sent to them by their employers, setting up remote access for North Koreans to control those machines from across the world—often enabling that remote access using a hardware device called a “keyboard-video-mouse switch” or KVM—and creating shell companies and bank accounts that allowed the North Korean government to receive the salaries they allegedly earned. The DOJ says the two American men also worked with six named Chinese coconspirators, according to the charging documents, as well as two Taiwanese nationals.

To create the cover identities for the North Korean workers, prosecutors say the two Wangs accessed the personal details of more than 700 Americans in searches of private records. But for the individuals the North Koreans impersonated, they allegedly went far further, using scans of the identity theft victims' drivers' licenses and Social Security cards to enable the North Koreans to apply for jobs under their names, according to the DOJ.

It's not clear from the charging documents just how those personal documents were allegedly obtained. But DTEX's Barnhart says North Korean impersonation operations typically obtain Americans' identifying documents from dark web cybercriminal forums or data leak sites. In fact, he says the 80-plus stolen identities cited by the DOJ represent a tiny sample of thousands of US IDs he's seen pulled in some cases from North Korean hacking operations' infrastructure.

“They have a stable of these,” says Barnhart. “Any place a criminal is going to get an ID, they're just going to piggyback, because then they don't even have to carry out the breach. It's already out there.” Barnhart says he's seen North Korean impersonators go so far as to screen their stolen identities for criminal backgrounds and even choose to impersonate Americans who are based in states without income tax to maximize their earnings.

Distinct from the DOJ's charges against Kejia Wang and Zhenxing Wang, prosecutors also announced that the FBI had carried out searches of 21 other suspected laptop farms across 14 US states and seized approximately 137 PCs that prosecutors say were used in North Korean remote worker schemes. In two other cases, prosecutors say that North Koreans used the insider access they gained through impersonating Western tech workers at crypto firms to steal more than $900,000 worth of funds, including around $740,000 stolen from one Atlanta-based company.

While most of the North Korean impersonation schemes the DOJ sought to disrupt appeared to be focused on money, prosecutors also note that one of the companies the North Korean workers penetrated in the operation allegedly facilitated by the two Wangs was a California-based defense contractor focused on AI-related technology. In that instance, the government claims the North Korean impersonators also accessed and likely stole technical data, including some information sensitive enough to be protected under the export controls known as the International Trafficking in Arms Regulations, or ITAR.

While the raids, indictments, and arrests carried out by the DOJ and FBI are significant, DTEX's Barnhart says, they're far from the end of North Korea's attempts to infiltrate Western and, specifically, US companies, both for profit and for espionage. Only one suspect, after all, is in custody even among the individuals the DOJ has named—and countless more North Koreans involved in these types of schemes remain untouched within the regime's borders and in the neighboring regions of China where they operate.

“This is going to put a heavy dent in what they're doing,” says Barnhart. “But as we adapt, they adapt.”

Source

Wired