Many people reported they hit a screen preventing them from seeing the alert unless they signed in.

Earlier this week, the California Highway Patrol sent an Amber Alert push notification to phones in the Los Angeles area about a 14-year-old girl that authorities believed had been abducted. But instead of conveying vital information that could help locate the victim within the notification itself, the law enforcement agency linked to a post from its official X account, a practice it adopted six years ago. But this time, many people reported they could not view the alert because they hit a screen that prevents users from seeing any content on X until they sign in to their account.

The California Highway Patrol told WIRED it was aware of the issue and had reached out to X for more information. “We’re looking into it,” Sergeant Dan Keane said. X did not respond to a request for comment.

Amber Alerts are issued by local law enforcement agencies to help locate children who are believed to have been abducted and are at risk of dying or serious injury. In California, the California Highway Patrol’s Emergency Notification and Tactical Alert Center is tasked with issuing the alerts. The law enforcement agency told WIRED it has used X (formerly Twitter) to push out the notifications since 2018 without any problems, at least until this incident.

On other social platforms, including Reddit, Threads, and Bluesky, local California residents vented their frustrations about being unable to receive the details of an emergency happening in their community. “This should be illegal and everyone should be upset about this. If that alert was for my child and tons of people couldn’t see it because they don’t have a stupid X account, I would be beyond infuriated,” one person wrote on Reddit. “Why the fuck should a social media platform benefit from people wanting to be good citizens and informed about missing kids?” another asked on Threads.

Some users reported they didn’t need to log in to see the California Highway Patrol’s X post, which was sent via a URL created using the Bitly link shortener service. It’s unclear what percentage of people who received the push notification were able to view the information about the missing girl and what percentage hit X’s log-in gate. Overall, only 21 percent of US adults say they ever use X, according to the Pew Research Center, not all of whom may have the app installed on their phones.

After Elon Musk took over Twitter more than two years ago, the billionaire rapidly laid off the majority of the social media site’s existing employees and instituted sweeping changes to its moderation and verification policies. The shifts spurred concerns that Twitter would become less reliable for emergency communications. The incident this week in California suggests at least some of these fears were founded.

“Requiring a login creates accessibility challenges and raises concerns about digital equity. Everyone should be able to access life-critical information, regardless of whether they use a specific platform,” says Amanda Lee Hughes, a professor of computer science at Brigham Young University who has studied digital emergency communications tools.

People in Missouri reported encountering a similar issue in July 2023, when the Missouri Highway Patrol sent out an Amber Alert push notification with a link to an X post. Local residents similarly spoke out about how they could not see the alert unless they logged on to the platform. “It was quite a change” from how the alerts used to work, says Missouri Highway Patrol lieutenant Eric Brown, who works in the public information and education department.

But the incident ultimately didn’t prompt the Missouri Highway Patrol to abandon X as its go-to platform for Amber Alert push notifications. According to Brown, when X verified the law enforcement agency's account as an official government entity, the log-in issue problem went away, and the public could once again access its posts.

Several of the California Highway Patrol’s official X accounts have the same verification badge as the Missouri Highway Patrol, including the one devoted specifically to disseminating active alerts statewide. However, not all of the California agency’s accounts appear to be verified, including what looks like the official channel for the CHP’s Southern Division, which includes Los Angeles county.

When it was known as Twitter, X was widely viewed as an essential part of global disaster and emergency communications infrastructure. Government officials and agencies around the world relied on the service as a way to broadcast information about hurricanes, mass shootings, and other crises. Before Musk took over the platform in 2022, anyone could view public tweets in their browser regardless of whether they had an account on the site or had installed Twitter’s mobile app. (In 2015, the company reported that more than 500 million people visited Twitter’s site per month without logging in.)

In June 2023, reports that X had started locking content behind a log-in screen began popping up online. At the time, Musk called the move a “temporary emergency measure” that was put in place because X was “getting data pillaged so much it was degrading the service.” It’s unclear exactly what Musk was referring to, but that same month he expressed concerns about AI companies like OpenAI allegedly scraping Twitter posts without prior authorization.

It now looks like the decision to turn X into a more closed platform stuck. According to tests conducted this week, X has continued to limit what people without accounts can see. WIRED looked at several of its staff reporters’ X accounts without logging in, for example, and was only able to view a sampling of their popular posts rather than a comprehensive chronological feed. It does appear that accounts run by government entities are not restricted in this way; all of the posts shared by the California Highway Patrol’s alerts account can be viewed without logging in.

Aside from allowing anyone to view content shared on the platform, another way Twitter previously helped emergency communicators was by giving them free access to its API, which Musk later revoked. That allowed organizations like the US National Tsunami Warning Center to send automatic alerts about potentially deadly natural disasters. Researchers and first responders could also use the API to monitor activity across Twitter and “extract key insights, such as identifying risk hot spots or combating misinformation,” says Hughes. “The platform’s role has shifted as policies and public usage evolve, so its effectiveness today may look quite different.”

Despite these drawbacks, X still remains an important platform for relaying information during emergency situations. In October, several government information officers emergency told PRWeek they planned to continue posting updates on X despite its diminished usefulness, because they had amassed large followings on the site and their priority ultimately remains ensuring that accurate information reaches as many people as possible. But the incident in California this week highlights how government agencies can run into problems when third-party services once considered reliable later change their policies in an unpredictable ways.

Californians Say X Blocked Them From Viewing Amber Alert About Missing 14-Year-Old

A network of Facebook pages has been advertising “fuel filters” that are actually meant to be used as silencers, which are heavily regulated by US law. Even US military officials are concerned.

Thousands of ads on Facebook and Instagram have promoted “fuel filters” using videos demonstrating how they can be easily modified into gun silencers—a process that, without federal approval, could lead to felony charges. Despite Meta’s policies banning ads for silencers on the company’s social networks, the promotions have persisted for years, driven by what appears to be a single network of more than 100 Facebook pages marketing “fuel filters” that can be easily turned into gun silencers, WIRED has found. The devices sell for as little as $50.

Silencers, also known as suppressors, are heavily regulated under United States federal law. Purchasing one legally requires submitting fingerprints, passing a background check, and paying a fee to the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). Federal law allows people to build their own suppressors, provided they register the device with the ATF. But the ads don’t mention this key stipulation, marketing silencers to buyers who may not understand the legal risks.

“You know those things that are definitely not suppressors, even though they look just like suppressors,” a man says in a video that appears in many of the ads. “Well, but they’re still not suppressors, because they don’t have a hole in the other end. So, you can legally own one without going through the paperwork to own a suppressor, because it isn’t one.”

The ads often recycle the same text, referencing “light and durable air-grade aluminum,” and use videos stitched together from a handful of YouTube clips featuring firearms influencers and enthusiasts. The original creators of these videos are likely unaware their content is being used; one tells WIRED they had deleted the footage from YouTube years ago.

One ad features a suppressor engraved with the words Black Collar Arms. A co-owner of Black Collar Arms, who goes by Jeremy McSorely, tells WIRED his company has no connection to the ad. McSorely explains that the footage was taken from a blog and YouTube video he had uploaded years ago but has since removed. “The photos you saw were screenshots taken from my video,” he says, emphasizing that the suppressor was legally manufactured and engraved with their corporate information to comply with ATF regulations.

In November 2023, the ATF warned federal firearms licensees about marketing silencers as “solvent traps,” or contraptions purportedly used to collect gun oil and residue during cleaning. The agency clarified that legality depends on functionality, not what you call a product, and stressed that even incomplete parts intended for silencers are regulated under federal law.

“The test for whether an item is a silencer is not the label a manufacturer or retailer applies. Rather, it is the way the statute written by Congress applies to the item,” the ATF wrote, referring to definitions of suppressors in the Gun Control Act and the National Firearms Act.

A WIRED analysis of more than 2,800 ads revealed they are linked to a network of hundreds of ecommerce websites. These sites often reuse code, share IP addresses, and peddle the same low-quality knockoff products alongside the “fuel filters.” At least one of the sites was flagged by Google as a likely phishing scam.

Experts believe the operation is based in China and relies on a drop-shipping scheme. “It’s likely just a reshipper selling controversial or illegal products,” says Zach Edwards, a senior threat researcher at cybersecurity firm Silent Push who specializes in online data ecosystems.

Typically, Edwards explains, drop-shippers wait for a customer to place an order, then purchase the item from inexpensive online retailers, repackage it, and ship it to the customers. Edwards says that the operator behind the network is likely creating hundreds of websites, applying a moderate markup to the products, and spinning up Facebook pages to promote their items. “Even if some sites or ads get caught and taken down, others keep running,” Edwards says. “It’s a spray-and-pray method.”

Meta explicitly bans ads promoting weapons, silencers, and related modifications. According to Meta, ads are reviewed by an automated system with support from human moderators. However, enforcement has been inconsistent: While at least 74 of the ad campaigns in our analysis were removed for violating the platforms’ terms, the rest appeared to have run successfully.

After WIRED reached out to Meta, the company said that it removed the ads and associated advertising accounts. However, a quick search of Meta’s Ad Library revealed that nearly identical ones have since been published.

“Bad actors constantly evolve their tactics to avoid enforcement, which is why we continue to invest in tools and technology to help identify and remove prohibited content,” Meta spokesperson Daniel Roberts wrote in a statement.

Roberts says that many of the ads flagged by WIRED had little to no engagement, suggesting few people ever saw this content. However, at least two ads reviewed by WIRED had thousands of comments, including accusations that it was an ATF honeypot, complaints from self-identified buyers whose products never arrived, and even testimonials from others claiming the item worked as advertised. WIRED reached out to several commenters who said they had purchased the product—none responded.

The ads have also drawn the attention of US Department of Defense officials. An internal presentation to Pentagon staff, viewed by WIRED, claims that the targeted ad for a fuel filter had been served to US military personnel on a government computer at the Pentagon. The presentation, which a source says was delivered to high-ranking general officers, including the US Army’s chief information officer, raised flags over how social media algorithms are being used to target service members.

Meta’s Ad Library provides limited transparency, leaving it unclear exactly how these ads are targeted. Researchers suggest that Meta’s powerful ad tools, which allow advertisers to find niche audiences using granular targeting options, could be exploited to reach gun enthusiasts or military personnel. While Roberts confirmed that Meta did not detect any indication that these ads were targeting the military, WIRED found that advertisers can easily target users who list their job title as “US Army” or “military” on their profiles—an audience that Meta estimates includes up to 46,134 people.

Meta’s platforms have long struggled to prevent the sale of firearms and related products. An October 2024 joint report by the Tech Transparency Project found that more than 230 ads for rifles and ghost guns had run on Facebook and Instagram in nearly three months. Many of these ads directed buyers to third-party platforms like Telegram to complete transactions. In 2024, two Los Angeles County men were charged with operating an “unlicensed firearm dealing business” that used Instagram accounts to advertise and market the sale of more than 60 firearms, which included some untraceable ghost guns and weapons with scratched-off serial numbers. Both individuals have since pleaded guilty.

Silencers are rarely used in crimes, but their use is on the rise—nearly 5 million are registered in the United States, up from 1.3 million in 2017. Last month, 26-year-old software engineer Luigi Mangione allegedly used a 3D-printed gun equipped with a silencer to fatally shoot UnitedHealthcare CEO Brian Thompson on a street in midtown Manhattan.

Facebook and Instagram Ads Push Gun Silencers Disguised as Car Parts

Your messages going back years are likely still lurking online, potentially exposing sensitive information you forgot existed. But there's no time like the present to do some digital decluttering.

If you're worried about possible expansions of government surveillance and access to your information, or simply want to do some digital purging so you're not saddled with old data, there are a bunch of concrete steps you can take to protect your digital privacy. Just as archeologists study carefully preserved tombs and ancient trash heaps to gain insight into historic communities, your long-forgotten digital footprint could be more revealing and sensitive than you realize. And while you can't control everything—particularly information stolen in breaches or gathered by data brokers—you probably have a digital attic full of old data that you can delete or download and save offline. First stop? Old message histories.

Chats are a good place to start your digital decluttering. Their real-time nature makes it easy to forget that if you don't have auto-delete turned on for a chat (or if a platform doesn't offer it), all of those “be there in 10 minutes,” “wait, what color is this dress???” and “welp, I have covid” messages are still knocking around years later. If you sent them on an end-to-end encrypted platform like Signal or WhatsApp, they only exist on your device and the devices of the other person or people you were chatting with. That means that for governments or bad actors to read them, they would need direct control of your device—a good level of protection, though not foolproof.

Crucially, though, messages that you sent on regular web apps like Slack, Facebook Messenger for most of its history, and Google Chat/Hangouts/Gchat are sitting on a cloud server somewhere. And while they're probably stored in an encrypted form to protect against theft, the platform itself has the keys to decrypt your data and would be able to comply with government requests for it, no matter how old the information is. Sure, all of those “u up?"s may not seem significant now, but years and years of chat histories can paint a very detailed picture of your life, associations, political beliefs, and past movements and activity.

“Doing a good digital cleaning from time to time is a great habit, especially with social media and old chat messages,” says Kenn White, security principal at the database developer MongoDB and director of the Open Crypto Audit Project. “Who you were five or 10 years ago is probably very different than who you are today, so it's worth asking yourself, ‘Do I really need those seven-year-old inside jokes and sarcastic posts? Do I need to keep old group chat messages and carry them forward to every new phone I get?’”

Some programs like Apple's Messages make it easy to auto-delete your chat histories after a set period of time. On iOS, go to **Settings** > **Apps** > **Messages** and then scroll and tap **Keep Messages**. Then choose whether to keep messages forever, for one year, or for 30 days before auto-deleting.

On the free version of Slack, data older than a year is automatically deleted. The company keeps data forever on paid plans, unless the administrator sets up rolling deletion. This is useful if you have an active Slack with your friends, but most people who use Slack at work don't make decisions about administrative policies and can't control deletion. Keep this in mind for any communication you do on an employer's platforms. You may be able to go through and delete messages or files one by one, but you likely won't have the access to make policy decisions about automatic or batch deletion.

Similarly, you may want to go through your chats on Android or iOS and delete old SMS conversations. Meta's Messenger now offers auto-delete options, but for your existing chats, you have to go down the list on desktop or in the Messenger mobile app and delete chats one by one. Meta's other chat platforms, Instagram Chat and WhatsApp, are similar, except that WhatsApp has been end-to-end encrypted since 2016 instead of adding the protection recently.

Consider whether you've spent time chatting on other social platforms as well. X, for example, has been through a lot of changes since Elon Musk bought Twitter more than two years ago and took the company private again. Musk promised that he would add end-to-end encryption to DMs on X, and eventually debuted an opt-in encryption feature with the paid tier of the platform, but the company doesn't definitively say that the tool offers full end-to-end encryption and it isn't open source for vetting. You can delete individual messages or go through your chat list and delete whole DM conversations if you want to pare down the data you're keeping on the platform.

If you've had Gmail for a long time, the messenger service “Google Talk,” once colloquially known as “Gchat,” may have a special place in your heart. And perhaps, over the years, you went through the saga in which Gchat—which was once known for interoperability with platforms like AIM—became the siloed Google chat platform Hangouts, and then transformed again into what is now called Google Chat. Your chats on this platform through the years are still hanging around, but they're not all in the same place.

The crucial thing to understand is that Gchat was fully integrated with Gmail and wasn't a separate platform, so your chat histories all saved in your mail archive. To find them now, open Gmail and **search for the phrase in:chats** (using no quotation marks). Hundreds or thousands of chats from May 2013 and earlier may pop up. They must be deleted directly from Gmail. After May 2013, Google migrated Gchat users to Hangouts, and that history has come forward into what is now Google Chat, so you can delete whole chats or individual messages there.

“Messages sent and received with history on in Google Talk from before May 2013 (the time when Google Hangouts launched) are stored in Gmail under the ‘in:chats’ label. Those messages are not available in Google Chat and can be deleted directly from Gmail only,” Google spokesperson Ross Richendrfer tells WIRED. “In terms of Hangouts data—which was merged with Chat—core Chat controls (including deletion) will work.”

There are lots of other chat apps to consider, too, where old messages may still be lurking. Think about Skype chat or GroupMe. And there's one other complicating factor when you declutter your messages: Most deletion features only delete data from your account, and the messages live on in the accounts of the person or people you were chatting with. To do a total digital detox you need to recruit your community to delete their message archives as well.

Additionally, you may feel sentimental about burning your letters (aka deleting all of your old chats). If you're sad about hitting that trash icon, consider downloading chat histories with your closest friends or other loved ones and storing them on an encrypted external hard drive before deleting them from the cloud. This way, you don't have to give up that slice of life completely, but the data isn't controlled by other entities anymore.

“Some apps, including Signal, give one the ability to set a ‘self-destruct’ time on messages, perhaps in hours or weeks. This is worth considering to reduce your exposure, particularly if you travel outside the country, are politically active, or in any way have a higher public profile,” MongoDB's White says. “It's easy to dismiss the potential of attacks on our personal data and physical safety as something that's only a concern for some James Bond–type scenarios, but the hard truth is that threats exist in many forms, both online and in person.”

Hey, Maybe It's Time to Delete Some Old Chat Histories

Treasury says hackers accessed “certain unclassified documents” in a “major” breach, but experts believe the attack’s impacts could prove to be more significant as new details emerge.

A disclosure notice to the United States Congress on Monday revealed that the US Treasury Department suffered a breach earlier this month that allowed hackers to remotely access some Treasury computers and “certain unclassified documents.”

The attackers exploited vulnerabilities in remote tech support software provided by the identity and access management firm BeyondTrust, and Treasury said in its letter to lawmakers that “the incident has been attributed to a China state-sponsored Advanced Persistent Threat (APT) actor.” Reuters first reported the disclosure and its contents.

In the notice, Treasury officials said that BeyondTrust notified the agency of the incident on December 8 after attackers were able to steal an authentication key and use it to bypass system defenses and gain access to Treasury workstations.

“The compromised BeyondTrust service has been taken offline and at this time there is no evidence indicating the threat actor has continued access to Treasury information,” Treasury assistant secretary for management Aditi Hardikar wrote the lawmakers. “In accordance with Treasury policy, intrusions attributable to an APT are considered a major cybersecurity incident.”

The disclosure says that Treasury has been collaborating with the FBI, the Cybersecurity and Infrastructure Security Agency, and the intelligence community broadly as well as private “forensic investigators” to evaluate the situation. The Treasury and FBI did not immediately return WIRED's request for additional information about the breach. CISA referred questions back to the Treasury Department. BeyondTrust was not immediately available for comment about the situation.

On December 8, BeyondTrust published an alert that it has continued to update about “a security incident that involved a limited number of Remote Support SaaS customers.” (SaaS stands for “software as a service.”) Though the notification does not say that the US Treasury was one of the impacted customers, the timeline and details appear to line up with the Treasury disclosure, including acknowledgment from BeyondTrust that attackers compromised an application programming interface key.

The BeyondTrust alert mentions two exploited vulnerabilities involved in the situation—the critical command injection vulnerability "CVE-2024-12356" and the medium-severity command injection vulnerability "CVE-2024-12686." CISA added the former CVE to its “Known Exploited Vulnerabilities Catalog” on December 19. Command injection vulnerabilities are common application flaws that can be easily exploited to gain access to a target's systems.

“I cannot believe that we're seeing command injection vulnerabilities in 2024 in any products, let alone a secure remote access product that's supposed to have additional vetting for use by the US government,” says Jake Williams, vice president of research and development at the cybersecurity consultancy Hunter Strategy and a former NSA hacker. “They are some of the easiest bugs to identify and remediate at this point.”

BeyondTrust is an accredited “Federal Risk and Authorization Management Program” vendor, but Williams speculates that it is possible that the Treasury was using a non-FedRAMP version of the company's Remote Support and Privileged Remote Access cloud products. If the breach actually affected FedRAMP-certified cloud infrastructure, though, Williams says, “it might be the first breach of one and almost certainly the first time FedRAMP cloud tools were abused to facilitate remote access to a customer's systems.”

The breach comes as US officials have been scrambling to address a massive espionage campaign compromising US telecoms that has been attributed to the China-backed hacking group known as Salt Typhoon. White House officials told reporters on Friday that Salt Typhoon breached nine US telecoms.

“We wouldn’t leave our homes, our offices, unlocked and yet our critical infrastructure—the private companies owning and operating our critical infrastructure—often do not have the basic cybersecurity practices in place that would make our infrastructure riskier, costlier, and harder for countries and criminals to attack,” Anne Neuberger, deputy national security adviser for cyber and emerging technology, said on Friday.

Treasury, CISA, and FBI officials did not respond to WIRED's questions about whether the actor that breached the Treasury was specifically Salt Typhoon. Treasury officials said in the disclosure to Congress that they would provide more information about the incident in the Department's mandated 30-day supplemental notification report. As details continue to emerge, Hunter Strategy's Williams says that the scale and scope of the breach may be even larger than it currently appears.

“I expect the impact to be more significant than access to just a few unclassified documents,” he says.

US Treasury Department Admits It Got Hacked by China

From Elon Musk and Donald Trump to state-sponsored hackers and crypto scammers, this was the year the online agents of chaos gained ground.

For its entire existence as a global medium, the internet's evolution has been caught in a tug of war, pulled by opposing forces: on one side, moderation and control; on the other, disruption and anarchy.

This year, the most prominent actors weighing in on the side of disruption were familiar faces: The reckless oligarchs, cybercriminals, scammers, and state-sponsored hackers who made the internet feel particularly dangerous in 2024 were, to some degree, the same forces destabilizing the online world in 2023. But perhaps more than in any other recent year, those agents of chaos seemed to persist in the face of opposition, to grow in their influence—and to win.

From Elon Musk's completed remake of X in his own tech-bro image to Trump's disinformation-fueled campaign, to Russia's ongoing cyberattacks against Ukraine, to China's relentless onslaught of digital intrusions and crypto scammers' global spread, the online experience of 2024 was messy, hazardous, and Hobbesian. And for the most part, the people who made it that way are poised to exert even more influence over the year to come.

As we do every year, WIRED has assembled a list of the most dangerous people, groups, and organizations on the internet. Here are our picks for 2024.

**Elon Musk**

After years of evolution from entrepreneur to edgelord, Musk seemed to reach his final form this year in the run-up to November's US election. Once a technologist with ambiguous politics who occasionally pursued public arguments against scuba divers, Musk now uses his megaphone of 200-million-plus followers on X, the social media platform he fully controls, to broadcast an unrelenting stream of anti-regulation, anti-immigrant, anti-transgender, anti-press, anti-progressive talking points. He's amplified and repeated disinformation, like claims after the disastrous damage done by Hurricanes Helene and Milton that the Federal Emergency Management Agency (FEMA) was hoarding supplies or had spent its budget on migrants instead of needy Americans. He's repeated debunked theories about voter fraud and immigrants swinging elections. In at least one case, he's even seemed to drop a reference that suggest support for the QAnon movement, which maintains bizarre theories about satanic pedophile rings that only Donald Trump can destroy.

Meanwhile, Musk continues to push his AI startup, xAI, toward one of the most no-holds-barred visions of what that technology can make possible, with little regard for safety or preventing its use for disinformation. The company this year launched new image-generation capabilities in its Grok tool that were immediately used to create images of copyrighted characters, celebrities, and political figures in compromising or sexual positions. Musk himself at one point posted an AI-generated deepfake of Kamala Harris that mocked her with her own voice—with no annotation that it was not authentic—that received 150 million views.

More than any particular political message or technology he's pushed, however, the danger Musk represents is simply that the richest man in the world can buy one of the internet's most vital media platforms, then use it, along with hundreds of millions of dollars in donations, to elect the president of his choosing and shape US policy. After Trump's election, Musk was rewarded with hundreds of billions more in net worth. The system, in other words, is working—for oligarchs like Elon Musk.

**Donald Trump**

For the next four years, Donald Trump will once again be the most powerful single person in the world. This year, he was just a very loud one. On social media platforms like X—where Musk reinstated Trump's account despite a 2021 ban following his incitement of the January 6 storming of the US Capitol—and Trump's own Truth Social, he lit fires with false claims that arguably helped fuel his path to political victory. Like Musk, he made and repeated falsehoods such as FEMA spending its budget on immigrants rather than hurricane victims, or that immigrants were stealing and eating pets. By converting Robert F. Kennedy Jr. from a third-party candidate to an endorsing ally, Trump also reciprocally endorsed RFK Jr.'s long-running stream of anti-vaccine misinformation, rhetoric that has led to childhood vaccine rates now dipping to a lower level than before the Covid-19 pandemic.

Once his second term in office begins, Trump is poised to use digital surveillance to carry out a highly disruptive and even vindictive agenda: He's promised mass deportations of millions of immigrants starting on day one of his administration, and he's vowed to target political opponents and journalists with prosecution. There's little doubt that Trump will top this list in 2025. But in 2024, his words alone represent a clear and present danger.

**Volt Typhoon**

In the cybersecurity world, the last months of 2024 have been dominated by warnings from public officials about a Chinese state-sponsored hacking group known as Salt Typhoon, which has penetrated at least eight telecoms, in some cases accessing the real-time calls and texts of Americans. But in the midst of that cyberespionage scandal, a different, far more dangerous digital threat from China still quietly looms: A Chinese state-sponsored group called Volt Typhoon spent much of 2024 continuing its stealthy campaign to breach US critical infrastructure facilities—not to spy on communications, but to prepare for a potential cyberattack. While headlines about Volt Typhoon have largely dissipated since it was first called out and named by Microsoft in May of 2023, officials warn that the group continues to “pre-position” itself inside of networks that appear to be chosen for maximum disruption, perhaps timed to a Chinese invasion of Taiwan. Given that Chinese head of state Xi Jinping has told his country's military to be prepared for that invasion by 2027, now is the time to head off the digital salient of what could be a world-shaking future war.

**Sandworm**

While Volt Typhoon prepares, Sandworm attacks. The Russian hacking group, a unit of the country's GRU military intelligence agency, has in fact carried out many of the most disruptive cyberattacks of the past decade. Those attacks—mostly in Ukraine—include at least three blackouts triggered by its hacking, the destructive NotPetya malware that spread around the globe and inflicted $10 billion in damage, and countless data-destroying breaches that the group has carried out since the beginning of Russia's full-scale invasion of Ukraine in 2022. In 2024, as Russia fought Ukraine to a stalemate or regained territory in the east of the country, Sandworm continued to project its power beyond that front: Security firm StrikeReady discovered Sandworm targeting Ukraine's energy sector again this fall, perhaps in preparation for another round of electrical utility hacking, either to carry out its own attacks or as reconnaissance for the Russian military's now-annual physical bombing of Ukraine's grid.

**Israeli Military and Intelligence**

Last year, WIRED named both the IDF and Hamas on this list, a nod to each side's use of the internet in its propaganda efforts in the war in Gaza following Hamas' October 7 attack. This year, with Israel's adversaries in that conflict like Hamas and Hezbollah significantly weakened and in retreat, it's the Israeli forces that remain on the offensive. Israel's military continues to use AI tooling to identify targets for bombs as its strikes have killed tens of thousands of Gazan civilians and leveled entire cities in the territory. Israeli missiles continue to intermittently knock out Gaza's communications infrastructure, destroying 80 percent of the country's top telecom's cell towers and leading to information blackouts amid the destruction and starvation of that now year-plus siege. Add to all of that a still-mysterious Israeli supply chain attack that hid lethal explosives in pagers and walkie-talkies in an effort to target Hezbollah operatives, which led to immediate distrust of all communications devices in the country, and Israel's government forces remain an internet apex predator by any definition.

**Black Cat/AlphV/RansomHub**

Ransomware in 2024 was, again, one of the most abhorrent forms of cybercrime to blight the internet. But few ransomware attacks in history have been quite as dangerous and damaging as the one that targeted UnitedHealthcare subsidiary Change Healthcare early this year, carried out by a ransomware group known as Black Cat or AlphV. Even after extracting a $22 million ransom from the company—a payment processor that handles around 40 percent of all health care insurance claims across the US—the hackers' disruption of Change's network continued to prevent the company from completing payments to pharmacies, clinics, health care practices, and hospitals across the country for weeks, causing some to even go out of business. Then, as if it hadn't inflicted enough chaos, AlphV ran off with Change's ransom money instead of sharing it with a group of hackers with whom it had partnered to infiltrate the company. That led the jilted hackers to share the data stolen from Change Healthcare with another, newer ransomware crew called RansomHub, which extorted the company a second time—an unprecedented health care cybersecurity debacle.

**The Com**

Even in an age of state-sponsored Chinese cyberspies, Russian hacker saboteurs, and ransomware gangs, nihilistic young hackers remain a constant in the darker corners of the internet. And few of those corners are as dark as the ones frequented by the Com. The loose movement of online trolls and criminals who operate under the Com banner in channels on Telegram and Discord, many just in their teens, engage in some of the most despicable digital crimes possible, from petty crypto theft and ransomware to sextortion, harassment, and the creation and trade of child sexual abuse material. This year, several members of a Com subgroup of ransomware hackers known as Scattered Spider were arrested, following their alleged high-profile 2023 attacks on companies including Caesar's Entertainment and MGM Resorts. But other members of the group are allegedly responsible for the serial breaches of well over a hundred customers of the cloud provider Snowflake. It's a safe bet that the Com will continue to serve as a haven for plenty more criminal acts to come.

**Data Brokers**

Once, privacy fears centered on government agencies like the FBI and NSA and their ability to carry out mass surveillance worldwide. Now, increasingly, we give away that same surveillance data en masse to companies you've never heard of. This year, it came to light that several data brokers collect and then sell access to Americans' highly granular location data pulled from their phones. Surveillance services like Babel Street's LocateX allegedly can—and do—track visitors to sensitive locations abortion clinic or mosques. A data broker called Near Intelligence left a vast cache of location data exposed online, revealing the movements of hundreds of visitors to sex trafficker Jeffrey Epstein's island in the Caribbean. Reporting on both companies has demonstrated how much private location data our devices leave behind as revelatory digital detritus, and how the possession of that data now extends far beyond government agencies to little-known firms with highly questionable privacy and security practices.

**Character.AI**

If 2023 was the year that AI tools future-shocked the internet with their seemingly abrupt rise to prominence, 2024 was the year that those tools became normalized, quietly settling into common use in spite of all their alleged flaws and ethical problems. Yet those issues are still there, and perhaps no startup better exemplifies them than Character.AI, an AI firm backed by $2.7 billion in investment from Google. According to lawsuits filed in Texas and Florida against the company, its chatbots have encouraged children to engage in self-harm and violence against their parents, and allegedly contributed to 14-year-old dying by suicide. Other chatbots hosted by the company have allegedly coached kids into developing eating disorders, role-playing as school shooters, and even seemed to be sexually grooming them. Despite repeatedly vowing to implement age restrictions, no meaningful age safeguards appear to have been added even now, according to news outlet Futurism. If this is the future of artificial intelligence, the AI era is going to be a dark age indeed.

**Crypto Scammers**

The crypto-based investment scams known as “pig butchering”—a term experts now say should be retired because it can further harm victims—pulled in a staggering $37 billion in 2023, and likely more in 2024. The victims of that explosively growing form of crimes aren't just those who fall for its scams and lose their life savings, but also many of the perpetrators of the scams themselves: As many as 200,000 people have been enslaved in compounds across Southeast Asia and forced to carry out the fraud schemes. In some cases, they've been kept in electrified shackles and faced threats of cattle prods and beatings from the gangs overseeing their work. This year, the dystopia those scammers have ushered in has begun to spread worldwide, with operations cropping up in the Middle East, Eastern Europe, Latin America, and West Africa. The targets of their fraud, of course, are even more global. Crypto scams have already become a top-tier form of cybercrime, and there's no end in sight to the expansion of this predatory underworld industry.

The Most Dangerous People on the Internet in 2024

Smartphones and face recognition are being combined to create new digital travel documents. The paper passport’s days are numbered—despite new privacy risks.

In a matter of years, no matter where you live or travel, your face will likely be your new passport.

For centuries, people have used some form of passport while moving from place to place. But the widespread standardization of passports as we know them today didn’t really begin until after World War 1, when passports were commonly used as a security measure and to deter spies entering a country. Even then, some considered passports to be an “anachronism in the modern world.”

But the use of paper passports—which were first digitized as “e-Passports” with NFC chips in 2006—is slowly undergoing one of its biggest transformations to date. The travel industry, airports, and governments are working to remove the need to show your passport while flying internationally. Eventually, you may not need to carry your passport at all.

Instead, face recognition technology and smartphones are increasingly being used to check and confirm your identity against travel details before you can fly. These systems, advocates claim, can reduce the amount of waiting time and “friction” you experience at airports. But privacy experts caution that there is little transparency about the technologies being deployed, and their proliferation could lead to data breaches and greater levels of surveillance.

The push to remove paper passports is happening worldwide. So far, airports in Finland, Canada, the Netherlands, the United Arab Emirates, the United Kingdom, Italy, the United States, India, and elsewhere have been trialing various levels of passport-free travel or the technology needed to make it happen. In October, officials in Singapore announced that its residents can fly to and from the country without using their documentation, and foreign visitors can “enjoy the convenience of passport-less clearance when they depart Singapore.” More than 1.5 million people have used the systems, officials claim.

“It’s probably going to become the mainstream way of traveling, as I understand, in the near future,” says Athina Ioannou, a lecturer in business analytics at the University of Surrey in the UK, who has researched the privacy implications that come with different types of travel. Ioannou says the Covid-19 pandemic accelerated contact-free travel, and many efforts are driven by trying to get passengers moving quickly through airports.

While trials around the world are at different stages and use different technical infrastructure, they broadly work in similar ways: Information historically stored in your passport’s NFC chip, including facial data, is instead stored digitally and linked to your phone. The EU is planning to build an official travel app for this. When you are at an airport, the phone can be shown, and a face recognition camera will try to match you to the passport photo.

One of the most commonly tested approaches is using a “digital travel credential.” A DTC, according to the United Nations’ International Civil Aviation Organization (ICAO), which is behind the approach, is made up of two parts: a virtual element, which represents the information stored on passports, and a physical part, the bit on your phone. The two are cryptographically linked to ensure they’re not forgeries. “The key feature of the ICAO DTC is that authorities can verify a digital representation of the passport data before the traveller’s arrival and confirm the data’s integrity and authenticity,” a description of the system says.

Three different approaches to the DTC exist, with two requiring you to carry (but not necessarily use) paper passports, while the third approach, which may be some years down the line, doesn’t require a passport to even be issued. Earlier this year, border officials in Finland held a small-scale trial of a DTC on 22 airline routes, using a mobile app that had been developed. While passengers still had to carry passports, the country’s Border Guard concluded that checks lasted for just eight seconds, with the technical processing happening in two seconds. “Speed is really essential here if we are talking about facilitating a huge number of people,” Mikko Väisänen, the head of the DTC pilot, says.

While ending frustrating airport lines would be welcome for many, the shift to digital travel document also raises concerns about how data is protected, a normalization of problematic surveillance technology such as face recognition, plus whether digital ID systems will be further rolled out to other parts of society and who ultimately controls or builds these pieces of infrastructure.

The ICAO’s documentation around the DTC identifies risks such as “look-alike fraud,” criminals collecting DTC data and duplicating parts of it, delays to journeys if systems face outages, and people being unable to travel if there is a “false rejection” in face-recognition systems and no fallback systems in place. Face-recognition systems have been highly controversial for years.

Multiple companies around the world are building verification systems to help people prove they are who they say, which can involve linking with official government databases or systems. Udbhav Tiwari, the director of global product policy at Mozilla, says there are “privacy by design” and data minimization efforts that are taking place with the development of these products and systems, but there are still a range of other risks.

“We don’t really know how secure these systems are,” Tiwari says, adding that there are generally concerns about the “fairness, accountability, and transparency” with AI systems that can be used. “The fact is that all of these companies develop these systems often do so in deeply proprietary manners,” Tiwari says.

On top of this, Tiwari says, countries can treat people differently. Different nations have data protection regimes of varying quality and may use different standards around how people’s information can be passed to government or law enforcement agencies or sold. “I, for example, would be much more comfortable using biometric-based travel in Germany than I would in many other countries in the world, because I trust the data-protection ecosystem and regulators in Germany and might not in other countries,” Tiwari says.

Adam Tsao, vice president of digital identity at security firm Entrust, says that people using any systems will want to know that their data is being used the way they expect it to be. For instance, he says, among other things people will want to know who has access to information, what purposes they can access it for, and what say they have in what happens to it. “You really want to get to the point where as we move in this digitized world, that you’re giving the exact right amount of information, for the exact right amount of time, for the right purpose to the right people,” Tsao says. And that may not be straightforward.

In India, the Digi Yatra face-recognition boarding system has faced multiple criticisms about how it has been introduced and how people have been signed up for the voluntary scheme, as Biometric Update has reported. “The way that it’s happening in India is no longer voluntary, and it’s no longer something we can hold the government or anybody else accountable for,” says Disha Verma, from the Internet Freedom Foundation.

The Digi Yatra system, which has been operating in 24 airports around the country, may be opening up to foreign citizens in 2025. Meanwhile, there are plans to roll out the identity technology to hotels and historical monuments. Your face could soon be your room key as well.

The Paper Passport Is Dying

From Chinese cyberspies breaching US telecoms to ruthless ransomware gangs disrupting health care for millions of people, 2024 saw some of the worst hacks, breaches, and data leaks ever.

Every year has its own mix of digital security debacles, from the absurd to the sinister, but 2024 was particularly marked by hacking sprees in which cybercriminals and state-backed espionage groups repeatedly exploited the same weakness or type of target to fuel their frenzy. For attackers, the approach is ruthlessly efficient, but for compromised institutions—and the individuals they serve—the malicious rampages had very real consequences for people's privacy, safety, and security.

As political turmoil and social unrest intensify around the world, 2025 will be a complicated—and potentially explosive—year in cyberspace. But first, here's WIRED's look back on this year's worst breaches, leaks, state-sponsored hacking campaigns, ransomware attacks, and digital extortion cases. Stay alert, and stay safe out there.

**China's Salt Typhoon Telecom Breaches**

Espionage operations are a fact of life, and relentless Chinese campaigns have been a constant in cyberspace for years now. But the China-linked espionage group Salt Typhoon carried out a particularly noteworthy operation this year, infiltrating a slew of US telecoms including Verizon and AT&T (plus others around the world) for months. And US officials told reporters earlier this month that many victim companies are still actively attempting to remove the hackers from their networks.

The attackers surveilled a small group of people—less than 150 by current count—but they include individuals who were already subject to US wiretap orders as well as state department officials and members of both the Trump and Harris presidential campaigns. Additionally, texts and calls from other people who interacted with the Salt Typhoon targets were inherently also caught up in the espionage scheme.

**Snowflake Customer Breaches**

Throughout the summer, attackers were on a tear, breaching prominent companies and organizations that were all customers of the cloud data storage company Snowflake. The spree barely qualifies as hacking, since cybercriminals were simply using stolen passwords to log in to Snowflake accounts that didn't have two-factor authentication turned on. The end result, though, was an extraordinary amount of data stolen from victims including Ticketmaster, Santander Bank, and Neiman Marcus. Another prominent victim, the telecom giant AT&T, said in July that “nearly all” records relating to its customers' calls and texts from a seven-month stretch in 2022 were stolen in a Snowflake-related intrusion. The security firm Mandiant, which is owned by Google, said in June that the rampage impacted roughly 165 victims.

In July, Snowflake added a feature so account administrators could make two-factor authentication mandatory for all of their users. In November, suspect Alexander “Connor” Moucka was arrested by Canadian law enforcement for allegedly leading the hacking spree. He was indicted by the US Department of Justice for the Snowflake tear and faces extradition to the US. John Erin Binns, who was arrested in Turkey for an indictment related to a 2021 breach of the telecom T-Mobile, was also indicted on charges related to the Snowflake customer breaches.

**Change Healthcare Ransomware Attack**

At the end of February, the medical billing and insurance processing company Change Healthcare was hit with a ransomware attack that caused disruptions at hospitals, doctor's offices, pharmacies, and other health care facilities around the US. The attack is one of the all-time largest breaches of medical data, impacting more than 100 million people. The company, which is owned by UnitedHealth, is a dominant medical billing processor in the US. It said days after the attack started that it believed ALPHV/BlackCat, a notorious Russian-speaking ransomware gang, was behind the assault.

Personal data stolen in the attack included patient phone numbers, addresses, banking and other financial information, and health records including diagnoses, prescriptions, and treatment details. The company paid a $22 million ransom to ALPHV/BlackCat at the beginning of March in an attempt to contain the situation. The payment seemingly emboldened attackers to hit health care targets at an even greater rate than usual. With ongoing, rolling notifications to more than 100 million victims—with more still being discovered—lawsuits and other blowback has been mounting. This month, for example, the state of Nebraska sued Change Healthcare, alleging that “failures to implement basic security protections” made the attack much worse than it should have been.

**Russia's Midnight Blizzard Hit Microsoft**

Microsoft said in January that it had been breached by Russia's “Midnight Blizzard” hackers in an incident that compromised company executives' email accounts. The group is tied to the Kremlin's SVR foreign intelligence agency and is specifically linked to SVR's APT 29, also known as Cozy Bear. After an initial intrusion in November 2023, the attackers targeted and compromised historic Microsoft system test accounts that then allowed them to access what the company said were “a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions.” From there, the group exfiltrated “some emails and attached documents.” Microsoft said that the attackers seemed to be looking for information about what the company knew about them—in other words, Midnight Blizzard doing reconnaissance on Microsoft's research into the group. Hewlett-Packard Enterprise (HPE) also said in January that it had suffered a corporate email breach attributed to Midnight Blizzard.

**National Public Data**

The background check company National Public Data suffered a breach in December 2023, and data from the incident started showing up for sale on cybercriminal forums in April 2024. Different configurations of the data cropped up again and again over the summer, culminating in public confirmation of the breach by the company in August. The stolen data included names, Social Security numbers, phone numbers, addresses, and dates of birth. Since National Public Data didn't confirm the breach until August, speculation about the situation grew for months and included theories that the data included tens or even hundreds of millions of Social Security numbers. Though the breach was significant, the true number of impacted individuals seems to be, mercifully, much lower. The company reported in a filing to officials in Maine that the breach affected 1.3 million people. In October, National Public Data's parent company, Jerico Pictures, filed for Chapter 11 bankruptcy reorganization in the Southern District of Florida, citing state and federal investigations into the breach as well as a number of lawsuits that the company is facing over the incident.

**Honorable Mention: North Korean Cryptocurrency Theft**

A lot of people steal a lot of cryptocurrency every year, including North Korean cybercriminals who have a mandate to help fund the hermit kingdom. A report from the cryptocurrency tracing firm Chainalysis released this month, though, underscores just how aggressive Pyongyang-backed hackers have become. The researchers found that in 2023, hackers affiliated with North Korea stole more than $660 million across 20 attacks. This year, they stole roughly $1.34 billion across 47 incidents. The 2024 figures represent 20 percent of total incidents Chainalysis tracked for the year and a whopping 61 percent of the total funds stolen by all actors.

The sheer domination is impressive, but the researchers emphasize the seriousness of the crimes. “US and international officials have assessed that Pyongyang uses the crypto it steals to finance its weapons of mass destruction and ballistic missiles programs, endangering international security,” Chainalysis wrote.

The Worst Hacks of 2024

AI voice cloning and deepfakes are supercharging scams. One method to protect your loved ones and yourself is to create secret code words to verify someone’s identity in real time.

Scammers are out of control. Every year, fraudsters and cybercriminals make billions by tricking people into parting with their cash. Romance fraud, business email compromise, investment scams, sextortion—the list of ways criminals prey on people is virtually endless and constantly changing.

Add to that impersonation scams, where a criminal pretends to be someone known to their target and extracts money. There have been increasing calls for people, and particularly families, to create passphrases or passwords with each other. At the start of December, the FBI issued a recommendation that people create a “secret word or phrase with your family to verify their identity,” and British bank Starling has also published guidelines on creating safe phrases with others.

It’s a simple, if not new, approach—one that can potentially be effective. For instance, if you receive a message or call from your “son” or “daughter,” and they’re urgently asking for money to get out of a jam, asking them to provide a pre-agreed passphrase can reveal whether it’s really them.

“Fraudsters will use manipulation tactics to put the victim in a vulnerable state where they act out of panic, urgency, or a strong desire,” says Erin Englund, a director of threat analytics at fraud-detection firm BioCatch. “Having a passphrase or similarly prepared strategy enables victims to quickly validate legitimacy of an unusual interaction and take control.”

The calls to create family passwords or passphrases have come because scammers are increasingly adopting AI. Machine learning has allowed criminals to create deepfake videos impersonating people and to clone voices with only a few seconds of audio. Scammers have used these voice clones to pretend family members have been kidnapped and demand ransom payments for their release.

“AI is creating a large amount of risk for businesses and families,” says Rachel Tobac, CEO of SocialProof Security. Tobac says companies she has worked with have been on the receiving end of AI voice-cloned calls, which also use spoofed phone numbers, that try to impersonate business executives.

“I also hear about a few families every day who have received AI phone-call attacks voice-cloning a nephew, grandchild, or sibling in hysterics about being kidnapped or being involved in a car accident where they hit someone pregnant and need money for legal fees and bail,” Tobac says.

**Making a Good Family Password**

As with your online passwords, there are things you should and shouldn’t do when it comes to creating a shared passphrase. For starters, you shouldn’t make a passphrase the same as any of your passwords, and they shouldn’t be things a scammer could easily find—such as street names, birthdays, pets, or other personal information that may be shared online.

“Consider anything that you or your loved ones post online as data available to scammers,” Englund says. “Even if you keep all social media private, your data is available to your connections and followers who can be hacked.”

A good family passphrase, according to Starling Bank’s advice, could be anything that is unique, easy to remember, and can ideally be “shared with friends and family in person.” The guidelines give some hypothetical examples, such as a short phrase like “cheese puffs” or “rainbows and dragons,” or a mnemonic like ABC, which stands for “ants bake cakes.”

“Avoid joking about your code word in your text messages, social media posts, et cetera,” Tobac says. “We see folks make a family code word and then it’s hashtagged in their Instagram post. That's not a great idea—it’s got to be kept private.”

Tobac says that while family passwords can be useful, it’s crucial to be aware of their potential limitations. “We have to remember how human beings actually act in an emergency,” she says. For instance, if someone has really been in a car accident, Tobac says, it’s likely adrenaline would kick in and they may not remember a passphrase.

Tobac recommends using a method she calls “Being Politely Paranoid,” which at its simplest is trying to verify the identity of the person who is contacting you by a second method. “If you receive a call from a nephew who says they are in an accident and need money for legal fees, you can say, ‘100 percent I can help you. I just texted you a word, go ahead and read that out to me.’”

Ultimately, nobody is infallible to scamming, even if they know the steps they should take when receiving a potentially suspicious call or message. “If you do fall victim to a scam, report it to your bank or the authorities,” Englund says. “Often victims feel shame and fault and do not report scams. There are options available to protect yourself and get resolution.”

You Need to Create a Secret Password With Your Family

In Russia’s war against Ukraine, electronic warfare, including signal-jamming, anti-drone weapons, and innovative protections for critical military systems, has become a key piece of the conflict.

The Invisible Russia-Ukraine Battlefield

Plus: Google’s U-turn on creepy “fingerprint” tracking, the LockBit ransomware gang’s teased comeback, and a potential US ban on the most popular routers in America.

It’s been a busy year in cybersecurity, but it’s not over yet. This week, we revealed how hackers figured out how to “jailbreak” digital license plates—which are legally issued in at least a couple of states and are valid across the US—allowing them to change the license plate number to basically anything. That means someone with this capability can avoid tolls and tickets, or even change their plate to be the same as their enemy.

While the company that makes the plates, Reviver, makes clear that doing this would be both illegal and a terms-of-service violation, we’re guessing that the people who want to hide their car’s credentials so they can speed all over town aren’t too concerned about that.

Staff at the Cybersecurity and Infrastructure Security Agency are preparing for an uncertain future. Several CISA employees told WIRED that they’re afraid the incoming Trump administration will scrap key programs that they say are keeping Americans safe from cyberattacks and other threats—or that the agency itself could be dismantled.

In recent years, financial scams that involve bilking people out of their cryptocurrency holdings have come to be known by an eye-catching, catch-all name: “pig butchering.” But it’s time for a rebrand, according to officials at Interpol. The term, which is a translation from Chinese and refers to the slow process of fattening up a pig before slaughtering it, was likely created by the scammers themselves. As such, its use could further degrade victims of these scams or shame them into not reporting a crime.

Doing crimes in public is, apparently, all the rage. We took a deep dive into the world of drug dealers who are advertising their goods on open web platforms like Instagram, X, and Snapchat. The practice isn’t new, but authorities in Europe say it’s growing more popular.

And that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

**FAA Bans Drones Over Parts of NJ and NY but “Has Not Identified Anything Anomalous”**

The US Federal Aviation Administration said on Thursday that it was temporarily banning drone flights over dozens of critical infrastructure and utility sites in New Jersey and New York “at the request of federal security partners.” The restrictions are set to last 30 days. The announcement comes as panic over reported mysterious drone sightings in the two states has surged in recent weeks. The FAA said in a joint statement with the US Department of Homeland Security, Department of Defense, and FBI on Wednesday that the US government has not found evidence of malicious or unexplained aircraft.

"Having closely examined the technical data and tips from concerned citizens, we assess that the sightings to date include a combination of lawful commercial drones, hobbyist drones, and law enforcement drones, as well as manned fixed-wing aircraft, helicopters, and stars mistakenly reported as drones,” the agencies wrote. "We have not identified anything anomalous and do not assess the activity to date to present a national security or public safety risk over the civilian airspace in New Jersey or other states in the northeast.”

The agencies said that the FBI has received more than 5,000 tips about reported drone sightings in recent weeks that have generated about 100 leads investigated by local, state, and federal officials. None have proved to be problematic or concerning. The mass hysteria is itself creating dangerous conditions, though. The FAA warned on Wednesday that there has been a significant uptick in people pointing lasers at aircraft, which is illegal because it can be dangerous and distracting for pilots.

**Google U-Turn Allows Creepy “Fingerprint” Tracking Next Year**

Back in 2019, Google made its position on the online tracking method called fingerprinting pretty clear. “Unlike cookies, users cannot clear their fingerprint, and therefore cannot control how their information is collected,” the company said in a blog post. “We think this subverts user choice and is wrong.”

That viewpoint appears to have changed. This week, Google announced that, starting in February 2025, advertisers would be allowed to use fingerprinting. The method is largely hidden and allows online activity to be tracked by building up a profile using characteristics from your device—for instance, your phone type, language settings, timezone, can be combined with other information unique to your setup and identify you.

Google indicated the change in new advertising policies, which will go into force next year. The current version of the policy says fingerprinting is not allowed, while that reference has been scrubbed from the new version. The change drew instant criticism, with the UK’s data regulator, the Information Commissioner’s Office (ICO), saying that “fingerprinting is not a fair means of tracking users online” and it called the U-turn “irresponsible.” The ICO said it is talking to Google about the shift.

**LockBit Teases Potential Comeback as Alleged Developer Faces US Extradition**

Early this year, the notorious Lockbit ransomware group was thoroughly dismantled by a law enforcement operation, called Operation Cronos. The group’s website was taken over, details of its members and their cyberattacks extracted, decryption tools released, and its alleged Russian mastermind identified.

Now, the US government is attempting to extradite Rostislav Panev, an Israeli citizen who it suggested worked as a LockBit developer between 2019 and 2024. According to Ynet news, Panev was arrested in August and it is alleged that he received more than $230,000 in Bitcoin and developed ransomware tools from the gang. According to a complaint unsealed by US officials, Panev said he was regularly paid $10,000 per month for software development. Panev’s lawyers deny the claims.

At the same time, the organizers of the LockBit ransomware claim that they have created a new “4.0” version of their tools and will be “launching” them in February. A post on LockBit’s reincarnated dark-web sites urged potential hackers to sign up. As with many cybercrime groups, LockBit has lied about its activities in the past, and following the humiliation of its disruption, many other cybercriminals may not trust its tattered brand.

**One of America’s Most Popular Router Manufacturers May Be Banned**

Chinese technology company and router maker TP-Link could be banned in the US, a report from The Wall Street Journal this week claimed. Officials at the Defense, Commerce, and Justice departments have launched investigations into the company over potential cybersecurity and national security concerns around its routers. The Commerce Department has reportedly subpoenaed TP-Link, which has more than 60 percent of the US retail market for routers. A ban could reportedly happen next year.

While TP-Link is a Chinese company, its products are sold in the US by a separate California-based business. In October, Microsoft said that TP-Link routers “make up most” of a network of compromised devices that it has detected being used in Chinese hacking campaigns. The news of the potential ban follows the previous bans of Huawei and ZTE equipment and comes as TikTok will challenge its ban before the US Supreme Court in early January.

Source

Wired