In occupied Ukraine, people’s internet is being routed to Russia—and subjected to its powerful censorship and surveillance machine.

Web pages in the city of Kherson in south Ukraine stopped loading on people’s devices at 2:43 pm on May 30. For the next 59 minutes, anyone connecting to the internet with KhersonTelecom, known locally as SkyNet, couldn’t call loved ones, find out the latest news, or upload images to Instagram. They were stuck in a communications blackout. When web pages started stuttering back to life at 3:42 pm, everything appeared to be normal. But behind the scenes everything had changed: Now all internet traffic was passing through a Russian provider and Vladimir Putin’s powerful online censorship machine.

Since the end of May, the 280,000 people living in the occupied port city and its surrounding areas have faced constant online disruptions as internet service providers are forced to reroute their connections through Russian infrastructure. Multiple Ukrainian ISPs are now forced to switch their services to Russian providers and expose their customers to the country’s vast surveillance and censorship network, according to senior Ukrainian officials and technical analysis viewed by WIRED.

The internet companies have been told to reroute connections under the watchful eye of Russian occupying forces or shut down their connections entirely, officials say. In addition, new unbranded mobile phone SIM cards using Russian numbers are being circulated in the region, further pushing people towards Russian networks. Grabbing control of the servers, cables, and cell phone towers—all classed as critical infrastructure—which allow people to freely access the web is considered one of the first steps in the “Russification” of occupied areas.

“We understand this is a gross violation of human rights,” Victor Zohora, the deputy head of Ukraine’s cybersecurity agency, known as the State Services for Special Communication and Information Protection (SSSCIP), tells WIRED. “Since all traffic will be controlled by Russian special services, it will be monitored, and Russian invaders will restrict the access to information resources that share true information.”

KhersonTelecom first switched its internet traffic to a Russian network on April 30, before flipping back to Ukrainian connections for the majority of May. However, things appear to have shifted permanently since May 30. All of KhersonTelecom’s traffic is now being routed through Miranda Media, a Crimea-based company that’s itself connected to Russian national telecom provider Rostelecom. (Miranda Media was set up after Putin annexed Crimea in 2014). The day after KhersonTelecom made its latest switch, state-controlled Russian media outlet RIA Novosti claimed the Kherson and Zaporizhzhia areas were officially being moved to Russian internet connections—days earlier, the outlet said the regions were also going to start using the Russian telephone code +7.

Zohora says that across occupied regions of Ukraine—including Kherson, Luhansk, Donetsk, and Zaporizhzhia—there is a patchwork of around 1,200 different ISPs. “We understand that most of them are forced to connect to Russian telecom infrastructure and reroute traffic,” Zohora tells WIRED. “Unfortunately, there are cases of massive routing of traffic of Ukrainian operators across Russian channels,” says Liliia Malon, the commissioner of Ukraine’s telecom regulator, the National Commission for the State Regulation of Electronic Communications. “Ukrainian networks are partially blocked or completely disconnected.”

Technical analysis confirms that the connections are switching. Internet monitoring company Cloudflare has observed KhersonTelecom’s traffic passing through Miranda Media for more than two weeks in June. Doug Madory, director of internet analysis at monitoring firm Kentik, has observed around half a dozen networks in Kherson connecting to the provider. “It's not a one-time thing,” Madory says. “Every couple of days, there's another company getting switched over to Russian transit from Ukraine.”

Since the start of Putin’s war in February, disrupting or disabling internet infrastructure has been a common tactic—controlling the flow of information is a powerful weapon. Russian missiles have destroyed TV towers, a cyberattack against a satellite system had knock-on impacts across Europe, and disinformation has tried to break Ukrainian spirits. Despite frequent internet blackouts, Ukraine’s rich ecosystem of internet companies has rallied to keep people online. While Ukrainian troops are successfully launching counterattacks against Russian occupation in the south of the country, Kherson remains controlled by invading forces. (In March, it became the first major city to fall into Russian hands, and its residents have lived under occupation for around 100 days, reporting numerous incidents of torture.)

“It's one thing to take over a city and to control the supply lines into the city, the flow of food or fuel,” says David Belson, head of data insight at Cloudflare, who has written about internet control in Kherson. But, he says, “controlling internet access and being able to manipulate the internet access into an occupied area” is a “new front” in the conflict.

There are multiple ways Russian forces are taking over internet systems. First, there is physical access—troops are seizing equipment. Spokespeople for two of Ukraine’s biggest internet providers, Kyivstar and Lifecell, say their equipment in Kherson was switched off by Russian occupying forces, and they don’t have any access to restore or repair equipment. (Throughout the war, internet engineers have been working amid shelling and attacks to repair damaged equipment). The SSSCIP says 20 percent of telecommunications infrastructure across the whole of Ukraine has been damaged or destroyed, and tens of thousands of kilometers of fiber networks are not functioning.

Once Russian forces have control of the equipment, they tell Ukrainian staff to reconfigure the networks to Miranda Media, Zohora says. “In case the local employees of these ISPs are not willing to help them with the reconfiguration, they are able to do it by themselves,” Zohora says. The SSSCIP, he adds, has advised staff not to risk their own lives or the lives of their families. “We hope that we are able to liberate these lands soon and this temporary period of blackmailing of these operators will pass off,” Zohora says, adding it is unlikely that communications in the region can be restored before the areas are liberated.

For the time being, at the very least, this means connections will be routed through Russia. When Gudz Dmitry Alexandrovich, the owner of KhersonTelecom, switched his connection to Miranda Media for the first time at the start of May, he claims some customers thanked him because he was getting people online, while others chastised him for connecting to the Russian service. “On May 30 again, like on April 30, everything absolutely everything fell and only Miranda's channels work,” Alexandrovich says in a translated online chat. In a long Facebook post published on the company’s page at the start of May, he claimed he wanted to help people and shared photos of crowds gathering outside KhersonTelecom’s office to connect to the Wi-Fi.

Russia is also trying to control mobile connections. In recent weeks, a mysterious new mobile company has popped up in Kherson. Images show blank SIM cards—totally white with no branding—being sold. Little is known about the SIM cards; however, the mobile network appears to use the Russian +7 prefix at the start of a number. Videos reportedly show crowds of citizens gathering to collect the SIM cards. “The Russian forces realize they're at a disadvantage if they keep using Ukrainian mobile networks,” says Cathal Mc Daid, the chief technology officer at mobile security company AdaptiveMobile. The company has seen two separatist mobile operators in Donetsk and Luhansk expanding the territory they are covering to newly occupied areas.

Who controls the internet matters. While most countries place only limited restrictions on the websites people can view, a handful of authoritarian nations—including China, North Korea, and Russia, severely limit what people can access.

Russia has a vast system of internet censorship and surveillance, which has been growing in recent years as the country tries to implement a sovereign internet project that cuts it off from the rest of the world. The country’s System for Operative Investigative Activities, or SORM, can be used to read people’s emails, intercept text messages, and surveil other communications.

“Russian networks are fully controlled by the Russian authorities,” Malon, the Ukrainian telecom regulator, says. The rerouting of the internet in occupied Ukrainian areas, Malon says, has the goal of spreading “Kremlin propaganda” and making people believe Ukrainian forces have abandoned them. “They are afraid that the news about the progress of the Ukrainian army will encourage resistance in the Kherson region and facilitate real activities,” Zohora says.

At the heart of the rerouting is Miranda Media, the operator in Crimea that appeared following the region’s annexation in 2014. Among “partners” listed on its website are the Russian security service known as the FSB and the Russian Ministry of Defense. The company did not respond to a request for comment.

In many ways, Crimea may act as an example of what happens next in newly occupied areas. “Only in 2017, Crimea was completely disconnected from Ukrainian traffic. And now, as far as I know, it's only Russian traffic there,” says Ksenia Ermoshina, an assistant research professor at the Center for Internet and Society and an affiliated researcher at the Citizen Lab. In January last year, Ermoshina and colleagues published research on how Russia has taken control of Crimea’s internet infrastructure.

After it annexed Crimea in 2014, Russian authorities created two new internet cables running along the Kerch Strait, where they connect with Russia. This process took three years to complete—something Ermoshina calls a “soft substitution model,” with connections transferring slowly over time. Since then, Russia has developed more advanced internet control systems. “The power of the Russian censorship machine changed in between \[2014 and 2022\],” Ermoshina says. “What I'm afraid of is the strength of Russian propaganda.”

It’s likely that rerouting the internet in Kherson and the surrounding areas is seen by Russian authorities as a key step in trying to legitimize the occupation, says Olena Lennon, a Ukrainian political science and national security adjunct professor at the University of New Haven. The moves could also be a blueprint for future conflicts.

Alongside internet rerouting in Kherson and other regions, Russian officials have started handing out Russian passports. Officials claim a Russian bank will soon open in Kherson. And the region has been moved to Moscow’s time zone by occupying forces. Many of the steps echo what previously happened in Crimea, Donetsk, and Luhansk. “Russia is making it clear that they're there for a long haul,” Lennon says, and controlling the internet is core to that. “They're making plans for a long-term occupation.”

Russia Is Taking Over Ukraine’s Internet

Many people reportedly died after struggling to access medical care during a brutal lockdown. The families want to make sure these deaths are counted.

ZHOU SHENGNI NEEDED a doctor, and fast. The 49-year-old, who was having an asthma attack, was being driven by her family to Shanghai East Hospital, where she worked as a nurse, for urgent treatment. It was March 23, and the Chinese city was under a strict Covid lockdown.

However, when they arrived at the emergency department, Zhou’s family found that it was closed for disinfection under Shanghai’s rules to contain the spread of Covid. In urgent need of medical care, they had no choice but to drive to another hospital about 9 kilometers away. Zhou later died.

Zhou’s death caused outrage on Chinese social media, but it was not an isolated incident. Shanghai’s citywide lockdown lasted two months, with most restrictions removed on June 1. But, for those two months, almost nothing moved—including the city’s hospitals, which were hit by sudden closures, with many restricting their services to emergencies only. Patients in need of medical help were told to present a negative PCR test to access care.

From February to May, health authorities in Shanghai had reported 588 deaths related to Covid-19, the majority elderly residents. But officials didn’t count people like Zhou, who may have died as a result of the city’s lockdown restrictions.

Discussions about the collateral damage of China’s zero-Covid policy are heavily restricted in the country. Censors have blocked comments from people opposing the pandemic strategy, including remarks made by World Health Organization director-general Tedros Adhanom Ghebreyesus. But, as ever in China, censorship has not stopped people from finding technical workarounds to express dissent.

On April 14, a WeChat account called Shi You shared an article entitled “Shanghai Deceased,” which reported on people in the city who had seemingly died as a result of harsh lockdown restrictions. The article’s comment section was quickly flooded with messages from people saying they had also heard of or knew someone who had died during the lockdown.

Capser Yu immediately realized that both the article and its comments were important. A Shanghai native now working in Singapore, Yu had heard stories of people back home who had lost loved ones during lockdown. One of those lost was Chen Xiangru, a 3-year-old girl who was reportedly unable to receive timely treatment when she developed a serious fever in late March. Chen died in hospital while waiting for the result of a PCR test doctors required to provide treatment.

Worried that censors would hide crucial evidence, Yu started taking screenshots of the WeChat article. A few hours later, WeChat scrubbed the article. When people in China tried to open the article again, all that was left was a message saying it “violates regulations.”

Yu reposted the content on a blog he created, called Real China, to help keep his parents in Shanghai informed about how news in China was being reported overseas. Within hours, Chinese censors blocked the reposted content. Yu says the article, which is still accessible outside China, was read by more than 20,000 people before it was censored. The link has since started working again for unknown reasons and, by the end of June, had become the most-read post on Yu’s blog.

During the past two months, several projects trying to document deaths linked to Shanghai’s recent lockdown have appeared online. One of the largest, on the collaboration service Airtable, has been live since April. The page is a mix of basic descriptions, images of dead bodies, location information, scans of documents, and photos of the smiling faces of the loved ones who have now passed away. The database went viral but was swiftly blocked on WeChat and Weibo for containing “non-compliant content.” Though users in China can still access it, discussions of the database have been restricted on social media.

By early June, the database contained 210 entries, each representing a life reportedly lost. It’s unclear how many of these deaths might be directly linked to Shanghai’s lockdown, but a separate tally, conducted by Singapore-based news outlet Initium Media, claimed that at least 170 people had died as a result of lockdown measures by early May. Many of the deaths were linked to difficulties accessing urgent medical treatment, the report claimed.

A Shanghai-based recruiter, who asks not to be named for security reasons, says he felt “hopeless” when he found out about the death of an industry colleague’s mother, who had skin cancer and was reportedly denied treatment because she had Covid. Though he didn’t know the woman personally, the recruiter decided not to let her death go unreported. On Reddit, he found a shared Google Sheet that, like the Airtable database, kept a record of the deceased.

The recruiter added details he knew about the woman to the spreadsheet for fact-checking. Volunteers working on the document are required to list their sources, and each link is archived by the Wayback Machine in case the post disappears. The shared document has stricter sourcing rules and fewer entries than the Airtable database—just 60 cases—and was last updated in early May.

The recruiter says he has no idea who created the document or who he was working with, but he feels safer this way. “I would be a bit afraid if we talk to each other in private,” he says, adding that he is still haunted by an experience of being reprimanded at school for speaking out on Twitter against an influential official.

It’s almost impossible to grasp the scale of the suffering caused by Shanghai’s recent lockdown. But Daohouer, a volunteer-run mutual aid network created to help people access food, treatment, and medication during the lockdown, hints at the level of desperation. The site worked by encouraging residents in urgent need of supplies or health care to leave a message, with volunteers then contacting them to help. A visualization of requests submitted to the network shows that over half of the requests dealt with medical accessibility.

The page has kept a record of 1,297 requests in Shanghai involving seriously ill people since April 11, when the data became available. The number of such requests peaked in mid-April, when the site reported a surge in messages from people seeking help accessing medical care.

The cases from Daohouer were visualized by two Chinese people living in Canada who form part of a tech collective called O3O. The pair plan to archive the data submitted to the platform in case it is somehow scrubbed by censors. “The older generation has a habit of hoarding food,” says one of O3O’s cofounders, who asks to remain anonymous. “But the younger generation has the habit of taking screenshots of all things that might be considered sensitive.” The duo also maintains a website called Our Pandemic Memory that invites people to record stories of their lockdown lives. The site, preempting likely censorship in China, automatically submits every story to the Wayback Machine.

Despite efforts to record deaths in the city, the Shanghai-based recruiter remains skeptical that the government will launch an official investigation into the number of people who reportedly died as a result of the recent lockdown. No such efforts have been announced following similar citywide lockdowns in cities such as Xi’an, where deaths related to difficulties in accessing health care have also been reported.

Still, the recruiter hopes that projects to remember and record the dead could, one day, help people learn what life, and death, was really like in Shanghai during the harshest of lockdowns. “Maybe one day in the future, when we can discuss the outbreak and learn lessons, these materials will be used for reference.”

Shanghai’s Censors Can’t Hide Stories of the Dead

A pair of ransomware attacks crippled parts of the country—and rewrote the rules of cybercrime.

But the attack against the finance ministry was just the beginning. A timeline shared by Mora claims Conti attempted to breach different government organizations almost every day between April 18 and May 2. Local authorities, such as the Municipality of Buenos Aires, were targeted, as well as central government organizations, including the Ministry of Labor and Social Security. In some cases, Conti was successful; in others, it failed. Mora says the US, Spain, and private companies helped defend against Conti attacks, providing software and indicators of compromises related to the group. “That blocked Conti a lot,” he says. (In early May, the US posted a $10 million reward for information about Conti’s leadership.)

On May 8, Chaves started his four-year term as president and immediately declared a “national emergency” due to the ransomware attacks, calling the attackers “cyberterrorists.” Nine of the 27 targeted bodies were “very affected,” Chaves said on May 16. The MICIT, which is overseeing the response to the attacks, did not respond to questions about the progress of the recovery, despite originally offering to set up an interview.

“All the national institutions, they don’t have enough resources,” Robles says. During the recovery, he says, he has seen organizations running on legacy software, making it much harder to enable the services they provide. Some bodies, Robles says, “don’t even have a person working on cybersecurity.” Mora adds that the attacks show Latin American countries need to improve their cybersecurity resilience, introduce laws to make cyberattack reporting mandatory, and allocate more resources to protect public institutions.

But just as Costa Rica started getting a grip on the Conti attacks, another hammer blow struck. On May 31, the second attack started. The systems of the Costa Rican Social Security Fund (CCSS), which organizes health care, were taken offline, plunging the country into a new kind of disarray. This time the HIVE ransomware, which has some links to Conti, was blamed.

The attack had an immediate effect on people’s lives. Health care systems went offline and printers spewed out garbage, as first reported by security journalist Brian Krebs. Since then patients have complained of delays in getting treatment and the CCSS has warned parents whose children were undergoing surgery that they may have trouble locating their kids. The health service has also begun printing discontinued paper forms.

By June 3, CCSS had declared an “institutional emergency,” with local reports claiming that 759 of the 1,500 servers and 10,400 computers have been impacted. A spokesperson for CCSS says hospital and emergency services are now running normally and the efforts of its staff have maintained care. However, those seeking medical care have faced significant disruptions: 34,677 appointments have been rescheduled, as of June 6. (The figure is 7 percent of total appointments; the CCSS says 484,215 appointments have gone ahead.) Medical imaging, pharmacies, testing laboratories, and operating theaters are all facing some disruption.

The Death of Conti

There are questions about whether the two separate ransomware attacks against Costa Rica are linked. However, they come as the face of ransomware may be changing. In recent weeks, Russian-linked ransomware gangs have changed their tactics to avoid US sanctions and are fighting over their territory more than usual.

Conti first announced its attack on the finance ministry on its blog, where it publishes the names of its victims and, if they fail to pay its ransom, the files it has stolen from them. A person or group dubbing themselves unc1756—the “UNC” abbreviation is used by some security firms to indicate “uncategorized” attackers—used the blog to claim responsibility for the attack. The attacker demanded $10 million as a ransom payment, later upping the figure to $20 million. When no payment was made, they started uploading 672 GB of files to Conti’s website.

Conti's Attack Against Costa Rica Sparks a New Ransomware Era

Plus: Russia rattles its cyber sword, a huge Facebook phishing operation is uncovered, feds take down the SSNDOB marketplace, and more.

How do you smuggle information into the USSR right under the nose of the KGB? Create your own encryption system, of course. That’s exactly what saxophonist and music professor Merryl Goldberg did during the 1980s. This week Goldberg revealed that she used musical notation to hide the names and addresses of activists and details of meetings on a rare trip to the Soviet Union. To do so, she cooked up her own encryption system. Each musical note and marking represented letters of the alphabet and helped disguise the sensitive information. When Soviet officers inspected the documents, no suspicions were raised.

Goldberg’s story was retold at the RSA Conference in San Francisco this week, where WIRED’s Lily Newman has been digging up stories. Also coming out of RSA: a warning that as ransomware becomes less profitable, attackers may turn to business email compromise (BEC) scams to make money—BEC attacks are already highly profitable.

Also this week, dark-web marketplace AlphaBay is about to complete its journey back to the top of the online underworld. The original AlphaBay site—home to more than 350,000 product listings, ranging from drugs to cybercrime services—was purged from the dark web in July 2017 as part of a huge law enforcement operation. However, AlphaBay’s second-in-command, an actor going by the name of DeSnake, survived the law enforcement operation and relaunched the site last year. Now AlphaBay is growing quickly and is on the verge of resuming its dominant dark-web market position.

Elsewhere, Apple held its annual Worldwide Developers Conference this week and revealed iOS 16, macOS Ventura and some new MacBooks—WIRED’s Gear team has you covered on everything Apple announced at WWDC. However, there are two standout new security features worth mentioning: Apple is replacing passwords with new cryptographic passkeys, and it’s introducing a safety check feature to help people in abusive relationships. Database firm MongoDB also held its own event this week, and while it might not have been as high-profile as WWDC, MongoDB’s new Queryable Encryption tool may be a key defense against preventing data leaks.

Also this week we’ve reported on a Tesla flaw that lets anyone create their own NFC car key. New research from the ​​Mozilla Foundation has found that disinformation and hate speech are flooding TikTok ahead of Kenya’s elections, which take place at the start of August. Elon Musk reportedly gained access to Twitter’s “fire hose,” raising privacy concerns. And we dove into the shocking new evidence televised by the House January 6 committee.

But that's not all, folks. Each week we round up the big security and privacy news we didn't cover ourselves. Click the links for the full stories, and stay safe out there.

For the past two years, state-sponsored hackers working on behalf of the Chinese government have targeted scores of communications technologies, ranging from home routers to large telecom networks. That’s according to the NSA, FBI, and the Cybersecurity and Infrastructure Security Agency (CISA), which published a security advisory this week detailing the “widespread” hacking.

Since 2020, Chinese-backed actors have been exploiting publicly known software flaws in hardware and incorporating compromised devices into their own attack infrastructure. According to the US agencies, the attacks typically contained five steps. China’s hackers would use publicly available tools to scan for vulnerabilities in networks. They would then gain initial access through online services, access login details from the systems, get access to routers and copy network traffic, before finally “exfiltrating” victim data.

“Exploiting these vulnerabilities has allowed them to establish broad infrastructure networks to exploit a wide range of public- and private-sector targets,” the agencies say in their joint advisory.

Since the start of the war in Ukraine, Russia has been hacked at an unprecedented scale. Now, more than 100 days into the war, tensions around cyber activity are rising. On June 9, Russia’s Foreign Ministry said that its critical infrastructure and government bodies were being hit by cyberattacks and warned that it could lead to military confrontation with the West. “The militarization of the information space by the West, and attempts to turn it into an arena of interstate confrontation, have greatly increased the threat of a direct military clash with unpredictable consequences,” the Foreign Ministry said in a statement. From the moment Russian troops entered Ukraine, questions have been raised about the potential for escalation if people outside of Ukraine are involved in cyberattacks against Russia. Last week, the head of US Cyber Command told _Sky News_ that its military hackers have been involved in offensive operations that support Ukraine.

Phishing remains one of the most successful ways for criminals to break into people’s accounts and make money—and there’s no better example of this than a newly uncovered Facebook and Facebook Messenger phishing campaign. This week, security researchers at US firm PIXM revealed a huge network of at least 400 phishing pages that are raking in millions of views and have made its creators an estimated $59 million. The scam, which has been running since at least September 2021, directs people to false Facebook login pages where their credentials are hoovered up. What stands out, as noted by the Register, is that the phishing campaign has managed to avoid Facebook’s phishing detection methods more effectively than others.

So far in 2022, police and tech companies have been cracking down on cybercriminals with some success: Raidforums, ZLoader, and the dark-web market Hydra have all been shut down in recent months. That list got a little bit longer this week as the FBI and its international law enforcement took down a marketplace selling the personal information of around 24 million Americans, according to authorities. The SSNDOB marketplace, which was made up of four individual domains, was selling people’s names, dates of birth, and Social Security numbers. SSNDOB has existed for around a decade, and in 2013, details obtained from the organization were used in the takeover of Xbox Live accounts. It’s believed the website has made its unknown owners around $22 million since 2015.

How China Hacked US Phone Networks

Twitter has reportedly given the billionaire access to its full stream of tweets and related user data. Is your privacy in jeopardy?

Elon Musk’s never-ending attempt to take over Twitter has taken yet another weird turn as the social media platform appears to have acceded to the entrepreneur’s request to gain access to a “fire hose of” internal data held by the company.

For weeks, Musk has pressed Twitter to provide data that would allow the South African entrepreneur to test whether a significant share of the platform’s users are fake bot accounts—something he believes would cheapen the price he’d be willing to pay for the company. Musk contends that bot accounts make up more than 5 percent of Twitter’s user base—something even Musk’s critics believe is true—and wants the company to disprove that.

Twitter has reported lower numbers of inauthentic accounts in its financial results, and according to _The Washington Post_, it is willing to give Musk access to every tweet posted daily, alongside granular user information, in order to allow him to look for inauthentic behavior. (Informally, this data is called the "fire hose.” Twitter declined WIRED's request to confirm or deny the _Post_ report.) Twitter’s apparent willingness to grant Musk access to the datastream comes days after the suitor’s lawyers sent a letter to the company saying it was “actively resisting and thwarting \[Musk’s\] information rights,” and threatening to pull out of the deal.

The reported shift to grant Musk access to the data is significant, and it raises two key questions: One, will Musk get what he wants from the data he’s been given? And two: What does him gaining access mean for everyday users’ privacy and security?

For Axel Bruns, professor at Queensland University of Technology, the move is Twitter calling Musk’s bluff. “By giving him access to the fire hose, Twitter can presumably say, ‘Prove your claims about the abundance of bots, then,’” he says. Bruns believes that Musk and whoever he employs to track down bots would have a difficult time. But even for someone with the requisite skills to handle that level of data, it’s unlikely to be the right method to answer the question. It’s uncertain whether access to the fire hose of 500 million tweets posted to the social media platform every day will actually help Musk answer the key question he claims is holding up his purchase of Twitter: The proportion of users who are bots. “It seems a bit performative,” says Paddy Leerssen, a researcher in information law at the University of Amsterdam. “My sense is that this data isn’t the data you need to figure out who’s a bot or not.”

Being able to pinpoint what makes a bot a bot has been a hotly debated subject in the field of academia, one that experts have devoted much of their working lives to—which is why they’re skeptical that access to all the tweets posted to Twitter will answer the bot question definitively enough to convince Musk to go ahead with the purchase. “My impression is that people tend to overestimate how easy it is to detect bots,” says Leerssen. “A tool like this \[the fire hose\] isn’t going to enable you to do that, unless you combine it with all sorts of other research methods. I don’t think that’s something that in a timeline like this, Elon Musk is going to have time for.” The man who could answer how that data would help him identify bots, Musk himself, did not respond to an emailed request for comment.

Giving Musk access to the fire hose of tweets is a relatively innocuous move, says Christopher Bouzy, the founder of Bot Sentinel, a service that tracks inauthentic behavior on Twitter. “It doesn’t expose users’ private data,” he says. “It’s just a stream of tweets.” From that stream, Musk could analyze the data to see whether accounts spammed the same message, or whether a small number of accounts were responsible for the majority of tweets on the platform—both of which would be potential warning signals for bot behavior. Asked whether we should be concerned about Musk gaining access to the fire-hose data, Bouzy said no. “It’s just a massive number of tweets,” he says. And it’s also an unmanageable number of tweets for pretty much everyone outside Twitter: Bruns points out that the US Library of Congress once had fire hose access in an attempt to archive every tweet ever posted and gave up on the endeavor.

Musk’s interest in the fire hose data is ironic, given that he reportedly declined an offer to look at Twitter’s data room—a collection of information and documents that are collated by companies when touting their businesses to potential buyers—back when his initial takeover bid was launched in April. Twitter spokesperson Jasmine Basi declined to respond to questions, including whether Musk previously asked for access to the data room. Basi also refused to answer direct questions about how many people outside of Twitter, other than Musk, have access to the fire hose data, and whether Musk would have to sign a nondisclosure or usage agreement in order to access it. That gives some cause for concern. “While I understand what Twitter is doing here, it is nonetheless also highly unusual,” says Bruns, who equates it to “giving away the crown jewels”.

The crown jewels are, however, up for sale: Around two dozen companies already have access to the fire hose of data to which Twitter has granted Musk access. Twitter’s Basi declined to name those companies, but their handling of the data has so far seemingly not caused any known issues among those dozen firms. Previously, Twitter has given broader fire hose access, with issues: The company recognized it was leaving money on the table by giving third-party data resellers access, while spy agencies previously gained access to user data through Dataminr, a company that had bought fire hose access. Google and researchers at the Massachusetts Institute of Technology have previously had access to the same data Musk is now being granted access to. “The sharing of sensitive information is a key part of acquisition procedures,” says Leerssen, who prior to his career in academia worked on data protection issues around data rooms for due diligence. “When you go through the process of acquiring a company, you need to look under the hood,” he says.

Yet the big unknown is Musk himself—someone who has already shown during the course of his attempted acquisition that he’s willing to ignore legal agreements. Many also see his ostensible concern about the number of bot accounts as a pretext in order to back out of the deal, despite the terms of the agreement he came to with Twitter precluding that from happening without massive, punitive fines.

“It basically becomes more about trying to psychoanalyze Elon Musk than about the Twitter data, almost,” says Midas Nouwens, assistant professor in digital rights at Aarhus University. Nouwens has long had concerns about the scale of information available to employees at Twitter—a single tech company in a single jurisdiction in the world. “I find it a bit difficult to separate the way that social media platforms like Twitter operate, and then the rogue element of Elon Musk in there,” he says. “It very quickly becomes trying to figure out what Elon Musk would do, and his behavior is quite erratic sometimes.”

Nouwens is one of those who has access to Twitter data through an API available to researchers that allows him to query 10 million tweets a month. Gaining access to the datastream, he says, was easier than expected given the volume of data he had access to. He had to write a description of the project he intended to use the data for, alongside providing proof he was an active academic. “Whether it was Elon Musk or some other actor, I would always have concerns,” Nouwens says. “Now for him, the added element is his past behavior, sure, but also his commercial interests.” The fear is that even if Musk does pull out of the deal to buy Twitter, the information he’s been granted access to by getting free visibility over Twitter’s fire hose of tweets could be used by him or his companies in the future. Bruns says the fire-hose data set could generate new insights into who uses Twitter and why, how usage patterns change over the long term, and what problematic behaviors users engage in—alongside generating detailed profiles of users' interests and networks. “Unless there's anything in the reporting that I've missed about how long Musk gets access to the fire hose for, I'm assuming Twitter is gambling on him and his team giving up on it fairly quickly,” says Bruns. “Especially if he had the fire hose for months or longer, this really becomes a user privacy and ethics concern too.”

Regardless of whether Musk gains access to the data or not, it’s unlikely to help him overcome the main hurdle he has for his purchase of Twitter. “I don’t know if there’s an answer to the question he is posing to Twitter,” says Nouwens. “Perhaps Twitter knows more than external researchers do at the moment or can do. But it’s a really tricky question.”

The Tricky Business of Elon Musk Getting Twitter Fire-Hose Access

The House committee's televised hearings interrogate the Capitol attack with damning new evidence. Whether it's enough to prevent another one is uncertain.

It’s hard to tell which fact should shock us most out of the first, surprisingly compelling public hearing of the congressional committee investigating the insurrection at the US Capitol on January 6.

Jared Kushner brushing aside as mere “whining” the repeated resignation threats from White House counsel and its top lawyers in the face of Donald Trump’s ongoing push to overturn the election?

The fact that even as rioters surged through the Capitol and members of Congress fled in terror, Donald Trump, the president of the United States, never once spoke to any corner of the US government to ask for help—never once called the Justice Department, Homeland Security, or the Pentagon?

The committee’s allegations that members of Congress sought presidential pardons for their own roles in the January 6 events?  

Or the simple power of a brave police officer talking about our nation’s most sacred democratic space as a “war zone” and how—repeatedly injured by the rioters that the GOP has sought in the last 18 months to reframe as “normal tourists” engaged in “legitimate political discourse”—she slipped on others’ blood spread across the steps of the US Capitol? 

After months of behind-the-scenes investigation, wide-ranging subpoenas, witness depositions, document reviews, countless hours of reviewing video footage, and delicate internal political machinations, the public portion of the House’s January 6 select committee kicked off Thursday night with a two-hour blockbuster that immediately established the stakes of the work—the former president of the United States attempted nothing less than a coup to remain in power—and recentered its work as one of the most important political investigations in our lifetime.

Committee vice-chair Rep. Liz Cheney, a Wyoming Republican who has been excoriated by her own party for agreeing to participate in the investigation alongside Republican Rep. Adam Kinzinger of Illinois, provided a captivating introduction and overview of the events of January 6, 2021. She also highlighted what the committee will explore over the course of roughly a half-dozen hearings this month and immediately gave the lie to GOP dismissals of the investigation as nothing more than a political witch hunt.

The skillful—and politically courageous—presentation by Cheney, followed up by multiple video segments produced by the committee, highlights the coordination among armed, white nationalist militia groups like the Proud Boys and Oath Keepers, as well as the singular role Donald Trump played in stoking lies that the election had been stolen and then inviting his supporters to come to Washington on January 6 to protest—protests that quickly escalated into a brutal, violent assault on the Capitol that had lawmakers fleeing for their lives. One of the most powerful video clips showed staffers of Republican leader Kevin McCarthy—who has long downplayed the Capitol assault—evacuating their House offices in terror. Other clips showed the crowd chanting, “Hang Mike Pence” and insurrectionists screaming in the face of police to demand that they hand over House speaker Nancy Pelosi. Cheney closed her poised and pointed presentation with a warning to the hundreds of her GOP colleagues who have excused the events of 1/6: “There will come a day when Donald Trump is gone, but your dishonor will remain.”

Committee chair Rep. Bennie Thompson, Democrat of Mississippi, outlined how future hearings would focus on the particulars of the conspiracy and the careful construction of Trump’s knowing lies—committee members explained that they saw in Trump’s behavior a “sophisticated” seven-step plan for overturning the election—but Thursday’s hearing mostly focused on reminding Americans of the stakes involved. This was no ordinary political protest. This was no ordinary election loss. The actions of Donald Trump before, during, and after the January 6 Capitol assault instead marked an end to America’s 240-year tradition of peaceful transitions of presidential power.

Instead, Donald Trump embarked on a concerted effort to use the tools of the presidency and the US government to overturn the legitimate, authentic election results—even though his own staff told him, according to their depositions aired Thursday in the hearing, that “there was no there there.”

First Trump lied to the public. Then he tried to weaponize the Justice Department to back his lies. He pressured state election officials and legislators to embrace far-fetched legal theories and change their states’ election results. His team worked to invent and send to Washington invalid slates of electors, in the hopes that Congress would recognize them and allow him to overturn his loss. He summoned supporters and encouraged armed groups to join him in DC on January 6, promising in a tweet that it “will be wild.” Then he pressured Vice President Mike Pence to violate his constitutional oath and refuse to certify the valid election results ahead of January 6. And lastly, he seemingly refused to lift a finger—either to place a telephone call or send a tweet—to summon federal aid as the Capitol and legislative branch remained under violent assault for hours. Instead, according to the committee, only Vice President Pence—himself hiding at a secure loading dock inside the Capitol complex after being hastily evacuated from the Senate chamber above—contacted the military and ordered them to respond and secure the Capitol.

Taken together, it is the most audacious, calculated, and unconstitutional plot America has faced in its history—one that came far closer to success than anyone imagined.

Over the course of those two hours, the committee succeeded in reframing the national conversation and focused on the true horror of January 6. In doing so, it surely raised the pressure on the Justice Department, which is conducting a seemingly slow-moving parallel investigation that has seen hundreds of low-level indictments and charges against January 6 rioters—including the arrest just yesterday of a GOP gubernatorial candidate in Michigan—and a number of more serious “seditious conspiracy” indictments against Oath Keepers and Proud Boys leaders. Thus far, it has stopped short of penetrating Donald Trump’s motley collection of enablers, grifters, and hangers-on.

Despite the shocking clarity of the committee’s opening presentation, it remains uncertain at best whether it will be able to break through America’s political polarization and its increasingly separate-and-unequal media ecosystems. Fox News, alone among the major networks, refused to air the hearings live and instead allowed its host Tucker Carlson, who increasingly features openly white nationalist positions, to spew venom to his millions of prime-time viewers during an hour-long show, unusually uninterrupted by commercials.

In many ways, Fox’s decision to double down on Tucker Carlson’s lies Thursday night is unsurprising. The network’s decision in the weeks after the 2020 election—as Donald Trump built up the Big Lie and set the kindling for January 6—to embrace Trump’s lies and undermine the legitimacy of then-President-elect Joe Biden’s victory makes it all but an unindicted co-conspirator in the violence on Capitol Hill.

The challenge America now faces, heading into next week’s follow-up hearings, is that none of us know what part of Donald Trump’s story we’re living in—the beginning, the middle, or the end? The committee’s work ahead is to convince America to view January 6 as a turning point, not a warning that we will later say went ignored.

There’s a saying, after all, that there’s no such thing as an unsuccessful coup. An unsuccessful coup is just practice.

The January 6 Hearing Was a Warning

A researcher found that a recent update lets anyone enroll their own key during the 130-second interval after the car is unlocked with an NFC card.

Last year, Tesla issued an update that made its vehicles easier to start after being unlocked with their NFC key cards. Now, a researcher has shown how the feature can be exploited to steal cars.

For years, drivers who used their Tesla NFC key card to unlock their cars had to place the card on the center console to begin driving. Following the update, which was reported here last August, drivers could operate their cars immediately after unlocking them with the card. The NFC card is one of three means for unlocking a Tesla; a key fob and a phone app are the other two.

Enrolling Your Own Key

Martin Herfurt, a security researcher in Austria, quickly noticed something odd about the new feature: Not only did it allow the car to automatically start within 130 seconds of being unlocked with the NFC card, but it also put the car in a state to accept entirely new keys—with no authentication required and zero indication given by the in-car display.

"The authorization given in the 130-second interval is too general … it's not only for drive," Herfurt said in an online interview. "This timer has been introduced by Tesla … in order to make the use of the NFC card as a primary means of using the car more convenient. What should happen is that the car can be started and driven without the user having to use the key card a second time. The problem: Within the 130-second period, not only the driving of the car is authorized, but also the enrolling of a new key."

The official Tesla phone app doesn't permit keys to be enrolled unless it's connected to the owner's account, but despite this, Herfurt found that the vehicle gladly exchanges messages with any Bluetooth Low Energy, or BLE, device that's nearby. So the researcher built his own app, named Teslakee, that speaks VCSec, the same language that the official Tesla app uses to communicate with Tesla cars.

A malicious version of Teslakee that Herfurt designed for proof-of-concept purposes shows how easy it is for thieves to surreptitiously enroll their own key during the 130-second interval. (The researcher plans to release a benign version of Teslakee eventually that will make such attacks harder to carry out.) The attacker then uses the Teslakee app to exchange VCSec messages that enroll the new key.

All that's required is to be within range of the car during the crucial 130-second window of it being unlocked with an NFC card. If a vehicle owner normally uses the phone app to unlock the car—by far the most common unlocking method for Teslas—the attacker can force the use of the NFC card by using a signal jammer to block the BLE frequency used by Tesla's phone-as-a-key app.

This video demonstrates the attack in action:

As the driver enters the car after unlocking it with an NFC card, the thief begins exchanging messages between the weaponized Teslakee and the car. Before the driver has even driven away, the messages enroll a key of the thief's choice with the car. From then on, the thief can use the key to unlock, start, and turn off the car. There is no indication from the in-car display or the legitimate Tesla app that anything is amiss.

Herfurt has successfully used the attack on Tesla Models 3 and Y. He hasn't tested the method on new 2021+ facelift models of the S and X, but he presumes they are also vulnerable because they use the same native support for phone-as-a-key with BLE.

Tesla didn't respond to an email seeking comment for this post.

Parlez-Vous VCSec?

The vulnerability is the result of the dual roles played by the NFC card. It not only opens a locked car and starts it; it's also used to authorize key management.

Herfurt said:

_The attack exploits Tesla's way of handling the unlock process via NFC card. This works because Tesla's authorization method is broken. There is no connection between the online account world and the offline BLE world. Any attacker who can see the Bluetooth LE advertisements of a vehicle may send VCSEC messages to it. This would not work with the official app, but an app that is also able to speak the Tesla-specific BLE protocol … allows attackers to enroll keys for arbitrary vehicles. Teslakee will communicate with any vehicle if it is told to._

Herfurt created Teslakee as part of Project Tempa, which “provides tools and information about the VCSEC protocol used by Tesla accessories and the Tesla app in order to control vehicles via Bluetooth LE.” Herfurt is a member of Trifinite Group, a research and hacker collective that focuses on BLE.

The attack is easy enough in technical aspects to carry out, but the mechanics of staking out an unattended vehicle, waiting for or forcing the owner to unlock it with an NFC card, and later catching up with the car and stealing it can be cumbersome. This method isn't likely to be practical in many theft scenarios, but for some, it seems viable.

With Tesla maintaining radio silence on this weakness, there's only so much that concerned owners can do. One countermeasure is to set up Pin2Drive to prevent thieves who use this method from starting a vehicle, but it will do nothing to prevent the thief from being able to enter the car when it's locked. Another protection is to regularly check the list of keys authorized to unlock and start the car through a process Tesla calls "whitelisting." Tesla owners may want to perform this check after giving an NFC card to an untrusted mechanic or valet parking attendant.

Based on the lack of response Herfurt said he received from Tesla regarding vulnerabilities he uncovered in 2019 and again last year, he's not holding his breath that the company will address the issue.

"My impression was that they always already knew and would not really change stuff," he said. "This time, there is no way that Tesla does not know about that poor implementation. So for me, there was no point in talking to Tesla beforehand."

_This story originally appeared on_ _Ars Technica__._

Hackers Can Steal Your Tesla by Creating Their Own Personal Keys

Using a custom encryption scheme within music notation, Merryl Goldberg and three other US musicians slipped information to Soviet performers and activists known as the Phantom Orchestra.

In 1985, saxophonist Merryl Goldberg found herself on a plane to Moscow with three fellow musicians from the Boston Klezmer Conservatory Band. She had carefully packed sheet music, reeds, and other woodwind supplies, along with a soprano saxophone, to bring into the USSR. But one of her spiral-bound notebooks, lined with staves for hand-notating music, contained hidden information.

Courtesy of Merryl Goldberg

Courtesy of Merryl Goldberg

Using a code she had developed herself, Goldberg had obscured names, addresses, and other details the group would need for their trip in handwritten compositions that looked, to an untrained eye, like the real melodies she’d written on other pages of the book. Goldberg and her colleagues didn’t want to give Soviet officials details of who they planned to see and what they planned to do on their trip. They were going to meet the Phantom Orchestra.

The group was a dissident ensemble that Goldberg describes as an amalgamation of Jewish refuseniks (Jews who were barred from emigrating out of the USSR), Christian activists, and Helsinki monitors—watchdogs who tracked Soviet compliance with the 1975 Helsinki Accords. The Americans’ trip was funded and coordinated by the nonprofit Action for Soviet Jewry (now Action for Post-Soviet Jewry), which works on humanitarian relief in the former Soviet Union and was focused on helping Soviet Jews emigrate to Israel and the United States. 

The trip was a rare and special opportunity for American and Soviet players to meet in the USSR and make music together. It was also an opportunity for the American musicians to smuggle information about aid efforts and plans to the Phantom Orchestra, and for the ensemble to send updates out, including details about individuals looking to escape the Soviet Union.

Courtesy of Merryl Goldberg

Goldberg and her colleagues, all of whom are Jewish, traveled to Moscow separately in two pairs to make it less likely that they would arouse suspicion as a group. They had received training on how to react to questioning and been told to expect surveillance, even run-ins with Soviet officials, throughout their trip. But first Goldberg needed to get her notebook past border control. 

“When we arrived, we were immediately pulled aside, and they went through everything in our luggage, to the point of unwrapping Tampax. It was crazy,” says Goldberg, who is presenting about the experience and her musical code at the RSA security conference in San Francisco today. “With my music, they opened it up and there were some real tunes in there. If you’re not a musician, you wouldn’t know what’s what. They went page by page through everything—and then they handed it back.”

Goldberg says that while the code worked and Soviet officials didn’t confiscate their music, they did interrogate all four travelers about what they planned to do while in the USSR. “We were brought into a room with a big burly guy who banged on the table and yelled at us,” remembers Goldberg, now a music education professor at California State University, San Marcos.

Musical note names span the letters A to G, so they don’t provide a full alphabet of options on their own. To create the code, Goldberg assigned letters of the alphabet to notes in the chromatic scale, a 12-tone scale that includes semi-tones (sharps and flats) to expand the possibilities. In some examples, Goldberg wrote only in one musical range, known as treble clef. In others, she expanded the register to be able to encode more letters and added a bass clef to extend the range of the musical scale. These details and variations also added verisimilitude to her encoded music. 

For numbers, Goldberg would simply write them between the staves, where sometimes you might see chord symbols. She also added other characteristics of composition, like rhythms (half notes, quarter notes, eighth notes, whole notes), key signatures, tempo markings, and articulation indicators like slurs and ties. Most of these were there to make the music look more legitimate, but some doubled as coded supplements to the letters hidden in the music notes. She even occasionally drew tiny diagrams that could be mistaken for charts to remind herself of where a meeting place was located or how to deliver something. 

While someone could technically have played the code as music, it would have sounded less like a tune and more like a cat walking across piano keys.

“I picked a note to start, and then I created the alphabet from there. Once you know it, it ends up being pretty easy to write things. I taught my friends on the trip the code, too,” Goldberg says. “We used it in order to take in people’s addresses and other information we would need to find them. And we coded things while we were there so we would be able to take out some information about people and their efforts to emigrate, as well as details we hoped could help other people ask to leave.”

The US musicians got their bearings in Moscow before heading to Tbilisi, the capital of Georgia. There and on their next stop in Yerevan, the capital of Armenia, they successfully met members of the Phantom Orchestra, many of whom spoke some English, and spent time getting to know each other, playing music together, and even staging small, impromptu concerts.

During eight days of travel, the musicians were tailed constantly by Soviet agents and were repeatedly stopped for questioning. Goldberg says that members of the Phantom Orchestra, all of whom faced similar treatment in their daily lives, gave her and her colleagues advice and encouragement. When the Americans would express concerns that their presence was endangering the activists, Goldberg says the Phantom Orchestra members were resolute about the importance of spending time together. She adds, though, that some of the activists were later arrested and even beaten, because of the interactions.

“On the second night, we were playing together and the KGB came in and everything got shut down. The electricity was turned off; it was a scary situation,” Goldberg says. “And yet, when we’re playing music no one can take away that sense of freedom and empowerment. Playing together and communicating with people through music is like nothing else. I was amazed by the strength it brought the people there. Music can be very comforting, but it also conveys a sense of feeling powerful.”

After their time in Yerevan, the American musicians had planned to go to Riga, the capital of Latvia, and then to Leningrad, now St. Petersburg in Russia. Finally, they were set to stop in Paris before returning to the United States. Instead, they were stopped and questioned again. The musicians were supposed to be placed under house arrest in Yerevan, but Goldberg says that Armenian officials bristled at the KGB intrusion and let them continue their trip. Eventually, though, the musicians were picked up and escorted back to Moscow, where Soviet agents confiscated their passports. Goldberg says the group was driven around Moscow for several hours, perhaps as a scare tactic, before finally being allowed to stay together in a dormitory room guarded by young Soviet men with machine guns.

Courtesy of Merryl Goldberg

“At that point, you’re thinking they’re going to take us to Siberia or something,” she says. “We were super freaked out. So we kept playing music for each other that night. And we played a beloved Russian folk tune, but out of tune, to annoy the young soldier outside our door. It gave us a sense of humor and empowerment.”

Finally, officials said the group would be deported to Sweden. They were heavily guarded and brought to a plane that had come from Sweden and was going to return without passengers. While officials searched their possessions again before letting them on the plane, no one ever flagged the sheet music. Goldberg points out that she even got the film from her camera back, perhaps thanks to a sympathizer.

“They were given no reason for their expulsion, and US officials are still waiting for information from the Soviet Foreign Ministry,” Reuters reported in a wire about the situation on May 31, 1985. “The spokesman said the expulsion appeared to be linked to their meeting with … Georgian dissidents.”

Goldberg says that while she later learned that some of the Soviet activists faced consequences for the visit, some of the people the musicians met on the trip were eventually able to permanently leave the USSR. She notes that while her musical code wouldn’t have been very difficult to crack if someone were focused on it, the obfuscation served its purpose, making it both an elegant and harmonious encryption scheme.

How a Saxophonist Tricked the KGB by Encrypting Secrets in Music

Mozilla researchers identified accounts with millions of view spreading hate speech and disinformation

Last August the TikTok account @aironixon shared a video intercutting scenes from Netflix’s docuseries _How to Become a Tyrant_ with videos and screenshots of Kenyan deputy president and presidential candidate William Ruto. An added caption read, “Is Ruto a tyrant?”

The video is one of 130 identified by Mozilla Foundation fellow Odanga Madung, who has detailed his findings in a new report. Altogether, Madung found hate speech and disinformation in videos that accrued over 4 million views after being shared by 33 TikTok accounts. All of them appear to violate the company’s terms of service, and target Kenya’s upcoming August 9 elections.

“What we noticed is that there are very many cases where a certain page, for example, might have 5,000 followers, but the kind of the content that it posts ends up getting \[more than\] 500,000 views, because it has been supercharged by the platform itself,” says Madung.

Though Facebook, WhatsApp, and Instagram remain the most popular platforms in Kenya, TikTok’s popularity has risen steadily over the past two years, and it is among the most-downloaded social apps in the country.

For Kenyans heading into an election season, disinformation is hardly new, especially as millions of its citizens have come online over the past decade. Madung worries that the country’s history of electoral violence makes it particularly combustible. In 2007, a contested presidential election between Raila Odinga and Mwai Kibaki led to widespread violence that left more than 1,000 people dead and 600,000 displaced. The country’s current president, Uhuru Kenyatta, was accused of helping to incite the violence by charging armed groups of Kikuyus, the ethnic group to which he and Kibaki both belong, to target Luos, Odinga’s ethnic group.

Kenyatta ascended to the presidency in 2013. His reelection in 2017 also sparked protests that were met with swift police crackdowns. Human Rights Watch documented at least 42 people killed by police, though it estimated the real number to be higher.

Earlier this year, the country’s National Cohesion and Integration Commission, which was formed after the 2007 violence to ensure peaceful elections, warned of the “misuse of social media platforms to perpetuate ethnic hate speech and incitement to violence,” saying that in 2022 hate speech on social platforms had increased 20 percent. The commission also cited increasing communal conflict and personal attacks on politicians, in addition to other conditions that could make this year’s elections particularly tumultuous.

A TikTok video of a speech given by Ruto included the caption, “Ruto hates Kikuyus and wants to take revenge come 2022.” It has garnered more than 400,000 views.

“There's a very clear attempt to try and use the ghosts of 2007 to move voters one way or the other, to take advantage of or glorify past violence,” says Madung. “That’s something that is completely not taken into account in TikTok’s own hate speech content guidelines.”

Unlike Facebook or Twitter, TikTok serves users content based not on who they follow but what the platform believes their interests are. This can make it hard for researchers like Madung to map out how content spreads and to whom. “There's no tool like Crowdtangle for TikTok,” he says. “Doing research on TikTok is tiresome, sometimes gruesome, because I had to watch all the videos all the way through to perform content analysis.”

By its very nature, TikTok is harder to moderate than many other social media platforms, according to Cameron Hickey, project director at the Algorithmic Transparency Institute. The brevity of the videos, and the fact that many can include audio, visual, and text elements makes human discernment even more necessary when deciding whether something violates platform rules. Even advanced artificial intelligence tools, like using speech-to-text to quickly identify problematic words, is more difficult “when the audio that you're dealing with also has music behind it,” says Hickey. “The default mode for people creating content on TikTok is to also embed music.”

That becomes even more difficult in languages other than English.

“What we know generally is that platforms do best at the work of addressing problematic content in the places where they are based or within the languages in which the people who created them speak,” says Hickey. “And there are more people making bad stuff than there are people at these companies trying to get rid of the bad stuff.”

Many pieces of disinformation Madung found were “synthetic content,” videos created to look like they might be from an old news broadcast, or they use screenshots that appear to be from legitimate news outlets.

“Since 2017, we’ve noticed that there was a burgeoning trend at the time to appropriate the identities of mainstream media brands,” says Madung. “We are seeing rampant usage of this tactic on the platform, and it seems to do exceptionally well.”

Madung also spoke with former TikTok content moderator Gadear Ayed to get a better understanding of the company’s moderation efforts more broadly. Although Ayed did not moderate TikToks from Kenya, she told Madung that she was often asked to moderate content in languages or contexts she was not familiar with, and would not have had the context to tell whether a piece of media had been manipulated.

“It's common to find moderators being asked to moderate videos that were in languages and contexts that were different from what they understood,” Ayed told Madung. “For example, I at one time had to moderate videos that were in Hebrew despite me not knowing the language or the context. All I could rely on was the visual image of what I could see but anything written I couldn't moderate.”

A TikTok spokesperson told WIRED that the company prohibits election misinformation and the promotion of violence and is “committed to protecting the integrity of \[its\] platform and have a dedicated team working to safeguard TikTok during the Kenyan elections.” The spokesperson also said that it works with fact-checking organizations, including Agence France-Presse in Kenya, and plans to roll out features to connect its “community with authoritative information about the Kenyan elections in our app."

But even if TikTok removes the offending content, Hickey says that may not be enough. “One person can remix, duet, reshare someone else's content,” says Hickey. That means that even if the original video is removed, other versions can live on, undetected. TikTok videos can also be downloaded and shared on other platforms, like Facebook and Twitter, which is how Madung first encountered some of them.

Several of the videos flagged in the Mozilla Foundation report have since been removed, but TikTok did not respond to questions about whether it has removed other videos or whether the videos themselves were part of a coordinated effort.

But Madung suspects that they might be. “Some of the most egregious hashtags were things I would find researching coordinated campaigns on Twitter, and then I would think, what if I searched for this on TikTok?”

Source

Wired