Three technologists in India used a homemade Faraday cage and a microwave oven to get around Apple’s location blocks.

When Apple released a software update at the start of November that enabled its new hearing aid features in AirPods Pro 2 earbuds, Rithwik Jayasimha immediately went out with his dad to buy a pair for his grandma. “We came back home, we took them out of the case, and I was looking for the feature and it was just missing,” Jayasimha says. India, where Jayasimha and his family live, is not one of the many countries where Apple’s hearing aid features are available. “It was a huge bummer,” Jayasimha says.

Instead of abandoning the headphones, Jayasimha and two friends, Arnav Bansal and Rithvik Vibhu—both of whom say they have grandmas who use hearing aids as well—hacked a way to bypass Apple’s location restrictions and enable their hearing aids in Bangalore.

To dodge Apple’s geolocation restrictions, the trio built a rudimentary, signal-blocking Faraday cage on top of a microwave with aluminum foil, which ultimately allowed them to enable the hearing aid settings. “We don’t even think it’s Apple’s fault. The feature is amazing,” Jayasimha says.

One of the older hearing aids that was replaced with an Apple’s AirPods Pro 2.Photograph: Lagrange Point/Rithwik Jayasimha

The group members, who have a mix of hardware and software skills and first detailed their hack as part of a technology collective called Lagrange Point, say a couple of dozen people have contacted them asking for help with their AirPods. “We’ve got a huge amount of interest from folks in India who have these AirPods or whose grandparents need them and they’ve not been able to use them,” Jayasimha says. Others have documented the same issue in social media posts.

The researchers demonstrated that they could bypass Apple’s geographic restrictions with a set of AirPods Pro 2 connected to a 10th generation Wi-Fi-only iPad. They note that it would be possible to do the workaround on an iPhone or iPad connected to a mobile carrier as well, but it would be more involved.

To find the workaround, the researchers first looked at the different ways that iOS establishes where a device is in the world. For Wi-Fi-only devices, there are a few checks. The server looks at which Apple Store region the device is connected to, as well as the time zone, language, and region the device is set to. Additionally, the operating system sends a simple web request to an Apple web service that then responds with the country code of the country the device appears to be in based on the location associated with its IP address.

The researchers first tried manually changing the time zone and region settings for the iPad, but it ultimately wasn’t clear whether this impacted their ability to hide the iPad’s true location. When masking the iPad’s IP address so it would appear to be connected in the United States didn’t work, the researchers assessed other metrics the device might be using to establish its geographic location. It turns out that iOS also examines Wi-Fi “service set identifiers,” or SSIDs, that help devices connect to the right Wi-Fi network when there are many network signals in the air—like in an apartment building or at a coffee shop.

The operating system also uses GPS triangulation and device identifier “MAC addresses” of nearby devices, including routers, to establish a device’s location. In other words, even if a person in Bangalore uses a proxy to make it seem like their iPad has a US-based IP address, all the nearby routers and devices are associated with India-located IP addresses that give the real location away.

To deal with this, the researchers rigged up a Faraday cage, which blocks electromagnetic signals, to isolate the iPad from the other devices and wireless networks around it. They built their aluminum-foil-clad enclosure on top of a regular kitchen microwave and then turned on the microwave whenever they wanted to block signals to the iPad. The setup worked because consumer microwaves heat food using electromagnetic waves that are at the same frequency as Wi-Fi signals—2.4 GHz. Essentially, the researchers had turned their microwave oven into a Wi-Fi jammer.

The hackers first built a Faraday cage using a cardboard box and several sheets of aluminum foil, and placed it on top of a microwave to further block wireless signals.Photograph: Lagrange Point/Rithwik Jayasimha

“We put several layers of aluminum inside and outside \[a cardboard box\] and we’d see some signal strength drop,” Bansal says. “Of course, it’s not going to be great, but combined with the microwave, it worked.”

Ultimately, the researchers designed a less ingenious, but simpler and more reliable Faraday cage to make their manipulation more practical. With the iPad placed in its own shielded bubble, the researchers used an open source Wi-Fi location database and Wi-Fi SSID cycling tool to trick iOS into locating the iPad in California. With this complete, the AirPods could work as hearing aids in India.

Apple offers the hearing aid features in more than 100 countries, and it has great promise as a tool for making hearing aid tech more accessible—and more palatable—to millions of people around the world. But the company isn’t able to offer the feature everywhere and restricts access in certain countries, like India, likely because of regulatory hurdles related to medical devices. The fact that it’s possible to circumvent these restrictions may offer a solution, at least temporarily, for people in blocked countries who are looking for a workaround.

Apple did not return WIRED’s request for comment about the findings, but the researchers note that it seems like it would be possible for Apple to close the loophole they discovered fairly easily. They say they haven’t heard from the company.

Alan Woodward, a cybersecurity professor at the University of Surrey, says their work is “very interesting” and demonstrates how there may often be ways around “safeguards” put in place by Big Tech. “It shows that those with the technical understanding can bypass the geofencing of apps relatively simply,” Woodward says. “Not that everyone could do it, but they probably know someone that can.”

“I’m not sure how many people realize the number of variants in something like iOS even on what is apparently the same version—the build number is what really matters,” Woodward says. “It’s more a lesson to people that you have more than you realize on your phone.”

The second version of the Faraday cage, which the researchers plan to use to run more experiments.Photograph: Lagrange Point/Rithwik Jayasimha

Services offered by Big Tech companies such as Apple and Google often have had staggered launches around the world as lawmakers have introduced regulations to control technology companies’ power and protect people’s rights. In the EU, for instance, several AI products have been delayed or not launched due to strict privacy laws. Apple has also been required to allow alternative App Stores due to EU rules. At the same time, right-to-repair movements have grown in popularity, and people have increasingly been hacking into the products they buy.

While the three researchers in India believe that it is likely Apple’s hearing aid features will officially come to the country in the coming months, they plan in the meantime to help the dozens of people they say have reached out to them about their own headphones. They also plan on using the second version of the Faraday cage to set up people’s AirPods. From their own grandmas’ experiences, the hearing aid features appear to be valuable in their everyday lives.

Bansal says his grandma has some hearing loss and other health challenges, but has typically worn hearing aids while watching television. “She used to wear her old clunky hearing aids, and they were really problematic because they had these tiny little buttons on them,” Bansal says. “But now she uses the AirPods, we’ve set it up with her hearing profile, and she can use it to watch the TV just fine and it’s a lot nicer. She doesn’t feel like a patient wearing it.”

These Guys Hacked AirPods to Give Their Grandmas Hearing Aids

US Immigration and Customs Enforcement put out a fresh call for contracts for surveillance technologies before an anticipated surge in the number of people it monitors ahead of deportation hearings.

On November 6, just hours after news outlets declared that Donald Trump had been elected the next president of the United States, Immigration and Customs Enforcement posted a notice asking companies to submit plans for how they would expand ICE’s system of ankle monitors, GPS trackers, biometric check-in technology, and human agents monitoring “non-citizens” awaiting immigration court hearings or deportation.

The notice signals the mechanisms through which ICE will expand its intensive surveillance of people awaiting deportation hearings—a list that could grow from under 200,000 to more than 5 million.

Throughout Trump’s presidential campaign, he has promised to execute “the largest deportation operation in American history.” Beyond promising workplace raids and giant detention “camps,” Trump hasn’t released specific plans for how his mass deportations would work. However, it’s likely that many granular aspects of a mass monitoring, detention, and deportation program would be planned by private companies contracting with ICE.

ICE’s recent notice asks interested companies to send specific details about how they would store location data and personal information, where their office locations would be, how they would staff agents, and what technology they have for remote surveillance, among other details. Currently, ICE uses a combination of ankle monitors and GPS-enabled smartwatches and smartphone apps to remotely monitor people. It also uses apps with facial recognition for “biometric” check-ins.

The notice says companies must have facilities with “suitably large intake rooms” for people being enrolled in ICE surveillance. They also must have the “ability to perform mass-scale intakes as required by unforeseeable events.”

Contractors would be facilitating ICE’s Intensive Supervision Appearance Program, which is a way for ICE to monitor these undocumented or unnaturalized people without placing them in a detention facility. ISAP is meant especially for people who have been in the United States for some period of time and already have a house, apartment, or other residence. ISAP has flourished under President Biden, who has more than doubled the number of participants since December 2020, putting the current total at almost 200,000 people.

For ICE, according to the November notice, the program offers “considerable cost savings” compared to detention. So even if Trump follows through on his promise of mass detention, it’s likely that ISAP would be a significant aspect of any mass deportation program.

Compared to its recent November notice, ICE was more detailed about its 2025 plans in a different notice released last year. This earlier notice shows that ICE was preparing for a more intense immigration policy on the horizon regardless of who eventually won the election.

In the 2023 notice, ICE says that ISAP’s parent program, Alternatives to Detention, would be rebranded as Release and Reporting Management. This new program would involve monitoring every single non-detained person who’s awaiting a court hearing or deportation, as opposed to just some. At the time the notice was published, ICE said 5.7 million people were eligible to be monitored under the new program—meaning that if implemented, the scale of ICE’s remote surveillance would increase by approximately 3,000 percent.

According to a government contract database, B.I. Incorporated has been ICE’s ISAP contractor since at least 2005. The company is a subsidiary of GEO Group, which is one of the largest private prison companies in the US.

Though the stock market as a whole went up the day after Trump’s victory, GEO Group’s stock boost made it “the single biggest winner in the US stock market—among companies of any size,” according to Robinhood-owned investment news site Sherwood News. Its five-year contract to run ISAP, worth $2.2 billion, is scheduled to expire next year.

On a post-election earnings call for GEO Group, CEO Brian Evans said that the company could increase its ISAP capacity by “several hundreds of thousands of participants, and up to several million if necessary,” as reported by HuffPo. The company’s COO, Wayne Calabrese, added that they have already informed ICE that it’s ready to do this.

“We expect the incoming Trump administration to take a much more expansive approach to monitoring the several millions of individuals who are currently on the non-detained immigrant docket,” Calabrese said on the call.

According to HuffPo, GEO Group competitor CoreCivic (previously called Corrections Corporation of America) had its own post-election earnings call, during which CEO Damon Hininger said that the timing of the November 6 ICE notice was “probably not a coincidence.”

“We took that as a very encouraging sign,” Hininger said.

ICE Started Ramping Up Its Surveillance Arsenal Immediately After Donald Trump Won

Donald Trump has vowed to deport millions and jail his enemies. To carry out that agenda, his administration will exploit America’s digital surveillance machine. Here are some steps you can take to evade it.

The WIRED Guide to Protecting Yourself From Government Surveillance

Privacy advocates worry banning masks at protests will encourage harassment, while cops’ high-tech tools render the rules unnecessary.

“There are lots of different tools that are available to law enforcement. Facial recognition is one of those tools that it's about expediency,” said Nicole Napolitano, director of research at the Center for Policing Equity. But it’s not without its pitfalls. Like PimEyes, tools like Clearview AI can make mistakes and incorrectly identify people, leading to erroneous arrests. “Police have become increasingly reliant on and then biased by what the model tells them,” said Napolitano.

“There's no constitutional right to cover your face in public,” charged Meyers, the Manhattan Institute’s policing director.

Indeed, the legal landscape surrounding how law enforcement can use surveillance technologies has been hazy, explained Beth Haroules, a staff attorney for the New York branch of the American Civil Liberties Union, largely because the law hasn’t kept up with the pace with technological development.

For Haroules, the potential for omnipresent surveillance means people never really have a reasonable expectation of privacy—an important historic legal standard. “\[Surveillance\] cameras aren't just the eyes of a police officer,” she said. “They are being monitored, perhaps 24/7, in real time. They're feeding images into artificial intelligence, aided by algorithms that then kick out and match you to a number of faces and places that you've been.”

That legal haze, though, may finally be starting to clear.

This summer, a federal appeals court judge declared that geofence warrants were violations of the Constitution’s protections against unreasonable searches and seizures, though this decision only holds in Texas, Mississippi, and Louisiana. Similarly, a New York judge ruled warrantless phone searches at border crossings are unconstitutional. While the ruling only applies to a portion of New York, it does cover John F. Kennedy International Airport, one of the country’s busiest airports.

Phone manufacturers have also been making strides with regard to technological solutions to subvert surveillance methods. Google announced changes to how it stores users’ location data, making it unable to comply with future geofence warrants.

Even so, determining when police use surveillance technology can be difficult. Tushar Jois, a City College of New York professor studying the intersection of privacy, technology, and censorship, said that police departments “would routinely drop evidence in their cases rather than share data” about their surveillance technology use.

Beryl Lipton, a senior investigative researcher at the Electronic Frontier Foundation, a tech-focused civil liberties nonprofit, said that many of the things law enforcement officials used to only dream of are now increasingly possible.

“I think there's been a big shift in how we need to think about what it means to have an expectation of privacy in a public space,” Lipton said.

Half a century ago, Lipton explained, you'd potentially be able to see someone following you down the street, listening to your conversation. Now, that type of surveillance isn't so obvious.

“That's something we, as a country, really need to reevaluate,” she added. “We don't want to be in a position, either as protesters, or just as regular individuals, trying to live a life where we're essentially being followed and listened to all the time.”

The Real Problem With Banning Masks at Protests

The Pentagon is pursuing every available option to keep US troops safe from the rising tide of adversary drones, including a robotic twist on its standard-issue small arms.

Amid a rising tide of low-cost weaponized adversary drones menacing American troops abroad, the US military is pulling out all the stops to protect its forces from the ever-present threat of death from above. But between expensive munitions, futuristic but complicated directed energy weapons, and its own growing drone arsenal, the Pentagon is increasingly eyeing an elegantly simple solution to its growing drone problem: reinventing the gun.

At the Technology Readiness Experimentation (T-REX) event in August, the US Defense Department tested an artificial intelligence-enabled autonomous robotic gun system developed by fledgling defense contractor Allen Control Systems dubbed the “Bullfrog.”

Consisting of a 7.62-mm M240 machine gun mounted on a specially designed rotating turret outfitted with an electro-optical sensor, proprietary AI, and computer vision software, the Bullfrog was designed to deliver small arms fire on drone targets with far more precision than the average US service member can achieve with a standard-issue weapon like the M4 carbine or next-generation XM7 rifle. Indeed, footage of the Bullfrog in action published by ACS shows the truck-mounted system locking onto small drones and knocking them out of the sky with just a few shots.

The Bullfrog appears effective enough against drone targets to impress DOD officials: According to Defense Daily, Alex Lovett, the deputy assistant secretary of defense for prototyping and experimentation within the Pentagon’s Research and Engineering office, told reporters at a demonstration event in August that the testing of the “low-cost” Bullfrog solution had “gone really well.” Should the Pentagon adopt the system, it would represent the first publicly known lethal autonomous weapon in the US military’s arsenal, according to the Congressional Research Service. (The Office of the Secretary of Defense did not yet respond to WIRED’s request for comment.)

Shooting down small, fast-moving drones with conventional firearms is a significant challenge to even the most talented marksman, and the US military has been pursuing various ways to make its small arms more effective against unmanned airborne threats. Those efforts include the procurement of small- to medium-caliber munitions and “buckshot-like” ammo that can replicate the effects of the shotguns that have proven effective counter-drone measures amid Russia’s invasion of Ukraine; rifle-mounted radio frequency and GPS jammers to disorient incoming drones so troops don’t have to carry separate, bulky counter-drone weapons like the Dronebuster or NightFighter; and “smart” optics from companies like SmartShooter and ZeroMark that purportedly only allow a weapon to fire when it locks on target. The Army has even started integrating counter-drone exercises into its basic training regimen, part of a broader effort to make such schooling as “routine” as conventional marksmanship training.

For ACS cofounder and CEO Steve Simoni, a former Navy nuclear engineer, the best way to optimize a firearm for drone threats isn’t through novel accessories or enhanced training, but a combination of advanced robotics and a sophisticated AI that can take the guesswork out of target acquisition and tracking.

“During the Russian invasion of Ukraine, we \[Simoni and his ACS cofounder, fellow Navy veteran Luke Allen\] saw the proliferation of drones on both sides of the conflict, and we read in various news outlets the Ukrainians were firing AK-47s in the air at them,” Simoni tells WIRED. “We thought, ‘That’s a good robotics problem.’ It's hard to hit something flying so fast, but a robot can do that with modern-day computer vision and AI control algorithms.”

While smart optics like SmartShooter’s SMASH fire control system also use AI and computer vision to track potential targets, Simoni believes that physically keeping a rifle zeroed in on a fast-moving drone is a more significant challenge than even a highly trained human soldier with an advanced weapon-mounted scope is equipped to address. The solution, Simoni says, is to remove humans from the equation altogether and allow an extremely precise, custom-built motion control system to maintain a steady bead on an incoming drone amid the chaos of a battlefield.

“We are electrical engineers, and we decided that in order to solve this problem of hitting a fast drone that's accelerating at five Gs at a couple hundred yards, you would need an incredibly high-end current that goes through a motor and encoders that know the position of your gun at all times,” Simoni says. “To put that form factor in the hands of someone with an M4 seemed like a very tough problem.”

“A DJI Mini \[drone\] is a little bit bigger than my hand, and our system can down one at 200 yards with two shots,” he adds. “No human could make that shot.”

The 11th Armored Cavalry Regiment and the Threat Systems Management Office operate a swarm of 40 drones to test the rotational units' capabilities during the battle of Razish, National Training Center in 2019.

Photograph Courtesy of the U.S. Army / Pv2 James Newsome

Gun turrets are nothing new for the US military and its allies, from the manually operated Common Remotely Operated Weapon Station (CROWS) that adorns a growing number of American ground combat vehicles to the beloved semi-autonomous Phalanx Close-In Weapon System (CIWS) that’s essential to defending Navy warships from incoming missiles. More recently, the Army has experimented with several other gun-based counter-drone solutions—including a Ghost Robotics robot dog with its own AI-enabled AR/M4-pattern rifle turret.

At less than 400 pounds, the Bullfrog is smaller and simpler than the hulking 15-foot-tall, 12,000-plus-pound Phalanx CIWS and, in turn, better suited to provide flexible protection for individual platforms like, say, a Joint Light Tactical Vehicle on the move. And where the Phalanx CIWS sprays what essentially amounts to “a cloud of bullets,” Simoni claims the Bullfrog is precise enough to not only down airborne targets with minimal ammo expended, but deliver crossing shots at targets from the side, allowing the turret to accurately engage threats to units other than itself—and, with multiple systems, create a layered air defense network.

“Internally, we used to call the Bullfrog the ‘mini-CIWS,’” Simoni says. “But the CIWS control system isn’t as accurate.”

Then there’s the matter of the Bullfrog’s autonomy, a prickly subject for military planners. In accordance with the Pentagon’s current policy governing lethal autonomous weapons, the Bullfrog is designed to keep a human “in the loop” in order to avoid a potential “unauthorized engagement." In other words, the gun points at and follows targets, but does not fire until commanded to by a human operator. However, ACS officials claim that the system can operate totally autonomously should the US military require it to in the future, with sentry guns taking the entire kill chain out of the hands of service members and freeing them up to focus on other, more mission-essential tasks.

“Our system is fully autonomous-capable, we’re just waiting for the government to determine its needs,” Brice Cooper, ACS’s chief strategy officer and a Green Beret veteran who previously served as head of US Special Operations Command’s counter-drone program, tells WIRED. “Legacy systems in our category are just not there yet.”

A Phalanx Close-In Weapons System (CIWS) is tested aboard the amphibious assault ship USS Makin Island on Jan. 29, 2011.

Photograph Courtesy of the US Navy

The Bullfrog’s debut at T-REX couldn’t have come at a more fortuitous time. The Pentagon recently announced the second increment of its Replicator initiative that was launched last year to catalyze a surge in US military drone and counter-drone capabilities ahead of potential future conflicts with “great power” threats like China or Russia. Where the first Replicator increment focused on rapidly procuring and fielding low-cost, attritable drones for US forces around the world, the second will tackle “the threat posed by small uncrewed aerial systems (C-sUAS) to our most critical installations and force concentrations,” as Defense Secretary Lloyd Austin put it in a late September letter announcing the new stage of the initiative.

American military commanders in the Middle East have for years maintained that cheap, easily weaponizable commercial drones represent the greatest threat to their deployed forces since the advent of the improvised explosive device during the Global War on Terror, a concern driven home by attacks on Navy warships and commercial vessels in the Red Sea and US troop outposts in Iraq and Syria in the year following the outbreak of the current Israeli-Hamas conflict. In January, three US service members were killed in a drone attack on a military outpost in Jordan near the Syrian border, an incident that the Pentagon later determined had occurred because American forces there lacked the appropriate capabilities to defend against incoming drone threats.

“The threat landscape has become hyper-accelerated,” Cooper says. “A year ago, nobody was really concerned about the small drones that are destroying all kinds of armored vehicles in Ukraine. In reality, we're in the very nascent stages of what the unmanned threat landscape is going to look like, and it’s going to involve a serious investment from the Defense Department in perpetuity.”

It’s unclear at this time what specific types of counter-drone capabilities Replicator 2 might yield. At the moment, it appears that all options are on the table. They include remotely operated weapons turrets like the XM914 30-mm chain gun loaded up with explosive proximity rounds; missile systems like MSI’s Electronic Advanced Ground Launcher System (EAGLS) laser-guided rocket pod, L3Harris’s Vehicle-Agnostic Modular Palletized ISR Rocket Equipment (VAMPIRE) system, and Raytheon’s Coyote interceptor; “autonomous air vehicles” like the Air Force’s Paladin flying gun and the Roadrunner from defense upstart Anduril; vehicle-mounted sensor- and signal-jamming electronic warfare suites like the Marine Corps’ Light Marine Air-Defense Integrated System (L-MADIS) that’s been knocking drones out of the sky since 2019 and the Army’s Mobile Low, Slow Unmanned Aircraft Integrated Defense System (M-LIDS) that was most recently deployed to protect the service’s temporary pier in Gaza, both of which also feature “kinetic effectors” like machine guns and missiles; exotic directed energy weapons like high-energy lasers and high-powered microwaves to disrupt and disable drone electronics mid-flight; and a growing arsenal of infantry weapons from counter-drone rifles to the tried-and-true FIM-92 Stinger man-portable air-defense system. These weapons are all intended to turn every service member in American combat formations into a “drone defender.”

US Army soldiers with Task Force Spartan conduct Mobile Low, Slow, Small Unmanned Aerial Vehicle Integrated Defense System (M-LIDS) training at Camp Buehring, Kuwait, in 2022.

Photograph Courtesy of the US Army / Sgt. Gabriel Washington

One major factor driving the Pentagon’s counter-drone push, however, is cost. Many kill systems currently in use are still disproportionately expensive defense against comparatively cheap drones. And while directed-energy weapons like lasers and microwaves, at something like $10 a shot, offer a far more cost-effective solution than traditional munitions, they are also still relatively experimental (and incredibly complicated) technologies that, despite their ongoing testing and even active use in the Middle East, are not yet seen as reliable enough to field at scale.

“If something like \[the Bullfrog\] works where you can modify an existing system across the fleet, that's ideal,” Mike Clementi, a former congressional defense appropriator who previously worked on the US military’s counter-drone efforts, tells WIRED. “And if you can use it effectively for the cost of a handful of 7.62-mm rounds, you're getting ahead of the game.”

“The real question is: How do you eliminate massive amounts of cheap targets?” he adds. “If the Bullfrog pans out, it would be the cheapest solution out there.”

Simoni believes AI-powered autonomous gun systems like the Bullfrog can provide enough precision to deliver a cost-per-kill ratio similar to that associated with laser and microwave systems without the intensive maintenance and logistics upkeep. And while the Bullfrog isn’t the only counter-drone gun system on the Pentagon’s radar, Simoni believes that the algorithmic accuracy enabled by the turret’s unique machine-learning software and motion control system remains superior to that of other offerings.

“Tracking and shooting is only the tip of the iceberg: Eventually, the system will consist of different guns, reaching out to longer ranges, engaging drones that are moving in different acceleration patterns—that’s all based on updates to our AI model,” Simoni says. “We envision a convoy of vehicles outfitted with turrets employing coordinated fires that are effective even if they’re driving down a bumpy road. That’s what we’re building over the next 12 to 18 months.”

Regardless of Simoni’s ambitious vision and the Pentagon's recent push into the realm of autonomous weapons, questions still persist in defense circles about the potential dangers of taking a human operator out of the kill chain.

“Anything with robotics requires software to make the determination of friend or foe, and that's a concern with anything that's automated,” Clementi says. The use of fully automated systems would be “uncharted territory,” he says. “There's always been a person in the loop before.”

Should the Pentagon end up embracing an autonomous robotic gun system as its counter-drone defense of choice, the next big conflict involving American troops could end up looking like a joke from an episode of _The Simpsons_: “most of the actual fighting will be done by small robots.”

“The future battlespace is incredible autonomous robots like ours shooting each other,” Simoni said. “I don’t think there's much room for people with guns.”

The AI Machine Gun of the Future Is Already Here

Plus: Hot Topic confirms a customer data breach, Germany arrests a US citizen for allegedly passing military secrets to Chinese intelligence, and more.

Maybe you already heard, but Donald Trump will be president of the United States again. The far-right is celebrating by calling for mass executions. The left is responding with their own election conspiracy theories. Convicted January 6 rioters are banking on a pardon. And women who oppose Trump have frankly had enough.

Ahead of Election Day, WIRED found that an “election integrity” app made by True the Vote, a right-wing group that helped popularize election denialism around the 2020 election, was leaking the emails of its users. In one instance it revealed an election officer in California who appeared to be engaged in illegal voter suppression.

Disinformation and other forms of election interference have been a major issue since Russia’s hack of the Democratic National Committee in the lead-up to the 2016 election. But 2024 appears to have been the worst yet, with US officials warning that Russia had amplified its efforts to unprecedented levels.

In non-election news, Canadian authorities arrested Alexander “Connor” Moucka, who is accused of hacking a slew of Snowflake cloud storage customers earlier this year. Security experts who’ve long followed the exploits of a hacker who went by the handle Waifu—whom authorities say is Moucka—believe him to be “one of the most consequential threat actors of 2024.”

A federal judge in Michigan sentenced Richard Densmore to 30 years in prison after he pleaded guilty to sexually exploiting a child. Densmore was highly active in 764, an online criminal network that the FBI now considers to be a “tier one” terrorism threat.

Finally, in WIRED’s first story published in partnership with 404 Media, reporter (and 404 co-owner) Joseph Cox took a deep dive into the world of infostealer malware—the same kind used in all those Snowflake account breaches Moucka is accused of committing.

And that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

Some iPhones that police have in their possession for forensic examination are suddenly rebooting themselves, making it more difficult for investigators to access their contents, reports 404 Media. Police use tools like Cellebrite to essentially hack into phones, but this is typically done when a device is in the so-called After First Unlock (AFU) state. Once they reboot, iPhones are put into Before First Unlock (BFU), which makes them much harder to access with forensic tools.

According to a document obtained by 404, police believed the sudden reboots stemmed from the fact that the devices run iOS 18, Apple’s new mobile operating system. The police suspected that iOS 18 contains a secret feature that allowed the impacted devices, all of which were in airplane mode, to communicate with other nearby iPhones, which sent “a signal to devices to reboot after so much time had transpired since device activity or being off network,” the document reads.

They're half right. 404 reported Friday evening that multiple experts have discovered a new feature in iOS 18 called “inactivity reboot,” which appears to force iPhones to reboot on the fourth day after being locked—no secret signal-sending required. While the feature could help prevent robbers from using stolen iPhones, it's clearly giving the cops a headache, too.

Bad news, kids. The retail chain Hot Topic confirmed this week that it suffered a data breach that exposed the personal information of some 54 million customers. The stolen data includes email addresses for all 54 million people, 25 million “lightly encrypted” credit card numbers, the names, phone numbers, and birthdays of 20 million customers, and even the home addresses of 10 million people. While the hackers behind the breach claimed to have data on far more people than the dataset contains—350 million customers—the exposed data could still be used for identity theft and other malicious activities. Not cool!

Authorities in Germany this week arrested a US citizen for allegedly giving American military secrets to the Chinese government. Identified only as Martin D. due to German privacy laws, prosecutors say he recently “worked for the US armed forces in Germany” and “obtained the information in question during his work with the US armed forces,” according to NBC News. Prosecutors claim that Martin D. “contacted Chinese government agencies and offered to provide them with sensitive US military information for forwarding to a Chinese intelligence service.” Martin D.’s arrest comes just a month after German authorities arrested a woman on suspicion of passing information about arms deliveries to Chinese intelligence.

The FBI is investigating whether Chinese state-backed hackers breached the iPhones of senior staff members in either the Kamala Harris or Donald Trump presidential campaigns, Forbes reports. The CEO of security firm iVerify, Rocky Cole, tells Forbes that his company’s software identified strange changes to the settings on the iPhones of campaign staff “in patterns that are not observed on healthy devices.” (Cole declined to identify which campaign’s staff was impacted.) The FBI told Cole that the affected iPhones belonged to known targets of Chinese hacker group Salt Typhoon, which reportedly breached several US telecom networks including AT&T and Verizon.

Auto-Rebooting iPhones Are Causing Chaos for Cops

The 47-year-old Michigan man, who pleaded guilty to sexually exploiting a child, was highly active in the online criminal network called 764, which the FBI now considers a “tier one” terrorism threat.

Richard Densmore, a 47-year old Army veteran and member of the noxious criminal network known as 764, was sentenced to 30 years in federal prison on Thursday by a federal judge in Grand Rapids, Michigan.

Densmore was arrested on federal charges in late January at a home in Kaleva, Michigan, where he lived with his grandmother. He pleaded guilty in July to one count of sexually exploiting a child.

764 and its associated splinter groups have grown at a breakneck speed over the past four years. Since the network’s its creation by a Texas teenager, Bradley Cadenhead, in 2020, criminal cases connected it have cropped up in at least seven US states, as well as Brazil, Canada, the UK, and multiple European nations. Cadenhead is currently serving decades in Texas state prison for offenses related to child sexual abuse imagery.

Because of 764’s ties to extremist ideologies like neofascist accelerationism and the Order of Nine Angles, the US Department of Justice and the FBI categorizes 764 as a “tier one/category 1” terrorism threat that “directly threaten\[s\] the national or economic security of the United States.” According to a federal law enforcement official not authorized to speak on the record, the DOJ has seen 764-related cases in every field office in the US and currently assigns about 10 such cases for investigation every week.

In a press conference after Thursday’s sentencing, assistant attorney general Matt Olsen of the National Security Division for the first time directly addressed 764 as an extremist threat. “This group seeks to do unspeakable harm to children to advance their goals of destroying civilized society, fomenting civil unrest, and ultimately collapsing the US Government institutions,” Olsen said.

Known for its members engaging in child abuse and distributing child sexual abuse material (CSAM), 764 controls its victims through “extreme fear,” federal officials said, using compromising photographs, personal information, and the threat of public exposure to extort minors into sexual exploitation or self-harm.

“Many members \[of this network\] have an end goal of forcing their victims to commit suicide on livestream for the network’s entertainment or for the perpetrator’s own sense of fame within the 764 network,” Olsen said. “It is difficult to even comprehend such shocking and inhumane violence targeted at innocent and vulnerable children.”

In the government’s sentencing memorandum, federal prosecutors asked that Densmore receive the maximum 30-year penalty for his role in creating and leading “online chat rooms where children were encouraged to cut themselves, bleed for members, and publicly engage in depraved sexual acts.”

Images of Richard Densmore presented by US prosecutors as exhibits in their sentencing recommendations.

Courtesy of the US Department of Justice

Prior government filings show that Densmore ran a 764-adjacent server called “S3wer,” where he hosted other 764 members and provided a space to groom underage victims into sexually exploiting themselves and harming themselves for his benefit, often carving his alias into their bodies in a practice common to 764 and its offshoots known as “cut-signing.” According to prosecutors, some victims are driven to commit suicide on camera for the entertainment and status of their exploiters, though no precise number of suicides connected to 764 as been given.

Using excerpts of online conversations Densmore had both with his victims and other members of 764, mostly on Discord, federal prosecutors showed Densmore’s pride at his place of influence in 764.

In September 2022, Densmore intimidated a victim into self-abuse by demonstrating he had compromising information on them and that he ran not one but two CSAM and extortion servers. “I’m the owner of cultist \[another 764 Discord server\] and 764. I want you to cut for me.” The user responded that they did not cut, to which Densmore responded by threatening to expose confidential information about the minor: “Don’t make daddy angry. I’ll extort you. . . . I have all your information. I own you . . . You do what I say now kitten.”

In an October 2022 Discord conversations between Densmore and another participant in his child abuse servers included by the feds in the evidence against Densmore, he bragged about his exploitation methods.

“I gaslight and make them fucked up. Then they follow me,” Densmore said. “We got a girl to cut her ass off on cam. They kill their pets too. Most will do anything for power.” When a Discord user told Densmore that there was no reason to abuse people, Densmore wrote, “They beg for it.”

Much of the evidence against Densmore was sealed by court order to protect the identities of his victims and because of the shocking nature of the evidence presented against him.

“Densmore’s phones, seized during search warrants in this case, contain some of the most heinous images and videos the undersigned counsel has had the misfortune of seeing,” assistant US attorney Adam Townshend wrote in his sentencing memorandum.

The feds also drilled down on Densmore’s seeming delight in his online notoriety. “Being Discord famous isn’t all it’s cracked up to be,” he messaged another user, and in another instance lamented, “Why can’t these ppl just let me be famous.”

Prior to his indictment and arrest, Densmore was initially raided by the FBI in February 2023, when the FBI found CSAM on his devices. When they raided him earlier this year, the feds claim Densmore had two cell phones hidden in an air vent in his bedroom. He’d also faced charges of a sexual offense involving a minor in the 1990s, according to a government filing from January. At one point last year, Densmore posted a video to a 764 server depicting himself burning electronics in a metal barrel outside. “Bye-bye, evidence,” Densmore says on the recording.

764 Terror Network Member Richard Densmore Sentenced to 30 Years in Prison

Along with other foreign influence operations—including from Iran—Kremlin-backed campaigns to stoke division and fear have gone into overdrive.

As the 2024 US presidential election comes to a close, and with Donald Trump on the ballot once again, Russian actors are spreading disinformation with unprecedented and alarming intensity—and US officials say that the Kremlin’s efforts to undermine confidence in the election and foment unrest are likely to continue into January.

Russian disinformation operations have had a prominent presence in United States elections since the Kremlin’s sea-changing influence campaign during the 2016 presidential race between Hillary Clinton and Trump. But with so much scrutiny and investigation into that operation’s mechanics and impact—including the use of hack-and-leak tactics against the Democratic National Committee, Clinton campaign, and other targets—Russia was less technically aggressive and more focused on influence operations in the midterms and 2020 presidential election. That momentary respite is now over.

In calls with reporters on Monday night and Tuesday, as well as in public statements, US intelligence and law enforcement officials working on election security warned repeatedly that foreign influence actors including Iran, but “particularly Russia,” are ramping up their activity with an “increasing volume of inauthentic content online.” And while officials say they haven't detected cyberattacks beyond floods of junk traffic, or DDoS attacks, attempting to knock election-related sites offline, Russian activity has become increasingly menacing.

On Tuesday morning, for example, Georgia secretary of state Brad Raffensperger attributed multiple bomb threats against two Georgia polling places to Russia. The threats were deemed non-credible, but they briefly disrupted voting at the two poll sites. The FBI added later on Tuesday that poll sites in “several states” faced non-credible bomb threats that appeared to “originate from Russian email domains.”

“It is a greater scope and scale of foreign influence operations we have seen in 2024 than in prior cycles, and yes, Russia presents, in terms of our adversaries, the greatest degree of capability and sophistication,” Cait Conley, senior adviser to the director of the Cybersecurity and Infrastructure Security Agency (CISA), told reporters in a call on Tuesday afternoon. “Overall, I think the range of tactics we are seeing being employed, and the level of sophistication, is greater than prior cycles.”

In a joint statement on Monday evening, the Office of the Director of National Intelligence, CISA, and the FBI emphasized that “Russia is the most active threat” to the US election. “Influence actors linked to Russia in particular are manufacturing videos and creating fake articles to undermine the legitimacy of the election, instill fear in voters regarding the election process, and suggest Americans are using violence against each other due to political preferences,” they wrote.

The agencies cited some specific examples of content from Russian influence campaigns. One was a fake interview with someone purporting to be a former aide to Arizona secretary of state Adrian Fontes, claiming a vast election fraud campaign involving the manufacture of fake overseas ballots. Another involved alleged Russian influence actors amplifying an article that falsely claimed US officials in swing states were committing election fraud using a variety of tactics, including ballot stuffing and cyberattacks.

A video claiming to show evidence of fraud in Georgia was also linked to “Russian influence actors” in late September. Last month, experts also credited Russia-aligned propaganda network Storm-1516 with amplifying baseless claims that Minnesota governor and vice presidential candidate Tim Walz previously assaulted one of his former students.

In a press release on Tuesday morning, the FBI also warned about two videos circulating online featuring fake press releases purporting to be from the bureau. Officials did not attribute the videos to a specific actor but said that both are “promoting false narratives surrounding the election.” One claims to be a terrorist warning from the FBI urging Americans to “vote remotely” due to “a high terror threat at polling stations.” The second video also contains a fabricated FBI press release and claims that the management of five prisons in Pennsylvania, Georgia, and Arizona “rigged inmate voting and colluded with a political party.”

US government officials have called out Russian influence operations and other foreign malign activity surrounding elections before, but never with the speed and consistency of this election cycle. The FBI has been putting out multiple alerts a week in recent weeks, and CISA alone is holding four briefings with the press on Tuesday along with an Election Threat Updates landing page to centralize information.

“It’s reassuring to see the attribution process move so quickly,” says John Hultquist, who leads threat intelligence at Google-owned cybersecurity firm Mandiant. “More than anything, the speed suggests a strong familiarity with threat actors who may be struggling to carry out a serious surprise and hide their hand in these operations. It’s important to expose these operations while taking care not to give them a boost. The biggest struggle for these actors is almost always their ability to generate attention.”

As CISA’s Conley told reporters, US foreign adversaries are focused on “undermining American confidence in American democracy and pitting Americans against one another … With all of the noise and disinformation out there, what Americans need to realize is that your state and local election official is the signal through that noise. That is your source for authoritative information on election security—on election administration. So if there are questions, that is who the American people should be turning to for the authoritative answers.”

_You can follow all of WIRED's 2024 presidential election coverage here._

Russia Is Going All Out on Election Day Interference

Alexander “Connor” Moucka was arrested this week by Canadian authorities for allegedly carrying out a series of hacks that targeted Snowflake’s cloud customers. His next stop may be a US jail.

For much of this summer, a mysterious group of hackers carried out a landmark spree of major data breaches, all targeting customers of the cloud data storage company Snowflake. Now one alleged hacker—whom experts believe to be the ringleader of that group—has been arrested in Canada, and he may be on his way to a US court.

On Monday, Bloomberg and 404 Media reported that a Canadian man named Alexander Moucka, who also goes by the name Connor Moucka, was detained at the end of October on a provisional arrest warrant. Moucka then appeared in a court hearing today, November 5, as part of extradition proceedings, 404 Media first reported.

Under the hacker handles Waifu and Judische, Moucka is believed to be a notorious figure in the cybercriminal underground, says Allison Nixon, a security researcher and the chief research officer at security firm Unit 221B, who has long tracked his online activity. She alludes to Moucka’s alleged hacking activity going back years prior to the Snowflake breaches. “I was waiting for this one,” says Nixon. “Waifu was the leader of a group who was responsible for many major intrusions over the last half decade.”

Suspicious activity linked to Snowflake customer accounts was first spotted in April, according to a June report by Google-owned security company Mandiant, which was employed by Snowflake to jointly investigate the hacking. The first unknown victim’s Snowflake systems had been accessed using login details that were previously taken by infostealer malware, the report says. Over the next couple of chaotic months more than 165 Snowflake customers, according to Mandiant’s report, potentially had data they stored in Snowflake’s systems exposed or stolen. Hundreds of millions of records from AT&T, Santander, Ticketmaster owner Live Nation Entertainment, and more were accessed in the hacking spree.

Mandiant’s report in June said that the majority of the compromised Snowflake accounts did not have multifactor authentication turned on, and credentials gathered from infostealer logs—some dating back to 2020—were used to access them. Since the breaches, Snowflake has updated its systems to require multifactor authentication to be turned on by default.

A spokesperson for Snowflake tells WIRED it has no comment on the arrest. Ian McLeod, a spokesperson for Canada’s Department of Justice, says Moucka was arrested following a request by the United States. “As extradition requests are considered confidential state-to-state communications, we cannot comment further on this case,” McLeod says.

The cybersecurity firm Mandiant, a subsidiary of Google that has investigated the Snowflake breaches, referred to the hacker behind them as UNC5537, and the company's threat intelligence analyst Austin Larsen describes him in a statement to WIRED as “one of the most consequential threat actors of 2024.”

“The operation, which left organizations reeling from significant data loss and extortion attempts, highlighted the alarming scale of harm a single individual can cause using off-the-shelf tools,” Larsen adds.

While the hacker behind the Waifu and Judische handles has been linked to a Canadian identity for several months, they are believed to not be the only person linked to the Snowflake incidents. As WIRED reported in July, American hacker John Binns was allegedly involved in the Snowflake-related AT&T breach, which saw the company pay out more than $300,000 to have millions of stolen customer records deleted. (Binns was previously arrested in Turkey after the US indicted him for a 2021 breach of T-Mobile). Unit 221B’s Nixon says she’s aware of other members of the cybercriminal gang who remain at large.

According to Nixon, Waifu, now alleged to be Moucka, emerged from a cybercriminal community known as “the Com,” an underground network of young hackers and trolls active on platforms like Telegram and Discord and responsible for hacking and other digital crimes including ransomware, SIM swapping, cryptocurrency theft, sextortion, and harassment. The ransomware group known as Scattered Spider, which is responsible for highly disruptive extortion attacks against victims including MGM Entertainment and Caesars Entertainment, is among several criminal subgroups linked to the Com. “These are people who treat criminal statutes like a checklist,” says Nixon.

“I know that he’s been in the Com for a very long time, closer to a decade. He clearly spent his former teenage years being part of this culture,” Nixon says of Moucka, whom she says is now in his 20s. “When people grow up in the Com, this is how they turn out.”

As Nixon tracked Waifu and his associates over the past year, she says that he at one point made an operational security or “opsec” slipup that may have led law enforcement to his identity—though she declined to say what that mistake was or exactly when it occurred. Waifu subsequently tried to cover up this accidental reveal with false leads and misinformation posted to Telegram, what he described as “well poison.” But Nixon says law enforcement has nonetheless been aware of Moucka’s identity since at least early July. “If you make an opsec mistake, it’s done. You can’t bury it under a lot of bullshit you post later,” says Nixon. “All it’s accomplished is to show that he knew that what he was doing was wrong.”

While Moucka’s arrest is far from the end of the Com, Nixon says she sees it as a potentially important move in responding to the chaos that the larger criminal network has inflicted. Waifu, she says, was an example of a larger principle she’s observed in the cybercriminal world, that a small minority of criminals are often responsible for the majority of harms.

“This particular case is significant because they’ve picked up one of that tiny minority that causes disproportionate harm,” she says. “That’s why this is a good start. We need to arrest more of these disproportionately harmful actors.”

_Updated 3:55 pm EST, November 5, 2024: Added a statement from Mandiant._

Man Arrested for Snowflake Hacking Spree Faces US Extradition

A bug that WIRED discovered in True the Vote’s VoteAlert app revealed user information—and an election worker who wrote about carrying out an illegal voter-suppression scheme.

An app developed by the right-wing nonprofit True the Vote to crowdsource claims of voter fraud contained a security flaw that exposed the email addresses of all users who posted or commented on the platform, along with other information.

The vulnerability, which has since been patched, exposed a California election officer who used the app to post about her racist and illegal scheme to demand IDs from certain voters based on perceived citizenship status. California does not require voters to show identification in most cases. Election officials are now investigating the incident, WIRED has learned.

The app, VoteAlert, is the latest initiative from True the Vote, a Texas-based nonprofit founded by Catherine Engelbrecht, a once-fringe right-wing figure who helped to mainstream the modern election denial movement. Known for promoting election conspiracy theories without substantiating evidence, the organization has repeatedly touted technology to legitimize its claims of widespread voter fraud, even though it has refused to present proof when challenged.

WIRED discovered the data exposure while reviewing VoteAlert’s public-facing code. When loading new posts, VoteAlert inadvertently returned the email addresses of users who submitted reports or comments, making them visible to anyone who inspected the site’s source code.

True the Vote did not directly address specific questions about the data exposure, content posted to the app, or the likely election official using the tool to post about their illegal scheme to check citizenship status. Instead, a spokesperson attributed the leak to an issue with an infinite scroll feature introduced over the weekend, which they said “temporarily affected the configuration.” When WIRED pointed out that the exposure had been ongoing for several weeks, True the Vote did not respond further. The issue has since been resolved, and emails are no longer visible.

Prior to being patched, the flaw exposed at least 146 user email addresses of people who posted claims of voter fraud and commented on the site. WIRED’s analysis of the app’s content revealed 186 user-submitted reports of fraud and more than 200 more comments left on those reports, suggesting that the app has a relatively small user base. However, for these niche users, VoteAlert has become a hub for posting unverifiable and misleading claims about supposed election irregularities.

In one claim debunked by the New York Times, a user alleged that a Dominion voting machine displayed mismatched “public” and “private” vote counters—a feature Dominion says does not exist. Another post, now deleted, claimed a bake sale at a Delaware polling place was intended to sway votes, a potential violation of election law. ProPublica and Wisconsin Watch later reported that the photo included with the post was at least seven years old.

In a since-deleted VoteAlert post reviewed by WIRED, a user wrote: “I’m probably going to be fired for this but I was hired by the Riverside County Registrar of Voters as an Election Officer in Hemet, CA. Since I’m in charge at this polling center, I’m asking for citizenship ID of anyone that looks suspiciously like they’re not here legally.”

The post went on to suggest that the Riverside County Sheriff’s Office wouldn’t intervene in her scheme. “It’s just a drop in the bucket but I’m going to do my part to stop election fraud,” she wrote. “Wish me luck🙏”

WIRED traced the email associated with the post to a California woman who describes herself as a person who is “FED UP with all the bullsh\*t,” according to one app profile. “You’re only getting the hard, smack-your-face TRUTH from me.”

The woman, whose name WIRED is not publishing because it was revealed through a security flaw, did not respond to requests for comment.

In a phone call, Riverside County public information officer Elizabeth Florer confirmed that the county had hired an election worker matching WIRED’s findings, and committed to ensuring all election laws are followed, confirming that the county is investigating the incident. Florer added that additional personnel have now been deployed to the Hemet polling center to provide oversight and ensure strict compliance with election laws.

True the Vote is perhaps best known for its role in the widely debunked film _2,000 Mules_. The film relied heavily on the group’s research to allege that “ballot mules” were paid to fraudulently collect and deliver ballots for Democratic candidates in key swing states during the 2020 election. However, an investigation by the Associated Press found that the film was based on flawed and improper analysis of cell phone location data. After a defamation lawsuit, the film’s publishers, Salem Media Group, retracted the film, removing it from its platforms, and said there wouldn't be any future distribution of the book. They also issued an apology to a voter falsely portrayed as illegally voting in the film.

Undeterred, in 2022 True the Vote launched a web app called IV3, which it claimed led to the challenge of hundreds of thousands of voter registrations. A WIRED analysis found that the app’s methodology was unreliable and prone to error, with experts warning that IV3 weaponizes public data and is more likely to remove eligible voters from the rolls than to detect widespread fraud—a problem they note is virtually nonexistent in the US.

In records obtained by the nonprofit group American Oversight and shared with WIRED, in May 2024, an individual with the username “Totes Legit Votes” apparently used IV3 to challenge the eligibility of 5,000 people in Florida.

True the Vote has struggled to provide courts with meaningful evidence to substantiate its claims of widespread voter fraud.

In 2021, the group filed a complaint with Georgia’s secretary of state, alleging widespread illegal ballot stuffing in Atlanta during the 2020 election and subsequent runoff. However, when ordered by a judge to provide evidence, True the Vote admitted it had no names or documentation to support its claims.

The following year, court marshals arrested True the Vote founder Engelbrecht and board member Gregg Phillips after they defied a court order to produce evidence in a defamation case brought by the software company Konnech. The lawsuit accused True the Vote of falsely claiming that Konnech stored US election workers’ personal information on an unsecured server in China.

_You can follow all of WIRED's 2024 presidential election coverage here._

Source

Wired