X is promoting Community Notes to solve its disinformation problems, but some former employees and people who currently contribute notes say it’s not fit for that purpose.

Community Notes, the crowdsourced fact-checking program launched a year ago to tackle disinformation on X (formerly Twitter), has flown under the radar for much of its existence. But in the past week it has been heralded by Elon Musk and X CEO Linda Yaccarino as a key tool in tackling the toxic deluge of disinformation that has flooded social media, and in particular X, during the ongoing Israel-Hamas war.

On Saturday, the company wrote on its own platform that “notes across the platform are now being seen tens of millions of times per day, generating north of 85 million impressions in the last week.” It added that thousands of new contributors had been enrolled in the system. However, a WIRED investigation found that Community Notes appears to be not functioning as designed, may be vulnerable to coordinated manipulation by outside groups, and lacks transparency about how notes are approved. Sources also claim that it is filled with in-fighting and disinformation, and there appears to be no real oversight from the company itself.

“I understand why they do it, but it doesn't do anything like what they say it does,” one Community Notes contributor tells WIRED. “It is prone to manipulation, and it is far too slow and cumbersome. It serves no purpose as far as I can see. I think it's probably making the disinformation worse, to be honest.”

This contributor, who was granted anonymity for this story because of concerns about retaliation from Musk or his supporters, should know about platform manipulation, because he is one of those engaging in it.

He is one member of a group of about 25 Community Notes contributors who actively coordinate on a daily basis in order to upvote or downvote particular notes. He is a member of the North Atlantic Fella Organization (NAFO), a decentralized online volunteer movement that emerged following Russia’s invasion of Ukraine and uses humor to counter Russian disinformation and propaganda while raising funds in support of Ukraine.

“We have a group so we can coordinate who writes what Community Notes, and if you write one, you can coordinate so you get one voted as helpful, and there's no validation on any of that,” the contributor says. The contributor claims that Russian embassies have engaged in similar tactics and alleges that they “will downvote anything that's anti-Russian.” A WIRED review of unpublished notes accompanying contested Russian embassy posts written by NAFO members shows they have all been repeatedly downvoted.

A contributor based in the southern hemisphere tells WIRED that he has two accounts on X, and he alleges that both of them have been approved for access to the Community Notes system—evidence that the program may be vulnerable to even broader manipulation, just as Kremlin trolls were able to operate multiple Twitter accounts impersonating US citizens and influence the 2016 election.

Community Notes began life as Birdwatch, first announced in October 2020 before going live in a pilot project in January 2021, weeks after Donald Trump supporters attacked the United States Capitol. Envisioned as a way of harnessing the power of the crowd to debunk misinformation in near real time, Birdwatch was never fully embraced by the company, which was criticized in March last year, soon after the Russian invasion of Ukraine, for failing to roll it out more broadly.

At the time, there was trepidation within the company about how effective the tool would be at controlling the quality of information on the platform, Yoel Roth, Twitter's former head of Trust and Safety, tells WIRED.

“There was a belief amongst the Trust and Safety team that people would not do uncompensated labor at scale, and that the things that would attract attention in a Birdwatch format didn't necessarily correspond with the harmful things that constituted violations of policies,” says Roth.

This truth was later borne out, at least in part. A study presented at a conference in April 2022 by researchers at MIT found that Birdwatch users were much more likely to fact-check posts expressing political views that differ from their own. David Rand, the study’s lead researcher and a professor at MIT’s Sloan School of Management, says that while around 80 percent of the tweets that users chose to annotate were, in fact, misleading, users overwhelmingly tended to prioritize political content. Users were also likely to flag a piece of content based on whether it seemed “reasonable.” It is unclear whether these users had the knowledge and skills to debunk misinformation or offer alternative, correct information.

“In a situation like what is happening in Israel and Gaza right now, where there's a massive amount of unknowns, that gut-check of ‘Does this seem reasonable?’ is not great. Even professional journalists, as I understand it, are having a lot of trouble understanding what's true and what's not true,” says Rand. With such a fast-moving and volatile situation, “what I expect the crowd to produce is a lot of noise,” he says.

Almost immediately after Musk took control of the company in late October 2022, he renamed Birdwatch “Community Notes,” claiming that the system had “incredible potential for improving information accuracy.” In the months that followed, X systematically eradicated almost all of the teams and individuals overseeing content moderation and trust and safety at the company, putting even greater emphasis on the role of Community Notes.

Joe Benarroch, head of business operations at X, tells WIRED that the company has contributors across 44 countries, and while he would not give an exact number, he noted that more than 10,000 people had joined the program in the past week. Alongside contributors who volunteer for the program, some contributors are invited by X itself, WIRED has learned, according to one contributor we spoke to and a search of X, where contributors say X invited them to join.

Benarroch did not address whether there is any form of moderation for Community Notes. And while Benarroch says “Community Notes were designed to tackle misinformation on X,” Roth says their original intention was not to perform that task alone.

“The intention of Birdwatch was always to be a complement to, rather than a replacement for, Twitter's other misinformation methods,” says Roth. “The company fired the entire curation team, without whom misinformation enforcement can't operate, even if the policies are still on the books,” he says, referring to the former employees who would create the collections of tweets for corrections or produce the labels to let users know if something was misinformative.

“Community Notes is an imperfect replacement for Trust and Safety staff,” says one former Twitter Trust and Safety employee who spoke to WIRED on the condition of anonymity for fear of retaliation. “You can’t just outsource that work to the community.”

While X claims Community Notes is having a significant impact on tackling disinformation on the platform, the notes system itself can also spread disinformation. Last week WIRED revealed that a note appended to a post from Donald Trump Jr. wrongly claimed a video he posted about the Hamas attack on Israel was fake. The original note has since been replaced with one citing WIRED’s report.

Many notes written by contributors are never seen by the public. A WIRED examination of these unpublished notes shows that just like the main X platform, the Community Notes community is similarly riven by in-fighting and misinformation.

On Saturday, the official Israel account on X posted a picture of what looks like a child’s bedroom with blood covering the floor. “This could be your child’s bedroom. No words,” the post reads. There is no suggestion the picture is fake, and publicly there are no notes on the post. However, in the Community Notes backend, viewed by WIRED, multiple contributors are engaging in a conspiracy-fueled back-and-forth.

“Deoxygenated blood has a shade of dark red, therefore this is staged,” one contributor wrote. “Post with manipulative intent that tries to create an emotional reaction in the reader by relating words and pictures in a decontextualized way,” another writes.

“There is no evidence that this picture is staged. A Wikipedia article about blood is not evidence that this is staged,” another contributor writes.

“There is no evidence this photo is from the October 7th attacks,” another claims.

These types of exchanges raise questions about how X approves contributors for the program, but this, along with precisely what factors are considered before each note is approved, remains unknown. X’s Benarroch did not respond to questions about how contributors are chosen.

None of those approved for the system are given any training, according to all contributors WIRED spoke to, and the only limitation placed on the contributors initially is an inability to write new notes until they have rated a number of other notes first. One contributor claims this approval process can take fewer than six hours.

In order for notes to become attached to a post publicly, they need to be approved as “helpful” by a certain number of contributors, though how many is unclear. X describes “helpful” notes as ones that get “enough contributors from different perspectives.” Benarroch did not say how X evaluates a user’s political leanings. However, the system at least previously employed a technique known as bridge-based ranking to favor notes that receive positive interactions from users estimated to hold differing viewpoints. Still, how this works is not clear to at least some Community Notes contributors. 

“I don't see any mechanism by which they can know what perspective people hold,” Anna, a UK-based former journalist whom X invited to become a Community Notes contributor, tells WIRED. “I really don't see how that would work, to be honest, because new topics come up that one could not possibly have been rated on.” Anna asked only to be identified by her first name for fear of backlash from other X users.

For all the notes that do become public, there are many more that remain unseen, either because they are deemed unhelpful, or in the majority of cases reviewed by WIRED, they simply didn’t get enough votes from other contributors. One contributor tells WIRED that 503 notes he had rated in the last week remained in limbo because not enough people had voted on them.

“I think one of the issues with Community Notes at its core, it's not really scalable for the amount of media that's being consumed or posted in any given day,” the contributor, who is known online as Investigator515, tells WIRED. They asked to only be identified by their handle because of fears of damage to their professional reputation.

All of the contributors who spoke to WIRED feel that Community Notes is not up to the task of policing the platform for misinformation, and none of them believed that the program would improve at all in the coming months if it remains in its current form.

“It's much harder to deal with misinformation when there isn't the top-down moderation that Twitter used to have, because accounts willfully spreading misinformation would get suspended before they could really do a lot of harm,” the longtime contributor says. “So a reliance on Community Notes is not good. It's not a replacement for proper content moderation.”

_Updated at 7:10 pm ET, October 17, 2023, to add further context about how the Community Notes system may gauge the viewpoint diversity of contributors._

Insiders Say X’s Crowdsourced Anti-Disinformation Tool Is Making the Problem Worse

Myanmar’s military junta is increasing surveillance and violating basic human rights. The combination of physical and digital surveillance is reaching dangerous new levels.

Since taking power in a coup two years ago, Myanmar’s military junta has suppressed people's rights, cracked down on opposition, and used deadly force against civilians. To enable this, officials have clamped down on people’s communications and rolled out extensive digital surveillance systems. Now, new evidence shows how people are being tracked online and offline simultaneously.

In April this year, the military junta launched one of its deadliest air strikes—killing more than 160 people in the Kanbalu region in a single day. Following the strike, pro-junta Telegram channels systematically doxed people who showed support for the victims on social media, new research shared with WIRED shows. Their names, photos, and other personal information were all shared. Days after the doxing, which also revealed the real-world movements of some of the individuals, people were arrested and imprisoned.

The revelations from Myanmar Witness, a project run by the digital investigations group Centre for Information Resilience, demonstrates how oppressive forces can use people’s social media posts against them. It also shows the intense surveillance faced by people living under Myanmar’s military junta, which includes rolling internet shutdowns and increasing CCTV.

“The military regime and their supporters in Myanmar have weaponized the internet, and doxing has become the tip of the spear—the most aggressive way of intimidating people into silence, online and offline,” says Lu Aye, the lead investigator at Myanmar Witness. The group investigated the incident using open source intelligence techniques, comparing on-the-ground reports with digital evidence.

The air strike hit the village of Pa Zi Gyi, in central Myanmar, on the morning of April 11 as hundreds of people celebrated the opening of a new village building, which had been backed by Myanmar’s pro-democratic National Unity Government. More than 160 people, including women and children, died in the air strike, with reports from CNN and the _Guardian_ describing bodies burning on the ground and medical teams not immediately able to access the site due to planes flying overhead. (A military spokesperson told local press it was targeting “terrorists.”)

In the days following the incident, locals changed their Facebook profile pictures to black images and shared messages of support for the victims. According to reports in the state-owned Myanmar Alin newspaper that were analyzed by Myanmar Witness, 68 people were arrested. (One other arrest was reported by the BBC.) People were arrested for spreading propaganda, cooperating with the pro-democracy government, and public disturbance, according to the analysis. All the of arrests mention people’s social media profiles.

A series of 19 Telegram channels that appear to support the State Administration Council, the official name of the military junta, shared the personal details and Facebook posts of 20 people who supported air strike victims, the Myanmar Witness research says. Of these, 11 were arrested after being doxed. “Revealing the identities, addresses, and other details of dissenters online is a powerful weapon of suppression,” Lu Aye says. “It leaves individuals vulnerable and intimidated and scares off many more from calling out the military and standing up for democracy.”

It is “highly likely” that the doxing and subsequent arrests are related, Lu Aye says. Messages sent alongside the doxing posts were often similar to the published reasons for the arrest, and the timelines overlap, Lu Aye says. On average, according to the analysis, an arrest happened six and a half days after the doxing post appeared—and in all the instances, the doxing happened at least one day before the arrest. Some people were doxed multiple times, with a total of 59 doxing posts for the 20 people targeted.

Lu Aye says that the researchers have, for the “first time,” found evidence to show the “coordination of online and offline surveillance and suppression.” “We found a shop owner who was named and targeted by seven different pro-junta Telegram channels in one day,” Lu Aye says. “The victim fled her home and shop, movements which were reported on by two of the channels who also called for the shop owner’s arrest and \[said\] they would continue to report on the individual.”

Myanmar’s embassy in Washington, DC did not respond to WIRED’s request for comment about the arrests and doxing. Telegram has also not responded to a request for comment at the time of writing. Doxing on Telegram isn’t new. As WIRED has previously reported, politically motivated doxing is now rife across the Middle East, Southeast Asia, and Eastern Europe. Telegram previously said it moderates the publication of private information on its platform.

Of the 19 Telegram channels highlighted by Myanmar Witness, five no longer appear to exist. The largest has 112,000 followers, while others have more than 10,000. Several seem to still be posting screenshots of people’s Facebook profiles and other personal information, a WIRED review of the channels found.

Manny Maung, a Myanmar researcher at nongovernmental organization Human Rights Watch, says that while doxing has been increasing in the country in the past two years, it is hard to document. Maung says she has seen lawyers “go to ground” after having their personal details, as well as their home address and details about family members, spread online. “That is enough to scare people right now,” she says.

Since the military junta took power, people’s digital and physical rights have been eroded, Maung says. There have been frequent internet shutdowns, which keep people from organizing and prevent information from getting out of Myanmar. Several laws have also been amended, giving authorities greater powers, such as the ability to clamp down on civil society and snoop on people’s communications.

Andrea Calderaro, a senior lecturer in international relations at Cardiff University who has worked on Myanmar’s internet connectivity, says the digital activists he knows have had to flee. “All the telecom operators are under the control of the military junta,” he says. “The connectivity that has been built over the years is clearly now being turned against the population. It’s now a tool that the government is using to control and repress populations.”

Myanmar Witness has verified and mapped more than 750 incidents in the three years from October 2020 to this month. Each one is based on photos or videos that have come out of the country, and researchers have checked their location and the events recorded. These include houses being destroyed and burnt, bombs caught exploding on CCTV footage, and dead bodies on the street.

“Among the litany of atrocities and abuses, the military is abusing their own people’s rights: rights to access of information, the right to organize, the right to live without fear of being attacked or killed,” Maung says. “All of this is happening in a widespread context where the military is clamping down on all aspects of life.”

Myanmar Witness’s Lu Aye says that since the doxing and the wider arrests, at least five of the people apprehended were released within four months of their arrest. These individuals were mostly well-known in local communities, and their release was reported by people on the ground, Lu Aye says. “We do not know the fate of the more than 60 other people who were arrested.”

They Supported Air Strike Victims. Then They Were Doxed and Arrested

New research shows the number of deepfake videos is skyrocketing—and the world's biggest search engines are funneling clicks to dozens of sites dedicated to the nonconsensual fakes.

Google’s and Microsoft’s search engines have a problem with deepfake porn videos. Since deepfakes emerged half a decade ago, the technology has consistently been used to abuse and harass women—using machine learning to morph someone’s head into pornography without their permission. Now the number of nonconsensual deepfake porn videos is growing at an exponential rate, fueled by the advancement of AI technologies and an expanding deepfake ecosystem.

A new analysis of nonconsensual deepfake porn videos, conducted by an independent researcher and shared with WIRED, shows how pervasive the videos have become. At least 244,625 videos have been uploaded to the top 35 websites set up either exclusively or partially to host deepfake porn videos in the past seven years, according to the researcher, who requested anonymity to avoid being targeted online.

Over the first nine months of this year, 113,000 videos were uploaded to the websites—a 54 percent increase on the 73,000 videos uploaded in all of 2022. By the end of this year, the analysis forecasts, more videos will have been produced in 2023 than the total number of every other year combined.

These startling figures are just a snapshot of how colossal the issues with nonconsensual deepfakes has become—the full scale of the problem is much larger and encompasses other types of manipulated imagery. A whole industry of deepfake abuse, which predominantly targets women and is produced without people’s consent or knowledge, has emerged in recent years. Face-swapping apps that work on still images and apps where clothes can be “stripped off a person” in a photo with just a few clicks are also highly prominent. There are likely millions of images being created with these apps.

“This is something that targets everyday people, everyday high school students, everyday adults—it's become a daily occurrence,” says Sophie Maddocks, who conducts research on digital rights and cyber-sexual violence at the University of Pennsylvania. “It would make a lot of difference if we were able to make these technologies harder to access. It shouldn't take two seconds to potentially incite a sex crime.”

The new research highlights 35 different websites, which exist to exclusively host deepfake pornography videos or incorporate the videos alongside other adult material. (It does not encompass videos posted on social media, those shared privately, or manipulated photos.) WIRED is not naming or directly linking to the websites, so as not to further increase their visibility. The researcher scraped the websites to analyze the number and duration of deepfake videos, and they looked at how people find the websites using the analytics service SimilarWeb.

Many of the websites make it clear they host or spread deepfake porn videos—often featuring the word _deepfakes_ or derivatives of it in their name. The top two websites contain 44,000 videos each, while five others host more than 10,000 deepfake videos. Most of them have several thousand videos, while some only list a few hundred. Some videos the researcher analyzed have been watched millions of times.

The research also identified an additional 300 general pornography websites that incorporate nonconsensual deepfake pornography in some way. The researcher says “leak” websites and websites that exist to repost people’s social media pictures are also incorporating deepfake images. One website dealing in photographs claims it has “undressed” people in 350,000 photos.

Measuring the full scale of deepfake videos and images online is incredibly difficult. Tracking where the content is shared on social media is challenging, while abusive content is also shared in private messaging groups or closed channels, often by people known to the victims. In September, more than 20 girls aged 11 to 17 came forward in the Spanish town of Almendralejo after AI tools were used to generate naked photos of them without their knowledge.

“There has been significant growth in the availability of AI tools for creating deepfake nonconsensual pornographic imagery, and an increase in demand for this type of content on pornography platforms and illicit online networks,” says Asher Flynn, an associate professor at Monash University, Australia, who focuses on AI and technology-facilitated abuse. This is only likely to increase with new generative AI tools.

The gateway to many of the websites and tools to create deepfake videos or images is through search. Millions of people are directed to the websites analyzed by the researcher, with 50 to 80 percent of people finding their way to the websites via search. Finding deepfake videos through search is trivial and does not require a person to have any special knowledge about what to search for.

The issue is global. Using a VPN, the researcher tested Google searches in Canada, Germany, Japan, the US, Brazil, South Africa, and Australia. In all the tests, deepfake websites were prominently displayed in search results. Celebrities, streamers, and content creators are often targeted in the videos. Maddocks says the spread of deepfakes has become “endemic” and is what many researchers first feared when the first deepfake videos rose to prominence in December 2017.

Since the tools needed to create deepfake videos emerged, they’ve become easier to use, and the quality of the videos being produced has improved. The wave of image-generation tools also offers the potential for higher-quality abusive images and, eventually, video to be created. And five years after the first deepfakes started to appear, the first laws are just emerging that criminalize the sharing of faked images.

The proliferation of these deepfake apps combined with a greater reliance on digital communications in the Covid-19 era and a "failure of laws and policies to keep pace" has created a “perfect storm,” Flynn says.

Experts say that alongside new laws, better education about the technologies is needed, as well as measures to stop the spread of tools created to cause harm. This includes action by firms that host the websites and also search engines, including Google and Microsoft’s Bing. Currently, Digital Millennium Copyright Act (DMCA) complaints are the primary legal mechanism that women have to get videos removed from websites.

Henry Ajder, a deepfake and generative AI expert who has monitored the spread of the technologies, says adding more “friction” to the process of people finding deepfake porn videos, apps to change people’s faces, and tools that specifically allow the creation of nonconsensual images can reduce the spread. “It's about trying to make it as hard as possible for someone to find,” he says. This could be search engines down-ranking results for harmful websites or internet service providers blocking sites, he says. “It's hard to feel really optimistic, given the volume and scale of these operations, and the need for platforms—which historically have not taken these issues seriously—to suddenly do so,” Ajder says.

“Like any search engine, Google indexes content that exists on the web, but we actively design our ranking systems to avoid shocking people with unexpected harmful or explicit content they don't want to see,” says Google spokesperson Ned Adriance, pointing to its page on when it removes search results. Google’s support pages say it is possible for people to request that “involuntary fake pornography” be removed. Its removal form requires people to manually submit URLs and the search terms that were used to find the content. “As this space evolves, we're actively working to add more safeguards to help protect people, based on systems we've built for other types of nonconsensual explicit imagery,” Adriance says.

Courtney Gregoire, chief digital safety officer at Microsoft, says it does not allow deepfakes, and they can be reported through its web forms. “The distribution of nonconsensual intimate imagery (NCII) is a gross violation of personal privacy and dignity with devastating effects for victims,” Gregoire says. “Microsoft prohibits NCII on our platforms and services, including the soliciting of NCII or advocating for the production or redistribution of intimate imagery without a victim’s consent.”

While the number of videos and pictures continues to skyrocket, the impact on victims can be long-lasting. “Gender-based online harassment is having an enormous chilling effect on free speech for women,” Maddocks says. As reported by WIRED, female Twitch streamers targeted by deepfakes have detailed feeling violated, being exposed to more harassment, and losing time, and some said the nonconsensual content found its way to family members.

Flynn, the Monash University professor, says her research has found “high rates” of mental health concerns—such as anxiety, depression, self-injury, and suicide—as a result of digital abuse. “The potential impacts on a person’s mental and physical health, as well as impacts on their employment, family, and social lives can be immense,” Flynn says, “regardless of whether the image is deepfaked or ‘real.’”

Deepfake Porn Is Out of Control

Plus: Hamas raised millions in crypto, Exxon used hacked data, and more.

The media consortium, along with security researchers from Amnesty International and Google’s Threat Analysis Group, were able to show Vietnam’s connection to the Predator hacking campaign through documents they obtained that detail the Vietnamese government’s contract with Intellexa in 2020, and later an extension of the deal to allow the use of the Predator software. The internal documents went so far as to capture the response of Intellexa’s founder, Israeli former military hacker turned entrepreneur Tal Dilian, when the deal was announced: “Wooow!!!!” Vietnam’s government would later target French officials with Predator before this year’s campaign targeting US congressmen.

Despite efforts by Israel and other nations to cut off funding to Hamas in recent years, the group raised millions of dollars worth of cryptocurrency before the past weekend’s attack that killed more than a thousand Israelis. An analysis by _The Wall Street Journal_ found that Hamas, Palestinian Islamic Jihad, and Hezbollah had collectively raised hundreds of millions in crypto over the past several years, with $41 million going to Hamas specifically. Given that the _Journal_ learned of that funding in part through Israeli seizures of crypto accounts, however, it’s not clear how much of that money was frozen or seized versus how much might have actually been successfully laundered or liquidated by Hamas and other groups. 

In response to the weekend’s attacks, the Israeli government and the world’s largest crypto exchange, Binance, both announced that a new round of Hamas crypto accounts had been frozen. Though crypto has helped Hamas and other groups move funds across borders, its traceability on blockchains has presented a challenge for designated terrorist groups. In 2021, for instance, Hamas asked its supporters to stop making donations via cryptocurrency, due to the ease of tracking those transactions and unmasking contributors.

Last year, _Reuters_ reporters Chris Bing and Raphael Satter published an investigation into Aviram Azari, an Israeli private investigator who is accused of using mercenary hackers to gather intelligence on the critics of major corporations involved in lawsuits against them. 

Now, prosecutors in the Southern District of New York, where Azari has been convicted on criminal charges, have filed a sentencing memo that notes that activists’ communications stolen by Azari’s hackers were later used by Exxon in the company’s attempts to head off investigations and lawsuits by state attorneys general. The memo still doesn’t name Exxon as Azari’s client, but it implicitly suggests a link between the company and Azari: Prosecutors point in their memo to leaks of climate activists’ private emails to media, which were later cited by Exxon in their responses to state attorney generals as evidence of underhanded tactics by activists as they tried to prove that Exxon knew and covered up the role of fossil fuels in climate change. A Massachusetts lawsuit against Exxon that resulted from the state’s investigation is ongoing.

Internet giant Akamai warned this week that the infamous Magecart hacker crew, long focused on credit card fraud, has developed a clever new technique for spoofing credit card payment fields. The hackers managed to hide their malicious scripts in the 404 “page not found” error pages of ecommerce sites, then trigger those pages to load a spoofed payment field that impersonates a checkout page to steal credit card information. “The idea of manipulating the default 404 error page of a targeted website can offer Magecart actors various creative options for improved hiding and evasion,” warned Akamai researcher Roman Lvovsky. Akamai noted that the technique was used on the website of significant brands in the food and retail industries but declined to name them.

The US Congress Was Targeted With Predator Spyware

The rapid spread of violent videos and photos, combined with a toxic stew of mis- and disinformation, now threatens to spill over into real-world violence.

Yesterday, FBI director Christopher Wray attempted to assure the Jewish community in the US that his agency is taking any threats seriously. “I am not, in any way, trying to alarm you, but I want you to be confident that the FBI is most assuredly paying attention,” he said during an update on domestic security guidance following the Hamas attacks. “We remain vigilant to the potential of this event to inspire violence.”

The terms “jihad” and “day of rage” were both trending on X this morning, having been boosted by prominent accounts, including one belonging to hard-right representative Marjorie Taylor-Greene of Georgia. “If we are not going to vote today for a Speaker, why don't we just go home and regroup next week? I’ll buy ammo while I’m home,” Greene wrote on X.

Rogan O’Handley, a former Hollywood lawyer who has become a influential far-right figure under the pseudonym DC Draino, falsely claimed that Hamas had called for “an international day of terrorism.” O’Handley, who has 1.1 million followers on X, added, “I will not be changing 1 thing about my daily life b/c I will not let terrorism win,” he wrote. “I will, however, be carrying an extra mag. Be safe y’all.”

A WIRED review of Facebook, Instagram, and TikTok found dozens of posts highlighting Meshaal’s comments and the potential threat from the “day of jihad” but little evidence of threats against Muslims posted on those platforms. On Instagram yesterday, popular right-wing podcaster Charlie Kirk wrote: “Day of Jihad? Arm up.” The post has received 34,000 likes. Meta did not respond to a request for comment about Kirk’s post.

Amidst the flurry of threats, disinformation, and real acts of violence, it appears that X is attempting to limit search results for the terms “global day of jihad” and “jihad,” both of which returned no results when WIRED searched on mobile, desktop, and in different countries. While a search for the term “jihad” on X didn’t return any posts, it did suggest three people to follow, the first of which was US president Joe Biden.

X did not respond to WIRED’s request for comment about the violent threats on its platform or the lack of search results for terms related to jihad.

The calls for violence from right-wing accounts online echo violent responses from extremist groups in the days following the outbreak of the war.

While many right-wing groups have posted Islamophobic content and calls for violence against Muslims, many others have doubled down on their antisemitic worldview and are posting violent threats against Jews.

In a post on Telegram, the Texas chapter of the extremist group the Proud Boys, using multiple antisemitic slurs to describe Jews, called for the “extermination” of the Jewish people.

Rumors of a ‘Global Day of Jihad’ Have Unleashed a Dangerous Wave of Disinformation

In an attempt to wrest control from raucous far-right hardliners amid the fight for a new House speaker, Republican Party leaders are instituting phone bans to keep backroom deals secret.

Last week, after helping foment the eight-person coup that ended Kevin McCarthy’s 269-day reign as speaker of the United States House of Representatives Matt Gaetz’s signature smirk was everywhere. The 41-year-old Florida congressman peacocked through a slew of must-see Beltway cable news shows, dancing on McCarthy’s political grave, and generally basking in the brilliance of his successful scheme—one he openly doubted would work just the night before it did.

This week, Gaetz shut up—or, more accurately, he was shut up.

It’s not just Gaetz. All week long, unidentified Republican Party puppet masters have muzzled House members, scrambling to portray unity in the face of the disarray emanating from today’s leaderless House GOP. This includes the rare step of confiscating Republican’s electronic devices in an attempt to prevent leaks in the midst of their secret meetings to pick McCarthy’s replacement.

“I don't know who keeps talking in real time, because that's what they're concerned about,” Chris Smith, a New Jersey Republican, tells WIRED.

Nothing seems to be going right for House Republicans. Just ask the party’s handpicked majority leader, Steve Scalise. To the surprise of most, on Thursday night, he bowed out of the speaker race just a day after the majority of the conference tapped him to replace McCarthy. Even after disconnecting members and stopping real-time leaks, a minority of the majority party scuttled Scalise in less than 48 hours. Despite the wishes of party leaders, this revolt isn’t leaving our screens anytime soon.

It’s impossible to mute contemporary lawmakers for very long. The more party leaders try, the more the Republican base erupts with accusations of secret side deals. Still, party leaders are scrambling to regain control—if only momentarily and only in the Capitol’s plethora of backrooms.

“They're a little either whiplashed or gun shy from the McCarthy stuff. Gaetz and others knew they could blow up the Congress, but they didn't know how to rebuild it,” David Jolly, a former Florida Republican congressman, tells WIRED. “And in the rebuilding phase, they're sensitive to some of the negative press and the negative impressions.”

Today’s members of Congress are beholden to their online followings, not some party leader. Even one picked by the overwhelming majority—some 96 percent, in McCarthy’s case—of their peers. Regaining control of the seemingly uncontrollable seems to, once again, be proving a fool’s errand.

“The power centers no longer go up through leadership,” Jolly says. “Go back as far as you want—20 years, 30 years, whatever—all power structures funneled through leadership. Now they're all these independent power structures that reward and stabilize members regardless of if they've been there a year or 30 years. In fact, in many ways, the people who have been there 30 years probably have less security than the ones that just got there.”

Stripping members of their electronic devices is punishment for leaks and Gaetz-style boasting. It's being lauded by many members annoyed that their internal party deliberations often make headlines before they even hit the exits. But it’s backfiring.

Republican Party deliberations are staying secret longer—mere minutes longer, really—but the digital time-out isn’t fostering party unity. Following one of the party’s daily secret meetings this week, Republicans announced that Louisiana congressman Steve Scalise would be their nominee for the new House speaker, beating out Ohio’s Jim Jordan. Now the real trouble begins. In the wake of McCarthy’s speakership—the third-shortest in US history—the Republican Party’s right flank is emboldened, empowered, and feeling more justified than ever in their self-righteous quest to rid Washington of what they view as the federal government’s biggest problems.

The far-right Freedom Caucus and its allies began the House speaker fight in January, demanding more transparency, like the ability to review bills 72 hours before voting. Just last week, as he was moving his motion to vacate the speaker, Gaetz accused McCarthy of making "secret side deals" with US president Joe Biden. It seems calls for transparency withered alongside McCarthy’s short-lived speakership. If anything, the party seems mostly unified in embracing a new level of secrecy.

Phoneless in Washington

It’s still unclear who is running things among House Republicans. WIRED reached out to a slew of Republican leaders—former speaker McCarthy, speaker pro tem Patrick McHenry, former speaker-designate Scalise, majority whip Tom Emmer, and GOP conference chair Elise Stefanik—asking who made the call to temporarily confiscate member’s phones this week. None responded.

With no one in charge, everyone’s in charge. Each member of Congress is coached to run their office like a business, with each serving as the CEO, CFO, and mascot. Who’s Cupid without a bow and arrow? Ask a phoneless politician.

“Oh, wow. Really?” John Larson, a Connecticut Democrat, says after WIRED informs him of his rowdy Republican neighbor’s new no-phone rule. “It goes to show you the level of trust in this place, huh?”

It’s not unheard of for lawmakers to be stripped of their devices. US senators had to check their phones and tablets when they sat as the jury for former US president Donald Trump’s two impeachments. They were also only allowed to drink water and milk (yeah, it’s a thing).

Lawmakers also turn over their personal and government-issued devices before heading into classified briefings, like the one House members had Wednesday morning on the Israel-Hamas war. Most of the time, like the rest of us, lawmakers’ fingers are all but one with their screens.

“One of the members said to me—I won’t say who she was—she goes, ‘I need my phone!’” Smith, the New Jersey lawmaker, says with a laugh. “It is a different world. For a while there, all of us went to our grandkids or kids to figure out how to use these things. Now we got it down, and we can't stop it!”

But stop they did. Many Republicans report that these deviceless—and largely staffless—meetings are a welcome change. “I think it does help. Looking over at your colleague, wondering if he's the one livestreaming it, it foments mistrust,” Thomase Massie, a Republican Kentuckian, tells WIRED. “I think you have more direct, but coarser, conversations if there aren’t witnesses in the room. You’re missing the good stuff!”

Still, Massie is attuned to the complaints from the base about secret meetings. “If we don't have some kind of public vote on the floor, or in conference, where everybody accounts for their own vote, I feel like they can claim this is a stolen election,” Massie says. “If you come out of a secret room, with a secret ballot, and say, ‘This is our choice. Take our word for it,’ I think a lot of people want to know how their congressmen voted, and they want them to prove it, either in a roll call here or on the floor.”

But confiscating rank-and-file Republicans’ devices didn’t heal the internet-fueled internal GOP rift barely hiding underneath the party’s near universal hatred of Joe Biden, love of tax cuts, and fear of Donald Trump. It merely paused the cage match again. And, as usual, some of McCarthy’s fiercest opponents are now the loudest critics of the clampdown on devices.

“It’s ridiculous, really,” Tim Burchett—the Tennessee Republican who partnered with Gaetz in orchestrating McCarthy’s demise—tells WIRED. “You know someone’s gonna walk out and tell it.”

If anything, the no-phone rule is only fueling the Republican Party’s new ranks of conspiracy-laden conservatives. Burchett doesn’t know who made the call—but he blames McCarthy anyway. “That’s part of his leadership team that’s in place still,” Burchett says. “It'll work for a little while, and then somebody will figure something out.”

That Escalated Quickly—and Is Far From Over

Burchett, Gaetz, Marjorie Taylor Greene, and their fellow GOP hardliners were leaders of the transparency pack ahead of McCarthy’s ouster. Problem is, the public is now locked out of their private feeding frenzy at the feet of the party’s next generation of potential power brokers.

Just as McCarthy did in January, Scalise hosted holdouts and opponents alike for private meetings. While Republicans were encouraged to personally air their concerns and demands alike to his face, something was different this time, at least according to former speaker-designate Scalise.

“No side deals,” Scalise told reporters huddled outside an impromptu Thursday afternoon GOP conference meeting. “Let’s have this in full view of everybody. No side deals. No secret meetings.”

Full view? Just no phones allowed. No side deals either? Just private one-on-one conversations with some of the most expensive—morally speaking, at the very least—votes to buy on Capitol Hill.

Just as McCarthy did in January, Scalise moved further right—or at least did all he could to placate holdouts. It seemed to be working, just as it did for McCarthy—until it didn’t.

The towel came flying in after just one day of private confabs with the farthest-flung rightward wing of today’s rightward-tilting GOP. Scalise flipped at least one vote, but at what cost? Freshman Anna Paulina Luna is a Floridian who was slingshotted into this 118th Congress via her previous perch as a so-called social media influencer. Scalise denies doling out promises, and Luna refuses to say how the majority leader won her trust and met her demand.

All we know is, Scalise flipped her from a no to a yes. And she left the private meeting satisfied, feeling confident he met each one of the three bright red lines she’s publicly drawn in the proverbial political sands: impeaching Biden, slapping his son Hunter Biden with a subpoena, and defunding special counsel Jack Smith, thus halting the two federal cases he’s spearheading against Trump.

"After talking to Representative Scalise, I feel very confident that he's going to allow me to aggressively pursue justice for this country and this nation," Luna told reporters after meeting with Scalise on Wednesday. "He will be aggressively allowing me to pursue and do my job."

That’s a lot of weighty demands for anyone to placate in one day. One down, but Scalise still had 106 or so to go. Many were adamantly unbudgeable, even if they did go through the formal motions of sitting down with Scalise. The de-phoning experiment failed to unite the GOP’s new ranks of partisans, so vulnerable members are now demanding party leaders try other out-of-the-box options.

“We have to have something that takes the personality and emotion out of it,” says Marc Molinaro, a freshman Republican from New York. “At the end of the day, in the conference, we have to have a deliberative effort to get from whatever number the top vote getter has to 217. That has to happen in a deliberative way. We didn't have that the last few days.”

Frustration turned to anger after McCarthy was pushed out. Now, after more than a week of the House being ground to a halt by the majority party, embarrassment is now transforming into desperation. Ineptitude is not a good look, which speaker pro tem Patrick McHenry understands. When WIRED asks if Molinaro’s got any new ideas to try next, the former government relations consultant’s mind darts to a recent closed-door conversation he had with McHenry.

“Patrick McHenry suggested we don't get food or water, and maybe that will help,” Molinaro tells WIRED. “That was a joke. I don't want people to think he's gonna starve us.”

Like good policy, all good humor is grounded in reality, no? The unanswered question—one hovering ominously over all US politics these days—is, do Republicans live in the same reality as, well, Republicans? MAGA’s now passé—a distinction without a difference, really. That is, unless centrist Republicans actually declare the difference. That’s a step too far for most tenets cramped in Trump’s new small-tent GOP. Scalise gets the distinction, but he stops short of defining the difference.

"There's some folks that really need to look in the mirror over the next couple of days and decide are we going to get back on track, or if they're going to pursue their own agenda," Scalise told reporters at the Capitol Thursday night. That’s the same tightrope McCarthy—who only was granted his recently retired gavel in the 15th bruising round of speaker votes back in January—teetered on throughout his tenuous nine-month tenure. It’s also much like the one Senate minority leader Mitch McConnell has delicately maneuvered around—or sidestepped—on the other side of the Capitol. Center-right Republicans seem to finally be standing up to minority rule of their majority.

“It shows a structural problem,” Michael Waltz, a third-term Floridia Republican, tells WIRED. “You have to, in a republic, be able to rule by majority vote, and when we have a structural problem that came out of January where we can't, then I think that's gotta be fixed.”

Scalise’s surrender seems to have dislodged something. Some Republicans say it’s time to call on the House parliamentarian—the chamber’s procedural brain trust—to see if there’s an obscure loophole they can use to bypass this latest Republican blockade of Republicans. “There’s suggestion of that, but I don't see consensus around that,” Waltz says, even as he says tweaking internal party rules is different than overhauling House rules. “We're gonna be addressing our rules.” For now, the majority of the GOP don’t dare tamper with House rules, in no small part because Trump’s base is enlivened, engaged, and digitally screaming at the party’s rank and file.

Thing is, all of this was inevitable. “We knew this. I felt this in November when we, sadly, won with such a slim majority,” Chuck Fleischmann, a seven-term Tennessean, tells WIRED. “You could feel the difficulties of that slim majority present at that time. It just came into fruition 10 months later.”

Inevitable sure; painful nonetheless. Scalise is affable, genuine, and beloved by many, especially as he currently battles cancer after surviving a mass shooting just six years ago.

“The mood is pensive. There was a little bit of surprise there,” Fleischmann says. “This is not going to be an easy process. We had an historic event last week—a first, the vacating of the chair—so moving forward in these uncharted waters, in these uncharted times, is going to be difficult with a very slim majority.”

Slim and divided. Moments after Scalise and his entourage of aides and suit-donning officers left the Capitol Thursday evening, his inglorious departure was already a distant memory to second-term Michelle Fischbach of Minnesota.

“I’m looking for my phone,” the flustered congresswoman fretted, rifling through the huge handbag she set on a bronze-rimmed trash can in the Capitol’s dingy basement. When asked if she was frustrated by how the day ended, with Scalise’s walk of shame before his political family and the press corps, Fischbach spoke up on behalf of the minority of the minority of the majority party, telling WIRED, “It’s more frustrating that I can’t find my phone.”

The frustration is palpable.

US House Republicans Had Their Phones Confiscated to Stop Leaks

Dubbed “HTTP/2 Rapid Reset,” the flaw requires issuing patches to virtually every web server around the world before the problem can be eradicated.

Google, Amazon, Microsoft, and Cloudflare revealed this week that they battled massive, record-setting distributed denial of service attacks against their cloud infrastructure in August and September. DDoS attacks, in which attackers attempt to overwhelm a service with junk traffic to bring it down, are a classic internet menace, and hackers are always developing new strategies to make them bigger or more effective. The recent attacks were particularly noteworthy, though, because hackers generated them by exploiting a vulnerability in a foundational web protocol. This means that while patching efforts are well underway, fixes will need to essentially reach every web server globally before these attacks can be fully stamped out.

Dubbed “HTTP/2 Rapid Reset,” the vulnerability can only be exploited for denial of service—it doesn't allow attackers to remotely take over a server or exfiltrate data. But an attack doesn't need to be fancy to cause major problems—availability is vital for access to any digital service, from critical infrastructure to crucial information.

“DDoS attacks can have wide-ranging impacts to victim organizations, including loss of business and unavailability of mission-critical applications,” Google Cloud's Emil Kiner and Tim April wrote this week. “Time to recover from DDoS attacks can stretch well beyond the end of an attack.”

Another facet of the situation is where the vulnerability came from. Rapid Reset isn't in a particular piece of software but in the specification for the HTTP/2 network protocol used for loading webpages. Developed by the Internet Engineering Task Force (IETF), HTTP/2 has been around for about eight years and is the faster, more efficient successor to the classic internet protocol HTTP. HTTP/2 works better on mobile and uses less bandwidth, so it has been extremely widely adopted. IETF is currently developing HTTP/3.

“Because the attack abuses an underlying weakness in the HTTP/2 protocol, we believe any vendor that has implemented HTTP/2 will be subject to the attack,” Cloudflare's Lucas Pardue and Julien Desgats wrote this week. Though it seems that there are a minority of implementations that are not impacted by Rapid Reset, Pardue and Desgats emphasize that the problem is broadly relevant to "every modern web server.”

Unlike a Windows bug that gets patched by Microsoft or a Safari bug that gets patched by Apple, a flaw in a protocol can't be fixed by one central entity because each website implements the standard in its own way. When major cloud services and DDoS-defense providers create fixes for their services, it goes a long way toward protecting everyone who uses their infrastructure. But organizations and individuals running their own web servers need to work out their own protections.

Dan Lorenc, a longtime open source software researcher and CEO of the software supply chain security company ChainGuard, points out that the situation is an example of a time when the availability of open source and the prevalence of code reuse (versus always building everything from scratch) is an advantage, because many web servers have likely copied their HTTP/2 implementation from somewhere else rather than reinvent the wheel. If these projects are maintained, they will develop Rapid Reset fixes that can proliferate out to users.

It will take years to reach full adoption of these patches, though, and there will still be some services that did their own HTTP/2 implementation from scratch and don't have a patch coming from anywhere else.

“It's important to note that the big tech companies discovered this while it was being actively exploited,” Lorenc says. “It can be used to take a service down like operational tech or industrial control. That’s scary.”

Though the string of recent DDoS attacks on Google, Cloudflare, Microsoft, and Amazon raised the alarm for being so large, the companies were ultimately able to repel the attacks, which didn't cause lasting damage. But just by carrying out the assaults, hackers revealed the existence of the protocol vulnerability and how it could be exploited—a cause and effect known in the security community as “burning a zero day.” Even though the patching process will take time, and some web servers will remain vulnerable long term, the internet is safer now than if attackers hadn't shown their cards by exploiting the flaw.

“A bug like this in the standard is unusual, it's a novel vulnerability and was a valuable finding for whoever first discovered it,” Lorenc says. “They could have saved it or even probably sold it for a lot of money. I'm always going to be curious about the mystery of why someone decided to burn this one.”

HTTP/2 Rapid Reset: A New Protocol Vulnerability Will Haunt the Web for Years

Whoever looted FTX on the day of its bankruptcy has now moved the stolen money through a long string of intermediaries—including a service owned by FTX itself.

As the criminal trial of FTX founder Sam Bankman-Fried unfolds in a Manhattan courtroom, some observers in the cryptocurrency world have been watching a different FTX-related crime in progress: The still-unidentified thieves who stole more than $400 million out of FTX on the same day that the exchange declared bankruptcy have, after nine months of silence, been busy moving those funds across blockchains in an apparent attempt to cash out their loot while covering their tracks. Blockchain watchers still hope that money trail might help to identify the perpetrators of the heist—and answer the looming question of whether someone with insider knowledge of FTX was involved.

Today, cryptocurrency tracing firm Elliptic released a new report on the complex path those stolen funds have taken over the 11 months since they were pulled out of FTX on November 11 of last year. Elliptic's tracing shows how that nine-figure sum, which FTX puts at between $415 million and $432 million, has since moved through a long list of crypto services as the thieves attempt to prepare it for laundering and liquidation, and even through one service owned by FTX itself. But those hundreds of millions also sat idle for all of 2023—only to begin to move again this month, in some cases as Bankman-Fried himself sat in court, raising new and unanswered questions about the thieves' identities and plans.

“The funds basically didn't move for nine months, and then a couple of days before the trial starts, they start to move again,” says Tom Robison, Elliptic's cofounder and chief scientist. “Why did they have to move the funds now? It doesn't really make sense to start laundering funds at the time when there's so much attention on the victim of the hack.”

Aside from that strange timing, Elliptic says the FTX thieves have largely taken steps typical for the perpetrators of large-scale crypto heists as the culprits sought to secure the funds, swap them for more easily laundered coins, and then funnel them through cryptocurrency "mixing" services to achieve that laundering. The majority of the stolen funds, Elliptic says, were stablecoins that, unlike other forms of cryptocurrency, can be frozen by their issuer in the case of theft. In fact, the stablecoin issuer Tether moved quickly to freeze $31 million of the stolen money in response to the FTX heist. So the thieves immediately began exchanging the rest of those stablecoins for other crypto tokens on decentralized exchanges like Uniswap and PancakeSwap—which don't have the know-your-customer requirements that centralized exchanges do, in part because they don't allow exchanges for fiat currency.

In the days that followed, Elliptic says, the thieves began a multi-step process to convert the tokens they'd traded for the stablecoins into cryptocurrencies that would be easier to launder. They used “cross-chain bridge” services that allow cryptocurrencies to be exchanged from one blockchain to another, trading their tokens on the bridges Multichain and Wormhole to convert them to Ethereum. By the third day after the theft, the thieves held a single Ethereum account worth $306 million, down about $100 million from their initial total due to the Tether seizure and the cost of their trades.

From there, the thieves appear to have focused on exchanging their Ethereum for Bitcoin, which is often easier to feed into "mixing" services that offer to blend a user's bitcoins with those of other users to prevent blockchain-based tracing. On November 20, nine days after the theft, they traded about a quarter of their Ethereum holdings for Bitcoin on a bridge service called RenBridge—a service that was, ironically, itself owned by FTX. “Yes, it is quite amazing, really, that the proceeds of a hack were basically being laundered through a service owned by the victim of the hack,” says Elliptic's Robison.

On December 12, a month after the theft, most of the bitcoins from that RenBridge trade were then fed into a mixing service called ChipMixer. At that point, the thieves went strangely quiet. The rest of their Ethereum would remain dormant for the next nine months.

Only on September 30, just days ahead of Bankman-Fried's trial, did the remainder of the funds begin to move again, Elliptic says. By that time, both RenBridge and ChipMixer had been shut down—RenBridge due to its parent company FTX's collapse and ChipMixer due a law enforcement seizure. So the thieves pivoted to trading their Ethereum for Bitcoin on a service called THORSwap and then routing those bitcoins into a mixing service called Sinbad.

Sinbad has over the past year become a popular destination for criminal cryptocurrency, particularly crypto stolen by North Korean hackers. But Elliptic's Robison notes that despite this, the movement of funds appears less sophisticated than what he's seen in the typical North Korean heist. “It doesn't use some of the services that Lazarus typically use,” Robison says, referring to the broad group of North Korean state-sponsored hackers known as Lazarus. “So it doesn't look like them.”

Does the timing of those new movements of funds ahead of—and even during—Bankman-Fried's trial suggest someone with insider knowledge is responsible? Elliptic's Robison notes that, while the timing is conspicuous, he can only speculate at this point. It's possible that the timing has been purely coincidental, Robison says. Or someone might be moving the money now to make it _look_ like an FTX insider—potentially one who fears they might be about to lose their internet access. Neither Bankman-Fried nor his fellow executives have been charged with the theft, and some of the money movements have taken place while Bankman-Fried has been in court, with only a laptop disconnected from the internet.

Eventually, no doubt, the thieves will attempt to cash out their stolen and laundered cryptocurrency for some sort of fiat currency. Robison is still hopeful that, despite their use of mixers, they can still be identified at that point—though he declined to definitively answer whether Elliptic can defeat those mixing services' anonymity measures. “I think they probably will be successful in cashing out at least some of these funds. I think whether they're going to get away with it is a separate question,” says Robison. “There's already a blockchain trail to be followed, and I think that trail will only become clearer with time.”

Two other cryptocurrency tracing firms, TRM Labs and Chainalysis, have both been hired by FTX's new regime under CEO John Ray III to aid in the investigation. TRM Labs declined to comment on the case. Chainalysis didn’t respond to WIRED’s request for comment, nor did FTX itself.

If those cryptocurrency tracers succeed, we may someday have an answer to the mystery of the FTX heist. In the meantime, however, FTX's many aggrieved creditors will be left to keep one eye on Bankman-Fried's trial and the other on the Bitcoin blockchain.

How the FTX Thieves Have Tried to Launder Their $400 Million Haul

A video posted by Donald Trump Jr. showing Hamas militants attacking Israelis was falsely flagged in a Community Note as being years old, thus making X's disinformation problem worse, not better.

Yesterday afternoon, Donald Trump Jr. posted a graphic video to X (formerly Twitter) that purported to show Hamas fighters murdering Israeli citizens during the attack last Saturday morning. “You don’t negotiate with this,” Trump Jr. wrote. “There’s only one way to handle this.” The son of former US president Donald Trump added that the video had come from a “source within Israel.”

The post was shared widely, and within hours it had amassed over 4 million views.

Then X’s user-generated fact-checking system, Community Notes, appended a message to the tweet, stating: “This is an old video and is not from Israel,” accompanied by a link to the original video. The note suggested that Trump Jr. was contributing to what has been a flood of disinformation on X since Hamas militants attacked Israel on Saturday, supercharged by verified users and accompanied by other conspiracy theories pushed by the company’s owner, Elon Musk.

But WIRED has now verified that the Community Notes system appears to be wrong. According to an independent OSINT analysis published on Wednesday, the video Trump Jr. posted is real. It was recorded during Saturday’s attack and does show Hamas fighters shooting Israelis, the analysis found.

The incident highlights how Community Notes, touted this week by X as one of the crucial ways it was tackling disinformation, is still struggling to function as intended and is, in some instances, adding to the level of disinformation on X rather than correcting it.

The Community Notes system is made up of X users who volunteer to fact-check posts on the site. It is X’s primary fact-checking mechanism since Musk eradicated virtually all full-time Trust and Safety staff and part-time moderators who previously did that work.

The volunteers, who must be approved by X to contribute to Community Notes, suggest notes to add to what they believe are misleading posts. Those notes are only displayed publicly once a sufficient number of volunteers have approved them.

Once approved, notes are regarded as “helpful” and posted publicly. This is how X describes what it sees as a “helpful” note: “Enough contributors from different perspectives agreed that this note is helpful, so it’s being shown as context on the post.”

Earlier this week, X praised the Community Notes team for tackling the misinformation that has flooded the platform in the past week and said new accounts are being enrolled “in real time to propose and rate notes.” On Tuesday, an NBC investigation found the system was not functioning as proposed; of the two Israel-Hamas misinformation claims investigated by the outlet, more than a quarter had notes that remained private as they had not been approved by enough volunteers, while roughly two-thirds had no notes at all.

X replaces the names of users who suggest the notes with aliases, making it impossible to see who submits any particular note. In the case of the note on Trump Jr’s account, the note was submitted by a user pseudonymously identified as “Mellow Sun Swan” four hours after Trump Jr posted the video.

This was the eighth note the user had submitted, according to their profile, but the first to have been approved. The user has in recent days submitted multiple notes on posts related to Iranian links to the conflict.

In the case of the Trump Jr. video, the Community Notes user linked to a video posted on the Iranian social media platform Wisgoon as evidence that the video was from years ago, not this past weekend. In the post, the upload date on the video is in Persian, which, when translated, reads “15 Mehr 1402,” a date in the Persian calendar. This date translates in the Gregorian calendar to October 7, 2023—the date Hamas attacked Israel.

An open source intelligence researcher tells WIRED that they confirmed the video’s veracity by tracking the original video, which was broadcast by a Gaza civilian on a Facebook livestream on Saturday morning. The researcher, who posts anonymously on social media using the handle OSINTtechnical, is frequently cited by news outlets covering conflict zones.

Soon after the Trump Jr. note was published, an account associated with the far right that has advocated for banning the Anti-Defamation League tried to back up the claim about the video being fake, sharing a screenshot that showed the results of a reverse-image search for the thumbnail image of the original video. The results appear to show a series of links to Wisgoon featuring the same image, all of which have dates from seven or eight years ago. However, this is because the recent video was listed in the related videos list of the older videos, not proof that it is an older video.

On Wednesday afternoon, the note on Trump's tweet was updated to link to the tweet from the account linked to the far right.

X replied with an automated response to WIRED’s questions, stating: “Busy now, please check back later.” Trump Jr. did not respond to WIRED’s request for comment.

A Graphic Hamas Video Donald Trump Jr. Shared on X Is Actually Real, Research Confirms

The United Nations' top internet governance body will allegedly host its next two annual meetings in countries known for repressive internet policies and human rights abuses.

The United Nations’ main internet governance body looks set to host its next international forum in Riyadh, Saudi Arabia. In 2025, the UN may take its discussions on the future of an open internet to Russia. Holding the Internet Governance Forum (IGF), back to back, in authoritarian countries notorious for their surveillance and censorship of the internet risks making “a joke of the whole system,” one advocate says.

While the UN has yet to formally announce the host countries for either meeting, Saudi Arabia's minister of communications and information technology, Abdullah Alswaha, seemed to let the news slip at this year’s forum in Tokyo, Japan, which began on Sunday and ends Thursday.

In a short speech before the plenary, Alswaha ran through some key issues facing the IGF, including generative artificial intelligence and the digital divide. He proposed to the attendees that “we continue this dialog at Riyadh IGF ‘24.” He repeated that idea again at the end of his speech, leaving attendees buzzing.

“It's extremely problematic,” Barbora Bukovská, senior director for law and policy at human rights organization Article 19, tells WIRED. She learned the news on Tuesday from colleagues in Tokyo. “Their human rights record and their record on digital freedoms should disqualify them from having it.”

In recent years, Riyadh has engaged in digital surveillance of dissidents, administering the death penalty against citizens who called out its human rights record online. The Saudi regime also ordered the 2018 extrajudicial killing of journalist Jamal Khashoggi. Freedom House, a pro-democracy nonprofit, assesses that Saudi Arabia maintains one of the world’s most restrictive and censored internet systems, only marginally better than Russia.

“The IGF is a community, it's a multi-stakeholder event,” Bukovská says. “You are supposed to have not just governments and companies, but also civil society, activists, and so on.” She says it will be difficult to invite democracy and open internet advocates to Riyadh. “How are they supposed to participate in Saudi Arabia, when you can be targeted by spyware, and with all kinds of restrictions? So I think it's extremely problematic.”

The IGF is a relatively new organization, having been set up in 2006. Its purpose is more advisory than regulatory, serving as a chance for countries, corporations, civil society organizations, and activists to discuss and debate various aspects of how the internet itself is run. “It's quite interesting and important for shaping the responses on certain issues,” Bukovská says.

While it may not be responsible for standards and regulations like the International Telecommunications Union—which has also been the subject of an international tug-of-war between censorship-minded countries and those who support an open internet—it is the main UN body devoted to internet governance. Where it is hosted matters, Bukovská says. Countries like Saudi Arabia can use the Forum “as a decoy to present themselves as a part of the international community, which respects human rights.”

Oppressive governments have worked hard to dismantle the shared system of governance model of the internet, argues Léa Fiddler, pushing instead for “sovereign digital ecosystems over which they can exert even more control, leading to what is often called the ‘splinternet.”

Fiddler is a visiting fellow for democracy and human rights at the Atlantic Council’s DFRLab. She wrote in advance of the 2023 Forum that the IGF will have an “outsized impact on how the internet looks and operates over the next several decades.” The IGF is also due to renew and rewrite its mandate in the coming years, she notes. “The conclusions that stakeholders come to at IGF will inform their stance on efforts at risk of being exploited for authoritarian purposes.”

There have been proposals put forth at the UN to substantially alter the balance of power in global internet governance. Fiddler points to the “Global Digital Compact,” which could substantially increase the UN’s role in regulating the internet. In a similar vein, Bukovská points to a cybersecurity treaty currently being proposed by Russia which, critics fear, is so vague that it could permit prosecution and targeting of journalists and democracy advocates.

Saudi Arabia will not be the first illiberal regime to host the IGF. Last year’s Forum was held in Addis Ababa, Ethiopia, amid an internet shutdown in the country’s Tigray region. Critics like digital rights group AccessNow decried the choice of venue at the time. “We cannot have a truly resilient internet or shared, sustainable, common future if we systematically silence or ignore those most at risk of rights violations,” the organization wrote in a statement.

It’s unclear if Saudi Arabia was the only country to actually submit a bid to host the 2024 Forum.

In 2021, Canadian cybersecurity firm eQualitie launched a petition to have the 2024 Forum in Montreal. Dozens of tech companies and civil society organizations from Canada and around the world signed on to the petition, but the Canadian government appears to have ignored the request. A spokesperson for Canadian foreign affairs minister Melanie Joly did not return a request for comment.

In a press release, eQualitie called Riyadh’s selection a "missed opportunity" and that Saudi Arabia's successful bid "raises concerns about the Forum's ability to maintain its principles of open dialogue and collaboration with civil society."

In a LinkedIn post, Bukovská sarcastically wrote of the trend being set by the UN body hosting an internet governance conference in Riyadh. “I guess I will also be looking forward to visiting Pyongyang, Teheran, or Moscow in the years to come.” But there are good odds that the IGF’s next meeting will, in fact, be held in Russia.

In 2020, the Russian Internet Governance Forum issued a press release indicating that Russia had been chosen as the 2025 host, citing official confirmation sent by the UN. It was repeated again in December 2021 by Russia’s deputy prime minister, Dmitry Chernyshenko. “Choosing Russia as the venue to host the 20th forum is a great honor for us and evidence that our country’s strong positions in the field of the development of the information society and digital technologies are recognized,” he said in a speech.

WIRED has previously reported on how a concerted American campaign for the presidency of the International Telecommunications Union thwarted Russian efforts to take over the body.

“This actually makes a joke of the whole system,” Bukovská says. She points to similar efforts at the UN Human Rights Council. “If you want to protect the integrity of these UN systems, as something where states should be held accountable for their human rights violations, it should not go to these countries.”

This spring, the Norwegian government announced its bid for the 2025 forum. The IGF has not officially indicated where the forum will be held, and the Norwegian government did not respond to a request for comment.

It is increasingly clear that the world’s most repressive countries are vying, either in conjunction or independently, to gain more control of how the very mechanics of the internet operate.

Source

Wired