Nonprofit donors had their information given to law enforcement without consent, highlighting limited data protections in the world’s largest democracy.

Prasanto K. Roy, a public policy consultant from New Delhi, is worried. In 2017 he began sending regular donations to the Indian fact-checking organization Alt News to support its work countering online misinformation. But on July 5 the nonprofit said that Indian payments gateway Razorpay, which it used to receive donations, had shared its donors’ data with New Delhi police following the arrest of Alt News cofounder Mohammed Zubair last month.

Roy is now hesitant to use Razorpay, saying he is concerned about tech companies handing over data—including his own—to law enforcement without consent. “When a payment gateway gives out donor databases on a police demand that is excessive, that information can be misused by the police or others it could reach,” he said. “India doesn’t even have privacy laws in place yet.”

The full extent of the data that Razorpay shared with police remains unclear, but Alt News said that the data it collects from donors includes phone numbers, email addresses, and tax IDs. A police official told the _Hindustan Times_ that the force is gathering data from banks to cross-reference with the Alt News data.

The investigation appears to be part of an ongoing probe to check whether Alt News received donations from outside of India, after police claimed that the organization’s parent received funds from several other countries, including Pakistan and Syria. Zubair, the cofounder of Alt News, was arrested on June 27 for a 2018 tweet that allegedly hurt religious sentiments, but is also being investigated for other charges, including receiving foreign funds under India’s Foreign Contribution (Regulation) Act, which restricts foreign donations to nonprofits.

While the arrest has spurred many Indians to fear that police are quashing internet freedom, it has also highlighted the limited legal protections on privacy in the world’s largest democracy, which lacks a comprehensive data protection law. The stakes are growing higher as more people in India use the internet for leisure, communications, and commerce. The country’s digital payments market—already at $3 trillion in value—is expected to skyrocket to $10 trillion by 2026, according to Boston Consulting Group.

Razorpay has faced social media backlash and threats of a boycott for sharing donor data without first informing Alt News. “Many donors and fundraisers said they wouldn’t use Razorpay again, and that was my initial reaction too,” said Roy, while adding that perhaps other companies would also have caved under the same pressure from police.

In a public statement on Twitter, Razorpay did not mention Alt News and said that the data shared was “restricted to what was within the scope of investigation.” Razorpay CEO Harshil Mathur tweeted that police were attempting to “determine whether there were any foreign donations or not” and claimed that donors’ tax IDs and addresses were not shared. Razorpay did not respond to a request for comment; Alt News cofounder Pratik Sinha declined to comment.

Indian police obtained the data from Razorpay under section 91 of the Criminal Procedure Code, which allows officials to seek documents or data connected to an ongoing investigation. But criminal lawyers told WIRED that the law gives police considerable flexibility, leaving room for overreach or misuse.

“Section 91 allows the police to make any request for information to any person during an inquiry, and it’s a standard investigative tool,” said Abhinav Sekhri, a criminal lawyer based in New Delhi. “Companies routinely receive such requests, at severe cost, because there are consequences for noncompliance, leaving them with no choice at times.” One such consequence could be an executive facing criminal action and potentially imprisonment, Sekhri says.

Meanwhile, financial technology experts say that even if Razorpay hadn’t complied with the demand to hand over Alt News data, the police could likely have retrieved it from other players in the payments ecosystem. “The source and destination information is stored across the entire chain,” said Srikanth Lakshmanan, a researcher who runs Cashless Consumer, a collective that works on consumer awareness of digital payments in India. “It’s not just Razorpay that will store this information, but also the card issuer and acquiring bank and payment network.”

This broad collection and sharing of data can make privacy in digital payments in India seem nigh on impossible. “The state of privacy in digital payments in India is nonexistent,” Lakshmanan says. The ease with which digital data can be shared and leaked makes privacy challenging around the world, but India’s centralized biometric identity system, Aadhaar, can add extra vulnerabilities, he says. “It's easy to look for more information in India where a whole range of data sets are cross-linked, giving a much richer profile.”

A Privacy Panic Flares Up in India After Police Pull Payment Data

The US House committee has already uncovered a more organized and sinister plot than many imagined. But history suggests the worst may be yet to come.

The House committee investigating the January 6 attack never promised a quiet summer, but when hearings started a month ago it certainly seemed like it might be a _quieter_ summer. Many of what were anticipated to be the biggest revelations appeared to have leaked before the hearings began, and the six to eight scheduled public sessions, expected to last only about two hours each, seemed to telegraph modest ambitions—especially in comparison to the 1973 Watergate hearings that stretched for 237 hours, or even the far less consequential 2015 Republican-led Benghazi hearings, where Hillary Clinton alone testified publicly for 11 hours.

But then the hearings began, and with them an emotional and tense multimedia roller coaster, exquisitely produced by former ABC News executive James Goldston to mimic a prestige TV series, in which each “episode” reveals deeper twists and turns and ever more corruption and outrage. Representative Liz Cheney and surprise witness Cassidy Hutchinson, an aide to former chief of staff Mark Meadows, emerged as the summer’s biggest breakout TV stars. 

The testimony so far has proven far more compelling, damning, and reputationally damaging to former president Trump than almost anyone imagined. The committee evidently has the goods and understands how to package them for maximum effect. They are now preparing to return from a brief summer break with two more hearings this week, one on Tuesday and a second prime-time hearing on Thursday.

For 18 months, the tick-tock of the Trump administration’s chaotic build to January 6 has trickled out in news reports, documentaries, and government documents, giving the public a sense of the scope of misdeeds and damage to American democracy. But the events had seemed akin to what the country (and the world) lived through during Trump’s four years as president—a disordered and noisy series of imprudent and haphazard pronouncements, ill-considered tweets, hasty policy choices, and reckless bluster.

Now the country can see otherwise: There was a method to Trump’s madness. The events across the 10 weeks from early November to January 6 were far more organized and sinister than previously known.

Most importantly, the evidence of crimes and criminality has proved inescapable.

In fact, it seems there was a lot of crime in the days and weeks leading up to the riot at the Capitol on January 6—and Trump’s aides seemed to clearly understand that they were headed toward a criminal reckoning. As Hutchinson recounted White House counsel Pat Cipollone telling her, “We’re going to get charged with every crime imaginable if we \[let the President go to the Capitol on January 6.\]”

Altogether, the committee has painted a far more organized and coherent picture of the administration’s efforts than most imagined existed. The hearings have revealed a seven-part coordinated effort by the Trump White House—and the president personally—to weaponize every public, political, and governmental tool at his disposal to hold on to power in the face of a clear and convincing electoral loss. He and a small cadre of loyal aides tried to undermine the legitimacy of Joe Biden’s victory, encouraged states to overturn valid election results, attempted to install election-doubting loyalists at the Justice Department, and applied consistent pressure to Vice President Mike Pence to step outside his constitutional role and reject the electoral college certification. And then—when literally all else failed—Trump encouraged his supporters to flock to the Capitol and stood by—without taking any action to stop them—while they rampaged through the building and came close to harming Pence and lawmakers.

Trump knew what he was doing, was told by aides repeatedly and broadly that it was wrong, and continued his pressure campaign anyway. January 6 wasn’t a spontaneous riot; it was the final attempt at a coup that had failed at every step until then. And the fact that so many of the participants, from members of Congress to, according to Hutchinson, White House chief Mark Meadows himself, apparently sought presidential pardons for their actions in the Trump administration’s final days makes it clear there was what prosecutors call “mens rea,” a guilty mind. In the 18 months since the events at the Capitol, the Justice Department has brought charges against more than 800 people involved in the riots, including eye-opening charges of “seditious conspiracy” against some of the white nationalist militia members, like the Oath Keepers and the Proud Boys, who should figure prominently at this week’s congressional hearings. Precisely none of those yet charged have been within Trump’s inner circle.

That may soon change—and American democracy might very well hinge on whether it does.

While the chair, Representative Bennie Thompson, and vice chair Cheney maintain that their purpose is only to deliver a comprehensive accounting of the events around January 6, the outlines of a whole series of criminal actions are now evident. The technical crimes may feel somewhat obscure—wire fraud, theft of honest services, defrauding the United States, obstruction of justice, obstruction of an official proceeding of Congress—but the fact pattern seems to grow ever more clear. Moreover, the hearing that focused on the White House pressuring elected officials in the state of Georgia brought renewed attention to the possibility that even if the US Justice Department fails to act, state prosecutors might very well decide Donald Trump committed electoral crimes there.

The biggest shift in the national landscape from the January 6 committee, though, seems likely to be ahead of us.

It’s worth remembering too how much the political and factual landscape can change during hearings like this: The biggest revelation of the Watergate hearings—that Nixon had installed a taping system in the White House that would have captured all the key conversations of the conspiracy and cover-up—didn’t emerge until mid-July 1973, weeks into the hearings by Senator Sam Ervin’s Watergate select committee.

Perhaps similarly, there’s a growing sense that the blockbuster nature of the January 6 hearings—and the damaging testimony elicited thus far—is itself compelling further cooperation and testimony. For example, Hutchinson, who had long been represented by a Trump-paid attorney, changed counsel midstream and began cooperating. Friday, Cipollone—who had also resisted testifying—met with committee investigators for nearly eight hours. And the Justice Department announced in a court filing Monday that one of Trump’s attorneys had interviewed with the FBI, as part of Steve Bannon’s related criminal contempt process, testimony that could have wide-ranging implications and itself spur further targets to cooperate. (As part of that filing, the Justice Department rejected Bannon’s weekend public proclamation that he was willing to cooperate with the committee as insincere, saying, “The only thing that has really changed since he refused to comply with the subpoena in October 2021 is that he is finally about to face the consequences of his decision to default.”)

Prosecutors understand this phenomenon well: As evidence of crimes mount, cooperation among the conspirators often spreads. Conspiracies crumble as testimony builds and personal legal and criminal jeopardy rises with it. John Dean, the former White House counsel who originally helped architect the Watergate cover-up before turning states’ witness, became a star witness only after he realized how much—and how clearly—he’d participated in the obstruction of justice.

Other Trump aides seem to be listening to the January 6 hearings and making their own calculations as the committee reconvenes this week. Surely many of them will be uncomfortable with what they hear in the hours and days ahead.

The January 6 Insurrection Hearings Are Just Heating Up

The pro-Russian group Killnet is targeting countries supporting Ukraine. It has declared "war" against 10 nations.

The attacks against Lithuania started on June 20. For the next 10 days, websites belonging to the government and businesses were bombarded by DDoS attacks, overloading them with traffic and forcing them offline. “Usually the DDoS attacks are concentrated on one or two targets and generate huge traffic,” says Jonas Sakrdinskas, acting director of Lithuania’s national cybersecurity center. But this was different.

Days before the attacks started, Lithuania blocked coal and metal from being moved through its country to the Russian territory of Kaliningrad, further bolstering its support for Ukraine in its conflict with Russia. Pro-Russian hacker group Killnet posted “Lithuania are you crazy? 🤔” on its Telegram channel to 88,000 followers. The group then called on hacktivists—naming a number of other pro-Russian hacking groups—to attack Lithuanian websites. A list of targets was shared.

The attacks, Sakrdinskas explains, were continuous and spread across all areas of daily life in Lithuania. In total more than 130 websites in both the public and private sectors were “hindered” or made inaccessible, according to Lithuania’s government. Sakrdinskas says the attacks, which were linked to Killnet, have mostly dropped off since the start of July, and the government has opened a criminal investigation.

The attacks are just the latest wave of pro-Russian “hacktivist” activity since the start of Vladimir Putin’s war in February. In recent months Killnet has targeted a growing list of countries that have supported Ukraine but are not directly involved in the war. Attacks against websites in Germany, Italy, Romania, Norway, Lithuania, and the United States have all been linked to Killnet. The group has declared “war” on 10 nations. The targeting often happens after a country offers support for Ukraine. Meanwhile XakNet, another pro-Russian hacktivist group, has claimed to have targeted Ukraine’s biggest private energy company and the Ukrainian government.

While security experts have frequently warned that attacks from Russia could target Western countries, the efforts of volunteer hacktivist groups can have an impact without being officially backed or conducted by the state. “They definitely have malicious intent when they conduct these attacks,” says Ivan Righi, a senior cyberthreat intelligence analyst at security firm Digital Shadows who has studied Killnet. “They're not working together with Russia but in support of Russia.”

Killnet started as a DDoS tool and was first spotted in January this year, Righi says. “They were advertising this app or this website, where you could hire a botnet and then use it to launch DDoS attacks.” But when Russia invaded Ukraine at the end of February, the group pivoted. The vast majority of Killnet’s efforts and those of its “legion” group—members of the public who are asked to join and launch attacks—have been DDoS attacks, Righi says, but he has also seen the group linked to some website defacements, and the group itself has made unverified claims that it has stolen data.

Its Telegram channel, where it makes political statements and talks about targets, was created at the end of February and has grown in popularity, with the number of members doubling since May. “They began to gain a lot of popularity from the public in Russia,” Righi says. Righi says it produces slick promotional videos and sells its own merchandise.

While DDoS attacks aren’t sophisticated, they “will still be able to create uncertainty in the population and give the impression that we are a piece in the current political situation in Europe,” said Sofie Nystrøm, the head of Norway’s NSM cybersecurity agency, in a statement after businesses in the country were targeted by DDoS attacks at the end of June.

Russia has long been home to cybercriminals such as ransomware groups, which the country has largely ignored as long as they don’t target companies in Russia. Simultaneously, Russian military hackers have stirred global chaos for years—causing electricity blackouts in Ukraine, hacking the Olympics, and conducting the worst cyberattack in history. Evidence against state-backed Russian hackers has been piling up since the start of the war, though Russia has consistently denied launching cyberattacks around the world. The Russian embassy in the United States did not immediately respond to a request for comment.

In April, cybersecurity officials in the US, Australia, Canada, New Zealand, and the UK warned against the potential damage that pro-Russian groups, including XakNet and Killnet, could cause. While it is not clear who is behind Killnet or whether the group is backed by the Russian state, one other notorious Russian hacktivist group has been linked to the Kremlin. At the end of June, US cybersecurity company Mandiant, as first reported by Bloomberg, said Russian intelligence operatives had passed stolen information to XakNet. Ukrainian officials have also pinned attacks on DTEK, the country’s largest private energy firm, on XakNet. (The group has posted about DTEK multiple times in its 36,000-subscriber Telegram channel.)

“We've seen a number of groups emerge in the context of the Russian invasion of Ukraine,” says Alden Wahlstrom, a senior analyst at Mandiant. “XakNet and Killnet both have questionable provenance.” Wahlstrom says any claims of hacktivism should be approached with “a healthy dose of skepticism” and that Russian intelligence agencies have an “established history of using cutout groups” for cyberactivities. Last week the Trickbot cybercriminal group—which is made up of multiple smaller groups like the Conti ransomware group, and has links to the Russian state—was spotted by IBM targeting Ukraine for the first time. IBM describes the move as a “huge shift” in the group’s behavior.

XakNet has claimed it is not being directed by the Russian government. In one Telegram post responding to Mandiant’s findings, it said it “fully” supports the Kremlin’s position and acknowledges its activities aren’t legal. It said it does not cooperate with Russia’s FSB security service “at the moment” but is “happy to provide data to those who ask.”

It is possible there are some connections among Russian hacker groups themselves. In multiple instances, Wahlstrom says, they have cross-posted about other groups’ work on their Telegram channels. For instance, when Killnet called for Lithuania to be targeted it posted a message asking for help from XakNet, Russian ransomware groups, and other pro-Russian hacking groups.

“XakNet and Killnet have given a decent amount of media interviews in the Russian media space, which is a reason to at least consider that there is a potential dual component to some of this activity,” Wahlstrom says. “They are helping to advance Russian interests abroad, either in Ukraine or further afield, but on the flip side they're being heavily promoted in the Russian media as groups that are displays of these patriotic volunteers that embody support for Russian government decisions.”

Killnet responded to a request for comment by saying it was “no longer friends” with XakNet. “Our enemy is your government bro,” the group says. “But we are not dangerous to ordinary people.”

DDoS attacks have been prominent in Ukraine, too. Officials there created a volunteer IT army, where people from around the world can help launch attacks against Russian targets. The IT army has claimed to take down, at least temporarily, the websites of Russian government departments, food delivery services, and banks—one of Putin’s speeches last month was delayed by an hour after the IT army attacks. Attacks against Russia have also come from hacktivist groups outside of Ukraine, such as Anonymous.

Ultimately, as Russia’s war against Ukraine continues, the activity of pro-Russian cyber groups continues to be in line with Russian aims. “Moscow has kept its relationship with Russia-based hacktivist groups deliberately ambiguous,” says Emily Harding, deputy director of the international security program at the Center for Strategic and International Studies, a US-based think tank. “Moscow’s security services know who these operators are and will use some form of leverage to force them to cooperate when needed.”

Harding says analysts have continuously predicted that Russia would use “deniable tools” and groups to react against countries that support Ukraine. While DDoS attacks may not be sophisticated, they contribute to this effort. And if attacks by so-called hacktivist groups become more advanced, there’s a greater chance they could cause more damage or risk escalation of the conflict. “The risk of miscalculation is real,” Harding says. “No one has yet really tested the limits of cyber operations without causing escalation.”

Russian ‘Hacktivists’ Are Causing Trouble Far Beyond Ukraine

Plus: A duplicitous bug bounty scheme, the iPhone's new “lockdown mode,” and more of the week's top security news.

As states grapple with the far-reaching implications of the United States Supreme Court's June decision to reverse the constitutional right to abortion, WIRED examined the privacy risks posed by widely deployed automated license plate readers as the risks of being prosecuted for seeking an abortion ramp up around the country. And researchers underscored the digital self-defense value of end-to-end encryption anywhere in the world, as civil rights protections and law enforcement powers evolve.

Apple announced a new protection this week known as “Lockdown Mode” for iOS 16 that will let users elect to run their phone in a more limited, but more secure mode if they are at risk of being targeted with invasive spyware. And researchers say that new encryption algorithms announced by the National Institute of Standards and Technology that are designed to be resistant to quantum computers will be difficult to test in any practical sense for years to come. 

We examined how users can protect themselves against the worst Instagram scams and took a look back at the worst hacks and data breaches of 2022 so far, with many more inevitably still to come.

But that's not all. Each week we round up the news that we didn’t break or cover in-depth. Click on the headlines to read the full stories. And stay safe out there!

In one of the most expansive and impactful breaches of personal data of all time, attackers grabbed data of almost 1 billion Chinese citizens from a Shanghai police database and attempted to extort the department for about $200,000. The trove of data contains names, phone numbers, government ID numbers, and police reports. Researchers found that the database itself was secure, but that a management dashboard was publicly accessible from the open internet, allowing anyone with basic technical skills to grab the information without needing a password. The scale of the breach is immense and it is the first of this size to hit the Chinese government, which is notorious for hoarding massive amounts of data, not only about its own citizens, but about people all over the world. China was memorably responsible for the United States Office of Personnel Management breach and Equifax credit bureau breach, among many others worldwide.

FBI director Christopher Wray and the chief of the UK's security agency MI5, Ken McCallum, issued a joint warning this week that China is, as Wray put it, the "biggest long-term threat to our economic and national security." The pair noted that China has conducted extensive espionage around the world and interfered in elections and other political proceedings. Wray noted that if China moves to seize Taiwan it would "represent one of the most horrific business disruptions the world has ever seen." McCallum said that since 2019, MI5 has more than doubled its focus on China and now conducts seven times as many Chinese Community Party-related investigations as it did in 2018. China Foreign Ministry spokesman Zhao Lijian described British officials as attempting to "hype up the China threat theory." He added that MI5 should "cast away imagined demons."

The bug bounty program HackerOne, which manages vulnerability submission and reward programs for companies, fired an employee this week for stealing vulnerability disclosures submitted through the platform and submitting them to affected companies to recover the reward for personal gain. HackerOne uncovered the scheme when one customer company flagged a vulnerability disclosure that was suspiciously similar to one it had received in June from a different researcher. The rogue employee, who was new to the company, had access to HackerOne's platform from April 4 until June 23 and made seven vulnerability disclosures using stolen research. “This is a clear violation of our values, our culture, our policies, and our employment contracts,” HackerOne wrote in an incident report. “We have since terminated the employee, and further bolstered our defenses to avoid similar situations in the future.”

The United States Cybersecurity and Infrastructure Security Agency, Federal Bureau of Investigation, and Treasury Department said in a joint alert this week that North Korean hackers have been targeting the healthcare and public health sectors with the little known Maui ransomware strain. They warned that paying such ransoms could violate US sanctions. “North Korean state-sponsored cyber actors used Maui ransomware in these incidents to encrypt servers responsible for healthcare services—including electronic health records services, diagnostics services, imaging services, and intranet services,” the alert warns. “In some cases, these incidents disrupted the services provided by the targeted HPH Sector organizations for prolonged periods.”

Chinese Police Exposed 1B People's Data in Unprecedented Leak

Quantum-proof encryption is here—decades before it can be put to the test.

In 1994, a Bell Labs mathematician named Peter Shor cooked up an algorithm with frightening potential. By vastly reducing the computing resources required to factor large numbers—to break them down into their multiples, like reducing 15 to 5 and 3—Shor’s algorithm threatened to upend many of our most popular methods of encryption.

Fortunately for the thousands of email providers, websites, and other secure services using factor-based encryption methods such as RSA or elliptic curve cryptography, the computer needed to run Shor’s algorithm didn’t exist yet. 

Shor wrote it to run on quantum computers which, back in the mid-1990s, were largely theoretical devices that scientists hoped might one day outperform classical computers on a subset of complex problems.

In the decades since, huge strides have been made toward building practical quantum computers, and government and private researchers have been racing to develop new quantum-proof algorithms that will be resistant to the power of these new machines. For the last six years, the National Institute of Standards and Technology (NIST)—a division of the US Department of Commerce—has been running a competition to find the algorithms that it hopes will secure our data against quantum computers. This week, it published the results.

NIST has whittled hundreds of entries from all over the world to an initial list of just four: CRYSTALS-Kyber for general encryption, and CRYSTALS-Dilithium, FALCON, and SPHINCS+ for use in digital signatures during identity verification or when signing digital documents. “People have to understand the threat that quantum computers can pose to cryptography,” says Dustin Moody, who leads the post-quantum cryptography project at NIST. “We need to have new algorithms to replace the ones that are vulnerable, and the first step is to standardize them.”

Just as RSA encryption relies on the difficulty of factoring extremely large numbers, three of the four algorithms unveiled this week use a complicated mathematical problem that’s expected to be difficult for even quantum computers to wrestle with. Structured lattices are abstract multi-dimensional grids that are extremely challenging to navigate unless you know the shortcuts. In structured lattice cryptography, as with RSA, the sender of a message will encrypt the contents using the recipient’s public key, but only the receiver will have the keys to decrypt it. With RSA the keys are factors—two large prime numbers that are easy to multiply together but difficult to ascertain if you have to work backwards. In these post-quantum cryptography algorithms the keys are vectors, directions through the maze of a structured lattice.

Although it will be a few years before these standards are published in their final form, it’s a pretty big moment. “For the first time, we have something to use against a quantum threat,” says Ali El Kaafarani, the CEO of PQShield, which worked on the FALCON algorithm.

Those quantum threats might still be decades away, but security experts warn of “harvest now, decrypt later” attacks—bad actors hovering up caches of encrypted data with the expectation that they’ll eventually have a quantum computer that can access them. The longer it takes to implement quantum-proof cryptography, the more data will be vulnerable. (Although, Lancaster University quantum researcher Rob Young points out that a lot of sensitive data that could be harvested now is also time sensitive: Your credit card number today will be irrelevant in 15 years.)

“The first thing organizations need to do is understand where they are using crypto, how, and why,” says El Kaafarani. “Start assessing which parts of your system need to switch, and build a transition to post-quantum cryptography from the most vulnerable pieces.”

There is still a great degree of uncertainty around quantum computers. No one knows what they’ll be capable of or if it’ll even be possible to build them at scale. Quantum computers being built by the likes of Google and IBM are starting to outperform classical devices at specially designed tasks, but scaling them up is a difficult technological challenge and it will be many years before a quantum computer exists that can run Shor’s algorithm in any meaningful way. “The biggest problem is that we have to make an educated guess about the future capabilities of both classical and quantum computers,” says Young. “There's no guarantee of security here.”

The complexity of these new algorithms makes it difficult to assess how well they’ll actually work in practice. “Assessing security is usually a cat-and-mouse game,” says Artur Ekert, a quantum physics professor at the University of Oxford and one of the pioneers of quantum computing. “Lattice based cryptography is very elegant from a mathematical perspective, but assessing its security is really hard.”

The researchers who developed these NIST-backed algorithms say they can effectively simulate how long it will take a quantum computer to solve a problem. “You don't need a quantum computer to write a quantum program and know what its running time will be,” argues Vadim Lyubashevsky, an IBM researcher who contributed to the the CRYSTALS-Dilithium algorithm. But no one knows what new quantum algorithms might be cooked up by researchers in the future.

Indeed, one of the shortlisted NIST finalists—a structured lattice algorithm called Rainbow—was knocked out of the running when IBM researcher Ward Beullens published a paper entitled “Breaking Rainbow Takes a Weekend on a Laptop.” NIST’s announcements will focus the attention of code breakers on structured lattices, which could undermine the whole project, Young argues. 

There is also, Ekert says, a careful balance between security and efficiency: In basic terms, if you make your encryption key longer, it will be more difficult to break, but it will also require more computing power. If post-quantum cryptography is rolled out as widely as RSA, that could mean a significant environmental impact.

Young accuses NIST of slightly “naive” thinking, while Ekert believes “a more detailed security analysis is needed”. There are only a handful of people in the world with the combined quantum and cryptography expertise required to conduct that analysis.

Over the next two years, NIST will publish draft standards, invite comments, and finalize the new forms of quantum-proof encryption, which it hopes will be adopted across the world. After that, based on previous implementations, Moody thinks it could be 10 to 15 years before companies implement them widely, but their data may be vulnerable now. “We have to start now,” says El Kaafarani. “That’s the only option we have if we want to protect our medical records, our intellectual property, or our personal information.”

Will These Algorithms Save You From Quantum Threats?

The US Federal Communications Commission says a man posing as a fake broadband service promised victims discounts on internet services and devices.

Traxler's scam lasted from May to August 2021, during which he "repeatedly engaged in conduct that violated the federal wire fraud statute and the Commission's rules," the FCC said. The proposed $220,210 forfeiture penalty is "the statutory maximum we can impose, and reflects the scope, duration, seriousness, and egregiousness of Cleo's apparent violations," according to the commission.

When Cleo applied to be in the EBB program, the FCC initially told the entity that its application would be "denied as it lacks sufficient information for approval." But Cleo subsequently gained FCC approval by offering documents including copies of two invoices "with customer-identifying information removed, which Cleo claimed was 'due to CPNI and privacy.'" Cleo also claimed to the FCC that it "had been providing high-speed wireless Internet" to 500 customers.

Dozens of Nearly Identical Complaints

The FCC said it reviewed 41 complaints about Cleo, all of which "focused on the same types of allegations. According to the complaints, consumers searched the list of participating EBB Program providers through individual states' Universal Service or EBB Program websites, the FCC website, or USAC's \[Universal Service Administrative Company\] website and followed links to Cleo's website. The complaints alleged that Cleo accepted payment for EBB Program discounted broadband services or connected devices from these consumers electronically, failed to send the ordered product or provide the requested services, and then failed to provide refunds."

The FCC interviewed eight of the consumers who filed complaints, who live in Alabama, Arizona, Colorado, Illinois, Massachusetts, New York, Washington state, and Wisconsin.

An Illinois woman ordered a laptop from Cleo for $50 using the Venmo payment service. The woman got no response when she contacted Cleo to report that she never received the laptop, the FCC said. She then "attempted to reach out to Cleo via social media (Facebook) and by telephone, but Cleo did not respond and blocked her both on Facebook and telephone," the FCC said.

A New York woman "ordered an EBB Program-discounted tablet, laptop, 'Wi-Fi box,' and hotspot service from Cleo's website on July 13, 2021, and arranged payment of $108.94 on the website through PayPal," the FCC said. This consumer "told Bureau staff that she e-mailed Cleo when she did not receive the devices she ordered and that Cleo staff were 'rude to her and told her they didn't have to provide service to her.' She said someone at Cleo told her to 'read the fine print.' She exchanged a few e-mails with Cleo until it ultimately stopped responding."

Other complainants similarly said that Cleo stopped responding to messages seeking information on the devices they never received. Some of the consumers were able to cancel payments made via credit card or PayPal.

"The eight consumers interviewed by the Bureau and other consumers who filed complaints with the FCC's Consumer Complaint Center all stated that Cleo did not deliver the EBB Program-supported services or devices they ordered, and the company refused to issue refunds. Some consumers stated in their complaints that Cleo claimed it would sue them when they asked for a refund," the FCC said.

Shady Terms of Service Forbade Refunds

The terms of service that Cleo cited when denying refunds said the company "does NOT nor will ever imply or agree upon a refund, credits nor any other refunds of service and monies to be returned to you."

"Cleo Communications operates a PREPAID Service. All services are sold as in \[sic\] and without warranty. Under NO circumstances does Cleo Communications represent any warranty nor provide a refund of any kind for services that are offered," the terms state, according to the FCC. The Cleo terms additionally said that "charge backs to us via any customer bank is breach of contract at any time and is subject to further legal action up to but not limited to small claims court actions for breach of contract in the amount of what is disputed, any and all legal fees, court fees, attorney fees, filing fees, interest at 9.9%, and a contract breach fee in the amount of $300.00."

Rude Responses: “You Will Be Taken to Court”

The FCC document detailed incidents in which Cleo responded to customers seeking refunds by threatening to sue or seek charges for harassment:

_As examples, on August 2, 2021, when a customer e-mailed requesting a refund, Cleo responded, "\[y\]our wish to hide behind PayPal instead of contacting us. We will not be issuing you a refund. We will not be allowing you to use your benefits as we have claimed them. And you will be taken to Court. Cleo Care."_

_On August 10, 2021, when another customer requested a refund, Cleo responded, "Refund denied. Please see the terms of service that outline your rights and our obligations and rights that will be imposed. Also your EBB has been claimed. You will not use our credit anywhere else and you will be issued an invoice and to collections. Cleo Collections." Cleo continued in a later e-mail with that customer by saying, "\[n\]ext time read before you order. As we will now no longer communicate. Any further e-mails will result in harassment charges in Ohio. Cleo Legal."_

_On August 12, 2021, Cleo stated to another customer, "\[w\]e are not ignoring you, nor are we charging you. You have requested a refund and refunds are not given and was informed of this and someone would decide of \[sic\] one would be issued or not. Please see- kyty.xyz/terms.html. Is what was sent to the FCC. With documents that you are and have not been ignored that your claims state \[sic\]. Cleo Legal Affairs._

_This story originally appeared on_ _Ars Technica__._

An ISP Scam Targeted Low-Income People Seeking Government Aid

Known as ALPRs, this surveillance tech is pervasive across the US—and could soon be used by police and anti-abortion groups alike.

Since the United States Supreme Court overturned _Roe v. Wade_ last month, America’s extensive surveillance state could soon be turned against those seeking abortions or providing abortion care.

Currently, nine states have almost entirely banned abortion, and more are expected to follow suit. Many Republican lawmakers in these states are discussing the possibility of preventing people from traveling across state lines to obtain an abortion. If such plans are enacted and withstand legal scrutiny, one of the key technologies that could be deployed to track people trying to cross state lines is automated license plate readers (ALPRs). They’re employed heavily by police forces across the US, but they’re also used by private actors.

ALPRs are cameras that are mounted on street poles, overpasses, and elsewhere that can identify and capture license plate numbers on passing cars for the purpose of issuing speeding tickets and tolls, locating stolen cars, and more. State and local police maintain databases of captured license plates and frequently use those databases in criminal investigations.

The police have access to not only license plate data collected by their own ALPRs but also data gathered by private companies. Firms like Flock Safety and Motorola Solutions have their own networks of ALPRs that are mounted to the vehicles of private companies and organizations they work with, such as car repossession outfits. Flock, for instance, claims it’s collecting license plate data in roughly 1,500 cities and can capture data from over a billion vehicles every month.

“They have fleets of cars that have ALPRs on them that just suck up data. They sell that to various clients, including repo firms and government agencies. They also sell them to police departments,” says Jay Stanley, a senior policy analyst at the ACLU. “It’s a giant, nationwide mass surveillance system. That obviously has serious implications should interstate travel become part of forced-birth enforcement.”

Neither Flock Safety nor Motorola Solutions responded to requests for comment prior to publication.

Stanley says that ALPRs are more concentrated in metropolitan areas, but they’re also common in rural areas. If someone is traveling out of state to get an abortion, police could likely repeatedly identify where their license plate was scanned during the trip and the times it was scanned. With that information, they may be able to sketch out that person’s travel patterns. Police don’t need a warrant to obtain this information because license plates are out in the open and can be seen by anyone, which is not necessarily the case when the police want to obtain someone’s location data from their phone or use another tracking method.

“The more densely situated ALPR scanners are, the more they come to resemble GPS tracking,” Stanley says.

Once the person seeking an abortion has left the state, a police department could look for license plate data in another state through the private databases, or they could obtain this data via a police department in that state. Police departments around the country regularly share ALPR data with each other, and the data is often shared with little oversight.

“It’s a huge problem that people are sharing data without really being deliberate about who they’re sharing it with and why,” says Dave Maass, a senior investigative researcher for the Electronic Frontier Foundation (EFF).

Maass notes that police aren’t the only ones who could utilize ALPR data to track people seeking abortion access. Thanks to the passage of Texas Senate Bill 8 (SB 8), he says anti-abortion groups could use license plate data in litigation against whole swaths of people. That law allows anyone in the US to sue abortion providers, anyone who “aids or abets” someone seeking an abortion after a fetal heartbeat is detected (typically around six weeks)—or anyone with intent to help someone receive an illegal abortion in the state. Anti-abortion groups have also been known to write down people’s license plate numbers at abortion clinics over the years, Maass notes, so they may even have a database of license plate numbers already available to them that they could search through.

“One of the things I’m concerned about is this big private database that is operated by DRN Data. It’s not necessarily law enforcement but individual actors who might be trying to enforce abortion laws under things like Texas’ SB 8,” Maass says.

DRN Data operates a license plate reader database that receives its data from repo trucks and other vehicles equipped with ALPRs. (DNR Data did not yet respond to WIRED’s request for comment.) Regardless of who’s operating them, there’s no shortage of license plate scanners, and both Maass and Stanley say it would be extremely difficult for someone seeking an abortion to avoid being surveilled along the way.

“You could take an Uber, but that’s going to create a different data trail. You could rent a car, but that’s a different data trail. You could ride the bus, but that’s a different data trail,” Maass says.

One policy change that could help address this issue is if states would adopt the same kind of legislation that New Hampshire has, Stanley says. Its statute states that ALPR data “shall not be recorded or transmitted anywhere and shall be purged from the system within three minutes of their capture, unless the number resulted in an arrest, a citation, or protective custody or identified a vehicle that was the subject of a missing or wanted person broadcast.” This type of law would prevent police departments from retaining data that could be utilized for long periods.

Like abortion laws, ALPR regulations vary state by state. New Hampshire isn’t storing this data for long, but Arkansas—which last month criminalized nearly all abortion care—allows the data to be stored for 150 days. Other states may limit license plate data storage to between 21 and 90 days. Georgia, whose pending law would ban abortions after the detection of fetal cardiac activity, allows police to store license plate data for up to 30 months after collection. Maass says these issues will have to be addressed throughout the country.

“Legislators need to be looking at this. Law enforcement needs to talk to their city council members about how they’re going to address this,” Maass says. “Attorneys general who are claiming they’re going to protect abortion access need to look at their data systems. A lot of this is going to have to be dealt with in a policy context.”

ALPRs are just one of the many surveillance tools police departments and anti-abortion groups will have available to them, but they’ll become one of the most powerful tools available if states manage to make it illegal to cross state lines to obtain an abortion. For states that seek to safeguard access to abortion care, there’s little time to assess how this technology is being utilized and whether policies need to be altered to limit its use.

The Danger of License Plate Readers in Post-Roe America

Starting with iOS 16, people who are at risk of being targeted with spyware will have some much-needed help.

The surveillance-for-hire Industry has emerged in recent years as a very real threat to activists, dissidents, journalists, and human rights defenders around the world, as vendors offer increasingly invasive and effective spyware to governments. The most sophisticated of these tools, like NSO Group's notorious Pegasus spyware, target victims' smartphones using rare and sophisticated exploits to compromise Apple's iOS and Google's Android mobile operating systems. As the situation has deteriorated for victims, activists and security experts have increasingly called for more drastic measures to protect vulnerable individuals. Now Apple has an option.

Today, Apple is announcing a new feature for its upcoming iOS 16 release called Lockdown Mode. Apple emphasizes that the feature was created for a small subset of users who are at high risk of government targeting, and it doesn't expect the feature to be widely adopted. But for those who want to use it, the feature is an alternate mode of iOS that heavily restricts the tools and services that spyware actors target to take control of victims' devices.

“This is an unprecedented step for user security for high-risk users,” Ron Deibert, director of the University of Toronto's Citizen Lab said on a call with reporters ahead of the announcement. “I believe that this will throw a wrench into their modus operandi. I expect \[spyware vendors\] to try to evolve, but hopefully, this feature will prevent some of those harms from happening down the road.”

Lockdown Mode is a separate operating system mode. To turn it on, users enable the feature in the Settings menu and then are prompted to restart their device for all of the protections and digital defenses to fully take effect. The feature imposes limitations on the leakiest parts of the operating system sieve. Lockdown Mode attempts to comprehensively address threats from web browsing, for example, by blocking many speed and efficiency features that Safari (and WebKit) use to render webpages. Users can specifically mark a certain webpage as trusted so it loads normally, but by default, Lockdown Mode imposes a host of restrictions that extend anywhere WebKit is working behind the scenes. In other words, when you load web content in a third-party app or an iOS app like Mail, the same Lockdown Mode protections will apply. 

Lockdown Mode also limits all sorts of incoming invitations and requests, unless the device has previously initiated a request. That means your friend won't be able to call you on FaceTime, for example, if you've never called them. And to take it one step further, even when you initiate an interaction with another device, Lockdown Mode only honors that connection for 30 days. If you don't talk to a particular friend for weeks after that, you'll need to reestablish contact before they can reach out to you again. In Messages—a frequent target of spyware exploitation—Lockdown Mode won't show link previews and will block all attachments with the exception of a few trusted image formats.

Lockdown Mode also strengthens other protections. For example, when a device is locked, it won't receive connections from anything physically plugged into it. And, crucially, a device that isn't already registered with one of Apple's enterprise mobile device management (MDM) programs can't be added to one of these schemes once Lockdown Mode is turned on. This means that if your company gives you a phone enrolled in the corporate MDM, it will remain active if you then enable Lockdown Mode. And the manager of your MDM can't remotely turn off Lockdown Mode on your device. But if your phone is just a regular consumer device and you put it in Lockdown mode, you won't be able to activate MDM. This is important because attackers will trick victims into enabling MDM as a way of gaining the ability to install malicious apps on their devices.

Apple says the idea of Lockdown Mode feels foreign because iOS has always been developed to offer all security protections to every user. But the company saw the necessity to take drastic action as more and more spyware victims emerged worldwide. The company says it plans to continue refining Lockdown Mode and expanding it as needed. It also added a new category to its bug bounty program to reward researchers up to $2 million for finding flaws in Lockdown Mode or total bypasses. 

The company also pledged in November to donate $10 million to research and defense related to targeted spyware. On Wednesday, Apple is announcing that this money will become a grant to the Ford Foundation's Dignity and Justice Fund. At launch, advisers for the fund will come from Access Now, Citizen Lab, the Engine Room, Amnesty International, and Apple.

“The mercenary spyware industry is facilitating the spread of authoritarian practices,” Citizen Lab's Deibert emphasizes. “I applaud Apple for developing Lockdown Mode. It will be a major blow to mercenary spyware companies.”

Targeted spyware has proved a complicated threat to counter, and the industry is only growing. But a radical new defense can only help potential targets around the world who are exposed and in dire need of resources.

Apple’s Lockdown Mode Aims to Counter Spyware Threats

Fake sellers. Competitions. Crypto cons. There are plenty of grifts on the platform, but you don’t have to get sucked in.

Since Mark Zuckerberg snapped up Instagram for a mere $1 billion in April 2012, the app has grown into a social media juggernaut and one of Meta’s biggest assets. More than a billion people use Instagram every month, with influencers relying on it as a key source of their income.

Any online congregation of this size is naturally a target for hackers and scammers looking to take advantage of people and make a quick buck. As a result, Instagram is a frequent objective for scammers trying to take over your account and get you to send them money, as well as for shilling cryptocurrency scams.

“Instagram scams and account takeovers are a big problem,” says Jessica Barker, the co-CEO of cybersecurity company Cygenta, who says she has seen a recent uptick in reports of Instagram scammers. “Scams take place over all social media platforms, but Instagram’s popularity, open nature, and sense of personal connection make it an ideal platform for scammers to exploit.”

Still, it is possible to avoid the vast majority of Instagram scams with a little knowledge of what to be cautious of and some quick changes to your account settings.

How to Spot Scams on Instagram

Scammers move quickly. Whenever there’s a big event such as Russia’s war in Ukraine, the outbreak of Covid-19, or rapidly fluctuating cryptocurrency prices, the scams appear soon afterward. Online scams are constantly evolving, which means there are plenty of ways scammers may try to extort you. One startup is now even selling insurance against Instagram hacks.

“With Instagram being so popular, audiences can grow quickly, and often the number of followers can make people trust an account in no time,” says Jake Moore, global cybersecurity advisor at security firm ESET. “This is accelerated when known contacts already follow such accounts, and this trust can be a very forceful presence if required to make victims hand over details such as their credentials to a fake landing page to ‘sign in,’ for example.”

Instagram details the wide range of potential scams in a post on its website. These include loan and investment scams such as cryptocurrency scams, competitions and giveaway scams, job scams involving fake job ads, phishing scams to gain access to your account, and counterfeit products like fake iPhones and Apple Watches.

Scammers try to achieve a couple of things: They want you to send them money or get access to your Instagram account so it can be used in ongoing and future scams. These scams often work in similar ways as scammers try to trick you into either handing over personal information or money, or get you to click on links that can harvest your login details.

It’s likely that a lot of scam efforts on Instagram will be directed at you using direct messages. Scammers can send you messages or links to click on that lead to phishing websites. “A good way to recognize if you’re being manipulated is to look out for communications that are unexpected, make you feel something, and ask you to do something,” Barker says.

If an account slides into your DMs saying you’ve won a competition or that you should check out a way to make money quickly, or is offering some kind of promotional collaboration, then it's probably too good to be true. (You should delete the messages and report the scam.)

“When it comes to spotting a scam on Instagram, people should look out for messages asking you to click on a link, even if they appear to come from a friend, a trusted brand, or Instagram itself,” Barker adds. Scam messages often include typos, poor English, or want you to click on a link taking you away from the app. They often also come from recently created accounts.

Scammers have been spotted using Instagram’s logo and branding to send tech, verification, or security support messages to people via DMs. These are all fakes. Instagram says it will never send you direct messages about your account. (You can see official emails from Instagram in the app’s settings.) “Look out for posts about giveaways, gift cards, and investment schemes, as these are common tactics for criminals,” Barker says. If a brand is contacting you from an unverified account, you should be very cautious about replying.

Scams also come through Instagram Stories. “Fraudsters abuse the Instagram Stories feature, posting scams there that autodelete after 24 hours,” says Chris Boyd, lead malware intelligence analyst at cybersecurity firm Malwarebytes. “The scam is hidden behind their profile picture; you won't see it in the main collection of images,” Boyd says, adding that this move helps to keep the scam away from Instagram feeds and automatically vanish, making it harder to detect.

While competition scams and attempts to access people’s accounts aren’t new, Instagram has also seen a rise in “hostage-style” scams, where people are forced to post videos telling people to invest in bitcoin or other cryptocurrencies to get their hacked accounts returned. Multiple Instagram users, as reported by _VICE_, have been pressured into recording videos after their accounts were hacked. Other people report losing thousands to Instagram scammers. The incidents highlight why you shouldn’t trust every account you follow.

"Cryptocurrency scams are quick methods to whisk users away from the relative safety of the Instagram platform and onto trading sites where Instagram can't help,” Boyd says. “Extortion-driven cryptocurrency endorsements are a smart move on the part of the scammer. Leveraging people you know and trust in visual mediums to promote something is always going to be more convincing than a random email.”

How to Avoid Getting Scammed

There are things you can do to avoid getting hacked and the worst scams—these are a mixture of security settings and slight behavioral tweaks. Thankfully the process isn't too complicated, and small changes can make a big difference.

First, as mentioned earlier, you should avoid clicking on links that are sent to you, especially from accounts that you don’t know personally, or if someone you know sends a URL that seems out of character. “Following an account for many months still may not make it an authentic account,” Moore says.

If an account doesn’t seem right, you can look into its origins. “Research accounts to decide if they can be trusted—you can find information, such as when an account was created, by clicking **About this Account** under a profile. You can also check whether accounts are verified,” Barker says.

Second, your default setting should be one of suspicion. If your Instagram account is public, anyone can see your posts and message you. By limiting who can message you, you reduce the chances of being exposed to scams. To change whether your account is public or private, visit **Settings**, **Privacy**, and toggle your account to **Private**.

While you are in privacy settings, you should also limit who can message you. Under **Messages** there are options to send received messages to a Message Requests folder, and you can stop accounts that don’t follow you from messaging you through the **Others on Instagram** menu. For more details, see our guides on how to limit who can contact you on Instagram and the steps you can take to stop tracking and improve your Instagram privacy.

Arguably the biggest way you can protect your account from being taken over by scammers is by using a unique, strong password—stored in a password manager—and turning on multifactor authentication. Enabling multifactor authentication requires anyone trying to log in to your account to use a login code or click a notification in addition to using your password—and it's effective against account takeovers.

To turn on two-factor authentication on Instagram, tap on your profile picture in the bottom right corner of your phone, then tap on the hamburger menu. Go to **Settings**, then **Security**, then **Two-Factor Authentication**. You can turn on security protection there. If, in the worst-case scenario, your Instagram account does get hacked, here’s what you should do.

How to Avoid the Worst Instagram Scams

With abortion set to be criminalized in more than half the US, encryption has never been more important for protection—and civil disobedience.

a number of course-altering US Supreme Court decisions last month—including the reversal of a constitutional right to abortion and the overturning of a century-old limit on certain firearms permits—have activists and average Americans around the country anticipating the fallout for rights and privacy as abortion “trigger laws,” expanded access to concealed carry permits, and other regulations are expected to take effect in some states. And as people seeking abortions scramble to protect their digital privacy and researchers plumb the relationship between abortion speech and tech regulations, encryption proponents have a clear message: Access to end-to-end encrypted services in the US is more important than ever.

Studies, including those commissioned by tech giants like Meta, have repeatedly and definitively shown that access to encrypted communications is a human rights issue in the digital age. End-to-end encryption makes your messages, phone calls, and video chats unintelligible everywhere except on the devices involved in the conversations, so snoops and interlopers can’t access what you’re saying—and neither can the company that offers the platform. As the legal climate in the US evolves, people who once thought they had nothing to hide may realize that era is now over.

“There are plenty of people in the US for whom it has always been true that the state wasn’t really helping them and was mostly harming them,” says Riana Pfefferkorn, a research scholar at the Stanford Internet Observatory. “But for those who are now losing faith in traditional institutions of government, it provides room for them to say, ‘OK, what technologies exist for taking back some control?’”

Over the past decades, law enforcement officials around the world have increasingly marked encryption as a hindrance to investigations and, therefore, a threat. The US Department of Justice and other agencies worldwide have campaigned to undermine encryption features with backdoors or make it economically infeasible for companies to offer the protection. While it is important to prevent violence and prosecute activity like the distribution of child sexual abuse materials, researchers consistently note that criminals will deploy and use encryption to protect their data whether the tools are legal or not—as has been the case with terrorist groups like Al Qaeda and ISIS.

Moxie Marlinkspike, the cryptographer who founded the open source, end-to-end encrypted messaging service Signal, explored the question of criminality and access to secure communications in a blog post nearly 10 years ago. “Police already abuse the immense power they have, but if everyone’s _every_ action were being monitored, and everyone technically violates some obscure law at some time, then punishment becomes purely selective,” he wrote. "Those in power will essentially have what they need to punish anyone they’d like, whenever they choose.”

The potential for laws to change abruptly and completely was on display last month in the Supreme Court’s _New York State Rifle & Pistol Association v. Bruen_ decision that struck down a century-old concealed carry licensure law with implications for similar laws in other states. And _Dobbs v. Jackson Women’s Health Organization_ instantly banned abortion in many states—a move that means people around the country who were previously law-abiding may now be seeking life-or-death treatment in violation of the law. Furthermore, in restrictive states, people who aid someone who receives an abortion or who are simply close to a patient could now be subject to law enforcement surveillance and investigation, regardless of whether they are ultimately charged and prosecuted.

Meanwhile, anti-encryption initiatives in the US, including proposed legislation like the Earn It Act, continue to pit law enforcement against technical protections. Pfefferkorn is clear about the divide. “You really can’t be pro-choice and anti-encryption at this point,” she says.

Researchers point out that encryption is often thought of in the context of enabling free speech, but it can also be looked at through the lens of self-defense.

“Effective, uncensorable, secret communications are certainly far more valuable to resistance movements than small arms are,” says computer security consultant Ryan Lackey. “If you had magic, secure telepathy between everyone in your organization, in a civil war or resistance scenario where some of your allies were inside the opposition, you wouldn’t need a single gun to win.”

Lackey points out that there are parallels between encryption and firearms, as laid out in the Second Amendment, an observation that others have explored at times. The crucial element, though, is the connection to a right to self-defense, which the Supreme Court’s Second Amendment absolutists cite repeatedly as the law’s “central component.”

Beyond end-to-end encryption’s ability to protect people from their government, police, and prosecutors, it also protects them from other people who seek to enact harm, be they criminal hackers or violent extremists. While equating encryption to a weapon misconstrues its function—it’s much more shield than sword—these defenses remain the most powerful tool people everywhere have to protect their digital privacy. And a clear parallel can be drawn to the fervor with which gun advocates embrace their right to bear arms.

Stanford's Pfefferkorn points out that it is logical and necessary for abortion providers, patients, or anyone who is pro-choice to embrace and defend encryption in general, but particularly so in light of the overturning of _Roe v. Wade._ She adds that in this moment, when the Supreme Court is reversing decades of established precedent on a variety of issues at once, the most important generalizable takeaway is the benefits of access to end-to-end encryption, and the necessity of preserving that access.

“Laws can change. Social rules can change. The perfectly harmless conversation you had yesterday might come back to hurt you years from now,” says Johns Hopkins cryptographer Matthew Green. “That’s why we don’t write down every spoken conversation and keep it forever. Encryption is just a way to give digital communications the same basic protections.”

Twenty-six states have either criminalized abortion, will do so, or are likely to take that step. How those laws will be enforced remains unknown. What’s certain is that millions of people who had nothing to hide before the Supreme Court’s June 24 decision now face the prospect of potential targeting, surveillance, and even prison over their reproductive health. And comprehensive encryption will be essential to their self-defense. As Signal’s Marlinspike said during a panel discussion at the 2016 RSA security conference in San Francisco, “I actually think that law enforcement should be difficult … I think it should actually be possible to break the law.”

Source

Wired