Several of the strikes occurred far from the front lines of the conflict, indicating possible war crimes. Researchers say the attacks likely had devastating impacts on civilians.

Last week marked the second anniversary of Russia’s full-scale invasion of Ukraine, a conflict that has been marked by multiple reports that Russia may have committed war crimes by indiscriminately targeting civilians and civilian infrastructure. During the first winter of the conflict, Russia pursued a strategy that US secretary of state Antony Blinken described as trying to “freeze \[Ukraine\] into submission” by attacking its power infrastructure, shutting citizens off from heat and electricity.

Now, using satellite imagery and open source information, a new report from the Conflict Observatory, a US-government-backed initiative between Yale University’s Humanitarian Research Lab, the Smithsonian Cultural Rescue Initiative, PlanetScape AI, and the mapping software Esri, offers a clearer picture of the scale of this strategy. Between October 1, 2022, and April 30, 2023, researchers found more than 200 instances of damage to the country’s power infrastructure, amounting to more than $8 billion in estimated destruction. Of the 223 instances identified in the report, researchers were able to confirm 66 of them with high confidence, meaning they were able to cross-reference the damage across multiple trustworthy sources and data points.

Courtesy of Yale Humanitarian Research Lab

“What we see here is that there was a pattern of bombardment that hit front lines and non-frontline areas, at a scale that must have had civilian effect,” says Nathaniel Raymond, a coleader of the Humanitarian Research Lab and lecturer at Yale’s Jackson School of Global Affairs. The UN Office for the Coordination of Humanitarian Affairs estimated at the time that attacks on Ukraine’s power grid had left “millions” of people without electricity throughout the country.

Researchers found and were able to identify and verify damage to power infrastructure in 17 of the country’s 24 oblasts, or administrative units.

Documenting specific instances of damage to power infrastructure has been particularly difficult for researchers and investigators, because the Ukrainian government has sought to limit public information about which sites have been damaged and which continue to be operational in an effort to prevent further attacks. (For this reason, the report itself avoids getting too specific about which locations it analyzed and the extent of the destruction.) But this can also make it difficult to collect, verify, and build upon the data necessary to prove violations of international law.

By making its methodology public, Raymond hopes that it will make further investigation possible. “Having common standards to a common dataset is a prerequisite for accountability,” he says.

Courtesy of Yale Humanitarian Research Lab

International humanitarian law prohibits attacks on civilians or civilian infrastructure, like schools or hospitals. But Oona Hathaway, professor of international law at Yale University, says that power stations and infrastructure can present a trickier question, because it’s often difficult, if not impossible, to tell whether power is being distributed to the military or civilians (oftentimes it’s both). This can sometimes make targeting power infrastructure legitimate, says Hathaway, but combatants need to consider how something like a sustained power outage or an explosion at a power plant could impact civilians. Unleashing “dangerous forces” by, say, bombing or opening a dam could also be a war crime.

“That is a clear violation, even if part of its infrastructure might be supporting both civilian and military purposes,” says Hathaway.

Russia has not only sought to damage Ukraine’s power infrastructure through physical attacks. In October 2022, during the same time period covered by the report, hackers from Russia’s GRU military intelligence unit known as Sandworm plunged an unknown number of Ukrainian civilians into a blackout during a missile strike. It is the third time Sandworm has caused a blackout in Ukraine with a cyberattack since 2015.

Courtesy of Yale Humanitarian Research Lab

While some of the attacks documented by the Conflict Observatory did indeed occur near the front lines, Raymond says that researchers found strikes as far away from the battlefield as the country’s westernmost city, Lviv. Of the strikes that Raymond and his team identified, 128 occurred in places that were not part of the conflict’s front lines at the times when they were attacked.

The report “indicates the attacks were deliberate and disproportionately harmed civilian populations, which, if true, would violate international humanitarian law and the laws of armed conflict,” says US state department spokesperson Russell Brooks. “Many of the affected areas are remote from the front lines of the war, calling into question whether the attacks served any justifiable military objective.”

Some Russian officials have claimed that Ukrainian infrastructure is a legitimate target. In December 2022, Russia’s foreign minister, Sergey Lavrov, asserted that by attacking the country’s energy grid it was making it harder for Ukraine to access weapons provided by Western countries. In other instances, Russian officials indicated that its attacks on the country’s electricity supply were “strikes of retribution,” according to Russian politician Boris Chernyshov.

“The justifications that Russian officials provided varied from arguments that they were legitimate military objectives to statements that pointed more toward civilian harm and general retaliation not grounded in a concrete and direct military objective,” says Raymond. “It was important to capture this, because it can be indicative of intent, even though the statements alone are not in themselves indicative of an international legal violation.”

Courtesy of Yale Humanitarian Research Lab

Hathway notes that several of the statements seem to indicate that Russia was intentionally targeting civilians as a way to pressure the Ukrainian government into conceding the conflict. “I think a lot of the comments are indicative of this unlawful purpose that Russia and certain Russian leaders and military officials may have had in the carrying out of these attacks,” she says.

Hathaway adds that while the report’s findings are not themselves evidence of war crimes, they provide a strong foundation for bodies like the Independent International Commission of Inquiry on Ukraine, whose work is still ongoing. “I would say it is kind of a roadmap for prosecutors.”

Russia Attacked Ukraine's Power Grid at Least 66 Times to ‘Freeze It Into Submission’

As Chinese automakers prepare to launch in the US, the White House is investigating whether cars made in China could pose a national security threat.

The US government has launched an investigation into the national security risks posed by foreign-made vehicles with internet connectivity—especially those made in China. At a briefing on Wednesday, Secretary of Commerce Gina Raimondo even raised the specter of Beijing remotely triggering mayhem on US highways.

“Imagine if there were thousands or hundreds of thousands of Chinese connected vehicles on American roads that could be immediately and simultaneously disabled by somebody in Beijing,” Raimondo said.

The new US government fears about Chinese autos come as automakers such as BYD and Geely have become major global players in car manufacturing—and particularly electric vehicles. They also build on evidence that as cars have become increasingly computerized, and connected to the internet, vehicles have become vulnerable to new security threats. Hackers have shown it is possible to disable internet-connected vehicles from afar. Automated driving systems and internet connectivity have added cameras and other sensors to vehicles, and can also make them mobile repositories of personal information.

Raimondo said that the Bureau of Industry and Security, a division of the Commerce Department that handles national security issues related to advanced technology, would explore how sensor-laden, internet-connected vehicles could be used to commit espionage, collect data on US citizens, or commit sabotage on US roads.

The alarm sounded about Chinese autos adds to a recent history of US government concern about China’s technology ambitions under President Joe Biden and under President Trump before him. Trump imposed sanctions on Chinese telecoms equipment maker Huawei and other 5G companies working on 5G wireless technology and targeted Chinese AI firms with similar controls. The Biden administration has aggressively restricted the flow of advanced chips into China. Concerns over sensitive US data passing back to China has led to a TikTok ban for most federal government devices.

The move comes as US automakers miss targets for EV sales, and as Chinese automakers such as BYD tout record global sales and build new factories. Many Chinese manufacturers are producing cars, and particularly EVs, more efficiently and profitably than their US counterparts, with billions in assistance from the central government.

In January, BYD overtook Tesla as the world’s leading manufacturer of EVs, according to figures released by the two companies. Last year, China became the world’s biggest car exporter.

“China is determined to dominate the future of the auto market, including by using unfair practices,” reads a statement from Biden released by the White House. “China’s policies could flood our market with its vehicles, posing risks to our national security. I’m not going to let that happen on my watch.”

Rising Power

China’s automakers are expected to soon begin a direct assault on the US market. Recent news reports suggest that Chinese automakers including BYD, MG, and Chery plan to manufacture their lower-cost electric vehicles in Mexico, enabling them to take advantage of North American trade treaties and evade US tariffs of 27.5 percent on imported Chinese autos.

The Alliance for American Manufacturing, a trade group, earlier this month called China a “significant” threat to US car manufacturers. It urged US policymakers to “adopt a proactive and evolving strategy to stymie the CCP’s penetration.”

Speaking at the briefing Wednesday, Lael Brainard, national economic adviser to the White House, described US automakers being on a competitive playing field that appears to be rapidly tilting in favor of Chinese automakers. “For years China has employed an array of subsidies and protections to build massive capacity in EV production,” Brainard said. “Chinese automakers are now flooding foreign markets with their autos.”

The security risks posed by vehicles have grown as they’ve become more computerized, more sensor-filled, and more connected. Anne Neuberger, the Biden administration’s deputy national security adviser for cyber, recently told WIRED that the US is working with allies to develop standards for autonomous vehicles that would address the risks they pose. Neurberger said the administration is concerned about Chinese autonomous vehicles that have been approved for testing on US roads.

Administration officials say that the investigation would extend to Chinese-made components and other technologies. This could include the lidar systems that use lasers to map roads and spot obstacles, a market in which Chinese companies are major players.

Officials note that China has imposed restrictions on connected vehicles from US companies. Tesla cars are reportedly restricted from driving in military- and government-affiliated areas, including meeting halls and exhibition centers, for instance.

The move will risk ratcheting up tension between the US and China. If the action leads to trade restrictions, it could be met with counter restrictions from Beijing. “We'll have to wait to see what China's retaliation might be,” a senior administration official said.

The White House Warns Cars Made in China Could Unleash Chaos on US Highways

Every time someone in the UK searched for child abuse material on Pornhub, a chatbot appeared and told them how to get help.

For the past two years, millions of people searching for child abuse videos on Pornhub’s UK website have been interrupted. Each of the 4.4 million times someone has typed in words or phrases linked to abuse, a warning message has blocked the page, saying that kind of content is illegal. And in half the cases, a chatbot has also pointed people to where they can seek help.

The warning message and chatbot were deployed by Pornhub as part of a trial program, conducted with two UK-based child protection organizations, to find out whether people could be nudged away from looking for illegal material with small interventions. A new report analyzing the test, shared exclusively with WIRED, says the pop-ups led to a decrease in the number of searches for child sexual abuse material (CSAM) and saw scores of people seek support for their behavior.

“The actual raw numbers of searches, it’s actually quite scary high,” says Joel Scanlan, a senior lecturer at the University of Tasmania, who led the evaluation of the reThink Chatbot. During the multiyear trial, there were 4,400,960 warnings in response to CSAM-linked searches on Pornhub’s UK website—99 percent of all searches during the trial did not trigger a warning. “There’s a significant reduction over the length of the intervention in numbers of searches,” Scanlan says. “So the deterrence messages do work.”

Millions of images and videos of CSAM are found and removed from the web every year. They are shared on social media, traded in private chats, sold on the dark web, or in some cases uploaded to legal pornography websites. Tech companies and porn companies don’t allow illegal content on their platforms, although they remove it with different levels of effectiveness. Pornhub removed around 10 million videos in 2020 in an attempt to eradicate child abuse material and other problematic content from its website following a damning _New York Times_ report.

Pornhub, which is owned by parent company Aylo (formerly MindGeek), uses a list of 34,000 banned terms, across multiple languages and with millions of combinations, to block searches for child abuse material, a spokesperson for the company says. It is one way Pornhub tries to combat illegal material, the spokesperson says, and is part of the company’s efforts aimed at user safety, after years of allegations it has hosted child exploitation and nonconsensual videos. When people in the UK have searched for any of the terms on Pornhub’s list, the warning message and chatbot have appeared.

The chatbot was designed and created by the Internet Watch Foundation (IWF), a nonprofit which removes CSAM from the web, and the Lucy Faithfull Foundation, a charity which works to precent child sexual abuse. It appeared alongside the warning messages a total of 2.8 million times. The trial counted the number of sessions on Pornhub, which could mean people are counted multiple times, and it did not look to identify individuals. The report says there was a “meaningful decrease” in searches for CSAM on Pornhub and that at least “in part” the chatbot and warning messages appear to have played a role.

The chatbot was relatively simple: It asked people a series of questions, allowing them to click buttons to answer or type out a response. Ultimately, it explained that the material people were searching for may be illegal and pointed them toward the Lucy Faithfull Foundation’s help services. There were 1,656 requests for more information made through the chatbot, while 490 people clicked through to the charity’s Stop It Now website. Around 68 people called or chatted with Lucy Faithfull’s confidential helpline, the report says.

Donald Findlater, the director of the Stop It Now helpline, says that while the numbers are “relatively modest” compared to the overall number of warnings displayed, they are still seen as a “big success” as it’s a sign that people may want to get help. “If people have been doing something dodgy on a site, clicking through is quite a bold step to make,” Findlater says.

The vast majority of people who received the warning message and chatbot did so only once, the report says. Around 1.7 million people saw a warning before leaving Pornhub or making other searches related to legal material. “They didn't just disappear. They typically remained on the site and looked for other stuff,” Findlater says. “The influence for the millions of people that actually did a dubious search and then stopped doing that dubious search is a big win.” Not everyone was deterred, however. In the most persistent cases, around 400 people made 10 searches that triggered the message.

Cynthia Najdowski, an associate professor of psychology at the State University of New York at Albany, who was not involved in the research, says the chatbot appears to show promise for interrupting some people’s efforts to access CSAM. Warning messages and small behavioral nudges have been used in multiple ways to change people’s behavior online, from piracy and copyright infringement to gambling. Google has used some deterrence messages around child abuse searches since 2013, and other studies have found decreases in searches and millions of views or warnings.

Najdowski says there are three things known about deterring people from engaging in criminal behavior: People must know what they’re doing is illegal; they need to apply that “legal knowledge” to their own behavior; and they need to believe the cost of the behavior may outweigh any benefits they expect. “A chatbot that delivers notice of the potential illegality of certain searches can certainly accomplish the first step in the deterrence process, and that alone is a significant contribution,” Najdowski says. It may struggle to help cases where people are more persistent in their behavior or more complex scenarios though.

Scanlan, who conducted the analysis into the chatbot trial, says there were some complexities with the work. The data provided by Pornhub, the IWF, and the Lucy Faithfull Foundation wasn’t always complete, and there weren’t any figures from before the warnings were introduced to compare the results against. However, Scanlan says the results show the method could be one part of broader education and deterrence efforts against people finding CSAM online. “If someone's doing that sort out of curiosity, you want to nudge them away from it before they get involved in it, because we can't arrest our way out of the problem,” Scanlan says.

Scanlan’s findings say that over time, the web traffic being referred to the Stop It Now website appeared to decrease, perhaps as people who continued to search became used to the messaging. However, helpline calls, emails, and online chats showed an increase over the duration of the trial. The report says that in the future, a variety of messages could be used—potentially including existing deterrence videos—and the chatbot could directly connect people to a live chat session with Lucy Faithfull’s helpline.

The chatbot itself could also be improved. Since it was initially designed and created, says Dan Sexton, the chief technology officer at the IWF, generative AI has changed people’s perceptions of what chatbots are and how they interact with people. The reThink Chatbot could respond to only a limited number of queries. Sexton says there may be ways to make the chatbot more approachable and better handle questions it was not programmed to deal with.

While the trial period has ended, the chatbot and warnings are still in place on Pornhub’s UK website. “There's certainly no plans to turn it off. It is in production. It was a pilot project, but it is having an effect right now,” Sexton says. Those involved in the study say that other porn companies could look to introduce similar nudges across their services and deter people from looking for child abuse content. “They all should be doing this; it should become the norm,” Scanlan says. “This report and technology are significant steps forward in identifying, removing, and reporting harmful and illegal content,” a spokesperson for Pornhub says. “We feel all other major tech and social media platforms should explore the implementation of similar deterrence technology to create a safer internet for all.”

Findlater, from the Stop It Now helpline, says he hopes other companies, such as social media websites and file-hosting platforms, can look at the results of the trial and introduce similar nudges where people are seeking CSAM. “The more places you can put it, the greater chance you're going to catch those people that might be at a stage where they can still be helped, or those people that are looking for help but don't know about it,” Sexton says.

A Pornhub Chatbot Stopped Millions From Searching for Child Abuse Videos

The White House issued an executive order on Wednesday that aims to prevent the sale of Americans' data to “countries of concern,” including China and Russia. Its effectiveness may vary.

US president Joe Biden will sign an executive order on Wednesday aimed at preventing a handful of countries, including China, North Korea, and Russia, from purchasing sensitive information about Americans through commercial data brokers in the United States.

Administration officials say categories of sensitive data, including personal identifiers, precise location information, and biometrics—vital tools for waging cyberattacks, espionage, and blackmail operations against the US—are being amassed by what the White House is calling “countries of concern.”

Biden administration officials disclosed the order to reporters in advance during a Zoom call on Tuesday and briefly took questions, on the condition that they not be named or referred to by job title.

The order will have few immediate effects, they said. The US Justice Department will instead launch a rulemaking process aimed at mapping out a “data security program” envisioned by the White House. The process affords experts, industry stakeholders, and the public at large an opportunity to chime in prior to the government adopting the proposal.

White House officials said the US Attorney General would consult with the heads of the Department of State and Department of Commerce to finalize a list of countries falling under the eye of the program. A tentative list given to reporters during Tuesday’s call, however, included China, Cuba, Iran, North Korea, Russia, and Venezuela.

The categories of information covered by the program will include health and financial data, precise geolocation information, and “certain sensitive government-related data,” among others, the officials said. The order will contain several carve-outs for certain financial transactions and activities that are “incidental” to ordinary business operations.

It’s unclear to what degree such a program would be effective. Notably, it does not extend to a majority of countries where trafficking in Americans’ private data will ostensibly remain legal. What’s more, it’s unclear whether the government has the authority or wherewithal (outside of an act of Congress) to restrict countries that, while diplomatically and militarily allied with the US, are also known to conduct espionage against it: close US ally Israel, for instance, was accused in 2019 of planting cell-phone-spying devices near the White House, and has served as an international marketplace for illicit spyware; or Saudi Arabia, which availed itself of that market in 2018 to covertly surveil a _Washington Post_ contributor who was later abducted and murdered by a Saudi hit squad.

If China, Russia, or North Korea moves to obtain US data from a third party in one of the more than 170 countries not on the US government’s list, there may be little to prevent it. US data brokers need only take steps to ensure overseas customers follow “certain security requirements” during the transfer, many of which are already required by law.

The restrictions imposed by the executive order are meant to protect against “direct” and “indirect transfers of data,” officials said. But data brokers are on the hook merely until they obtain “some type of commitment" from overseas customers—an “understanding”—when it comes to the possibility of data being sold or transferred to others down the line.

Biden Executive Order Bans Sale of US Data to China, Russia. Good Luck

Canada-based Sandvine has long sold its web-monitoring tech to authoritarian regimes. This week, the US sanctioned the company, severely limiting its ability to do business with American firms.

When the Egyptian government shut down the internet in 2011 to give itself cover to crush a popular protest movement, it was Nora Younis who got the word out. Younis, then a journalist with daily newspaper _Al-Masry Al-Youm_, found a working internet connection at the InterContinental Cairo Semiramis Hotel that overlooked Tahrir Square, the heart of the protests. From the balcony, she filmed as protesters were shot and run down with armored vehicles, posting the footage to the newspaper’s website, where it was picked up by global media.

In 2016, with Egypt having slid back into the authoritarianism that prompted the uprising, Younis launched her own media platform, Al-Manassa, which combined citizen journalism with investigative reporting. The following year, Almanassa.com suddenly disappeared from the Egyptian internet, along with a handful of other independent publications. It was still available overseas, but domestic users couldn’t see it. Younis’ team moved their site to a new domain. That, too, was rapidly blocked, so they moved again and were blocked again. After three years and more than a dozen migrations to new domains and subdomains, they asked for help from the Swedish digital forensics nonprofit Qurium, which figured out how the blocks were being implemented—using a network management tool provided by a Canadian tech company called Sandvine.

Sandvine is well known in digital rights circles, but unlike leading villains of the spyware world such as NSO Group or Candiru, it’s often floated below the eyeline of lawmakers and regulators. The company, owned by the private equity group Francisco Partners, mainly sells above-board technology to internet service providers and telecom companies to help them run their networks. But it has often sold that technology to regimes that have abused it, using it to censor, shut down, and surveil activists, journalists, and political opponents.

On Monday, after years of lobbying from digital rights activists, the US Department of Commerce added Sandvine to its Entity List, effectively blacklisting it from doing business with American partners. The department said that the company’s technology was “used in mass-web monitoring and censorship” in Egypt, “contrary to the national security and foreign policy interests of the United States.” Digital rights activists say it’s a major victory because it shows that companies can’t avoid responsibility when they sell potentially dangerous products to clients who are likely to abuse them.

“Better late than never,” Tord Lundström, Qurium’s technical director, says. “Sandvine is a shameless example of how technology is not neutral when seeking profit at all costs.”

”We are aware of the action announced by the US Commerce Department, and we’re working closely with government officials to understand, address, and resolve their concerns,” says Sandvine spokesperson Susana Schwartz. “Sandvine solutions help provide a reliable and safe internet, and we take allegations of misuse very seriously.”

Sandvine’s flagship product is deep packet inspection, or DPI, a common tool used by ISPs and telecom companies to monitor traffic and prioritize certain types of content. DPI lets network administrators see what’s in a packet of data flowing on the network in real time, so it can intercept or divert it. It can be used, for example, to give priority to traffic from streaming services over static web pages or downloads, so that users don’t see glitches in their streams. It has been used in some countries to filter out child sexual abuse images.

Dictators Used Sandvine Tech to Censor the Internet. The US Finally Did Something About It

Two months ago, the FBI “disrupted” the BlackCat ransomware group. They're already back—and their latest attack is causing delays at pharmacies across the US.

Six days before Christmas, the US Department of Justice loudly announced a win in the ongoing fight against the scourge of ransomware: An FBI-led, international operation had targeted the notorious hacking group known as BlackCat or AlphV, releasing decryption keys to foil its ransom attempts against hundreds of victims and seizing the dark web sites it had used to threaten and extort them. “In disrupting the BlackCat ransomware group, the Justice Department has once again hacked the hackers,” deputy attorney general Lisa Monaco declared in a statement.

Two months and one week later, however, those hackers don't appear particularly “disrupted.” For the last seven days and counting, BlackCat has held hostage the medical firm Change Healthcare, crippling its software in hospitals and pharmacies across the United States, leading to delays in drug prescriptions for an untold number of patients.

The ongoing outage at Change Healthcare, first reported to be a BlackCat attack by Reuters, represents a particularly grim incident in the ransomware epidemic not just due to its severity, its length, and the potential toll on victims' health. Ransomware-tracking analysts say it also illustrates how even law enforcement's wins against ransomware groups appear to be increasingly short-lived, as the hackers that law enforcement target in carefully coordinated busts simply rebuild and restart their attacks with impunity.

“Because we can't arrest the core operators that are in Russia or in areas that are uncooperative with law enforcement, we can't stop them,” says Allan Liska, a ransomware-focused researcher for cybersecurity firm Recorded Future. Instead, Liska says, law enforcement often has had to settle for spending months or years arranging takedowns that target infrastructure or aid victims, but without laying hands on the attacks' perpetrators. “The threat actors just need to regroup, get drunk for a weekend, and then start right back up,” Liska says.

In another, more recent bust, the UK's National Crime Agency last week led a broad takedown effort against the notorious Lockbit ransomware group, hijacking its infrastructure, seizing many of its cryptocurrency wallets, taking down its dark web sites, and even obtaining information about its operators and partners. Yet less than a week later, Lockbit has already launched a fresh dark web site where it continues to extort its victims, showing countdown timers for each one that indicate the remaining days or hours before it dumps their stolen data online.

None of that means law enforcement's BlackCat or Lockbit operations haven't had some effect. BlackCat listed 28 victims on its dark web site for February so far, a significant drop from the 60-plus Recorded Future counted on its site in December prior to the FBI's takedown. (Change Healthcare isn't currently listed among BlackCat's current victims on its site, though the hackers reportedly took credit for the attack, according to ransomware-tracking site Breaches.net. Change Healthcare also didn't respond to WIRED's request for comment on the cyberattack.)

Lockbit, for its part, may be hiding the extent of its disruption behind the bluster of its new leak site, argues Brett Callow, a ransomware analyst at security firm Emsisoft. He says that the group is likely downplaying last week's bust in part to avoid losing the trust of its affiliate partners, the hackers who penetrate victim networks on Lockbit's behalf and might be spooked by the possibility that Lockbit has been compromised by law enforcement.

Nonetheless, Callow says, ransomware actors “do seem to be bouncing back faster.” That's only to be expected, he argues, when the hackers aren't in custody and the money to be made provides the resources and the incentive to simply get back to work, even after seizures or disruptions. In 2023, he notes, cryptocurrency tracing firm Chainalysis pegged total ransoms paid by victims at a record-breaking $1.1 billion. “It's inevitable that groups are going to try harder to maintain their share of that massively profitable industry,” Callow says.

When the FBI targeted BlackCat in December, for instance, the group immediately posted on a newly launched dark web site a message to its partners, promising a higher rate of payment and removing all restrictions on potential victims, other than those in the former Soviet Union, a typical rule for Russia-based cybercriminals. The message suggested its affiliate hackers could now target “hospitals, nuclear power plants, anything and anywhere.” (In fact, the rule change was at least in part a scare tactic, says Recorded Future's Liska—BlackCat had targeted hospitals before.)

Ransomware groups' quick recoveries from recent law enforcement operations contrast with earlier cases when actual arrests were made—almost always arrests of ransomware group members or partners outside of Russia. Those cases, like the arrest of a suspect in Florida who was allegedly associated with the Scattered Spider group that targeted MGM Casinos last year, had far more permanent effects.

Even some past takedowns that _didn't_ include arrests, however, have put longer-lasting dents in the ransomware economy. The FBI's hijacking of infrastructure belonging to the Hive ransomware group early last year led to a nearly year-long disappearance of the group before it resurfaced under the name Hunters International, says Jackie Burns Koven, Chainalysis's head of cyber threat intelligence. Chainalysis estimates the Hive operation averted more than $210 million in total ransoms paid.

Ransomware groups may be rebuilding faster over time in part due to the increasing sophistication of the ransomware economy, Burns Koven says. Hackers who have been targeted in disruption operations can now quickly purchase access to malware or other tools, crime-friendly hosting providers, or even buy their way into breached organizations from other hackers who act as “access brokers.” But Burns Koven also notes that law enforcement operations help to degrade that economy by creating divisions between hackers. In the wake of the Lockbit takedown, for instance, the cybercriminal marketplace Breached Forum banned the sale of ransomware tools and services in an apparent attempt to avoid law enforcement's scrutiny. “What these operations do is degrade trust among members and cause operational friction,” she says.

All of that suggests that law enforcement disruption campaigns serve a purpose. But they won't solve the ransomware problem on their own, argues Emsisoft's Callow. The larger solution, he says, will have to include improved security for potential victim organizations, sanctions on ransomware actors and those associated with them, tighter regulations on cryptocurrency, and perhaps even laws banning ransomware payments—a controversial proposal.

“Disruption efforts alone aren’t likely to represent a solution to the ransomware problem. Rather, they need to be part of a multi-pronged strategy,” says Callow. “Tightening the screws on every single bit of the ransomware ecosystem.”

Change Healthcare Ransomware Attack: BlackCat Hackers Quickly Returned After FBI Bust

Ankle tags that constantly log a person’s coordinates are part of a growing cadre of experimental surveillance tools that countries around the world are trying out on new arrivals.

Mark Nelson took the call in an immigration detention center—a place that, to him, felt just like prison. It had the same prison windows, the same tiny box rooms. By the time the phone rang, he’d already spent 10 days detained there, and he was wracked with worry that he would be forced onto a plane without the chance to say goodbye to his kids. So when his lawyers relayed the two options available under UK law—either stay in detention indefinitely or go home wearing a tracking device—it didn’t exactly feel like a choice. “That’s being coerced,” says Nelson, who moved from Jamaica to the UK more than 20 years ago. He felt desperate to get out of there and go home to his family—even if a GPS tag had to come too.

It was May 2022 when the contractors arrived at Colnbrook Detention Center, on the edge of London’s Heathrow Airport, to fit the device. Nelson knew the men were with the government’s Electronic Monitoring Service, but he didn’t know their names or the company they worked for. Still, he followed them to a small room, where they measured his leg and locked the device around his ankle. Since then, for almost two years, Nelson has been accompanied by the tag wherever he goes. Whether he is watching TV, taking his kids to school, or in the shower, his tag is continuously logging his coordinates and sending them back to the company that operates the tag on behalf of the British government.

Nelson lifts up his trousers to reveal the tag, wrapped around his leg, like a giant gray leech. He chokes down tears as he describes the impact the device has had on his life. “It’s depressing,” he says, being under constant surveillance. “Right through this process, it’s like I’m not a human anymore.”

In England and Wales, since 2019, people convicted of knife crime or other violent offenses have been ordered to wear GPS ankle tags upon their release from prison. But requiring anyone facing a deportation order to wear a GPS tag is a more recent and more controversial policy, introduced in 2021. Nelson wears a tag because his right to remain in the UK was revoked following his conviction for growing cannabis in 2017—a crime for which he served two years of a four-year sentence. But migrants arriving in small boats on the coast of southern England, with no previous convictions, were also tagged during an 18-month pilot program that ended in December 2023. Between 2022 and 2023, the number of people ordered to wear GPS trackers jumped by 56 percent to more than 4,000 people, according to research by the Public Law Project, a legal nonprofit.

“Foreign nationals who abuse our hospitality by committing crimes in the UK should be in no doubt of our determination to deport them,” a Home Office spokesperson tells WIRED. “Where removal isn’t immediately possible, electronic monitoring can be used to manage foreign national offenders and selected others released on immigration bail.” The Home Office, the UK’s interior ministry, declined to answer questions on “operational details,” such as whether GPS coordinates are being tracked in real time and for how long the Home Office stores individuals’ location data. “This highly intrusive form of surveillance is being used to solve a problem that does not exist,” says Jo Hynes, a senior researcher at the Public Law Project. GPS tags are designed to prevent people facing deportation orders from going on the run. But according to Hynes, only 1.3 percent of people on immigration bail absconded in the first six months of 2022.

Now, Nelson is the first person to challenge Britain’s GPS tagging regime in a high court, arguing that the tags are a disproportionate breach of privacy. A judgment on the case is expected any day now, and critics of GPS tagging hope the decision will have ripple effects throughout the British immigration system. “A judgment in Mark’s favor could take quite a lot of different forms,” says Jonah Mendelsohn, a legal officer at data rights group Privacy International. He adds that the court could force the Home Office to stop tagging migrants altogether, or it could limit the amount of data the tags collect. “It could set a precedent.”

The GPS tags are part of an intensifying surveillance regime that migrants and refugees are now subject to in the UK, the US, and Australia, says Mendelsohn. “There is so much tech that’s being rolled out and used almost in an experimental lab-esque way,” he says, pointing to how migrants arriving in Britain on small boats have been told to hand over their phones and pin codes or fitted with bar-coded wristbands. “GPS tracking is just one aspect of that.”

Allegations that the tags are prone to malfunction also aggravate the stress people feel while wearing them, Mendelsohn says. By law, the tags can’t be removed. But they still need charging, either by being plugged into a socket or a portable battery pack. Nelson’s first tag would run out of battery every two hours, he claims, meaning he could never travel far from a plug socket—failure to charge a tag can count as a breach of immigration bail conditions, risking return to a detention center.

The battery was just one in a series of problems, Nelson claims. Between November 2022 and May 2023, he believes his tag was no longer logging his GPS coordinates, with his legal team at Wilsons Solicitors arguing this proved the tag was redundant and should be removed. But until now, the Home Office has refused to take off the tag. “\[They said\] the law is the law and I’m subject to the law,” says Nelson. “So I’ve got to wear this broken tag whether it works or not.” The company that monitors and maintains the tags on behalf of the government since 2014, Capita Business Services, did not reply to WIRED’s request to comment.

Nelson might have been the first person to challenge the GPS tagging regime in court. But others were close behind. British law firm Duncan Lewis Solicitors is representing another four people forced to wear GPS tags, ranging from EU citizens to people who arrived in the UK on small boats. “Such surveillance of vulnerable individuals is not necessary in any democratic society, and we are proud to represent these claimants in their fight against this poorly run and dystopian regime,” says Conor Lamb, who works in the public law department at Duncan Lewis.

One of the people whom Duncan Lewis is representing is a 25-year-old former asylum seeker from Sudan who arrived in the UK via a small boat and has no criminal history, according to his lawyers. The tag brought up painful memories of being bound and tortured during his journey to the UK, they argued in court. After two psychiatric reports were submitted to the government, the tag was taken off and his data deleted. Despite that, the man, who uses the pseudonym ADL, remains part of the court case in order to challenge the practice of tagging new arrivals.

Meanwhile, Nelson is still waiting for his tag to be taken off. He’s frustrated that he has to wear the tag despite already having served his time in prison. “Before all of this, I was social,” he says. Now, he says, he’s too self-conscious to go out much, in case others see the tag and mistake him for the perpetrator of a violent crime. He describes how the tag has left him feeling “up and down,” as if he has no good choices left. “In order for me to see my family and to be part of my family, I’m still being forced into 24/7 monitoring, someone watching me and watching what I do, every day.”

The UK Is GPS-Tagging Thousands of Migrants

Meet the guy who taught US intelligence agencies how to make the most of the ad tech ecosystem, "the largest information-gathering enterprise ever conceived by man."

How the Pentagon Learned to Use Targeted Ads to Find Its Targets—and Vladimir Putin

Republicans who run elections are split over whether to keep working with the Cybersecurity and Infrastructure Security Agency to fight hackers, online falsehoods, and polling-place threats.

The meeting between top US election officials and their cybersecurity partners from the federal government almost went off without a hitch. Then Mac Warner spoke up.

Warner, West Virginia’s Republican secretary of state, didn’t have a mundane logistical question for the government representatives, who were speaking at the winter meeting of the National Association of Secretaries of State in Washington, DC, on February 8. Instead, Warner lambasted the officials for what he said was their agencies’ scheme to suppress the truth about US president Joe Biden’s son Hunter during the 2020 election and then cover their tracks.

“When we have our own federal agencies lying to the American people, that’s the most insidious thing that we can do in elections,” Warner told the officials from the FBI and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), who watched him impassively from the stage. “You all need to clean up your own houses.”

Neither of the officials responded to Warner, and the NASS meeting—a semiannual confab for the nation’s election administrators that deals with everything from mail-in voting to cyber threats—quickly moved on to other business. But Warner, who attended an election-denier rally after Biden’s 2020 victory and is now running for governor on a far-right platform, isn’t a fringe voice in the GOP. His impassioned speech reflected a growing right-wing backlash to the election security work of agencies like CISA and the FBI—one that now threatens the partnership that the federal government has been painstakingly building with state leaders over the eight years since Russia interfered in the 2016 election.

CISA plays a critical role in helping states run secure elections, but its work alerting social media companies to misinformation has earned it special contempt from conservatives. While most GOP secretaries of state are holding their fire about CISA’s efforts to combat online lies, Democrats and nonpartisan experts worry that that could change in the coming years. With national Republicans increasingly turning against CISA—investigating its activities and voting to slash its budget—the agency’s partnerships with GOP leaders in the states are more vulnerable than ever before.

“The hard and necessary work of securing our elections should not be a partisan issue,” says US representative Chris Deluzio, a Pennsylvania Democrat and former cyber policy scholar. “So I am very concerned that some Republican secretaries of state might undermine that work just to serve their selfish partisan interests.”

Stumbling Into Controversy

The federal program that earned Warner’s wrath began as a response to the rampant mis- and disinformation that has spread online since the 2016 election.

Determined to avoid another contest marred by viral false claims about voting processes, CISA in 2018 began coordinating conversations with social media companies and other federal agencies about the best ways to counter dangerous and destabilizing lies. During the 2020 election, through a process known as “switchboarding,” CISA alerted social media firms to complaints from state and local election officials about online misinformation, such as posts advertising incorrect voting times and locations.

It was in this spirit that FBI officials met with Twitter and Facebook executives in the lead-up to Election Day 2020 and advised them to be wary of Russian disinformation operations involving fake documents. That warning later led both companies to suppress posts about a controversial _New York Post_ story about the contents of a laptop belonging to Hunter Biden.

Silicon Valley’s response to the Hunter Biden laptop story outraged conservatives, who began accusing tech companies and their federal partners of conspiring to censor speech in an effort to rig the election. In subsequent investigations, CISA found itself squarely in the crosshairs. The agency had already earned the ire of former president Donald Trump and his allies for reassuring the public about the integrity of the 2020 election, but the new controversy practically made it a pariah on the right.

In June 2023, a House Judiciary Committee report blasted CISA as “the nerve center of the federal government’s domestic surveillance and censorship operations on social media.” A few months later, a federal appeals court partially affirmed a district judge’s ruling that placed limits on CISA’s ability to communicate with tech companies, finding that the agency’s work to fight disinformation “likely violated the First Amendment.”

Stunned by the intense backlash, CISA stopped working with social media platforms to combat mis- and disinformation. The FBI, too, scaled back its interactions with those companies, halting briefings about foreign interference activities. “The symbiotic relationship between the government and the social media companies has definitely been fractured,” a US official told NBC News.

CISA has staunchly avoided acknowledging the reality that its reputation has been damaged.

“CISA’s election security mission is stronger than ever,” says Cait Conley, a senior adviser to director Jen Easterly who oversees the agency’s election work. “We remain engaged with election officials in all 50 states and will continue to conduct all of our work in an apolitical and nonpartisan manner.”

A GOP Split

As the controversies have eroded CISA’s bipartisan brand, Republicans who run elections have split into two camps over whether to keep working with the agency to fight hackers, online falsehoods, and polling-place threats.

West Virginia’s Warner is the indisputable flag-bearer of the anti-CISA camp. “I’ve pulled away from them,” he tells WIRED at the NASS conference, a few hours after venting his frustrations to the federal officials. “I’m not attending their briefings, because I haven’t found anything useful out of them.”

Warner says he’s proud of the “tremendous advances” that federal and state officials have made together on election security since 2016, but he warns that CISA and the FBI will continue losing conservatives’ trust until they investigate their roles in the controversies of 2020. “I’ve brought this to the attention of CISA officials,” he says, “and there’s no effort there to do this.”

Warner argues that CISA’s warnings about foreign disinformation, AI-powered deep fakes, and death threats to election officials are “distractions from the real threat to American democracy” posed by censorship.

It remains unclear how many of Warner’s colleagues agree with him. But when WIRED surveyed the other 23 Republican secretaries who oversee elections in their states, several of them said they would continue working with CISA.

“The agency has been beneficial to our office by providing information and resources as it pertains to cybersecurity,” says JoDonn Chaney, a spokesperson for Missouri’s Jay Ashcroft.

South Dakota’s Monae Johnson says her office “has a good relationship with its CISA partners and plans to maintain the partnership.”

But others who praised CISA’s support also sounded notes of caution.

Idaho’s Phil McGrane says CISA is doing “critical work … to protect us from foreign cyber threats.” But he also tells WIRED that the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC), a public-private collaboration group that he helps oversee, “is actively reviewing past efforts regarding mis/disinformation” to determine “what aligns best” with CISA’s mission.

Mississippi’s Michael Watson says that “statements following the 2020 election and some internal confidence issues we’ve since had to navigate have caused concern.” As federal and state officials gear up for this year’s elections, he adds, “my hope is CISA will act as a nonpartisan organization and stick to the facts.”

CISA’s relationships with Republican secretaries are “not as strong as they’ve been before,” says John Merrill, who served as Alabama’s secretary of state from 2015 to 2023. In part, Merrill says, that’s because of pressure from the GOP base. “Too many conservative Republican secretaries are not just concerned about how the interaction with those federal agencies is going, but also about how it’s perceived … by their constituents.”

Free Help at Risk

CISA’s defenders say the agency does critical work to help underfunded state and local officials confront cyber and physical threats to election systems.

The agency’s career civil servants and political leaders “have been outstanding” during both the Trump and Biden administrations, says Minnesota secretary of state Steve Simon, a Democrat.

Others specifically praised CISA’s coordination with tech companies to fight misinformation, arguing that officials only highlighted false claims and never ordered companies to delete posts.

“They’re just making folks aware of threats,” says Arizona’s Democratic secretary of state, Adrian Fontes. The real “bad actors,” he says, are the people who “want the election denialists and the rumor-mongers to run amok and just spread out whatever lies they want.”

If Republican officials begin disengaging from CISA, their states will lose critical security protections and resources. CISA sponsors the EI-ISAC, which shares information about threats and best practices for thwarting them; provides free services like scanning election offices’ networks for vulnerabilities, monitoring those networks for intrusions and reviewing local governments’ contingency plans; and convenes exercises to test election officials’ responses to crises.

“For GOP election officials to back away from \[CISA\] would be like a medical patient refusing to accept free wellness assessments, check-ups, and optional prescriptions from one of the world’s greatest medical centers,” says Eddie Perez, a former director for civic integrity at Twitter and a board member at the OSET Institute, a nonprofit group advocating for improved election technology.

Worse, some CISA projects will become less effective as they lose participants. The EI-ISAC’s information-sharing initiative is only as valuable as the information that state and federal agencies submit to it.

Even if most states stick with CISA, it would only take a few holdouts to create systemic risk. “America's election security posture is only as strong as its weakest jurisdiction,” says David Levine, the senior elections integrity fellow at the German Marshall Fund’s Alliance for Securing Democracy.

Cautious Optimism Despite ‘Strain’

Election security experts and Democratic officials express cautious optimism that there won’t be a GOP exodus from CISA this year.

“I have faith Republican secretaries of state will continue to prioritize their voters and collaborate with CISA to ensure a secure 2024 election,” says Mississippi representative Bennie Thompson, the top Democrat on the House Homeland Security Committee.

Lawrence Norden, the senior director of the Brennan Center for Justice’s Elections and Government Program, notes that some of CISA’s new regional election security advisers “have worked in recent years as or for Republican officeholders,” giving them credibility with GOP leaders.

According to Minnesota’s Simon, “the vast majority of secretaries find these partnerships valuable.”

Still, Warner says some secretaries quietly support his pushback against CISA and other aspects of the Biden administration’s election security strategy. “There \[is a\] meeting of the minds by some of the secretaries, especially on the right, with some of these similar concerns,” he says, even if “they’re not as outspoken as I am.”

That shared skepticism of CISA means that, even after Warner leaves office next year, the agency will remain on precarious footing with some of its Republican partners. For now, CISA’s allies are left hoping that the agency’s time-tested bonds will prove stronger than pressures from conservative activists.

“You can have strain in some areas of a relationship and still have a strong relationship,” says Arizona’s Fontes. “That’s what being a grown-up is about. And I think most of us are doing that pretty well.”

How a Right-Wing Controversy Could Sabotage US Election Security

A student investigation at the University of Waterloo uncovered a system that scanned countless undergrads without consent.

Canada-based University of Waterloo is racing to remove M&M-branded smart vending machines from campus after outraged students discovered the machines were covertly collecting face recognition data without their consent.

The scandal started when a student using the alias SquidKid47 posted an image on Reddit showing a campus vending machine error message, “Invenda.Vending.FacialRecognitionApp.exe,” displayed after the machine failed to launch a face recognition application that nobody expected to be part of the process of using a vending machine.

"Hey, so why do the stupid M&M machines have facial recognition?" SquidKid47 pondered.

The Reddit post sparked an investigation from a fourth-year student named River Stanley, who was writing for a university publication called MathNEWS.

Stanley sounded the alarm after consulting Invenda sales brochures that promised “the machines are capable of sending estimated ages and genders” of every person who used the machines—without ever requesting consent.

This frustrated Stanley, who discovered that Canada's privacy commissioner had years ago investigated a shopping mall operator called Cadillac Fairview after discovering some of the malls' informational kiosks were secretly “using facial recognition software on unsuspecting patrons.”

Only because of that official investigation did Canadians learn that “over 5 million nonconsenting Canadians” were scanned into Cadillac Fairview's database, Stanley reported. Where Cadillac Fairview was ultimately forced to delete the entire database, Stanley wrote that consequences for collecting similarly sensitive face recognition data without consent for Invenda clients like Mars remain unclear.

Stanley's report ended with a call for students to demand that the university “bar facial recognition vending machines from campus.”

A University of Waterloo spokesperson, Rebecca Elming, eventually responded, confirming to CTV News that the school had asked to disable the vending machine software until the machines could be removed.

Students told CTV News that their confidence in the university's administration was shaken by the controversy. Some students claimed on Reddit that they attempted to cover the vending machine cameras while waiting for the school to respond, using gum or Post-it notes. One student pondered whether “there are other places this technology could be being used” on campus.

Elming was not able to confirm the exact timeline for when the machines would be removed, other than telling Ars it would happen “as soon as possible.” Elming declined Ars' request to clarify if there are other areas of campus collecting face recognition data. She also wouldn't confirm, for any casual snackers on campus, when, if ever, students could expect the vending machines to be replaced with snack dispensers not equipped with surveillance cameras.

Invenda Claims Machines Are GDPR-Compliant

MathNEWS' investigation tracked down responses from companies responsible for smart vending machines on the University of Waterloo's campus.

Adaria Vending Services told MathNEWS that “what’s most important to understand is that the machines do not take or store any photos or images, and an individual person cannot be identified using the technology in the machines. The technology acts as a motion sensor that detects faces, so the machine knows when to activate the purchasing interface—never taking or storing images of customers.”

According to Adaria and Invenda, students shouldn't worry about data privacy because the vending machines are “fully compliant” with the world's toughest data privacy law, the European Union's General Data Protection Regulation (GDPR).

“These machines are fully GDPR compliant and are in use in many facilities across North America,” Adaria's statement said. “At the University of Waterloo, Adaria manages last mile fulfillment services—we handle restocking and logistics for the snack vending machines. Adaria does not collect any data about its users and does not have any access to identify users of these M&M vending machines.”

Source

Wired