A surprise disclosure of a national security threat by the House Intelligence chair was part of an effort to block legislation that aimed to limit cops and spies from buying Americans' private data.

The latest botched effort at salvaging a controversial US surveillance program collapsed this week thanks to a sabotage campaign by the United States House Intelligence Committee (HPSCI), crushing any hope of unraveling the program’s fate before Congress pivots to prevent a government shutdown in March.

An agreement struck between rival House committees fell apart on Wednesday after one side of the dispute—represented by HPSCI—ghosted fellow colleagues at a crucial hearing while working to poison a predetermined plan to usher a “compromise bill” to the floor.

A civil war between the House Judiciary and Intelligence Committees has crippled months of efforts to reauthorize Section 702 of the Foreign Intelligence Surveillance Act (FISA), an unpopular but crucial spy power, stunning the intelligence system and forcing security hawks to publicly argue in favor of surveillance tactics that even top spies acknowledge has been prone to abuse.

Witnesses to the events this week that forced House speaker Mike Johnson to shelve the latest Section 702 bill—the third of its kind to fail in as many months—say the leaders of HPSCI abandoned a deal that had been agreed to in private after weeks of negotiation. Sources familiar with the negotiations asked not to be identified, as none of them are authorized to speak publicly.

The impetus for killing the deal, WIRED has learned, was an amendment that would end the government’s ability to pay US companies for information rather than serving them with a warrant. This includes location data collected from cell phones that are capable in many cases of tracking people’s physical whereabouts almost constantly. The data is purportedly gathered for advertising purposes but is collected by data brokers and frequently sold to US spies and police agencies instead.

Senior aides say the HPSCI chair, Mike Turner, personally exploded the deal while refusing to appear for a hearing on Wednesday in which lawmakers were meant to decide the rules surrounding the vote. A congressional website shows that HPSCI staff had not filed one of the amendments meant to be discussed before the Rules Committee, suggesting that at no point in the day did Turner plan to attend.

Two senior sources on the Hill who are working for members with direct knowledge of the events but are not affiliated with either of the relevant committees say that while lawmakers waited on Turner to appear, he was meeting privately with Johnson and threatening to kill the bill he'd already signed off on.

At the same time, Turner and other HPSCI members were engaged in a floundering but possibly effective scheme to whip votes against any potential privacy enhancements, floating vague claims about an “urgent” threat against the US. Turner’s warning was later reported to concern Russia developing the capability to deploy nuclear weapons in space.

In a letter on Friday, four advocacy organizations signed a letter calling for Turner to step down from his role as Intel chair over what they called a “near-panic” started purely for “political gain.” The letter, first reported by Politico, was signed by members of groups FreedomWorks, Due Process Institute, Demand Progress, and Restore the Fourth.

Neither Johnson nor Turner’s offices responded to a request for comment.

Internal emails obtained by WIRED show that HPSCI’s ranking Democrat, Jim Himes, was likewise a part of that effort, his signature attached to a letter urging Democrats to schedule time to review “certain intelligence” in a HPSCI-operated “SCIF”—a room designed to securely host classified information. The letter implies an “urgent” threat involving foreign military capabilities that requires wide dissemination, all but ensuring it leaked to the press.

In news reports about that intelligence the following day, anonymous officials ensured it was stressed to reporters that Section 702 was essential to identifying the threat. More recent statements made by the White House and Senate intelligence staff that relay the risks the disclosure poses to classified “sources and methods” have generated skepticism around 702’s role.

Four senior aides tell WIRED that, despite speculation in _The New York Times_ that a foreign aid package related to Ukraine had been the impetus behind the effort to center the threat, Turner and Himes were motivated to instill paranoia in members that would inevitably raise doubts as to whether popular private reforms were simply too great a risk—namely those requiring the government to obtain warrants before accessing the private calls, texts, and emails of US persons, as well as “commercially available data” that can be used to monitor their whereabouts, both historically and in real-time.

This campaign—mirrored with less success by the FBI—appeared to backfire in a matter of hours, with Senate intelligence staff refusing to support Turner’s claims and instead issuing a statement that implied his disclosure had put classified sources at risk. The White House similarly dismissed the urgency communicated by Turner, warning that information related to the “threat” might expose intelligence sources.

Some aides critical of the tactics say nevertheless that they believe it may have been effective, shaking some members’ willingness to openly support reform.

“These tricks aren’t new,” said one aide. “They’re recycled, but increasingly transparent.” (“Every spymaster in history has exploited the mixed feeling of awe, gratitude, and fear that power-holders respond to in dealing with intelligence,” civil liberties attorney Frank Donner once said. It was 1971.)

By Wednesday afternoon, Himes, whose signature appeared on the initial “dear colleague” email announcing that the classified matter “should be known by all,” appeared to be seeking distance from the controversy, issuing a statement acknowledging the intel was “not a cause for panic” and saying the protection of sources is “a legal and sacred duty.”

After Johnson reluctantly killed the plans to move forward with a vote—and with it, any hope of resolving the battle over Section 702—intelligence officials began the task of redirecting the blame. The complexities of the issue, and general lack of knowledge among the public and press, aided significantly in that goal.

A Fox News report published Thursday morning, while accurately noting that it was Turner's threat that forced Johnson to cancel the vote, goes on to cite “sources close to the Intelligence Committee” who offered analysis of the events. The sources claimed that Turner was compelled to abandon the deal because the “compromise bill” had been sneakily altered in a manner that “totally screws FISA in terms of its ability to be a national security tool.”

While redirecting blame away from Turner and his cohorts, the claim is both false and deceptive, relying on assertions that, while farcical perhaps to legal experts, would be impossible for the public at large (and most of the press) to parse alone.

The text that Fox News’ intelligence sources are referring to—which can be read on the final page of the bill online—does nothing, in reality. It does not require or prevent anyone in the government from taking any action whatsoever. It also has no impact on FISA, the statute from which Section 702 derives its power.

The controversial text states that the nation’s top intelligence official “may submit” information to Congress regarding how “law enforcement agencies and the intelligence community” purchase “commercially available data about United States persons.” Essentially, it grants the intelligence community permission to do something that it does not actually need permission to do.

The language was included not to “totally screw” FISA, but to ensure that the phrase “commercially available data” appears at least once in the text, for reasons that are as benign as they are elusive to casual followers of legislative procedures.

One of the most popular amendments suggested to the Section 702 bill, discussed openly by lawmakers for months, is one that would prevent the government from purchasing data that normally requires a warrant. To counter arguments that these purchases are unrelated (which is to say, not “germane”) to the 702 program, the language in the final section, accomplishing nothing else, was added. A placeholder, effectively.

A senior source close to the Judiciary Committee said that it would have been impossible for Turner not to know the amendment was coming, and that the surprise expressed by his staff in the Fox News piece and elsewhere appeared to those in the know as pure theater.

Four aides, recordings of several public hearings, and a slew of reporting confirm that Turner had been aware for weeks, if not months, that restrictions on commercially available data would be one of the key amendments offered up by Judiciary members. The aides added that he'd also privately agreed to allow Judiciary members to offer their amendments. Prior to the bill being pulled, Representatives Warren Davidson and Zoe Lofgren had issued a relevant joint statement publicly: “It makes little sense to rein in warrantless surveillance under one authority when the government can simply fall back on other available techniques to acquire similar information,” they said.

Only after forcing Johnson to cancel the vote did the germaneness of the measure become a justification for tanking the entire process.

“No one actually thinks the Intelligence Committee cares about this,” says an aide working for a Judiciary member. “It’s the amendment they’re freaking out about. They don’t want the intelligence community to have to ask judges before they do anything.”

“For all the downplaying the agencies have done, telling us repeatedly they aren’t purchasing our data that often, Turner just blew weeks of negotiation to defend this one thing,” says the same aide. “To me, that says something about how much the government actually cares about this.”

_Update: 2/16/24, 3:35 pm ET: Added details about a letter calling for Turner to step down as Intel chair._

Leak of Russian ‘Threat’ Part of a Bid to Kill US Surveillance Reform, Sources Say

A new report cited 28 “verified” accounts on X that appear to be tied to sanctioned groups or individuals.

A watchdog group's investigation found that terrorist group Hezbollah and other US-sanctioned entities have accounts with paid check marks on X, the Elon Musk–owned social network that still resides at the Twitter.com domain.

The Tech Transparency Project (TTP), a nonprofit that is critical of Big Tech companies, said in a report on Wednesday that "X, the platform formerly known as Twitter, is providing premium, paid services to accounts for two leaders of a US-designated terrorist group and several other organizations sanctioned by the US government."

After buying Twitter for $44 billion, Musk started charging users for check marks that were previously intended to verify that an account was notable and authentic. "Along with the check marks, which are intended to confer legitimacy, X promises various perks for premium accounts, including the ability to post longer text and videos and greater visibility for some posts," the Tech Transparency Project report noted.

The Tech Transparency Project suggests that X may be violating US sanctions. "The accounts identified by TTP include two that apparently belong to the top leaders of Lebanon-based Hezbollah and others belonging to Iranian and Russian state-run media," the report said. "The fact that X requires users to pay a monthly or annual fee for premium service suggests that X is engaging in financial transactions with these accounts, a potential violation of US sanctions."

Some of the accounts were verified before Musk bought Twitter, but verification was a free service at the time. Musk's decision to charge for check marks means that X is "providing a premium, paid service to sanctioned entities," which may raise "new legal issues," the Tech Transparency Project said.

Report Details 28 Check-Marked Accounts

Musk's X charges $1,000 a month for a Verified Organizations subscription and last month added a basic tier for $200 a month. For individuals, the X Premium tiers that come with check marks cost $8 or $16 a month.

It's possible for US companies to receive a license from the government to engage in certain transactions with sanctioned entities, but it doesn't seem likely that X has such a license. X's rules explicitly prohibit users from purchasing X Premium "if you are a person with whom X is not permitted to have dealings under US and any other applicable economic sanctions and trade compliance law."

In all, the Tech Transparency Project said it found 28 "verified" accounts tied to sanctioned individuals or entities. These include individuals and groups listed by the US Treasury Department’s Office of Foreign Assets Control (OFAC) as Specially Designated Nationals.

"Of the 28 X accounts identified by TTP, 18 show they got verified after April 1, 2023, when X began requiring accounts to subscribe to paid plans to get a check mark. The other 10 were legacy verified accounts, which are required to pay for a subscription to retain their check marks," the group wrote, adding that it "found advertising in the replies to posts in 19 of the 28 accounts."

X issued the following statement on Wednesday: "X has a robust and secure approach in place for our monetization features, adhering to legal obligations, along with independent screening by our payments providers. Several of the accounts listed in the Tech Transparency Report are not directly named on sanction lists, while some others may have visible account check marks without receiving any services that would be subject to sanctions. Our teams have reviewed the report and will take action if necessary. We're always committed to ensuring that we maintain a safe, secure and compliant platform."

X Removes Some Check Marks

An account with the handle @SH\_NasrallahEng appears to be tied to Hezbollah leader Hassan Nasrallah, the TTP report said. The account had a check mark when we first checked it earlier Wednesday, but it has since been removed.

"The account, which has 93,600 followers, posts English-language Hezbollah messages and memes disparaging Israel and the US. It was created in October 2021 and verified in November 2023, the same month that Nasrallah threatened further escalation of Israel's war with Hamas," the report said.

Elon Musk’s X Gave Check Marks to Terrorist Group Leaders, Report Says

Prominent advocates for the rights of pregnant people are urging members of Congress to support legislation that would ban warrantless access to sensitive data as the White House fights against it.

One of the foremost women’s advocacy groups in the United States is urging members of Congress to support a ban on government agencies using private data brokers to acquire access to Americans’ private data without a warrant, a response that came late Tuesday following explosive revelations about the surveillance of women’s health clinics across the US.

The National Partnership for Women & Families, a nonpartisan nonprofit based in Washington, DC, is pressing federal lawmakers to throw support behind an amendment this week aimed at closing off a legal loophole through which police and spy agencies routinely circumvent the courts, buying information traditionally shielded by the country’s constitution.

The organization pointed to news in Politico on Tuesday which revealed a data broker tracked people’s visits to nearly 600 reproductive health clinics in the US and put that information up for sale. Politico cites a letter from US senator Ron Wyden to the Securities and Exchange Commission calling for an investigation into the company, Near Intelligence.

“This is not only a blatant violation of privacy but a cruel attempt to force pregnant people into reproductive health decisions that they should be making for themselves,” the National Partnership told members, according to an email obtained by WIRED. “Congress needs to curtail warrantless law enforcement access to people’s data in order to prevent government monitoring of abortion and pregnancy outcomes.”

The National Partnership for Women & Families has earned praise previously from former first ladies Michelle Obama and Hillary Clinton (during the latter’s tenure as secretary of state).

The data-broker amendment aimed at preventing government agencies from circumventing warrant requirements with money has gained widespread support in Congress. Likewise, recent polling shows up to 80 percent of Americans would support its passage. It faces powerful opposition, however, from the White House, the US military, and the nation’s spy agencies, which have acknowledged purchasing domestic internet data in recent years.

In December, pro-privacy members of the House Judiciary Committee attached language that would ban government data-broker purchases of information safeguarded under the nation’s Fourth Amendment to a House bill reauthorizing Section 702, a classified surveillance program designed to target foreigners on foreign soil that also routinely sweeps up the private communications of Americans: emails, calls, and text messages in their entirety.

Roughly a week later, pro-surveillance lawmakers on the House Intelligence Committee introduced their own bill reauthorizing the 702 program, which excluded the data-broker ban as well as other reforms included in the Judiciary Committee bill. One such reform, supported by the Judiciary Committee, would force federal analysts and investigators to get a warrant before examining the communications of Americans unavoidably intercepted under the sprawling 702 program.

US House leaders had tentatively agreed to a deal that would allow the entire House to vote on both bills, passing whichever received the most support. That plan fell through, however, and before the new year, lawmakers voted instead to extend the 702 program until mid-April. An effort to proactively block the Biden administration from taking advantage of this temporary extension, circumventing Congress and getting the program reauthorized for an additional year on its own, was ultimately rejected by House speaker Mike Johnson.

As a result, most House members remain confused as to when 702 surveillance would actually end if Congress fails to take action. Reformers say fomenting a sense of urgency to salvage the spy program—ultimately deemed vital even by many of its loudest critics—mostly plays into the administration’s hand, as it serves up “what-if” scenarios concerning possible terrorist attacks to lawmakers still on the fence. A group of senior congressional aides told WIRED last month that discussions about the program have been plagued for weeks by “scare tactics” and disinformation campaigns, with intelligence officials privately using images of Hamas to imply a growing domestic threat.

Rumors have circulated about a “secret session” being called this week, a rare procedure in which Congress meets behind closed doors. The session has been reported as called off, but a source with knowledge of recent developments tells WIRED that White House national security advisers are still expected to meet privately with lawmakers—one final attempt to dissuade them from supporting privacy reforms.

Last week, House speaker Mike Johnson and House minority leader Steve Scalise privately signed off on what they’d planned to advertise as a “compromise” bill, the latest in a string of schemes aimed at preserving the 702 program with as few changes as possible. It drew immediate criticism from civil liberties organizations such as the Brennan Center for Justice, which said it had been “carefully crafted” to preserve the “status quo.” The Electronic Privacy Information Center (EPIC) said the House leadership bill was a “compromise” in name only, aligning clearly with the priorities of the spy agencies over those fighting for reform.

Multiple sources, however, say the bill ultimately gained acceptance on the condition that members of both the House Judiciary and House Intelligence Committees would be allowed to offer amendments this week that would be subject to a floor vote. The amendment supported by the National Partnership for Women & Families is destined to be among them.

Police and intelligence agencies regularly purchase millions of dollars worth of sensitive information from data brokers each year, according to a December 2021 study of public records by the Center for Democracy & Technology (CDT), a civil-liberties-focused nonprofit. This data can include phone location data and health data collected by medical apps, which could be used to identify people seeking abortion care.

The Congressional Research Service (CRS), which provides Congress with legal and policy analysis, noted in 2022 that federal law includes “relatively little constraints” on law enforcement gaining access to sensitive data, including geolocation data and health data collected by apps and fitness trackers. The lack of constraints is particularly true for information sold by data brokers, which are “generally not regulated by any specific privacy statute,” according to CRS. While abortion-related information obtained from data brokers is known to have been used by anti-abortion activists, the CRS notes that it could equally be used by police investigating violations of state-level abortion laws.

The primary federal law regulating data broker activities is the FTC Act, which gives the US Federal Trade Commission the authority to penalize companies that fail to disclose how the data they sell may be used. In January, the FTC banned X-Mode Social, a Virginia-based data broker now named Outlogic, from selling “sensitive location data” that “could be used to track people’s visits to sensitive locations such as medical and reproductive health clinics, places of religious worship, and domestic abuse shelters” after the company allegedly failed to institute “appropriate safeguards” against the use of precise location data by third parties.

In July 2022, US president Joe Biden issued an executive order instructing the FTC chair to “consider actions” that aim to further “protect consumers’ privacy when seeking information about and provision of reproductive healthcare services.” The House Judiciary Committee’s amendment, which US spy agencies oppose, would strengthen these protective efforts far beyond the remit of the FTC Act.

In a “dear colleagues” email obtained by WIRED, Jerrold Nadler, the ranking Democrat on the Judiciary Committee, and Representative Zoe Lofgren wrote Wednesday that the so-called compromise bill “closely tracks” with the demands of the intelligence community, “bypassing commonsense reforms,” including the amendment now endorsed by the National Partnership for Women & Families, which Lofgren and Nadler describe as strictly written to stop the government from “buying its way around the Fourth Amendment.”

“The implications for Americans’ privacy rights are staggering,” they said, refuting claims that the data-broker issue is unrelated to surveillance conducted under the 702 program. “It makes little sense to rein in warrantless surveillance under one authority when the government can simply fall back on other available techniques to acquire similar information.”

Section 702 Surveillance Fight Pits the White House Opposite Reproductive Rights

Romantic chatbots collect huge amounts of data, provide vague information about how they use it, use weak password protections, and aren’t transparent, new research from Mozilla says.

You shouldn’t trust any answers a chatbot sends you. And you probably shouldn’t trust it with your personal information either. That’s especially true for “AI girlfriends” or “AI boyfriends,” according to new research.

An analysis into 11 so-called romance and companion chatbots, published on Wednesday by the Mozilla Foundation, has found a litany of security and privacy concerns with the bots. Collectively, the apps, which have been downloaded more than 100 million times on Android devices, gather huge amounts of people’s data; use trackers that send information to Google, Facebook, and companies in Russia and China; allow users to use weak passwords; and lack transparency about their ownership and the AI models that power them.

Since OpenAI unleashed ChatGPT on the world in November 2022, developers have raced to deploy large language models and create chatbots that people can interact with and pay to subscribe to. The Mozilla research provides a glimpse into how this gold rush may have neglected people’s privacy, and into tensions between emerging technologies and how they gather and use data. It also indicates how people’s chat messages could be abused by hackers.

Many “AI girlfriend” or romantic chatbot services look similar. They often feature AI-generated images of women which can be sexualized or sit alongside provocative messages. Mozilla’s researchers looked at a variety of chatbots including large and small apps, some of which purport to be “girlfriends.” Others offer people support through friendship or intimacy, or allow role-playing and other fantasies.

“These apps are designed to collect a ton of personal information,” says Jen Caltrider, the project lead for Mozilla’s Privacy Not Included team, which conducted the analysis. “They push you toward role-playing, a lot of sex, a lot of intimacy, a lot of sharing.” For instance, screenshots from the EVA AI chatbot show text saying “I love it when you send me your photos and voice,” and asking whether someone is “ready to share all your secrets and desires.”

Caltrider says there are multiple issues with these apps and websites. Many of the apps may not be clear about what data they are sharing with third parties, where they are based, or who creates them, Caltrider says, adding that some allow people to create weak passwords, while others provide little information about the AI they use. The apps analyzed all had different use cases and weaknesses.

Take Romantic AI, a service that allows you to “create your own AI girlfriend.” Promotional images on its homepage depict a chatbot sending a message saying,“Just bought new lingerie. Wanna see it?” The app’s privacy documents, according to the Mozilla analysis, say it won’t sell people’s data. However, when the researchers tested the app, they found it “sent out 24,354 ad trackers within one minute of use.” Romantic AI, like most of the companies highlighted in Mozilla’s research, did not respond to WIRED’s request for comment. Other apps monitored had hundreds of trackers.

In general, Caltrider says, the apps are not clear about what data they may share or sell, or exactly how they use some of that information. “The legal documentation was vague, hard to understand, not very specific—kind of boilerplate stuff,” Caltrider says, adding that this may reduce the trust people should have in the companies.

‘AI Girlfriends’ Are a Privacy Nightmare

Top congressional lawmakers are meeting in private to discuss the future of a widely unpopular surveillance program, worrying members devoted to reforming Section 702.

Twice in the past decade, legislation limiting the United States government’s domestic surveillance powers sailed through the US House of Representatives. Attached to bills that would ultimately become law, both of these pro-privacy amendments were killed off in the final hours of consideration—erased each time in secret meetings held among a select group of congressional power brokers. Capitol Hill sources familiar with ongoing negotiations over a top US surveillance program fear House leaders may once again scrap popular civil-liberty-focused reforms.

Last week, House members became aware that closed-door discussions were ongoing at the highest levels concerning the latest pro-privacy reforms to gain widespread legislative support. Public reporting on the discussions, first disclosed by Politico, set off a firestorm of speculation over whether another deal may have been quietly struck to prolong a domestic surveillance program no longer assumed to have the support of a majority of Congress.

Sources with knowledge of ongoing negotiations over the future of Section 702—a controversial but pivotal US foreign surveillance program—say a host of pro-privacy reforms, including new warrant requirements for obtaining commercially available data, have gained serious traction among an anomalous coalition of progressives and conservatives otherwise at odds on most matters. WIRED granted these sources anonymity because they were not authorized to speak publicly about ongoing negotiations.

A source with knowledge of the 702 fight tells WIRED that last week House speaker Mike Johnson and House majority leader Steve Scalise met privately about drafting a new bill to reauthorize the program—an attempt to somehow merge existing bills introduced separately in December by the House Judiciary and Intelligence committees. The history of genuine privacy legislation being killed off in these closed-door sessions immediately sparked concerns among reformers.

“This is the room where we get fucked,” one civil liberties expert tells WIRED.

Senior aides on the Hill, working from offices on both ends of the surveillance fight, say there is a 90 percent agreement among the two bipartisan factions. It is the final 10 percent—composed almost entirely of the warrant issue—on which neither is willing to budge.

Several aides attributed the drawn-out nature of the fight, at least in part, to the relative naivete of the House speaker on national security matters, saying that, with little experience in the area, Johnson had not previously had the opportunity to be captured by the intelligence community—powerful interests accused by congressional staffers of routinely deploying “fear tactics” to defend surveillance operations plagued by regular error and abuse.

Johnson’s lack of any intelligence background, staffers say, would have likely increased his dependence on House intelligence staffers, who, while cultivating a sense of awe due to their access to national secrets, routinely behave as ambassadors between the spy agencies and regular congressional staff.

House members remained in the dark Monday morning as to the details of Johnson and Scalise’s purported plan for Section 702, and whether the compromise—potentially to arrive later this week—would include popular measures aimed at ending a prominent data broker loophole, through which US spy agencies are known to purchase information on Americans for which a warrant is typically required.

Johnson, notably, previously voted in favor of legislation that would have drastically reformed the 702 program with a slew of privacy protections.

Despite the uncommon bipartisan support for reforming Section 702, sources familiar with the negotiations say pro-privacy amendments have a history of dying in backroom deals. An amendment proposed last summer to ban the US military from tracking Americans’ cell phones without a warrant was snuffed out in a closed-door session despite winning widespread support in the House. Yet another amendment—which would have done little to interfere with the federal government’s domestic surveillance work—likewise gained support in the House two years ago. But even this half-measure ultimately found itself on the chopping block after negotiations were moved into rooms open to neither the public nor the press.

The effectiveness of this latest round of pro-privacy bipartisanship came as a surprise to many in the national security establishment. Congressional sources say that a year ago, only a feeble resistance to reauthorizing the surveillance was anticipated. Even its biggest detractors acknowledge that the 702 program is likely vital to the US national defense, crucial to investigations of terrorist threats, acts of espionage, and the constant deluge of cyberattacks aimed at US companies and national infrastructure.

To the contrary, a serious challenge to continuing the program under status quo conditions did arise in the fall of 2023. Compounded by the sudden fight over the House speakership in October, the smooth reauthorization of Section 702 became a distant fantasy. Working groups established in the House to find common ground eventually disintegrated, leaving only two discernible factions in their wake—one that believes the FBI should apply for warrants before accessing US calls, texts, and emails intercepted by US spies; and another that says warrants are too much of a burden for investigators.

What’s counted toward compromise since then might best be described as a “rounding error.” Lawmakers opposed to warrants agreed in December that the FBI should obtain a warrant before accessing 702 data in investigations that lack a foreign component. But of the hundreds of thousands of Americans queried by the bureau each year, only a small fraction fall into this category—fewer than 1 percent, according to some civil liberties experts.

The Section 702 program was last extended in December until April, when certifications issued by the Foreign Intelligence Surveillance Court expire, ending a requirement that American companies cooperate with the intelligence community’s wiretap demands. Some experts have forecast that the intelligence community may begin to apply for new certifications as early as next month, allowing the surveillance to continue uninterrupted for an additional year, even if Congress fails to act.

It is often the last resort of congressional leaders to block privacy-enhancing bills from reaching the floor for a vote—even if the result is that a surveillance program goes suddenly unauthorized by Congress. Letting a program expire is often preferable to allowing a vote to take place if it runs the risk of enshrining unwanted restrictions in the law.

Expired surveillance programs can find ways to carry on. US lawmakers introduced bills twice last year, for instance, with measures aimed at banning FBI surveillance techniques technically rendered unlawful four years after Congress failed to reauthorize Section 215: a package of surveillance tools provided by the 9/11-era Patriot Act legislation.

House leaders—Democrats at the time—faced similar popular opposition to continuing the 215 surveillance under status quo conditions. Rather than risk a vote that might permanently kill the programs, it was simply allowed to expire. Since then, the FBI has continued availing itself of the surveillance techniques, year after year, “grandfathering” in a bevy of new cases.

A Backroom Deal Looms Over Section 702 Surveillance Fight

New research finds that Israel’s attacks on Gaza damaged hospitals and other medical facilities at the same rate as other buildings, potentially in violation of international law.

The world has witnessed a near-unprecedented and ongoing humanitarian crisis in Gaza during the first 129 days of the Israel-Hamas war. Despite their critical role in saving lives, hospitals and other health care facilities—which are protected under international law—have not been spared the widespread destruction in the Palestinian territory, according to new research.

A study published Monday in the _British Medical Journal Global Health_ from researchers at the Yale School of Public Health found that from October 7—the day Hamas launched an unexpected attack on Israel that left some 1,200 Israelis dead—to November 7, 2023, hospitals and health care facilities were damaged at the same rate as other buildings. The paper’s authors suggest that the Israel Defense Forces (IDF) did not take measures to ensure it did not strike these facilities, despite their protected status.

“This pattern of war, at least in this first month, looks like it was not really aligned with international humanitarian law,” says Danielle Poole, an associate research scientist at the Yale School of Public Health and lead author on the paper.

The United Nations Relief and Works Agency for Palestine Refugees in the Near East estimates that at the start of 2024, 85 percent of Gaza’s population, or some 1.9 million people, had been displaced by the conflict, and the Gaza Ministry of Health reports that at least 28,064 Palestinians were killed between October 7, 2023, and February 10, 2024. Human Rights Watch, a nonprofit watchdog organization, has characterized Israel’s attacks on health care facilities in Gaza as “apparently unlawful.”

Using high-resolution satellite imagery from the United Nations, data from the open source mapping platform OpenStreetMap, and known locations of medical facilities listed by the World Health Organization (WHO) and the United Nations Office for Coordination of Humanitarian Assistance, the researchers were able to identify damage to over 167,000 buildings during the first month of the conflict. Poole and her team found that 15,768 nonmedical structures and nine health care–related facilities suffered damage—about 9 percent in each case. The analysis also found that health care facilities were more likely than other buildings to have sustained severe damage or to have been destroyed completely.

“Already in this first month, their health system was severely compromised due to the conflict,” says Poole. As the researchers note in their report, the attacks on medical facilities “will undoubtedly have long-term effects on the health system through the severely decreased ability to provide necessary medical care to the population.”

Researchers ranked the damage done to buildings in four ascending categories: “possible damage,” “moderate damage,” “severe damage,” and “destroyed.” Poole says the numbers noted in her team’s report are conservative because they don’t count smaller medical facilities, like pharmacies or small clinics. “You wouldn't expect an artillery officer to know about the little pharmacy in the strip mall, even though those things are still protected” under international humanitarian law, she says.

IDF flares light up the sky above the Al-Shifa hospital on November, 6, 2023.Photograph: Ahmad Salem/Bloomberg/Getty Images

International humanitarian law prohibits attacks on hospitals and health care facilities, or against patients, doctors, and their means of transport, during a conflict. A health care facility can lose its protected status if it is used to “commit acts that are harmful to the enemy,” according to the International Committee of the Red Cross (ICRC).

“Hospitals have special protection status underneath the Geneva Conventions and the Law of Armed Conflict,” says Nathaniel Raymond, a human rights investigator and a coauthor of the study. “To intentionally strike a hospital, the protocol required is the most restrictive for any type of civilian infrastructure. An armed party to a conflict must ensure that the hospital is notified that it has lost protected status, and efforts are made to ensure the evacuation of those facilities prior to any kinetic strike. That is what the law requires.”

In a lengthy response to WIRED’s questions about what measures it has taken to prevent damage to health care facilities, the IDF defended its military operations. “A central feature of Hamas’ strategy is the exploitation of civilian structures for terror purposes,” says an IDF spokesperson. “It is against this context of widespread exploitation of medical facilities and intelligence indicating their knowledge and even participation in terror activities that Israel has apprehended and questioned individuals in Gaza, including medical staff. We reiterate that individuals found not to have been involved in terrorist activity are released after questioning.”

The IDF has alleged that Hamas was operating out of tunnels underneath Al-Shifa, the largest hospital in Gaza, thereby making it a legitimate target. IDF forces raided the hospital on November 15. The tunnels have not been proven to have had a military function, and the legality of that IDF military operation remains in dispute.

Even in cases where the military has leveraged civilian structures, combatants are expected to exercise what IHL dubs “proportionality” and “precaution,” meaning that any attack should be done such that civilian harms do not outweigh the military benefit. “This does not mean there’s free license to attack,” ICRC chief legal officer Cordula Droege said in an ICRC video posted November 2 on X. “The party to the conflict has to do everything feasible in order to avoid or at least minimize harm to patients and medical staff.”

Although the destruction of health care facilities in Gaza is far more extensive, the WHO also recorded “33 attacks on health care in Israel during the violent events of October 7.” The WHO cautioned Hamas and Israel to remember “their obligation under international humanitarian law to respect the sanctity of, and actively protect, health facilities.” An independent UN Human Rights Council commission also says it is “collecting and preserving evidence of war crimes committed by all sides since 7 October 2023.”

The implications for Gaza’s health system have been disastrous. Even in the earliest weeks of the conflict, doctors warned that hospitals were running out of space to treat the wounded and were operating without access to anesthetics or even clean water. Hospitals and the health care system have also seen continued destruction. On January 3, the WHO estimated that only 13 of the 36 hospitals in Gaza remained operational. The WHO also says that instances of disease in Gaza have skyrocketed as access to health care, food, and clean water has plummeted.

Poole says she hopes the research leads to further investigations to “ascertain whether or not the medical complexes were getting distinction, proportionality, and precaution principles that protects them through IHL” throughout the course of the conflict.

“If the principle of distinction was being respected in this conflict, there would be a stark difference in our findings between special protected infrastructure—in this case, health facilities—and non-health facility infrastructure,” Raymond says. “What we find instead is that there is no difference.”

_Update: 2/12/2024, 8:40 am ET to clarify the description of the satellite material on which the researchers based their analysis._

Satellite Images Point to Indiscriminate Israeli Attacks on Gaza’s Health Care Facilities

Cyberattacks and criminal scams can impact anyone. But communities of color and other marginalized groups are often disproportionately impacted and lack the support to better protect themselves.

Talk about the promise and the peril of artificial intelligence is everywhere these days. But for many low-income families, communities of color, military veterans, people with disabilities, and immigrant communities, AI is a back-burner issue. Their day-to-day worries revolve around taking care of their health, navigating the economy, seeking educational opportunities, and upholding democracy. But their worries are also being amplified through advanced, persistent, and targeted cyberattacks.

Cyber operations are relentless, growing in scale, and exacerbate existing inequalities in health care, economic opportunities, education access, and democratic participation. And when these pillars of society become unstable, the consequences ripple through national and global communities. Collectively, cyberattacks have severe and long-term impacts on communities already on the margins of society. These attacks are not just a technological concern—they represent a growing civil rights crisis, disproportionately dismantling the safety and security for vulnerable groups and reinforcing systemic barriers of racism and classism. The United States currently lacks an assertive response to deter the continued weaponization of cyber operations and to secure digital access, equity, participation, and safety for marginalized communities.

Health Care

Cyberattacks on hospitals and health care organizations more than doubled in 2023, impacting over 39 million people in the first half of 2023. A late-November cyberattack at the Hillcrest Medical Center in Tulsa, Oklahoma, led to a system-wide shutdown, causing ambulances to reroute and life-saving surgeries to be canceled. These attacks impact patients' reliance and trust in health care systems, which may make them more hesitant to seek care, further endangering the health and safety of already vulnerable populations.

The scale and prevalence of these attacks weaken public trust—especially among communities of color who already have deep-rooted fears about our health care systems. The now-condemned Untreated Syphilis Study at Tuskegee, where researchers denied treatment to Black men without their knowledge or consent in order to observe the disease’s long-term effects, only ended 52 years ago. However, the study created a legacy of suspicion and mistrust of the medical community that continues today, leading to a decrease in the life expectancy of Black men and lower participation in medical research among Black Americans. The compounding fact that Black women are three to four times more likely, and American Indian and Alaska Native women are two times more likely, to die from pregnancy-related causes than White women only adds to mistrust.

Erosion of trust also extends to low-income people. Over a million young patients at Lurie Children's Surgical Foundation in Chicago had their names, Social Security numbers, and dates of birth exposed in an August 2023 breach. The hospital treats more children insured by Medicaid—an economic hardship indicator—than any other hospital in Illinois. Once breached, a child’s personal data could be used to commit identity fraud, which severely damages credit, jeopardizes education financial aid, and denies employment opportunities. While difficult for anyone, children from financially insecure households are least equipped to absorb or overcome these economic setbacks.

Economic Opportunity

Identity theft is not the only way cyberattacks exploit hard times. Cyberattacks also go after financially vulnerable individuals—and they are getting more sophisticated. In Maryland, hackers targeted Electronic Benefits Transfer cards—used to provide public assistance funds for food—to steal more than $2 million in 2022 and the first months of 2023. That’s an increase of more than 2,100 percent compared to the $90,000 of EBT funds stolen in 2021. Maryland’s income limit to qualify for the government’s food assistance program is $39,000 for a family of four in 2024, and only if they have less than $2,001 in their bank account. Unlike a credit card, which legally protects against fraudulent charges, EBT cards don’t have fraud protections. Efforts to help the victims are riddled with red tape: reimbursements are capped at two months of stolen benefits, and only within a specific time period.

Cybercriminals also target vulnerable populations, especially within older age groups. Since the last reporting in 2019, 40 percent of Asian Pacific Islander Desi Americans (APIDAs) aged 50 and older have reported experiencing financial fraud, with one-third of those victims losing an average of $15,000. From 2018 through 2023, Chinese Embassy Scam robocalls delivered automated messages and combined caller ID spoofing, a method where scammers disguise their phone display information, targeting Chinese immigrant communities. This resulted in more than 350 victims across 27 US states and financial losses averaging $164,000 per victim for a total of $40 million. And for five years, this scam just kept going. As these scams evolve, groups now face increasingly sophisticated AI-assisted calls, where scammers use technology to convincingly mimic loved ones' voices, further exploiting vulnerabilities, particularly among older adults—many of whom live on fixed incomes or live with economic insecurity.

While social movements have fought to promote economic equity, cybercriminals undermine these efforts by exacerbating financial vulnerabilities. From the 1960s La Causa movement advocating for migrant worker rights to the Poor People’s Campaign mobilizing across racial lines, activists have worked to dismantle systemic barriers, end poverty, and push for fair wages. Current attacks on financial systems, however, often target the very groups these movements aim to empower—perpetuating the disparities that advocates have fought against. Digital scams and fraud incidents disproportionately impact those least equipped to recover—including natural disaster victims, people with disabilities, older adults, young adults, military veterans, immigrant communities, and lower-income families. By stealing essential resources, cybercriminals compound hardships for those already struggling to make ends meet or those experiencing some of the worst hardships of their lives—pushing groups deeper into the margins.

Education Access

Education is another area where cybercrime has soared. One of the worst hacks of 2023 exploited a flaw in a file transfer software called MOVEit that multiple government entities, nonprofits, and other organizations use to manage data across systems. This includes the National Student Clearinghouse, which serves 3,600 colleges, representing 97 percent of college students in the US, to provide verification information to academic institutions, student loan providers, and employers.

Attacks on educational systems are devastating at all levels. A top target for ransomware attacks last year was K-12 schools. While the complete data is not available yet, by August 2023 ransomware attacks (where hackers lock an organization’s data and demand payment for its release) hit at least 48 US school districts—three more than in all of 2022. Schools already have limited resources, and cybersecurity can be expensive, so many have few defenses against sophisticated cyberattacks.

The Hidden Injustice of Cyberattacks

“This eruption of violence had been brewing for years, through successive economic collapses, pandemics, and the utter dysfunction that had become American life.” An exclusive excerpt from 2054: A Novel.

2054, Part VI: Standoff at Arlington

Two researchers have improved a well-known technique for lattice basis reduction, opening up new avenues for practical experiments in cryptography and mathematics.

_The original version of_ _this story_ _appeared in_ Quanta Magazine_._

In our increasingly digital lives, security depends on cryptography. Send a private message or pay a bill online, and you’re relying on algorithms designed to keep your data secret. Naturally, some people want to uncover those secrets—so researchers work to test the strength of these systems to make sure they won’t crumble at the hands of a clever attacker.

One important tool in this work is the LLL algorithm, named after the researchers who published it in 1982—Arjen Lenstra, Hendrik Lenstra Jr. and László Lovász. LLL, along with its many descendants, can break cryptographic schemes in some cases; studying how they behave helps researchers design systems that are less vulnerable to attack. And the algorithm’s talents stretch beyond cryptography: It’s also a useful tool in advanced mathematical arenas such as computational number theory.

Over the years, researchers have honed variants of LLL to make the approach more practical—but only up to a point. Now, a pair of cryptographers have built a new LLL-style algorithm with a significant boost in efficiency. The new technique, which won the Best Paper award at the 2023 International Cryptology Conference, widens the range of scenarios in which computer scientists and mathematicians can feasibly use LLL-like approaches.

“It was really exciting,” said Chris Peikert, a cryptographer at the University of Michigan who was not involved in the paper. The tool has been the focus of study for decades, he said. “It’s always nice when a target that has been worked on for so long … shows that there’s still surprises to be found.”

LLL-type algorithms operate in the world of lattices: infinite collections of regularly spaced points. As one way of visualizing this, imagine you’re tiling a floor. You could cover it in square tiles, and the corners of those tiles would make up one lattice. Alternatively, you could choose a different tile shape—say, a long parallelogram—to create a different lattice.

A lattice can be described using its “basis.” This is a set of vectors (essentially, lists of numbers) that you can combine in different ways to get every point in the lattice. Let’s imagine a lattice with a basis consisting of two vectors: \[3, 2\] and \[1, 4\]. The lattice is just all the points you can reach by adding and subtracting copies of those vectors.

That pair of vectors isn’t the lattice’s only basis. Every lattice with at least two dimensions has infinitely many possible bases. But not all bases are created equal. A basis whose vectors are shorter and closer to right angles with one another is usually easier to work with and more useful for solving some computational problems, so researchers call those bases “good.” An example of this is the pair of blue vectors in the figure below. Bases consisting of longer and less orthogonal vectors—like the red vectors—can be considered “bad.”

Illustration: Merrill Sherman/Quanta Magazine

  
This is a job for LLL: Give it (or its brethren) a basis of a multidimensional lattice, and it’ll spit out a better one. This process is known as lattice basis reduction.

What does this all have to do with cryptography? It turns out that the task of breaking a cryptographic system can, in some cases, be recast as another problem: finding a relatively short vector in a lattice. And sometimes, that vector can be plucked from the reduced basis generated by an LLL-style algorithm. This strategy has helped researchers topple systems that, on the surface, appear to have little to do with lattices.

In a theoretical sense, the original LLL algorithm runs quickly: The time it takes to run doesn’t scale exponentially with the size of the input—that is, the dimension of the lattice and the size (in bits) of the numbers in the basis vectors. But it does increase as a polynomial function, and “if you actually want to do it, polynomial time is not always so feasible,” said Léo Ducas, a cryptographer at the national research institute CWI in the Netherlands.

In practice, this means that the original LLL algorithm can’t handle inputs that are too large. “Mathematicians and cryptographers wanted the ability to do more,” said Keegan Ryan, a doctoral student at the University of California, San Diego. Researchers worked to optimize LLL-style algorithms to accommodate bigger inputs, often achieving good performance. Still, some tasks have remained stubbornly out of reach.

The new paper, authored by Ryan and his adviser, Nadia Heninger, combines multiple strategies to improve the efficiency of its LLL-style algorithm. For one thing, the technique uses a recursive structure that breaks the task down into smaller chunks. For another, the algorithm carefully manages the precision of the numbers involved, finding a balance between speed and a correct result. The new work makes it feasible for researchers to reduce the bases of lattices with thousands of dimensions.

Past work has followed a similar approach: A 2021 paper also combines recursion and precision management to make quick work of large lattices, but it worked only for specific kinds of lattices, and not all the ones that are important in cryptography. The new algorithm behaves well on a much broader range. “I’m really happy someone did it,” said Thomas Espitau, a cryptography researcher at the company PQShield and an author of the 2021 version. His team’s work offered a “proof of concept,” he said; the new result shows that “you can do very fast lattice reduction in a sound way.”

The new technique has already started to prove useful. Aurel Page, a mathematician with the French national research institute Inria, said that he and his team have put an adaptation of the algorithm to work on some computational number theory tasks.

LLL-style algorithms can also play a role in research related to lattice-based cryptography systems designed to remain secure even in a future with powerful quantum computers. They don’t pose a threat to such systems, since taking them down requires finding shorter vectors than these algorithms can achieve. But the best attacks researchers know of use an LLL-style algorithm as a “basic building block,” said Wessel van Woerden, a cryptographer at the University of Bordeaux. In practical experiments to study these attacks, that building block can slow everything down. Using the new tool, researchers may be able to expand the range of experiments they can run on the attack algorithms, offering a clearer picture of how they perform.

_Original story_ _reprinted with permission from_ Quanta Magazine, _an editorially independent publication of the_ _Simons Foundation_ _whose mission is to enhance public understanding of science by covering research developments and trends in mathematics and the physical and life sciences._

A Celebrated Cryptography-Breaking Algorithm Just Got an Upgrade

Plus: China’s Volt Typhoon hackers lurked in US systems for years, the Biden administration’s crackdown on spyware vendors ramps up, and a new pro-Beijing disinformation campaign gets exposed.

Documents exclusively obtained by WIRED reveal that AI surveillance software tracked thousands of people using the London Underground to detect crime or unsafe situations. The machine learning software scoured live CCTV footage to spot aggressive behavior, weapons being brandished, and people dodging fares. The documents also detail errors made during the trial—for instance, mistakenly identifying children walking with their parents as fare evaders.

Meanwhile, on Wednesday, cryptocurrency tracing firm Chainalysis published a report finding ransomware payments in 2023 reached over $1.1 billion, the highest annual total ever recorded. The record-breaking sum of extorted funds was due to two things: the high number of ransomware attacks and the amount of money that hackers were demanding from victims, many of whom were targeted specifically for their ability to pay and their inability to sustain a prolonged disruption of services.

A tech company, notorious for keeping websites with far-right and other extreme content online, was bought last year by a secretive company whose business is to help set up businesses, often in ways that keep details of those companies secret, WIRED reported on Thursday. Registered Agents Inc.’s acquisition of Epik may allow the shadowy company to provide its customers with another layer of anonymity.

For the past month, senior security reporter Matt Burgess has been transitioning away from using passwords to log in to his hundreds of online accounts. Instead, he’s using passkeys, a more secure form of authentication that uses generated codes stored on your device to log in to websites and apps using a biometric identifier like a fingerprint, face scan, or PIN. When it works, it’s seamless and secure. When it doesn’t, it’s a mess.

WhatsApp is developing a feature to allow its users to message across apps, all while maintaining its secure end-to-end encryption. In theory, the move would allow users to chat with people on WhatsApp using apps like Signal or Telegram. It’s unclear which companies, if any, will link their services with WhatsApp.

And there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

Hackers have, in the real world, caused blackouts, set fire to a steel mill, and released worms that took down medical record systems in hospitals across the US and the UK. So it hardly seems necessary to invent new nightmares about them taking over our toothbrushes.

Yet, when the Swiss newspaper _Aargauer Zeitung_ published a story that cybercriminals had infected 3 million internet-connected toothbrushes with malware, then used them to launch a cyberattack that downed a website for four hours and caused millions of dollars in damage, the tale was somehow irresistible. This week, news outlets around the world picked up the story, which quoted the cybersecurity firm Fortinet as its source, spinning it out as the perfect illustration of how hackers can exploit the most mundane technology for epic malevolence. “This example, which seems like a Hollywood scenario, actually happened,” the Swiss newspaper wrote.

Except, of course, it didn’t. Cybersecurity professionals quickly started to point out that the story was unsupported by any evidence—and was somewhat absurd on its face. (Even the Mirai botnet, which knocked out its targets with record-breaking tsunamis of junk traffic and eventually broke a large fraction of the internet, infected only 650,000 internet-connected devices at its peak.)

Fortinet belatedly sought to correct the record, writing in public statements that “it appears that due to translations the narrative on this topic has been stretched to the point where hypothetical and actual scenarios are blurred.” But the _Aargauer Zeitung_ pointed the finger back at Fortinet, noting in a follow-up story that Fortinet provided exact details of the dental doomsday it described as real, and that the company even reviewed the text of the article prior to publication. Regardless of who’s to blame, at least this cyber urban legend has inspired some solid meme content.

Back to more factual cyber doomsday headlines: The US Federal Bureau of Investigation, National Security Agency, and Cybersecurity and Infrastructure Security Agency this week warned in a report that China’s hacker group known as Volt Typhoon had quietly maintained access to some US critical infrastructure networks for as long as half a decade. The report included detailed descriptions of the intrusion and persistence techniques used by the group, which has distinguished itself as perhaps China’s most aggressive state-sponsored hacking force. Volt Typhoon’s broad penetration of US electric grids, transportation networks, and other critical infrastructure has raised alarms among US federal agencies since as early as May of last year, when those agencies began to warn that the group appeared to be laying the groundwork for cyberwar-style attacks in the midst of any future conflict. Now it’s clear that those warnings came only years after the hackers’ sabotage preparations were well underway.

The Biden administration announced that it will restrict the visas of foreign sellers of commercial spyware, potentially preventing executives or associates of those surveillance firms from traveling to the US. The new regulation is part of the White House’s slow tightening of the screws on spyware seller firms like NSO Group, Cytrox, Intellexa, and Candiru, after an earlier move to place those firms on a Commerce Department trade blocklist and prevent US government agencies from buying those hacking firms’ tools. On the day of the announcement, Google released its own detailed report on alleged commercial spyware vendors, calling out a dozen of the companies by name and offering policy recommendations for protecting users.

Citizen Lab this week exposed a vast network of Chinese websites posing as local news sites across the globe, all used to post pro-Beijing disinformation and propaganda. The 123 sites, targeting audiences in more than 30 countries in Europe, Asia, and Latin America, mixed innocuous commercial and cut-and-pasted content with anti-Western conspiracy theories, such as allegations of human experimentation carried out by the United States in Southeast Asia, and targeted attacks on critics of the Chinese government. While the visibility and impact of the influence operation has been “negligible,” according to Citizen Lab, it’s another sign of China’s growing efforts to wield disinformation as a soft power tactic.

Source

Wired