President Donald Trump has proposed building a massive antimissile system in space that could enrich Elon Musk if it materializes. But experts say the project’s feasibility remains unclear.

During A Press conference in the Oval Office late last month, US President Donald Trump doubled down on his plan to build a massive new missile defense system, largely based in space, he is calling the “Golden Dome.” In recent weeks, defense companies have begun vying for anticipated government contracts tied to the project, and three firms with deep connections to the White House—SpaceX, Palantir, and Anduril—have been named as purported front-runners.

Trump ordered plans to be drawn up for the Golden Dome within days of returning to office in January, and he said in May that it would be operational by the end of his term in January 2029. But behind the scenes over the past few months, competing defense companies and industry experts have told WIRED the future of the project isn’t certain.

They say it’s unclear whether the missile shield could be constructed in space the way Trump wants and how many contracts will ultimately be awarded. Trump recently claimed that he had selected a $175 billion design for the shield, but some experts expect the cost to be far greater, and they question how it will be paid for.

Although it has been compared to Israel’s Iron Dome missile defense system, some sources noted that a project of the Golden Dome’s size and scope has never been built before. “The Manhattan Project element of this is just simply the scale,” says John Clark, senior vice president of technology and strategic innovation at Lockheed Martin. “The technologies exist. The integration strategies we've demonstrated, they are available. It's really, how do you scale this?"

Trump said on May 20 that he had chosen Space Force general Michael Guetlein as a “lead program manager” for the Golden Dome. But Clark says that a number of different branches of the US military and federal government have been “providing feedback and insight” as part of the planning process, including a specialized group inside the Department of Defense called the Missile Defense Agency, as well as the Space Force, Space Development Agency, the Army, the Navy, and the Air Force. It’s unclear how many of them will ultimately remain involved.

“What I am seeing and hearing in our conversations is that each agency is still trying to understand where they fit into this really broad mission and architecture,” says Susanne Hake, general manager of US government business at the geospatial intelligence firm Maxar.

Mark Montgomery, executive director of the Cyberspace Solarium Commission, a government body that advises US policymakers on cyber- and space-based threats, believes that SpaceX is almost certainly going to play a major role in the initiative because of its existing dominance in the commercial space launch sector.

“The only thing I'd say is consistent, and almost definitely true, is SpaceX is going to be part of the launch cycle,” says Montgomery, who says it “would be criminal” to pick winners and losers this early in the process.

In mid-April, CEO Elon Musk said publicly that SpaceX “has not tried to bid for any contract” tied to the Golden Dome project. (It’s not possible at this stage for firms to make formal bids.) He added that he hopes “other companies” can work on it instead.

Musk did not respond to a request for comment asking what role he may have played in SpaceX’s work related to the Golden Dome.

Clark says that Lockheed Martin is having early-stage conversations with SpaceX, Palantir, and Anduril, as well as many other companies that it could eventually enter into partnerships with to work on the Golden Dome. “Candidly, I think it's a little premature to lock in on a team when you don't know exactly what the requirements are,” he tells WIRED.

Hake says that Maxar is also in early talks with other firms. She argues that Maxar’s products—such as imaging technology that can detect objects in low Earth orbit—are “pretty differentiated” from anything that SpaceX, Palantir, or Anduril have, meaning Maxar wouldn’t be in direct competition with them.

Clark says that Lockheed Martin has proposed an approach for the Golden Dome that involves building out the existing US missile defense system regionally, then nationally. The current system already includes many components from Lockheed Martin, including land- and sea-based antimissile systems, as well as a long-range radar for detecting missiles.

“Right now, that system has been attributed to ensuring, you know, zero US fatalities,” Clark says.

Anduril declined to comment. The US Department of Defense, SpaceX, and Palantir did not respond to requests for comment from WIRED.

**Why Upgrade?**

When Trump initially demanded the creation of a “next-generation” missile defense system in January, he referred to the project as the "Iron Dome Missile Defense Shield." It was later rebranded as a “Golden Dome for America,” according to a request for information published in April by the Missile Defense Agency.

An earlier February notice asked private companies to detail technological capabilities they possess that could help make the Golden Dome happen, including artificial intelligence and building space-based missile interceptors. It also outlined a laundry list of bells and whistles the Trump administration wants the shield to have, such as space-based sensors (for defending against hypersonic and ballistic missiles), a large satellite system for encrypted communications across the US military, and new weapons for striking down missiles both before and after they launch.

The existing system the US uses to protect itself from missiles and nuclear warheads relies on a constellation of radar sensors and launchpads equipped with antimissile ballistics stationed on US Navy ships and military vehicles around the world. It has the capability to detect when other countries launch missiles, track their paths, and intercept the weapons without detonating them. But many experts worry it’s woefully inadequate and can’t fully protect the US from the nation’s most pressing national security threats.

“We just kind of wished away the problem,” says Montgomery.

While the US military has spent lavishly on missile defense over the past few decades, it has “little to show” for it, argues a recently revised report published by the Panel on Public Affairs of the American Physical Society, a nonprofit that researches physics and other scientific issues.

The authors, who noted that US funding for missile defense typically only increases in response to things like “presidential advocacy,” concluded that America’s current system couldn’t reliably take down missiles and warheads from North Korea, let alone attacks from more sophisticated actors.

Montgomery tells WIRED that the US should be particularly concerned about advanced long-range ballistic and hypersonic missiles from China, Russia, and Iran.

**Going to Space**

Laura Grego, a senior research director at the Union of Concerned Scientists and a coauthor of the report, says she gets why the Trump administration wants the ability to launch missile interceptors from space.

Interceptors launched from land sites may have to travel hundreds of miles horizontally, while an interceptor in space needs to travel only a short distance to reach a missile and stop it in its tracks. “Most people's intuition is that space is far away,” Grego says. “But in this case, space is close. Space is about as close as you can get.”

Grego adds that the idea of building a futuristic antimissile system in the sky has preoccupied American leaders on and off for decades. President Ronald Reagan proposed a similar plan in the early 1980s nicknamed the “Star Wars” program by critics, which consisted of a space-based laser system to shoot down ballistics. While the kinds of technologies Reagan proposed using weren’t feasible at the time, they are now, Grego says.

Montgomery says that the US government will likely need to choose between building a new space-based system or building up its land-based system, because it would simply be too expensive to do both. “If you go down that second path of legacy systems now, you'll inevitably come up short on your space-based funding later,” he says.

But Grego says she believes that a space-based missile interceptor system would be highly vulnerable and impractical, because it requires using missile interceptors carried aboard satellites. Since the satellites would be constantly moving relative to the Earth's surface, the US would need an astronomical amount of interceptors to offer full protection.

Grego says that it only works when it's totally complete. “If you're able to pick apart that constellation and punch holes in it by using anti-satellite weapons or other types of attacks to the system, that whole thing basically becomes useless,” she explains.

Grego adds that a space-based interceptor system would likely cost trillions of dollars between building, launching, and replacing the interceptors—even considering the fact that new technology developed by SpaceX has helped push down the cost of satellite launches considerably in recent years. Satellites circling the earth in low Earth orbit also fall into the atmosphere and burn up after about three to five years, meaning components will need to be replaced regularly.

Trump dismissed concerns about how much the system will cost when asked about it by reporters last month. “We took in $5.1 trillion in the last four days in the Middle East, and when you think about it, this is a tiny fraction of that,” he said. (Prior reports pegged the deals to be worth more than $1 trillion, though the final amount remains unclear, and none of the deals are explicitly related to the Golden Dome.)

Montgomery says that cost isn’t necessarily a reason to rule out a space-based missile defense system entirely. “I’d spend as little as possible on legacy ground-based interceptors, because I think there's limited return in them over time,” he says. “They're expensive, and they're configured for yesterday's threat, and maybe today's threat, but probably not tomorrow's threat.”

The greatest danger of any version of the Golden Dome, Grego says, is that it could spark an arms race. Russia and China will likely view the missile defense system as a threat, because if the US becomes effectively immune to missile attacks, those countries fear American forces could act without fear of retaliation.

To counter this, Grego says, Russia and China may respond by building more offensive missiles to overwhelm or bypass American defenses, ultimately fueling an “unstable” cycle of escalation. “If your adversary builds up defenses so that they're immune, they're no longer vulnerable to you, then you have to do something,” she says.

When asked about concerns about the risk of an arms race at a press conference in May, Trump simply said, “Well, they’re wrong,” adding that the Golden Dome will be “about as close to perfect as you can have.”

The Race to Build Trump’s ‘Golden Dome’ Missile Defense System Is On

GPS jamming and spoofing attacks are on the rise. If the global navigation system the US relies on were to go down entirely, it would send the world into unprecedented chaos.

Around 12,500 miles above our heads, the satellites that make up the Global Positioning System (GPS) quietly keep the world running. A blackout would result in almost instantaneous chaos.

“You would see traffic jams, a lot more traffic accidents, because transportation is going to see the first most immediate impact,” says Dana Goward, the founder of the Resilient Navigation and Timing Foundation, a charity which works to strengthen GPS.

Thousands of planes in the air, which use GPS among other systems for navigation and precision landing, would face a wave of uncertainty. Then other critical parts of society—from financial transactions to energy production systems—which have come to rely upon the precision positioning, navigation and timing (PNT) provided by the US-owned constellation of 31 GPS satellites may start to stutter. The ripples would be felt around the world.

“If it was a catastrophic moment that happened at a blink of an eye and we lost GPS entirely, you would see this global seizure of everything that moves, every piece of data that moves, every human that moves. All of that would shut down,” says Erik Daehler, the vice president of defense, satellites, and spacecraft systems at Sierra Space. The timing signals included in GPS would be one of the most impactful losses. Cell phone connections would likely collapse. Billions would quickly be wiped from stock markets amid the disruption.

A GPS outage could be particularly ruinous to the United States, which has a heavy reliance on its sovereign space system and has dragged its feet in building backups that can provide the required resilience needed to keep the country running. The US has fallen behind, the National Space-based PNT Advisory Board warned last year. In contrast, China has reinforced its own more modern satellite navigation system—BeiDou—with a sprawling network of fiber-optic cables and terrestrial radio signals.

The conditions needed to cause the entire GPS network to be entirely knocked out would be extraordinary and likely would come with wider societal ramifications. Such an outage, for instance, could be caused by China or Russia firing anti-satellite weapons against the GPS satellites (the US also has anti-satellite weapons), a powerful geomagnetic storm, or an escalation in the capabilities of electronic warfare.

Despite the improbability of a total outage, GPS isn’t infallible. It has its demons. “What really happens is, regionally, GPS gets messed with and jammed and interfered with on a regular basis,” Daehler says. Thousands of planes and ships are having their GPS interfered with each week, and signals are regularly disrupted around war zones.

“America is not well prepared at all,” Goward says. More should be done to build out PNT systems that can act as a backstop to the space-based GPS signals, he says. “There’s not a general overall awareness. We certainly don’t have a resilient PNT architecture or a PNT architecture of any kind other than GPS.”

The GPS constellation of 31 satellites, which has received several hardware updates over the years, has been in operation for the past 40 years. The system typically broadcasts at 100 percent availability and provides accurate location data to within 7 meters.

The GPS satellites are just one of the four so-called global navigation satellite systems (GNSS) in operation. As well as China’s BeiDou, there is Russia’s GLONASS and Europe’s Galileo constellation. Over the past half decade, though, GNSS signals have increasingly been attacked as the technology to disrupt them has become cheaper and more sophisticated. Most commonly, disruption happens around Russia, Israel, Myanmar, the South China sea, areas of the Middle East, and the Baltic countries in Europe.

Broadly, there are two main forms of attack against GNSS signals: jamming and spoofing. Jamming involves blocking signals so that positioning isn’t available, while spoofing involves creating mock signals that make something appear somewhere else on the map. Ships have been made to appear inland at airports, while planes are made to look like they are flying in tight circles. In one video shared by the Resilient Navigation and Timing Foundation that appears to show GPS interference, a plane’s systems blast out a warning message to “pull up” when its pilots reported they were flying higher than Mount Everest.

“I’m most concerned about aviation,” says Todd Humphreys, the director of the University of Texas at Austin’s radio navigation laboratory. “At least one fatal aviation accident in Europe can be traced to GNSS interference as a primary cause. A deliberate attack against US aviation, as opposed to the collateral attacks in Europe, would cause astounding economic harm.” The number of spoofing incidents last year was 500 percent higher than in 2023, according to aviation officials.

The US Space Force, which is responsible for the GPS satellites, did not respond to a request for comment for this article from WIRED.

Across the US, PNT data is crucial to almost all critical infrastructure—from communications and health care monitoring systems to food production and wastewater management—but GPS is often the “sole” source of this information, according to the Cybersecurity and Infrastructure Security Agency, making the systems more vulnerable. (The military uses a more robust GPS setup than commercial applications).

“There is no one sector that doesn’t use GPS, and some are more reliant than others. Users in these sectors are not all acutely aware of the risks associated with their dependency on it and the ways that the system can be disrupted or degraded,” says Caitlin Durkovich, a former national security official and critical infrastructure expert.

Building a “layered” approach could help to make GPS less vulnerable to attack, experts say. Both Europe’s Galileo and China’s BeiDou are newer than GPS and, in some ways, more resilient. Last year, the National Space–based PNT Advisory Board produced a comparison of GPS and BeiDou that flagged a broader series of backups to Beijing’s system.

While GPS satellites are located only in middle Earth orbit, BeiDou has satellites in multiple orbits and is further along in deploying them into low Earth orbit. China also has a terrestrial radio broadcast network, called eLoran, and has laid 20,000 kilometers of fiber-optic cables that link up with 295 timing centers to broadcast alternatives.

“In the case of BeiDou, the system’s enhanced resiliency and capability should be considered an element of ‘soft power’ and an element of great power competition,” the advisory board wrote last year. The board, led by Admiral Thad Allen, a former leader of the US Coast Guard, called for a more joined-up approach to managing PNT across the US government and for GPS to be specifically designated as “critical infrastructure.”

On April 26, 2024, the first of two Finnair flights were forced to turn around due to GPS interference likely carried out by Russia. After a second aircraft was diverted the following day, Finnair suspended its daily flights between Helsinki and Tartu, Estonia. _Source: AirNav_

“I think there has to be a federal role in this, both because the system and signals are operated and provisioned by the federal government. But because of the complexity of the system and the fact that you need a common standard,” Durkovich says.

“We’d like to see a core national PNT architecture,” Goward says. “Then we would suggest some form of fiber network and a terrestrial broadcast. We think it would be a substantial deterrent and it would actually make space-based systems safer because folks would be less likely to interfere with it.”

Across the country, there are various levels of backup systems in place that have been sporadically introduced and multiple ongoing efforts to improve the GPS setup. Financial institutions, for instance, have been deploying atomic clocks to ensure they have backups for the timing element provided by GPS and telecoms networks have some capacity in place.

“It’s not to say that the US doesn’t have a robust timing infrastructure, actually it’s quite robust,” says Jeremy Bennington, the vice president of PNT Assurance at Spirent Communications, adding that much of it is spread across commercial entities, a stark difference to China’s national approach. “I do think that a backup is going to be required so that you end up with that layered approach.”

The calls to modernize PNT have increasingly become more urgent. In 2020, a first-term Trump executive order called for making PNT systems more resilient. At the end of March this year, the Federal Communications Commission opened an inquiry to identify GPS alternatives that can provide backups. “Relying on GPS alone as the primary source of PNT data leaves America exposed to a single point of failure and leaves our PNT system open to disruption or manipulation by adversaries,” the FCC said at the time.

There are multiple ways to add more resilience and upgrade the existing GPS system. The military has long been working on upgrades to be used in defense situations. Bennington says that GPS satellites could be added to other orbits and the further rollout of more capable signals. Daehler and colleagues at Sierra Space are working on creating ways to reduce the impact of jamming and spoofing.

Lisa Dyer, the executive director of the GPS Innovation Alliance, says the GPS system could build in authentication to confirm its signals are genuine, like Galileo and BeiDou. Dyer says that rolling out the newer L5 signal can also build in more protection for planes and aviation. “To me that's an important national objective of the United States: that GPS remains the de facto international navigation standard,” Dyer says.

There are also hardware updates happening, though some of them are slow and have dragged on for years. The US Space Force has recently been funding multiple companies to develop low Earth orbit satellite GPS constellations and quickly launching systems into space. Elsewhere, quantum technologies are being used to create new navigation systems. SandboxAQ, a Google spinout, is working on magnetic navigation.

Ultimately, as well as better government management around GPS, organizations need to spend money to upgrade their systems and protections, Bennington says. That means spending money. “If GPS jamming or spoofing were to happen at any major airport, whether it's Heathrow, Frankfurt, Munich, New York, the amount of cancellation and delays in the cost incurred by the airlines just in several hours would be more than the cost to upgrade their fleets,” he says.

A GPS Blackout Would Shut Down the World

Everyone knows what it’s like to lose cell service. A burgeoning open source project called Meshtastic is filling the gap for when you’re in the middle of nowhere—or when disaster strikes.

Hypothetical: You wake up tomorrow morning to find a superstorm that developed overnight thanks to climate change has sparked a chain of events that abruptly ushers in a new ice age and alters human society as we know it. (Yes, this is the plot of _The Day After Tomorrow_. Stick with us.) All the communication networks you relied on are down. Your phone is basically worthless. The internet has functionally ceased to exist. But you need to connect with people you trust to get help and survive. What do you do? More importantly, how did you prepare?

Less Hollywood-esque versions of having no cell service or Wi-Fi happen all the time, of course; maybe you’re hiking in a secluded area, white-knuckling through a major natural disaster, or living under a repressive regime that cuts internet access to quash public protests. Fortunately, for all these scenarios, there’s a low-budget solution: Meshtastic.

Meshtastic is a program that enables devices to send text messages over long distances without needing Wi-Fi or cell service. Long range radio (LoRa) nodes help pass messages along, forming a network of devices that can talk to each other even in remote areas. Messages hop from device to device, with each node relaying messages it hasn't seen before—extending the network’s reach across miles using minimal power. That is to say, Meshtastic is designed specifically for sending text messages over free-to-use radio frequencies to both groups and individuals, even when cell service and internet connections are nowhere to be found.

“The cool thing about Meshtastic is that it’s like a radio infrastructure without the infrastructure. It’s ad hoc,” says Eric Kristoff, a volunteer member of the Chicago chapter of the Mars Society, a nonprofit that advocates for the human exploration and colonization of Mars.

Kristoff says the group has been testing the use of Meshtastic as a way to give Mars Society “analog astronauts” the ability to communicate and keep track of each others’ locations without the use of earthly infrastructure.

“We have a set of Meshtastic T-Echo radios, about the size of a deck of cards, and they are worn on the person of the analog astronaut,” he says.

The radios that use Meshtastic cost roughly $30 (though you can spend two, three, or four times that if you want to). And because they operate over unlicensed radio frequencies on a network created by personal devices, they’re essentially free to use. Each message is end-to-end encrypted, ensuring privacy while it’s relayed through the network. And Meshtastic’s optional location-tracking capabilities give people a way to monitor their communities and keep tabs on their kids—or fellow analog astronauts—without using invasive, data-hungry apps.

Kristoff says that Mars Society members will take weeks-long excursions in remote areas with little cellular or Wi-Fi connectivity, which creates additional risks.

“There is heat stroke. We are two hours from the nearest hospital. If you go too far from the campus, it can get dangerous,” Kristoff says of the experience. “So anytime there’s a risk, the risk is made worse if people don’t know where you are.”

Most Meshtatic devices currently on the market need to pair with a phone over Bluetooth to function as a texting alternative. Some devices are just a radio, antenna, and battery, with the expectation that you’ll make the housing yourself. The radio does all the device-to-device communication, while the iOS and Android apps or the web client let you read and compose messages that are received or sent over the network—no service plan needed.

The apps also allow you to see the approximate location of nearby nodes and a map of the Meshtastic network. But fancier stand-alone devices are already available, like a line of Meshtastic-enabled gadgets from maker-friendly tech firm LilyGo that, in addition to the T-Echo model used by Mars Society members, includes Blackberry-like handhelds with their own keyboards, a smartphone-like device with an e-paper screen, and even a Meshtastic-enabled smartwatch.

Meshtastic was created by technologist Kevin Hester in early 2020 as a way to communicate while doing “any hobby where you don’t have reliable internet access,” and it remains a grassroots endeavor, with established local communities spanning from Argentina to China that are ripe with a DIY ethos. The software itself is open source, meaning anyone can theoretically contribute, and hundreds have. Still, as with many open source projects, a core group of volunteer developers help maintain the Meshtastic firmware, mobile apps, and more.

Jonathan Bennett, a self-described “Linux guy” who upgraded Meshtastic to stronger end-to-end encryption for direct messaging and keeps the software working on Linux, says he first got involved in the project after a listener of one his podcasts wanted a way to communicate with friends while attending a festival where the cell network could get overloaded.

“I put my open source enthusiast hat on and I went looking, and I came across Meshtastic,” he says. “And it immediately tickled my interest.”

Bennett says he ultimately connected with Garth Vander Houwen, a C# developer who wrote Meshtastic’s iOS app, and Ben Meadors, another C# developer who took on maintaining the Android app, web client, firmware, and other parts of the Meshtastic ecosystem after Hester needed to step back due to health issues.

Like Bennett, Vander Houwen and Meadors got involved with Meshtastic while looking for solutions to real-life problems. Vander Houwen, an iPhone user, says he found Meshtastic while on the hunt for a way to communicate as he hiked on remote trails in the Seattle area, just to find that it only had an Android app. He decided to write the iOS app himself. “So the fact that there was not an iOS app for Meshtastic was kind of how I got started,” he says, “and it's been a lot of fun.”

Meadors says he came to Meshtastic after a dangerous tornado hit his home state of Arkansas, causing major damage. “My kind of initial use case was honestly a backup communication for storm-related outages,” Meadors says. After taking part in the cleanup effort around Little Rock, he realized the value of a decentralized, off-grid communication network like Meshtastic. “It's just really handy to have anywhere where you’ve got a limited connection to the grid.”

None of which is to say you should throw your cell phone in the sea and go all-in on Meshtastic. At least not yet. First, getting into the world of LoRa remains a little bit technical, so if the idea of “flashing” your device with new firmware makes you instinctively pick up your phone to scroll TikTok, it might not be the hobby for you. Even if you are tech savvy, the system has some notable limitations.

Using the decentralized mesh network requires having your Meshtastic device in range of at least one other radio; obstructions like buildings, trees, and hills or mountains can prevent the line-of-sight communication needed to join the mesh network. This means it may only be reliable when there’s a variety of other Meshtastic nodes in the area.

Next is what Meadors calls the “narrowness” of the network’s technical capabilities. “One of the most frequent things that we get is, ‘Can I replace the internet with this?’ No, no you cannot,” he says. “You can send text messages.” Mercifully, that does include emoji.

Photograph: Michael Tessier

This may be obvious, but you also need to have a network set up before disaster hits, Meadors says. So, set up anyone who you might need to communicate with during a cell and internet blackout before it actually happens. And, due to relatively frequent firmware updates, you can’t just toss your device in a bug-out bag and forget about it. But “if it's something that you actually use, like if you pull it out and use it once a month, you'll be good to go,” Bennett says.

Then there’s the issue of raw bandwidth. This limitation can cause issues when a lot of people are trying to use the network at the same time. At a ham radio convention in Dayton, Ohio, last year (yes, it’s called Hamvention), the Meshtastic network crashed after someone ran a program that flooded the network with additional traffic, pushing the Meshtastic network to its limits.

“Because literally one person turned on this MQTT bridge, which then joined the rest of us into this mesh in a metal building in Dayton, it crashed the whole mesh immediately,” Vander Houwen says.

After this incident, Vander Houwen, Bennett, and Meadors went to work to prepare for the upcoming Defcon hacker convention in Las Vegas, ultimately releasing a special firmware for the much larger event that Vander Houwen estimates allows “somewhere between 2,000 and 2,500 nodes” to operate on the network simultaneously. A similar firmware released ahead of the 2025 Hamvention in May drew praise from the community.

Despite Meshtastic’s limitations, its promise as a backup communication system—and the sheer fun you can have with it—continues to pull in new enthusiasts. The Android app alone has drawn thousands of reviews, and the Meshtastic subreddit has grown to nearly 50,000 members. Some municipalities are even hoping to launch Meshtastic networks to help protect their communities in the event of natural disasters.

For Bennett, Meadors, and Vander Houwen, they’re excited to not just see the number of Meshtastic nodes increase, but to see the technology develop into something anyone can use without having to become an enthusiast or “analog astronaut” at all.

“I think the biggest thing for me too is that it’s not just accessible from the aspect of the hardware being available to more people. I want to make the software more accessible,” Meadors says. “I want to make the experience such that I can hand this device to anybody and have them download the app and start messaging. We've come a long way. I think there's still some room to grow there.”

_Updated at 10:25 am ET, June 4, 2025: Corrected a misspelling of Ben Meadors' surname._

The Texting Network for the End of the World

The easy access that scammers have to sophisticated AI tools means everything from emails to video calls can’t be trusted.

Imagine you meet someone new. Be it on a dating app or social media, you chance across each other online and get to talking. They’re genuine and relatable, so you quickly take it out of the DMs to a platform like Telegram or WhatsApp. You exchange photos and even video call each over. You start to get comfortable. Then, suddenly, they bring up money.

They need you to cover the cost of their Wi-Fi access, maybe. Or they’re trying out this new cryptocurrency. You should really get in on it early! And then, only after it’s too late, you realize that the person you were talking to was in fact not real at all.

They were a real-time AI-generated deepfake hiding the face of someone running a scam.

This scenario might sound too dystopian or science-fictional to be true, but it has happened to countless people already. With the spike in the capabilities of generative AI over the past few years, scammers can now create realistic fake faces and voices to mask their own in real time. And experts warn that those deepfakes can supercharge a dizzying variety of online scams, from romance to employment to tax fraud.

David Maimon, the head of fraud insights at identity verification firm SentiLink and a professor of criminology at Georgia State University, has been tracking the evolution of AI romance scams and other kinds of AI fraud for the past six years. “We’re seeing a dramatic increase in the volume of deepfakes, especially in comparison to 2023 and 2024,” Maimon says.

“It wasn’t a whole lot. We’re talking about maybe four or five a month,” he says. “Now, we’re seeing hundreds of these on a monthly basis across the board, which is mind-boggling.”

Deepfakes are already being used in a variety of online scams. One finance worker in Hong Kong, for example, paid $25 million to a scammer posing as the company’s chief financial officer in a deepfaked video call. Some deepfake scammers have even posted instructional videos on YouTube, which have a disclaimer as being for “pranks and educational purposes only.” Those videos usually open with a romance scam call, where an AI-generated handsome young man is talking to an older woman.

More traditional deepfakes—such as a pre-rendered video of a celebrity or politician, rather than a live fake—have also become more prevalent. Last year, a retiree in New Zealand lost around $133,000 to a cryptocurrency investment scam after seeing a Facebook advertisement featuring a deepfake of the country’s prime minister encouraging people to buy in.

Maimon says SentiLink has started to see deepfakes used to create bank accounts in order to lease an apartment or engage in tax refund fraud. He says an increasing number of companies have also seen deepfakes in video job interviews.

“ Anything that requires folks to be online and which supports the opportunity of swapping faces with someone—that will be available and open for fraud to take advantage of,” Maimon says.

Part of the reason for this increase is that the barriers for creating deepfakes are getting lower. There are a lot of easily accessible AI tools that can generate realistic faces and a lot of tools that can animate those faces or create full-length videos out of them. Scammers often use images and videos of real people, deepfaked to slightly change their faces or alter what they’re saying, to target their loved ones or hijack their public influence.

Matt Groh, a professor of management at Northwestern University who researches people’s ability to detect deepfakes, says that point-and-click generative AI tools make it much easier to make small, believable changes to already-existing media.

“If there’s an image of you on the internet, that would be enough to manipulate a face to look like it’s saying something that you haven’t said before or doing something you haven’t done before,” Groh says.

It’s not just fake video that you need to be worried about. With a few clips of audio, it’s also possible to make a believable copy of somebody’s voice. One study in 2023 found that humans failed to detect deepfake audio over a quarter of the time.

“ Just a single image and five seconds of audio online mean that it’s definitely possible for a scammer to make some kind of realistic deepfake of you,” Groh says.

Deepfakes are becoming more pervasive in contexts other than outright scams. Social media has been flooded over the past year with AI-generated “influencers” stealing content from adult creators by deepfaking new faces onto their bodies and monetizing the resulting videos. Deepfakes have even bled over into geopolitics, like when the mayors of multiple European capital cities held video calls with a fake version of the mayor of Kyiv, Ukraine. People have started using deepfakes for personal reasons, like bringing back a dead relative or creating an avatar of a victim to testify in court.

So, if deepfakes are everywhere, how do you spot one? The answer is not technology. A number of technology companies, including OpenAI, have launched deepfake detection tools. Researchers have also proposed mechanisms to detect deepfakes based on things like light reflected in a person’s eyes or inconsistent facial movements, and have started investigating how to implement them in real time.

But those models often cannot reliably detect different kinds of AI fakes. OpenAI’s model, for example, is specifically designed only to report content generated with the company’s own Dall-E 3 tool but not other image generation models.

There’s also the risk that scammers can abuse AI detectors by repeatedly tweaking their content until it fools the software.

“ The major thing we have to understand is that the technology we have right now is not good enough to detect those deepfakes,” Maimon says. “ We’re still very much behind.”

For now, as video deepfakes get more popular, the best way to detect one relies on humans. Studies on deepfake detection show that people are best at distinguishing whether videos are real or fake, as opposed to just audio or text content, and are in some cases even better than leading detection models.

Groh’s team conducted one study which found that taking more time to determine whether an image was real or fake led to a significant increase in accuracy, by up to eight percentage points for just 10 seconds of viewing time.

“ This sounds almost so simple,” Groh says. “But if you spend just a couple extra seconds, that leads to way higher rates of being able to distinguish an image as real or fake. One of the ways for any regular person to just be a little bit less susceptible to a scam is to ask, ‘Does this look actually real?’ And if you just do that for a few extra seconds, we’re all going to be a little bit better off.”

Deepfakes’ popularity could be a double-edged sword for scammers, Groh says. The more widespread they are, the more people will be familiar with them and know what to look for.

That familiarity has paid off in some cases. Last summer, a Ferrari executive received a call from someone claiming to be the CEO of the company. The person convincingly emulated the CEO’s voice but abruptly hung up the call when the executive tried to verify their identity by asking what book the CEO had recommended just days earlier. The CEO of WPP, the world’s biggest advertising agency, was also unsuccessfully targeted by a similar deepfake scam.

“I think there’s a balancing act going on,” Groh says. “ We definitely have technology today that is generally hard for people to identify. But at the same time, once you know that there’s a point-and-click tool that allows you to transform one element into something else, everyone becomes a lot more skeptical.”

Deepfake Scams Are Distorting Reality Itself

In the very near future, victory will belong to the savvy blackhat hacker who uses AI to generate code at scale.

In the near future one hacker may be able to unleash 20 zero-day attacks on different systems across the world all at once. Polymorphic malware could rampage across a codebase, using a bespoke generative AI system to rewrite itself as it learns and adapts. Armies of script kiddies could use purpose-built LLMs to unleash a torrent of malicious code at the push of a button.

Case in point: as of this writing, an AI system is sitting at the top of several leaderboards on HackerOne—an enterprise bug bounty system. The AI is XBOW, a system aimed at whitehat pentesters that “autonomously finds and exploits vulnerabilities in 75 percent of web benchmarks,” according to the company’s website.

AI-assisted hackers are a major fear in the cybersecurity industry, even if their potential hasn’t quite been realized yet. “I compare it to being on an emergency landing on an aircraft where it’s like ‘brace, brace, brace’ but we still have yet to impact anything,” Hayden Smith, the cofounder of security company Hunted Labs, tells WIRED. “We’re still waiting to have that mass event.”

Generative AI has made it easier for anyone to code. The LLMs improve every day, new models spit out more efficient code, and companies like Microsoft say they’re using AI agents to help write their codebase. Anyone can spit out a Python script using ChatGPT now, and vibe coding—asking an AI to write code for you, even if you don’t have much of an idea how to do it yourself—is popular; but there’s also vibe hacking.

“We’re going to see vibe hacking. And people without previous knowledge or deep knowledge will be able to tell AI what it wants to create and be able to go ahead and get that problem solved,” Katie Moussouris, the founder and CEO of Luta Security, tells WIRED.

Vibe hacking frontends have existed since 2023. Back then, a purpose-built LLM for generating malicious code called WormGPT spread on Discord groups, Telegram servers, and darknet forums. When security professionals and the media discovered it, its creators pulled the plug.

WormGPT faded away, but other services that billed themselves as blackhat LLMs, like FraudGPT, replaced it. But WormGPT’s successors had problems. As security firm Abnormal AI notes, many of these apps may have just been jailbroken versions of ChatGPT with some extra code to make them appear as if they were a stand-alone product.

Better then, if you’re a bad actor, to just go to the source. ChatGPT, Gemini, and Claude are easily jailbroken. Most LLMs have guard rails that prevent them from generating malicious code, but there are whole communities online dedicated to bypassing those guardrails. Anthropic even offers a bug bounty to people who discover new ones in Claude.

“It’s very important to us that we develop our models safely,” an OpenAI spokesperson tells WIRED. “We take steps to reduce the risk of malicious use, and we’re continually improving safeguards to make our models more robust against exploits like jailbreaks. For example, you can read our research and approach to jailbreaks in the GPT-4.5 system card, or in the OpenAI o3 and o4-mini system card.”

Google did not respond to a request for comment.

In 2023, security researchers at Trend Micro got ChatGPT to generate malicious code by prompting it into the role of a security researcher and pentester. ChatGPT would then happily generate PowerShell scripts based on databases of malicious code.

“You can use it to create malware,” Moussouris says. “The easiest way to get around those safeguards put in place by the makers of the AI models is to say that you’re competing in a capture-the-flag exercise, and it will happily generate malicious code for you.”

Unsophisticated actors like script kiddies are an age-old problem in the world of cybersecurity, and AI may well amplify their profile. “It lowers the barrier to entry to cybercrime,” Hayley Benedict, a Cyber Intelligence Analyst at RANE, tells WIRED.

But, she says, the real threat may come from established hacking groups who will use AI to further enhance their already fearsome abilities.

“It’s the hackers that already have the capabilities and already have these operations,” she says. “It’s being able to drastically scale up these cybercriminal operations, and they can create the malicious code a lot faster.”

Moussouris agrees. “The acceleration is what is going to make it extremely difficult to control,” she says.

Hunted Labs’ Smith also says that the real threat of AI-generated code is in the hands of someone who already knows the code in and out who uses it to scale up an attack. “When you’re working with someone who has deep experience and you combine that with, ‘Hey, I can do things a lot faster that otherwise would have taken me a couple days or three days, and now it takes me 30 minutes.’ That's a really interesting and dynamic part of the situation,” he says.

According to Smith, an experienced hacker could design a system that defeats multiple security protections and learns as it goes. The malicious bit of code would rewrite its malicious payload as it learns on the fly. “That would be completely insane and difficult to triage,” he says.

Smith imagines a world where 20 zero-day events all happen at the same time. “That makes it a little bit more scary,” he says.

Moussouris says that the tools to make that kind of attack a reality exist now. “They are good enough in the hands of a good enough operator,” she says, but AI is not quite good enough yet for an inexperienced hacker to operate hands-off.

“We’re not quite there in terms of AI being able to fully take over the function of a human in offensive security,” she says.

The primal fear that chatbot code sparks is that anyone will be able to do it, but the reality is that a sophisticated actor with deep knowledge of existing code is much more frightening. XBOW may be the closest thing to an autonomous “AI hacker” that exists in the wild, and it’s the creation of a team of more than 20 skilled people whose previous work experience includes GitHub, Microsoft, and a half a dozen assorted security companies.

It also points to another truth. “The best defense against a bad guy with AI is a good guy with AI,” Benedict says.

For Moussouris, the use of AI by both blackhats and whitehats is just the next evolution of a cybersecurity arms race she’s watched unfold over 30 years. “It went from: ‘I’m going to perform this hack manually or create my own custom exploit,’ to, ‘I’m going to create a tool that anyone can run and perform some of these checks automatically,’” she says.

“AI is just another tool in the toolbox, and those who do know how to steer it appropriately now are going to be the ones that make those vibey frontends that anyone could use.”

The Rise of ‘Vibe Hacking’ Is the Next AI Nightmare

A major cyberattack on the US electrical grid has long worried security experts. Such an attack wouldn’t be easy. But if an adversary pulled it off, it’d be lights out in more ways than one.

When the lights went out across the Iberian Peninsula in April, everything ground to a halt. Scores of people were trapped in Madrid’s underground metro system. Hospitals in Lisbon had to switch to emergency generators. Internet service as far away as Greenland and Morocco went down.

While the cause remains unclear, the actual damage to the Iberian power grid—and the people it serves—was relatively minor. Less than 24 hours after the outage began, the region’s electricity operators managed to get the grid back online.

Even if things could have been much worse, the outage was both an unnerving reminder of how suddenly things can go offline.

For years, cybersecurity professionals, watchdogs, and government agencies have warned that a malicious cyberattack on the US power grid could be devastating. With ample evidence that state-sponsored hacking groups are eyeing the decentralized and deeply vulnerable power grid, the risk is more acute than ever.

Case in point: Hackers, believed to be linked to the Chinese government, spent years exploiting vulnerabilities in critical infrastructure across the mainland United States and Guam to obtain access to their systems. The operations, dubbed Volt Typhoon, could have used this access to shut down or disconnect parts of the American power grid—throwing millions into the dark. The effort was, luckily, disrupted and the vulnerabilities patched. Still, it is an unnerving illustration of just how vulnerable the electric system truly is.

We know what such a hack could look like. In 2015, Ukraine experienced the world’s first large-scale cyberattack on an electrical grid. A Russian military intelligence unit known as Sandworm disconnected various substations from the central grid and knocked hundreds of thousands of people offline.

The attack on Ukraine was repaired quickly, but cybersecurity experts have been warning for years that the next one might be more devastating.

Unlike Ukraine, America does not have a single power grid—it has three large interconnections, broken down into a network of smaller regional systems, some of which stretch into Canada. Most of the East is on one grid, most of the West is on another, while Texas and Alaska run their own interconnections. Keeping these networks running is a wildly complicated effort: There are thousands of utility operations, tens of thousands of substations, and hundreds of thousands of miles of high-voltage transmission lines.

Photograph: Michael Tessier

To some degree, this decentralized network is an asset, as it means there is no core vulnerability that risks knocking the entire country offline. But the interconnections mean that a failure in one corner of the grid could cause a cascade that takes down the entire system.

In 2018, researchers from Northwestern University ran large-scale models, gaming out what would happen if parts of the grid failed. They found that, generally, the American power grid was resilient. However, they found that about 10 percent of power lines in the US were susceptible to the kind of failure that could trigger this domino effect under some conditions. A 2022 study that looked at possible disruptions to the Texas grid also found that, in some cases, a relatively small disruption could cause a series of downstream outages “rapidly in succession.”

This means that even if malicious actors manage to take only a small number of nodes in the network offline, it has the potential to do enormous downstream damage.

Insurance underwriter Lloyd’s of London has looked at the effects of such an outage. In this hypothetical, first drafted in 2015 but updated in the years since, Lloyd’s estimates that a Trojan virus that manages to infect just 50 generators—removing 10 percent of the grid’s total power—can trigger this cascade effect and knock out power for most of the East Coast, including New York City and Washington, DC. The Lloyd’s report states that this is an “extreme” but “not unrealistic scenario.”

“Images of a dark New York City make front pages worldwide,” they write, “accompanied by photographs of citizens stuck underground for hours on stranded subway cars and in elevators in the summer heat.”

These rolling blackouts would stretch through 36 states over the course of a day, throwing some 93 million people into the dark. It could take up to three days for half of those people to get back online—while hardware damage and other problems could require up to three weeks to fix.

As the outages continue, more difficulties arise. The analysts warn that an information campaign running parallel to the cyberattack could prompt strikes, protests, or general unrest.

In 2016, then Federal Emergency Management Agency administrator Craig Fugate was summoned to Congress to testify on the possible impacts of a cyberattack on the US electric grid. Water and wastewater systems are some of the first things to go down, he noted. “There is not really a good way to manage that if those systems go offline for extensive periods of time,” Fugate said.

He explained that the emergency response will become a game of triage: distributing enough power, gas, and generators to emergency services and utilities, while also trying to keep consumer-facing supply chains operating.

“Can you get enough life support and infrastructure going to keep the major supply lines up?” Fugate continued. “You are not going to have everything. You are not going to have what the normal consumption rates are.”

Lloyd’s estimates that the total economic costs and losses could hit $1 trillion.

The US Grid Attack Looming on the Horizon

A quantum computer will likely one day be able to break the encryption protecting the world's secrets. See how much faster such a machine could decrypt a password compared to a present-day supercomputer.

WIRED is where tomorrow is realized. It is the essential source of information and ideas that make sense of a world in constant transformation. The WIRED conversation illuminates how technology is changing every aspect of our lives—from culture to business, science to design. The breakthroughs and innovations that we uncover lead to new ways of thinking, new connections, and new industries.

See How Much Faster a Quantum Computer Will Crack Encryption

Seems bad out there. Unfortunately, it can always get worse. From evil hacker AI to world-changing cyberattacks, WIRED envisions the future you haven't prepared for.

You're Not Ready

For years, a powerful farm industry group served up information on activists to the FBI. Records reveal a decade-long effort to see the animal rights movement labeled a “bioterrorism” threat.

How the Farm Industry Spied on Animal Rights Activists and Pushed the FBI to Treat Them as Bioterrorists

Plus: An Iranian man pleads guilty to a Baltimore ransomware attack, Russia’s nuclear blueprints get leaked, a Texas sheriff uses license plate readers to track a woman who got an abortion, and more.

For years, a mysterious figure who goes by the handle Stern led the Trickbot ransomware gang and evaded identification—even as other members of the group were outed in leaks and unmasked. This week German authorities revealed, without much fanfare, who they believe that enigmatic hacker kingpin to be: Vi­ta­ly Ni­ko­lae­vich Kovalev, a 36-year-old Russian man who remains at large in his home country.

Closer to home, WIRED revealed that Customs and Border Protection has mouth-swabbed 133,000 migrant children and teenagers to collect their DNA and uploaded their genetic data into a national criminal database used by local, state, and federal law enforcement. As the Trump administration’s migrant crackdown continues, often justified through invocations of crime and terrorism, WIRED also uncovered evidence that ties a Swedish far-right mixed-martial-arts tournament to an American neo-Nazi “fight club” based in California.

For those seeking to evade the US government surveillance, we offered tips about more private alternatives to US-based web browsing, email, and search tools. And we assembled a more general guide to protecting yourself from surveillance and hacking, based on questions our senior writer Matt Burgess received in a Reddit Ask Me Anything.

But that's not all. Each week, we round up the security and privacy news we didn't cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

**A Hacker May Have Deepfaked Trump’s Chief of Staff in a Phishing Campaign**

The FBI is investigating who impersonated Susie Wiles, the Trump White House’s chief of staff and one of the president’s closest advisers, in a series of fraudulent messages and calls to high-profile Republican political figures and business executives, The Wall Street Journal reported. Government officials and authorities involved in the probe say the spear-phishing messages and calls appear to have targeted individuals on Wiles’ contact list, and Wiles has reportedly told colleagues that her personal phone was hacked to gain access to those contacts.

Despite Wiles’ reported claim of having her device hacked, it remains unconfirmed whether this was actually how attackers identified Wiles’ associates. It would also be possible to assemble such a target list from a combination of publicly available information and data sold by gray-market brokers.

“It's an embarrassing level of security awareness. You cannot convince me they actually did their security trainings,” says Jake Williams, a former NSA hacker and vice president of research and development at Hunter Strategy. “This is the type of garden-variety social engineering that everyone can end up dealing with these days, and certainly top government officials should be expecting it.”

In some cases, the targets received not just text messages but phone calls that impersonated Wiles’ voice, and some government officials believe the calls may have used artificial intelligence tools to fake Wiles’ voice. If so, that would make the incident one of the most significant cases yet of so-called deepfake software being used in a phishing attempt.

It’s not yet clear how Wiles’ phone might have been hacked, but the FBI has ruled out involvement by a foreign nation in the impersonation campaign, the bureau reportedly told White House officials. In fact, while some of the impersonation attempts appeared to have political goals—a member of Congress, for instance, was asked to assemble a list of people Trump might pardon—in at least one other case the impersonator tried to trick a target into setting up a cash transfer. That attempt at a money grab suggests that the spoofing campaign may be less of an espionage operation than a run-of-the-mill cybercriminal fraud scheme, albeit one with a very high-level target.

“There’s an argument here for using something like Signal—yes, the irony—or another messaging platform that offers an independent form of authentication if users want to validate who they’re talking to,” Hunter Strategy's Williams says. “The key thing as always is for government officials to be using vetted tools and following all federally mandated protocols rather than just winging it on their own devices.”

**Iranian Man Behind Baltimore Ransomware Attack Pleads Guilty**

The 2019 ransomware attack against the city government of Baltimore represents one of the worst municipal cybersecurity disasters on record, paralyzing city services for months and costing taxpayers tens of millions of dollars. Now the Department of Justice has unexpectedly revealed that it arrested one of the hackers behind that attack, 37-year-old Sina Gholinejad, in North Carolina last January, and that he has pleaded guilty in court. Gholinejad has admitted to being involved in the larger Robbinhood ransomware campaign that hit other targets, including the cities of Greenville, North Carolina, and Yonkers, New York. It’s still far from clear how Gholinejad was identified or why he traveled from Iran to the US, given that most ransomware criminals are careful to remain in countries that don’t have extradition agreements with the US government and are thus beyond US law enforcement’s reach. Indeed, the indictment against him names several unnamed co-conspirators who may be still at large in Iran.

**Russia’s Nuclear Blueprints Exposed in Huge Document Leak**

More than 2 million documents left exposed in a public database have revealed Russia’s nuclear weapons facilities in unprecedented levels of detail, according to reporting this week by Danish media outlet Danwatch and Germany’s Der Spiegel. Reporters examined the huge trove of documents relating to Russian military procurement—as Russian authorities slowly restricted access—and found blueprints for nuclear facilities across the country. Experts called the leak an unparalleled breach of Russia’s nuclear security, with the data potentially being incredibly useful for foreign governments and intelligence services.

The documents show how Russia’s nuclear facilities have been rebuilt in recent years, where new facilities have been created, detailed site plans including the locations of barracks and watchtowers, and the locations of underground tunnels connecting buildings. There are descriptions of IT systems and security systems, including information on surveillance cameras, electric fences being used, and the alarm systems in place. “It’s written explicitly where the control rooms are located, and which buildings are connected to each other via underground tunnels,” Danwatch reports.

**Cops Used License Plate Recognition Cameras in Search for Woman Who Got an Abortion**

License-plate-recognition cameras are creating huge databases of people’s movements across America—capturing where and when cars are traveling. For years there have been concerns that the cameras could be weaponized by law enforcement officials or private investigators and turned against those seeking abortions or providing abortion-related care. Officials from Johnson County Sheriff’s Office in Texas—where nearly all abortions are illegal—searched 83,000 Flock license-plate reader cameras at the start of this month while looking for a woman they claim had a self-administered abortion, 404 Media reported this week.

Sheriff Adam King said that the officials weren’t trying to “block her from leaving the state” and were searching for the woman as her family was concerned about her safety. However, experts say that conducting a search across the entire United States shows the sprawling dragnet of license-plate-reader cameras and highlights how those seeking abortions can be tracked. “The idea that the police are actively tracking the location of women they believe have had self-administered abortions under the guise of ‘safety’ does not make me feel any better about this kind of surveillance,” Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation told 404 Media.

**Investment Scam Company Linked to $200 Million in Losses Sanctioned by US Government**

Philippines-based company Funnull Technology and its boss, Liu Lizhi, have been sanctioned by the US Treasury’s Office of Foreign Assets Control for their links to investment and romance scams, which are often referred to as “pig-butchering” scams. “Funnull has directly facilitated several of these schemes, resulting in over $200 million in US victim-reported losses,” OFAC said in a statement announcing the sanctions. The company purchases IP addresses from major cloud service providers and then sells them to cybercriminals who could use them to host scam websites—OFAC says Funnull is “linked to the majority” of investment scam websites reported to the FBI. In January independent cybersecurity journalist Brian Krebs detailed how Funnull was abusing Amazon’s and Microsoft’s cloud services.

Source

Wired