In a letter to the Department of Defense, senators Ron Wyden and Eric Schmitt are calling for an investigation into fallout from the Salt Typhoon espionage campaign.

The senators also provide evidence in their letter that US telecoms have worked with third-party cybersecurity firms to conduct audits of their systems related to the telecom protocol known as SS7 but have declined to make the results of these evaluations available to the Defense Department. “The DOD has asked the carriers for copies of the results of their third-party audits and were informed that they are considered attorney-client privileged information,” the department wrote in answer to questions from Wyden’s office.

The Pentagon contracts with major US carriers for much of its telecom infrastructure, which means that it inherits any potential corporate security weaknesses they may have but also the legacy vulnerabilities at the heart of their telephony networks.

AT&T and Verizon did not respond to multiple requests for comment from WIRED. T-Mobile was also reportedly breached in the Salt Typhoon campaign, but the company said in a blog post last week that it has seen no signs of compromise. T-Mobile has contracts with the Army, Air Force, Special Operations Command, and many other divisions of the DOD. And in June, it announced a 10-year, $2.67 billion contract with the Navy that “will give all Department of Defense agencies the ability to place orders for wireless services and equipment from T-Mobile for the next 10 years.”

In an interview with WIRED, T-Mobile chief security officer Jeff Simon said that the company recently detected attempted hacking activity coming from its routing infrastructure by way of an unnamed wireline partner that suffered a compromise. T-Mobile isn't certain that the “bad actor” was Salt Typhoon, but whoever it was, Simon says the company quickly stymied the intrusion attempts.

“From our edge routing infrastructure you can’t get to all of our systems—they’re somewhat contained there and then you need to try to move between that environment and another one in order to gain more access,” Simon says. “That requires them to do things that are rather noisy and that’s where we were able to detect them. We’ve invested heavily in our monitoring capabilities. Not that they’re perfect, they never will be, but when someone’s noisy in our environment, we like to think that we’re going to catch them.”

In the midst of the Salt Typhoon chaos, T-Mobile’s assertion that it did not suffer a breach in this instance is noteworthy. Simon says that the company is still collaborating with law enforcement and the telecom industry more broadly as the situation unfolds. But it is no coincidence that T-Mobile has invested so extensively in cybersecurity. The company had suffered a decade of repeated, vast breaches, which exposed an immense amount of customer data. Simon says that since he joined the company in May 2023, it has undergone a significant security transformation. As one example, the company implemented mandatory two-factor authentication with physical security keys for all people who interact with T-Mobile systems, including all contractors in addition to employees. Such measures, he says, have drastically reduced the risk of threats like phishing. And other improvements in device population management and network detection have helped the company feel confident in its ability to defend itself.

“The day we did the transition, we cut off a number of people’s access, because they hadn’t gotten their YubiKeys yet. There was a line out the door of our headquarters,” Simon says. “Every life form that accesses T-Mobile systems has to get a YubiKey from us.”

Still, the fact remains that there are fundamental vulnerabilities in US telecom infrastructure. Even if T-Mobile successfully thwarted Salt Typhoon’s latest intrusion attempts, the espionage campaign is a dramatic illustration of long-standing insecurity across the industry.

“We urge you to consider whether DOD should decline to renew these contracts,” the senators wrote, “and instead renegotiate with the contracted wireless carriers, to require them to adopt meaningful cyber defenses against surveillance threats.”

_Additional reporting by Dell Cameron._

Senators Warn the Pentagon: Get a Handle on China’s Telecom Hacking

Western authorities say they’ve identified a network that found a new way to clean drug gangs’ dirty cash. WIRED gained exclusive access to the investigation.

She Was a Russian Socialite and Influencer. Cops Say She’s a Crypto Laundering Kingpin

At WIRED’s The Big Interview event, the president of the Signal Foundation talked about secure communications as critical infrastructure and the need for a new funding paradigm for tech.

“We don’t want to be the outlier that proves the rule, we want to be a new set of rules leading the way to a much more open and diverse tech ecosystem,” Whittaker said, “that isn’t reliant on like five companies and 15 guys and a paradigm that is very, very stale and ultimately not healthy for the world and the future.”

It costs around $50 million per year to run Signal, and Whittaker noted at the event that there are no easy answers to finding that type of funding—or more—for projects that need consistent, independent, and secure backing without being subject to the forces of data monetization and surveillance capitalism.

“None of this is simple, friend,” Whittaker said. “There’s a type of capital we need. How do we get it?”

The first Trump presidency in the United States was increasingly hostile to encryption and independent tech, so with a new Trump administration looming and anti-encryption advocates making inroads in governments around the world, what comes next for Signal?

“Signal knows who we are. Signal will continue being Signal,” Whittaker says. “Signal has one thing we do, and we do it really well and we do it pretty obsessively, and that is: provide truly private communications infrastructure to everyone, everywhere, globally. Full stop. We’re not changing.”

With Threats to Encryption Looming, Signal’s Meredith Whittaker Says ‘We’re Not Changing’

The FTC is targeting data brokers that monitored people’s movements during protests and around US military installations. But signs suggest the Trump administration will be far more lenient.

The United States Federal Trade Commission is taking action against two American data brokers accused of unlawfully trafficking in people’s sensitive location data. The data was used, the agency says, to track Americans in and around churches, military bases, and doctors’ offices, among other protected sites. It was sold not only for advertising purposes but also for political campaigns and government uses, including immigration enforcement.

Mobilewalla, a Georgia-based data broker that’s said to have digitally tracked the residents of domestic abuse shelters, is accused by the agency of purposefully tracking protesters in the wake of George Floyd’s murder in 2020. In a court filing, the FTC says Mobilewalla attempted to unmask the protesters’ racial identities by tracking their mobile devices to, for example, Hindu temples and Black churches.

The FTC also accused Gravy Analytics and its subsidiary Venntel of harvesting and exploiting consumers’ location data without consent, alleging that the company used that data to unfairly infer health decisions and religious beliefs.

According to the FTC, Gravy Analytics collected over 17 billion location signals from approximately a billion mobile devices daily. It has reportedly sold access to that data to federal law enforcement agencies such as the Department of Homeland Security, the Drug Enforcement Agency, and the Federal Bureau of Investigation.

Gravy Analytics could not be immediately reached for comment.

A spokesperson for Mobilewalla says the company's privacy policies are constantly evolving, adding: “While we disagree with many of the FTC’s allegations and implications that Mobilewalla tracks and targets individuals based on sensitive categories, we are satisfied that the resolution will allow us to continue providing valuable insights to businesses in a manner that respects and protects consumer privacy.”

“This data can be used to identify and target consumers based on their religion,” the FTC says. The location data collected by the two companies makes it possible, the agency says, to “identify where individual consumers lived, worked, and worshipped, thus suggesting the mobile device user’s religion and routine and identifying the user’s friends and families.”

According to the two settlements, which must be finalized in court before they would go into effect, Gravy Analytics and Mobilewalla are barred from collecting sensitive location data from consumers and must delete the historical data they gathered on millions of Americans. Mobilewalla would be banned from acquiring location data and other sensitive information from online auctions known as real-time bidding exchanges, marketplaces where advertisers compete to instantaneously deliver ads to targeted consumers. This case marks the first time the FTC has moved to police the collection of data directly from an ad exchange.

In another first, the proposed Gravy Analytics settlement would introduce military installations to the list of “sensitive locations” where the FTC bans location tracking. Under the terms, the company would be prohibited from selling, disclosing, or using data drawn from these locations, which include mental health clinics, substance abuse centers, and child care service providers.

In November, a collaborative investigation by WIRED, Bayerischer Rundfunk, and Netzpolitik.org revealed that over 3 billion phone location data points, collected by a US-based data broker, exposed the movements of US military and intelligence personnel in Germany. These movements included visits to nuclear vaults and brothels. In that story, WIRED first reported on FTC chair Lina Khan’s efforts to shield US military and intelligence personnel from data brokers.

US senator Ron Wyden of Oregon, who first urged the FTC to take action against Mobilewalla in 2020, praised the announcements, calling the companies’ actions “outrageous violations of Americans’ privacy.”

“These companies enabled US government agencies to surveil Americans without a warrant and enabled foreign countries to spy on service members with just a credit card,” says Wyden, who also previously investigated Venntel with other members of Congress.

While the FTC’s orders don’t directly tackle the issue of government agencies purchasing Americans’ location data—information for which a warrant is normally required—Wyden says the cases nevertheless undermine the government’s case for allowing the purchases. The orders make clear, he says, that federal agencies are hiding behind a “flimsy claim that Americans consented to the sale of their data.”

In a statement, FTC commissioner Alvaro Bedoya notes that while surveillance conducted by private companies won't raise the same constitutional issues as surveillance by government, the difference between the two is “porous if not irrelevant” to the people being watched. "Governments have long relied on private citizens for work that would be impractical or illegal for law enforcement," he says.

Whether the orders against Gravy Analytics and Mobilewalla will be enforced remains to be seen. Major changes are coming to the agency under the future Trump administration—most expected to undermine years of work by Khan and her staff. Many of Donald Trump's allies have been vocally critical of Khan's aggressive pro-consumer approach, including Republican megadonor Elon Musk, who has taken command of an ad hoc office that will purportedly advise the White House on improving “government efficiency.”

FTC commissioner Andrew Ferguson, whose name was floated last month as a potential Khan replacement, partially concurred with the agency’s decision to bring cases against the two data brokers on Tuesday. He agreed the companies had taken insufficient steps to ensure consumer data was properly anonymized, adding that they’d failed to obtain the “meaningfully informed consent” of the consumers they targeted.

Unlike Khan, however, Ferguson argues that the companies did not run afoul of the law by “categorizing consumers based on sensitive characteristics,” such as whether they attend church or political meetings. “These are all public acts that people carry out in the sight of their fellow citizens every day,” he says.

Ferguson likewise chastised the agency for attempting to restrict the power of data brokers to target protesters specifically. “Treating attendance at a political protest as uniquely private and sensitive is an oxymoron,” he says.

In a separate action Tuesday morning, the Consumer Financial Protection Bureau announced it was taking steps to crack down on predatory data brokers that traffic in people’s financial information, calling the practice a gateway for “scamming, stalking, and spying.”

Musk, who donated more than $100 million toward Trump’s reelection, called publicly last week for the bureau to be “deleted.”

FTC Says Data Brokers Unlawfully Tracked Protesters and US Military Personnel

When programmer Micah Lee was kicked off X for a post that offended Elon Musk, he didn't look back. His new tool for saving and deleting your X posts can give you that same sweet release.

At around 5 pm on a Thursday in December 2022, a privacy- and information-freedom-focused programmer named Micah Lee learned, to his shock, that he had just been banned from Twitter. His crime: posting a link to @Elonjets, an account on the competing social media service Mastodon that tracked the location of the private jet of Twitter’s new billionaire owner, Elon Musk—a link that Musk would later claim amounted to “doxing” despite the jet’s location info being publicly available.

For a moment, Lee grieved the loss of an account he'd spent years building, with more than 50,000 followers. Then, almost immediately, that feeling was replaced with relief to have escaped a platform he felt was already in precipitous moral decline. Since Musk had taken it over two months earlier, Twitter's new owner had already allowed previously banned far-right and even neo-Nazi figures back onto the service in the name of free speech—while simultaneously axing the accounts of leftists. Perhaps getting banned for offending the mercurial mogul behind those partisan decisions was “a good way to go,” Lee decided.

He hasn't looked back. Twitter eventually told Lee he could return to the service if he deleted his @Elonjets tweet. Instead, he stayed off the platform for eight months before finally deleting that post, but only so that he could log in and delete his entire history on the platform. A few months later, after Twitter had become X, he wrote a few messages promoting a book he'd written—all now deleted, too—and says he has barely touch the service otherwise. “Honestly, my mental health is much better since then,” he adds.

Now, Lee wants to help you achieve that same cleansing release. Today, he launched Cyd—an acronym for “Claw back Your Data”—a desktop application designed to give users more control over their X history: archiving it, trimming it to their preferences, or destroying it altogether. In the free version of Cyd, the program allows anyone to download their X posts—Cyd can save up to 2,000 of your most recent posts itself, or you can use X's built-in feature that allows you to download your entire archive—and then automatically delete them. For $36 a year, users can access Cyd's premium features, like erasing the contents of their account with more fine-grained filters based on variables like date, number of likes or retweets, or keywords, un-retweeting or removing likes from posts en masse, and unfollowing all X users.

While Cyd for now is designed specifically for managing—or emptying out—your X account, Lee says he hopes to eventually add other features for carrying out the same archiving and deletion functions on services like Facebook and Reddit. “A handful of billionaires like Elon Musk and Mark Zuckerberg and Jeff Bezos control all the platforms that we use all the time and where we have all our data,” Lee says. “I want to basically make it so that the users of these platforms—everybody else who isn't one of these really rich tech billionaires—has a bit more power.”

Cyd creator Micah Lee.Courtesy of BSidesPDX

Lee is launching Cyd in the midst of a mass X exodus: Millions of users have fled the service in the wake of the election of Donald Trump, many turned off by Elon Musk's support for Trump in the form of both campaign contributions and in his own nonstop political posts, as well as the increasingly conservative bent of X's remaining user base. The social media Bluesky, in particular, appears to have gained most of those X refugees, adding at least 8 million users in the weeks after the election.

“I think it's incredibly timely for people to delete as much as they can, as much as they want to, off of X, and just stop using the platform,” Lee says, “and try to take some of its influence away and move it to better platforms like Bluesky or Mastodon.”

Cyd is only one of several apps like TweetDeleter and Redact.dev that offer to archive and prune your X account. But unlike TweetDeleter, Cyd allows mass deletion of posts in its free version. While Redact.dev offers more free deletion features than Cyd, Cyd's $36 paid version is about half the price of Redact's $6 a month premium plan. It also offers some features that Redact doesn't, like deleting posts based on number of likes or retweets, so that users can, for instance, scrub all but their most viral posts.

Despite Cyd's timeliness, Lee says he's been working on a social media archiving and deletion tool for years, even before Musk acquired Twitter. In 2019, he released Semiphemeral, an earlier app with social media management features similar to Cyd, partially in response to his own experience of becoming the target of harassment and antisemitic tweets in the previous years. To perform its social media archiving and curation, Semiphemeral tapped into Twitter's API, an interface to its backend data provided to developers.

A few months after Musk acquired Twitter, however—and after the site summarily banned Lee and a handful of other journalists for linking to @Elonjets—Twitter ended free access to that API, killing Semiphemeral. A year later, however, Lee was laid off from his job as the director of information security at the news outlet the Intercept, along with about a third of the newsroom, and started looking for projects to work on. He soon figured out that he could revive Semiphemeral by designing it to automatically view and scrape X pages from a web browser instead of using X's API. “Everything it does is actually something you can do yourself in a web browser,” Lee says. “It would just take you a lot more time.” He also rebranded the app to Cyd in an attempt to make its name easier to remember and spell, and created a cute blue bird in a pirate mask (also named Cyd) to serve as its animated logo.

Though it's cheaper than some other options, Cyd's annual cost of $36 for its premium features will no doubt still be too steep for many users. Lee says he plans to work with organizations that represent at-risk groups to offer the tool for free to those who need it. He also points out, perhaps only half-jokingly, that $36 is less than half the annual cost of a Twitter blue account.

More to the point, he says that he hopes that unlike some of his previous software projects—the secure and anonymous file-sharing tool Onionshare and the safe-download protection app Dangerzone—he hopes this one will have a business model that gives him time to work on it and expand its feature set to include other social media platforms. “I would love to make it so that it can pay for itself,” Lee says, “so that I can make it bigger.”

Despite those big ambitions, Lee says that he hadn't quite intended to launch Cyd just as Bluesky experiences a user explosion at X's expense—and as more users than ever consider the motives and power of the tech billionaires who control the platforms they use.

“I knew that X was going down the drain, and I knew that people would be pissed off about it. I didn't really quite realize that people would be quitting en masse like they are now," says Lee. “It just happens to be perfect timing.”

He Got Banned From X. Now He Wants to Help You Escape, Too

A new proposal by the Consumer Financial Protection Bureau would use a 54-year-old privacy law to impose new oversight of the data broker industry. But first, the agency must survive Elon Musk.

The United States government’s leading consumer protection watchdog announced Tuesday the first steps in a plan to crack down on predatory data broker practices that the agency says help fuel scams, violence, and threats to US national security.

The Consumer Financial Protection Bureau is proposing a rule that would allow regulators to police data brokers under the Fair Credit Reporting Act (FCRA), a landmark privacy law enacted more than a half century ago. Under the proposal, data brokers would be limited in their ability to sell certain sensitive personal information, including financial data and credit scores, phone numbers, Social Security numbers, and addresses. The CFPB says that closing the loopholes allowing data brokers to trade in this data with little to no oversight will benefit vulnerable people and the US as a whole.

“By selling our most sensitive personal data without our knowledge or consent, data brokers can profit by enabling scamming, stalking, and spying,” Rohit Chopra, CFPB’s director, said in a statement. “The CFPB’s proposed rule will curtail these practices that threaten our personal safety and undermine America’s national security.”

Passed in 1970 as the first US privacy law, the FCRA requires “credit reporting agencies” to adhere to certain standards of accuracy and privacy in their dealing with people’s financial information, including credit histories, credit scores, debt payment histories, and other related data. The CFPB’s proposal aims to treat data brokers like credit reporting agencies when they deal in this sensitive data. It would require data brokers to obtain “separate, explicit authorization” before acquiring or sharing people’s credit information, rather than burying these permissions in expansive legal documents that surveys show are often unread or impossible for the average person to parse.

In a conversation with reporters on Monday, Chopra pointed to the recent attacks on US telecommunications systems, which the government has attributed to China, to emphasize the value of personal data to the nation's foreign rivals. “But often, our adversaries don't need to hack anything,” he says. “Data brokers, the outfits that collect and sell detailed information about our personal and financial lives, are making this data available to anyone willing to pay a price.”

The action proposed by the CFPB is aimed, Chopra says, at stopping data brokers from “enabling scammers, stalkers and spies undermining our personal safety and America's national security.”

The CFPB’s idea of using existing US law to regulate data brokers is not novel. In February 2023, a group of consumer-focused nonprofits urged Chopra to enforce the powers the FCRA affords regulators to prevent data brokers from engaging in these potentially damaging practices.

“Protecting the personal information of all people in the US is increasingly urgent in our current political climate,” says Laura Rivera, attorney with Just Futures Law, a nonprofit that supports grassroots activists. “The stakes are too high to continue to let the data broker industry sell our information at their discretion, where the status quo has made it ripe for abuse and targeting from harmful actors.”

In a briefing with WIRED on Monday, CFPB officials declined to comment on whether they believe the regulatory action will be short lived, as president-elect Donald Trump plans to empower a number of Silicon Valley figures to reorganize the federal government with the aim of targeting “waste and fraud.”

Elon Musk, who is coleading an office named after a meme coin—the Department of Government Efficiency, or DOGE—directly attacked the CFPB's work last week, calling for the agency to be “deleted.” Musk's remarks followed an attack on the agency's work by Marc Andreessen, a venture capitalist, who claimed on a recent episode of Joe Rogan’s podcast that the agency is “terrorizing” banking startups.

The CFBP was founded in 2011 with the aim of protecting consumers from the kinds of fraud and abuse that kicked off the 2008 financial crisis.

A CFPB official tells WIRED that the agency is also concerned about data being transmitted in ways that companies allege protects people's identities but in reality can be "de-anonymized" in simple ways, as studies have repeatedly shown. "As technology advances, we surmise that it will be even easier to de-mask purportedly de-identified data," one official said. The proposed rule thus includes a range of guidelines for credit reporting agencies involved in selling data they alleged has been de-identified.

Asked whether the proposal would extend to US government agencies, an official says that US law sets forth "very clear pathways" for the government to purchase personally identifying data for law enforcement and intelligence purposes. In a recent case, US Immigration and Customs Enforcement was discovered by reporters to have purchased access to the personal data of Americans in an attempt to investigate immigrants—data acquired by the media conglomerate Thomson Reuters, which it provided to custeroms in contracts the company disclosed were worth more than $100 million. (Thomson Reuters previously denied that the purpose of the data is to track undocumented immigrants and has emphasized that its database does not contain information that normally requires a search warrant to access.)

“We are not disrupting any of those pathways,” a CFPB official says. The agency is requesting comment, however, on the potential impacts of such government purchases to ensure that access is “appropriate.”

Emily Peterson-Cassin, director of corporate power at the nonprofit advocacy group Demand Progress’s Education Fund, commended the CFPB’s proposal and urged the incoming Trump administration to see it through.

“The CFPB is doing something important that will resonate with every single American. Anyone you pick off the street can tell you about the daily scam texts, emails and calls they receive from fraudsters who easily buy our contact information from shady, unaccountable data brokers,” Peterson-Cassin says. “Finally, someone—specifically the CFPB—has stepped in to stop this daily plague affecting hundreds of millions of people by applying real standards to their sale of our sensitive information.”

Top US Consumer Watchdog Has a Plan to Fight Predatory Data Brokers

The scourge of “malvertising” is nothing new, but the tactic is still so effective that it's contributing to the rise of investment scams and the spread of new strains of malware.

Malicious digital advertisements and “SEO poisoning” that gets those ads to prime spots in search results have been mainstays of the digital scamming ecosystem for years. But as online crime evolves and malicious trends like “pig butchering” investment scams and infostealing malware proliferate, researchers say that so-called “malvertising” is still a key technique for scammers—and still a growing problem.

Instances of malvertising in the US were up 42 percent month-over-month in fall 2023 and increased another 41 percent from July to September of this year, according to data from the security firm Malwarebytes. The company says that scammers typically cycle through the advertising accounts used for malvertising quickly, and 77 percent of the accounts are only used once. The bulk of the activity, though, traces back to South Asia and Southeast Asia, Malwarebytes says, with 90 percent of the ad fraud coming from Pakistan and Vietnam, according to the researchers' telemetry. But as with many components of the digital crime ecosystem, malvertising is often offered as a service where cybercriminals from around the world can purchase ads that distribute their malware or lead potential victims to a malicious website of their choosing.

Jérôme Segura, senior director of threat intelligence at Malwarebytes, emphasizes that a particularly effective place for potential victims to encounter malicious ads is in search results, where sponsored marketing content gains legitimacy just by showing up on the same page as legitimate search results. Such malicious ads can even end up getting prime placement in the layout of search results.

“Scammers are using the power of internet and advertising technology, which allows really immense targeting of the right victim. They can get the right ad with the right intent in front of them at the right time,” Segura says. “The fact that scammers are continuing to spend money on advertising shows that these scams are working and they’re getting a return on their ad spend.”

Malvertising has been and continues to be used in phishing attacks and credit card scams, as well as for distributing malware like cryptominers and ransomware. But researchers are increasingly seeing it being used to infect victims with infostealers as well. And researchers from the United Nations Office on Drugs and Crime report that malicious ads have been incorporated into pig butchering and other investment scams, and even romance scams.

“Malvertising is a cyberattack technique that injects malicious code within digital ads,” UNODC notes in a recent report on evolving cybercrime tactics. “Difficult to detect by both internet users and publishers, these infected ads are usually distributed to consumers through legitimate advertising networks. Because ads are displayed to all website visitors, virtually every page viewer is at risk of infection.”

Researchers regularly see malicious ads in search results representing themselves as coming from legitimate businesses and organizations. Whether it's a regional municipality, a utility like a power company, or a big business, people will use search engines simply to pull up the URL of an organization. And if the first results or the most convenient results to click on are ads, scammers have the opportunity to buy this real estate.

“The volume of these things is immense,” says Sean Gallagher, the senior threat researcher at Sophos. “Search engines like Google will say they check the content of ads to ensure they’re safe, but the thing is that attackers are using ad delivery networks and can redirect the URL after the ad is paid for.”

Google is clearly aware that malicious ad activity is growing and evolving. The company specifically addresses misleading and fraudulent ad activity in its policies, including a “misrepresentation policy,” and says that it takes numerous approaches to vetting ads and detecting malvertising. Attackers have continued to develop circumvention methods, though, to avoid having their ads flagged or removed. In 2023, Google blocked or removed about 5.5 billion ads and suspended more than 12.7 million advertiser accounts.

The company has also taken steps over the years to label ads clearly and delineate them in the search results layout. Still, any search engine that’s supported by ads ultimately has the two types of content side by side, especially on mobile, where users have limited screen space.

“We expressly prohibit ads that attempt to circumvent our enforcement by disguising the advertiser’s identity to deceive users and distribute malware," Google spokesperson Nate Funkhouser told WIRED in a statement. “When we identify an ad that violates this policy, we remove it and suspend the associated advertiser account as quickly as possible.”

Sophos' Gallagher points out that criminals can often get the most for their money when buying ads for more unique searches, where they can dominate the ad space and get to the top of the results more organically. But both Sophos and Malwarebytes researchers also regularly see malicious ads running against frequent searches like those for Google, Walmart, Disney+, Slack, Lowe’s, and Apple. Segura even says that Malwarebytes itself has to invest heavily in buying search engine ads just to keep malvertising at bay for the company's brand.

“We have to defend our brand so much,” he says. “People take advantage of that.”

Malicious Ads in Search Results Are Driving New Generations of Scams

Brands have been at the mercy of the algorithm when it comes to where their ads appear online, but they’re about to get more control.

Digital advertising is a whopping $700 billion (£530 billion) industry that remains largely unregulated, with few laws in place to protect brands and consumers. Companies and brands advertising products often don’t know which websites display their ads. I run Check My Ads, an ad tech watchdog, and we constantly deal with situations where advertisers and citizens have been the victims of lies, scams, and manipulations. We have removed ads from websites with serious disinformation about Covid-19, false election content, and even AI-generated obituaries.

Currently, if a brand wants to advertise a product, Google facilitates the ad placement based on desired ad reach and metrics. It may technically follow through on the agreement by delivering views and clicks, but does not provide transparent data about how and where the ad views came from. It is possible that the ad was shown on unsavory websites diametrically opposed to the brand’s values. For example, in 2024, Google was found to be profiting by placing product ads on websites that promoted hardcore pornography, disinformation, and even hate speech, against the brands’ wishes.

In 2025, however, this scandal will end, as we start to enact the first regulations targeting the digital advertising industry. Around the world, lawmakers in Brussels, Ottawa, Washington, and London are already in the early stages of developing regulation that will ensure brands have access to the legal support to ask questions, check ad data, and receive automatic refunds when they find that their digital campaigns have been subject to fraud or safety violations.

In Canada, for example, Parliament is deliberating the enactment of the Online Harms Act, a law to incentivize the removal of sexual content involving minors. The idea behind this law is that if the content is illegal, then making money off it should be illegal, too.

In California and New York, advocates are also proposing legislation that will aim to implement a know-your-customer law to track the global financial trade of advertising. This is significant because these two states power the global ad tech industry. New York has more ad tech companies than any other city in the world. Transparency laws enacted in California, on the other hand, would affect Google’s international advertising business—by far the biggest ad tech company in the world.

Beyond brand and consumer issues, the unregulated nature of the digital advertising landscape is a direct threat to democracy. In the US, for instance, presidential campaign spending remains effectively unregulated. It is estimated that the presidential campaigns will spend up to $2 billion (£1.5 billion) on digital advertising in 2024. With current laws, we will likely have no external data about their refunds or rates.

In 2025, the legislative pressure is on for big tech companies to regulate ad technology.

The Pressure Is on for Big Tech to Regulate the Broken Digital Advertising Industry

Following decades of failed attempts and dashed dreams, the US Army is once again trying out powered exoskeletons to help soldiers haul munitions and equipment in the field.

After decades of research and development, the United States Army is taking yet another run at developing a powered exoskeleton to help soldiers carry heavy loads on the battlefield—but don’t expect a futuristic suit of combat armor straight out of _Starship Troopers_ or _Iron Man_ anytime soon.

Soldiers assigned to the Army’s 1-78 Field Artillery Battalion training unit at Fort Sill, Oklahoma, recently completed a three-day “proof of concept” evaluation of several off-the-shelf “exoskeleton suits” in late September and early October, officials confirmed to WIRED. The evaluation was overseen by the service’s Combat Capabilities Development Command (DEVCOM), the organization responsible for developing new technology for soldiers.

Official photos from the evaluation published to social media showed Advanced Individual Training students hauling artillery shells to and from a M109 Paladin self-propelled howitzer and M777-towed howitzer with telltale black exoskeleton harnesses contrasted against their camouflage uniforms, part of a field exercise undertaken “to assess the potential of human augmentation, improve soldier performance, and determine if these exoskeletons meet the demands of our warfighters,” as the service put it.

While a DEVCOM spokesperson declined to identify which commercially produced systems were evaluated by soldiers, the Army announced its intent in August to award a contract to exoskeleton maker SUITX to “give users experience of advanced soldier augmentation technologies,” according to a government notice. “This exoskeleton will serve as a critical tool for evaluating the potential benefits of robotic assistance in increasing soldier endurance, strength, and overall operational effectiveness.”

Increased strength and endurance are an alluring duo for an American fighting force used to hauling close to 140 pounds into combat, and the prospect of a sophisticated combat suit that delivers both to soldiers even more so. But DEVCOM officials strongly emphasized that, despite this recent testing, the US military has yet to even determine how to actually apply a powered exoskeleton in a military context, let alone outfit soldiers in an “Iron Man suit” the likes of which the Army has bragged about in years past. Indeed, service officials tell WIRED that an official requirement document—a formal outline of a potential program’s technical and logical preconditions—for the adoption and fielding of exoskeletons does not currently exist, despite the fact that officials previously stated back in 2020 that Army Futures Command, DEVCOM’s superior organization, was closing in on one.

“As of today, the Army has not determined what the primary purpose of a ‘military exoskeleton’ is,” says David Accetta, a DEVCOM spokesperson.

That the Army is taking another crack at a powered exoskeleton should come as no surprise. The US military has been pursuing such technology for potential tactical applications for decades, since around the same time that science fiction author Robert Heinlein introduced the world to his vision of a “mobile infantry” flitting across future battlefields clad in advanced robotic armor in his beloved 1959 military science fiction classic _Starship Troopers_. Where Heinlein imagined future soldiers operating a mechanized battlesuit reminiscent of “a big steel gorilla, armed with gorilla-sized weapons,” the ostensible advantage of powered armor wasn’t just its added strength and durability, but the fact that “you don’t have to control the suit; you just wear it, like your clothes, like skin.” No fancy control interface, no complicated training: Soldiers would ostensibly step into a notional apparatus and be ready to “fight tonight,” as US military planners are fond of saying.

With an eye to future conflicts on an atomic battlefield, the Cold War-era US Defense Department clearly drew at least some inspiration from _Starship Troopers._ One year after Heinlein’s novel published, the Army went on the hunt for a “power-operated mechanical suit or skeleton that would transform the ordinary GI into a Superman,” according to a 1960 issue of the service’s _Army Research & Development_ magazine, with future “servo-soldiers” hauling munitions and other heavy equipment “beyond the strength of a dozen men.” The servo-soldier “will wear a special suit which will have its own engine, enabling him to run faster, stop quicker, and lift bigger loads than ordinary mortals,” as _Armor_ magazine put it in 1961 when the Pentagon officially solicited the defense industry for potential exoskeleton solutions. “What is more, he will be immune to germ warfare, poison gas, and the heat and radiation from nuclear blasts.”

In the following decades, the Pentagon took several stabs at making the servo-soldier a reality. In the 1960s, Cornell University engineer Neil Mizen’s “Man Amplifier,” funded by an Office of Naval Research grant, offered service members a patchwork of robotic components intended “to help sailors manhandle torpedoes, bombs, and machinery in the cramped quarters aboard ships and submarines,” as _Popular Science_ described it in a November 1965 issue. In the later part of the decade, General Electric debuted its “Hardiman” exoskeleton, developed under a dual Army-Navy effort, a colossal, bulky apparatus that more closely resembled the P-5000 Powered Work Loader from the 1986 movie _Aliens_ than a sleek battlesuit like Iron Man’s armor. In the 1980s, Los Alamos National Laboratory Advanced Weapons Technology Group engineer Jeffery Moore offered the Pentagon its most futuristic vision of a powered exoskeleton yet with his proposed “Pitman” combat suit, a vision of robot armor so advanced it remained a mere concept without ever producing a prototype. Every decade, the Pentagon appears to stand up and quickly wind down an exoskeleton project without ever producing a feasible prototype.

While the Defense Advanced Research Projects Agency (Darpa) oversaw incremental advances in US military exoskeleton research in the early 2000s, the most recent concerted attempt at a suit of powered armor came in the last decade in the form of US Special Operations Command’s Tactical Assault Light Operator Suit (TALOS). Inspired by the death of a Navy SEAL during a hostage rescue effort in Afghanistan, TALOS sought to cloak elite US special operations forces in additional layers of ballistic armor, sensors, and an exoskeleton to boost their survivability and situational awareness to near-superhuman levels. But while the TALOS program did yield several novel technologies (a lower body exoskeleton among them), the effort was canceled in 2019 after just five years of research and development, felled by “complex subsystem interdependencies” between its various elements that failed to coalesce into a unified and intuitive suit that operators could “just wear,” as Heinlein envisioned decades earlier. (SOCOM would pivot to its “hyper enabled operator” concept, which focuses on “cognitive overmatch” rather than physical augmentation to give American commandos an edge on the battlefield.)

Wary of the technological complexity required to develop mechanized armor for infantry troops, the Pentagon has spent the better part of the last two decades, with the exception of SOCOM’s TALOS effort, scaling back its exoskeleton ambitions to better match the original duties of the servo-soldier: hauling munitions and other heavy equipment. The Army’s Robotics and Autonomous Systems strategy released in March 2017, for example, stated that the service would pursue exoskeleton research primarily “to lighten the soldier load in the future” as a near-term priority as the Pentagon began its pivot from counter-insurgency operations in the Middle East to “great power competition” with technologically-advanced “near-peer” adversaries like Russia and China. The following October, in a letter to senior officials laying out the Army’s core modernization priorities for the coming decades, General Mark Milley, then the Army chief of staff and later chairman of the Joint Chiefs of Staff, declared that the service would eventually field “load-bearing exoskeletons” as part of a renewed emphasis on “soldier lethality” (the next year, Milley directed DEVCOM to undertake “a detailed engineering analysis of existing and emerging exoskeleton products” for their potential military applications).

This newfound push appears to have yielded several fresh experiments with exoskeleton technology in recent years. In 2018, Lockheed Martin was awarded a $6.9 million contract to “enhance” its ONYX exosuit for future Army demonstrations (Accetta, the DEVCOM spokesman, tells WIRED that initiative was ended due to a “number of technical issues” and lack of funding). Similarly, the service has been testing the Dephy ExoBoot for at least the last several years. In August 2022, the Army unveiled an (unpowered) exoskeleton dubbed the Soldier Assistive Bionic Exosuit for Resupply (SABER) to reduce lower back pain and physical stress among service members in the field; according to a 2023 study, 90 percent of soldiers who used the exosuit during field artillery training exercises reported an increased ability to perform their assigned tasks. And the Army isn’t the only branch exploring exoskeletons: Later in 2022, the Air Force announced that the service was testing its own pneumatically powered exosuit developed by ROAM Robotics to help aerial porters load up cargo aircraft like the C-17 Globemaster III.

The Fort Sill exoskeleton trial isn’t just the latest installment in a seven-decade push to meld man and machine; it’s also representative of the service’s cautious, restrained approach to the technology. Although US military planners may have long aspired to build an army of those so-called servo soldiers to dominate the future battlefield, current exoskeleton research efforts appear laser focused on more modest and potentially attainable applications like logistics and resupply rather than combat engagements. Slowly but surely, the Pentagon is carefully examining whether a robotic assist will help service members carry more for longer downrange.

But the Pentagon doesn’t appear to have totally given up on its dream of a powered exoskeleton as the basis for an armored battlesuit just yet. The 2017 Army RAS strategy, despite its emphasis on lightening soldier loads, also posited the long-term goal of building a “warrior suit” with “integrated displays that aggregates a common operating picture, provides intelligence updates, and integrates indirect and direct fire weapons systems”—capabilities not unlike those imagined with a notional _Starship Troopers_ mobile infantry or Iron Man suit-clad operator and explored with the TALOS initiative. As of a few years ago, at least one Army official was still talking about such a suit as a long-term effort that could potentially become a reality sometime in the 2040s.

Today, however, that idea appears to be in hibernation, if not fully dead. When asked about the “warrior suit” effort, DEVCOM officials threw cold water on the entire concept as “the professional vision of one person” and “not to be considered (even at the time) as an official Army position,” despite its explicit mention in the 2017 RAS document.

“The ‘warrior suit’ never existed as such, it was never considered a ‘warrior suit’—at least not by the Army—but a proof of concept, meaning, ‘Would something like this help manage load while on the move?’’ Accetta says. “The number of technical, integration, design, power, ergonomic, and so on concerns were not trivial.”

“The project is not abandoned, it’s simply inactive,” he adds. “And if it ever were to become active, we doubt highly it would be called a ‘warrior suit.’”

The US Army's Vision of Soldiers in Exoskeletons Lives On

Newly published research finds that the flashing lights on police cruisers and ambulances can cause “digital epileptic seizures” in image-based automated driving systems, potentially risking wrecks.

Carmakers say their increasingly sophisticated automated driving systems make driving safer and less stressful by leaving some of the hard work of knowing when a crash is about to happen—and avoiding it—to the machines. But new research suggests some of these systems might do the virtual opposite at the worst possible moment.

A new paper from researchers at Ben-Gurion University of the Negev and the Japanese technology firm Fujitsu Limited demonstrates that when some camera-based automated driving systems are exposed to the flashing lights of emergency vehicles, they can no longer confidently identify objects on the road. The researchers call the phenomenon a “digital epileptic seizure”—_epilepticar_ for short—where the systems, trained by artificial intelligence to distinguish between images of different road objects, fluctuate in effectiveness in time with the emergency lights’ flashes. The effect is especially apparent in darkness, the researchers say.

Emergency lights, in other words, could make automated driving systems less sure that the car-shaped thing in front of them is actually a car. The researchers write that the flaw “poses a significant risk” because it could potentially cause vehicles with automated driving systems enabled to “crash near emergency vehicles" and “be exploited by adversaries to cause such accidents.”

While the findings are alarming, this new research comes with several caveats. For one thing, the researchers were unable to test their theories on any specific driving systems, such as Tesla’s famous Autopilot. Instead, they ran their tests using five off-the-shelf automated driving systems embedded in dashcams purchased off of Amazon. (These products are marketed as including some collision detection features, but for this research, they functioned as cameras.) They then ran the images captured on those systems through four open source object detectors, which are trained using images to distinguish between different objects. The researchers aren’t sure whether any automakers use the object detectors tested in their paper. It could be that most systems are already hardened against flashing light vulnerabilities.

The research was inspired by reports that Teslas using the electric carmaker’s advanced driver assistance feature, Autopilot, collided with some 16 stationary emergency vehicles between 2018 and 2021, says Ben Nassi, a cybersecurity and machine learning researcher at Ben-Gurion University who worked on the paper. “It was pretty clear to us from the beginning that the crashes might be related to the lighting of the emergency flashers,” says Nassi. “Ambulances and police cars and fire trucks are different shapes and sizes, so it’s not the type of vehicle that causes this behavior.”

A three-year investigation by the US National Highway Traffic Safety Administration into the Tesla-emergency vehicle collisions eventually led to a sweeping recall of Tesla Autopilot software, which is designed to perform some driving tasks—like steering, accelerating, braking, and changing lanes on certain kinds of roads—without a driver’s help. The agency concluded that the system inadequately ensured drivers paid attention and were in control of their vehicles while the system was engaged. (Other automakers’ advanced driving assistance packages, including General Motors’ Super Cruise and Ford’s BlueCruise, also perform some driving tasks but mandate that drivers pay attention behind the wheel. Unlike Autopilot, these systems work only in areas that have been mapped.)

In a written statement sent in response to WIRED’s questions, Lucia Sanchez, a spokesperson for NHTSA, acknowledged that emergency flashing lights may play a role. “We are aware of some advanced driver assistance systems that have not responded appropriately when emergency flashing lights were present in the scene of the driving path under certain circumstances,” Sanchez wrote.

Tesla, which disbanded its public relations team in 2021, did not respond to WIRED’s request for comment. The camera systems the researchers used in their tests were manufactured by HP, Pelsee, Azdome, Imagebon, and Rexing; none of those companies responded to WIRED’s requests for comment.

Although the NHTSA acknowledges issues in “some advanced driver assistance systems,” the researchers are clear: They’re not sure what this observed emergency light effect has to do with Tesla’s Autopilot troubles. “I do not claim that I know why Teslas crash into emergency vehicles,” says Nassi. “I do not know even if this is still a vulnerability.”

The researchers’ experiments were also concerned solely with image-based object detection. Many automakers use other sensors, including radar and lidar, to help detect obstacles in the road. A smaller crop of tech developers—Tesla among them—argue that image-based systems augmented with sophisticated artificial intelligence training can enable not only driver assistance systems, but also completely autonomous vehicles. Last month, Tesla CEO Elon Musk said the automaker's vision-based system would enable self-driving cars next year.

Indeed, how a system might react to flashing lights depends on how individual automakers design their automated driving systems. Some may choose to “tune” their technology to react to things it’s not entirely certain are actually obstacles. In the extreme, that choice could lead to “false positives,” where a car might hard brake, for example, in response to a toddler-shaped cardboard box. Others may tune their tech to react only when it’s very confident that what it’s seeing is an obstacle. On the other side of the extreme, that choice could lead to the car failing to brake to avoid a collision with another vehicle because it misses that it is another vehicle entirely.

The BGU and Fujitsu researchers did come with a software fix to the emergency flasher issue. Called “Caracetamol”—a portmanteau of “car” and the painkiller “Paracetamol”—it’s designed to avoid the “seizure” issue by being specifically trained to identify vehicles with emergency flashing lights. The researchers say it improves object detectors’ accuracy.

Earlence Fernandes, an assistant professor of computer science and engineering at University of California, San Diego, who was not involved in the research, said it appeared “sound.” “Just like a human can get temporarily blinded by emergency flashers, a camera operating inside an advanced driver assistance system can get blinded temporarily,” he says.

For researcher Bryan Reimer, who studies vehicle automation and safety at the MIT AgeLab, the paper points to larger questions about the limitations of AI-based driving systems. Automakers need “repeatable, robust validation” to uncover blind spots like susceptibility to emergency lights, he says. He worries some automakers are “moving technology faster than they can test it.”

Source

Wired