The WikiLeaks founder will appeal the UK Home Office's decision to extradite him to the US.

WikiLeaks founder Julian Assange faces a dwindling number of options after the UK government approved his extradition to the United States on Friday. The decision is the latest chapter in a prolonged legal battle that started when former military intelligence analyst Chelsea Manning leaked classified government documents about the wars in Afghanistan and Iraq, which Assange published on WikiLeaks in 2010.

Friday’s decision, approved by UK home secretary Priti Patel, is the latest in a series of legal battles Assange has lost in his effort to remain in the UK. It’s a blow to Assange, who has spent the last decade either in hiding in Ecuador’s London embassy or in a UK prison. And his increasingly likely prosecution in US courts creates a precarious moment for First Amendment rights and the ability of news outlets to publish material deemed a threat to national security.

“This is a dark day for Press freedom and for British democracy,” WikiLeaks said in a statement shared on Twitter. “Julian did nothing wrong. He has committed no crime and is not a criminal. He is a journalist and a publisher.” Wikileaks said Assange intends to appeal.

“Assange may have at least one more avenue of appeal, so he may not be on a flight to the United States just yet,” Trevor Timm, executive director of the group Freedom of Press, said in a statement. “But this is one more troubling development in a case that could upend journalists’ rights in the 21st century.” The charges against Assange include 17 under the Espionage Act and one under the Computer Fraud and Abuse Act.

Friday’s ruling overturns a December 2021 decision that declared Assange could not be extradited because subjecting him to US incarceration could increase the risk of suicide. The judge has accepted US assurances that Assange won’t face solitary confinement and will have access to psychological treatment.

“The UK courts have not found that it would be oppressive, unjust, or an abuse of process to extradite Mr. Assange,” a spokesperson for the British Home Office told WIRED. “Nor have they found that extradition would be incompatible with his human rights, including his right to a fair trial and to freedom of expression, and that whilst in the US he will be treated appropriately, including in relation to his health.”

Assange’s legal team has 14 days to appeal, according to the Home Office. His next step, now that the defense’s argument based on Assange’s suicide risk has been rejected, would likely be to focus on the other arguments his team has made against extradition, such as the threat it poses to press freedom and the political bias against Assange from United States law enforcement, given that Assange has been a thorn in the side of the US executive branch for over a decade.

“I think there’s a lot of roads to run here,” says Naomi Colvin, UK/ Ireland director at the advocacy group Blueprint for Free Speech. She points out that even if these additional arguments fail to sway the UK judicial system, Assange can also appeal to the European Court of Human Rights in Strasbourg, France, arguing that extradition would violate the UK’s commitment to human rights treaties. In yet another option, Assange’s team could demand a judicial review that would challenge the political side of Patel’s decision specifically, Colvin adds.

Assange has faced charges in the United States since April of 2019, when the US Department of Justice indicted him for hacking crimes: He was accused of conspiring with Manning to steal Department of Defense secrets. That initial indictment centered on accusations that Assange had actively helped the young private crack a password in order to gain access to a restricted part of a military network—a carefully crafted charge that seemed designed to distinguish Assange from traditional journalists and brand him instead as a cybercriminal.

Just a month later, however, the Justice Department veered into a more aggressive strategy, unsealing a superseding indictment against Assange that accused him of violating the Espionage Act, a 100-year-old law against publishing classified information. That new charge had already been levied against leakers like Manning and Edward Snowden, but using it against a journalist like Assange—a recipient and publisher of classified leaks rather than a source of them—represented a new and highly controversial move for US law enforcement.

​​“For the first time in the history of our country, the government has brought criminal charges against a publisher for the publication of truthful information,” Ben Wizner, director of the American Civil Liberties Union’s Speech, Privacy, and Technology Project, told WIRED at the time. “This is an extraordinary escalation of the Trump administration’s attacks on journalism and a direct assault on the First Amendment.”

Manning did not immediately respond to WIRED’s request for comment.

As it has evolved, Assange’s case has been buffeted by politics. His case was dropped by former US president Barack Obama’s administration before being resurrected under Donald Trump. The administration of President Joe Biden has continued the case against Assange, but Blue Print for Free Speech’s Colvin hopes that the Biden White House may be less committed than Trump’s to extradition. “It may well be that within the Biden administration, there are people who would quite like this to go away,” says Colvin. “I don’t think that’s impossible by any stretch of the imagination.”

In the meantime, Assange’s avenues of escape from an American jail are narrowing. Unless the UK government or the US Department of Justice reverses course, his case may soon be moving across the Atlantic. And if it does, a journalistic publisher of information—however radical or controversial of a publisher Assange may be—will for the first time face spying charges in a US court.

UK Approves WikiLeaks Chief Julian Assange's Extradition to the US

Contactless fingerprinting uses a smartphone camera to capture your prints—and opens up a whole new set of privacy concerns.

For more than 100 years, recording people’s fingerprints has involved them pressing their fingertips against a surface. Originally this involved ink but has since moved to sensors embedded in scanners at airports and phone screens. The next stage of fingerprinting doesn’t involve touching anything at all.

So-called contactless fingerprinting technology uses your phone’s camera and image processing algorithms to capture people’s fingerprints. Hold your hand in front of the camera lens and the software can identify and record all the lines and swirls on your fingertips. The technology, which has been in development for years, is ready to be more widely used in the real world. This includes use by police—a move that worries civil liberty and privacy groups.

Contactless fingerprinting works using several processes, says Chace Hatcher, vice president of technology at Telos, a fingerprinting technology company. “The underlying component of this is an image processing algorithm that works with computer vision principles to transform the photograph of fingers into a machine-matchable fingerprint,” Hatcher says.

To accurately collect someone’s fingerprints, a person’s hand should be around five centimeters away from a phone’s camera, Hatcher says. From here, the company’s machine learning algorithms identify your fingertips and process the image. The system, Hatcher says, is able to detect the ridges that define your fingerprint by identifying shadows and lighter areas. “We need a camera that has autofocus on it,” Hatcher says. It’s possible to pick out fingerprints using a phone camera with a resolution as low as two megapixels. The result is a traditional fingerprint image, which can then be matched against existing databases.

Last week, Telos was announced as a joint winner of a US National Institute of Standards and Technology (NIST) competition, which looked at the performance of contactless fingerprinting systems and how they can be used by law enforcement. According to a report by the industry title _Biometric Update_, the results indicate the technology is ready for a wider rollout.

Contactless fingerprints are just one part of a rapidly expanding biometrics industry, which sells ways to gather and process the data created by our bodies. Biometrics can include face recognition, the way you walk, the patterns of veins in your wrist, and the way you sound. Among other things, the technologies are being used to replace passwords and help with proving your identity when opening a new bank account. Biometrics is a big business, with some estimates saying the market could be worth $127 billion by 2030.

Despite the increase in biometric technology, it can prove controversial. Theft or spoofing of fingerprints and other biometric information can lead to fraud and identity theft. Some lawmakers in Europe are pushing for bans on the use of biometric technology to identify people in public spaces—saying such surveillance technology could be “the end of anonymity.”

Shweta Mohandas, a lawyer working on privacy issues at the nonprofit Centre for Internet and Society, in India, says any new technologies should face privacy- and harm-impact assessments before they’re widely used. “More worrying issues would be when these technologies will be imported into developing economies, which neither have standards in place nor a robust data protection legislation to protect the individuals from harms that might arise,” Mohandas says.

Despite recent advancements, research around contactless fingerprints isn’t new. Multiple companies are developing the technology—around half a dozen were listed as winners of different categories in the NIST competition. One recent study from researchers in Germany found that contactless fingerprinting could be as accurate as more traditional fingerprinting. “The presented usability study shows that the majority of users prefer a contactless recognition system over a contact-based one for hygienic reasons,” the researchers write. “In addition, the usability of the contactless capturing device was seen as slightly better.”

Law enforcement agencies have also taken a keen interest in the new fingerprinting method for several years. (The FBI has a database holding more than 160 million people’s fingerprints). One 2017 biometrics review by the FBI and other US government staff says contactless fingerprinting would potentially allow people’s prints to be collected faster and more efficiently than by existing methods. By using smartphone cameras, police wouldn’t need mobile fingerprint readers nor would they need to take people to stations to collect their prints. “But by and large, what we're allowing to happen is use cases that are already in effect to be leveraged more efficiently and more cost-effectively,” Hatcher says.

The FBI-linked review also highlights some of the risks. It says people may not properly understand that their fingerprints are being gathered. “An impersonal collection method does not necessarily trigger the owner’s recognition of a biometric record creation,” it says.

“As the technology evolves, we'll see increasing possibilities for people to be 'fingerprinted' remotely and without their knowledge,” says Daniel Leufer, a senior policy analyst at the European NGO Access Now. “When technologies like this become more accessible and easier to use, they'll be used more often, increasing the risk.” At the extreme end of the scale there have already been several examples of police forces identifying suspects by pulling fingerprint data from photos they’ve shared online.

There’s also the potential that easier fingerprint collection results in more people’s data being recorded. For instance, police in the UK have been using fingerprint scanning devices that clip onto smartphones since 2018. The tests involve scanning one finger using a device that plugs into a smartphone’s charging port, providing potential matches against a database in under a minute. A WIRED investigation in late 2020 found the devices were being disproportionately used to target ethnic minorities—in some areas Black Britons were between three and 18 times more likely to be stopped and scanned than white people.

“There is a lot of evidence showing intent in countries such as Greece and Italy to use 'handheld' biometric devices to identify migrants,” says Ella Jakubowska, a policy adviser at the civil rights NGO European Digital Rights. The technologies have the “capacity to exacerbate discrimination,” Jakubowska says.

The biometrics industry at large is pushing toward “seamless” biometrics, Jakubowska says. “We're seeing this idea across many different use cases, with providers trying to remove manual steps in biometric processing,” Jakubowska adds. “The problem is that when we talk about meaningful, informed consent, this becomes a lot harder when people are no longer as conscious and conscientious about the data that they are providing.”

Cops Will Be Able to Scan Your Fingerprints With a Phone

Despite major progress fighting spam and scams, the roots of the problem go far deeper than your phone company’s defenses.

There's a good reason you're still afraid to answer your phone when an unknown number pops up.

For years, the telecommunications industry has been trying to curb robocalls, the frustrating and potentially dangerous spam calls that try to scam anyone who picks up the phone. But even after significant milestones in defense—including the introduction of two telecom protocols that cryptographically authenticate the source of calls—you're probably still getting spammy calls that drive you nuts. In spite of the setbacks, though, researchers say they've seen real progress on reducing spam calls in the United States, and there's potential for even more improvement. 

At the RSA Conference in San Francisco last week, Josh Bercu of the trade association USTelecom and Gary Warner, director of intelligence at the security firm DarkTower, presented findings on progress squashing robocalls and the illegal call centers they emanate from, which are predominantly located in India. And they dug into the frustrating reality that the issue is far from solved.

“I think it’s not going well at all!” Warner tells WIRED. “And people understandably wonder why the carriers don’t just block spam calls. But if you're AT&T or Verizon or T-Mobile or whoever, it’s not in your purview to decide which conversations people are allowed to have. I don’t think people want to be in that surveillance state where carriers are in a position of deciding what is an acceptable conversation for Americans to have.”

That doesn't mean the carriers haven't stepped up their blocking when they see enough evidence that a call has a suspicious provenance. But USTelecom's Bercu notes that deciding how bold to be about blocking is a delicate issue that each phone company handles differently.

“As providers have gotten more aggressive blocking or labeling suspicious calls, they've taken on more risk that they'll mis-block or mislabel a legitimate call,” he says. “Maybe it really was a call from the bank or the pharmacy. There is some delicate balancing that providers have to do, and some are more aggressive than others.”

Bercu adds, too, that different carriers work with different analytics services to identify suspicious call activity. This can create situations where, as trends in robocalling techniques evolve and spammers use different strategies to bounce calls around international networks, some analytics services may be better at catching certain behavior than others.

Bercu is also executive director of the Industry Traceback Group, a neutral entity under USTelecom designated by the Federal Communications Commission to promote intelligence-sharing to trace the source of illegal robocalls and promote collaboration between carriers. The idea is to look at how robocalls circumvent existing technical defenses, identify networks where these protections haven't been fully implemented, and work with providers to adopt stronger safeguards.

Ultimately, though, DarkTower's Warner says that as with other digital criminal industries like email spam, business email compromise, and even ransomware, the key to limiting robocalling is to make it more difficult for scammers to operate at every level of their business. This means making it harder for them to route their calls, but also harder to recruit call agents and purchase lead lists—curated collections that claim to contain the phone numbers of targets like elderly people or people with medical issues. 

It also means targeting spammers' methods for laundering money. The financial sector has already done work in this area by putting flags on potentially suspicious gift cards, but scammers have found ways around this simply by requiring that victims send them a photo of their receipt for the gift card along with the card number itself. This way they can file claims that seem to show that they legitimately purchased and own the gift card. This takes time, though, and scammers have also developed laundering techniques in which they lean on money mule networks in the US or wherever they are operating and have mules open checking accounts where victims can wire money. They then quickly move the money out of the accounts using apps like Zelle, Venmo, or Cash App.

“The key is getting more people to understand the problem who can deny infrastructure to these actors, like communication platforms, financial institutions, telecoms, everyone together,” Warner says. "Denying the ability for criminals to communicate and coordinate—I think that is probably our most actionable path forward.”

He adds, too, that while the Indian government has struggled to meaningfully address the issue, Indian law enforcement has significantly ramped up arrests related to illegal call centers. But even arresting more than a dozen people a week won't curb the problem when there are estimated to be tens of thousands of people working on illegal robocalling scams in India alone.

YouMail, the blocking company that has reported estimated robocall volumes in the US for years, found that Americans received just under 4 billion robocalls in May, down from 4.74 billion in May 2019. In general, the company's stats underscore both improvement in the total volume of robocalls and the reality that numbers are still extremely high.

“The only way we could ensure that we never get any robocalls ever would be that we don’t have phone calls at all,” USTelecom's Bercu says. “When you can receive calls, you're opening up your network to someone else. So that's why I increasingly like to think about the problem the same way you would think about other cybersecurity issues. Every provider needs to do due diligence,  and we need accountability—but also collaboration.”

Here’s Why You’re Still Stuck in Robocall Hell

New details connect police in India to a plot to plant evidence on victims' computers that led to their arrest.

police forces around the world have increasingly used hacking tools to identify and track protesters, expose political dissidents’ secrets, and turn activists’ computers and phones into inescapable eavesdropping bugs. Now, new clues in a case in India connect law enforcement to a hacking campaign that used those tools to go an appalling step further: planting false incriminating files on targets’ computers that the same police then used as grounds to arrest and jail them. 

More than a year ago, forensic analysts revealed that unidentified hackers fabricated evidence on the computers of at least two activists arrested in Pune, India, in 2018, both of whom have languished in jail and, along with 13 others, face terrorism charges. Researchers at security firm Sentinel One and nonprofits Citizen Lab and Amnesty International have since linked that evidence fabrication to a broader hacking operation that targeted hundreds of individuals over nearly a decade, using phishing emails to infect targeted computers with spyware, as well as smartphone hacking tools sold by the Israeli hacking contractor NSO Group. But only now have Sentinel One’s researchers revealed ties between the hackers and a government entity: none other than the very same Indian police agency in the city of Pune that arrested multiple activists based on the fabricated evidence.

“There’s a provable connection between the individuals who arrested these folks and the individuals who planted the evidence,” says Juan Andres Guerrero-Saade, a security researcher at Sentinel One who, along with fellow researcher Tom Hegel, will present findings at the Black Hat security conference in August. “This is beyond ethically compromised. It is beyond callous. So we’re trying to put as much data forward as we can in the hopes of helping these victims.”

Sentinel One’s new findings that link the Pune City Police to the long-running hacking campaign, which the company has called Modified Elephant, center on two particular targets of the campaign: Rona Wilson and Varvara Rao. Both men are activists and human rights defenders who were jailed in 2018 as part of a group called the Bhima Koregaon 16, named for the village where violence between Hindus and Dalits—the group once known as “untouchables”—broke out earlier that year. (One of those 16 defendants, 84-year-old Jesuit priest Stan Swamy, died in jail last year after contracting Covid-19. Rao, who is 81 years old and in poor health, has been released on medical bail, which expires next month. Of the other 14, only one has been granted bail.)

Early last year, Arsenal Consulting, a digital forensics firm working on behalf of the defendants, analyzed the contents of Wilson’s laptop, along with that of another defendant, human rights lawyer Surendra Gadling. Arsenal analysts found that evidence had clearly been fabricated on both machines. In Wilson’s case, a piece of malware known as NetWire had added 32 files to a folder of the computer’s hard drive, including a letter in which Wilson appeared to be conspiring with a banned Maoist group to assassinate Indian prime minister Narendra Modi. The letter was, in fact, created with a version of Microsoft Word that Wilson had never used, and that had never even been installed on his computer. Arsenal also found that Wilson’s computer had been hacked to install the NetWire malware after he opened an attachment sent from Varvara Rao’s email account, which had itself been compromised by the same hackers. “This is one of the most serious cases involving evidence-tampering that Arsenal has ever encountered,” Arsenal’s president, Mark Spencer, wrote in his report to the Indian court.

In February, Sentinel One published a detailed report on Modified Elephant, analyzing the malware and server infrastructure used in the hacking campaign to show that the two cases of evidence fabrication Arsenal had analyzed were part of a much larger pattern: The hackers had targeted hundreds of activists, journalists, academics, and lawyers with phishing emails and malware since as early as 2012. But in that report, Sentinel One stopped short of identifying any individual or organization behind the Modified Elephant hackers, writing only that the “activity aligns sharply with Indian state interests.”

Now the researchers have gone further in nailing down the group’s affiliations. Working with a security analyst at a certain email provider—who also spoke to WIRED but asked that neither they nor their employer be named—Sentinel One learned that three of the victim email accounts compromised by the hackers in 2018 and 2019 had a recovery email address and phone number added as a backup mechanism. For those accounts, which belonged to Wilson, Rao, and an activist and professor at Delhi University named Hany Babu, the addition of a new recovery email and phone number appears to have been intended to allow the hacker to easily regain control of the accounts if their passwords were changed. To the researchers’ surprise, that recovery email on all three accounts included the full name of a police official in Pune who was closely involved in the Bhima Koregaon 16 case.

The three hacked accounts have other fingerprints that link them—and thus the Pune police—to the larger Modified Elephant hacking campaign: The email provider found that the hacked accounts were accessed from IP addresses that Sentinel One and Amnesty International had previously identified as those of Modified Elephant. In the case of Rona Wilson, the email provider security analyst says that Wilson’s email account received a phishing email in April 2018 and then appeared to be compromised by the hackers using those IPs, and at the same time the email and phone number linked to the Pune City Police were added as recovery contacts to the account. The analyst says Wilson’s email account was then itself used to send out other phishing emails to targets in the Bhima Koregaon case for at least two months before Wilson was arrested in June of 2018.

“We generally don’t tell people who targeted them, but I’m kind of tired of watching shit burn,” the security analyst at the email provider told WIRED of their decision to reveal the identifying evidence from the hacked accounts. “These guys are not going after terrorists. They’re going after human rights defenders and journalists. And it’s not right.”

To further confirm the link between the recovery email and phone number on the hacked accounts and the Pune City Police, WIRED turned to Citizen Lab security researcher John Scott-Railton, who along with researchers at Amnesty International had earlier revealed the extent of the hacking campaign against the Bhima Koregaon 16 and shown that the NSO hacking tool Pegasus had been used to target some of their smartphones. To prove that the Pune City Police controlled the recovery contacts on the hacked accounts, Scott-Railton dug up entries in open source databases of Indian mobile phone numbers and emails for the recovery phone number that linked it to an email address ending in pune@ic.in, a suffix for other email addresses used by police in Pune. Scott-Railton found that the number is also linked in the database to the recovery email address connected to the hacked accounts for the same Pune police official.

Separately, security researcher Zeshan Aziz found the recovery email address and phone number tied to the Pune police official’s name in the leaked database of TrueCaller, a caller ID and call-blocking app, and found the phone number linked to his name in the leaked database of iimjobs.com, an Indian job recruitment website. Finally, Aziz found the recovery phone number listed with the official’s name on multiple archived web directories for Indian police, including on the website of the Pune City Police. (WIRED also verified that at the time the accounts were compromised, the email provider would have sent a confirmation link or text message to any recovery contact information added to an email account, which suggests that the police did, in fact, control that email address and phone number.)

Scott-Railton further found that the WhatsApp profile photo for the recovery phone number added to the hacked accounts displays a selfie photo of the police official—a man who appears to be the same officer at police press conferences and even in one news photograph taken at the arrest of Varvara Rao.

WIRED reached out in multiple emails and phone calls to the Pune City Police and the Pune police official whose personal details were linked to the hacked accounts and received no reply.

One Mumbai-based defense attorney representing several of the Bhima Koregaon 16, Mihir Desai, says he would need to independently corroborate the new evidence of the Pune police’s links to the hacking campaign. But taken at face value, he says, it appears “very damning.” He adds that he is hopeful it could help his clients, including Anand Teltumbde, who has been accused of terrorist connections based in part on an apparently fabricated document found on Rona Wilson’s computer. “We’ve known things have been planted, but the police could have always said, ‘we are not involved in all this,’” says Desai. “By showing the police did this, it would mean there was a conspiracy to arrest these people. It would show the police have acted in a vicious and deliberate manner knowing fully well this was false evidence.”

The conclusion that Pune police are tied to a hacking campaign that appears to have framed and jailed human rights activists presents a disturbing new example of the dangers of hacking tools in the hands of law enforcement—even in an ostensible democracy like India. Sentinel One’s Guerrero-Saade argues that it also raises questions about the validity of any evidence pulled from a computer that’s been hacked by a law enforcement surveillance operation. “This should invite a conversation about whether we can trust law enforcement with these sorts of malware operations at all,” says Guerrero-Saade. “What does it mean to have evidentiary integrity when you have a compromised device? What does it mean for somebody to hack a device for fact-finding in a law enforcement operation when they can also alter the contents of the device in question?”

Beyond any larger questions, Guerrero-Saade and his fellow Sentinel One researcher Tom Hegel say they’re focused on the fate of the victims in the Bhima Koregaon case, almost all of whom have remained in jail even as the evidence against them proves to be more corrupt with every year. Ultimately, the researchers hope their findings can not only demonstrate police wrongdoing in the case, but win those activists and human rights defenders their freedom. “The real concern here is the folks languishing in prison,” says Guerrero-Saade. “We’re hoping this leads to some form of justice.”

Police Linked to Hacking Campaign to Frame Indian Activists

In occupied Ukraine, people’s internet is being routed to Russia—and subjected to its powerful censorship and surveillance machine.

Web pages in the city of Kherson in south Ukraine stopped loading on people’s devices at 2:43 pm on May 30. For the next 59 minutes, anyone connecting to the internet with KhersonTelecom, known locally as SkyNet, couldn’t call loved ones, find out the latest news, or upload images to Instagram. They were stuck in a communications blackout. When web pages started stuttering back to life at 3:42 pm, everything appeared to be normal. But behind the scenes everything had changed: Now all internet traffic was passing through a Russian provider and Vladimir Putin’s powerful online censorship machine.

Since the end of May, the 280,000 people living in the occupied port city and its surrounding areas have faced constant online disruptions as internet service providers are forced to reroute their connections through Russian infrastructure. Multiple Ukrainian ISPs are now forced to switch their services to Russian providers and expose their customers to the country’s vast surveillance and censorship network, according to senior Ukrainian officials and technical analysis viewed by WIRED.

The internet companies have been told to reroute connections under the watchful eye of Russian occupying forces or shut down their connections entirely, officials say. In addition, new unbranded mobile phone SIM cards using Russian numbers are being circulated in the region, further pushing people towards Russian networks. Grabbing control of the servers, cables, and cell phone towers—all classed as critical infrastructure—which allow people to freely access the web is considered one of the first steps in the “Russification” of occupied areas.

“We understand this is a gross violation of human rights,” Victor Zohora, the deputy head of Ukraine’s cybersecurity agency, known as the State Services for Special Communication and Information Protection (SSSCIP), tells WIRED. “Since all traffic will be controlled by Russian special services, it will be monitored, and Russian invaders will restrict the access to information resources that share true information.”

KhersonTelecom first switched its internet traffic to a Russian network on April 30, before flipping back to Ukrainian connections for the majority of May. However, things appear to have shifted permanently since May 30. All of KhersonTelecom’s traffic is now being routed through Miranda Media, a Crimea-based company that’s itself connected to Russian national telecom provider Rostelecom. (Miranda Media was set up after Putin annexed Crimea in 2014). The day after KhersonTelecom made its latest switch, state-controlled Russian media outlet RIA Novosti claimed the Kherson and Zaporizhzhia areas were officially being moved to Russian internet connections—days earlier, the outlet said the regions were also going to start using the Russian telephone code +7.

Zohora says that across occupied regions of Ukraine—including Kherson, Luhansk, Donetsk, and Zaporizhzhia—there is a patchwork of around 1,200 different ISPs. “We understand that most of them are forced to connect to Russian telecom infrastructure and reroute traffic,” Zohora tells WIRED. “Unfortunately, there are cases of massive routing of traffic of Ukrainian operators across Russian channels,” says Liliia Malon, the commissioner of Ukraine’s telecom regulator, the National Commission for the State Regulation of Electronic Communications. “Ukrainian networks are partially blocked or completely disconnected.”

Technical analysis confirms that the connections are switching. Internet monitoring company Cloudflare has observed KhersonTelecom’s traffic passing through Miranda Media for more than two weeks in June. Doug Madory, director of internet analysis at monitoring firm Kentik, has observed around half a dozen networks in Kherson connecting to the provider. “It's not a one-time thing,” Madory says. “Every couple of days, there's another company getting switched over to Russian transit from Ukraine.”

Since the start of Putin’s war in February, disrupting or disabling internet infrastructure has been a common tactic—controlling the flow of information is a powerful weapon. Russian missiles have destroyed TV towers, a cyberattack against a satellite system had knock-on impacts across Europe, and disinformation has tried to break Ukrainian spirits. Despite frequent internet blackouts, Ukraine’s rich ecosystem of internet companies has rallied to keep people online. While Ukrainian troops are successfully launching counterattacks against Russian occupation in the south of the country, Kherson remains controlled by invading forces. (In March, it became the first major city to fall into Russian hands, and its residents have lived under occupation for around 100 days, reporting numerous incidents of torture.)

“It's one thing to take over a city and to control the supply lines into the city, the flow of food or fuel,” says David Belson, head of data insight at Cloudflare, who has written about internet control in Kherson. But, he says, “controlling internet access and being able to manipulate the internet access into an occupied area” is a “new front” in the conflict.

There are multiple ways Russian forces are taking over internet systems. First, there is physical access—troops are seizing equipment. Spokespeople for two of Ukraine’s biggest internet providers, Kyivstar and Lifecell, say their equipment in Kherson was switched off by Russian occupying forces, and they don’t have any access to restore or repair equipment. (Throughout the war, internet engineers have been working amid shelling and attacks to repair damaged equipment). The SSSCIP says 20 percent of telecommunications infrastructure across the whole of Ukraine has been damaged or destroyed, and tens of thousands of kilometers of fiber networks are not functioning.

Once Russian forces have control of the equipment, they tell Ukrainian staff to reconfigure the networks to Miranda Media, Zohora says. “In case the local employees of these ISPs are not willing to help them with the reconfiguration, they are able to do it by themselves,” Zohora says. The SSSCIP, he adds, has advised staff not to risk their own lives or the lives of their families. “We hope that we are able to liberate these lands soon and this temporary period of blackmailing of these operators will pass off,” Zohora says, adding it is unlikely that communications in the region can be restored before the areas are liberated.

For the time being, at the very least, this means connections will be routed through Russia. When Gudz Dmitry Alexandrovich, the owner of KhersonTelecom, switched his connection to Miranda Media for the first time at the start of May, he claims some customers thanked him because he was getting people online, while others chastised him for connecting to the Russian service. “On May 30 again, like on April 30, everything absolutely everything fell and only Miranda's channels work,” Alexandrovich says in a translated online chat. In a long Facebook post published on the company’s page at the start of May, he claimed he wanted to help people and shared photos of crowds gathering outside KhersonTelecom’s office to connect to the Wi-Fi.

Russia is also trying to control mobile connections. In recent weeks, a mysterious new mobile company has popped up in Kherson. Images show blank SIM cards—totally white with no branding—being sold. Little is known about the SIM cards; however, the mobile network appears to use the Russian +7 prefix at the start of a number. Videos reportedly show crowds of citizens gathering to collect the SIM cards. “The Russian forces realize they're at a disadvantage if they keep using Ukrainian mobile networks,” says Cathal Mc Daid, the chief technology officer at mobile security company AdaptiveMobile. The company has seen two separatist mobile operators in Donetsk and Luhansk expanding the territory they are covering to newly occupied areas.

Who controls the internet matters. While most countries place only limited restrictions on the websites people can view, a handful of authoritarian nations—including China, North Korea, and Russia, severely limit what people can access.

Russia has a vast system of internet censorship and surveillance, which has been growing in recent years as the country tries to implement a sovereign internet project that cuts it off from the rest of the world. The country’s System for Operative Investigative Activities, or SORM, can be used to read people’s emails, intercept text messages, and surveil other communications.

“Russian networks are fully controlled by the Russian authorities,” Malon, the Ukrainian telecom regulator, says. The rerouting of the internet in occupied Ukrainian areas, Malon says, has the goal of spreading “Kremlin propaganda” and making people believe Ukrainian forces have abandoned them. “They are afraid that the news about the progress of the Ukrainian army will encourage resistance in the Kherson region and facilitate real activities,” Zohora says.

At the heart of the rerouting is Miranda Media, the operator in Crimea that appeared following the region’s annexation in 2014. Among “partners” listed on its website are the Russian security service known as the FSB and the Russian Ministry of Defense. The company did not respond to a request for comment.

In many ways, Crimea may act as an example of what happens next in newly occupied areas. “Only in 2017, Crimea was completely disconnected from Ukrainian traffic. And now, as far as I know, it's only Russian traffic there,” says Ksenia Ermoshina, an assistant research professor at the Center for Internet and Society and an affiliated researcher at the Citizen Lab. In January last year, Ermoshina and colleagues published research on how Russia has taken control of Crimea’s internet infrastructure.

After it annexed Crimea in 2014, Russian authorities created two new internet cables running along the Kerch Strait, where they connect with Russia. This process took three years to complete—something Ermoshina calls a “soft substitution model,” with connections transferring slowly over time. Since then, Russia has developed more advanced internet control systems. “The power of the Russian censorship machine changed in between \[2014 and 2022\],” Ermoshina says. “What I'm afraid of is the strength of Russian propaganda.”

It’s likely that rerouting the internet in Kherson and the surrounding areas is seen by Russian authorities as a key step in trying to legitimize the occupation, says Olena Lennon, a Ukrainian political science and national security adjunct professor at the University of New Haven. The moves could also be a blueprint for future conflicts.

Alongside internet rerouting in Kherson and other regions, Russian officials have started handing out Russian passports. Officials claim a Russian bank will soon open in Kherson. And the region has been moved to Moscow’s time zone by occupying forces. Many of the steps echo what previously happened in Crimea, Donetsk, and Luhansk. “Russia is making it clear that they're there for a long haul,” Lennon says, and controlling the internet is core to that. “They're making plans for a long-term occupation.”

Russia Is Taking Over Ukraine’s Internet

Many people reportedly died after struggling to access medical care during a brutal lockdown. The families want to make sure these deaths are counted.

ZHOU SHENGNI NEEDED a doctor, and fast. The 49-year-old, who was having an asthma attack, was being driven by her family to Shanghai East Hospital, where she worked as a nurse, for urgent treatment. It was March 23, and the Chinese city was under a strict Covid lockdown.

However, when they arrived at the emergency department, Zhou’s family found that it was closed for disinfection under Shanghai’s rules to contain the spread of Covid. In urgent need of medical care, they had no choice but to drive to another hospital about 9 kilometers away. Zhou later died.

Zhou’s death caused outrage on Chinese social media, but it was not an isolated incident. Shanghai’s citywide lockdown lasted two months, with most restrictions removed on June 1. But, for those two months, almost nothing moved—including the city’s hospitals, which were hit by sudden closures, with many restricting their services to emergencies only. Patients in need of medical help were told to present a negative PCR test to access care.

From February to May, health authorities in Shanghai had reported 588 deaths related to Covid-19, the majority elderly residents. But officials didn’t count people like Zhou, who may have died as a result of the city’s lockdown restrictions.

Discussions about the collateral damage of China’s zero-Covid policy are heavily restricted in the country. Censors have blocked comments from people opposing the pandemic strategy, including remarks made by World Health Organization director-general Tedros Adhanom Ghebreyesus. But, as ever in China, censorship has not stopped people from finding technical workarounds to express dissent.

On April 14, a WeChat account called Shi You shared an article entitled “Shanghai Deceased,” which reported on people in the city who had seemingly died as a result of harsh lockdown restrictions. The article’s comment section was quickly flooded with messages from people saying they had also heard of or knew someone who had died during the lockdown.

Capser Yu immediately realized that both the article and its comments were important. A Shanghai native now working in Singapore, Yu had heard stories of people back home who had lost loved ones during lockdown. One of those lost was Chen Xiangru, a 3-year-old girl who was reportedly unable to receive timely treatment when she developed a serious fever in late March. Chen died in hospital while waiting for the result of a PCR test doctors required to provide treatment.

Worried that censors would hide crucial evidence, Yu started taking screenshots of the WeChat article. A few hours later, WeChat scrubbed the article. When people in China tried to open the article again, all that was left was a message saying it “violates regulations.”

Yu reposted the content on a blog he created, called Real China, to help keep his parents in Shanghai informed about how news in China was being reported overseas. Within hours, Chinese censors blocked the reposted content. Yu says the article, which is still accessible outside China, was read by more than 20,000 people before it was censored. The link has since started working again for unknown reasons and, by the end of June, had become the most-read post on Yu’s blog.

During the past two months, several projects trying to document deaths linked to Shanghai’s recent lockdown have appeared online. One of the largest, on the collaboration service Airtable, has been live since April. The page is a mix of basic descriptions, images of dead bodies, location information, scans of documents, and photos of the smiling faces of the loved ones who have now passed away. The database went viral but was swiftly blocked on WeChat and Weibo for containing “non-compliant content.” Though users in China can still access it, discussions of the database have been restricted on social media.

By early June, the database contained 210 entries, each representing a life reportedly lost. It’s unclear how many of these deaths might be directly linked to Shanghai’s lockdown, but a separate tally, conducted by Singapore-based news outlet Initium Media, claimed that at least 170 people had died as a result of lockdown measures by early May. Many of the deaths were linked to difficulties accessing urgent medical treatment, the report claimed.

A Shanghai-based recruiter, who asks not to be named for security reasons, says he felt “hopeless” when he found out about the death of an industry colleague’s mother, who had skin cancer and was reportedly denied treatment because she had Covid. Though he didn’t know the woman personally, the recruiter decided not to let her death go unreported. On Reddit, he found a shared Google Sheet that, like the Airtable database, kept a record of the deceased.

The recruiter added details he knew about the woman to the spreadsheet for fact-checking. Volunteers working on the document are required to list their sources, and each link is archived by the Wayback Machine in case the post disappears. The shared document has stricter sourcing rules and fewer entries than the Airtable database—just 60 cases—and was last updated in early May.

The recruiter says he has no idea who created the document or who he was working with, but he feels safer this way. “I would be a bit afraid if we talk to each other in private,” he says, adding that he is still haunted by an experience of being reprimanded at school for speaking out on Twitter against an influential official.

It’s almost impossible to grasp the scale of the suffering caused by Shanghai’s recent lockdown. But Daohouer, a volunteer-run mutual aid network created to help people access food, treatment, and medication during the lockdown, hints at the level of desperation. The site worked by encouraging residents in urgent need of supplies or health care to leave a message, with volunteers then contacting them to help. A visualization of requests submitted to the network shows that over half of the requests dealt with medical accessibility.

The page has kept a record of 1,297 requests in Shanghai involving seriously ill people since April 11, when the data became available. The number of such requests peaked in mid-April, when the site reported a surge in messages from people seeking help accessing medical care.

The cases from Daohouer were visualized by two Chinese people living in Canada who form part of a tech collective called O3O. The pair plan to archive the data submitted to the platform in case it is somehow scrubbed by censors. “The older generation has a habit of hoarding food,” says one of O3O’s cofounders, who asks to remain anonymous. “But the younger generation has the habit of taking screenshots of all things that might be considered sensitive.” The duo also maintains a website called Our Pandemic Memory that invites people to record stories of their lockdown lives. The site, preempting likely censorship in China, automatically submits every story to the Wayback Machine.

Despite efforts to record deaths in the city, the Shanghai-based recruiter remains skeptical that the government will launch an official investigation into the number of people who reportedly died as a result of the recent lockdown. No such efforts have been announced following similar citywide lockdowns in cities such as Xi’an, where deaths related to difficulties in accessing health care have also been reported.

Still, the recruiter hopes that projects to remember and record the dead could, one day, help people learn what life, and death, was really like in Shanghai during the harshest of lockdowns. “Maybe one day in the future, when we can discuss the outbreak and learn lessons, these materials will be used for reference.”

Shanghai’s Censors Can’t Hide Stories of the Dead

A pair of ransomware attacks crippled parts of the country—and rewrote the rules of cybercrime.

But the attack against the finance ministry was just the beginning. A timeline shared by Mora claims Conti attempted to breach different government organizations almost every day between April 18 and May 2. Local authorities, such as the Municipality of Buenos Aires, were targeted, as well as central government organizations, including the Ministry of Labor and Social Security. In some cases, Conti was successful; in others, it failed. Mora says the US, Spain, and private companies helped defend against Conti attacks, providing software and indicators of compromises related to the group. “That blocked Conti a lot,” he says. (In early May, the US posted a $10 million reward for information about Conti’s leadership.)

On May 8, Chaves started his four-year term as president and immediately declared a “national emergency” due to the ransomware attacks, calling the attackers “cyberterrorists.” Nine of the 27 targeted bodies were “very affected,” Chaves said on May 16. The MICIT, which is overseeing the response to the attacks, did not respond to questions about the progress of the recovery, despite originally offering to set up an interview.

“All the national institutions, they don’t have enough resources,” Robles says. During the recovery, he says, he has seen organizations running on legacy software, making it much harder to enable the services they provide. Some bodies, Robles says, “don’t even have a person working on cybersecurity.” Mora adds that the attacks show Latin American countries need to improve their cybersecurity resilience, introduce laws to make cyberattack reporting mandatory, and allocate more resources to protect public institutions.

But just as Costa Rica started getting a grip on the Conti attacks, another hammer blow struck. On May 31, the second attack started. The systems of the Costa Rican Social Security Fund (CCSS), which organizes health care, were taken offline, plunging the country into a new kind of disarray. This time the HIVE ransomware, which has some links to Conti, was blamed.

The attack had an immediate effect on people’s lives. Health care systems went offline and printers spewed out garbage, as first reported by security journalist Brian Krebs. Since then patients have complained of delays in getting treatment and the CCSS has warned parents whose children were undergoing surgery that they may have trouble locating their kids. The health service has also begun printing discontinued paper forms.

By June 3, CCSS had declared an “institutional emergency,” with local reports claiming that 759 of the 1,500 servers and 10,400 computers have been impacted. A spokesperson for CCSS says hospital and emergency services are now running normally and the efforts of its staff have maintained care. However, those seeking medical care have faced significant disruptions: 34,677 appointments have been rescheduled, as of June 6. (The figure is 7 percent of total appointments; the CCSS says 484,215 appointments have gone ahead.) Medical imaging, pharmacies, testing laboratories, and operating theaters are all facing some disruption.

The Death of Conti

There are questions about whether the two separate ransomware attacks against Costa Rica are linked. However, they come as the face of ransomware may be changing. In recent weeks, Russian-linked ransomware gangs have changed their tactics to avoid US sanctions and are fighting over their territory more than usual.

Conti first announced its attack on the finance ministry on its blog, where it publishes the names of its victims and, if they fail to pay its ransom, the files it has stolen from them. A person or group dubbing themselves unc1756—the “UNC” abbreviation is used by some security firms to indicate “uncategorized” attackers—used the blog to claim responsibility for the attack. The attacker demanded $10 million as a ransom payment, later upping the figure to $20 million. When no payment was made, they started uploading 672 GB of files to Conti’s website.

Conti's Attack Against Costa Rica Sparks a New Ransomware Era

Plus: Russia rattles its cyber sword, a huge Facebook phishing operation is uncovered, feds take down the SSNDOB marketplace, and more.

How do you smuggle information into the USSR right under the nose of the KGB? Create your own encryption system, of course. That’s exactly what saxophonist and music professor Merryl Goldberg did during the 1980s. This week Goldberg revealed that she used musical notation to hide the names and addresses of activists and details of meetings on a rare trip to the Soviet Union. To do so, she cooked up her own encryption system. Each musical note and marking represented letters of the alphabet and helped disguise the sensitive information. When Soviet officers inspected the documents, no suspicions were raised.

Goldberg’s story was retold at the RSA Conference in San Francisco this week, where WIRED’s Lily Newman has been digging up stories. Also coming out of RSA: a warning that as ransomware becomes less profitable, attackers may turn to business email compromise (BEC) scams to make money—BEC attacks are already highly profitable.

Also this week, dark-web marketplace AlphaBay is about to complete its journey back to the top of the online underworld. The original AlphaBay site—home to more than 350,000 product listings, ranging from drugs to cybercrime services—was purged from the dark web in July 2017 as part of a huge law enforcement operation. However, AlphaBay’s second-in-command, an actor going by the name of DeSnake, survived the law enforcement operation and relaunched the site last year. Now AlphaBay is growing quickly and is on the verge of resuming its dominant dark-web market position.

Elsewhere, Apple held its annual Worldwide Developers Conference this week and revealed iOS 16, macOS Ventura and some new MacBooks—WIRED’s Gear team has you covered on everything Apple announced at WWDC. However, there are two standout new security features worth mentioning: Apple is replacing passwords with new cryptographic passkeys, and it’s introducing a safety check feature to help people in abusive relationships. Database firm MongoDB also held its own event this week, and while it might not have been as high-profile as WWDC, MongoDB’s new Queryable Encryption tool may be a key defense against preventing data leaks.

Also this week we’ve reported on a Tesla flaw that lets anyone create their own NFC car key. New research from the ​​Mozilla Foundation has found that disinformation and hate speech are flooding TikTok ahead of Kenya’s elections, which take place at the start of August. Elon Musk reportedly gained access to Twitter’s “fire hose,” raising privacy concerns. And we dove into the shocking new evidence televised by the House January 6 committee.

But that's not all, folks. Each week we round up the big security and privacy news we didn't cover ourselves. Click the links for the full stories, and stay safe out there.

For the past two years, state-sponsored hackers working on behalf of the Chinese government have targeted scores of communications technologies, ranging from home routers to large telecom networks. That’s according to the NSA, FBI, and the Cybersecurity and Infrastructure Security Agency (CISA), which published a security advisory this week detailing the “widespread” hacking.

Since 2020, Chinese-backed actors have been exploiting publicly known software flaws in hardware and incorporating compromised devices into their own attack infrastructure. According to the US agencies, the attacks typically contained five steps. China’s hackers would use publicly available tools to scan for vulnerabilities in networks. They would then gain initial access through online services, access login details from the systems, get access to routers and copy network traffic, before finally “exfiltrating” victim data.

“Exploiting these vulnerabilities has allowed them to establish broad infrastructure networks to exploit a wide range of public- and private-sector targets,” the agencies say in their joint advisory.

Since the start of the war in Ukraine, Russia has been hacked at an unprecedented scale. Now, more than 100 days into the war, tensions around cyber activity are rising. On June 9, Russia’s Foreign Ministry said that its critical infrastructure and government bodies were being hit by cyberattacks and warned that it could lead to military confrontation with the West. “The militarization of the information space by the West, and attempts to turn it into an arena of interstate confrontation, have greatly increased the threat of a direct military clash with unpredictable consequences,” the Foreign Ministry said in a statement. From the moment Russian troops entered Ukraine, questions have been raised about the potential for escalation if people outside of Ukraine are involved in cyberattacks against Russia. Last week, the head of US Cyber Command told _Sky News_ that its military hackers have been involved in offensive operations that support Ukraine.

Phishing remains one of the most successful ways for criminals to break into people’s accounts and make money—and there’s no better example of this than a newly uncovered Facebook and Facebook Messenger phishing campaign. This week, security researchers at US firm PIXM revealed a huge network of at least 400 phishing pages that are raking in millions of views and have made its creators an estimated $59 million. The scam, which has been running since at least September 2021, directs people to false Facebook login pages where their credentials are hoovered up. What stands out, as noted by the Register, is that the phishing campaign has managed to avoid Facebook’s phishing detection methods more effectively than others.

So far in 2022, police and tech companies have been cracking down on cybercriminals with some success: Raidforums, ZLoader, and the dark-web market Hydra have all been shut down in recent months. That list got a little bit longer this week as the FBI and its international law enforcement took down a marketplace selling the personal information of around 24 million Americans, according to authorities. The SSNDOB marketplace, which was made up of four individual domains, was selling people’s names, dates of birth, and Social Security numbers. SSNDOB has existed for around a decade, and in 2013, details obtained from the organization were used in the takeover of Xbox Live accounts. It’s believed the website has made its unknown owners around $22 million since 2015.

How China Hacked US Phone Networks

Twitter has reportedly given the billionaire access to its full stream of tweets and related user data. Is your privacy in jeopardy?

Elon Musk’s never-ending attempt to take over Twitter has taken yet another weird turn as the social media platform appears to have acceded to the entrepreneur’s request to gain access to a “fire hose of” internal data held by the company.

For weeks, Musk has pressed Twitter to provide data that would allow the South African entrepreneur to test whether a significant share of the platform’s users are fake bot accounts—something he believes would cheapen the price he’d be willing to pay for the company. Musk contends that bot accounts make up more than 5 percent of Twitter’s user base—something even Musk’s critics believe is true—and wants the company to disprove that.

Twitter has reported lower numbers of inauthentic accounts in its financial results, and according to _The Washington Post_, it is willing to give Musk access to every tweet posted daily, alongside granular user information, in order to allow him to look for inauthentic behavior. (Informally, this data is called the "fire hose.” Twitter declined WIRED's request to confirm or deny the _Post_ report.) Twitter’s apparent willingness to grant Musk access to the datastream comes days after the suitor’s lawyers sent a letter to the company saying it was “actively resisting and thwarting \[Musk’s\] information rights,” and threatening to pull out of the deal.

The reported shift to grant Musk access to the data is significant, and it raises two key questions: One, will Musk get what he wants from the data he’s been given? And two: What does him gaining access mean for everyday users’ privacy and security?

For Axel Bruns, professor at Queensland University of Technology, the move is Twitter calling Musk’s bluff. “By giving him access to the fire hose, Twitter can presumably say, ‘Prove your claims about the abundance of bots, then,’” he says. Bruns believes that Musk and whoever he employs to track down bots would have a difficult time. But even for someone with the requisite skills to handle that level of data, it’s unlikely to be the right method to answer the question. It’s uncertain whether access to the fire hose of 500 million tweets posted to the social media platform every day will actually help Musk answer the key question he claims is holding up his purchase of Twitter: The proportion of users who are bots. “It seems a bit performative,” says Paddy Leerssen, a researcher in information law at the University of Amsterdam. “My sense is that this data isn’t the data you need to figure out who’s a bot or not.”

Being able to pinpoint what makes a bot a bot has been a hotly debated subject in the field of academia, one that experts have devoted much of their working lives to—which is why they’re skeptical that access to all the tweets posted to Twitter will answer the bot question definitively enough to convince Musk to go ahead with the purchase. “My impression is that people tend to overestimate how easy it is to detect bots,” says Leerssen. “A tool like this \[the fire hose\] isn’t going to enable you to do that, unless you combine it with all sorts of other research methods. I don’t think that’s something that in a timeline like this, Elon Musk is going to have time for.” The man who could answer how that data would help him identify bots, Musk himself, did not respond to an emailed request for comment.

Giving Musk access to the fire hose of tweets is a relatively innocuous move, says Christopher Bouzy, the founder of Bot Sentinel, a service that tracks inauthentic behavior on Twitter. “It doesn’t expose users’ private data,” he says. “It’s just a stream of tweets.” From that stream, Musk could analyze the data to see whether accounts spammed the same message, or whether a small number of accounts were responsible for the majority of tweets on the platform—both of which would be potential warning signals for bot behavior. Asked whether we should be concerned about Musk gaining access to the fire-hose data, Bouzy said no. “It’s just a massive number of tweets,” he says. And it’s also an unmanageable number of tweets for pretty much everyone outside Twitter: Bruns points out that the US Library of Congress once had fire hose access in an attempt to archive every tweet ever posted and gave up on the endeavor.

Musk’s interest in the fire hose data is ironic, given that he reportedly declined an offer to look at Twitter’s data room—a collection of information and documents that are collated by companies when touting their businesses to potential buyers—back when his initial takeover bid was launched in April. Twitter spokesperson Jasmine Basi declined to respond to questions, including whether Musk previously asked for access to the data room. Basi also refused to answer direct questions about how many people outside of Twitter, other than Musk, have access to the fire hose data, and whether Musk would have to sign a nondisclosure or usage agreement in order to access it. That gives some cause for concern. “While I understand what Twitter is doing here, it is nonetheless also highly unusual,” says Bruns, who equates it to “giving away the crown jewels”.

The crown jewels are, however, up for sale: Around two dozen companies already have access to the fire hose of data to which Twitter has granted Musk access. Twitter’s Basi declined to name those companies, but their handling of the data has so far seemingly not caused any known issues among those dozen firms. Previously, Twitter has given broader fire hose access, with issues: The company recognized it was leaving money on the table by giving third-party data resellers access, while spy agencies previously gained access to user data through Dataminr, a company that had bought fire hose access. Google and researchers at the Massachusetts Institute of Technology have previously had access to the same data Musk is now being granted access to. “The sharing of sensitive information is a key part of acquisition procedures,” says Leerssen, who prior to his career in academia worked on data protection issues around data rooms for due diligence. “When you go through the process of acquiring a company, you need to look under the hood,” he says.

Yet the big unknown is Musk himself—someone who has already shown during the course of his attempted acquisition that he’s willing to ignore legal agreements. Many also see his ostensible concern about the number of bot accounts as a pretext in order to back out of the deal, despite the terms of the agreement he came to with Twitter precluding that from happening without massive, punitive fines.

“It basically becomes more about trying to psychoanalyze Elon Musk than about the Twitter data, almost,” says Midas Nouwens, assistant professor in digital rights at Aarhus University. Nouwens has long had concerns about the scale of information available to employees at Twitter—a single tech company in a single jurisdiction in the world. “I find it a bit difficult to separate the way that social media platforms like Twitter operate, and then the rogue element of Elon Musk in there,” he says. “It very quickly becomes trying to figure out what Elon Musk would do, and his behavior is quite erratic sometimes.”

Nouwens is one of those who has access to Twitter data through an API available to researchers that allows him to query 10 million tweets a month. Gaining access to the datastream, he says, was easier than expected given the volume of data he had access to. He had to write a description of the project he intended to use the data for, alongside providing proof he was an active academic. “Whether it was Elon Musk or some other actor, I would always have concerns,” Nouwens says. “Now for him, the added element is his past behavior, sure, but also his commercial interests.” The fear is that even if Musk does pull out of the deal to buy Twitter, the information he’s been granted access to by getting free visibility over Twitter’s fire hose of tweets could be used by him or his companies in the future. Bruns says the fire-hose data set could generate new insights into who uses Twitter and why, how usage patterns change over the long term, and what problematic behaviors users engage in—alongside generating detailed profiles of users' interests and networks. “Unless there's anything in the reporting that I've missed about how long Musk gets access to the fire hose for, I'm assuming Twitter is gambling on him and his team giving up on it fairly quickly,” says Bruns. “Especially if he had the fire hose for months or longer, this really becomes a user privacy and ethics concern too.”

Regardless of whether Musk gains access to the data or not, it’s unlikely to help him overcome the main hurdle he has for his purchase of Twitter. “I don’t know if there’s an answer to the question he is posing to Twitter,” says Nouwens. “Perhaps Twitter knows more than external researchers do at the moment or can do. But it’s a really tricky question.”

The Tricky Business of Elon Musk Getting Twitter Fire-Hose Access

The House committee's televised hearings interrogate the Capitol attack with damning new evidence. Whether it's enough to prevent another one is uncertain.

It’s hard to tell which fact should shock us most out of the first, surprisingly compelling public hearing of the congressional committee investigating the insurrection at the US Capitol on January 6.

Jared Kushner brushing aside as mere “whining” the repeated resignation threats from White House counsel and its top lawyers in the face of Donald Trump’s ongoing push to overturn the election?

The fact that even as rioters surged through the Capitol and members of Congress fled in terror, Donald Trump, the president of the United States, never once spoke to any corner of the US government to ask for help—never once called the Justice Department, Homeland Security, or the Pentagon?

The committee’s allegations that members of Congress sought presidential pardons for their own roles in the January 6 events?  

Or the simple power of a brave police officer talking about our nation’s most sacred democratic space as a “war zone” and how—repeatedly injured by the rioters that the GOP has sought in the last 18 months to reframe as “normal tourists” engaged in “legitimate political discourse”—she slipped on others’ blood spread across the steps of the US Capitol? 

After months of behind-the-scenes investigation, wide-ranging subpoenas, witness depositions, document reviews, countless hours of reviewing video footage, and delicate internal political machinations, the public portion of the House’s January 6 select committee kicked off Thursday night with a two-hour blockbuster that immediately established the stakes of the work—the former president of the United States attempted nothing less than a coup to remain in power—and recentered its work as one of the most important political investigations in our lifetime.

Committee vice-chair Rep. Liz Cheney, a Wyoming Republican who has been excoriated by her own party for agreeing to participate in the investigation alongside Republican Rep. Adam Kinzinger of Illinois, provided a captivating introduction and overview of the events of January 6, 2021. She also highlighted what the committee will explore over the course of roughly a half-dozen hearings this month and immediately gave the lie to GOP dismissals of the investigation as nothing more than a political witch hunt.

The skillful—and politically courageous—presentation by Cheney, followed up by multiple video segments produced by the committee, highlights the coordination among armed, white nationalist militia groups like the Proud Boys and Oath Keepers, as well as the singular role Donald Trump played in stoking lies that the election had been stolen and then inviting his supporters to come to Washington on January 6 to protest—protests that quickly escalated into a brutal, violent assault on the Capitol that had lawmakers fleeing for their lives. One of the most powerful video clips showed staffers of Republican leader Kevin McCarthy—who has long downplayed the Capitol assault—evacuating their House offices in terror. Other clips showed the crowd chanting, “Hang Mike Pence” and insurrectionists screaming in the face of police to demand that they hand over House speaker Nancy Pelosi. Cheney closed her poised and pointed presentation with a warning to the hundreds of her GOP colleagues who have excused the events of 1/6: “There will come a day when Donald Trump is gone, but your dishonor will remain.”

Committee chair Rep. Bennie Thompson, Democrat of Mississippi, outlined how future hearings would focus on the particulars of the conspiracy and the careful construction of Trump’s knowing lies—committee members explained that they saw in Trump’s behavior a “sophisticated” seven-step plan for overturning the election—but Thursday’s hearing mostly focused on reminding Americans of the stakes involved. This was no ordinary political protest. This was no ordinary election loss. The actions of Donald Trump before, during, and after the January 6 Capitol assault instead marked an end to America’s 240-year tradition of peaceful transitions of presidential power.

Instead, Donald Trump embarked on a concerted effort to use the tools of the presidency and the US government to overturn the legitimate, authentic election results—even though his own staff told him, according to their depositions aired Thursday in the hearing, that “there was no there there.”

First Trump lied to the public. Then he tried to weaponize the Justice Department to back his lies. He pressured state election officials and legislators to embrace far-fetched legal theories and change their states’ election results. His team worked to invent and send to Washington invalid slates of electors, in the hopes that Congress would recognize them and allow him to overturn his loss. He summoned supporters and encouraged armed groups to join him in DC on January 6, promising in a tweet that it “will be wild.” Then he pressured Vice President Mike Pence to violate his constitutional oath and refuse to certify the valid election results ahead of January 6. And lastly, he seemingly refused to lift a finger—either to place a telephone call or send a tweet—to summon federal aid as the Capitol and legislative branch remained under violent assault for hours. Instead, according to the committee, only Vice President Pence—himself hiding at a secure loading dock inside the Capitol complex after being hastily evacuated from the Senate chamber above—contacted the military and ordered them to respond and secure the Capitol.

Taken together, it is the most audacious, calculated, and unconstitutional plot America has faced in its history—one that came far closer to success than anyone imagined.

Over the course of those two hours, the committee succeeded in reframing the national conversation and focused on the true horror of January 6. In doing so, it surely raised the pressure on the Justice Department, which is conducting a seemingly slow-moving parallel investigation that has seen hundreds of low-level indictments and charges against January 6 rioters—including the arrest just yesterday of a GOP gubernatorial candidate in Michigan—and a number of more serious “seditious conspiracy” indictments against Oath Keepers and Proud Boys leaders. Thus far, it has stopped short of penetrating Donald Trump’s motley collection of enablers, grifters, and hangers-on.

Despite the shocking clarity of the committee’s opening presentation, it remains uncertain at best whether it will be able to break through America’s political polarization and its increasingly separate-and-unequal media ecosystems. Fox News, alone among the major networks, refused to air the hearings live and instead allowed its host Tucker Carlson, who increasingly features openly white nationalist positions, to spew venom to his millions of prime-time viewers during an hour-long show, unusually uninterrupted by commercials.

In many ways, Fox’s decision to double down on Tucker Carlson’s lies Thursday night is unsurprising. The network’s decision in the weeks after the 2020 election—as Donald Trump built up the Big Lie and set the kindling for January 6—to embrace Trump’s lies and undermine the legitimacy of then-President-elect Joe Biden’s victory makes it all but an unindicted co-conspirator in the violence on Capitol Hill.

The challenge America now faces, heading into next week’s follow-up hearings, is that none of us know what part of Donald Trump’s story we’re living in—the beginning, the middle, or the end? The committee’s work ahead is to convince America to view January 6 as a turning point, not a warning that we will later say went ignored.

There’s a saying, after all, that there’s no such thing as an unsuccessful coup. An unsuccessful coup is just practice.

Source

Wired