“This eruption of violence had been brewing for years, through successive economic collapses, pandemics, and the utter dysfunction that had become American life.” An exclusive excerpt from 2054: A Novel.

2054, Part VI: Standoff at Arlington

Two researchers have improved a well-known technique for lattice basis reduction, opening up new avenues for practical experiments in cryptography and mathematics.

_The original version of_ _this story_ _appeared in_ Quanta Magazine_._

In our increasingly digital lives, security depends on cryptography. Send a private message or pay a bill online, and you’re relying on algorithms designed to keep your data secret. Naturally, some people want to uncover those secrets—so researchers work to test the strength of these systems to make sure they won’t crumble at the hands of a clever attacker.

One important tool in this work is the LLL algorithm, named after the researchers who published it in 1982—Arjen Lenstra, Hendrik Lenstra Jr. and László Lovász. LLL, along with its many descendants, can break cryptographic schemes in some cases; studying how they behave helps researchers design systems that are less vulnerable to attack. And the algorithm’s talents stretch beyond cryptography: It’s also a useful tool in advanced mathematical arenas such as computational number theory.

Over the years, researchers have honed variants of LLL to make the approach more practical—but only up to a point. Now, a pair of cryptographers have built a new LLL-style algorithm with a significant boost in efficiency. The new technique, which won the Best Paper award at the 2023 International Cryptology Conference, widens the range of scenarios in which computer scientists and mathematicians can feasibly use LLL-like approaches.

“It was really exciting,” said Chris Peikert, a cryptographer at the University of Michigan who was not involved in the paper. The tool has been the focus of study for decades, he said. “It’s always nice when a target that has been worked on for so long … shows that there’s still surprises to be found.”

LLL-type algorithms operate in the world of lattices: infinite collections of regularly spaced points. As one way of visualizing this, imagine you’re tiling a floor. You could cover it in square tiles, and the corners of those tiles would make up one lattice. Alternatively, you could choose a different tile shape—say, a long parallelogram—to create a different lattice.

A lattice can be described using its “basis.” This is a set of vectors (essentially, lists of numbers) that you can combine in different ways to get every point in the lattice. Let’s imagine a lattice with a basis consisting of two vectors: \[3, 2\] and \[1, 4\]. The lattice is just all the points you can reach by adding and subtracting copies of those vectors.

That pair of vectors isn’t the lattice’s only basis. Every lattice with at least two dimensions has infinitely many possible bases. But not all bases are created equal. A basis whose vectors are shorter and closer to right angles with one another is usually easier to work with and more useful for solving some computational problems, so researchers call those bases “good.” An example of this is the pair of blue vectors in the figure below. Bases consisting of longer and less orthogonal vectors—like the red vectors—can be considered “bad.”

Illustration: Merrill Sherman/Quanta Magazine

  
This is a job for LLL: Give it (or its brethren) a basis of a multidimensional lattice, and it’ll spit out a better one. This process is known as lattice basis reduction.

What does this all have to do with cryptography? It turns out that the task of breaking a cryptographic system can, in some cases, be recast as another problem: finding a relatively short vector in a lattice. And sometimes, that vector can be plucked from the reduced basis generated by an LLL-style algorithm. This strategy has helped researchers topple systems that, on the surface, appear to have little to do with lattices.

In a theoretical sense, the original LLL algorithm runs quickly: The time it takes to run doesn’t scale exponentially with the size of the input—that is, the dimension of the lattice and the size (in bits) of the numbers in the basis vectors. But it does increase as a polynomial function, and “if you actually want to do it, polynomial time is not always so feasible,” said Léo Ducas, a cryptographer at the national research institute CWI in the Netherlands.

In practice, this means that the original LLL algorithm can’t handle inputs that are too large. “Mathematicians and cryptographers wanted the ability to do more,” said Keegan Ryan, a doctoral student at the University of California, San Diego. Researchers worked to optimize LLL-style algorithms to accommodate bigger inputs, often achieving good performance. Still, some tasks have remained stubbornly out of reach.

The new paper, authored by Ryan and his adviser, Nadia Heninger, combines multiple strategies to improve the efficiency of its LLL-style algorithm. For one thing, the technique uses a recursive structure that breaks the task down into smaller chunks. For another, the algorithm carefully manages the precision of the numbers involved, finding a balance between speed and a correct result. The new work makes it feasible for researchers to reduce the bases of lattices with thousands of dimensions.

Past work has followed a similar approach: A 2021 paper also combines recursion and precision management to make quick work of large lattices, but it worked only for specific kinds of lattices, and not all the ones that are important in cryptography. The new algorithm behaves well on a much broader range. “I’m really happy someone did it,” said Thomas Espitau, a cryptography researcher at the company PQShield and an author of the 2021 version. His team’s work offered a “proof of concept,” he said; the new result shows that “you can do very fast lattice reduction in a sound way.”

The new technique has already started to prove useful. Aurel Page, a mathematician with the French national research institute Inria, said that he and his team have put an adaptation of the algorithm to work on some computational number theory tasks.

LLL-style algorithms can also play a role in research related to lattice-based cryptography systems designed to remain secure even in a future with powerful quantum computers. They don’t pose a threat to such systems, since taking them down requires finding shorter vectors than these algorithms can achieve. But the best attacks researchers know of use an LLL-style algorithm as a “basic building block,” said Wessel van Woerden, a cryptographer at the University of Bordeaux. In practical experiments to study these attacks, that building block can slow everything down. Using the new tool, researchers may be able to expand the range of experiments they can run on the attack algorithms, offering a clearer picture of how they perform.

_Original story_ _reprinted with permission from_ Quanta Magazine, _an editorially independent publication of the_ _Simons Foundation_ _whose mission is to enhance public understanding of science by covering research developments and trends in mathematics and the physical and life sciences._

A Celebrated Cryptography-Breaking Algorithm Just Got an Upgrade

Plus: China’s Volt Typhoon hackers lurked in US systems for years, the Biden administration’s crackdown on spyware vendors ramps up, and a new pro-Beijing disinformation campaign gets exposed.

Documents exclusively obtained by WIRED reveal that AI surveillance software tracked thousands of people using the London Underground to detect crime or unsafe situations. The machine learning software scoured live CCTV footage to spot aggressive behavior, weapons being brandished, and people dodging fares. The documents also detail errors made during the trial—for instance, mistakenly identifying children walking with their parents as fare evaders.

Meanwhile, on Wednesday, cryptocurrency tracing firm Chainalysis published a report finding ransomware payments in 2023 reached over $1.1 billion, the highest annual total ever recorded. The record-breaking sum of extorted funds was due to two things: the high number of ransomware attacks and the amount of money that hackers were demanding from victims, many of whom were targeted specifically for their ability to pay and their inability to sustain a prolonged disruption of services.

A tech company, notorious for keeping websites with far-right and other extreme content online, was bought last year by a secretive company whose business is to help set up businesses, often in ways that keep details of those companies secret, WIRED reported on Thursday. Registered Agents Inc.’s acquisition of Epik may allow the shadowy company to provide its customers with another layer of anonymity.

For the past month, senior security reporter Matt Burgess has been transitioning away from using passwords to log in to his hundreds of online accounts. Instead, he’s using passkeys, a more secure form of authentication that uses generated codes stored on your device to log in to websites and apps using a biometric identifier like a fingerprint, face scan, or PIN. When it works, it’s seamless and secure. When it doesn’t, it’s a mess.

WhatsApp is developing a feature to allow its users to message across apps, all while maintaining its secure end-to-end encryption. In theory, the move would allow users to chat with people on WhatsApp using apps like Signal or Telegram. It’s unclear which companies, if any, will link their services with WhatsApp.

And there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

Hackers have, in the real world, caused blackouts, set fire to a steel mill, and released worms that took down medical record systems in hospitals across the US and the UK. So it hardly seems necessary to invent new nightmares about them taking over our toothbrushes.

Yet, when the Swiss newspaper _Aargauer Zeitung_ published a story that cybercriminals had infected 3 million internet-connected toothbrushes with malware, then used them to launch a cyberattack that downed a website for four hours and caused millions of dollars in damage, the tale was somehow irresistible. This week, news outlets around the world picked up the story, which quoted the cybersecurity firm Fortinet as its source, spinning it out as the perfect illustration of how hackers can exploit the most mundane technology for epic malevolence. “This example, which seems like a Hollywood scenario, actually happened,” the Swiss newspaper wrote.

Except, of course, it didn’t. Cybersecurity professionals quickly started to point out that the story was unsupported by any evidence—and was somewhat absurd on its face. (Even the Mirai botnet, which knocked out its targets with record-breaking tsunamis of junk traffic and eventually broke a large fraction of the internet, infected only 650,000 internet-connected devices at its peak.)

Fortinet belatedly sought to correct the record, writing in public statements that “it appears that due to translations the narrative on this topic has been stretched to the point where hypothetical and actual scenarios are blurred.” But the _Aargauer Zeitung_ pointed the finger back at Fortinet, noting in a follow-up story that Fortinet provided exact details of the dental doomsday it described as real, and that the company even reviewed the text of the article prior to publication. Regardless of who’s to blame, at least this cyber urban legend has inspired some solid meme content.

Back to more factual cyber doomsday headlines: The US Federal Bureau of Investigation, National Security Agency, and Cybersecurity and Infrastructure Security Agency this week warned in a report that China’s hacker group known as Volt Typhoon had quietly maintained access to some US critical infrastructure networks for as long as half a decade. The report included detailed descriptions of the intrusion and persistence techniques used by the group, which has distinguished itself as perhaps China’s most aggressive state-sponsored hacking force. Volt Typhoon’s broad penetration of US electric grids, transportation networks, and other critical infrastructure has raised alarms among US federal agencies since as early as May of last year, when those agencies began to warn that the group appeared to be laying the groundwork for cyberwar-style attacks in the midst of any future conflict. Now it’s clear that those warnings came only years after the hackers’ sabotage preparations were well underway.

The Biden administration announced that it will restrict the visas of foreign sellers of commercial spyware, potentially preventing executives or associates of those surveillance firms from traveling to the US. The new regulation is part of the White House’s slow tightening of the screws on spyware seller firms like NSO Group, Cytrox, Intellexa, and Candiru, after an earlier move to place those firms on a Commerce Department trade blocklist and prevent US government agencies from buying those hacking firms’ tools. On the day of the announcement, Google released its own detailed report on alleged commercial spyware vendors, calling out a dozen of the companies by name and offering policy recommendations for protecting users.

Citizen Lab this week exposed a vast network of Chinese websites posing as local news sites across the globe, all used to post pro-Beijing disinformation and propaganda. The 123 sites, targeting audiences in more than 30 countries in Europe, Asia, and Latin America, mixed innocuous commercial and cut-and-pasted content with anti-Western conspiracy theories, such as allegations of human experimentation carried out by the United States in Southeast Asia, and targeted attacks on critics of the Chinese government. While the visibility and impact of the influence operation has been “negligible,” according to Citizen Lab, it’s another sign of China’s growing efforts to wield disinformation as a soft power tactic.

How 3 Million ‘Hacked’ Toothbrushes Became a Cyber Urban Legend

“Had this all been contrived? Had his life become a game in which everyone knew the rules but him?” An exclusive excerpt from 2054: A Novel.

2054, Part V: From Tokyo With Love

Known for doing business with far-right extremist websites, Epik has been acquired by a company that specializes in helping businesses keep their operations secret.

A technology company that has been essential in keeping far-right and extremist websites online was acquired last year by a firm that operates an empire of shell companies across the United States, according to people familiar with the deal.

Epik.com has been for years the go-to domain registrar for websites that other companies refuse to do business with. Sites dedicated to white nationalism, QAnon conspiracy theories, and harassing transgender people were all welcomed by Epik. Now, it appears that Epik’s new owner may abandon the extremist fringe and shift its customer base toward companies seeking to operate in the shadows.

Rob Monster, a born-again Christian who founded Epik in 2009, had been key in keeping many of the most extreme websites online. He often went to great lengths to personally defend the sites and extolled the virtues of free speech. Epik was sold to new ownership last year after the company unraveled amid allegations of gross financial mismanagement.

An accounting firm hired by Epik to conduct a forensic investigation alleged that Monster had misappropriated more than $3.5 million, according to an internal preliminary report obtained by WIRED. More than $1.5 million was attributed to Monster personally withdrawing funds from the company. Nearly $2 million of Epik funds was used in Kingdom Ventures, Monsters’ venture capital firm, according to the report.

Monster didn’t respond to multiple requests for comment.

The buyer of Epik’s domain registrar business was a brand-new company that had been incorporated in Wyoming weeks before the sale was completed last summer: Epik LLC. The owner of Epik LLC, according to two people familiar with the deal, is Registered Agents Inc. The company confirmed its ownership in a press release late Friday night.

Registered Agents Inc. and its subsidiary companies claim to have offices in every state and Washington, DC. Its services allow companies to operate anonymously in a jurisdiction of its choosing. Registered Agents Inc. says it provides services to over 1 million companies.

The founder and owner of Registered Agents, according to two people familiar with the company, is a man named Dan Keen. In an email, a lawyer for Registered Agents Inc. says Keen is not the owner nor an employee of Registered Agents Inc. or Epik, and that he acted as a consultant in the acquisition.

Keen is intensely private, according to multiple people who have worked with him who requested anonymity to discuss details of the deal. “He has made it his mission in life to be invisible,” said one. “He’s someone who likes to operate in the shadows,” claims another. Keen is a serial entrepreneur who previously ran a lawn care and tree-trimming business, according to public records.

Keen has no website or social media pages. Emails sent by Keen don’t include a signature. Attempts to reach Keen for comment led to a reply from Bryce Myrvang, a lawyer for Registered Agents Inc.

Using a registered agent to incorporate a business allows the owner to shield who actually owns it. A registered agent will act as an official point of contact for a company, receiving legal notices and mail, and filing incorporation documents with the state. In Wyoming alone, Registered Agents Inc. represents around 50,000 companies, according to the Wyoming secretary of state.

For example, a company that uses Registered Agents Inc. to set up shop in Wyoming would have its address listed as 30 N. Gould Sreet, a squat one-story building in the town of Sheridan.

A local paper in Wyoming, _The Sheridan Press_, reported in August 2021 that scam business had been linked to the 30 N. Gould Street address, where more than 20 registered agent firms claim to have their offices. An editor's note added after publication stated, “It remains completely legal for registered agents to do what they’re doing under Wyoming Statute.”

A 2022 investigation by the International Consortium of Investigative Journalists found that “oligarchs, criminals and online scammers” have used registered agents to operate in the United States and shield their true identity.

Registered Agents Inc.’s acquisition of Epik allows the company to extend its offerings to the internet, providing its customers another layer of anonymity for their websites.

“This most recent acquisition provided an opportunity to expand our business offerings to include a business email address, a domain name, and open source website hosting at a reasonable cost,” Myrvang tells WIRED. “Registered Agents Inc. now has the capability to establish an entire business identity for its customers in less than 10 minutes.”

Clues about changes within Epik first emerged in January, when the company terminated its relationship with Kiwi Farms, a notorious trolling site whose users are dedicated to perpetuating never-ending drama and misery. In a series of bizarre and now deleted tweets, Epik claimed it suspended Kiwi Farms in response to a US court order and that the site hosted child sexual abuse material. In response, the Kiwi Farms administrator began crowdfunding money for a defamation lawsuit against Epik.

“You specialize in defamation, revenge porn, harassment, and hate speech and you want to sue us? We will expose all your and your users dirty secrets and they will be permanent public records,” the EpikLLC X account replied. “The judgment we will win against you will follow you the rest of your life.”

It was as if a new set of trolls with an entirely different worldview had taken over Epik.

“Alright all Whiny, Beta Snowflakes. Our DEI hires of the month canceled #Kiwifarms,” another post from EpikLLC read. “We don't like hate speech, porn, or doxxing. #JoeBiden will fix it! 2024!”

Some of the tweets trolling Epik were later deleted. “If such comments and or interactions on X were found to be offensive, Epik LLC formally apologizes to those individuals and or company,” Myrvang, the company's lawyer, says. “Further, the appropriate action has been taken internally in relation to the comments made on X.”

It’s unclear if Epik’s new owners singled out Kiwi Farms or if it has booted other sites from its service. “Epik.com’s Terms of Service has been updated to maintain compliance with all regulatory requirements,” Myrvang says.

When asked if the company has stopped working with other customers, Myrvang says, “Epik LLC will suspend and or terminate relationships with any company and or individual who violates its Terms of Services.”

In late 2022, Epik customers began reporting that they were suddenly unable to withdraw money from Masterbucks, Epik’s payment platform, which facilitated buying and selling pricey domain names. One customer, Luigi Marruso, posted on the domain name forum NamePros claiming that Epik was holding onto $1.5 million of its money. In an email to WIRED, Marruso says he still hasn’t been paid back.

Another customer, Matthew Adkisson, sued Epik and Monster, claiming they had mismanaged or embezzled $327,000 from him as he sought to purchase nourish.com. Epik later settled with Adkisson.

Claims like Adkisson’s began to pile up on forums for professionals in the domain name business (known as “domainers”), and Epik was in serious financial jeopardy.

Epik’s customers, fearing the worst, rushed to get their money back from the company. Epik even had outstanding debts with ICANN, the nonprofit that serves as a global administrator for the internet, according to legal filings.

“They were using customer funds to fund its operations. People started asking for those customer funds back, and they couldn't pay them,” says Andrew Allemann, a journalist who covered the fiasco for Domain Name Wire. “There was a run on the bank, and the money wasn’t there.”

In September 2022, a new CEO was installed at Epik in an attempt to stem the bleeding and settle the company’s debts. Epik, once valued by an investor at around $150 million was sold for around $5 million dollars in June 2023, according to a purchase agreement released as an exhibit in the Adkisson lawsuit. Much of the $5 million purchase price was allocated to paying off some of Epik’s debts. It’s unclear if the terms of the final deal match the one released as part of the lawsuit, but a source familiar with the acquisition says it was generally similar.

The rest of the debt was left with Monster. Just how much Monster owes former customers and vendors is unknown. Two former Epik customers told WIRED they’re still waiting to be paid back $38,000 and $20,000, respectively.

_Updated: 2/8/2024, 2:35 pm ET: Added additional comment from a Registered Agents Inc. spokesperson regarding Dan Keen's relationship with the company._

Epik, the Far-Right's Favorite Web Host, Has a Shadowy New Owner

In a test at one station, Transport for London used a computer vision system to try and detect crime and weapons, people falling on the tracks, and fare dodgers, documents obtained by WIRED show.

Thousands of people using the London Underground had their movements, behavior, and body language watched by AI surveillance software designed to see if they were committing crimes or were in unsafe situations, new documents obtained by WIRED reveal. The machine-learning software was combined with live CCTV footage to try to detect aggressive behavior and guns or knives being brandished, as well as looking for people falling onto Tube tracks or dodging fares.

From October 2022 until the end of September 2023, Transport for London (TfL), which operates the city’s Tube and bus network, tested 11 algorithms to monitor people passing through Willesden Green Tube station, in the northwest of the city. The proof of concept trial is the first time the transport body has combined AI and live video footage to generate alerts that are sent to frontline staff. More than 44,000 alerts were issued during the test, with 19,000 being delivered to station staff in real time.

Documents sent to WIRED in response to a Freedom of Information Act request detail how TfL used a wide range of computer vision algorithms to track people’s behavior while they were at the station. It is the first time the full details of the trial have been reported, and it follows TfL saying, in December, that it will expand its use of AI to detect fare dodging to more stations across the British capital.

In the trial at Willesden Green—a station that had 25,000 visitors per day before the Covid-19 pandemic—the AI system was set up to detect potential safety incidents to allow staff to help people in need, but it also targeted criminal and antisocial behavior. Three documents provided to WIRED detail how AI models were used to detect wheelchairs, prams, vaping, people accessing unauthorized areas, or putting themselves in danger by getting close to the edge of the train platforms.

The documents, which are partially redacted, also show how the AI made errors during the trial, such as flagging children who were following their parents through ticket barriers as potential fare dodgers, or not being able to tell the difference between a folding bike and a nonfolding bike. Police officers also assisted the trial by holding a machete and a gun in the view of CCTV cameras, while the station was closed, to help the system better detect weapons.

Privacy experts who reviewed the documents question the accuracy of object detection algorithms. They also say it is not clear how many people knew about the trial, and warn that such surveillance systems could easily be expanded in the future to include more sophisticated detection systems or face recognition software that attempts to identify specific individuals. “While this trial did not involve facial recognition, the use of AI in a public space to identify behaviors, analyze body language, and infer protected characteristics raises many of the same scientific, ethical, legal, and societal questions raised by facial recognition technologies,” says Michael Birtwistle, associate director at the independent research institute the Ada Lovelace Institute.

In response to WIRED's Freedom of Information request, the TfL says it used existing CCTV images, AI algorithms, and “numerous detection models” to detect patterns of behavior. “By providing station staff with insights and notifications on customer movement and behaviour they will hopefully be able to respond to any situations more quickly,” the response says. It also says the trial has provided insight into fare evasion that will “assist us in our future approaches and interventions,” and the data gathered is in line with its data policies.

In a statement sent after publication of this article, Mandy McGregor, TfL's head of policy and community safety, says the trial results are continuing to be analyzed and adds, “there was no evidence of bias” in the data collected from the trial. During the trial, McGregor says, there were no signs in place at the station that mentioned the tests of AI surveillance tools.

“We are currently considering the design and scope of a second phase of the trial. No other decisions have been taken about expanding the use of this technology, either to further stations or adding capability.” McGregor says. “Any wider roll out of the technology beyond a pilot would be dependent on a full consultation with local communities and other relevant stakeholders, including experts in the field.”

Computer vision systems, such as those used in the test, work by trying to detect objects and people in images and videos. During the London trial, algorithms trained to detect certain behaviors or movements were combined with images from the Underground station’s 20-year-old CCTV cameras—analyzing imagery every tenth of a second. When the system detected one of 11 behaviors or events identified as problematic, it would issue an alert to station staff’s iPads or a computer. TfL staff received 19,000 alerts to potentially act on and a further 25,000 kept for analytics purposes, the documents say.

The categories the system tried to identify were: crowd movement, unauthorized access, safeguarding, mobility assistance, crime and antisocial behavior, person on the tracks, injured or unwell people, hazards such as litter or wet floors, unattended items, stranded customers, and fare evasion. Each has multiple subcategories.

Daniel Leufer, a senior policy analyst at digital rights group Access Now, says whenever he sees any system doing this kind of monitoring, the first thing he looks for is whether it is attempting to pick out aggression or crime. “Cameras will do this by identifying the body language and behavior,” he says. “What kind of a data set are you going to have to train something on that?”

The TfL report on the trial says it “wanted to include acts of aggression” but found it was “unable to successfully detect” them. It adds that there was a lack of training data—other reasons for not including acts of aggression were blacked out. Instead, the system issued an alert when someone raised their arms, described as a “common behaviour linked to acts of aggression” in the documents.

“The training data is always insufficient because these things are arguably too complex and nuanced to be captured properly in data sets with the necessary nuances,” Leufer says, noting it is positive that TfL acknowledged it did not have enough training data. “I'm extremely skeptical about whether machine-learning systems can be used to reliably detect aggression in a way that isn’t simply replicating existing societal biases about what type of behavior is acceptable in public spaces.” There were a total of 66 alerts for aggressive behavior, including testing data, according to the documents WIRED received.

Madeleine Stone, a senior advocacy officer at privacy-focused group Big Brother Watch, says that many Tube travelers will be “disturbed” to learn that authorities subjected people to AI-powered surveillance. Stone says that using an algorithm to determine whether someone is “aggressive” is “deeply flawed” and points out that the UK’s data regulator has warned against using emotion analysis technologies.

Staff at the transportation body ran “extensive simulations” at Willesden Green station during the trial to gather more training data, the documents say. These included members of staff falling on the floor, and some of these tests happened when the station was closed. “You will see the BTP \[British Transport Police\] officer holding a machete and handgun in different locations within the station,” one caption in the documents state, although the images are redacted. During the trial, the files say, there were no alerts for weapons incidents at the station.

The most alerts were issued for people potentially avoiding paying for their journeys by jumping over or crawling under closed fare gates, pushing gates open, walking through open gates, or tailgating someone who paid. Fare dodging costs up to £130 million per year, TfL says, and there were 26,000 fare evasion alerts during the trial.

During all of the tests, images of people’s faces were blurred and data was kept for a maximum of 14 days. However, six months into the trial, the TfL decided to unblur the images of faces when people were suspected of not paying, and it kept that data for longer. It was originally planned, the documents say, for staff to respond to the fare dodging alerts. “However, due to the large number of daily alerts (in some days over 300) and the high accuracy in detections, we configured the system to auto-acknowledge the alerts,” the documents say.

Birtwistle, from the Ada Lovelace Institute, says that people expect “robust oversight and governance” when technologies like these are put in place. “If these technologies are going to be used, they should only be used with public trust, consent and support,” Birtwistle says.

A large part of the trial was aimed at helping staff understand what was happening at the station and respond to incidents. The 59 wheelchair alerts allowed staff at Willesden Green station, which does not have access facilities for wheelchairs, to “provide the necessary care and assistance,” the files say. Meanwhile, there were almost 2,200 alerts for people going beyond yellow safety lines, 39 for people leaning over the edge of the track, and almost 2,000 alerts for people sitting on a bench for extended periods.

“Throughout the PoC we have seen a huge increase in the number of public announcements made by staff, reminding customers to step away from the yellow line,” the documents say. They also say the system generated alerts for “rough sleepers and beggars” at the station’s entrances and claim this allowed staff to “remotely monitor the situation and provide the necessary care and assistance.” TfL states that the system was trialed to try to help it improve the quality of staffing at its stations and make it safer for passengers.

The files do not contain any analysis of how accurate the AI detection system is; however, at various points, the detection had to be adjusted. “Object detection and behavior detection are generally quite fragile and are not foolproof,” Leufer, of Access Nows, says. In one instance, the system created alerts saying people were in an unauthorized area when in reality train drivers were leaving the train. Sunlight shining onto the camera also made them less effective, the documents say.

The tests also aimed to see if unfolded or nonfolding bikes and escooters—which are largely not allowed on the transport network—could be detected by AI. “The Al could not differentiate between an unfolded bike and normal bike and an e-scooter and children's scooter,” the documents state. The fare dodging model also flagged children. “During school travelling hours, we would see a spike in parent and child tailgating alerts,” the documents say. The system was adjusted to not flag people “whose height was below the gate.”

In recent years, the use of AI in public spaces to detect people’s behaviors, movements, or identities has increased—often through the guise of smart city approaches. In July last year, reports revealed that several New York City subway stations are using AI to track fare evasion. In London, TfL said in December it would expand its fare evasion trials to other stations, although the status of those experiments is unknown

Many of these systems are being developed in situations where there is a lack of specific laws governing their use, with warnings of a regulatory vacuum in the UK. “Normalizing AI-powered monitoring at transport hubs is a slippery slope towards a surveillance state, and must be subject to greater transparency and public consultation,” says Stone from Big Brother Watch.

Leufer warns that once these systems start to be used more widely, they can always be upgraded. “Once the infrastructure is there, it's absolutely trivial to update what it does,” he says. “It's really worrying, what could be added to these things. The slippery slope is very slippery."

_Update: 2/8/24, 5 pm ET: Added comment from a TfL spokesperson._

London Underground Is Testing Real-Time AI Surveillance Tools to Spot Crime

Passkeys are here to replace passwords. When they work, it’s a seamless vision of the future. But don’t ditch your old logins just yet.

Using passkeys likely means having a different mindset from how you think about passwords. There’s nothing to remember when you log in, and you have to use something else to store your passkeys. Passkeys can be stored in Apple’s, Google’s or Microsoft’s password manager systems; your browser; a dedicated password manager; or on a physical security key. I created a Google passkey on one USB key, and all I need to do to sign in is, essentially, plug it in. (All of the devices I use professionally and personally are Apple, meaning I haven’t tested passkeys between my iPhone and a Windows laptop, for instance.)

“The technology is mature, the front ends are still nascent,” Shikiar from the FIDO Alliance says. Over the past year, the FIDO alliance has also been working on user experience guidelines, he says, making it more straightforward for people to sign up and use passkeys across systems. Gary Orenstein, the chief customer officer of password manager Bitwarden, says there are multiple groups involved in the creation and rollout of passkeys, so transitioning to a world where everything is seamless takes coordination. “The standards are at one level, user expectations are at a different level,” he says. “The vendor implementations are at a third level, and they’re merging, but it takes time.”

Being able to save a passkey on essentially any device makes them more useful and means you aren’t locked in to Google’s, Microsoft’s, or Apple’s ecosystems. However, where you save a passkey is going to take some remembering. When setting up one passkey, I was asked by my password manager, browser, and the device operating system whether I wanted to save my passkey with each of them. Picking one spot and sticking to it is probably the best option.

Most of my work is done on my laptop—and it's rare that I download new apps or log out of apps on my phone—so I have been saving the majority of my passkeys in Bitwarden, which costs me $10 a year for a premium account alongside my hundreds of passwords. It works like this: When logging in to my Amazon account, I enter my username, and then Bitwarden’s browser extension pops up asking whether I want to log in with my passkey for Amazon. I press confirm, and I am logged in. It also offers the option to use my device or a hardware key to log in, and if I select one of these options, it looks for passkeys stored on my laptop.

However, as mentioned, Bitwarden doesn’t currently offer passkeys on mobile, meaning that to get the mobile-first Coinbase integration to work, I ended up saving that passkey to iCloud’s Keychain instead. Orenstein, from Bitwarden, says that making passkeys work on mobile is a priority for Bitwarden and more support should be rolling out in the coming months. The company has seen a “fantastic” adoption of passkeys so far, he says, but acknowledges people will have to get used to the change. “You still need an awareness about where it is,” Orenstein says. “I think, over time, as an industry, we can reduce the need for that awareness, hopefully to zero.”

The Password’s Long Goodbye

You may not have set up any passkeys yet, but it’s only a matter of time. Tech companies are starting to make passkeys the default, and more businesses are adopting them. In the past couple of weeks, X has started allowing some people to use passkeys, and WhatsApp is bringing them to iPhones and iPads after previously rolling out passkey support for Android devices.

Leona Lassak, Blase Ur, and Maximilian Golla, three academics from Germany and the US who have researched the adoption of passkeys, say that businesses they’ve interviewed are generally positive about the adoption of passkeys and the extra security it will bring. However, it will likely take some time until the majority of websites, apps, and companies are using passkeys for everything. “I don’t think we will have a big bang in the next few months,” Lassak says. “It’s going to be a slow process, which on the way will then also catch other and smaller entities.”

As a result, passwords will still be around for a while. It’ll be a long time until I have converted my remaining 320-ish accounts to be using passkeys. And for the time being at least, those accounts where I do have passkeys will still have existing passwords that I can fall back on. “Passkeys is having fewer passwords, but not necessarily no passwords,” says Golla.

Experts recommend setting up a few passkeys whenever you come across them on your online accounts, rather than necessarily trying to change them all at once. There are guides to what websites are using passkeys already, and Google, Microsoft, and Apple all have straightforward explanations on how to create passkeys. And there are plenty of benefits to getting started now.

“They are a true password replacement that eliminate the threat of phishing, eliminate the hassle of password resets, and eliminate the liability that service providers have when they’re managing thousands, tens of thousands, or tens of millions, or billions of passwords,” Shikiar says. “It really is an entirely new way of doing user authentication.”

I Stopped Using Passwords. It's Great—and a Total Mess

“The people are in the streets. We can’t ignore them any longer. Really, we have little choice. Either we heal together, or we tear ourselves apart.” An exclusive excerpt from 2054: A Novel.

2054, Part IV: A Nation Divided

After a slowdown in payments to ransomware gangs in 2022, last year saw total ransom payouts jump to their highest level yet, according to a new report from crypto-tracing firm Chainalysis.

A year ago, there seemed to be a glimmer of hope in the cybersecurity industry's long-running war of attrition against ransomware gangs. Fewer corporate victims of those hackers, it seemed, had paid ransoms in 2022, and cybercriminals were earning less from their ruthless attacks. Perhaps the cocktail of improved security measures, increased focus from law enforcement, international sanctions on the ransomware operators, and scrutiny of the cryptocurrency industry could actually beat the ransomware scourge.

Well, no. That respite appears to have been a mere hiccup on ransomware's trajectory to become one of the world's most profitable, and perhaps _the_ most disruptive, form of cybercrime. In fact, 2023 was its worst year ever.

On Wednesday, cryptocurrency-tracing firm Chainalysis published new numbers from its annual crime report showing that ransomware payments exceeded $1.1 billion in 2023, based on its tracking of those payments across blockchains. That's the highest number Chainalysis has measured for a single year, and nearly twice as much as the year before. Indeed, the company now describes 2022's relatively low $567 million in ransom payments as an “anomaly,” as total extortion transactions have steadily grown since 2020 towards their current 10-figure record.

“It's like we've picked up right where we left off, the real onslaught during Covid in 2020 and 2021,” says Jackie Burns Koven, head of threat intelligence at Chainalysis. “It feels very gloves-off.”

That record-breaking $1 billion-plus in extortion payments was a result, in part, of the sheer number of ransomware attacks in 2023. Cybersecurity firm Record Future counted 4,399 ransomware attacks last year, based on news reports and ransomware gangs' public listings of victims on their dark-web sites, a tactic the groups often use to pressure victims while threatening to release their stolen data. That's compared to just 2,581 total attacks in 2022 and 2,866 in 2021.

The spike in the number of attacks appears to have offset a more positive trend: By some counts, fewer victims of ransomware are paying the ransoms that hackers demand. According to data from the incident response firm Coveware, which frequently negotiates with ransomware gangs on behalf of victims, only 29 percent of ransomware victims paid a ransom in the fourth quarter of 2023, a dramatic drop from payment rates between 70 percent and 80 percent for most of 2019 and 2020.

Even as fewer victims are paying, however, the total sum collected by ransomware gangs is nonetheless growing as more cybercriminals are drawn to a lucrative industry and carry out more attacks. Allan Liska, a threat intelligence analyst at Recorded Future, argues that the highly public nature of ransomware serves as a kind of advertising, constantly pulling in more opportunistic hackers, like sharks who smell blood in the water. “Everybody _sees_ all these ransomware attacks,” Liska says. “Criminals tend to flock to where they see the money being made.”

Total annual ransomware payments over time.

Courtesy of Chainalysis

Chainalysis notes that the record $1.1 billion in ransoms paid in 2023 was also driven by ransomware hackers demanding larger sums from victims, many of whom were carefully chosen for both their inability to tolerate a crippling attack and their ability to pay—what Chainalysis' Burns Koven calls “big game hunting.” That resulted in close to 75 percent of ransomware payments' total value coming from transactions topping the $1 million mark in 2023, compared to just 60 percent in 2021.

Given ransomware's cutthroat evolution, 2022's dip in total payments now seems to represent a rare aberration. Chainalysis and other security firms explain that off year by pointing to the war in Ukraine—which disrupted Ukrainian ransomware operators, distracted Russian ones pulled into political hacking, and caused strife within ransomware groups with mixed loyalties—as well as international sanctions that dissuaded victims from paying ransoms and major law enforcement crackdowns.

In one case, for instance, the prolific ransomware group known as Conti disbanded after one of its leaders posted a statement in support of Russia's war in Ukraine and another dissented by leaking a vast trove of the group's internal communications. Many of Conti's members then reformed under the brand of the Hive ransomware operation—which turned out to have been infiltrated for months by the FBI and other agencies who were quietly stealing the group's decryption keys to foil hundreds of their extortion attempts. Chainalysis estimates that that sting alone likely prevented more than $200 million in ransomware payments. “The dissolution of Conti was almost a perfect storm,” says Burns Koven.

Last year, by contrast, saw a perform storm of a very different kind: The Cl0p ransomware group exploited a vulnerability in the MOVEit file transfer application to compromise thousands of victims, combing through them for the most high-value targets. Several were medical companies and government agencies holding millions of sensitive records. In total, at least 62 million people were affected, and Cl0p reaped more than $100 million from that mass exploitation, accounting for 45 percent of all ransom payments in June of 2023 and 39 percent in July by Chainalysis' count.

The continued growth of the ransomware business—whose disruption for victims, it should be noted, costs well beyond the $1.1 billion that some of them paid in 2023—may seem like a sign of failure for the continued crackdown on cryptocurrency crime: Since the beginning of the decade, regulators and law enforcement have been going after not just ransomware groups, but the rogue exchanges and “mixers” that often serve as money laundering tools that allow cybercriminals to cash out their crypto profits.

Burns Koven argues, however, that even 2023's record-breaking ransom total doesn't mean the crypto crackdown isn't working. In fact, she says, it's driven ransomware groups to constantly seek new laundering methods and, in some cases, forced them to hold on to ransom payments for years before they attempt to cash out that dirty crypto, for fear that it will be frozen or seized. She adds that faster reporting to law enforcement from victims who pay ransoms—faster even than Chainalysis or other crypto-tracing firms can spot those payments on blockchains—could further aid in chasing down those funds and preventing them from being liquidated.

“The best way to bring these numbers down is to impact that laundering and cashing-out process,” says Burns Koven. Beyond even flashy law enforcement operations like the Hive takeover, she says that “there's also operational friction and paralysis that contributes to stagnating some of their operations and ability to profit.”

For now, though, ransomware is looking anything but stagnant. And if tightening the screws on money launderers—or the victims paying ransoms, or the hackers themselves—has any chance of solving the problem, those screws aren't tight enough yet.

Ransomware Payments Hit a Record $1.1 Billion in 2023

“You’d have an incomprehensible level of computational, predictive, analytic, and psychic skill. You’d have the mind of God.” An exclusive excerpt from 2054: A Novel.

Source

Wired