Far-right influencers and right-wing lawmakers are using the spread of Osama bin Laden’s “Letter to America” to call for a TikTok ban and boost decades old conspiracies.

A number of users have posted TikToks in recent days that share parts of Osama bin Laden’s 2002 “Letter to America,” where the deceased al Qaeda leader said the attacks on September 11, 2001, were justified. Posters used it to critique US foreign policy and have claimed that the letter changed their perspective. But while some have questioned the actual virality of these posts as conversations about these TikToks exploded on Thursday evening, far-right lawmakers and influencers have used the renewed interest in bin Laden to spread conspiracy theories about 9/11 and push their own anti-China agenda.

On his Thursday podcast, right-wing commentator and conspiracist Glenn Beck compared the TikTok posts to “the Antichrist forming,” and claimed the phenomenon shows “the terrifying threat America continues to face from global powers.” He then compared bin Laden’s worldview “to modern leftist talking points.”

Charlie Kirk, president of Turning Point USA, boosted conspiracies about public education. “Why is everyone shocked \[that\] a generation taught to hate America would embrace Osama Bin Laden?” Kirk wrote on Telegram.

One of his followers replied: “Not shocked. We as a whole let this crap happen in our ‘higher’ education. We did not pay attention to the way the marxists infiltrated and thought it was just going to go away. Not anymore!”

The issue has also led to renewed calls for TikTok to be banned by right-wing lawmakers who have repeatedly claimed, without evidence, that TikTok is used by the Chinese government to spy on US citizens.

“TikTok is an espionage tool and a propaganda machine for the Communists. First pro-Hamas propaganda, now bin Laden?” Senator Josh Hawley from Missouri wrote on X, the website formerly known as Twitter, on Thursday night. “The CCP probably can’t believe we’re letting them get away with it. Ban TikTok.”

Similar calls were repeated elsewhere on X and on platforms home to pro-Trump far-right extremists. The top post on the message board known as The Donald this morning read, “Either get rid of TikTok or surrender to China,” and linked to an article that claimed the bin Laden trend was a Chinese government plot to undermine US democracy.

On Telegram, a number of QAnon influencers and far-right figures used the renewed interest in the al Qaeda leader to boost conspiracy theories around the 9/11 terrorist attacks. “A lot of grown ass adults still don't question 9/11 being an inside job,” QAnon influencer Jordan Sather wrote on Telegram. “The CIA and Mossad perpetrated 911,” a follower of right-wing commentator Jack Posobiec wrote in response to a link Posobiec shared about the TikTok trend, adding: “Bin Laden was their MKUltra puppet and was protected in hiding.”

Still, it is unclear what sparked the sharing of bin Laden’s letter.

Based on a review of TikTok conducted by WIRED before the platform began removing videos, the first video directing viewers to read bin Laden’s letter was posted on Friday, November 10, by an account with just 3,800 followers. The video has only been viewed 1,133 times as of the morning of Friday, November 17, with just 12 comments.

The account is, however, quite prolific, and posts up to a dozen videos each day, most of which are reposted from other accounts. The account holder appears to be an avid Trump supporter, and they share questionable content including conspiracy theories mostly linked to president Joe Biden. One video shared this week suggested that Biden was in fact a body double.

Unlike some of the later videos, which garnered many more views, this account holder didn’t read any of the content of the letter, simply telling their followers: “It’s too much to say, but I need for you guys to go and google Osama bin Laden’s “Letter to America,” and read it. It will explain a lot.”

The video was posted 24 hours after searches for the bin Laden letter spiked, according to data from Google Trends. The account holder did not respond to WIRED’s request for comment on how they learned about the letter. (A TikTok spokesperson told WIRED that the company was removing the November 10 video after WIRED had flagged it, and WIRED can confirm the video has now been removed.)

Bin Laden’s letter did not gain much attention on TikTok until Monday, November 13, when another TikTok user posted a video urging people to go and read the letter. Again, this video, from an account with 12,800 followers, did not read specific lines from the letter, but showed the poster apparently in shock upon discovering the letter’s contents.

This video gained a lot more attention, racking up over 210,000 views before it was taken down on Thursday. Numerous other accounts tagged or referenced this video in their own “Letter to America” videos in the following days.

The account holder, who didn’t respond to a question from WIRED asking where she first heard about the letter, posted a follow-up video on Wednesday, November 15, explaining that she had heard about the bin Laden video over the weekend but didn’t have time to post about it until Monday, November 13, though she failed to say where she had seen it referenced.

Then, on Wednesday, _The Guardian_ removed an English translation of bin Laden’s letter from its website. The publication said they first noticed an uptick in traffic to the site on Thursday, November 9, but didn’t remove the letter until Wednesday, after videos about it were shared to TikTok.

“The transcript published on our website had been widely shared on social media without the full context,” a note on the website reads. “Therefore we decided to take it down and direct readers instead to the news article that originally contextualized it.”

After _The Guardian_ removed the letter, some accounts, including those on X, began sharing a link to a page on the website of the US Director of National Intelligence, which hosts a different letter written by bin Laden in 2008.

The removal of the letter sparked a flurry of new videos on TikTok criticizing _The Guardian_’s decision and claiming it was somehow evidence that bin Laden’s message was being censored, even though the letter is freely available elsewhere online.

The same day, journalist Yashar Ali shared a compilation of the TikTok videos on X, with the comment: “Many of them say that reading the letter has opened their eyes, and they’ll never see geopolitical matters the same way again.” As of Friday morning, that video on X has been viewed 37 million times.

“Content promoting this letter clearly violates our rules on supporting any form of terrorism,” TikTok spokesperson Ben Rathe told WIRED on Thursday afternoon. “We are proactively and aggressively removing this content and investigating how it got onto our platform.” TikTok did not, however, confirm how many related videos it had removed from the site or how many people had seen them.

In a statement posted Thursday night on X, TikTok said the spread of these videos was “not a trend,” and said that interest in the topic gained traction only after media outlets reported on it and tweets like Ali’s went viral. The social media site also said they would take down any TikToks referencing the letter and the hashtag #lettertoamerica. The company added that prior to Ali’s post, videos with the #lettertoamerica hashtag had been viewed 1.85 million times, but after the post they had been viewed 13 million times. (Google Trends data does show a significant spike in interest in the story after Ali’s tweet on Wednesday.)

“Does anyone remember the NyQuil Chicken Challenge?” TikTok asked in their statement. “It only got attention after the media created a moral panic.”

The company claimed that this number of views for this hashtag was relatively insignificant compared to some others on the platform, such as #travel, which had 137 million views during the same period, and #skincare, which had 252 million views.

The White House has also weighed in on the topic. “There is never a justification for spreading the repugnant, evil, and antisemitic lies that the leader of al Qaeda issued just after committing the worst terrorist attack in American history,” White House spokesman Andrew Bates told CNN.

Though it's still not clear exactly why this began, some disinformation researchers believe that the trend has all the hallmarks of a coordinated influence campaign.

“It was my gut instinct the second I saw the first video, reinforced by seeing others that were so similar and seemed scripted,” Tamsin Shaw, who teaches philosophy and politics at New York University and tracks social media’s impact on society, tells WIRED. “Then there was the fact that the actual eight-page letter is full of religious jargon, fairly hard to parse, would take longer than the attention span of someone on TikTok to read, and the kids posting about it were saying it was only two pages.”

The Bin Laden Letter Is Being Weaponized by the Far Right

A new report by an oversight committee in the US House of Representatives says the FBI has routinely violated rules governing FISA’s Section 702 surveillance program and must be reined in.

A report compiled by the Republican majority members of the US House Intelligence Committee says that agents of the Federal Bureau of Investigation should be required under the law to obtain a “probable cause warrant” before scouring the database of a controversial foreign intelligence surveillance program for information related to domestic crimes.

The Section 702 program, authorized under the Foreign Intelligence Surveillance Act (FISA), has a history of being abused by the FBI, the Intelligence Committee says, necessitating a “complete review” of the program and “the enactment of meaningful reforms.”

The program, which targets the communications of foreigners overseas with the compulsory assistance of US telecom providers, has been the target of significant scrutiny on Capitol Hill, with federal lawmakers frequently airing concerns about its capacity to be turned against the American public, whose texts, emails, and internet calls are collaterally intercepted by the US National Security Agency in unknown quantities each year.

The Intelligence Committee report, first obtained by WIRED, labels the program as essential to combating nuclear proliferation and thwarting terror attacks, adding that it has also been employed successfully in investigations of ransomware targeting US infrastructure, war crimes by Russian soldiers in Ukraine, and the “malign investments” of hostile actors that pose key economic security risks to the United States and its allies.

Still, the program, according to the committee's majority party, has been “abused by those who swore to support and defend the American people—in particular, the FBI.”

“Our report outlines reforms necessary for FISA's reauthorization," says representative Mike Turner, the Intelligence Committee's chair, while claiming the US is currently “at its greatest risk of a terrorist attack in nearly a decade.” Adds Turner: “We cannot afford to let this critical national security tool expire.”

In total, the House Intelligence Committee lists 45 “improvements” that it wishes to include in coming legislation that would enable the 702 program to continue, including criminal liability for 702 leaks involving an American's communications; enhanced penalties for federal employees who violate FISA procedures; and a new court-appointed counsel able to scrutinize FISA application by the government aimed at surveillance of a US citizen.

The report was finalized by a working group composed of three Republican members: Turner, who hails from Ohio, and representatives Darin LaHood and Brian Fitzpatrick of Illinois and Pennsylvania, respectively. The working group stresses that federal courts have time and again ruled the 702 program constitutional—when its procedures are not skirted by negligent employees and willful violators for nefarious or self-serving means.

The FBI and the Biden administration at large have lobbied Congress to reauthorize the 702 program as is, ignoring calls for reform that have grown louder since the beginning of the year, manifesting this month in the form of a comprehensive privacy bill—the Government Surveillance Reform Act—legislation that likewise seeks to impose warrant requirements on the FBI, which at present can conduct searches of 702 data without a judge's consent, so long as it's “reasonably likely” to find evidence of a crime.

FBI director Christopher Wray, speaking before the House Homeland Security Committee on Wednesday, denounced plans to impose a warrant requirement under 702, calling it a “significant blow” to the bureau's national security division.

“A warrant requirement would amount to a de facto ban,” Wray says, noting the FBI would often be unable to meet the legal standard necessary for the court's approval, and that the processing of warrants would take too long in the face of “rapidly evolving threats.”

The report goes on to detail “significant” violations at the FBI, most previously reported to the Foreign Intelligence Surveillance Court (FISC) in 2022, before they were made known to the public in May. The majority of the incidents—including one in which an FBI analyst conducted “batch queries of over 19,000 donors to a congressional campaign”—took place prior to a package of “corrective reforms” that the FBI is crediting with practically curing its compliance issues.

The report attributes “most” misuses of 702 data to “a culture at the FBI” wherein access was granted to many “poorly trained” agents and analysts with few internal safeguards. As one example, it states that FBI systems for storing 702 data had not been designed to make employees “affirmatively opt-in” before conducting a query, “leading to many inadvertent, noncompliant” issues of the system. “It also seems that FBI management failed to take query compliance incidents seriously,” the report says, “and were slow to implement reforms that would have addressed many of the problems.”

Nevertheless, the committee says the FBI “realized the depth and breadth of its issues” and has begun implementing serious reforms on its own—including, among other measures, additional guidance for employees, ample system modifications, and heightened oversight in the form supervisory reviews by FBI legal experts and senior executives. The committee, nonetheless, notes that the FISC—albeit somewhat “encouraged” by recent improvements—has found the bureau's noncompliance with 702 procedures “persistent and widespread,” warning that it may become necessary to significantly curtail its employees' access to raw foreign intelligence in the future.

“The FBI has a history of abuse regarding the querying of Section 702 information,” the report says, adding that reforms soon to be advanced by the intel committee would see the number of FBI employees with access to the data cut by as much as 90 percent.

Citing “insufficient oversight and supervision” at the FBI, the committee says it should be prepared to audit every query targeting a US person “within 6 months” of the search, and House and Senate leaders should be notified at once when and if an FBI analyst queries a term that might "identify a member of Congress.”

“The American people deserve a law that protects them from both governmental overreach and security threats,” the report says. “Section 702 must be reauthorized, but it also must be reformed.”

US Congress Report Calls for Privacy Reforms After FBI Surveillance 'Abuses'

Signal’s president reveals the cost of running the privacy-preserving platform—not just to drum up donations, but to call out the for-profit surveillance business models it competes against.

The encrypted messaging and calling app Signal has become a one-of-a-kind phenomenon in the tech world: It has grown from the preferred encrypted messenger for the paranoid privacy elite into a legitimately mainstream service with hundreds of millions of installs worldwide. And it has done this entirely as a nonprofit effort, with no venture capital or monetization model, all while holding its own against the best-funded Silicon Valley competitors in the world, like WhatsApp, Facebook Messenger, Gmail, and iMessage.

Today, Signal is revealing something about what it takes to pull that off—and it’s not cheap. For the first time, the Signal Foundation that runs the app has published a full breakdown of Signal’s operating costs: around $40 million this year, projected to hit $50 million by 2025.

Signal’s president, Meredith Whittaker, says her decision to publish the detailed cost numbers in a blog post for the first time—going well beyond the IRS disclosures legally required of nonprofits—was more than just as a frank appeal for year-end donations. By revealing the price of operating a modern communications service, she says, she wanted to call attention to how competitors pay these same expenses: either by profiting directly from monetizing users’ data or, she argues, by locking users into networks that very often operate with that same corporate surveillance business model.

“By being honest about these costs ourselves, we believe that helps provide a view of the engine of the tech industry, the surveillance business model, that is not always apparent to people,” Whittaker tells WIRED. Running a service like Signal—or WhatsApp or Gmail or Telegram—is, she says, “surprisingly expensive. You may not know that, and there’s a good reason you don’t know that, and it’s because it’s not something that companies who pay those expenses via surveillance _want_ you to know.”

Signal pays $14 million a year in infrastructure costs, for instance, including the price of servers, bandwidth, and storage. It uses about 20 petabytes per year of bandwidth, or 20 million gigabytes, to enable voice and video calling alone, which comes to $1.7 million a year. The biggest chunk of those infrastructure costs, fully $6 million annually, goes to telecom firms to pay for the SMS text messages Signal uses to send registration codes to verify new Signal accounts’ phone numbers. That cost has gone up, Signal says, as telecom firms charge more for those text messages in an effort to offset the shrinking use of SMS in favor of cheaper services like Signal and WhatsApp worldwide.

Another $19 million a year or so out of Signal’s budget pays for its staff. Signal now employs about 50 people, a far larger team than a few years ago. In 2016, Signal had just three full-time employees working in a single room in a coworking space in San Francisco. “People didn’t take vacations,” Whittaker says. “People didn’t get on planes because they didn’t want to be offline if there was an outage or something.” While that skeleton-crew era is over—Whittaker says it wasn’t sustainable for those few overworked staffers—she argues that a team of 50 people is still a tiny number compared to services with similar-sized user bases, which often have thousands of employees.

While Whittaker argues that Signal runs as lean an operation as possible, she also notes that many of its features cost more than they do for other communications platforms, due to the extra cost of enabling those features in privacy-preserving ways. Signal implements encryption, for instance, not just for the content of calls and texts, but for users’ contacts, and even for their user profile names and photos, as well as more obscure features, like users’ searches for animated GIFs. That means simple-looking elements of the app often require far more time-consuming and expensive engineering than would be necessary if they were offered without encryption.

Signal was originally founded with funding from the US State Department’s Open Technology Fund, but the service has since turned to donations to keep afloat. When the Signal Foundation was created in 2018 and WhatsApp cofounder Brian Acton left Facebook to become its president, he donated $50 million. But with Signal’s growing user base and staff, that donation wouldn't cover much more than a year’s current budget for the company. Other major donors continue to cover the foundation’s costs, Whittaker says—Twitter cofounder Jack Dorsey, for instance, has pledged $1 million a year, and others Whittaker declines to name have given similarly large contributions.

But Signal hopes to increasingly rely on donations of as little as $3 that can be made through the app itself. Monthly donations of $5 or more are rewarded with a badge for the user’s account. Those small donations, Signal says, now account for 25 percent of its operating costs, up from 18 percent last year, the first full year after Signal enabled in-app contributions. But for Signal to continue to exist and grow without depending on a few wealthy individuals, Whittaker says small user donations will need to ramp up significantly.

With a nearly $50 million annual budget, can Signal actually survive on those donations? “We have to,” says Whittaker. “Signal needs to find a way to survive in perpetuity because it is _the_ tool that we have to ensure meaningfully private communications.”

Whittaker says that charging users has never been an option—Signal would never have grown its network to a degree that could compete with iMessage or WhatsApp if it hadn’t been free all along. Nor can Signal adopt a venture capital-funded business model that would leave the service vulnerable to investors or shareholders demanding a profitable exit. Exhibit one: Elon Musk’s acquisition of Twitter and his decisions that triggered an exodus of its users. “We’re not going to get leaned on,” says Whittaker. “We’re going to stay myopically focused on our mission, without the kind of pressure to compromise that for-profit tech companies feel. And that pressure is heavy when you recognize the cost to do what we do.”

Given that privacy-focused mission, Whittaker argues that revealing Signal’s costs isn't just about helping to raise money to keep protecting users’ communications, it also serves to call out the rest of the tech industry’s anti-privacy practices.

“The default for all this is surveillance. That’s the water we swim in. So how do we swim upstream? How do we move against this and build something that can perturb that default?” she asks. “I hope being honest about these costs leads people to ask better questions of other tech organizations, to better understand what’s actually happening and how we got into a situation where a handful of companies have such an outsize power globally based on their perfecting this surveillance business model.”

Running Signal Will Soon Cost $50 Million a Year

With Meta’s recent update to its 2FA process, the company now automatically trusts devices you often use.

Meta recently changed how two-factor authentication works for Facebook and Instagram. You might have received a notification about this, but it was easy to miss in the platform’s sea of red alerts. OK, so what’s different? “Any devices you’ve frequently used Facebook on in the past two years will be automatically trusted,” reads Meta’s updated settings page. This means it’s automatically adjusted, unless you go into your settings and opt out.

Over the years, Meta has made multiple tweaks to how it deploys 2FA. In 2018, it started to allow 2FA codes generated by third-party apps. A few years later, the company began requiring more vulnerable accounts to activate 2FA protection. The company faces a tricky balance between making it easy to log in to your account and protecting users from losing control of their online identities.

Enabling 2FA is a basic way to improve the security of any online profile, since it adds an extra layer of difficulty for hackers trying to break into your account. “The role two-factor plays is, basically, to assume that at some point your password is going to be known by someone else,” says Casey Ellis, founder and chief strategy officer at Bugcrowd, a crowdsourced security company that has previously collaborated with Facebook. “You don’t have control over when or how that happens.” For users, this fallback measure is often as easy as copying and pasting a quick code from within a smartphone app, like Google Authenticator.

Anyone with a social media account on Facebook or Instagram needs to go ahead and turn on two-factor authentication in their privacy settings. No shame if you haven’t, but do it right now by logging in to your **Account Center**, clicking **Password and security**, then **Two-factor authentication**.

Now that you’ve got it all set up, here’s what recently changed with Meta’s 2FA process: It’s no longer activated anywhere you often used Facebook or Instagram in the past two years, from previous-generation smartphones to hand-me-down laptops.

What’s the reasoning for this adjustment? “As part of our continuous work to balance account security and accessibility, we’re letting people know that we’ll be treating the devices they frequently use to log in to Facebook as trusted,” says Erin McPike, a Meta spokesperson.

Facebook via Reece Rogers

Want to activate a 2FA check for every device, even where you use Facebook or Instagram the most? Open the **Account Center,** then go to **Password and security**. You may need to enter your password after choosing **Two-factor authentication** and the account you want to adjust. Scroll all the way down to the **Authorized logins** section. After that, tap on **Trust frequently used devices** and **Opt out.**

You also have the option to granularly pick which devices won’t require a 2FA check. Go back to the **Authorized logins** section and choose **Recognized devices**. Here you’ll see every device where Meta won’t require a login code. You may be surprised by some of the old devices on the list. While the company claims it’s just for devices you used in the past two years, one option on my trusted list was an iPad accessed all the way back in 2013.

Facebook via Reece Rogers

While it’s common for social media platforms to trust certain devices for users, and security measures beyond 2FA may continue to provide protection for your account, the automatic aspect makes experts uneasy. “My immediate security reaction is that it’s going to lock in long-term access to all of those logged-in things,” says Ellis. Any change that puts more onus on the user to protect their security opens up more opportunities for mistakes and potential breaches.

After you’ve revoked trust for all the random iPads you used forever ago, what else can you do to improve the security for your Meta accounts? Always use a new, complex password, first off. Also, make sure to wipe the data from your dusty smartphones and laptops with a factory reset before selling or otherwise getting rid of them.

How to Opt Out of Facebook’s Latest Two-Factor Authentication Change

The National Telecommunication Monitoring Center in Bangladesh exposed a database to the open web. The types of data leaked online are extensive.

The list of data is long. Names, professions, blood groups, parents’ names, phone numbers, the length of calls, vehicle registrations, passport details, fingerprint photos. But this isn’t a typical database leak, the kind that happens all the time—these categories of information are all linked to a database held by an intelligence agency.

For months, the National Telecommunication Monitoring Center (NTMC), an intelligence body in Bangladesh that’s involved in collecting people’s cell phone and internet activity, has published people’s personal information through an unsecured database linked to its systems. And this past week, anonymous hackers attacked the exposed database, wiping details from the system and claiming to have stolen the trove of information.

WIRED has verified a sample of real-world names, phone numbers, email addresses, locations, and exam results included in the data. However, the exact nature and purpose of the amassed information is unclear, with some entries appearing to be test information, incorrect, or partial records. The NTMC and other officials in Bangladesh have not responded to requests for comment.

The disclosure, which appears to have been unintentional, provides a tiny glimpse into the highly secretive world of signals intelligence and how communications may be intercepted. “I wouldn't be expecting this to happen for any intelligence service, even if it's not really something that sensitive,” says Viktor Markopoulos, a security researcher for CloudDefense.AI who discovered the unsecured database. “Even if many data are test data, they still reveal the structure that they're using, or what exactly it is that they are intercepting or plan to intercept.”

After Markopoulos discovered the exposed database, he linked it back to the NTMC and login pages for a Bangladeshi national intelligence platform. Markopoulos believes the database was likely exposed due to a misconfiguration. Within the database, there are more than 120 indexes of data, with different logs stored in each. The indexes include names such as “sat-phone,” “sms,” “birth registration,” “pids\_prisoners\_list\_search,” “driving\_licence\_temp,” and “Twitter.” Some of those files contain a handful of entries each, while others contain tens of thousands.

The vast majority of the data exposed in the NTMC database is metadata—the extremely powerful “who, what, how, and when” of everyone’s communications. Phone call audio isn’t exposed, but metadata shows which numbers may have called others and how long each call lasted. This kind of metadata can be used broadly to show patterns in people’s behavior and whom they interact with.

For instance, the “birth registration” log includes fields such as name (in English and Bengali), birthday, sex, birthplace, and mother’s and father’s names and nationalities, according to a sample of the data reviewed by WIRED. Another log, called “finance personal details,” also includes people’s names as well as cell phone numbers and bank account details, and lists an “amount” for the account type. National ID numbers are frequently included in the data structures, as are cell phone numbers and the names of mobile operators in Bangladesh. There are lists of base transceiver stations, which are parts of cell phone networks, and the records mention “cdr,” which may refer to call detail records.

Some of the data leaked appears to be test information, as well as data that is incomplete or incorrect. Some entries include generic strings of numbers such as “123456789,” while other entries are repeated multiple times throughout the database. Real-world data is also included within the leaked information.

One person contacted by WIRED confirmed that the email, mobile number, and a billing address listed belonged to them. The person says they are a subscriber of telecom firm BTCL, which is government-run and has some of their personal information, although it’s unclear whether this is the source of the data that was leaked. Markopoulos found exam results listed in the data, including some that were taken in the late 1990s, that matched those listed on the Ministry of Education’s website. Text messages sent to multiple numbers in the database were delivered, although one person replied saying they were not the person listed in the dataset. Another phone number is publicly listed as belonging to a Bangladeshi business. An encoded passport photo correlates with the alleged owner’s public information (although they could not be reached for comment).

From a review of a sample of the exposed information, it is unclear why the data has been collected, where it has all been collected from, or what it is being used for. There is no indication that it relates to any wrongdoing.

Jeremiah Fowler, a security consultant and cofounder of data breach discovery firm Security Discovery, reviewed the exposed database and confirmed its links to the NTMC. Fowler, who regularly finds exposed servers and databases online, says the data being linked to the intelligence body is “probably one of the first that I have seen like this.”

“The biggest thing I saw that was really dangerous was a bunch of IMEI numbers,” he says, referring to the identifying code given to each individual cell phone. “With those, you can actually track the device or clone the device.”

The NTMC has not acknowledged or responded to WIRED’s questions about the leaked information, including those about its purpose and the amount that has been gathered. The press office of the government of Bangladesh and the Bangladesh High Commission in London also did not respond to requests for comment. Markopoulos reported the exposed information to Bangladesh’s Computer Incident Response Team (CIRT) on November 8, and it acknowledged his message and thanked him for disclosing the “sensitive exposure.” In an email to WIRED, the CIRT said it had “notified the issue” to the NTMC.

The database appeared to be offline ahead of the publication of this article. However, Markopoulos says that on November 12, the database was wiped and in its place appeared a ransom note by an unknown attacker or group of attackers. The note demanded payment of 0.01 bitcoin (around $360 at current exchange rates), or the “data will be publicly disclosed and deleted.” Both Markopoulos and Fowler say this is common for exposed databases of this kind. Meanwhile, new entries have started appearing in the wiped database, Markopoulos says, and they include a “search log” index that may indicate the system is still in use.

The NTMC, which emerged from a previous monitoring body in 2013, describes itself as an organization that provides “lawful communication interception facilities” to other agencies in Bangladesh, which has a population of 167 million. It is responsible for setting up and developing an “interception platform,” and ensuring that it operates 24/7, according to its website. Recent reporting has claimed that 30 agencies are linked to the NTMC using APIs, and that it incorporates records from mobile operators, passport and immigration services, and other bodies. In January, the NTMC reportedly purchased surveillance technology from companies headed by Israelis, and government ministers have discussed the NTMC intercepting social media data.

A telecoms expert who has worked in Bangladesh, who requested anonymity over fears of government retaliation against their family, alleges that as a “lawful intercept center,” the NTMC can collect huge volumes of data. “They are not only collecting call data records from mobile companies, but also, they are collecting logs and detailed records, session history, from internet providers,” they claim. “It's really powerful, and the kind of surveillance that they do is more powerful than European countries,” they add, citing Bangladesh’s lack of legislative parallels to Europe’s strict data protection laws.

In recent weeks, protests against the current government have rocked Bangladesh as a crackdown has happened against those in opposition, ahead of the country’s next round of elections in 2024. One Bangladesh-based researcher who asked not to be named, fearing repercussions, says they “expect to see more surveillance and targeting of individuals” ahead of the elections next year.

“I think the number one priority has to be to make individuals, especially activists … aware of the surveillance system and understand how to be safe online,” the researcher says when asked about digital rights. “When, in the country, people are fighting for their basic rights—such as securing their daily livelihood and fighting for their political rights—digital rights come much later.”

A Spy Agency Leaked People's Data Online—Then the Data Was Stolen

The new generation of hardware authentication key includes support for cryptographic passkeys as Google pushes adoption of the more secure login alternative.

Passwords are a woefully insecure—and frustrating—authentication technology, but after decades of digital use, they’re ubiquitous. Recently, though, the global tech industry has been working to promote a simpler and more secure alternative known as passkeys. Along with its other initiatives to champion the login tech, Google announced today that it is launching a new version of its Titan hardware authentication keys that can store passkeys directly on the device.

For most people on most accounts, passkeys are managed directly from a smartphone or laptop. But for anyone seeking an alternative, either because they prefer a stand-alone key for ease of use or because they want maximum security separation, storing passkeys on a hardware token is a valuable option. The new Titan keys are available now and can store more than 250 unique passkeys. They are replacing Google’s existing USB-A and USB-C Titan devices.

“We’re excited about the potential of passkeys, but know there’s no security silver bullet for everyone,” Google wrote in a blog post published today. “Some people require a solution not dependent on smartphones or use devices that don’t support passkeys—everyone has different approaches to security, but we all share one goal: stop attacks. That’s why we intentionally designed the latest Titan Security Keys to encompass the secure cryptography of passkeys on a portable piece of hardware.”

As part of setting up a passkey for a Google account on a Titan device, users will be prompted to create a PIN code that they’ll enter, along with producing the security key to log in.

As part of its announcement at the Aspen Cyber Summit in New York City today, Google also said that in 2024 it will give 100,000 of the new Titan keys to high-risk individuals around the world. The effort is part of Google’s Advanced Protection Program, which offers vulnerable users expanded account monitoring and threat protection. The company has given away Titan keys through the program in the past, and today it cited the rise of phishing attacks and upcoming global elections as two examples of the need to continue expanding the use of secure authentication methods like passkeys.

Hardware authentication tokens have unique protective benefits because they are siloed, stand-alone devices. But they still need to be rigorously secured to ensure they don’t introduce a different point of weakness. And as with any product, they can have vulnerabilities. In 2019, for example, Google recalled and replaced its Titan BLE-branded security key because of a flaw in its Bluetooth implementation.

When it comes to the new Titan generation, Google tells WIRED that, as with all of its products, it conducted an extensive internal security review on the devices and it also contracted with two external auditors, NCC Group and Ninja Labs, to conduct independent assessments of the new key.

Google’s New Titan Security Key Adds Another Piece to the Password-Killing Puzzle

Jacob Chansley, the January 6 rioter known as the QAnon Shaman, will run for Congress in Arizona. The most remarkable thing about his campaign so far is how unremarkable it is in a state that’s embraced election conspiracies.

The man who became a figurehead of the January 6 Capitol riot is planning to run for Congress in Arizona, and he may not even be the most extreme candidate on the ballot.

Jacob Chansley, a January 6 rioter known as the QAnon Shaman who wore face paint and horns to breach the Capitol, pleaded guilty to taking part in the riot. Last week, Chansley filed a statement of interest to run for a seat in Arizona’s 8th congressional district. Chansley, who has lived in the district for 30 years, tells WIRED that he is running his campaign single-handedly and does not plan to accept PAC money. Though he’s not eligible to vote under Arizona law because he is still serving part of his sentence, Chansley is able to run for Congress.

“When I heard that the seat was available, I prayed on it for a while, and the message I got from God was, ‘Do it,’” says Chansley.

In Arizona, Chansley’s decision to run for office is almost standard. Though Chansley may be viewed as a fringe candidate by many, he is not an outlier in a district and state where election deniers and conspiracists are already front and center in the 2024 election races.

Ever since former US president Donald Trump lost Arizona in 2020, the state has become the epicenter of election denial conspiracies and efforts to undermine democracy. The state was home to the Cyber Ninjas–run GOP recount that cost taxpayers millions, and its voters are represented by multiple far-right extremist GOP lawmakers, including state senator Wendy Rogers and US representative Paul Gosar, who have boosted wild conspiracy theories related to vote rigging. Former TV presenter Kari Lake, who has been touted as a possible vice presidential pick by Trump in 2024, continues to claim that the Arizona secretary of state race she lost by 17,000 votes in 2022 was stolen. Lake has also boosted racist “birther” conspiracies about former president Barack Obama and has pushed for journalists and political rivals to be jailed for unspecified crimes.

In Chansley’s home district, a slate of candidates reflecting Arizona’s embrace of extremist ideologies have already declared interest in running for the seat left open by the retirement of US representative Debbie Lesko, a member of the far-right Republican Freedom Caucus in Congress who voted against certifying the 2020 election results.

Blake Masters, who ran for a US Senate seat in 2022 and lost, announced he would run for a seat in Arizona’s 8th district last month. During his Senate race, Masters was backed by money from techno-libertarian Peter Thiel, his former boss, as well as an endorsement from Trump, who told him to lean into claims of election fraud if he wanted to win the election. (Masters very much touted 2020 election denial conspiracies, but they apparently didn’t help him win.)

Masters, who published videos of him shooting guns as part of his 2022 campaign, will face a challenge for the GOP nomination from Abe Hamadeh. Hamadeh, a 2022 Republican candidate for Arizona attorney general, also lost his race in 2022 despite having Trump’s endorsement. Hamadeh was one of the loudest voices in Arizona falsely claiming that Trump had won the 2020 election, and he is still trying to have his own loss to attorney general Kris Mayes overturned.

Former US representative Trent Franks, Lesko’s predecessor, is also running again. Franks was forced to resign in 2017 after he offered female staffers millions of dollars to serve as surrogate mothers for him and his wife—and at least one aide was unsure whether Franks was requesting to impregnate her through sexual intercourse or in vitro fertilization.

Anthony Kern, an Arizona state senator who was also in Washington, DC, on January 6, and who has been accused of using campaign finances to fund his trip to the capital, has announced his candidacy for the congressional seat as well. Kern was captured on video entering a restricted area outside the Capitol, though there is no evidence he was violent or entered the Capitol itself, and he has not been charged for any crimes related to the riot.

Kern is, however, currently under investigation by the Arizona attorney general as one of 11 fake electors who signed documents in 2020 to claim that Trump had beaten President Joe Biden in Arizona, even though Biden actually won the state. Kern also took part in the sham hand-recount of ballots in Maricopa County in 2021.

Before becoming a lawmaker, Kern was fired from his position with the El Mirage Police Department for lying to his supervisor about repaying the cost of a tablet computer he had lost. He was placed on a list of Maricopa County law enforcement officials with a history of dishonesty or misconduct.

“The race in general is gonna be wild,” one independent researcher who tracks the far-right in Arizona under the moniker Arizona Right Watch tells WIRED. But, they add, they would still “take Chansley over Kern, who is totally corrupt and batshit.”

And even though the other candidates are possibly more connected politically, Chansley still thinks he has closer ties to voters in his home district.

“Several of the candidates running here in District 8 don’t even live in District 8. I’ve lived in District 8 for over 30 years,” he tells WIRED. “I’m largely doing it on my own. It’s just me and God, man.”

He’s currently working on a campaign website, and plans to begin knocking on doors to meet voters in the next couple of weeks. Chansley is also eager to take part in debates with other candidates. “That's where I think I'll shine,” Chansley says. “I'm ready to debate anyone and everyone that wants to try.”

When asked whether he would be attending a candidate forum being organized by a local community organization on Wednesday night, Chalsey says, “quite possibly.”

Chansley added that he doesn’t want any campaign donations, but says that if people want to support him, they can do so by buying merchandise on his website which includes T-shirts, mugs, and yoga leggings that feature him dressed in the notorious QAnon Shaman garb.

Despite having no experience, no money, no support, and no endorsements, Chansley is still optimistic about winning in 2024.

“I think my chances of winning are good, otherwise God wouldn't have asked me to run,” Chansley says.

The QAnon Shaman Isn’t Even the Most Extreme Candidate in His Race for Congress

Poverty, fentanyl, and lack of public funding mean morgues are overloaded with unidentified bodies. TikTok and Facebook pages are filling the gap—with AI proving a powerful and controversial new tool.

In 2021, an unidentified Black woman died by suicide after jumping off the Brooklyn Bridge. She was wearing hot pink nail polish, had a pink left eyebrow piercing and several tattoos—all distinguishing features that should have made it easier to identify her. Two years later, her identity is still unknown.

The tragedy of unidentified cadavers is something that Rionna Lee had been thinking about for years. Her mother used to transport human remains for New York’s Office of the Chief Medical Examiner, and would bring home morbid stories. One, Lee remembers, was of a man who had been hit by an MTA train. “One of the things that stuck out to me was the condition of his remains, which were scattered across the train tracks,” says Lee, 24, who now lives in Kingston, Pennsylvania. It distressed her to think of the families who would have to identify their loved ones; even more so, later, when she learned that some human remains would never be identified.

There are an average of 4,400 unidentified new cadavers per year in the US, and a total of 600,000 missing people across the country. Some of these cases are collected on databases, such as the National Missing and Unidentified Persons System (NamUs), which helps medical examiners, coroners, law enforcement officers, and members of the public solve missing, unidentified, and unclaimed cases across the country. The true scale of the problem is unknown, as the data available for the average number of unidentified cadavers comes from a 2004 census. Just 10 states have laws requiring that cases be entered into NamUs, meaning that many reports are voluntary.

As she looked into cases—including the woman with the pink nail polish—Lee noticed a pattern in which were solved and which weren’t. The decisive factor was often money. Funding from private donors, sponsorship, and public support meant that law enforcement agencies were able to access cutting-edge technology, such as Othram, a forensic genetics company, which has been pivotal in cracking several high-profile cases. Those that weren’t solved didn’t have resources behind them. Often, they were from marginalized groups. Lee, who identifies as Black and LGBTQ+, felt the need to raise awareness among overlooked members of society, those whose deaths often go unnoticed: transient individuals, racial minorities, substance users, and members of the LGBTQ+ community.

Lee set up a TikTok to try to raise awareness. After a few false starts, she went viral, attracting a following of 128,000. She set up a Facebook group—Thee Unidentified & Unsolved—which now has 39,000 members, many of whom work together to solve unidentified and unsolved cases. Thee Unidentified & Unsolved is one of several volunteer social media communities that are filling a gap left by the US state, which is getting worse due to the overlapping crises of poverty, fentanyl, and shortfalls in public funding. Now, with AI image recognition more readily available, volunteers have new tools to help them identify the deceased. This brings with it new issues around privacy and consent, but those in the communities say their work brings closure to families. “I believe everyone starts off with a name,” says Lee. “I believe everyone should be able to leave this Earth peacefully with their name.”

Lee started her TikTok campaign in October 2021. There were already several popular accounts that focused on locating missing people, but few, if any, were working to identify the deceased. She created her own page, but TikTok doesn’t allow graphic content such as morgue photos, and she struggled for traction.

She focused on cases where the decedent had been found with items that might help their friends and relatives identify them. “One of the videos I posted that gained exposure was a man with an undetermined race. He was found with a Salvatore Ferragamo gold buckle belt,” says Lee. Her audience was curious how a person with such an expensive piece of clothing could go unidentified. Her engagement grew, and finally, on November 9, 2022, one of her TikTok videos—the case of a 2022 Union County Jane Doe, a Black woman who died after being struck by multiple vehicles on US Route 22 in Hillside, New Jersey—went viral, racking up 652,000 views. A couple of days later, another video hit a million views. She created the Facebook group later that month, because the platform allows graphic content, like morgue pictures, which TikTok doesn’t. The Facebook group now has more than 39,000 members.

There are around a dozen posts each day in the group, often unsolved cases from NamUs with pictures. Members scour the internet, looking for other images, comparing images with missing person sketches or social media profiles.

Some of the identification groups work globally, others are region or country specific or dedicated to unique circumstances, such as missing and murdered Indigenous women and girls. Online detective groups often tread a delicate line between altruistic investigation and mob obsession.

Thee Unidentified has had to tread that line carefully. Earlier this year, the group helped identify Adonis Beck, a TikTok star also known as Pope the Barber. Beck was found dead on August 10. The news spread quickly, causing an influx of new members to the Facebook group. Kenyetta Burks, one of the group’s admins who had first posted Beck’s image on the group, removed the morgue photos as they were posted, but was inundated with requests from people trying to see them, many from fake accounts pretending to be relatives. Sometimes, the admins will notice comments from members who seem more intrigued by the circumstances of death than those who are empathetic to the topic of unidentified cases. In situations that appear voyeuristic, the person is suspended, and if the behavior is repeated, they are banned, Lee says.

These social media groups have helped some families find closure. In 2022, a teenage boy stumbled upon Lee’s TikTok page and identified his mother, a 2017 Jane Doe case, via her tattoos. She was hit by a vehicle while crossing a street in Pasadena, California and succumbed to her injuries in hospital. In May 2023, Burks posted a sketch, images, and information from NamUs in the Facebook group, which led to the identification of Dytavious Sanders, an MMA fighter from South Carolina, whose body was discovered earlier that month on May 9. Sander’s aunt identified him in the group and his mother asked for assistance in claiming his body.

One member of Thee Unidentified has recently began using a new tool, PimEyes, a controversial facial recognition search engine, as a means to identify the deceased via morgue photos. A quick upload produces search results in a matter of seconds. Photos from across the internet are organized in a single view, mugshots frequently among them. While this technology can accelerate the process of identifying the dead, it brings with it serious privacy concerns. In many cases, informed consent is neither obtained for the image uploaded nor the results that the technology returns, which can include the biometric data of private individuals. Thus far, a few members of the group have utilized this tool.

“While some individuals might be well-meaning, online sleuths are using dangerous surveillance tools,” says Madeleine Stone, senior advocacy officer at Big Brother Watch, a privacy campaign group. “By selling this technology, facial recognition companies risk violating the dignity of deceased individuals, but moreover are violating the privacy rights of the billions of people whose photos they have taken, processed and exploited without consent.”

PimEyes has been criticized by privacy advocates for scraping the internet for images, and giving users access to highly personal information about private individuals. PimEyes CEO Giorgi Gobronidze says that these threats are exaggerated, and that PimEyes doesn’t hold images, but just directs users to the URLs where images are hosted. “The tool is designed to help people to find the sources that publish photos, and if they shouldn't be there, apply to the website and initiate takedown.” Gobronidze says that PimEyes has many use cases, such as searching for missing people, including women and children in conflict areas, and actively cooperates with human rights organizations.

Lee says that the Thee Unidentified & Unsolved Facebook group “is not focused on the use of PimEyes…But I respect those who do use the tool and actually have successful outcomes.”

In other social media groups, PimEyes is slowly being introduced as an investigative tool for cases related to missing persons, cold cases, and human trafficking.

Experts also worry that this technology is not necessarily accurate, meaning that amateur sleuths could make mistakes with heartbreaking consequences. “This a noble goal, but a terrible approach,” says Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project, an organization that litigates and advocates for privacy, fighting excessive local and state-level surveillance. “This technology is biased and error prone, and I worry that a lot of worried families will be wrongly told their missing loved one is dead.”

For all of the challenges presented by volunteer online communities, the reality is that they exist in a vacuum left by the authorities.

In 2021, 106,699 Americans died of an overdose. In Seattle, the fentanyl crisis is so bad that the number of overdose deaths has doubled in the last three years, causing the morgues to overflow. The “fourth wave” of the crisis recently descended upon the US, an ongoing mass-overdose event that has consumed law enforcement agencies, stretching the resources necessary for identifying the dead. For medical examiners, the “tsunami” of bodies has resulted in staff burnout, exhausted resources, and jeopardized many offices’ accreditation due to the necessity to conduct more autopsies than industry guidelines permit .

“Unfortunately, the opioid crisis has meant more individuals are coming into the Medical Examiner’s Office for examination,” says Dr. Constance DiAngelo, Philadelphia’s Chief Medical Examiner. “Many of these folks are not initially identified.”

The authorities just don’t have the resources to investigate every case thoroughly. “Our challenges are related to funding,” DiAngelo says. “Exhumations, reinterment, DNA extraction and processing, and genealogy comparisons are expensive. A case could cost between $2,500 to $10,000, and that doesn’t include the need for staff who can be dedicated to this type of work.”

In King County, where Seattle is located, there are currently 57 unidentified people that the Medical Examiner’s Office is working to identify. This dire situation is a reality across major American metropolitan areas. In situations where people are found without identification, it can take weeks, if not months, to locate next of kin.

That waiting, and not knowing, can be agony for people whose loved ones have disappeared—like the family of Kallie Catron. Catron’s mother, Crystal Newman, last spoke with her on October 14, 2022. Catron said she missed her two children and wanted to come home. “When Halloween, Thanksgiving, Christmas, and New Year’s passed, my sister knew something was wrong and called to report a missing person,” says Sarah Forister, Catron’s aunt. “I guess you can say a mother knows when something is wrong with her baby.”

On January 22, 2023, Newman was sent a link to a post on Thee Unidentified’s TikTok page. Morgue photos, and images of her tattoos, confirmed it was Catron. “At first, we were so mad that’s how we found out,” says Forister. “But Kallie’s mom, me, and her cousins watched the video showing her morgue photo and all her identifying tattoos multiple times a day.”

Eventually, Lee asked the family if she could take down the video, as Catron had been identified. “I said yes, but please send me the video so I can watch it whenever I want to,” says Forister. Lee obliged. The community shared the family’s GoFundMe campaign to raise funds for Catron's funeral and to support her children. “We realized that if it wasn’t for Thee Unidentified community and Rionna, we could still be looking for Kallie,” Forister says.

Social Media Sleuths, Armed With AI, Are Identifying Dead Bodies

More than 60 groups advocating for Asian American and Pacific Islander communities are pushing the US Congress to reform the Section 702 surveillance program as Senate leaders move to renew it.

Dozens of prominent Asian American groups are asking United States lawmakers this morning to hold fast in the face of an anticipated campaign by congressional leaders to extend the Section 702 surveillance program by securing it, like a rider, to another “must pass” bill.

Sixty-three groups across the country representing and allied with Asian American and Pacific Islander communities have signed a letter of “strong opposition” to any “short-term extension” of the 702 program—surveillance, the groups say, that is almost certainly impacting Asian Americans at a disproportionate rate.

WIRED first reported last week on an effort underway by US Senate leaders to extend the 702 program, which is slated to expire at the end of the year but may continue until April under the program’s “transition procedures.” Emails from WIRED requesting comment from the Senate majority leader, Chuck Schumer, have gone unanswered since Friday.

“Section 702 and related surveillance authorities have been misused to spy on Americans, including but not limited to protesters, journalists, campaign donors, and members of Congress,” says the letter, signed by the National Council of Asian Pacific Americans, the Sikh Coalition, Asian Americans Advancing Justice, and the Stop AAPI Hate coalition, among dozens of other groups. The consequences of unlawful surveillance have had a “devastating toll” on Asian Americans, they say, and on people’s “careers, livelihoods, and reputations.”

Demanding the 702 program be “pursued through standalone legislation” and open to debate, the letter says a short-term fix would alienate lawmakers already open to salvaging the program—albeit with heavily favored reforms. Renewing the program with a last-minute amendment tucked into a bill the government can’t function without would only serve to undermine the democratic process, the groups say, and “imperil the long-term viability of Section 702.”

“There are a lot of folks who are really worried,” says Andy Wong, managing director of advocacy at Stop AAPI Hate, a coalition of community-based groups. The impact of government surveillance on the broader Asian American community, he says, runs deep. "Whether it’s traveling or communicating with their loved ones or doing anything abroad, even if it’s completely innocuous, all of this surveillance has a chilling effect.”

“Approximately two-thirds of Asian Americans are immigrants,” says Joanna YangQing Derman, a program director at Asian Americans Advancing Justice, the civic engagement and civil rights nonprofit. “We are far more likely to have family, friends, and business associates abroad. As a result, Asian Americans are likely to be overrepresented in all the data that Section 702 enables the government to collect.”

The 702 program is used by the US National Security Agency (NSA) to target the electronic communications of hundreds of thousands of foreigners each year. The program, which works to gather intel for counterterrorism, espionage, and cyber defense investigations, relies on the compulsory assistance of US telecom providers—a power granted on a year-by-year basis through “certifications” by a secret court.

Despite the government’s avowed efforts not to intercept and store Americans’ internet communications in bulk, the NSA is known to capture significant volumes of domestic calls, texts, and emails between Americans and people overseas. The law, as it is, does little to prevent federal agents from dredging up the content of those calls or messages later without a warrant, for reasons often irrelevant to why they were captured in the first place.

On Monday, another letter directed at Senator majority leader Chuck Schumer was signed by more than 20 civil liberties groups that are likewise opposed to any attempt to prolong 702 surveillance, which falls under the Foreign Intelligence Surveillance Act (FISA), by linking its fate to a spending bill that will be inevitably negotiated at a high level, with little or no opportunity for amendment once it reaches the House or Senate floor. A leading contender for such a bill, a congressional source told WIRED last week, is the National Defense Authorization Act, annual legislation that’s considered “must pass,” and which will allocate roughly $886 billion in national security spending across the Pentagon and US Department of Energy next year.

The majority leader signaled openness to adopting other “must pass” legislation on Monday: an appropriations bill sponsored by House speaker Mike Johnson, which Schumer said “pleased” him, in that it avoided “steep cuts” and was “moving in our direction.” Attaching a 702 amendment to any stopgap spending bill at this hour, however, could serve as a poison pill, eliciting stiff opposition from House Republicans—such as the chairman of the House Judiciary Committee, Jim Jordan—for whom FISA remains a four-letter word.

Asian Americans Raise Alarm Over ‘Chilling Effects’ of Section 702 Surveillance Program

In its plans to implement a White House executive order, CISA aims to strike a balance between promoting AI adoption for national security and defending against its malicious use.

Last month, a 120-page United States executive order laid out the Biden administration's plans to oversee companies that develop artificial intelligence technologies and directives for how the federal government should expand its adoption of AI. At its core, though, the document focused heavily on AI-related security issues—both finding and fixing vulnerabilities in AI products and developing defenses against potential cybersecurity attacks fueled by AI. As with any executive order, the rub is in how a sprawling and abstract document will be turned into concrete action. Today, the US Cybersecurity and Infrastructure Security Agency (CISA) will announce a “Roadmap for Artificial Intelligence” that lays out its plan for implementing the order.

CISA divides its plans to tackle AI cybersecurity and critical infrastructure-related topics into five buckets. Two involve promoting communication, collaboration, and workforce expertise across public and private partnerships, and three are more concretely related to implementing specific components of the EO. CISA is housed within the US Department of Homeland Security (DHS).

“It's important to be able to put this out and to hold ourselves, frankly, accountable both for the broad things that we need to do for our mission, but also what was in the executive order,” CISA director Jen Easterly told WIRED ahead of the road map's release. “AI as software is clearly going to have phenomenal impacts on society, but just as it will make our lives better and easier, it could very well do the same for our adversaries large and small. So our focus is on how we can ensure the safe and secure development and implementation of these systems.”

CISA's plan focuses on using AI responsibly—but also aggressively in US digital defense. Easterly emphasizes that, while the agency is “focused on security over speed” in terms of the development of AI-powered defense capabilities, the fact is that attackers will be harnessing these tools—and in some cases already are—so it is necessary and urgent for the US government to utilize them as well.

With this in mind, CISA's approach to promoting the use of AI in digital defense will center around established ideas that both the public and private sectors can take from traditional cybersecurity. As Easterly puts it, “AI is a form of software, and we can’t treat it as some sort of exotic thing that new rules need to apply to.” AI systems should be “secure by design,” meaning that they've been developed with constraints and security in mind rather than attempting to retroactively add protections to a completed platform as an afterthought. CISA also intends to promote the use of “software bills of materials” and other measures to keep AI systems open to scrutiny and supply chain audits.

“AI manufacturers \[need\] to take accountability for the security outcomes—that is the whole idea of shifting the burden onto those companies that can most bear it,” Easterly says. “Those are the ones that are building and designing these technologies, and it’s about the importance of embracing radical transparency. Ensuring we know what is in this software so we can ensure it is protected.”

Finally, CISA will conduct assessments of the threats US critical infrastructure could face from AI-powered attacks. The agency plans to collaborate across the industrial control and critical infrastructure landscape to make recommendations for how these vital services—which are often built on always-on, legacy technology—can defend against novel threats and safely implement AI-powered protections.

“In last month’s Executive Order, the President called on DHS to promote the adoption of AI safety standards globally and help ensure the safe, secure, and responsible use and development of AI,” Homeland Security secretary Alejandro Mayorkas said in a statement today. "CISA’s roadmap lays out the steps that the agency will take as part of our Department’s broader efforts to both leverage AI and mitigate its risks to our critical infrastructure and cyber defenses.”

In practice, it's a massive and unwieldy set of goals. And some, like plans to hold businesses accountable, hinge largely on voluntary commitments and collaborations. But CISA's “road map” is a gesture toward imbuing its efforts with some amount of transparency and public responsibility at a critical moment.

“Not only are these going to be the most powerful capabilities of our lifetime, they could potentially be the most powerful weapons of our lifetime,” Easterly says. “We need to ensure that we are protecting them and protecting our global citizenry from the malicious use of these capabilities.”

Source

Wired