Russia's most notorious military hackers successfully sabotaged Ukraine's power grid for the third time last year. And in this case, the blackout coincided with a physical attack.

The notorious unit of Russia's GRU military intelligence agency known as Sandworm remains the only team of hackers to have ever triggered blackouts with their cyberattacks, turning off the lights for hundreds of thousands of Ukrainian civilians not once, but twice within the past decade. Now it appears that in the midst of Russia's full-scale war in Ukraine, the group has achieved another dubious distinction in the history of cyberwar: It targeted civilians with a blackout attack at the same time missile strikes hit their city, an unprecedented and brutal combination of digital and physical warfare.

Cybersecurity firm Mandiant today revealed that Sandworm, a cybersecurity industry name for Unit 74455 of Russia's GRU spy agency, carried out a third successful power grid attack targeting a Ukrainian electric utility in October of last year, causing a blackout for an unknown number of Ukrainian civilians. In this case, unlike any previous hacker-induced blackouts, Mandiant says the cyberattack coincided with the start of a series of missile strikes targeting Ukrainian critical infrastructure across the country, which included victims in the same city as the utility where Sandworm triggered its power outage. Two days after the blackout, the hackers also used a piece of data-destroying "wiper" malware to erase the contents of computers across the utility's network, perhaps in an attempt to destroy evidence that could be used to analyze their intrusion.

Mandiant, which has worked closely with the Ukrainian government on digital defense and investigations of network breaches since the start of the Russian invasion in February of 2022, declined to name the targeted electric utility or the city where it was located. Nor would it offer information like the length of the resulting power loss or the number of civilians affected.

Mandiant does note in its report on the incident that as early as two weeks before the blackout, Sandworm's hackers appear to have already possessed all the access and capabilities necessary to hijack the industrial control system software that oversees the flow of power at the utility's electrical substations. Yet it appears to have waited to carry out the cyberattack until the day of Russia's missile strikes. While that timing may be coincidental, it more likely suggests coordinated cyber and physical attacks, perhaps designed to sow chaos ahead of those air strikes, complicate any defense against them, or add to their psychological effect on civilians.

"The cyber incident exacerbates the impact of the physical attack," says John Hultquist, Mandiant's head of threat intelligence, who has tracked Sandworm for nearly a decade and named the group in 2014. "Without seeing their actual orders, it's really hard on our side to make a determination of whether or not that was on purpose. I will say that this was carried out by a military actor and coincided with another military attack. If it was a coincidence, it was a terribly interesting coincidence."

Nimbler, Stealthier Cybersaboteurs

The Ukrainian government's cybersecurity agency, SSSCIP, declined to fully confirm Mandiant's findings in response to a request from WIRED, but it didn't dispute them. SSSCIP's deputy chair, Viktor Zhora, wrote in a statement that the agency responded to the breach last year, working with the victim to "minimize and localize the impact." In an investigation over the two days following the near-simultaneous blackout and missile strikes, he says, the agency confirmed that the hackers had found a "bridge" from the utility's IT network to its industrial control systems and planted malware there capable of manipulating the grid.

Mandiant's more detailed breakdown of the intrusion shows how the GRU's grid hacking has evolved over time to become far more stealthy and nimble. In this latest blackout attack, the group used a "living off the land" approach that has become more common among state-sponsored hackers seeking to avoid detection. Instead of deploying their own custom malware, they exploited the legitimate tools already present on the network to spread from machine to machine before finally running an automated script that used their access to the facility's industrial control system software, known as MicroSCADA, to cause the blackout.

In Sandworm's 2017 blackout that hit a transmission station north of the capital of Kyiv, by contrast, the hackers used a custom-built piece of malware known as Crash Override or Industroyer, capable of automatically sending commands over several protocols to open circuit-breakers. In another Sandworm power grid attack in 2022, which the Ukrainian government has described as a failed attempt to trigger a blackout, the group used a newer version of that malware known as Industroyer2.

Sandworm Hackers Caused Another Blackout in Ukraine—During a Missile Strike

Face recognition technology has been controversial for years. Cops in the UK are drastically increasing the amount they use it.

A Beyoncé gig, the coronation of King Charles, and the British Formula One Grand Prix all have one thing in common: Thousands of people at the events, which all took place earlier this year, had their faces scanned by police-operated face recognition tech.

Backed by the Conservative government, police forces across England and Wales are being told to rapidly expand their use of the highly controversial technology, which globally has led to false arrests, misidentifications, and lives derailed. Police have been told to double their use of face searches against databases by early next year—45 million passport photos could be opened up to searches—and police are increasingly working with stores to try to identify shoplifters. Simultaneously, more regional police forces are testing real-time systems in public places.

The rapid expansion of face recognition comes at a time when trust in policing levels are at record lows, following a series of high-profile scandals. Civil liberties groups, experts, and some lawmakers have called for bans on the use of face recognition technology, particularly in public places, saying it infringes on people’s privacy and human rights, and isn’t a “proportionate” way to find people suspected of committing crimes.

“In the democratic world, we are an outlier at the moment,” says Madeleine Stone, a senior advocacy officer with Big Brother Watch, a privacy-focused group that has called for a ban and “immediate stop” on live face recognition, a proposal backed by 65 UK lawmakers. The EU, which the UK left in 2016, may ban the real-time use of face recognition systems, and one of its highest courts has called the technology “highly intrusive.” Various US states have banned police from using the technology.

Cops in England and Wales can hunt for potential criminals using two main kinds of face recognition. First, there are live face recognition systems (LFR): These usually include cameras mounted on police vans that scan people’s faces as they walk by and check them against a “watchlist” of wanted people. The LFR technology is deployed for some big events and announced in advance by the police. Second, there’s retrospective face recognition (RFR), where images from CCTV, smartphones, and doorbell cameras can be fed into a system that tries to identify the person based on millions of existing photos. Police use of both systems is increasing.

Two police forces in England and Wales—London’s Metropolitan Police and South Wales Police—have embraced LFR, using the technology for multiple years. (Police in Scotland, where policing is overseen locally, don’t use live systems but are reportedly increasing their use of RFR). So far this year, the Met and South Wales Police have used LFR on 22 separate occasions, according to statistics published on their websites.

Across 13 deployments, an estimated 247,764 people have passed the Met’s cameras this year, including at the King’s coronation and a soccer match between Arsenal and Tottenham. In 2023 so far, the Met’s system has pinged 18 times when it has matched a person with someone on the predetermined watchlist. Twelve of those people have been arrested. South Wales Police has used LFR nine times this year, scanning an estimated 705,290 faces and arresting two people.

Researchers and academics have long shown face recognition technologies to be biased or less accurate for people of color, particularly Black people. In all of the LFR uses by the Met and South Wales police forces this year, their figures show, there have been no false alerts or misidentifications. In short, every time the system made a match, it was correct, according to the departments’ data. The data published by the police forces show the LFR systems they are using are set to an accuracy threshold of either 0.6 or 0.64. A study conducted by the National Physical Laboratory, a UK public sector research organization, recommended the threshold setting of 0.64 as a way to reduce biased and incorrect matches.

Pete Fussey, a professor at the University of Essex who previously audited the Met’s face recognition, says that the report shows the algorithms may still be discriminatory and biased, but setting the thresholds neutralizes the system entirely. “If you desensitize the system, then you'll get fewer matches and fewer of those will be wrong,” Fussey says. Big Brother Watch’s Stone says it “brings into question the necessity and proportionality of the whole endeavor if you’re having dozens of police officers standing around the street looking at iPads just to make one arrest.” Stone argues “it’s not a good use of time.”

A spokesperson for the Home Office, the government department responsible for policing in England and Wales, says it is “committed” to giving police the technology they need to help solve crimes. “Technology such as facial recognition helps the police quickly and accurately identify those wanted for serious crimes, as well as missing or vulnerable people,” the spokesperson says, claiming it “frees up police time and resources.” They point to a blog post about police use of face recognition technologies.

“Live facial recognition isn't just deployed on its own. It's in support of wider policing operations,” says detective chief inspector Jamie Townsend, who is the operational lead for the Met's face recognition. A policing operation may make 30 arrests in an area with face recognition contributing two or three of them, he says.

Townsend says that the biometric data of people isn’t stored when they are scanned by LFR cameras, and he considers the system to be “precision policing” as it allows for the identification of specific individuals. The Home Office’s blog post claims LFR has led to the arrest of sex offenders and someone wanted for possessing a knife. South Wales Police did not respond to WIRED’s request for comment at the time of writing.

Two other UK police forces have tried LFR in recent months, raising concerns about how the technology will be used going forward and who is put on the watchlists of people the systems are looking for. There are more than 30 police forces that have not used LFR, although the government has said it is “very supportive” of more forces using it.

Around 380,000 people had their faces scanned by Northamptonshire police over three days at the British Grand Prix in July, according to public records requests. No arrests were made. A Freedom of Information Act request from Big Brother Watch revealed the force had placed 790 people on the watchlist for the event while only 234 were wanted for arrest. “It was largely individuals who were not wanted for any criminal reasons, which leads us to believe that these were protesters who were being put on watchlists,” Stone says. The previous year’s British Grand Prix was disrupted by protesters.

A statement from Northamptonshire Police says the watchlist “included a range of offences from organized crime to aggravated trespass, which had the potential of leading to the death or serious injury of the public, racing drivers and staff, especially if there was a repeat of the 2022 track incursion. We were not targeting those taking part in lawful, peaceful protests.”

Police forces are also being encouraged to ramp up the use of after-the-fact, retrospective face recognition. All police forces across the UK have the ability to run searches for faces against the Police National Database, which has more than 16 million photos and includes millions of images that should have been deleted years ago. In 2022, according to data from freedom of information requests, there were 85,158 face searches—up 330 percent on the previous year. Policing minister Chris Philp said in October that he wants the number of searches to double by May 2024.

Fussey, the University of Essex professor, says retrospective face recognition is often thought to be more “benign” than live face recognition, but he doesn't believe it is the case. “The issues and harms and human rights implications are the same, whether it's live or retrospective,” he says, adding there is a lot of ambiguity around how the technology is being used.

In August 2020, the UK’s Court of Appeal ruled that South Wales Police’s use of LFR was unlawful. Since then, police forces using the technology say they have changed their procedures in response to the court decision, and the Home Office spokesperson says there is a “comprehensive legal framework in the UK” that requires police to use the technology only when it is “necessary, proportionate, and fair.”

Many disagree. A wide-ranging review from the Ada Lovelace Institute, a nonprofit, says there is “legal uncertainty” about the use of LFR. Another report by University of Cambridge academics, from the Minderoo Centre for Technology and Democracy, concluded that three examined police deployments of face recognition “failed to meet the minimum ethical and legal standards.”

“It’s wholly legitimate for police to use technology to keep the public safe,” says Fussey, who recently completed a report on proposals to change the oversight of biometrics in the UK. “The question is about how lawful and necessary it is,” he says. “At the moment, we’re in a situation where the legal basis isn’t clear. There’s no external oversight of how it’s used, how it’s authorized, who’s on the watchlist.”

Police Use of Face Recognition Is Sweeping the UK

The third GOP debate is sponsored by the Republican Jewish Coalition and will be livestreamed on a platform favored by one of America’s most notorious white nationalists.

Tonight, the third GOP presidential primary debate will take place in Miami. The event is sponsored by the Republican Jewish Coalition (RJC) at a time when antisemitic incidents in the US, according to the Anti-Defamation League, have risen by nearly 400 percent since the Israel-Hamas war erupted last month.

While the Republican National Committee (RNC) has partnered with NBC to broadcast the debate on TV, the event will also be livestreamed for the third time on Rumble, the YouTube alternative that is home to what the Southern Poverty Law Center says is one of America’s most notorious white nationalists, Nick Fuentes.

For the past month, Fuentes has used the Israel-Hamas conflict to push antisemitic hate speech and Holocaust denial conspiracies on his Rumble channel, racking up hundreds of thousands of views. Fuentes has hailed Rumble for reviving his audience, which has gained thousands of followers since Hamas attacked Israel on October 7.

“I think the show is bigger than it's been in a really long time,” Fuentes told his more than 40,000 viewers last week during one of his frequent livestreams on the platform. “If you look at the viewership on Rumble, it’s crazy. I’ve been getting really good viewership on Rumble like I haven’t since I was on YouTube … The replays have been insane.”

Fuentes is a white nationalist leader of the Groyper movement. He attended the neo-Nazi Unite the Right rally in Charlottesville in 2017, has openly praised Hitler, and repeatedly denied the Holocaust. He has also had dinner with former president Donald Trump.

Fuentes’ YouTube account was terminated in 2020 as Google demonetized it, and he initially struggled to retain his audience on a number of other platforms, including DLive and his own Cozy.tv streaming service. Fuentes joined Rumble in March 2021, and he was initially critical of the platform’s failure to promote his videos. He claims he was briefly suspended from the platform in July after posting the livestream of a rally where he called for a “holy war” against non-Christians. Now, less than four months later, he claims his channel is flourishing.

Since the outbreak of the Israel-Hamas war in early October, Fuentes has used his channel on Rumble, which has 42,600 followers, to spread antisemitic conspiracies, claiming in one video that the Israeli government had created the Hamas attack as “atrocity propaganda” to advance “Jewish interests.”

Fuentes compared the Hamas attack to the Holocaust, claiming both were created to “elicit a certain emotional response \[to give the government\] the popular mandate to do whatever it is the government wants to do.”

While it portrays itself as a free speech network, Rumble does have specific policies in place against racism and antisemitism. The platform removed two of Fuentes’ videos on Tuesday evening after WIRED flagged the antisemitic comments made in them, but many others remain. Rumble declined WIRED’s request to comment on whether or not it had an antisemitism problem on its platform.

Fuentes’ is one of many accounts that researchers at Media Matters, a left-leaning media watchdog group, have identified as not only spreading antisemitic content on Rumble, but also monetizing it.

“There is a plethora of antisemitic content on the platform as well as other violent content, conspiracy theories, and bigotry,” Kayla Gogarty, research director at Media Matters, tells WIRED. “We found about 16 far-right figures and groups who have made antisemitic content and have run advertisements on the platform, including Keith Woods, Elijah Schaffer, Stew Peters, and other accounts like Vincent James Foxx.”

Fuentes’ account has not monetized his own channel, but clips of his content have been monetized on Rumble, Gogarty says.

Fuentes did not respond to WIRED’s request for comment, nor did Woods, Schaefer, Peters, and Fox.

The RNC told WIRED in an emailed statement that “hate, bigotry and violence is unfortunately prevalent on every social media platform, and the RNC condemns it entirely, but the RNC does not manage content or pages outside of our own.”

The RJC did not respond to multiple requests from WIRED about the presence of Fuentes and antisemitism on Rumble. At the announcement of the RJC’s sponsorship of the debate last month, the group’s chairman, former US senator Norm Coleman from Minnesota, told NBC: “As the horrific events of the last week have unfolded in Israel, the issue of American foreign policy has taken on an even greater role. American strength and American resolve—and our candidates’ vision for America’s role in the world—are more important than ever.”

Founded in 2013, Rumble has in recent years become a home for many right-wing extremists, conspiracy peddlers, and election deniers who have been banned from mainstream platforms like YouTube, Facebook, and Instagram, or who have had their ability to monetize their content removed.

Rumble, which went public in 2022 and has seen significant growth in users over the past 18 months, has also partnered with Trump’s struggling social media platform Truth Social to provide video services. Donald Trump Jr., the former president’s son, and his wife, Kimberly Guilfoyle, both have exclusive deals with the platform where they post video podcast series.

The GOP Presidential Debate Is Livestreaming on Rumble, Home to White Nationalist Nick Fuentes

For the first time, guerrilla animal rights group Direct Action Everywhere reveals a guide to its investigative tactics and toolkit, from spy cams to night vision and drones.

In recent years, the animal liberation group Direct Action Everywhere has carried out some of the most brazen and tech-savvy operations and investigations to ever target the animal agriculture industry. It has rescued pigs, goats, ducks, and chickens from factory farms and slaughterhouses in midnight intrusions; captured virtual reality footage with custom-built 360-degree video rigs inside massive pig barns; and used hidden cameras to record some of the meat industry's most disturbing practices, from the carbon dioxide gas chambers that are increasingly used in pig slaughterhouses to the “ventilation shutdowns” designed to cull thousands of farm animals through overheating and suffocation.

To pull off all those revelatory and often highly controversial actions, Direct Action Everywhere (which uses the abbreviation DxE) has also spent years evolving its toolkit and operational rigor—from communications security and physical stealth, to penetration tactics for getting inside factory farms and slaughterhouses. It has also long maintained a manual of its own methods for those operations. Now, for the first time, it's publicly releasing that guide.

The document is a rare glimpse into the detailed tech and tactics of a group that carries out sophisticated and often illegal acts of intrusion and espionage, turning a playbook that might otherwise be used by spies or thieves into one for grassroots activism. “To spend so much time thinking about the vulnerabilities in these facilities, how to get in, avenues of approach,” says Lewis Bernier, a longtime investigator at DxE who has led or participated in hundreds of operations inside farms and slaughterhouses around the country, “I think it's really changed the way I see security as a whole.”

A note of warning: Despite the “how-to” tone of the guide itself, do not try this at home. DxE investigators frequently face criminal charges, and DxE's critics in the agriculture industry and in law enforcement describe the group as radicals with extreme tactics. Despite the group’s nonviolent approach, the agribusiness trade group WATT Global Media wrote in 2018 that DxE “could very well be the most dangerous animal rights organization out there.” Even some other animal rights organizations have balked at their risky methods, especially given the potential for prison sentences under some US states’ severe laws protecting animal agriculture businesses.

DxE goes as far as to welcome those criminal charges, often willingly identifying themselves after an investigation's findings are released in an effort to draw more attention to their revelations and argue the justice of their cause. In fact, the group's cofounder, Wayne Hsiung, was convicted just last week on a felony charge of conspiracy to commit trespassing related to the removal of ducks and chickens from a California poultry farm. He now potentially faces years in prison.

Bernier says that DxE decided to publicly release its guide, even in the wake of Hsiung’s conviction, to help activists who are already committed to carrying out covert investigations do their work more safely and effectively. “More and more people around the world want to do this stuff, or at least are just interested in how it works,” he says. “I think this guide will offer an opportunity for people to understand what's really involved.”

Drones, Night Vision, and Spy Cams

Much of the guide is focused less on spy tricks and espionage gear than on effective activism: team building, creating a chain of command, understanding the media, logistics, planning, biosecurity to avoid contaminating farms with disease, and creating a “security culture” that avoids the gossip, bragging, prying, and infighting that can lead to operations being blown or infiltrated by law enforcement.

But other elements of the manual offer specific descriptions of surveillance tools like drones, hidden cameras, and thermal and night vision scopes. For stealthy after-hours intrusions into factory farms and other facilities, for instance, the guide describes assigning a team member as a scout, equipped with night vision and thermal imaging tools. The guide specifically names the Sionyx Aurora Sport as its recommended night vision camera for both reconnaissance and capturing images in the dark, but notes that thermal imaging tools like the Flir Scout TK offer its scouts other advantages. Thermal imaging can reveal which parts of a facility are active, the guide notes, given that those buildings will be running heating or fans, and also show from a distance which vehicles outside a building have their engines running or have recently moved, revealed in heat traces on a car or truck's brakes.

This Is the Ops Manual for the Most Tech-Savvy Animal Liberation Group in the US

The Government Surveillance Reform Act of 2023 pulls from past privacy bills to overhaul how police and the feds access Americans’ data and communications.

In 1763, the radical journalist and colonial sympathizer John Wilkes published issue no. 45 of _North Briton_, a periodical of anonymous essays known for its virulent anti-Scottish drivel—and for viciously satirizing a British prime minister until he quit his job. The fallout from the subsequent plan of the British king, George III, to see Wilkes put in irons for the crime of being too good at lambasting his own government reverberates today, particularly in the nation whose founders once held Wilkes up as an idol, plotting a revolt of their own.

Wilkes’ arrest boiled the Americans’ blood. Reportedly, the politician-cum-fugitive had invited the king’s men into his home to read the warrant for his arrest aloud. He quickly tossed it aside. At trial, Wilkes explained its most insidious feature: “It named nobody,” he said, “in violation of the laws of my country.” This so-called general warrant, which subsequent lawsuits by Wilkes would see permanently banned, vaguely described some criminal allegations, but not a single place to be searched nor suspect to be arrested was named. This ambiguity granted the king's men near blanket authority to arrest anyone they wanted, raid their homes, and ransack and destroy their possessions and heirlooms, confiscating large bundles of private letters and correspondence. When the Americans later passed an amendment to ban vague legal warrants describing neither "the place to be searched" nor "persons or things to be seized," it was Wilkes's home, historians say, that they pictured.

This morning, a group of United States lawmakers introduced bicameral legislation aimed, once again, at reining in a government accused of arbitrarily snatching up the private messages of its own citizens—not by breaking down doors and seizing handwritten notes, but by tapping into the power of internet directly to collect an endless ocean of emails, calls, and texts. The Government Surveillance Reform Act of 2023 (GSRA)—introduced in the US House by representatives Zoe Lofgren and Warren Davidson, and in the US Senate by Ron Wyden and Mike Lee—is a Frankenstein bill more than 200 pages long, combining the choicest parts of a stack of cannibalized privacy bills that rarely made it past committee. The patchwork effect helps form a comprehensive package, targeting various surveillance loopholes and tricks at all levels of government—from executive orders signed by the president, to contracts secured between obscure security firms and single-deputy police departments in rural areas.

“Americans know that it is possible to confront our country’s adversaries ferociously without throwing our constitutional rights in the trash can,” Wyden tells WIRED, adding that for too long surveillance laws have failed to keep up with the growing threats to people’s rights. The GSRA, he says, would not strip US intelligence agencies of their broad mandate to monitor threats at home or abroad, but rather restore warrant protections long recognized as core to democracy’s functioning.

The GSRA is a Christmas list for privacy hawks and a nightmare for authorities who rely on secrecy and circumventing judicial review to gather data on Americans without their knowledge or consent. A US Justice Department requirement that federal agents obtain warrants before deploying cell-site simulators would be codified into law and extended to cover state and local authorities. Police in the US would need warrants to access data stored on people’s vehicles, certain categories of which should already require one when the information is stored on a phone. The government could also no longer buy sensitive information about people that would require a judge’s consent, had they asked for it instead.

What’s more, the bill will end a grandfather clause that’s keeping alive expired portions of the USA Patriot Act that’s allowed the FBI to continue employing surveillance techniques that have technically been illegal for two years. Petitioners in federal court seeking relief due to privacy violations will also no longer be shown the door for having no more than a “reasonable basis” to believe they’ve been wrongfully searched or surveilled.

Not to be outstripped by the sheer variety of smaller pet reforms—such as yanking the security clearances of anyone caught abusing a classified database (a crime that’s commonly punished with a slap on the wrist), or ensuring that the government can’t simply store people’s data for the rest of their lives because it hasn’t been decrypted—the GSRA principally takes aim at Section 702 of the Foreign Intelligence Surveillance Act, the government’s most promiscuous surveillance program through which it captures a large but _indeterminate_ amount of messages en route to and from Americans’ phones each day.

After 9/11, the US government commenced with some of the most extensive domestic surveillance in modern history, a monument achieved on the back of the internet’s technological revolution that redefined what it meant for people to communicate. Exposed by journalists and leakers at the height of America’s recent wars in the Middle East, the extent of the surveillance, once publicly acknowledged, unleashed bad memories of corrupt intelligence agencies relentlessly bugging anyone with a phone—actors, comedians, civil rights leaders, and even one another.

The US Congress, fearful of foreign threats, enacted only piecemeal reforms in response to these revelations, which kicked off in the early aughts and crescendoed in 2013 with Edward Snowden’s polemic leaks. The government’s sporadic but incessant updating of agency rules and procedures have done little to stymie routine abuses of the 702 data—which is currently fathomless. The first thing to know about the program, and how many Americans it ensnares each year, is that the government doesn't know the number and has little interest in learning it. A key defense, in fact, of the government's lack of transparency in this area is that examining the data to determine who is and is not an American would technically commit the very violation its procedures are designed to prevent.

While the program is strictly authorized for the surveillance of foreigners on foreign soil, wiretapping internet communications is neither accurate nor precise. In 2008, Congress was forced to effectively recognize that the collateral surveillance of Americans was the inevitable byproduct of operating an intelligence program with Big Brother–like proportions. Faced with growing privacy fears at home and emerging national security threats abroad, Congress took stock of the situation and then resigned to split the baby.

Nearly 60 years ago, in the face of overwhelming evidence that police interrogations are inherently coercive, the US Supreme Court did not ban the practice in _Miranda v. Arizona_ but rather ruled that the threat to people's rights could be reasonably mitigated by cops reading “collared” suspects a brief statement of rights—a “warning” that has much the same purpose as legal disclaimers read aloud on customer care calls. Similarly, Congress chose not to put an end to the surveillance of Americans' communication despite the enormous scale of rights violations accumulating steadily each day. Instead, it ordered the creation of many byzantine rules and procedures designed to ameliorate constitutional risks to some reasonable degree—by merely lessening the odds of a federal employee laying eyes on any illicitly gained information.

“Incidental” is a surveillance term of art referring to communications of Americans not _accidentally_ intercepted by their own government, but _unavoidably_. In a report last month, a federal privacy watchdog stressed that while the word “incidental” made the collection sound small, “it should not be understood as occurring infrequently.”

The GSRA takes aim at the use of incidental data by federal law enforcement agents, who are not bound by the same rules against spying on Americans as are analysts at the Pentagon, whose purview lies strictly overseas. While it is illegal to target US persons under 702, once they have been surveilled, the communications become accessible nevertheless to the Federal Bureau of Investigation, which has its own procedures for “querying” the nebulous database—rules that can permit, for example, the reading of emails marked “attorney-client privilege” so long as the subject isn’t wanted for a crime.

An inspector general’s investigation last year found the FBI’s own legal experts at variance over “key legal principles” tied to rules governing 702's use. Findings like these have served only to repeatedly injure the FBI, nurturing a cycle of disappointment and distrust in its capacity to behave as a competent surveillant.

The GSRA could work positively to solve many problems at the FBI. Trust in the bureau among lawmakers is only likely to grow, once its unfettered access to a digital black box filled with everyone's secrets becomes subject to court review. The GSRA removes the ability entirely for the FBI to run queries on US persons without probable cause, that is, “a reasonable amount of suspicion, supported by circumstances sufficiently strong to justify a proven and cautious person's belief that certain facts are probably true.” (In contrast, the current standard is this: Be looking for evidence of a crime, don't go fishing, and be “reasonably” confident the information you're after is “likely” to be found.)

“For too long, intelligence and law enforcement agencies have had unchecked access to Americans’ personal data,” says Lofgren, the representative from California who issued a warning to colleagues on Tuesday against the “unwise” move of reauthorizing the 702 program without “carefully considering and enacting surveillance reforms.”

The GSRA is currently the only bill in Congress that could reauthorize the 702 statute that’s set to expire by the end of the year. The statute is what allows the government to apply for “certifications” issued by the secret Foreign Intelligence Surveillance Court (FISC). These certifications, which all last for one year, allow the government to compel the cooperation of communications services providers for three purposes: foreign intelligence, counterterrorism, and the tracking of nuclear proliferation—with an array of threats, from cybercrime to narco-trafficking, all couched within those categories.

Whether or not Congress reauthorizes 702 before it expires, the collection will continue unabated until at least April, when the certifications expire. Hypothetically, the government could reapply for new certifications, which the FISC could grant before April, thereby extending the program's life into 2025 without Congress lifting a finger. That is unlikely, however, says Bob Goodlatte, former chairman of the House Judiciary Committee, who says any attempt to wrest control away from Congress will be viewed as a “hostile gesture,” further imperiling Section 702's survivability.

“The FISA Court and the Director of National Intelligence have confirmed that our government conducted warrantless surveillance of millions of Americans’ private communications,” says Senator Mike Lee.

In remarks to WIRED, Lee pointed to high-level confirmations that the US government is conducting “warrantless surveillance of millions of Americans” each day. “It is imperative that Congress enact real reforms to protect our civil liberties,” he says, including “statutory penalties for privacy violations,” a precondition of his support for “reauthorizing Section 702.”

Government Surveillance Reform Act of 2023 Seeks to End Warrantless Police and FBI Spying

Israel has said it’s prepared to disrupt internet service in Gaza, signaling a new age of warfare. In the past two weeks, the Palestinian territory has already suffered three communications shutdowns.

Since Hamas’ tragic October attack on Israel that killed at least 1,400 people, the country’s retaliation in Gaza has led to more than 10,000 deaths, according to unverified claims from the Hamas-run Gazan Health Ministry, and broad destruction of the community's basic utilities and infrastructure. This includes its internet and communication systems, with dwindling connectivity largely cutting off 2.2 million Gazans from the outside world.

On October 27, Israel reportedly imposed a full internet shutdown in the area, cutting off the last remaining connectivity for about 34 hours as its troops moved into the Gaza Strip. After what’s left of Gaza’s internet access was restored—data shows it stands at around 15 percent or less of usual connectivity—the area has suffered two other, similar connectivity blackouts. The most recent lasted for about 15 hours on Sunday as Israel was carrying out an intense operation to cut off Gaza City in the north from southern Gaza

While researchers and technologists who monitor internet connectivity can’t conclusively say that Israel was behind the blackouts—or that they were imposed using technical controls rather than physical destruction of infrastructure—the fact that some connectivity could be restored so rapidly seems to indicate deliberate shutdowns over incidental destruction.

“In the last 10 days, there have been three periods of time that connectivity has gone to completely zero,” says Doug Madory, director of internet analysis at monitoring firm Kentik. He notes that from the data he is able to see, it's only possible to determine whether internet service providers in Gaza are communicating with the outside world and not the specific cause of an outage. One “aggressor in the conflict that's taking place in Gaza happens to have the ability to turn off service in the region that they're doing military operations in,” Madory says.

Throughout the Gaza Strip, there are around a dozen internet service providers and cell phone companies that get people online—although cell networks only use 2G technologies, as opposed to the faster 3G, 4G, and 5G connections available across much of Israel. These companies are heavily reliant on Israeli infrastructure to connect to the global internet, with open internet advocacy nonprofit the Internet Society classing Palestine as having “poor” connections to the wider internet. Since the start of the war, mobile and internet providers’ offices, cables, and cell towers have been destroyed. Many are now totally offline.

“Israel controls the telecommunication and internet that comes to Gaza,” says Husam Mekdad, a telecoms engineer living in southern Gaza in a message to WIRED. He says “most” of the main internet service providers are down, and the mobile operators that can still operate 2G connections have hugely congested networks.

“No company can repair or do anything right now,” Mekdad says. Many firms, he says, are waiting until the war is over to see the status of their infrastructure and evaluate it. The United Nations Office for the Coordination of Humanitarian Affairs said last week that 65 percent of households and businesses have lost access to the internet and half of networks have been damaged.

The Palestinian territories’ biggest internet provider, Paltel, has retained the most connectivity, according to internet analysts. But during the three complete blackouts, even Paltel has been knocked offline. “When Paltel is offline, then I think everybody's down,” Madory says.

Paltel alleges that during the three blackouts its services were being “disconnected” by Israel. The Ministry of Communications and Information Technology of the State of Palestine has also claimed there has been “systematic targeting” of networks and urged countries to “put pressure on the Israeli government” to restore connections. Paltel has not returned WIRED’s multiple requests for comment in recent weeks.

The Israeli Defense Forces declined to comment when asked whether they were behind the recent internet shutdowns in Gaza. Israel’s Ministry of Communications did not respond to WIRED’s request for comment. However, on October 17, ahead of the total blackouts, the Israeli communications ministry published an update on the war that appeared to detail its plans. “There is an ongoing examination and preparation for the shutting down of cellular communications and internet services to Gaza,” the update said.

In recent years, internet shutdowns have become a dystopian reality for millions of people in India, Iran, Pakistan, Iraq, and other countries. Last year there were 187 internet shutdowns in 35 countries, according to Access Now, a digital rights nonprofit. Internet shutdowns can do huge damage to a country’s economy as well as people’s ability to communicate with friends and loved ones and access medical care and other essential information. Typically, internet shutdowns are initiated by repressive governments trying to control protests, stop people organizing, and quell dissent. The approach is widely condemned by democratic countries, the United Nations, and human rights groups.

After internet service came back in Gaza the first time in late October, the White House wrote in a statement that “the restoration of communications in Gaza was critical. Aid workers, civilians, and journalists need to be able to communicate to each other and the rest of the world. Our Administration cared about this, worked on it, and are glad to see it restored.” The US State Department and White House National Security Council did not return requests for comment from WIRED about the implications of the two subsequent internet shutdowns in Gaza.

“Seeing intermittent shutdowns reiterates where the power to shut down actually lies,” says Helga Tawil-Souri, a digital communication and media researcher focused on Israel-Palestine at New York University. “Every major bombing campaign that Israel has taken on sees with it new strategies of what media or communication forms are allowed and what is not allowed, as in the 2008-2009 bombing of Gaza, where there was a crackdown on foreign journalists for the first time, and the 2014 bombing. The kinetic warfare, the starving, the lack of communication, lack of water, targeting solar panels—all of it just kind of works together for the total incapacitation of normal life on every possible level.”

For people living in Gaza, it’s likely that as the war continues there will be more total internet shutdowns. Some have been able to find spots of connectivity, people with access to expensive satellite phones can communicate with the outside world, and others have used eSIMs to access Israeli or Egyptian networks that reach into Gaza. These and other circumvention techniques, while a critical lifeline, have been unreliable, though, as the war rages on.

Mekdad, the network engineer in Gaza, says that with little electricity or fuel to use generators, some people are using small solar chargers to power their devices. He showed WIRED a photo of nine phones connected to a series of power outlets. “The situation is very bad. We are running out of electricity, clean water, food, and medical supplies,” Mekdad says. His relatives have fled from the north looking for safe shelter in southern Gaza. “We expected to die every second,” he says. “We just hope to stay alive.”

Internet Blackouts in Gaza Are a New Weapon in the Israel-Hamas War

A complaint filed with the EU’s independent data regulator accuses YouTube of failing to get explicit user permission for its ad blocker detection system, potentially violating the ePrivacy Directive.

Privacy campaigner Alexander Hanff claims that YouTube’s new ad blocker detection is illegal under European law, and he's taking the fight to the European Commission.

On November 6, German Pirate Party MEP Patrick Breyer addressed Hanff’s claim to the European Commission, formally requesting a legal position as to whether “protection of information stored on the device (Article 5(3) ePR) also cover information as to whether the user's device hides or blocks certain page elements, or whether ad-blocking software is used on the device” and—critically—if this kind of detection is “absolutely necessary to provide a service such as YouTube.”

YouTube began rolling out ad block detection to Europe earlier this year and is now preventing some European users from viewing its content if they have an ad blocker enabled. The EU’s ePrivacy Directive requires online service providers to get explicit permission to “gain access to information stored in the terminal equipment of a subscriber or user.” Hanff, an expert advisor to the European Data Protection Board, alleges that YouTube’s use of JavaScript-based detection scripts to look for specific HTML page elements rendered by a user’s browser is subject to that requirement and he believes it is failing to abide by it.

In a complaint lodged with Ireland's Data Protection Commissioner (DPC), Hanff called on the DPC to “take action against YouTube … for this breach of the law and demand YouTube cease their unlawful deployment of adblocker detection tools.”

Hanff, who helped to draft the forthcoming update to the EU’s ePrivacy regulations, says he believes YouTube’s JavaScript violates EU citizens' privacy.

“The script that \[YouTube\] deploys is detecting what software people are running on their machines or what behaviour their browser is exhibiting in relation to their private activities. It's not okay. It's illegal,” Hanff claims, echoing his complaint. We have a fundamental right to privacy under Article 7 of the European Charter of Fundamental Rights. We have a fundamental right to data protection under Article 8.”

YouTube reportedly started implementing anti-adblock measures in May 2023, and in June was still describing its ad blocker detection as a “experiment.” European users have reported seeing detection messages since at least mid-October. Not every user is affected, and you’ll only see these anti-adblocker messages if you’re signed into your YouTube account.

When YouTube detects an ad blocker or other privacy tool that blocks ads as part of its functions, you'll see a warning stating that “Ad blockers violate YouTube's Terms of Service” or “Ad blockers are not allowed on YouTube.” There are a few different versions of this message, including some that entirely prevent you from playing videos and others that allow you to view a number of videos with your blocker enabled before streaming is blocked.

A pop-up asking you to turn off your ad blocker is hardly an unusual sight on the internet, but could it be against the law?

All versions of YouTube's ad blocker detection that WIRED is aware of use a JavaScript program that runs in the client browser, although YouTube says that it could use non-invasive server-side methods to identify if a video ad served to a user has not been played.

Hanff’s complaint claims that YouTube’s client-side detection code meets the description, in Article 5(3) of the ePrivacy directive 2002/58/EC, of a process used to “gain access to information stored in the terminal equipment of a subscriber or user." If that’s the case, the user must be provided with “clear and comprehensive information” about what this information will be used for and given the “right to refuse such processing.”

You'll be familiar with this process from the cookie consent forms that appear whenever a website wishes to capture non-essential information about you and your browser. Right now, neither an explicit notification nor an opt-out are displayed when YouTube obtains data about whether ad blocking tools may be active on your device or network connection.

YouTube representative Christopher Lawton tells WIRED that “ads support a diverse ecosystem of creators globally and allow billions to access their favorite content on YouTube. The use of ad blockers violate\[s\] YouTube’s Terms of Service.”

YouTube’s current terms, last updated on January 5, 2022, don’t explicitly mention the use of ad blocking tools, nor any detection measures, although a Permissions and Restrictions clause that forbids user activity to “circumvent, disable, fraudulently engage, or otherwise interfere with the Service” could be read as covering this scenario.

But Hanff, who holds an advanced master of laws in privacy, cybersecurity and data management from Maastricht University, maintains that, “under EU Consumer Protection Law, you're not legally allowed to enforce any terms in the contract which infringe on the fundamental rights and freedoms of an EU resident.” The reason cookie consent forms are so intrusive is because consent for device access can’t be bundled up with other terms and conditions.

Breyer, the German MEP, echoes Hanff’s beliefs, telling WIRED that "ad blockers protect us from illegal tracking of our online life and online harms. YouTube's terms and conditions likely violate EU law. YouTube should offer surveillance-free advertising and stop its anti-adblock campaign now."

YouTube obviously wants to make money—that server bandwidth isn't going to pay for itself. In 2022, ad-free YouTube Music and Premium had 80 million subscribers, while YouTube reported ad revenue of $7.95 billion in the third quarter of 2023 alone.

Priced at $13.99 (or €12.99 in Europe), YouTube Premium's primary benefit is ad-free video and music streaming. But if you can use an ad blocker to obtain most of the benefits of a subscription, there's little incentive to pay.

YouTube also needs its content creators to make enough money to justify their efforts. If you don't watch the ads on a video, and aren’t paying for YouTube Premium, the video you’re watching doesn't make any money for its uploader. That includes if you have ads enabled but press the “skip ad” button as soon as it appears on a skippable ad.

YouTube also reserves the right to serve ads on videos by creators who are not in the YouTube Partner Program or under a monetizing agreement, without sharing any revenue from those ads with said creators.

The arguments in favor of ad blocking range from reducing bandwidth consumption to avoiding psychologically harmful ads. (YouTube, for example, runs ads for alcohol, diets, and online casinos.) But the most compelling argument in favor of ad blocking is online security. Security researchers regard online ad networks as a key threat vector when it comes to cybersecurity, and ads on YouTube have previously been cited as serving crypto-mining malware and links to scams and pornographic content.

Most ad-blocking browser extensions look for specific file paths and filenames (such as those in the ad blocking Easylist) being called from within a page, and remove them from the version of the page that is rendered in your browser.

For example, a JavaScript program called “clever\_ads.js” (the name of a script produced by the Clever Ads advertising automation service, which embeds ads in your page) would be identified by the ad blocker and removed, along with any content it would normally load. In the case of YouTube, the ad API returned JSON files, which the ad blockers would replace.

There are a few methods of detecting whether a user is blocking ads, most of which involve another JavaScript program that checks the rendered page for evidence that ad content has been removed. A frequent approach is to have your ad-loading script also insert a JavaScript variable or an HTML element that can be checked for.

Of course, ad blockers can look for and remove the anti-adblocker scripts as well, and that’s what’s happening in the case of blocking tools, such as Adblock Plus and uBlock Origin, that regularly provide extra filters to download and add to the blocker so that it can remove the latest scripts.

But as its anti-adblocker scripts are added to the filter lists, YouTube releases updated versions of those scripts. So now there’s an adblock detection arms race going on, embodied by the “Is YouTube Anti-Adblock Fixed” website, which monitors whether the uBlock Origin browser plugin is successfully circumventing YouTube’s adblock detection or not by comparing a list of YouTube anti-adblocker script IDs with the list of script IDs that are blocked by the plugin.

Fundamentally, the EU says that random websites aren't allowed to rummage around in your stuff without permission. That’s something most people agree on. Google itself forbids Android app developers from using the QUERY\_ALL\_PACKAGES permission, describing a user's installed apps as “personal and sensitive information.”

The question facing the DPC is whether YouTube’s adblock detection scripts are invasive enough to qualify: Is downloading and running a JavaScript routine equivalent to downloading and storing a cookie?

It looks like YouTube intends to argue that it isn’t, and is emphatic that it only seeks to identify whether ads have been served but not played. When WIRED asked the company if it was using or testing server-side ad blocker detection, YouTube’s Lawton said that it was currently carrying out ad blocker detection within YouTube and not on users’ devices. That doesn’t line up with our observations or those of the ad blocker developers, as a JavaScript detection routine on a website has to be run by the browser to function.

Lawton says that YouTube “will of course cooperate fully with any questions or queries from the DPC.”

The Irish Data Protection Commissioner’s office did not provide a comment for this feature, but Hanff says that the DPC has confirmed to him that it’s investigating the case.

YouTube's Ad Blocker Detection Believed to Break EU Privacy Law

When a homeless man attacked a former city official, footage of the onslaught became a rallying cry. Then came another video, and another—and the story turned inside out.

What a Bloody San Francisco Street Brawl Tells Us About the Age of Citizen Surveillance

The West Bank was Israel’s surveillance laboratory. Since the Israel-Hamas war began, Palestinian residents have been locked in for days at a time.

On Sunday, October 29, Ahmed Azza was given permission to leave his neighborhood for the first time in three days. He passed the surveillance camera trained on his front door and the group of Israeli soldiers stationed on the hill above and walked eight minutes to the checkpoint at the end of his street. He placed his belongings on a table to be searched, made mandatory eye contact with the facial recognition camera, and crossed through the rotating metal barriers into Hebron. Ten hours later, he was given a one-hour window to return home before the checkpoint closed and he was locked out—or in—for the next two days.

Azza lives in Tel Rumeida, Hebron, the most tightly controlled neighborhood in the West Bank. Since 1997, Tel Rumeida has formed part of H2, a section of Hebron controlled by the Israeli government. Around 35,000 Palestinians and 850 Israeli settlers live in this area, where Israeli soldiers impose a system of segregation that heavily restricts the movement of Palestinians. It’s enforced with a network of surveillance that includes at least 21 manned checkpoints, on-the-spot searches, and watchtowers, plus a vast array of CCTV cameras dubbed “Hebron Smart City.” According to critics, the aim of this system is to make life as difficult as possible for Palestinians, slowly forcing them to leave their homes and make way for Israeli settlers.

The West Bank has long been seen as a testing ground for Israeli surveillance technology and tactics. Its defense exports have doubled in the past decade, partially thanks to the success of companies producing surveillance systems, like Elbit, Candiru, and Rafael, as well as NSO Group, which produces the Pegasus spyware. But on October 7, on the other side of Israel, the country’s famed surveillance network apparently failed. Hamas gunmen breached the high-tech border separating Gaza from Israel and murdered 1,400 people, taking more than 200 hostages. Since then, a growing sense of paranoia has given Israel’s government the impetus to ramp up restrictions and surveillance in the West Bank, according to analysts and activists working in the region.

“We’re rats in a lab,” says Azza, over a cup of tea at his workplace in Hebron. “I want to go to the beach, I want to see the sea, I want to taste the water. Here, we don't have this freedom.”

The flagship component of the West Bank’s surveillance infrastructure is known as “Wolf Pack.” According to Amnesty International, its purpose is to create a database featuring profiles of every Palestinian in the region. One strand of this software, known as Red Wolf, uses facial recognition cameras placed at checkpoints to inform Israeli soldiers via a color-coded system whether to arrest, detain, or allow through Palestinians who approach. If the system doesn’t recognize an individual, it will automatically enroll their biometric data into Red Wolf, without their knowledge.

Another strand, known as Blue Wolf, has been described as “Facebook for Palestinians.” It requires Israeli soldiers to photograph Palestinians individually via a smartphone app in order to record them in the database. According to Breaking the Silence, an NGO made up of former Israeli soldiers that opposes Israeli military occupation of Palestinian territories, prizes were offered to different units based on how many Palestinians they could photograph within a week.

A person crossing the street in Huwara, West Bank on November 04, 2023.Photograph: Dan Kitwood/Getty Images

“There are indications that the data gathered by this software impacts whether a person can get a work permit, whether a person can move from place to place within the West Bank, whether a person can get into Israel and work there or leave the country via Ben Gurion Airport, and a whole range of other things,” says Antony Loewenstein, author of _The Palestine Laboratory_, a book investigating the links between Israel’s military and technology sector.

According to Azza, as he approaches a checkpoint and is picked up by a facial recognition camera, Israeli soldiers can see his profile from up to 100 meters away. They know who he is, who his family members are, where he lives, and his entire history of interactions with them. When he was 16, Azza was arrested for allegedly having a knife, but he denied the allegations and was later found to be innocent. He says this data is displayed every time he passes a checkpoint, meaning he is unfairly targeted and sometimes detained for up to three hours at a time. In recent years, he’s begun pre-emptively stripping to his underwear each time he enters a checkpoint, to avoid the lengthy process of being searched multiple times. “It’s a violation of our privacy,” he says.

Israeli officials claim the rollout of surveillance technology helps contribute to a "frictionless" occupation, reducing contact between Palestinians and Israeli soldiers. Instead of troops frisking every Palestinian who passes a checkpoint, this tech allows them to target only those who have a “negative” history. Instead of conducting night raids to gain intelligence, Israeli soldiers can simply use drones to spy on the specific people they are interested in.

The Israeli Defense Force declined to provide an attributable comment.

Many of Israel’s key surveillance technologies have been developed and tested in the West Bank. Israel’s military has promoted close collaboration with the private tech sector, meaning that military-trained engineers are able to learn new skills from private companies. After leaving the military, they are often headhunted by the private sector.

“That’s a key aspect of the Israeli defense sector, showing that it’s possible to maintain and manage a brutal occupation for over half a century, which can then be exported like flat-pack repression to other nations across the globe,” says Loewenstein.

Since the war began on October 7, restrictions for Palestinians living in the West Bank have risen to unseen levels. Residents told me that now they are allowed to leave the neighborhood just three days per week. In addition to the curfew imposed in Tel Rumeida, raids against Palestinian militia groups have ramped up, and the number of Israeli soldiers on the streets has increased, due to the call-up of the army reserve. It's also meant some Israeli settlers are now donning their army reserve uniforms, blurring the contours of the state. Across the wider West Bank, at least 121 Palestinians have been killed by Israeli forces or settlers, according to the United Nations Office for the Coordination of Humanitarian Affairs.

“We are not just numbers,” says a doctor from Hebron, whose name has been withheld to protect his identity. During a break from his shift at Ramallah Hospital, he explains that he now lives locally, but his parents and siblings still live in Hebron. Normally, he’d spend his weekends visiting them, but in recent weeks he has been unable to travel due to delays caused by the closure of checkpoints across the region. Since October 7, he says, he’s treated two Palestinians who have been shot by Israeli forces. Three others who were also shot arrived at the emergency reception but were soon pronounced dead. “There’s a tragedy inside every single one of us in the medical team,” he says.

The task of investigating and documenting the killings of Palestinians in the West Bank has become more challenging in recent weeks. Normally carried out by NGOs such as Al-Haq—one of the key human rights organizations in the region—these groups have been unable to work properly due to the closure of checkpoints and the fear of violence enacted by Israeli settlers.

“Since the 7th of October, our field researchers have not been able to meet directly with victims or eyewitnesses because of the situation. They cannot move freely,” says Tahseen Elayyan, a legal researcher at Al-Haq, over a cup of coffee in their modest office in Ramallah’s Old Town. “Even before, they didn’t have full freedom, but now there are more restrictions on their movement and they’re sometimes afraid to go to areas because of settler attacks. We know about the killings, but we cannot document them properly.”

In October 2021, Al-Haq and a number of other human rights groups were controversially labeled terrorist organizations by the Israeli government. Weeks later, it was revealed by the NGO Front Line Defenders that six of them had previously had their devices hacked by Pegasus software. “They used technology and surveillance to control our work,” says Elayyan.

A question eliciting both fear and hope is whether surveillance technologies are even effective. Despite employing many of these systems across Gaza, Israeli security services were caught off guard by Hamas’ surprise attack on October 7. “On the one hand, we can talk about facial recognition technologies and how bad they are and how harmful they are for democracy, but on the other hand, you say to yourself, who wants to use them? What help did it give?” says Tehilla Shwartz Altshuler, a senior fellow at the Israel Democracy Institute think tank.

Ori Givati, a former Israeli soldier and advocacy director for Breaking the Silence, says the surveillance program is now out of control. “We have to differentiate between securing Israel, which is Israel’s duty and responsibility, and expanding the occupation. There is a huge difference. Occupying more doesn’t mean more security for Israel,” Givati says, “I don’t think that in the long term, if we now use more systems of surveillance against Palestinians, this is what brings us security. We cannot accept this because it doesn’t work.’

Intensified Israeli Surveillance Has Put the West Bank on Lockdown

Plus: SolarWinds is charged with fraud, New Orleans police face recognition has flaws, and new details about Okta’s October data breach emerge.

As the Israel-Hamas war continues, with Israeli troops moving into the Gaza Strip and encircling Gaza City, one piece of technology is having an outsized impact on how we see and understand the war. Messaging app Telegram, which has a history of lax moderation, has been used by Hamas to share gruesome images and videos. The information has then spread to other social networks and millions more eyeballs. Sources tell WIRED that Telegram has been weaponized to spread horrific propaganda.

Microsoft has had a hard few months when it comes to the company’s own security, with Chinese-backed hackers stealing its cryptographic signing key, continued issues with Microsoft Exchange Servers, and its customers being impacted by failings. The company has now unveiled a plan to deal with the ever-growing range of threats. It’s the Secure Future Initiative, which plans, among multiple elements, to use AI-driven tools, improve its software development, and shorten its response time to vulnerabilities.

Also this week, we’ve looked at the privacy practices of Bluesky, Mastodon, and Meta’s Threads as all of the social media platforms jostle for space in a world where X, formerly known as Twitter, continues to implode. And things aren’t exactly great with this next generation of social media. With November arriving, we now have a detailed breakdown of the security vulnerabilities and patches issued last month. Microsoft, Google, Apple, and enterprise firms Cisco, VMWare, and Citrix all fixed major security flaws in October.

And there's more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

The Flipper Zero is a versatile hacking tool designed for security researchers. The pocket-size pen-testing device can intercept and replay all kinds of wireless signals—including NFC, infrared, RFID, Bluetooth, and Wi-Fi. That means it's possible to read microchips and inspect signals being admitted from devices. Slightly more nefariously, we've found it can easily clone building-entry cards and read credit card details through people's clothes.

Over the last few weeks, the Flipper Zero, which costs around $170, has been gaining some traction for its ability to disrupt iPhones, particularly by sending them into denial of service (DoS) loops. As Ars Technica reported this week, the Flipper Zero, with some custom firmware, is able to send “a constant stream of messages” asking iPhones to connect via Bluetooth devices such as an Apple TV or AirPods. The barrage of notifications, which is sent by a nearby Flipper Zero, can overwhelm an iPhone and make it virtually unusable.

“My phone was getting these pop-ups every few minutes, and then my phone would reboot,” security researcher Jeroen van der Ham told Ars about a DoS attack he experienced while commuting in the Netherlands. He later replicated the attack in a lab environment, while other security researchers have also demonstrated the spamming ability in recent weeks. In van der Ham’s tests, the attack only worked on devices running iOS 17—and at the moment, the only way to prevent the attack is by turning off Bluetooth.

In 2019, hackers linked to Russia’s intelligence service broke into the network of software firm SolarWinds, planting a backdoor and ultimately finding their way into thousands of systems. This week, the US Securities and Exchange Commission charged Tim Brown, the CISO of SolarWinds, and the company with fraud and “internal control failures.” The SEC alleges that Brown and the company overstated SolarWinds’ cybersecurity practices while “understating or failing to disclose known risks.” The SEC claims that SolarWinds knew of “specific deficiencies” in the company’s security practices and made public claims that weren’t reflected in its own internal assessments.

“Rather than address these vulnerabilities, SolarWinds and Brown engaged in a campaign to paint a false picture of the company’s cyber controls environment, thereby depriving investors of accurate material information,” Gurbir S. Grewal, director of the SEC’s Division of Enforcement said in a statement. In response, Sudhakar Ramakrishna, the CEO of SolarWinds, said in a blog post that the allegations are part of a “misguided and improper enforcement action.”

For years, researchers have shown that face recognition systems, trained on millions of pictures of people, can misidentify women and people of color at disproportionate rates. The systems have led to wrongful arrests. A new investigation from Politico, focusing on a year’s worth of face recognition requests made by police in New Orleans, has found that the technology was almost exclusively used to try to identify Black people. The system also “failed to identify suspects a majority of the time,” the report says. Analysis of 15 requests for the use of face recognition technology found that only one of them was for a white suspect, and in nine cases the technology failed to find a match. Three of the six matches were also incorrect. “The data has pretty much proven that \[anti-face-recognition\] advocates were mostly correct,” one city councilor said.

Identity management company Okta has revealed more details about an intrusion into its systems, which it first disclosed on October 20. The company said the attackers, who had accessed its customer support system, accessed files belonging to 134 customers. (In these instances, customers are individual companies that subscribe to Okta’s services). “Some of these files were HAR files that contained session tokens which could in turn be used for session hijacking attacks,” the company disclosed in a blog post. These session tokens were used to “hijack” the Okta sessions of five separate companies. 1Password, BeyondTrust, and Cloudflare have all previously disclosed they detected suspicious activity, but it is not clear who the two remaining companies are.

Source

Wired