A WIRED analysis of leaked police documents verifies that a secretive government program is allowing federal, state, and local law enforcement to access phone records of Americans who are not suspected of a crime.

A little-known surveillance program tracks more than a trillion domestic phone records within the United States each year, according to a letter WIRED obtained that was sent by US senator Ron Wyden to the Department of Justice (DOJ) on Sunday, challenging the program’s legality.

According to the letter, a surveillance program now known as Data Analytical Services (DAS) has for more than a decade allowed federal, state, and local law enforcement agencies to mine the details of Americans’ calls, analyzing the phone records of countless people who are not suspected of any crime, including victims. Using a technique known as chain analysis, the program targets not only those in direct phone contact with a criminal suspect but anyone with whom those individuals have been in contact as well.

The DAS program, formerly known as Hemisphere, is run in coordination with the telecom giant AT&T, which captures and conducts analysis of US call records for law enforcement agencies, from local police and sheriffs’ departments to US customs offices and postal inspectors across the country, according to a White House memo reviewed by WIRED. Records show that the White House has, for the past decade, provided more than $6 million to the program, which allows the targeting of the records of any calls that use AT&T’s infrastructure—a maze of routers and switches that crisscross the United States.

In a letter to US attorney general Merrick Garland on Sunday, Wyden wrote that he had “serious concerns about the legality” of the DAS program, adding that “troubling information” he’d received “would justifiably outrage many Americans and other members of Congress.” That information, which Wyden says the DOJ confidentially provided to him, is considered “sensitive but unclassified” by the US government, meaning that while it poses no risk to national security, federal officials, like Wyden, are forbidden from disclosing it to the public, according to the senator’s letter.

AT&T spokesperson Kim Hart Jonson declined WIRED’s request to comment on the DAS program, saying only that the company is required by law to comply with a lawful subpoena.

There is no law requiring AT&T to store decades’ worth of Americans’ call records for law enforcement purposes. Documents reviewed by WIRED show that AT&T officials have attended law enforcement conferences in Texas as recently as 2018 to train police officials on how best to utilize AT&T’s voluntary, albeit revenue-generating, assistance.

In 2020, the transparency collective Distributed Denial of Secrets published hundreds of gigabytes of law enforcement data stolen from agencies around the US. A WIRED review of the files unearths extraordinary detail regarding the processes and justifications that agencies use to monitor the call records of not only criminal suspects, but of their spouses, children, parents, and friends. While DAS is managed under a program devoted to drug trafficking, a leaked file from the Northern California Regional Intelligence Center (NCRIC) shows that local police agencies, such as those in Daly City and Oakland, requested DAS data for unsolved cases seemingly unrelated to drugs.

In one instance, an officer with the Oakland Police Department asked for a “Hemisphere analysis” to identify the phone number of a suspect by analyzing the calls of the suspect’s close friends. In another, a San Jose law enforcement officer asked the Northern California Regional Intelligence Center to identify a victim and material witness in an unspecified case. One officer, soliciting information from AT&T under the program, wrote: “We obtained six months of call data for \[suspect\]'s phone, as well as several close associations (his girlfriend, father, sister, mother).” The records do not indicate how AT&T responds to every request.

Leaked law enforcement files further show that a range of officials—from a US Postal Service inspector to a New York Department of Corrections parole officer—participated in DAS training sessions. Other participants include port authorities and members of US Immigration & Customs Enforcement, National Guard, and California Highway Patrol, alongside scores of smaller agencies.

First disclosed by _The New York Times_ in September 2013 as Hemisphere, the DAS program—renamed in 2013—has since flown largely under the radar. Internal records concerning the program’s secrecy that were obtained by the newspaper at the time show that law enforcement had long been instructed to never “refer to Hemisphere in any official document.”

Following the _Times_’ story, former US president Barack Obama reportedly suspended funding for the Hemisphere program in 2013. And while discretionary funding was withheld over the following three years, a White House memo obtained by WIRED shows that individual law enforcement organizations across the US were permitted to continue contracting with AT&T directly in order to maintain access to its data-mining service. Funding resumed under former president Donald Trump but was halted again in 2021, according to the White House memo. Last year, under president Joe Biden, the funding resumed once more, the memo says.

The White House acknowledged an inquiry from WIRED but has yet to provide a comment.

The DAS program is maintained under an affiliated program called HIDTA, funded by the White House’s Office of National Drug Control Policy (ONDCP). HIDTA, or “high-intensity drug trafficking area,” is a designation assigned to 33 different regions of the US, according to the White House. The first five regions, mapped out in 1990, included areas around Los Angeles, Houston, Miami, New York, and the entire US-Mexico border, some of the nation’s most active drug trafficking areas.

The collection of call record data under DAS is not wiretapping, which on US soil requires a warrant based on probable cause. Call records stored by AT&T do not include recordings of any conversations. Instead, the records include a range of identifying information, such as the caller and recipient’s names, phone numbers, and the dates and times they placed calls, for six months or more at a time. Documents released under public records laws show the DAS program has been used to produce location information on criminal suspects and their known associates, a practice deemed unconstitutional without a warrant in 2018.

“Requests concerning location information require the highest level of legal demand, which is a court-issued warrant, except in emergency situations,” AT&T’s Hart Jonson says.

Orders targeting a nexus of individuals are sometimes called “community of interest” subpoenas, a phrase that among privacy advocates is synonymous with dragnet surveillance.

“The scale of the data available to and routinely searched for the benefit of law enforcement under the Hemisphere Project is stunning in its scope,” Wyden’s letter to Garland says.

The White House has provided at least $6.1 million in discretionary funding to the DAS program since 2013, according to a two-page memo authored last year by White House officials. An internal HIDTA “participant guide” reviewed by WIRED shows that HIDTA funding exceeded $280 million in 2020 alone. It remains unclear how much HIDTA funding is spent to support AT&T’s vast collection of American call records.

It is not currently known how far back the call records accessible under DAS go. A slide deck released under the Freedom of Information Act in 2014 states that up to 10 years’ worth of records can be queried under the program, a statistic that contrasts with other internal documents that claimed AT&T could reach decades into the past. AT&T’s competitors, meanwhile, typically retain call records for no more than two years. (The necessity for phone companies to track call records for extended periods of time has gradually decreased with the disappearance of long-distance charges.)

The DAS program echoes multiple dragnet surveillance programs dating back decades, including a Drug Enforcement Agency program launched in 1992 that forced phone companies to surrender records of virtually all calls going to and from over 100 other countries; the National Security Agency’s bulk metadata collection program, which the US Second Circuit Court of Appeals deemed illegal in 2014; and the Call Details Records program, which suffered from “technical irregularities” leading the NSA to collect millions of calls it was “not authorized to receive.”

Unlike these past programs, which were subject to congressional oversight, DAS is not. A senior Wyden aide tells WIRED the program takes advantage of numerous “loopholes” in federal privacy law. The fact that it’s effectively run out of the White House, for example, means it is exempt from rules requiring assessments of its privacy impacts. The White House is also exempt from the Freedom of Information Act, reducing the public’s overall ability to shed light on the program.

Because AT&T’s call record collection occurs along a telecommunications “backbone,” protections enshrined under the Electronic Communications Privacy Act may not apply to the program.

Earlier this month, Wyden and other lawmakers in the House and Senate introduced comprehensive privacy legislation known as the Government Surveillance Reform Act. The bill contains numerous provisions that, if enacted, would patch most if not all of these loopholes, effectively rendering the DAS program, in its current form, explicitly illegal.

Read Wyden’s full letter to the US Department of Justice below:

_The Honorable Merrick B. Garland_  
_Attorney General_  
_U.S. Department of Justice_  
_950 Pennsylvania Avenue, NW_  
_Washington, DC 20530-0001_

_Dear Attorney General Garland:_

_I write to request that you clear for public release additional information about the Hemisphere Project. This is a long-running dragnet surveillance program in which the White House pays AT&T to provide all federal, state, local, and Tribal law enforcement agencies the ability to request often-warrantless searches of trillions of domestic phone records._

_In 2013, the New York Times revealed the existence of a surveillance program in which the White House Office of National Drug Control Policy (ONDCP) pays AT&T to mine its customers’ records for the benefit of federal, state, local, and Tribal law enforcement agencies. According to an ONDCP slide deck, AT&T has kept and queries as part of the Hemisphere Project call records going back to 1987, with 4 billion new records being added every day. That slide deck was apparently disclosed by a local law enforcement agency in response to a public information request and was published by the New York Times in 2013._

_The scale of the data available to and routinely searched for the benefit of law enforcement under the Hemisphere Project is stunning in its scope. One law enforcement official described the Hemisphere Project as “AT&T's Super Search Engine” and ... "Google on Steroids,” according to emails released by the Drug Enforcement Administration (DEA) under the Freedom of Information Act. The ONDCP slide deck and an email released by the DEA also reveal that AT&T searches records kept by its wholesale division, which carries communications on behalf of other communications companies and their customers. Another slide deck released by ONDCP and published by the press in 2014 describes the specific capabilities of Hemisphere, including that it can be used to identify alternate numbers used by a target, obtain location data and “two levels of call detail records for one target number” (meaning the phone records of everyone who communicated with the target)._

_The Hemisphere Project has been supported by regular funding from the White House ONDCP since 2009, according to the attached undated white paper that ONDCP provided to my office on October 27, 2022 (Appendix A). That same document reveals that White House funding for this program was suspended by the Obama Administration in 2013, the same year the program was exposed by the press, but continued with other federal funding under a new generic sounding program name, “Data Analytical Services.” ONDCP funding for this surveillance program was quietly resumed by the Trump Administration in 2017, paused again in 2021, the first year of the Biden Administration, and then quietly restarted again in 2022._

_Although the Hemisphere Project is paid for with federal funds, they are delivered to AT&T through an obscure grant program, enabling the program to skip an otherwise mandatory federal privacy review. If the funds came directly from a federal agency, such as the DEA, Hemisphere would have been subjected to a mandatory Privacy Impact Assessment conducted by the Department of Justice (DOJ) Office of Privacy and Civil Liberties, the findings of which would be made public. Instead, ONDCP provides funding for the program through the Houston High Intensity Drug Trafficking Area (HIDTA), one of 33 regional funding organizations as a part of a grant program created by Congress and administered by ONDCP. The HIDTAs distribute federal anti-drug law enforcement grants to state and local agencies, and are governed by a board made up entirely of federal, state and local law enforcement officials._

_ONDCP provided my staff with an undated white paper describing the program and its historical funding levels, but ONDCP directed all questions about Hemisphere to the Houston HIDTA. Officials at the Houston HIDTA provided my office with a briefing on November 7, 2022, and spoke again with my staff again by phone on December 1, 2022. The Houston HIDTA officials told my staff that all Hemisphere requests are sent to a single AT&T analyst located in Atlanta, Georgia, and that any law enforcement officer working for one of the federal, state, local and Tribal law enforcement agencies in the U.S. can contact the AT&T Hemisphere analyst directly to request they run a query, with varying authorization requirements. The Houston HIDTA officials confirmed that Federal and state law enforcement agencies can request a Hemisphere search with a subpoena, which is a directive that many law enforcement agencies can issue themselves (except in California and Texas, where a court order is required by state law). They also explained that Hemisphere searches are not required to be in support of drug-related investigations._

_For the past year, I have urged the DOJ to release dozens of pages of material related to the Hemisphere Project, which it first provided to my office in 2019. This information has been designated “Law Enforcement Sensitive,” which is meant to restrict its public release. I have serious concerns about the legality of this surveillance program, and the materials provided by the DOJ contain troubling information that would justifiably outrage many Americans and other members of Congress. While I have long defended the government’s need to protect classified sources and methods, this surveillance program is not classified and its existence has already been acknowledged by the DOJ in federal court. The public interest in an informed debate about government surveillance far outweighs the need to keep this information secret. To that end, I urge you to promptly clear for public release the material described in Appendix B._

_Thank you for your attention to this important matter._

_Sincerely,_

_Ron Wyden_  
_United States Senator_

Secretive White House Surveillance Program Gives Cops Access to Trillions of US Phone Records

Plus: The FBI's baffling inaction on a ransomware group, a massive breach of Danish electric utilities, and more.

If you’re looking for a long read to while away your weekend, we’ve got you covered. First up, WIRED senior reporter Andy Greenberg reveals the wild story behind the three teenage hackers who created the Mirai botnet code that ultimately took down a huge swath of the internet in 2016. WIRED contributor Garrett Graff pulls from his new book on UFOs to lay out the proof that the 1947 “discovery” of aliens in Roswell, New Mexico, never really happened. And finally, we take a deep dive into the communities that are solving cold cases using face recognition and other AI.

That’s not all. Each week, we round up the security and privacy stories we didn’t report in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

For years, mercenary hacker companies like NSO Group and Hacking Team have repeatedly been the subject of scandal for selling their digital intrusion and cyberespionage services to clients worldwide. Far less well-known is an Indian startup called Appin that, from its offices in New Delhi, enabled customers worldwide to hack whistleblowers, activists, corporate competitors, lawyers, and celebrities on a giant scale.

In a sprawling investigation, Reuters reporters spoke to dozens of former Appin staff and hundreds of its hacking victims. It also obtained thousands of its internal documents—including 17 pitch documents advertising its “cyber spying” and “cyber warfare” offerings—as well as case files from law enforcement investigations into Appin launched from the US to Switzerland. The resulting story reveals in new depth how a small Indian company “hacked the world,” as Reuters writes, brazenly selling its hacking abilities to the highest bidder through an online portal called My Commando. Its victims, as well as those of copycat hacking companies founded by its alumni, have included Russian oligarch Boris Berezovsky, Malaysian politician Mohamed Azmin Ali, targets of a Dominican digital tabloid, and a member of a Native American tribe who tried to claim profits from a Long Island, New York, casino development on his reservation.

The ransomware group known as Scattered Spider has distinguished itself this year as one of the most ruthless in the digital extortion industry, most recently inflicting roughly $100 million in damage to MGM Casinos. A damning new Reuters report—their cyber team has had a busy week— suggests that at least some members of that cybercriminal group are based in the West, within reach of US law enforcement. Yet they haven't been arrested. Executives of cybersecurity companies who have tracked Scattered Spider say the FBI, where many cybersecurity-focused agents have been poached by the private sector, may lack the personnel needed to investigate. They also point to a reluctance on the part of victims to immediately cooperate in investigations, sometimes depriving law enforcement of valuable evidence.

Denmark's critical infrastructure Computer Emergency Response Team, known as SektorCERT, warned in a report on Sunday that hackers had breached the networks of 22 Danish power utilities by exploiting a bug in their firewall appliances. The report, first revealed by Danish journalist Henrik Moltke, described the campaign as the biggest of its kind to ever target the Danish power grid. Some clues in the hackers' infrastructure suggest that the group behind the intrusions was the notorious Sandworm, aka Unit 74455 of Russia's GRU military intelligence agency, which has been responsible for the only three confirmed blackouts triggered by hackers in history, all in Ukraine. But in this case, the hackers were discovered and evicted from the target networks before they could cause any disruption to the utilities' customers.

Last month, WIRED covered the efforts of a whitehat hacker startup called Unciphered to unlock valuable cryptocurrency wallets whose owners have forgotten their passwords—including one stash of $250 million in bitcoin stuck on an encrypted USB drive. Now, the same company has revealed that it found a flaw in a random number generator widely used in cryptocurrency wallets created prior to 2016 that leaves many of those wallets prone to theft, potentially adding up to $1 billion in vulnerable money. Unciphered found the flaw while attempting to unlock $600,000 worth of crypto locked in a client's wallet. They failed to crack it but in the process discovered a flaw in a piece of open-source code called BitcoinJS that left a wide swath of other wallets potentially open to be hacked. The coder who built that flaw into BitcoinJS? None other than Stefan Thomas, the owner of that same $250 million in bitcoin locked on a thumb drive.

The Startup That Transformed the Hack-for-Hire Industry

Beyond the blinding speeds and sharp turns on new terrain, the teams at this weekend’s big F1 race are preparing for another kind of danger.

Every Formula 1 race weekend is essentially a pop-up event in a different city around the world, bringing 10 teams, their cars, and their entire mobile infrastructure to Australia, Singapore, Monaco, and beyond. This weekend's Las Vegas Grand Prix is especially unscripted, though, because the event is Formula 1's debut in Sin City. Cold weather and a rogue drain cover on the track have already injected some chaos into the spectacle. But as they prepared for the event, cybersecurity specialists from McLaren Racing, the city of Las Vegas, and the security firm Darktrace told WIRED that they aren't deterred—their whole job is to expect the unexpected.

Major live sporting events are a prime target for hackers because they are prominent, highly visible, and draw international attention. Russia's notorious attempt to target the 2018 Winter Olympics in South Korea, for example, included both disruptive attacks and hacks for information gathering. All sports now incorporate advanced elements of digital analysis and quantified performance, but Formula 1 is a particularly data-heavy sport. Race cars are essentially giant sensor arrays that are hurtling around at more than 200 miles per hour, generating massive amounts of information. The quicker teams can crunch the numbers from the track, the sooner they can determine which strategies and modifications to employ in real time or in preparation for the final race of the weekend. But a denial of service attack on any of a team’s engineering systems, one that disrupts their real-time communications, or theft of intellectual property could be disastrous for an F1 team.

“We’re a very public sport,” says Ed Green, McLaren's head of commercial technology. “Our people are known and where we’re racing is known and what we do is known. And while there are lots of unknown things about our operation, lots of what we do is public so people can find out information and start to target us. So what we’re trying to do is make sure that security is part of the team and an additive part of what we do.”

Green describes McLaren's setup at each race as “an extension of the office for the weekend.” The infrastructure is a sort of mobile data center where, for example, the pit crew on the ground is working as a remote part of the garage back at headquarters. This means that a crucial component of the entire operation is reducing latency in the digital connection between the track and home base—a geographic and network distance that varies significantly from weekend to weekend as the season plays out around the world. Green says that during the Brazil race in Sao Paulo at the beginning of November, McLaren was connected to its HQ in England with just a 223-millisecond delay.

“We pull down 1.5 terabytes of data a weekend and run 50 million simulations over the course of a weekend. And I would break down the importance of cybersecurity in a few different buckets,” McLaren CEO Zak Brown says. “We have the design IP of our race car, and that is highly confidential trade secrets that we're moving around a lot. We're dealing with third parties and racing around the world. And then we have all the data that is going on at the race track, where we're literally making split-second decisions.”

Darktrace, which provides digital defense services for McLaren and has also worked with the city of Las Vegas on its cybersecurity for years, says that phishing, business email compromise, and other scams are the types of attacks its real-time, artificial-intelligence-based threat monitoring system detects and blocks most often related to Formula 1, both day to day and on race weekends.

“One of the things that I've learned from being a partner with McLaren is the car changes continuously, every race there are things that are changing, new elements being introduced based on the track conditions,” says Nicole Eagan, Darktrace's chief strategy and AI officer. “It's a continuous updating and changing of IP that's much more dynamic than in other industries that we protect.”

All of this change and quick communication both within an organization and with third parties creates potential opportunities for scammers. But McLaren's Brown also notes that Formula 1 teams need to be wary of their position on the global stage.

“It's one thing to lock down Fort Knox—we’re moving 24 times around the world into different countries, from China to Saudi Arabia to Las Vegas,” he says. “Each one has its own challenges. With the growth of the sport, how much technology we use and where we're racing, people will attempt to use our sport sometimes in a political nature. There are bad actors that can potentially come at us from every angle and for every reason, some of which aren't personal. So therefore cybersecurity is right at the top of the list when we go through our IT needs.”

While Darktrace chief information security officer Mike Beck agrees that geopolitics and hacktivism can pose a threat to a sport with as much global reach as F1, he adds that competitive racing's simple and straightforward goal is an advantage for defenders.

“The mission is so clear, get that car around the track as fast as possible and make sure no one steals your IP and you don’t get locked out,” he says. “When you get that sort of clarity on a mission you can articulate risk really, really well.”

While preparing for the Formula 1 race weekend has been a logistical challenge in many ways, Michael Sherwood, Las Vegas' chief innovation and technology officer, says that the city is well positioned to handle the cybersecurity component because it deals with so many high-profile events throughout the year. Las Vegas has also invested in smart city infrastructure and already defends a massive array of deployed sensors and other networked devices.

Recent cyberattacks that targeted some of Las Vegas' entertainment giants, including Caesar's and MGM Resorts, have put the city on even higher alert, Sherwood says. But he adds that whether he's working on digital defenses for the Grand Prix, New Year's Eve, or just a regular night of epic Vegas partying, “there’s no resting. This is the world we live in—you’re on guard all the time, preparing and prepping.”

Inside the Race to Secure the F1 Las Vegas Grand Prix

Far-right influencers and right-wing lawmakers are using the spread of Osama bin Laden’s “Letter to America” to call for a TikTok ban and boost decades old conspiracies.

A number of users have posted TikToks in recent days that share parts of Osama bin Laden’s 2002 “Letter to America,” where the deceased al Qaeda leader said the attacks on September 11, 2001, were justified. Posters used it to critique US foreign policy and have claimed that the letter changed their perspective. But while some have questioned the actual virality of these posts as conversations about these TikToks exploded on Thursday evening, far-right lawmakers and influencers have used the renewed interest in bin Laden to spread conspiracy theories about 9/11 and push their own anti-China agenda.

On his Thursday podcast, right-wing commentator and conspiracist Glenn Beck compared the TikTok posts to “the Antichrist forming,” and claimed the phenomenon shows “the terrifying threat America continues to face from global powers.” He then compared bin Laden’s worldview “to modern leftist talking points.”

Charlie Kirk, president of Turning Point USA, boosted conspiracies about public education. “Why is everyone shocked \[that\] a generation taught to hate America would embrace Osama Bin Laden?” Kirk wrote on Telegram.

One of his followers replied: “Not shocked. We as a whole let this crap happen in our ‘higher’ education. We did not pay attention to the way the marxists infiltrated and thought it was just going to go away. Not anymore!”

The issue has also led to renewed calls for TikTok to be banned by right-wing lawmakers who have repeatedly claimed, without evidence, that TikTok is used by the Chinese government to spy on US citizens.

“TikTok is an espionage tool and a propaganda machine for the Communists. First pro-Hamas propaganda, now bin Laden?” Senator Josh Hawley from Missouri wrote on X, the website formerly known as Twitter, on Thursday night. “The CCP probably can’t believe we’re letting them get away with it. Ban TikTok.”

Similar calls were repeated elsewhere on X and on platforms home to pro-Trump far-right extremists. The top post on the message board known as The Donald this morning read, “Either get rid of TikTok or surrender to China,” and linked to an article that claimed the bin Laden trend was a Chinese government plot to undermine US democracy.

On Telegram, a number of QAnon influencers and far-right figures used the renewed interest in the al Qaeda leader to boost conspiracy theories around the 9/11 terrorist attacks. “A lot of grown ass adults still don't question 9/11 being an inside job,” QAnon influencer Jordan Sather wrote on Telegram. “The CIA and Mossad perpetrated 911,” a follower of right-wing commentator Jack Posobiec wrote in response to a link Posobiec shared about the TikTok trend, adding: “Bin Laden was their MKUltra puppet and was protected in hiding.”

Still, it is unclear what sparked the sharing of bin Laden’s letter.

Based on a review of TikTok conducted by WIRED before the platform began removing videos, the first video directing viewers to read bin Laden’s letter was posted on Friday, November 10, by an account with just 3,800 followers. The video has only been viewed 1,133 times as of the morning of Friday, November 17, with just 12 comments.

The account is, however, quite prolific, and posts up to a dozen videos each day, most of which are reposted from other accounts. The account holder appears to be an avid Trump supporter, and they share questionable content including conspiracy theories mostly linked to president Joe Biden. One video shared this week suggested that Biden was in fact a body double.

Unlike some of the later videos, which garnered many more views, this account holder didn’t read any of the content of the letter, simply telling their followers: “It’s too much to say, but I need for you guys to go and google Osama bin Laden’s “Letter to America,” and read it. It will explain a lot.”

The video was posted 24 hours after searches for the bin Laden letter spiked, according to data from Google Trends. The account holder did not respond to WIRED’s request for comment on how they learned about the letter. (A TikTok spokesperson told WIRED that the company was removing the November 10 video after WIRED had flagged it, and WIRED can confirm the video has now been removed.)

Bin Laden’s letter did not gain much attention on TikTok until Monday, November 13, when another TikTok user posted a video urging people to go and read the letter. Again, this video, from an account with 12,800 followers, did not read specific lines from the letter, but showed the poster apparently in shock upon discovering the letter’s contents.

This video gained a lot more attention, racking up over 210,000 views before it was taken down on Thursday. Numerous other accounts tagged or referenced this video in their own “Letter to America” videos in the following days.

The account holder, who didn’t respond to a question from WIRED asking where she first heard about the letter, posted a follow-up video on Wednesday, November 15, explaining that she had heard about the bin Laden video over the weekend but didn’t have time to post about it until Monday, November 13, though she failed to say where she had seen it referenced.

Then, on Wednesday, _The Guardian_ removed an English translation of bin Laden’s letter from its website. The publication said they first noticed an uptick in traffic to the site on Thursday, November 9, but didn’t remove the letter until Wednesday, after videos about it were shared to TikTok.

“The transcript published on our website had been widely shared on social media without the full context,” a note on the website reads. “Therefore we decided to take it down and direct readers instead to the news article that originally contextualized it.”

After _The Guardian_ removed the letter, some accounts, including those on X, began sharing a link to a page on the website of the US Director of National Intelligence, which hosts a different letter written by bin Laden in 2008.

The removal of the letter sparked a flurry of new videos on TikTok criticizing _The Guardian_’s decision and claiming it was somehow evidence that bin Laden’s message was being censored, even though the letter is freely available elsewhere online.

The same day, journalist Yashar Ali shared a compilation of the TikTok videos on X, with the comment: “Many of them say that reading the letter has opened their eyes, and they’ll never see geopolitical matters the same way again.” As of Friday morning, that video on X has been viewed 37 million times.

“Content promoting this letter clearly violates our rules on supporting any form of terrorism,” TikTok spokesperson Ben Rathe told WIRED on Thursday afternoon. “We are proactively and aggressively removing this content and investigating how it got onto our platform.” TikTok did not, however, confirm how many related videos it had removed from the site or how many people had seen them.

In a statement posted Thursday night on X, TikTok said the spread of these videos was “not a trend,” and said that interest in the topic gained traction only after media outlets reported on it and tweets like Ali’s went viral. The social media site also said they would take down any TikToks referencing the letter and the hashtag #lettertoamerica. The company added that prior to Ali’s post, videos with the #lettertoamerica hashtag had been viewed 1.85 million times, but after the post they had been viewed 13 million times. (Google Trends data does show a significant spike in interest in the story after Ali’s tweet on Wednesday.)

“Does anyone remember the NyQuil Chicken Challenge?” TikTok asked in their statement. “It only got attention after the media created a moral panic.”

The company claimed that this number of views for this hashtag was relatively insignificant compared to some others on the platform, such as #travel, which had 137 million views during the same period, and #skincare, which had 252 million views.

The White House has also weighed in on the topic. “There is never a justification for spreading the repugnant, evil, and antisemitic lies that the leader of al Qaeda issued just after committing the worst terrorist attack in American history,” White House spokesman Andrew Bates told CNN.

Though it's still not clear exactly why this began, some disinformation researchers believe that the trend has all the hallmarks of a coordinated influence campaign.

“It was my gut instinct the second I saw the first video, reinforced by seeing others that were so similar and seemed scripted,” Tamsin Shaw, who teaches philosophy and politics at New York University and tracks social media’s impact on society, tells WIRED. “Then there was the fact that the actual eight-page letter is full of religious jargon, fairly hard to parse, would take longer than the attention span of someone on TikTok to read, and the kids posting about it were saying it was only two pages.”

The Bin Laden Letter Is Being Weaponized by the Far Right

A new report by an oversight committee in the US House of Representatives says the FBI has routinely violated rules governing FISA’s Section 702 surveillance program and must be reined in.

A report compiled by the Republican majority members of the US House Intelligence Committee says that agents of the Federal Bureau of Investigation should be required under the law to obtain a “probable cause warrant” before scouring the database of a controversial foreign intelligence surveillance program for information related to domestic crimes.

The Section 702 program, authorized under the Foreign Intelligence Surveillance Act (FISA), has a history of being abused by the FBI, the Intelligence Committee says, necessitating a “complete review” of the program and “the enactment of meaningful reforms.”

The program, which targets the communications of foreigners overseas with the compulsory assistance of US telecom providers, has been the target of significant scrutiny on Capitol Hill, with federal lawmakers frequently airing concerns about its capacity to be turned against the American public, whose texts, emails, and internet calls are collaterally intercepted by the US National Security Agency in unknown quantities each year.

The Intelligence Committee report, first obtained by WIRED, labels the program as essential to combating nuclear proliferation and thwarting terror attacks, adding that it has also been employed successfully in investigations of ransomware targeting US infrastructure, war crimes by Russian soldiers in Ukraine, and the “malign investments” of hostile actors that pose key economic security risks to the United States and its allies.

Still, the program, according to the committee's majority party, has been “abused by those who swore to support and defend the American people—in particular, the FBI.”

“Our report outlines reforms necessary for FISA's reauthorization," says representative Mike Turner, the Intelligence Committee's chair, while claiming the US is currently “at its greatest risk of a terrorist attack in nearly a decade.” Adds Turner: “We cannot afford to let this critical national security tool expire.”

In total, the House Intelligence Committee lists 45 “improvements” that it wishes to include in coming legislation that would enable the 702 program to continue, including criminal liability for 702 leaks involving an American's communications; enhanced penalties for federal employees who violate FISA procedures; and a new court-appointed counsel able to scrutinize FISA application by the government aimed at surveillance of a US citizen.

The report was finalized by a working group composed of three Republican members: Turner, who hails from Ohio, and representatives Darin LaHood and Brian Fitzpatrick of Illinois and Pennsylvania, respectively. The working group stresses that federal courts have time and again ruled the 702 program constitutional—when its procedures are not skirted by negligent employees and willful violators for nefarious or self-serving means.

The FBI and the Biden administration at large have lobbied Congress to reauthorize the 702 program as is, ignoring calls for reform that have grown louder since the beginning of the year, manifesting this month in the form of a comprehensive privacy bill—the Government Surveillance Reform Act—legislation that likewise seeks to impose warrant requirements on the FBI, which at present can conduct searches of 702 data without a judge's consent, so long as it's “reasonably likely” to find evidence of a crime.

FBI director Christopher Wray, speaking before the House Homeland Security Committee on Wednesday, denounced plans to impose a warrant requirement under 702, calling it a “significant blow” to the bureau's national security division.

“A warrant requirement would amount to a de facto ban,” Wray says, noting the FBI would often be unable to meet the legal standard necessary for the court's approval, and that the processing of warrants would take too long in the face of “rapidly evolving threats.”

The report goes on to detail “significant” violations at the FBI, most previously reported to the Foreign Intelligence Surveillance Court (FISC) in 2022, before they were made known to the public in May. The majority of the incidents—including one in which an FBI analyst conducted “batch queries of over 19,000 donors to a congressional campaign”—took place prior to a package of “corrective reforms” that the FBI is crediting with practically curing its compliance issues.

The report attributes “most” misuses of 702 data to “a culture at the FBI” wherein access was granted to many “poorly trained” agents and analysts with few internal safeguards. As one example, it states that FBI systems for storing 702 data had not been designed to make employees “affirmatively opt-in” before conducting a query, “leading to many inadvertent, noncompliant” issues of the system. “It also seems that FBI management failed to take query compliance incidents seriously,” the report says, “and were slow to implement reforms that would have addressed many of the problems.”

Nevertheless, the committee says the FBI “realized the depth and breadth of its issues” and has begun implementing serious reforms on its own—including, among other measures, additional guidance for employees, ample system modifications, and heightened oversight in the form supervisory reviews by FBI legal experts and senior executives. The committee, nonetheless, notes that the FISC—albeit somewhat “encouraged” by recent improvements—has found the bureau's noncompliance with 702 procedures “persistent and widespread,” warning that it may become necessary to significantly curtail its employees' access to raw foreign intelligence in the future.

“The FBI has a history of abuse regarding the querying of Section 702 information,” the report says, adding that reforms soon to be advanced by the intel committee would see the number of FBI employees with access to the data cut by as much as 90 percent.

Citing “insufficient oversight and supervision” at the FBI, the committee says it should be prepared to audit every query targeting a US person “within 6 months” of the search, and House and Senate leaders should be notified at once when and if an FBI analyst queries a term that might "identify a member of Congress.”

“The American people deserve a law that protects them from both governmental overreach and security threats,” the report says. “Section 702 must be reauthorized, but it also must be reformed.”

US Congress Report Calls for Privacy Reforms After FBI Surveillance 'Abuses'

Signal’s president reveals the cost of running the privacy-preserving platform—not just to drum up donations, but to call out the for-profit surveillance business models it competes against.

The encrypted messaging and calling app Signal has become a one-of-a-kind phenomenon in the tech world: It has grown from the preferred encrypted messenger for the paranoid privacy elite into a legitimately mainstream service with hundreds of millions of installs worldwide. And it has done this entirely as a nonprofit effort, with no venture capital or monetization model, all while holding its own against the best-funded Silicon Valley competitors in the world, like WhatsApp, Facebook Messenger, Gmail, and iMessage.

Today, Signal is revealing something about what it takes to pull that off—and it’s not cheap. For the first time, the Signal Foundation that runs the app has published a full breakdown of Signal’s operating costs: around $40 million this year, projected to hit $50 million by 2025.

Signal’s president, Meredith Whittaker, says her decision to publish the detailed cost numbers in a blog post for the first time—going well beyond the IRS disclosures legally required of nonprofits—was more than just as a frank appeal for year-end donations. By revealing the price of operating a modern communications service, she says, she wanted to call attention to how competitors pay these same expenses: either by profiting directly from monetizing users’ data or, she argues, by locking users into networks that very often operate with that same corporate surveillance business model.

“By being honest about these costs ourselves, we believe that helps provide a view of the engine of the tech industry, the surveillance business model, that is not always apparent to people,” Whittaker tells WIRED. Running a service like Signal—or WhatsApp or Gmail or Telegram—is, she says, “surprisingly expensive. You may not know that, and there’s a good reason you don’t know that, and it’s because it’s not something that companies who pay those expenses via surveillance _want_ you to know.”

Signal pays $14 million a year in infrastructure costs, for instance, including the price of servers, bandwidth, and storage. It uses about 20 petabytes per year of bandwidth, or 20 million gigabytes, to enable voice and video calling alone, which comes to $1.7 million a year. The biggest chunk of those infrastructure costs, fully $6 million annually, goes to telecom firms to pay for the SMS text messages Signal uses to send registration codes to verify new Signal accounts’ phone numbers. That cost has gone up, Signal says, as telecom firms charge more for those text messages in an effort to offset the shrinking use of SMS in favor of cheaper services like Signal and WhatsApp worldwide.

Another $19 million a year or so out of Signal’s budget pays for its staff. Signal now employs about 50 people, a far larger team than a few years ago. In 2016, Signal had just three full-time employees working in a single room in a coworking space in San Francisco. “People didn’t take vacations,” Whittaker says. “People didn’t get on planes because they didn’t want to be offline if there was an outage or something.” While that skeleton-crew era is over—Whittaker says it wasn’t sustainable for those few overworked staffers—she argues that a team of 50 people is still a tiny number compared to services with similar-sized user bases, which often have thousands of employees.

While Whittaker argues that Signal runs as lean an operation as possible, she also notes that many of its features cost more than they do for other communications platforms, due to the extra cost of enabling those features in privacy-preserving ways. Signal implements encryption, for instance, not just for the content of calls and texts, but for users’ contacts, and even for their user profile names and photos, as well as more obscure features, like users’ searches for animated GIFs. That means simple-looking elements of the app often require far more time-consuming and expensive engineering than would be necessary if they were offered without encryption.

Signal was originally founded with funding from the US State Department’s Open Technology Fund, but the service has since turned to donations to keep afloat. When the Signal Foundation was created in 2018 and WhatsApp cofounder Brian Acton left Facebook to become its president, he donated $50 million. But with Signal’s growing user base and staff, that donation wouldn't cover much more than a year’s current budget for the company. Other major donors continue to cover the foundation’s costs, Whittaker says—Twitter cofounder Jack Dorsey, for instance, has pledged $1 million a year, and others Whittaker declines to name have given similarly large contributions.

But Signal hopes to increasingly rely on donations of as little as $3 that can be made through the app itself. Monthly donations of $5 or more are rewarded with a badge for the user’s account. Those small donations, Signal says, now account for 25 percent of its operating costs, up from 18 percent last year, the first full year after Signal enabled in-app contributions. But for Signal to continue to exist and grow without depending on a few wealthy individuals, Whittaker says small user donations will need to ramp up significantly.

With a nearly $50 million annual budget, can Signal actually survive on those donations? “We have to,” says Whittaker. “Signal needs to find a way to survive in perpetuity because it is _the_ tool that we have to ensure meaningfully private communications.”

Whittaker says that charging users has never been an option—Signal would never have grown its network to a degree that could compete with iMessage or WhatsApp if it hadn’t been free all along. Nor can Signal adopt a venture capital-funded business model that would leave the service vulnerable to investors or shareholders demanding a profitable exit. Exhibit one: Elon Musk’s acquisition of Twitter and his decisions that triggered an exodus of its users. “We’re not going to get leaned on,” says Whittaker. “We’re going to stay myopically focused on our mission, without the kind of pressure to compromise that for-profit tech companies feel. And that pressure is heavy when you recognize the cost to do what we do.”

Given that privacy-focused mission, Whittaker argues that revealing Signal’s costs isn't just about helping to raise money to keep protecting users’ communications, it also serves to call out the rest of the tech industry’s anti-privacy practices.

“The default for all this is surveillance. That’s the water we swim in. So how do we swim upstream? How do we move against this and build something that can perturb that default?” she asks. “I hope being honest about these costs leads people to ask better questions of other tech organizations, to better understand what’s actually happening and how we got into a situation where a handful of companies have such an outsize power globally based on their perfecting this surveillance business model.”

Running Signal Will Soon Cost $50 Million a Year

With Meta’s recent update to its 2FA process, the company now automatically trusts devices you often use.

Meta recently changed how two-factor authentication works for Facebook and Instagram. You might have received a notification about this, but it was easy to miss in the platform’s sea of red alerts. OK, so what’s different? “Any devices you’ve frequently used Facebook on in the past two years will be automatically trusted,” reads Meta’s updated settings page. This means it’s automatically adjusted, unless you go into your settings and opt out.

Over the years, Meta has made multiple tweaks to how it deploys 2FA. In 2018, it started to allow 2FA codes generated by third-party apps. A few years later, the company began requiring more vulnerable accounts to activate 2FA protection. The company faces a tricky balance between making it easy to log in to your account and protecting users from losing control of their online identities.

Enabling 2FA is a basic way to improve the security of any online profile, since it adds an extra layer of difficulty for hackers trying to break into your account. “The role two-factor plays is, basically, to assume that at some point your password is going to be known by someone else,” says Casey Ellis, founder and chief strategy officer at Bugcrowd, a crowdsourced security company that has previously collaborated with Facebook. “You don’t have control over when or how that happens.” For users, this fallback measure is often as easy as copying and pasting a quick code from within a smartphone app, like Google Authenticator.

Anyone with a social media account on Facebook or Instagram needs to go ahead and turn on two-factor authentication in their privacy settings. No shame if you haven’t, but do it right now by logging in to your **Account Center**, clicking **Password and security**, then **Two-factor authentication**.

Now that you’ve got it all set up, here’s what recently changed with Meta’s 2FA process: It’s no longer activated anywhere you often used Facebook or Instagram in the past two years, from previous-generation smartphones to hand-me-down laptops.

What’s the reasoning for this adjustment? “As part of our continuous work to balance account security and accessibility, we’re letting people know that we’ll be treating the devices they frequently use to log in to Facebook as trusted,” says Erin McPike, a Meta spokesperson.

Facebook via Reece Rogers

Want to activate a 2FA check for every device, even where you use Facebook or Instagram the most? Open the **Account Center,** then go to **Password and security**. You may need to enter your password after choosing **Two-factor authentication** and the account you want to adjust. Scroll all the way down to the **Authorized logins** section. After that, tap on **Trust frequently used devices** and **Opt out.**

You also have the option to granularly pick which devices won’t require a 2FA check. Go back to the **Authorized logins** section and choose **Recognized devices**. Here you’ll see every device where Meta won’t require a login code. You may be surprised by some of the old devices on the list. While the company claims it’s just for devices you used in the past two years, one option on my trusted list was an iPad accessed all the way back in 2013.

Facebook via Reece Rogers

While it’s common for social media platforms to trust certain devices for users, and security measures beyond 2FA may continue to provide protection for your account, the automatic aspect makes experts uneasy. “My immediate security reaction is that it’s going to lock in long-term access to all of those logged-in things,” says Ellis. Any change that puts more onus on the user to protect their security opens up more opportunities for mistakes and potential breaches.

After you’ve revoked trust for all the random iPads you used forever ago, what else can you do to improve the security for your Meta accounts? Always use a new, complex password, first off. Also, make sure to wipe the data from your dusty smartphones and laptops with a factory reset before selling or otherwise getting rid of them.

How to Opt Out of Facebook’s Latest Two-Factor Authentication Change

The National Telecommunication Monitoring Center in Bangladesh exposed a database to the open web. The types of data leaked online are extensive.

The list of data is long. Names, professions, blood groups, parents’ names, phone numbers, the length of calls, vehicle registrations, passport details, fingerprint photos. But this isn’t a typical database leak, the kind that happens all the time—these categories of information are all linked to a database held by an intelligence agency.

For months, the National Telecommunication Monitoring Center (NTMC), an intelligence body in Bangladesh that’s involved in collecting people’s cell phone and internet activity, has published people’s personal information through an unsecured database linked to its systems. And this past week, anonymous hackers attacked the exposed database, wiping details from the system and claiming to have stolen the trove of information.

WIRED has verified a sample of real-world names, phone numbers, email addresses, locations, and exam results included in the data. However, the exact nature and purpose of the amassed information is unclear, with some entries appearing to be test information, incorrect, or partial records. The NTMC and other officials in Bangladesh have not responded to requests for comment.

The disclosure, which appears to have been unintentional, provides a tiny glimpse into the highly secretive world of signals intelligence and how communications may be intercepted. “I wouldn't be expecting this to happen for any intelligence service, even if it's not really something that sensitive,” says Viktor Markopoulos, a security researcher for CloudDefense.AI who discovered the unsecured database. “Even if many data are test data, they still reveal the structure that they're using, or what exactly it is that they are intercepting or plan to intercept.”

After Markopoulos discovered the exposed database, he linked it back to the NTMC and login pages for a Bangladeshi national intelligence platform. Markopoulos believes the database was likely exposed due to a misconfiguration. Within the database, there are more than 120 indexes of data, with different logs stored in each. The indexes include names such as “sat-phone,” “sms,” “birth registration,” “pids\_prisoners\_list\_search,” “driving\_licence\_temp,” and “Twitter.” Some of those files contain a handful of entries each, while others contain tens of thousands.

The vast majority of the data exposed in the NTMC database is metadata—the extremely powerful “who, what, how, and when” of everyone’s communications. Phone call audio isn’t exposed, but metadata shows which numbers may have called others and how long each call lasted. This kind of metadata can be used broadly to show patterns in people’s behavior and whom they interact with.

For instance, the “birth registration” log includes fields such as name (in English and Bengali), birthday, sex, birthplace, and mother’s and father’s names and nationalities, according to a sample of the data reviewed by WIRED. Another log, called “finance personal details,” also includes people’s names as well as cell phone numbers and bank account details, and lists an “amount” for the account type. National ID numbers are frequently included in the data structures, as are cell phone numbers and the names of mobile operators in Bangladesh. There are lists of base transceiver stations, which are parts of cell phone networks, and the records mention “cdr,” which may refer to call detail records.

Some of the data leaked appears to be test information, as well as data that is incomplete or incorrect. Some entries include generic strings of numbers such as “123456789,” while other entries are repeated multiple times throughout the database. Real-world data is also included within the leaked information.

One person contacted by WIRED confirmed that the email, mobile number, and a billing address listed belonged to them. The person says they are a subscriber of telecom firm BTCL, which is government-run and has some of their personal information, although it’s unclear whether this is the source of the data that was leaked. Markopoulos found exam results listed in the data, including some that were taken in the late 1990s, that matched those listed on the Ministry of Education’s website. Text messages sent to multiple numbers in the database were delivered, although one person replied saying they were not the person listed in the dataset. Another phone number is publicly listed as belonging to a Bangladeshi business. An encoded passport photo correlates with the alleged owner’s public information (although they could not be reached for comment).

From a review of a sample of the exposed information, it is unclear why the data has been collected, where it has all been collected from, or what it is being used for. There is no indication that it relates to any wrongdoing.

Jeremiah Fowler, a security consultant and cofounder of data breach discovery firm Security Discovery, reviewed the exposed database and confirmed its links to the NTMC. Fowler, who regularly finds exposed servers and databases online, says the data being linked to the intelligence body is “probably one of the first that I have seen like this.”

“The biggest thing I saw that was really dangerous was a bunch of IMEI numbers,” he says, referring to the identifying code given to each individual cell phone. “With those, you can actually track the device or clone the device.”

The NTMC has not acknowledged or responded to WIRED’s questions about the leaked information, including those about its purpose and the amount that has been gathered. The press office of the government of Bangladesh and the Bangladesh High Commission in London also did not respond to requests for comment. Markopoulos reported the exposed information to Bangladesh’s Computer Incident Response Team (CIRT) on November 8, and it acknowledged his message and thanked him for disclosing the “sensitive exposure.” In an email to WIRED, the CIRT said it had “notified the issue” to the NTMC.

The database appeared to be offline ahead of the publication of this article. However, Markopoulos says that on November 12, the database was wiped and in its place appeared a ransom note by an unknown attacker or group of attackers. The note demanded payment of 0.01 bitcoin (around $360 at current exchange rates), or the “data will be publicly disclosed and deleted.” Both Markopoulos and Fowler say this is common for exposed databases of this kind. Meanwhile, new entries have started appearing in the wiped database, Markopoulos says, and they include a “search log” index that may indicate the system is still in use.

The NTMC, which emerged from a previous monitoring body in 2013, describes itself as an organization that provides “lawful communication interception facilities” to other agencies in Bangladesh, which has a population of 167 million. It is responsible for setting up and developing an “interception platform,” and ensuring that it operates 24/7, according to its website. Recent reporting has claimed that 30 agencies are linked to the NTMC using APIs, and that it incorporates records from mobile operators, passport and immigration services, and other bodies. In January, the NTMC reportedly purchased surveillance technology from companies headed by Israelis, and government ministers have discussed the NTMC intercepting social media data.

A telecoms expert who has worked in Bangladesh, who requested anonymity over fears of government retaliation against their family, alleges that as a “lawful intercept center,” the NTMC can collect huge volumes of data. “They are not only collecting call data records from mobile companies, but also, they are collecting logs and detailed records, session history, from internet providers,” they claim. “It's really powerful, and the kind of surveillance that they do is more powerful than European countries,” they add, citing Bangladesh’s lack of legislative parallels to Europe’s strict data protection laws.

In recent weeks, protests against the current government have rocked Bangladesh as a crackdown has happened against those in opposition, ahead of the country’s next round of elections in 2024. One Bangladesh-based researcher who asked not to be named, fearing repercussions, says they “expect to see more surveillance and targeting of individuals” ahead of the elections next year.

“I think the number one priority has to be to make individuals, especially activists … aware of the surveillance system and understand how to be safe online,” the researcher says when asked about digital rights. “When, in the country, people are fighting for their basic rights—such as securing their daily livelihood and fighting for their political rights—digital rights come much later.”

A Spy Agency Leaked People's Data Online—Then the Data Was Stolen

The new generation of hardware authentication key includes support for cryptographic passkeys as Google pushes adoption of the more secure login alternative.

Passwords are a woefully insecure—and frustrating—authentication technology, but after decades of digital use, they’re ubiquitous. Recently, though, the global tech industry has been working to promote a simpler and more secure alternative known as passkeys. Along with its other initiatives to champion the login tech, Google announced today that it is launching a new version of its Titan hardware authentication keys that can store passkeys directly on the device.

For most people on most accounts, passkeys are managed directly from a smartphone or laptop. But for anyone seeking an alternative, either because they prefer a stand-alone key for ease of use or because they want maximum security separation, storing passkeys on a hardware token is a valuable option. The new Titan keys are available now and can store more than 250 unique passkeys. They are replacing Google’s existing USB-A and USB-C Titan devices.

“We’re excited about the potential of passkeys, but know there’s no security silver bullet for everyone,” Google wrote in a blog post published today. “Some people require a solution not dependent on smartphones or use devices that don’t support passkeys—everyone has different approaches to security, but we all share one goal: stop attacks. That’s why we intentionally designed the latest Titan Security Keys to encompass the secure cryptography of passkeys on a portable piece of hardware.”

As part of setting up a passkey for a Google account on a Titan device, users will be prompted to create a PIN code that they’ll enter, along with producing the security key to log in.

As part of its announcement at the Aspen Cyber Summit in New York City today, Google also said that in 2024 it will give 100,000 of the new Titan keys to high-risk individuals around the world. The effort is part of Google’s Advanced Protection Program, which offers vulnerable users expanded account monitoring and threat protection. The company has given away Titan keys through the program in the past, and today it cited the rise of phishing attacks and upcoming global elections as two examples of the need to continue expanding the use of secure authentication methods like passkeys.

Hardware authentication tokens have unique protective benefits because they are siloed, stand-alone devices. But they still need to be rigorously secured to ensure they don’t introduce a different point of weakness. And as with any product, they can have vulnerabilities. In 2019, for example, Google recalled and replaced its Titan BLE-branded security key because of a flaw in its Bluetooth implementation.

When it comes to the new Titan generation, Google tells WIRED that, as with all of its products, it conducted an extensive internal security review on the devices and it also contracted with two external auditors, NCC Group and Ninja Labs, to conduct independent assessments of the new key.

Google’s New Titan Security Key Adds Another Piece to the Password-Killing Puzzle

Jacob Chansley, the January 6 rioter known as the QAnon Shaman, will run for Congress in Arizona. The most remarkable thing about his campaign so far is how unremarkable it is in a state that’s embraced election conspiracies.

The man who became a figurehead of the January 6 Capitol riot is planning to run for Congress in Arizona, and he may not even be the most extreme candidate on the ballot.

Jacob Chansley, a January 6 rioter known as the QAnon Shaman who wore face paint and horns to breach the Capitol, pleaded guilty to taking part in the riot. Last week, Chansley filed a statement of interest to run for a seat in Arizona’s 8th congressional district. Chansley, who has lived in the district for 30 years, tells WIRED that he is running his campaign single-handedly and does not plan to accept PAC money. Though he’s not eligible to vote under Arizona law because he is still serving part of his sentence, Chansley is able to run for Congress.

“When I heard that the seat was available, I prayed on it for a while, and the message I got from God was, ‘Do it,’” says Chansley.

In Arizona, Chansley’s decision to run for office is almost standard. Though Chansley may be viewed as a fringe candidate by many, he is not an outlier in a district and state where election deniers and conspiracists are already front and center in the 2024 election races.

Ever since former US president Donald Trump lost Arizona in 2020, the state has become the epicenter of election denial conspiracies and efforts to undermine democracy. The state was home to the Cyber Ninjas–run GOP recount that cost taxpayers millions, and its voters are represented by multiple far-right extremist GOP lawmakers, including state senator Wendy Rogers and US representative Paul Gosar, who have boosted wild conspiracy theories related to vote rigging. Former TV presenter Kari Lake, who has been touted as a possible vice presidential pick by Trump in 2024, continues to claim that the Arizona secretary of state race she lost by 17,000 votes in 2022 was stolen. Lake has also boosted racist “birther” conspiracies about former president Barack Obama and has pushed for journalists and political rivals to be jailed for unspecified crimes.

In Chansley’s home district, a slate of candidates reflecting Arizona’s embrace of extremist ideologies have already declared interest in running for the seat left open by the retirement of US representative Debbie Lesko, a member of the far-right Republican Freedom Caucus in Congress who voted against certifying the 2020 election results.

Blake Masters, who ran for a US Senate seat in 2022 and lost, announced he would run for a seat in Arizona’s 8th district last month. During his Senate race, Masters was backed by money from techno-libertarian Peter Thiel, his former boss, as well as an endorsement from Trump, who told him to lean into claims of election fraud if he wanted to win the election. (Masters very much touted 2020 election denial conspiracies, but they apparently didn’t help him win.)

Masters, who published videos of him shooting guns as part of his 2022 campaign, will face a challenge for the GOP nomination from Abe Hamadeh. Hamadeh, a 2022 Republican candidate for Arizona attorney general, also lost his race in 2022 despite having Trump’s endorsement. Hamadeh was one of the loudest voices in Arizona falsely claiming that Trump had won the 2020 election, and he is still trying to have his own loss to attorney general Kris Mayes overturned.

Former US representative Trent Franks, Lesko’s predecessor, is also running again. Franks was forced to resign in 2017 after he offered female staffers millions of dollars to serve as surrogate mothers for him and his wife—and at least one aide was unsure whether Franks was requesting to impregnate her through sexual intercourse or in vitro fertilization.

Anthony Kern, an Arizona state senator who was also in Washington, DC, on January 6, and who has been accused of using campaign finances to fund his trip to the capital, has announced his candidacy for the congressional seat as well. Kern was captured on video entering a restricted area outside the Capitol, though there is no evidence he was violent or entered the Capitol itself, and he has not been charged for any crimes related to the riot.

Kern is, however, currently under investigation by the Arizona attorney general as one of 11 fake electors who signed documents in 2020 to claim that Trump had beaten President Joe Biden in Arizona, even though Biden actually won the state. Kern also took part in the sham hand-recount of ballots in Maricopa County in 2021.

Before becoming a lawmaker, Kern was fired from his position with the El Mirage Police Department for lying to his supervisor about repaying the cost of a tablet computer he had lost. He was placed on a list of Maricopa County law enforcement officials with a history of dishonesty or misconduct.

“The race in general is gonna be wild,” one independent researcher who tracks the far-right in Arizona under the moniker Arizona Right Watch tells WIRED. But, they add, they would still “take Chansley over Kern, who is totally corrupt and batshit.”

And even though the other candidates are possibly more connected politically, Chansley still thinks he has closer ties to voters in his home district.

“Several of the candidates running here in District 8 don’t even live in District 8. I’ve lived in District 8 for over 30 years,” he tells WIRED. “I’m largely doing it on my own. It’s just me and God, man.”

He’s currently working on a campaign website, and plans to begin knocking on doors to meet voters in the next couple of weeks. Chansley is also eager to take part in debates with other candidates. “That's where I think I'll shine,” Chansley says. “I'm ready to debate anyone and everyone that wants to try.”

When asked whether he would be attending a candidate forum being organized by a local community organization on Wednesday night, Chalsey says, “quite possibly.”

Chansley added that he doesn’t want any campaign donations, but says that if people want to support him, they can do so by buying merchandise on his website which includes T-shirts, mugs, and yoga leggings that feature him dressed in the notorious QAnon Shaman garb.

Despite having no experience, no money, no support, and no endorsements, Chansley is still optimistic about winning in 2024.

“I think my chances of winning are good, otherwise God wouldn't have asked me to run,” Chansley says.

Source

Wired