The UK’s privacy regulator says the government did not take into account the intrusiveness of ankle tags that continuously monitor a person’s location.

The way the UK government has been tagging migrants with GPS trackers is illegal, the country’s privacy regulator ruled on Friday, in a rebuke to officials who have been experimenting with migrant-surveillance tech in both the UK and the US.

As part of an 18-month pilot that concluded in December, the UK interior ministry, known as the Home Office, forced up to 600 people who arrived in the country without permission to wear ankle tags that continuously tracked their locations. However, that pilot broke UK data protection law because it did not properly assess the privacy intrusion of GPS tracking or give migrants clear information about the data that was being collected, the UK’s Information Commissioner’s Office (ICO) said today. The ruling means the Home Office has 28 days to update its policies around GPS tracking.

Friday’s decision also means the ICO could fine the Home Office up to £17.5 million ($22 million) or 4 percent of its turnover—whichever is higher—if it resumes tagging people who arrive on the UK south coast in small boats from Europe. In 2023, over 29,000 people arrived using this often perilous route. Earlier this week, French rescue services said one person had died and two were missing after attempting to cross the English Channel, the stretch of water that separates England and France.

Critics of the GPS tags welcomed the decision. “Blanket 24/7 GPS surveillance of asylum seekers arriving in the UK runs diametrically opposed to data protection and privacy rights,” says Jonah Mendelsohn, a lawyer at Privacy International, a digital rights group that has campaigned against the tag. “The UK government’s gung-ho, Wild West approach in deploying deeply intrusive technology has through today’s decision collided with a rules-based system that we all have recourse to, regardless of our immigration status.” The Home Office did not respond to WIRED’s request for comment.

“Having access to a person’s 24/7 movements is highly intrusive, as it is likely to reveal a lot of information about them, including the potential to infer sensitive information such as their religion, sexuality, or health status,” said John Edwards, the UK information commissioner, in a statement. “Lack of clarity on how this information will be used can also inadvertently inhibit people’s movements and freedom to take part in day-to-day activities.”

The ICO did not rule that the Home Office had to delete migrants’ GPS data already stored in its systems. The regulator also left open the possibility that there may be a legal way to monitor migrants electronically, but not without data protections in place.

In UK courts, at least two cases revolving around GPS tags are awaiting judgment. In one, a 25-year-old former asylum seeker from Sudan, who was tagged by the Home Office as part of the pilot scheme after arriving in the UK via a small boat in May 2022, is challenging the regime for its disproportionate interference with his right to family and private life. Wearing the tag brought up painful memories of being bound and tortured during his journey to the UK, according to his lawyers at London firm Duncan Lewis, adding that his tag has since been removed.

Another case revolves around car mechanic Mark Nelson, who told WIRED that his experience wearing a GPS tag had been dehumanizing. “Our firm represents numerous individuals like Mark who are being electronically monitored,” says Katie Schwarzmann, a human rights lawyer at Wilsons Solicitors, who is representing Nelson. “In virtually all cases the Home Office has failed to provide evidence they have considered less-intrusive methods or explain why this draconian regime is necessary for immigration control.”

The UK is not the only country that is using GPS tracking devices as an alternative to immigration detention centers. Last year, the US Immigration and Customs Enforcement agency also announced it would start tracking migrants using GPS ankle tags and specially designed smartwatches.

The UK’s GPS Tagging of Migrants Has Been Ruled Illegal

The notorious LockBit gang promised a Georgia court leak "that could affect the upcoming US election.” It didn't materialize—but the story may not be over yet.

This week, the notorious ransomware gang known as LockBit threatened a kind of disruption that would have been a first even for a criminal industry that has crippled hospitals and triggered the shutdown of a gas pipeline: leaking documents from the criminal prosecution of a former president and presidential candidate.

Then, without explanation, that threat evaporated, leaving plenty of unanswered questions behind.

For the past five days, LockBit promised on its dark-web site to publish data stolen from the Fulton County, Georgia, government, which it listed as one of its extortion victims, unless the county paid an unspecified ransom. One administrator for the group went so far as to post the specific threat of releasing documents related to Fulton County's high-profile prosecution of Donald Trump: the Superior Court of Fulton County is the venue where Trump, the Republican presidential front-runner, stands accused of a criminal conspiracy to interfere in the 2020 election.

Yet when the hacker group's own deadline for that leak arrived, no documents appeared. Instead, LockBit mysteriously removed any mention of it from its website. Fulton County officials have denied paying a ransom—which leaves unanswered why the leak disappeared, and whether LockBit still holds any of the court's documents or ever did in the first place.

“We’re not aware of any data having been released today so far,” Fulton County Commission Chairman Robb Pitts said in a Thursday afternoon press conference. “Now that being said, that does not mean the threat is over by any means, and they could release whatever data they have at any time, today, tomorrow or any time in the future. We have no control over that."

The ransomware crew's threat, before it vanished, had been dramatically timed: It followed a coordinated law enforcement takedown operation targeting LockBit just last week. Known as Operation Chronos and led by the UK's National Crime Agency, the operation took control of much of LockBit's infrastructure, seized hundreds of its cryptocurrency wallets, tore down the dark-web sites it uses in its extortion campaigns, and even claimed to have compromised some of its members and partners. Just days later, however, LockBit managed to launch a new dark-web site, where it posted a list of victims along with countdown timers for each representing their deadline to pay a ransom before the hackers leaked their stolen data. The deadline for the Fulton County documents had been set for February 29 at 1:49 pm UTC.

On that relaunched site, one LockBit administrator also posted a lengthy screed accusing the FBI of timing the takedown specifically to prevent the release of the Trump-related Fulton County court documents—and promising to release them despite the bust if Fulton County didn't pay.

“The FBI decided to hack now for one reason only, because they didn't want to leak information from \[the Fulton County government website\],” the LockBit administrator wrote. “The stolen documents contain a lot of interesting things and Donald Trump's court cases that could affect the upcoming US election.”

The hacking-related paralysis of Fulton County's government, at least, seems to be very real: By its own admission, the county government is facing a serious and ongoing network disruption that looks very much like a ransomware attack. The website for Fulton County's government has noted in an alert on its homepage for nearly a week that it's “experiencing an unexpected IT outage currently affecting multiple systems” and that systems related to everything from phone lines to tax collection to courts had been affected. An official who answered the phone at the county's publicly listed phone line tells WIRED the outage had begun as early as late January. But a county government spokesperson declined WIRED's request for more information on the attack.

The LockBit hackers also posted some convincing sample documents that appeared to have been stolen from the Fulton County court systems prior to the takedown last week, according to Georgia-based reporter George Chidi, who wrote about the incident earlier this month. Chidi reported seeing documents that included court files and even documents under seal in specific cases, though none appeared to be related to Trump’s prosecution.

Then, on Wednesday, just hours before LockBit's deadline for the county to pay its ransom expired, the countdown timer for that leak on Lockbit's website froze, with an added line of text that read, “Timer stopped.” At the promised time of 1:49 PM UTC Thursday, the leak failed to materialize. Instead, all mention of Fulton County was removed from LockBit's extortion threat site.

In Thursday's press conference, Fulton County Chairman Rob Pitts denied that the county had paid Lockbit's extortion fee. “We have not paid any ransom, nor has any ransom been paid on our behalf,” Pitts said.

LockBit instead may well be bluffing—either it doesn't have the goods it claims or isn't ready to give up on its extortion demand. Robert McArdle, a researcher who leads a cybercrime-focused research team at security firm Trend Micro and was involved in the law enforcement operation against LockBit, says the group's thus-far empty threat is a sign that it was likely more disrupted by the bust than it wants to admit.

“This appears to be further evidence of the difficulties facing LockBit ever since Op Chronos took place, and should be considered as a sign they are unable to reliably follow through on their statements,” says McArdle. He points out that the victims listed on the group's new dark-web site were all compromised prior to Operation Chronos and that continuing to threaten them is the group's attempt to “appear as if everything is normal when most evidence points very much to the contrary.”

There remain other theories, however, that Lockbit might still possess the court's data but is seeking to use it in some other way. “They generally don't lie about victims, because they're so worried about their reputation,” says Jon DiMaggio, the ransomware-focused chief security strategist at cybersecurity firm Analyst1. He notes that the decision to take down the leak threat may have been the decision of the “affiliate” hackers who partner with LockBit to penetrate victims like Fulton County and may have different motivations from LockBit itself.

If Fulton County documents do remain in the hands of hackers, and if any of them relate to the Trump case, they could further complicate an already deeply messy trial. The state's case has been rocked by allegations that the prosecutor in the case, Fulton County district attorney Fanni Willis, had an improper affair with another prosecutor involved in Trump's prosecution, which the defense has argued should require Willis’ dismissal. The compromise of non-public documents in the case could make the proceedings—and the upcoming US presidential election—even more chaotic.

“We're watching with interest to see how the Fulton leak develops,” Trend Micro’s McArdle says. So, no doubt, will the US political sphere—including a certain former president.

_Additional reporting by Matt Burgess._

_Updated 2/29/2024, 4:15 pm EST with a statement from Fulton County Commission Chairman Robb Pitts._

The Mysterious Case of the Missing Trump Trial Ransomware Leak

Plus: Mozilla patches 12 flaws in Firefox, Zoom fixes seven vulnerabilities, and more critical updates from February.

CVE-2024-1553 and CVE-2024-1557 are memory-safety bugs rated as having a high severity. “Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code,” Mozilla researchers said.

Zoom

Video conferencing giant Zoom has issued fixes for seven flaws in its software, one of which has a CVSS score of 9.6. CVE-2024-24691 is an improper-input-validation bug in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows. If exploited, the issue may allow an unauthenticated attacker to escalate their privileges via network access, Zoom said in a security bulletin.

Another notable flaw is CVE-2024-24697, an untrusted-search-path issue in some Zoom 32 bit Windows clients that could allow an authenticated user with local access to escalate their privileges.

Ivanti

In January, Ivanti warned that attackers were targeting two unpatched vulnerabilities in its Connect Secure and Policy Secure products, tracked as CVE-2023-46805 and CVE-2024-21887. With a CVSS score of 8.2 the first authentication-bypass vulnerability in the web component of Ivanti Connect Secure and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

With a CVSS score of 9.1, the second command injection vulnerability in web components of Ivanti Connect Secure and Ivanti Policy Secure allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance. This vulnerability can be exploited over the internet.

At the end of the month, the firm alerted companies to another two serious flaws, one of which was being exploited in attacks. The exploited issue is a server-side request forgery bug in the SAML component tracked as CVE-2024-21893. Meanwhile, CVE-2024-21888 is a privilege-escalation vulnerability.

Patches were available by February 1, but the issues were deemed so serious that the US Cybersecurity and Infrastructure Security Agency (CISA) advised disconnecting all Ivanti products by February 2.

On February 8, Ivanti released a patch for yet another issue tracked as CVE-2024-22024, which prompted another CISA warning.

Fortinet

Fortinet has issued a patch for a critical issue with a CVSS score of 9.6, which it says is already being used in attacks. Tracked as CVE-2024-21762, the code-execution flaw impacts FortiOS versions 6.0, 6.2, 6.4, 7.0, 7.2 and 7.4. The out-of-bounds write vulnerability can be used for arbitrary code execution using specially crafted HTTP requests, Fortinet said.

It came just days after the firm released a patch for two issues in its FortiSIEM products, CVE-2024-23108 and CVE-2024-23109, rated as critical with a CVSS score of 9.7. The flaw in FortiSIEM Supervisor could allow a remote unauthenticated attacker to execute unauthorized commands via crafted API requests, Fortinet said in an advisory.

Cisco

Cisco has listed multiple vulnerabilities in its Expressway Series that could allow an unauthenticated, remote attacker to conduct cross-site request forgery attacks.

Tracked as CVE-2024-20252 and CVE-2024-20254, two vulnerabilities in the API of Cisco Expressway Series devices have been given a CVSS score of 9.6. “An attacker could exploit these vulnerabilities by persuading a user of the API to follow a crafted link,” Cisco said. “A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.”

SAP

Enterprise software firm SAP has released 13 security updates as part of its SAP Security Patch Day. CVE-2024-22131 is a code-injection vulnerability in SAP ABA with a CVSS score of 9.1.

CVE-2024-22126 is a cross-site scripting vulnerability in NetWeaver AS Java listed as having a high impact, with a CVSS score of 8.8. “Incoming URL parameters are insufficiently validated and improperly encoded before including them into redirect URLs,” security firm Onapsis said. “This can result in a cross-site scripting vulnerability, leading to a high impact on confidentiality and mild impact on integrity and availability.”

Here Are the Google and Microsoft Security Updates You Need Right Now

Several of the strikes occurred far from the front lines of the conflict, indicating possible war crimes. Researchers say the attacks likely had devastating impacts on civilians.

Last week marked the second anniversary of Russia’s full-scale invasion of Ukraine, a conflict that has been marked by multiple reports that Russia may have committed war crimes by indiscriminately targeting civilians and civilian infrastructure. During the first winter of the conflict, Russia pursued a strategy that US secretary of state Antony Blinken described as trying to “freeze \[Ukraine\] into submission” by attacking its power infrastructure, shutting citizens off from heat and electricity.

Now, using satellite imagery and open source information, a new report from the Conflict Observatory, a US-government-backed initiative between Yale University’s Humanitarian Research Lab, the Smithsonian Cultural Rescue Initiative, PlanetScape AI, and the mapping software Esri, offers a clearer picture of the scale of this strategy. Between October 1, 2022, and April 30, 2023, researchers found more than 200 instances of damage to the country’s power infrastructure, amounting to more than $8 billion in estimated destruction. Of the 223 instances identified in the report, researchers were able to confirm 66 of them with high confidence, meaning they were able to cross-reference the damage across multiple trustworthy sources and data points.

Courtesy of Yale Humanitarian Research Lab

“What we see here is that there was a pattern of bombardment that hit front lines and non-frontline areas, at a scale that must have had civilian effect,” says Nathaniel Raymond, a coleader of the Humanitarian Research Lab and lecturer at Yale’s Jackson School of Global Affairs. The UN Office for the Coordination of Humanitarian Affairs estimated at the time that attacks on Ukraine’s power grid had left “millions” of people without electricity throughout the country.

Researchers found and were able to identify and verify damage to power infrastructure in 17 of the country’s 24 oblasts, or administrative units.

Documenting specific instances of damage to power infrastructure has been particularly difficult for researchers and investigators, because the Ukrainian government has sought to limit public information about which sites have been damaged and which continue to be operational in an effort to prevent further attacks. (For this reason, the report itself avoids getting too specific about which locations it analyzed and the extent of the destruction.) But this can also make it difficult to collect, verify, and build upon the data necessary to prove violations of international law.

By making its methodology public, Raymond hopes that it will make further investigation possible. “Having common standards to a common dataset is a prerequisite for accountability,” he says.

Courtesy of Yale Humanitarian Research Lab

International humanitarian law prohibits attacks on civilians or civilian infrastructure, like schools or hospitals. But Oona Hathaway, professor of international law at Yale University, says that power stations and infrastructure can present a trickier question, because it’s often difficult, if not impossible, to tell whether power is being distributed to the military or civilians (oftentimes it’s both). This can sometimes make targeting power infrastructure legitimate, says Hathaway, but combatants need to consider how something like a sustained power outage or an explosion at a power plant could impact civilians. Unleashing “dangerous forces” by, say, bombing or opening a dam could also be a war crime.

“That is a clear violation, even if part of its infrastructure might be supporting both civilian and military purposes,” says Hathaway.

Russia has not only sought to damage Ukraine’s power infrastructure through physical attacks. In October 2022, during the same time period covered by the report, hackers from Russia’s GRU military intelligence unit known as Sandworm plunged an unknown number of Ukrainian civilians into a blackout during a missile strike. It is the third time Sandworm has caused a blackout in Ukraine with a cyberattack since 2015.

Courtesy of Yale Humanitarian Research Lab

While some of the attacks documented by the Conflict Observatory did indeed occur near the front lines, Raymond says that researchers found strikes as far away from the battlefield as the country’s westernmost city, Lviv. Of the strikes that Raymond and his team identified, 128 occurred in places that were not part of the conflict’s front lines at the times when they were attacked.

The report “indicates the attacks were deliberate and disproportionately harmed civilian populations, which, if true, would violate international humanitarian law and the laws of armed conflict,” says US state department spokesperson Russell Brooks. “Many of the affected areas are remote from the front lines of the war, calling into question whether the attacks served any justifiable military objective.”

Some Russian officials have claimed that Ukrainian infrastructure is a legitimate target. In December 2022, Russia’s foreign minister, Sergey Lavrov, asserted that by attacking the country’s energy grid it was making it harder for Ukraine to access weapons provided by Western countries. In other instances, Russian officials indicated that its attacks on the country’s electricity supply were “strikes of retribution,” according to Russian politician Boris Chernyshov.

“The justifications that Russian officials provided varied from arguments that they were legitimate military objectives to statements that pointed more toward civilian harm and general retaliation not grounded in a concrete and direct military objective,” says Raymond. “It was important to capture this, because it can be indicative of intent, even though the statements alone are not in themselves indicative of an international legal violation.”

Courtesy of Yale Humanitarian Research Lab

Hathway notes that several of the statements seem to indicate that Russia was intentionally targeting civilians as a way to pressure the Ukrainian government into conceding the conflict. “I think a lot of the comments are indicative of this unlawful purpose that Russia and certain Russian leaders and military officials may have had in the carrying out of these attacks,” she says.

Hathaway adds that while the report’s findings are not themselves evidence of war crimes, they provide a strong foundation for bodies like the Independent International Commission of Inquiry on Ukraine, whose work is still ongoing. “I would say it is kind of a roadmap for prosecutors.”

Russia Attacked Ukraine's Power Grid at Least 66 Times to ‘Freeze It Into Submission’

As Chinese automakers prepare to launch in the US, the White House is investigating whether cars made in China could pose a national security threat.

The US government has launched an investigation into the national security risks posed by foreign-made vehicles with internet connectivity—especially those made in China. At a briefing on Wednesday, Secretary of Commerce Gina Raimondo even raised the specter of Beijing remotely triggering mayhem on US highways.

“Imagine if there were thousands or hundreds of thousands of Chinese connected vehicles on American roads that could be immediately and simultaneously disabled by somebody in Beijing,” Raimondo said.

The new US government fears about Chinese autos come as automakers such as BYD and Geely have become major global players in car manufacturing—and particularly electric vehicles. They also build on evidence that as cars have become increasingly computerized, and connected to the internet, vehicles have become vulnerable to new security threats. Hackers have shown it is possible to disable internet-connected vehicles from afar. Automated driving systems and internet connectivity have added cameras and other sensors to vehicles, and can also make them mobile repositories of personal information.

Raimondo said that the Bureau of Industry and Security, a division of the Commerce Department that handles national security issues related to advanced technology, would explore how sensor-laden, internet-connected vehicles could be used to commit espionage, collect data on US citizens, or commit sabotage on US roads.

The alarm sounded about Chinese autos adds to a recent history of US government concern about China’s technology ambitions under President Joe Biden and under President Trump before him. Trump imposed sanctions on Chinese telecoms equipment maker Huawei and other 5G companies working on 5G wireless technology and targeted Chinese AI firms with similar controls. The Biden administration has aggressively restricted the flow of advanced chips into China. Concerns over sensitive US data passing back to China has led to a TikTok ban for most federal government devices.

The move comes as US automakers miss targets for EV sales, and as Chinese automakers such as BYD tout record global sales and build new factories. Many Chinese manufacturers are producing cars, and particularly EVs, more efficiently and profitably than their US counterparts, with billions in assistance from the central government.

In January, BYD overtook Tesla as the world’s leading manufacturer of EVs, according to figures released by the two companies. Last year, China became the world’s biggest car exporter.

“China is determined to dominate the future of the auto market, including by using unfair practices,” reads a statement from Biden released by the White House. “China’s policies could flood our market with its vehicles, posing risks to our national security. I’m not going to let that happen on my watch.”

Rising Power

China’s automakers are expected to soon begin a direct assault on the US market. Recent news reports suggest that Chinese automakers including BYD, MG, and Chery plan to manufacture their lower-cost electric vehicles in Mexico, enabling them to take advantage of North American trade treaties and evade US tariffs of 27.5 percent on imported Chinese autos.

The Alliance for American Manufacturing, a trade group, earlier this month called China a “significant” threat to US car manufacturers. It urged US policymakers to “adopt a proactive and evolving strategy to stymie the CCP’s penetration.”

Speaking at the briefing Wednesday, Lael Brainard, national economic adviser to the White House, described US automakers being on a competitive playing field that appears to be rapidly tilting in favor of Chinese automakers. “For years China has employed an array of subsidies and protections to build massive capacity in EV production,” Brainard said. “Chinese automakers are now flooding foreign markets with their autos.”

The security risks posed by vehicles have grown as they’ve become more computerized, more sensor-filled, and more connected. Anne Neuberger, the Biden administration’s deputy national security adviser for cyber, recently told WIRED that the US is working with allies to develop standards for autonomous vehicles that would address the risks they pose. Neurberger said the administration is concerned about Chinese autonomous vehicles that have been approved for testing on US roads.

Administration officials say that the investigation would extend to Chinese-made components and other technologies. This could include the lidar systems that use lasers to map roads and spot obstacles, a market in which Chinese companies are major players.

Officials note that China has imposed restrictions on connected vehicles from US companies. Tesla cars are reportedly restricted from driving in military- and government-affiliated areas, including meeting halls and exhibition centers, for instance.

The move will risk ratcheting up tension between the US and China. If the action leads to trade restrictions, it could be met with counter restrictions from Beijing. “We'll have to wait to see what China's retaliation might be,” a senior administration official said.

The White House Warns Cars Made in China Could Unleash Chaos on US Highways

Every time someone in the UK searched for child abuse material on Pornhub, a chatbot appeared and told them how to get help.

For the past two years, millions of people searching for child abuse videos on Pornhub’s UK website have been interrupted. Each of the 4.4 million times someone has typed in words or phrases linked to abuse, a warning message has blocked the page, saying that kind of content is illegal. And in half the cases, a chatbot has also pointed people to where they can seek help.

The warning message and chatbot were deployed by Pornhub as part of a trial program, conducted with two UK-based child protection organizations, to find out whether people could be nudged away from looking for illegal material with small interventions. A new report analyzing the test, shared exclusively with WIRED, says the pop-ups led to a decrease in the number of searches for child sexual abuse material (CSAM) and saw scores of people seek support for their behavior.

“The actual raw numbers of searches, it’s actually quite scary high,” says Joel Scanlan, a senior lecturer at the University of Tasmania, who led the evaluation of the reThink Chatbot. During the multiyear trial, there were 4,400,960 warnings in response to CSAM-linked searches on Pornhub’s UK website—99 percent of all searches during the trial did not trigger a warning. “There’s a significant reduction over the length of the intervention in numbers of searches,” Scanlan says. “So the deterrence messages do work.”

Millions of images and videos of CSAM are found and removed from the web every year. They are shared on social media, traded in private chats, sold on the dark web, or in some cases uploaded to legal pornography websites. Tech companies and porn companies don’t allow illegal content on their platforms, although they remove it with different levels of effectiveness. Pornhub removed around 10 million videos in 2020 in an attempt to eradicate child abuse material and other problematic content from its website following a damning _New York Times_ report.

Pornhub, which is owned by parent company Aylo (formerly MindGeek), uses a list of 34,000 banned terms, across multiple languages and with millions of combinations, to block searches for child abuse material, a spokesperson for the company says. It is one way Pornhub tries to combat illegal material, the spokesperson says, and is part of the company’s efforts aimed at user safety, after years of allegations it has hosted child exploitation and nonconsensual videos. When people in the UK have searched for any of the terms on Pornhub’s list, the warning message and chatbot have appeared.

The chatbot was designed and created by the Internet Watch Foundation (IWF), a nonprofit which removes CSAM from the web, and the Lucy Faithfull Foundation, a charity which works to precent child sexual abuse. It appeared alongside the warning messages a total of 2.8 million times. The trial counted the number of sessions on Pornhub, which could mean people are counted multiple times, and it did not look to identify individuals. The report says there was a “meaningful decrease” in searches for CSAM on Pornhub and that at least “in part” the chatbot and warning messages appear to have played a role.

The chatbot was relatively simple: It asked people a series of questions, allowing them to click buttons to answer or type out a response. Ultimately, it explained that the material people were searching for may be illegal and pointed them toward the Lucy Faithfull Foundation’s help services. There were 1,656 requests for more information made through the chatbot, while 490 people clicked through to the charity’s Stop It Now website. Around 68 people called or chatted with Lucy Faithfull’s confidential helpline, the report says.

Donald Findlater, the director of the Stop It Now helpline, says that while the numbers are “relatively modest” compared to the overall number of warnings displayed, they are still seen as a “big success” as it’s a sign that people may want to get help. “If people have been doing something dodgy on a site, clicking through is quite a bold step to make,” Findlater says.

The vast majority of people who received the warning message and chatbot did so only once, the report says. Around 1.7 million people saw a warning before leaving Pornhub or making other searches related to legal material. “They didn't just disappear. They typically remained on the site and looked for other stuff,” Findlater says. “The influence for the millions of people that actually did a dubious search and then stopped doing that dubious search is a big win.” Not everyone was deterred, however. In the most persistent cases, around 400 people made 10 searches that triggered the message.

Cynthia Najdowski, an associate professor of psychology at the State University of New York at Albany, who was not involved in the research, says the chatbot appears to show promise for interrupting some people’s efforts to access CSAM. Warning messages and small behavioral nudges have been used in multiple ways to change people’s behavior online, from piracy and copyright infringement to gambling. Google has used some deterrence messages around child abuse searches since 2013, and other studies have found decreases in searches and millions of views or warnings.

Najdowski says there are three things known about deterring people from engaging in criminal behavior: People must know what they’re doing is illegal; they need to apply that “legal knowledge” to their own behavior; and they need to believe the cost of the behavior may outweigh any benefits they expect. “A chatbot that delivers notice of the potential illegality of certain searches can certainly accomplish the first step in the deterrence process, and that alone is a significant contribution,” Najdowski says. It may struggle to help cases where people are more persistent in their behavior or more complex scenarios though.

Scanlan, who conducted the analysis into the chatbot trial, says there were some complexities with the work. The data provided by Pornhub, the IWF, and the Lucy Faithfull Foundation wasn’t always complete, and there weren’t any figures from before the warnings were introduced to compare the results against. However, Scanlan says the results show the method could be one part of broader education and deterrence efforts against people finding CSAM online. “If someone's doing that sort out of curiosity, you want to nudge them away from it before they get involved in it, because we can't arrest our way out of the problem,” Scanlan says.

Scanlan’s findings say that over time, the web traffic being referred to the Stop It Now website appeared to decrease, perhaps as people who continued to search became used to the messaging. However, helpline calls, emails, and online chats showed an increase over the duration of the trial. The report says that in the future, a variety of messages could be used—potentially including existing deterrence videos—and the chatbot could directly connect people to a live chat session with Lucy Faithfull’s helpline.

The chatbot itself could also be improved. Since it was initially designed and created, says Dan Sexton, the chief technology officer at the IWF, generative AI has changed people’s perceptions of what chatbots are and how they interact with people. The reThink Chatbot could respond to only a limited number of queries. Sexton says there may be ways to make the chatbot more approachable and better handle questions it was not programmed to deal with.

While the trial period has ended, the chatbot and warnings are still in place on Pornhub’s UK website. “There's certainly no plans to turn it off. It is in production. It was a pilot project, but it is having an effect right now,” Sexton says. Those involved in the study say that other porn companies could look to introduce similar nudges across their services and deter people from looking for child abuse content. “They all should be doing this; it should become the norm,” Scanlan says. “This report and technology are significant steps forward in identifying, removing, and reporting harmful and illegal content,” a spokesperson for Pornhub says. “We feel all other major tech and social media platforms should explore the implementation of similar deterrence technology to create a safer internet for all.”

Findlater, from the Stop It Now helpline, says he hopes other companies, such as social media websites and file-hosting platforms, can look at the results of the trial and introduce similar nudges where people are seeking CSAM. “The more places you can put it, the greater chance you're going to catch those people that might be at a stage where they can still be helped, or those people that are looking for help but don't know about it,” Sexton says.

A Pornhub Chatbot Stopped Millions From Searching for Child Abuse Videos

The White House issued an executive order on Wednesday that aims to prevent the sale of Americans' data to “countries of concern,” including China and Russia. Its effectiveness may vary.

US president Joe Biden will sign an executive order on Wednesday aimed at preventing a handful of countries, including China, North Korea, and Russia, from purchasing sensitive information about Americans through commercial data brokers in the United States.

Administration officials say categories of sensitive data, including personal identifiers, precise location information, and biometrics—vital tools for waging cyberattacks, espionage, and blackmail operations against the US—are being amassed by what the White House is calling “countries of concern.”

Biden administration officials disclosed the order to reporters in advance during a Zoom call on Tuesday and briefly took questions, on the condition that they not be named or referred to by job title.

The order will have few immediate effects, they said. The US Justice Department will instead launch a rulemaking process aimed at mapping out a “data security program” envisioned by the White House. The process affords experts, industry stakeholders, and the public at large an opportunity to chime in prior to the government adopting the proposal.

White House officials said the US Attorney General would consult with the heads of the Department of State and Department of Commerce to finalize a list of countries falling under the eye of the program. A tentative list given to reporters during Tuesday’s call, however, included China, Cuba, Iran, North Korea, Russia, and Venezuela.

The categories of information covered by the program will include health and financial data, precise geolocation information, and “certain sensitive government-related data,” among others, the officials said. The order will contain several carve-outs for certain financial transactions and activities that are “incidental” to ordinary business operations.

It’s unclear to what degree such a program would be effective. Notably, it does not extend to a majority of countries where trafficking in Americans’ private data will ostensibly remain legal. What’s more, it’s unclear whether the government has the authority or wherewithal (outside of an act of Congress) to restrict countries that, while diplomatically and militarily allied with the US, are also known to conduct espionage against it: close US ally Israel, for instance, was accused in 2019 of planting cell-phone-spying devices near the White House, and has served as an international marketplace for illicit spyware; or Saudi Arabia, which availed itself of that market in 2018 to covertly surveil a _Washington Post_ contributor who was later abducted and murdered by a Saudi hit squad.

If China, Russia, or North Korea moves to obtain US data from a third party in one of the more than 170 countries not on the US government’s list, there may be little to prevent it. US data brokers need only take steps to ensure overseas customers follow “certain security requirements” during the transfer, many of which are already required by law.

The restrictions imposed by the executive order are meant to protect against “direct” and “indirect transfers of data,” officials said. But data brokers are on the hook merely until they obtain “some type of commitment" from overseas customers—an “understanding”—when it comes to the possibility of data being sold or transferred to others down the line.

Biden Executive Order Bans Sale of US Data to China, Russia. Good Luck

Canada-based Sandvine has long sold its web-monitoring tech to authoritarian regimes. This week, the US sanctioned the company, severely limiting its ability to do business with American firms.

When the Egyptian government shut down the internet in 2011 to give itself cover to crush a popular protest movement, it was Nora Younis who got the word out. Younis, then a journalist with daily newspaper _Al-Masry Al-Youm_, found a working internet connection at the InterContinental Cairo Semiramis Hotel that overlooked Tahrir Square, the heart of the protests. From the balcony, she filmed as protesters were shot and run down with armored vehicles, posting the footage to the newspaper’s website, where it was picked up by global media.

In 2016, with Egypt having slid back into the authoritarianism that prompted the uprising, Younis launched her own media platform, Al-Manassa, which combined citizen journalism with investigative reporting. The following year, Almanassa.com suddenly disappeared from the Egyptian internet, along with a handful of other independent publications. It was still available overseas, but domestic users couldn’t see it. Younis’ team moved their site to a new domain. That, too, was rapidly blocked, so they moved again and were blocked again. After three years and more than a dozen migrations to new domains and subdomains, they asked for help from the Swedish digital forensics nonprofit Qurium, which figured out how the blocks were being implemented—using a network management tool provided by a Canadian tech company called Sandvine.

Sandvine is well known in digital rights circles, but unlike leading villains of the spyware world such as NSO Group or Candiru, it’s often floated below the eyeline of lawmakers and regulators. The company, owned by the private equity group Francisco Partners, mainly sells above-board technology to internet service providers and telecom companies to help them run their networks. But it has often sold that technology to regimes that have abused it, using it to censor, shut down, and surveil activists, journalists, and political opponents.

On Monday, after years of lobbying from digital rights activists, the US Department of Commerce added Sandvine to its Entity List, effectively blacklisting it from doing business with American partners. The department said that the company’s technology was “used in mass-web monitoring and censorship” in Egypt, “contrary to the national security and foreign policy interests of the United States.” Digital rights activists say it’s a major victory because it shows that companies can’t avoid responsibility when they sell potentially dangerous products to clients who are likely to abuse them.

“Better late than never,” Tord Lundström, Qurium’s technical director, says. “Sandvine is a shameless example of how technology is not neutral when seeking profit at all costs.”

”We are aware of the action announced by the US Commerce Department, and we’re working closely with government officials to understand, address, and resolve their concerns,” says Sandvine spokesperson Susana Schwartz. “Sandvine solutions help provide a reliable and safe internet, and we take allegations of misuse very seriously.”

Sandvine’s flagship product is deep packet inspection, or DPI, a common tool used by ISPs and telecom companies to monitor traffic and prioritize certain types of content. DPI lets network administrators see what’s in a packet of data flowing on the network in real time, so it can intercept or divert it. It can be used, for example, to give priority to traffic from streaming services over static web pages or downloads, so that users don’t see glitches in their streams. It has been used in some countries to filter out child sexual abuse images.

Dictators Used Sandvine Tech to Censor the Internet. The US Finally Did Something About It

Two months ago, the FBI “disrupted” the BlackCat ransomware group. They're already back—and their latest attack is causing delays at pharmacies across the US.

Six days before Christmas, the US Department of Justice loudly announced a win in the ongoing fight against the scourge of ransomware: An FBI-led, international operation had targeted the notorious hacking group known as BlackCat or AlphV, releasing decryption keys to foil its ransom attempts against hundreds of victims and seizing the dark web sites it had used to threaten and extort them. “In disrupting the BlackCat ransomware group, the Justice Department has once again hacked the hackers,” deputy attorney general Lisa Monaco declared in a statement.

Two months and one week later, however, those hackers don't appear particularly “disrupted.” For the last seven days and counting, BlackCat has held hostage the medical firm Change Healthcare, crippling its software in hospitals and pharmacies across the United States, leading to delays in drug prescriptions for an untold number of patients.

The ongoing outage at Change Healthcare, first reported to be a BlackCat attack by Reuters, represents a particularly grim incident in the ransomware epidemic not just due to its severity, its length, and the potential toll on victims' health. Ransomware-tracking analysts say it also illustrates how even law enforcement's wins against ransomware groups appear to be increasingly short-lived, as the hackers that law enforcement target in carefully coordinated busts simply rebuild and restart their attacks with impunity.

“Because we can't arrest the core operators that are in Russia or in areas that are uncooperative with law enforcement, we can't stop them,” says Allan Liska, a ransomware-focused researcher for cybersecurity firm Recorded Future. Instead, Liska says, law enforcement often has had to settle for spending months or years arranging takedowns that target infrastructure or aid victims, but without laying hands on the attacks' perpetrators. “The threat actors just need to regroup, get drunk for a weekend, and then start right back up,” Liska says.

In another, more recent bust, the UK's National Crime Agency last week led a broad takedown effort against the notorious Lockbit ransomware group, hijacking its infrastructure, seizing many of its cryptocurrency wallets, taking down its dark web sites, and even obtaining information about its operators and partners. Yet less than a week later, Lockbit has already launched a fresh dark web site where it continues to extort its victims, showing countdown timers for each one that indicate the remaining days or hours before it dumps their stolen data online.

None of that means law enforcement's BlackCat or Lockbit operations haven't had some effect. BlackCat listed 28 victims on its dark web site for February so far, a significant drop from the 60-plus Recorded Future counted on its site in December prior to the FBI's takedown. (Change Healthcare isn't currently listed among BlackCat's current victims on its site, though the hackers reportedly took credit for the attack, according to ransomware-tracking site Breaches.net. Change Healthcare also didn't respond to WIRED's request for comment on the cyberattack.)

Lockbit, for its part, may be hiding the extent of its disruption behind the bluster of its new leak site, argues Brett Callow, a ransomware analyst at security firm Emsisoft. He says that the group is likely downplaying last week's bust in part to avoid losing the trust of its affiliate partners, the hackers who penetrate victim networks on Lockbit's behalf and might be spooked by the possibility that Lockbit has been compromised by law enforcement.

Nonetheless, Callow says, ransomware actors “do seem to be bouncing back faster.” That's only to be expected, he argues, when the hackers aren't in custody and the money to be made provides the resources and the incentive to simply get back to work, even after seizures or disruptions. In 2023, he notes, cryptocurrency tracing firm Chainalysis pegged total ransoms paid by victims at a record-breaking $1.1 billion. “It's inevitable that groups are going to try harder to maintain their share of that massively profitable industry,” Callow says.

When the FBI targeted BlackCat in December, for instance, the group immediately posted on a newly launched dark web site a message to its partners, promising a higher rate of payment and removing all restrictions on potential victims, other than those in the former Soviet Union, a typical rule for Russia-based cybercriminals. The message suggested its affiliate hackers could now target “hospitals, nuclear power plants, anything and anywhere.” (In fact, the rule change was at least in part a scare tactic, says Recorded Future's Liska—BlackCat had targeted hospitals before.)

Ransomware groups' quick recoveries from recent law enforcement operations contrast with earlier cases when actual arrests were made—almost always arrests of ransomware group members or partners outside of Russia. Those cases, like the arrest of a suspect in Florida who was allegedly associated with the Scattered Spider group that targeted MGM Casinos last year, had far more permanent effects.

Even some past takedowns that _didn't_ include arrests, however, have put longer-lasting dents in the ransomware economy. The FBI's hijacking of infrastructure belonging to the Hive ransomware group early last year led to a nearly year-long disappearance of the group before it resurfaced under the name Hunters International, says Jackie Burns Koven, Chainalysis's head of cyber threat intelligence. Chainalysis estimates the Hive operation averted more than $210 million in total ransoms paid.

Ransomware groups may be rebuilding faster over time in part due to the increasing sophistication of the ransomware economy, Burns Koven says. Hackers who have been targeted in disruption operations can now quickly purchase access to malware or other tools, crime-friendly hosting providers, or even buy their way into breached organizations from other hackers who act as “access brokers.” But Burns Koven also notes that law enforcement operations help to degrade that economy by creating divisions between hackers. In the wake of the Lockbit takedown, for instance, the cybercriminal marketplace Breached Forum banned the sale of ransomware tools and services in an apparent attempt to avoid law enforcement's scrutiny. “What these operations do is degrade trust among members and cause operational friction,” she says.

All of that suggests that law enforcement disruption campaigns serve a purpose. But they won't solve the ransomware problem on their own, argues Emsisoft's Callow. The larger solution, he says, will have to include improved security for potential victim organizations, sanctions on ransomware actors and those associated with them, tighter regulations on cryptocurrency, and perhaps even laws banning ransomware payments—a controversial proposal.

“Disruption efforts alone aren’t likely to represent a solution to the ransomware problem. Rather, they need to be part of a multi-pronged strategy,” says Callow. “Tightening the screws on every single bit of the ransomware ecosystem.”

Change Healthcare Ransomware Attack: BlackCat Hackers Quickly Returned After FBI Bust

Ankle tags that constantly log a person’s coordinates are part of a growing cadre of experimental surveillance tools that countries around the world are trying out on new arrivals.

Mark Nelson took the call in an immigration detention center—a place that, to him, felt just like prison. It had the same prison windows, the same tiny box rooms. By the time the phone rang, he’d already spent 10 days detained there, and he was wracked with worry that he would be forced onto a plane without the chance to say goodbye to his kids. So when his lawyers relayed the two options available under UK law—either stay in detention indefinitely or go home wearing a tracking device—it didn’t exactly feel like a choice. “That’s being coerced,” says Nelson, who moved from Jamaica to the UK more than 20 years ago. He felt desperate to get out of there and go home to his family—even if a GPS tag had to come too.

It was May 2022 when the contractors arrived at Colnbrook Detention Center, on the edge of London’s Heathrow Airport, to fit the device. Nelson knew the men were with the government’s Electronic Monitoring Service, but he didn’t know their names or the company they worked for. Still, he followed them to a small room, where they measured his leg and locked the device around his ankle. Since then, for almost two years, Nelson has been accompanied by the tag wherever he goes. Whether he is watching TV, taking his kids to school, or in the shower, his tag is continuously logging his coordinates and sending them back to the company that operates the tag on behalf of the British government.

Nelson lifts up his trousers to reveal the tag, wrapped around his leg, like a giant gray leech. He chokes down tears as he describes the impact the device has had on his life. “It’s depressing,” he says, being under constant surveillance. “Right through this process, it’s like I’m not a human anymore.”

In England and Wales, since 2019, people convicted of knife crime or other violent offenses have been ordered to wear GPS ankle tags upon their release from prison. But requiring anyone facing a deportation order to wear a GPS tag is a more recent and more controversial policy, introduced in 2021. Nelson wears a tag because his right to remain in the UK was revoked following his conviction for growing cannabis in 2017—a crime for which he served two years of a four-year sentence. But migrants arriving in small boats on the coast of southern England, with no previous convictions, were also tagged during an 18-month pilot program that ended in December 2023. Between 2022 and 2023, the number of people ordered to wear GPS trackers jumped by 56 percent to more than 4,000 people, according to research by the Public Law Project, a legal nonprofit.

“Foreign nationals who abuse our hospitality by committing crimes in the UK should be in no doubt of our determination to deport them,” a Home Office spokesperson tells WIRED. “Where removal isn’t immediately possible, electronic monitoring can be used to manage foreign national offenders and selected others released on immigration bail.” The Home Office, the UK’s interior ministry, declined to answer questions on “operational details,” such as whether GPS coordinates are being tracked in real time and for how long the Home Office stores individuals’ location data. “This highly intrusive form of surveillance is being used to solve a problem that does not exist,” says Jo Hynes, a senior researcher at the Public Law Project. GPS tags are designed to prevent people facing deportation orders from going on the run. But according to Hynes, only 1.3 percent of people on immigration bail absconded in the first six months of 2022.

Now, Nelson is the first person to challenge Britain’s GPS tagging regime in a high court, arguing that the tags are a disproportionate breach of privacy. A judgment on the case is expected any day now, and critics of GPS tagging hope the decision will have ripple effects throughout the British immigration system. “A judgment in Mark’s favor could take quite a lot of different forms,” says Jonah Mendelsohn, a legal officer at data rights group Privacy International. He adds that the court could force the Home Office to stop tagging migrants altogether, or it could limit the amount of data the tags collect. “It could set a precedent.”

The GPS tags are part of an intensifying surveillance regime that migrants and refugees are now subject to in the UK, the US, and Australia, says Mendelsohn. “There is so much tech that’s being rolled out and used almost in an experimental lab-esque way,” he says, pointing to how migrants arriving in Britain on small boats have been told to hand over their phones and pin codes or fitted with bar-coded wristbands. “GPS tracking is just one aspect of that.”

Allegations that the tags are prone to malfunction also aggravate the stress people feel while wearing them, Mendelsohn says. By law, the tags can’t be removed. But they still need charging, either by being plugged into a socket or a portable battery pack. Nelson’s first tag would run out of battery every two hours, he claims, meaning he could never travel far from a plug socket—failure to charge a tag can count as a breach of immigration bail conditions, risking return to a detention center.

The battery was just one in a series of problems, Nelson claims. Between November 2022 and May 2023, he believes his tag was no longer logging his GPS coordinates, with his legal team at Wilsons Solicitors arguing this proved the tag was redundant and should be removed. But until now, the Home Office has refused to take off the tag. “\[They said\] the law is the law and I’m subject to the law,” says Nelson. “So I’ve got to wear this broken tag whether it works or not.” The company that monitors and maintains the tags on behalf of the government since 2014, Capita Business Services, did not reply to WIRED’s request to comment.

Nelson might have been the first person to challenge the GPS tagging regime in court. But others were close behind. British law firm Duncan Lewis Solicitors is representing another four people forced to wear GPS tags, ranging from EU citizens to people who arrived in the UK on small boats. “Such surveillance of vulnerable individuals is not necessary in any democratic society, and we are proud to represent these claimants in their fight against this poorly run and dystopian regime,” says Conor Lamb, who works in the public law department at Duncan Lewis.

One of the people whom Duncan Lewis is representing is a 25-year-old former asylum seeker from Sudan who arrived in the UK via a small boat and has no criminal history, according to his lawyers. The tag brought up painful memories of being bound and tortured during his journey to the UK, they argued in court. After two psychiatric reports were submitted to the government, the tag was taken off and his data deleted. Despite that, the man, who uses the pseudonym ADL, remains part of the court case in order to challenge the practice of tagging new arrivals.

Meanwhile, Nelson is still waiting for his tag to be taken off. He’s frustrated that he has to wear the tag despite already having served his time in prison. “Before all of this, I was social,” he says. Now, he says, he’s too self-conscious to go out much, in case others see the tag and mistake him for the perpetrator of a violent crime. He describes how the tag has left him feeling “up and down,” as if he has no good choices left. “In order for me to see my family and to be part of my family, I’m still being forced into 24/7 monitoring, someone watching me and watching what I do, every day.”

Source

Wired