Plus: A major FBI botnet takedown, new Sandworm malware, a cyberattack on two major scientific telescopes—and more.

A monthslong WIRED investigation published this week revealed the inner workings of the Trickbot ransomware gang, which has targeted hospitals, businesses, and government agencies around the world. 

The investigation stemmed from a mysterious leak publish on X (formerly Twitter) last year by an anonymous account called Trickleaks. The document trove contained dossiers on 35 alleged Trickbot members, including names, dates of birth, and much more. It also listed thousands of IP addresses, cryptocurrency wallets, email addresses, and Trickbot chat logs. Armed with this information, we enlisted the help of multiple cybersecurity and Russian cybercrime experts to paint a vivid picture of Trickbot’s organizational structure and corroborate the real-world identity of one of its key members. 

Last weekend, someone (more on that later) successfully disrupted more than 20 trains in Poland. The incidents were originally described as a “cyberattack,” but it was actually something much simpler: a radio hack. Using equipment that can cost as little as $30, the attack exploited the trains’ unencrypted radio system to cause them to perform an emergency stop. 

Over on the dark web, cybercriminals are making money in an unexpected way: writing contests. With total prizes reaching as high as $80,000, the competitions enlist hacking forum members to craft the best essays, many of which explain how to carry out cyberattacks and scams. 

Last December, Apple officially killed its controversial photo-scanning tool for detecting child sexual abuse material (CSAM) on iCloud, a tool the company launched in August 2021 before un-launching it a month later after backlash from cybersecurity experts, civil liberties advocates, and others who argued that the tool would violate users’ security and privacy. But the issue is far from resolved. This week, a new child safety group called Heat Initiative demanded that Apple reinstate the tool. Apple responded with a letter, which it shared with WIRED, detailing for the first time its full reasoning behind terminating the tool. Heat Initiative’s push comes amid international pressure to weaken encryption for law enforcement purposes.

Elsewhere, we detailed the big security patches you need to install to keep your devices safe (looking at you, Google Chrome and Android users). And we dove into the supremely nerdy world of a code-cracking competition that had contestants racing to decode a German U-boat cipher from World War II. One team had a secret weapon.

But that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

When more than 20 trains in Poland were bought to a halt last weekend in what was described as a “cyberattack,” all eyes turned to Russia. After all, Poland’s rails serve as a key piece of infrastructure for supporting Ukraine’s war effort. But as we reported a day later, the disruption had been caused not through any sophisticated cyber intrusion but through a simple radio hack that sent a “radio stop” command to the Polish trains over an unencrypted and unauthenticated system. “The frequencies are known. The tones are known. The equipment is cheap,” Polish-speaking cybersecurity researcher Lukasz Olejnik told WIRED. “Everybody could do this. Even teenagers trolling.”

Well, not teenagers exactly, but twentysomethings. This week, Polish police arrested a 24-year-old man and a 29-year-old man, both Polish citizens, who allegedly carried out the radio train hack. One of the two men, based in the city of Bialystok near the border with Belarus, was a police officer. Amateur radio equipment was found in one of their apartments, according to Poland’s RMF Radio, where the younger man was found (reportedly in a drunken state).

2 Polish Men Arrested for Radio Hack That Disrupted Trains

Child safety group Heat Initiative plans to launch a campaign pressing Apple on child sexual abuse material scanning and user reporting. The company issued a rare, detailed response on Thursday.

In December, Apple said that it was killing an effort to design a privacy-preserving iCloud photo-scanning tool for detecting child sexual abuse material (CSAM) on the platform. Originally announced in August 2021, the project had been controversial since its inception. Apple had first paused it that September in response to concerns from digital rights groups and researchers that such a tool would inevitably be abused and exploited to compromise the privacy and security of all iCloud users. This week, a new child safety group known as Heat Initiative told Apple that it is organizing a campaign to demand that the company “detect, report, and remove” child sexual abuse material from iCloud and offer more tools for users to report CSAM to the company. 

Today, in a rare move, Apple responded to Heat Initiative, outlining its reasons for abandoning the development of its iCloud CSAM scanning feature and instead focusing on a set of on-device tools and resources for users known collectively as Communication Safety features. The company's response to Heat Initiative, which Apple shared with WIRED this morning, offers a rare look not just at its rationale for pivoting to Communication Safety, but at its broader views on creating mechanisms to circumvent user privacy protections, such as encryption, to monitor data. This stance is relevant to the encryption debate more broadly, especially as countries like the United Kingdom weigh passing laws that would require tech companies to be able to access user data to comply with law enforcement requests.

“Child sexual abuse material is abhorrent and we are committed to breaking the chain of coercion and influence that makes children susceptible to it,” Erik Neuenschwander, Apple's director of user privacy and child safety, wrote in the company's response to Heat Initiative. He added, though, that after collaborating with an array of privacy and security researchers, digital rights groups, and child safety advocates, the company concluded that it could not proceed with development of a CSAM-scanning mechanism, even one built specifically to preserve privacy.

“Scanning every user’s privately stored iCloud data would create new threat vectors for data thieves to find and exploit," Neuenschwander wrote. "It would also inject the potential for a slippery slope of unintended consequences. Scanning for one type of content, for instance, opens the door for bulk surveillance and could create a desire to search other encrypted messaging systems across content types.”

WIRED could not immediately reach Heat Initiative for comment about Apple's response. The group is led by Sarah Gardner, former vice president of external affairs for the nonprofit Thorn, which works to use new technologies to combat child exploitation online and sex trafficking. In 2021, Thorn lauded Apple's plan to develop an iCloud CSAM scanning feature. Gardner said in an email to CEO Tim Cook on Wednesday, August 30, which Apple also shared with WIRED, that Heat Initiative found Apple's decision to kill the feature “disappointing.”

“We firmly believe that the solution you unveiled not only positioned Apple as a global leader in user privacy but also promised to eradicate millions of child sexual abuse images and videos from iCloud,” Gardner wrote to Cook. “I am a part of a developing initiative involving concerned child safety experts and advocates who intend to engage with you and your company, Apple, on your continued delay in implementing critical technology … Child sexual abuse is a difficult issue that no one wants to talk about, which is why it gets silenced and left behind. We are here to make sure that doesn’t happen.”

Apple maintains that, ultimately, even its own well-intentioned design could not be adequately safeguarded in practice, and that on-device nudity detections for features like Messages, FaceTime, AirDrop, and the Photo picker are safer alternatives. Apple has also begun offering an application programming interface (API) for its Communication Safety features so third-party developers can incorporate them into their apps. Apple says that the communication platform Discord is integrating the features and that appmakers broadly have been enthusiastic about adopting them.

“We decided to not proceed with the proposal for a hybrid client-server approach to CSAM detection for iCloud Photos from a few years ago,” Neuenschwander wrote to Heat Initiative. “We concluded it was not practically possible to implement without ultimately imperiling the security and privacy of our users.”

On Heat Initiative's request that Apple create a CSAM reporting mechanism for users, the company told WIRED that its focus is on connecting its vulnerable or victimized users directly with local resources and law enforcement in their region that can assist them rather than Apple positioning itself as an intermediary for processing reports. The company says that offering this intermediary service may make sense for interactive platforms like social networks.

The need to protect children from online sexual abuse is urgent, though, and as these concerns intersect with the broader encryption debate, Apple's resolve on refusing to implement data scanning will continue to be tested.

Read the full exchange between Heat Initiative and Apple below. WIRED has redacted sensitive personal information for the privacy of senders and recipients:

Apple's Decision to Kill Its CSAM Photo-Scanning Tool Sparks Fresh Controversy

Plus: Mozilla patches more than a dozen vulnerabilities in Firefox, and enterprise companies Ivanti, Cisco, and SAP roll out a slew of updates to get rid of some high-severity bugs.

August has ended the summer in style with multiple patches issued by Microsoft, Google Chrome, and its competitor Firefox to fix serious issues, some of which are being used in attacks.

While there was no Apple iPhone update at the time of writing, some major enterprise fixes were released during the month. These include patches for exploited flaws in Ivanti products, as well as fixes for vulnerabilities in SAP and Cisco software.

Read on for everything you need to know about the patches issued in August.

Microsoft

Microsoft’s August Patch Tuesday saw the software giant fixing dozens of vulnerabilities, including two already being used in real-world attacks. The first is a Defense in Depth update to CVE-2023-36884, a remote code execution (RCE) flaw in Windows Search that could allow attackers to bypass Microsoft’s Mark of the Web security feature. If it sounds familiar, that’s because Microsoft already fixed the vulnerability in July. But installing the latest update “stops the attack chain” leading to the issue, Microsoft said.

The second flaw, CVE-2023-38180 is an issue in .NET and Visual Studio that could allow an adversary to perform denial of service.

Six of the issues fixed in August’s Patch Tuesday are rated as critical, including CVE-2023-36895—an RCE flaw in the Outlook email client. Meanwhile, CVE-2023-35385, CVE-2023-36910, and CVE-2023-36911 are RCE issues in the Microsoft Message Queuing service, according to the Security Update Guide.

The fifth and sixth critical issues fixed by Microsoft in August are CVE-2023-29328 and CVE-2023-29330, both of which are RCE flaws in Teams.

Google Chrome

August kicked off with a slew of updates for Chrome 115 including nine rated as having a high impact. The 17 patches include three type-confusion flaws in V8: CVE-2023-4068, CVE-2023-4069, and CVE-2023-4070. And CVE-2023-4071 is a heap buffer overflow issue in Visuals and CVE-2023-4076 is a use-after-free flaw in WebRTC.

A couple of weeks later, Google issued Chrome 116 to patch 26 vulnerabilities, eight of which are rated as having a high impact. The most serious issues include CVE-2023-2312—a use-after-free bug in Offline—and CVE-2023-4349, a use-after-free flaw in Device Trust Connectors. A third, CVE-2023-4350, is an inappropriate implementation bug in Fullscreen.

Then, on August 23, Google released the first of its more regular weekly security updates, patching five flaws. The four vulnerabilities rated as having a high impact include two use-after-free bugs and two out-of-bounds memory access issues.

Firefox

Google Chrome’s privacy-focused competitor Firefox also had a hectic August, fixing more than a dozen vulnerabilities in Firefox 116. The issues patched by Firefox owner Mozilla include CVE-2023-4045, an issue in Offscreen Canvas rated as high, and CVE-2023-4047, a bug in popup notifications delay calculation that could allow an attacker to trick a user into granting permissions.

The update also patches memory safety bugs tracked as CVE-2023-4056, CVE-2023-4057, and CVE-2023-4058. The flaws fixed in the latest update “showed evidence of memory corruption,” Mozilla said. “We presume that with enough effort, some of these could have been exploited to run arbitrary code.”

Google Android

Google has issued 40 updates for its Android operating system including patches for serious flaws in the Framework, System, and Kernel. Tracked as CVE-2023-21273, the most severe bug fixed in August is a critical security vulnerability in the System component that could lead to RCE with no additional execution privileges needed. User interaction is not required for exploitation, Google said in its Android Security Bulletin.

Meanwhile, CVE-2023-21282 is an RCE flaw in the Media Framework also marked as having a critical impact. Another critical issue in the Kernel, tracked as CVE-2023-21264, could lead to local escalation of privilege, although System execution privileges are needed.

Google Fixes Serious Security Flaws in Chrome and Android

A WIRED investigation into a cache of documents posted by an unknown figure lays bare the Trickbot ransomware gang’s secrets, including the identity of a central member.

Unmasking Trickbot, One of the World’s Top Cybercrime Gangs

The competitions, which are held on Russian-language cybercrime forums, offer prize money of up to $80,000 for the winners.

The criminal contests have their own rules to reduce the chance of cheating, Budd says. On Exploit, the rules say the entries “must not have been published elsewhere,” should be “meaningful and voluminous,” they should include technical details such as code or algorithms, and be “at least 5,000 characters (excluding spaces).” That equals out to around 1,000 words, or the rough length of this WIRED article. The rules on XSS are similar—“copy-paste = expulsion from the contest, in disgrace”—but they require articles to be longer (at least 7,000 characters) and say there should be “proper formatting, spelling, and punctuation.”

However, scammers are going to scam. In their most recent contests, Exploit had 35 entries and XSS had 38 entries. But XSS disqualified 10 of them. The winners of the competitions are decided by forum members voting on the entries, but the sites’ admins can also pick the winners, and there have been complaints of vote rigging, according to Sophos.

These competitions have evolved and grown over time, Budd says. Previous research from cybersecurity firm Digital Shadows, which has since been acquired by ReliaQuest, shows that contests on cybercrime forums started around 2006. Roman Faithfull, a cyber-threat intelligence analyst at ReliaQuest, says these earliest competitions were very simple. “At the start, they were quite low-key,” Faithfull says. “They weren't always organized by forum administrators.”

Some of the earliest competitions, he says, asked forum members to design logos or even offered a small monetary prize to the commenter on a forum thread who had the longest account history on the site. “As forums became more sophisticated, the contests in general became more sophisticated,” Faithfull says.

Since around 2015, the contests, most of which are held annually, have focused on writing and submitting articles and code, the ReliaQuest researcher says. “There's a lot of focus on stuff that will make people money,” he adds. As this has happened, the prize pots have increased too: On XSS, the total prize pot was $1,000 in 2018 and rose to $40,000 with $14,000 for the winner in 2021. “No one is going to put out their absolute best stuff into this unless they're in a really hard spot and need some quick cash,” Faithfull says. “You're unlikely to see a ransomware group, or really, someone really high up.”

The content of the entries to the most recent two contests is reasonably broad, the Sophos research found. Some were more innovative, while others were essentially repeating information found elsewhere. The winning entry in Exploit’s 2021 crypto competition was the creation of the cloned blockchain.com website, with Sophos saying it is “relatively simplistic” overall. “A cloned site like this would typically be used like any other phishing or credential-harvesting site,” the research says.

Other winning entries or those getting honorable mentions in the Exploit competition focused on targeting initial coin offerings, a guide to creating a phishing site to steal people’s cryptocurrency account details, and a tutorial on creating a cryptocurrency from scratch. However, it is worth noting that there have been free and publicly available tutorials on how to do this for several years,” the Sophos research says.

The Weird, Big-Money World of Cybercrime Writing Contests

The sabotage of more than 20 trains in Poland by apparent supporters of Russia was carried out with a simple “radio-stop” command anyone could broadcast with $30 in equipment.

Since war first broke out between Ukraine and Russia in 2014, Russian hackers have at times used some of the most sophisticated hacking techniques ever seen in the wild to destroy Ukrainian networks, disrupt the country's satellite communications, and even trigger blackouts for hundreds of thousands of Ukrainian citizens. But the mysterious saboteurs who have, over the last two days, disrupted Poland's railway system—a major piece of transit infrastructure for NATO's support of Ukraine—appear to have used a far less impressive form of technical mischief: Spoof a simple radio command to the trains that triggers their emergency stop function.

On Friday and Saturday, more than 20 of Poland's trains carrying both freight and passengers were brought to a halt across the country through what Polish media and the BBC have described as a “cyberattack.” Polish intelligence services are investigating the sabotage incidents, which appear to have been carried out in support of Russia. The saboteurs reportedly interspersed the commands they used to stop the trains with the Russian national anthem and parts of a speech by Russian president Vladimir Putin.

Poland's railway system, after all, has served as a key source of Western weapons and other aid flowing into Ukraine as NATO attempts to bolster the country's defense against Russia's invasion. “We know that for some months there have been attempts to destabilize the Polish state,” Stanislaw Zaryn, a senior security official, told the Polish Press Agency. “For the moment, we are ruling nothing out.”

But as disruptive as the railway sabotage has been, on closer inspection, the “cyberattack” doesn't seem to have involved any “cyber” at all, according to Lukasz Olejnik, a Polish-speaking independent cybersecurity researcher and consultant and author of the forthcoming book _Philosophy of Cybersecurity_. In fact, the saboteurs appear to have sent simple so-called “radio-stop” commands via radio frequency to the trains they targeted. Because the trains use a radio system that lacks encryption or authentication for those commands, Olejnik says, anyone with as little as $30 of off-the-shelf radio equipment can broadcast the command to a Polish train—sending a series of three acoustic tones at a 150.100 megahertz frequency—and trigger their emergency stop function.

“It is three tonal messages sent consecutively. Once the radio equipment receives it, the locomotive goes to a halt,” Olejnik says, pointing to a document outlining trains' different technical standards in the European Union that describes the “radio-stop” command used in the Polish system. In fact, Olejnik says that the ability to send the command has been described in Polish radio and train forums and on YouTube for years. “Everybody could do this. Even teenagers trolling. The frequencies are known. The tones are known. The equipment is cheap.”

Poland's national transportation agency has stated its intention to upgrade Poland's railway systems by 2025 to use almost exclusively GSM cellular radios, which do have encryption and authentication. But until then, it will continue to use the relatively unprotected VHF 150 MHz system that allows the “radio-stop” commands to be spoofed.

The only real limitation of the train-paralyzing radio attack, Olejnik says, would be that the saboteurs would have to be relatively close to the target trains—somewhere from hundreds of feet to miles, depending on the power of the radio equipment used in their disruption operation. (Olejnik was careful to note that he hasn't tested the attack himself.) Given that the disruptions appear to have occurred in three different Polish administrative regions across the country, getting that equipment close enough to all the target trains would likely have been the biggest challenge for the saboteurs. “It is really a cheap operation,” Olejnik says. “The biggest risk is the need of being in proximity.”

Polish State Railways didn't immediately respond to WIRED's request for comment. But a statement from the railways agency notes that the train disruptions were due to “unauthorized broadcasting of the radio-stop signal” sent “by means of a radiotelephone by an unknown perpetrator.” The statement adds that “receiving a radio-stop signal results in an immediate stop of all trains whose radios operate on a given frequency.”

Despite those automated emergency stops, the railway agency wrote that “there is no threat to rail passengers. The result of this event is only difficulties in the running of trains.” The Polish Press Agency reported no injuries or damage as a result of the radio sabotage operation.

If Russia or its supporters have in fact sabotaged the railway system of Ukraine's ally, the operation wouldn't be without precedent. In fact, Belarusian dissident hackers known as the Cyber Partisans protested Belarus's support of the Russian military by launching their own rare political ransomware attack against Belarus's Railways' IT network in January of 2022, in an attempt to prevent Belarus's participation in the invasion that came just a month later.

This disruption of Poland's rail system doesn't appear to have required any such ransomware or even a penetration of a digital network. But Olejnik cautions that the simplicity of the attack shouldn't lead anyone to underestimate its effects, which may continue to play out given the difficulty of preventing the radio attack on Polish trains' unauthenticated communication systems.

“When you’re a hub of support to war-stricken Ukraine, you’re indeed a target,” says Olejnik. “Low-hanging fruits are always the best approach.”

_Additional reporting by Lily Hay Newman._

The Cheap Radio Hack That Disrupted Poland's Railway System

A ramshackle team of American scientists scrambled to decode the Nazi cipher before the time ran out. Luckily, they had a secret weapon.

“What am I supposed to see?” Krutzler asks, staring at his screen and bouncing his knee like he has a baby on it. His T-shirt reads “Defense Nuclear Weapons School.”

“You’re supposed to see a little ladder,” explains Koeth. “Like DNA strands.”

A few minutes go by before the transmission begins again. This time, it sounds a bit different. Koeth gives the thumbs up. Holly Wilson, a student of Koeth’s who graduated with a bachelor’s in physics in 2023, gets enlisted to transcribe the code into a yellow-lined legal pad. She’s wearing a faded Fleetwood Mac T-shirt and has a massive tattoo of an octopus wrapping her arm. Wilson writes down OKTOBER 7 and DBK WSE before the signal fades.

“That’s it, that’s it!” shouts Koeth. He consults the page from the German Army Staff Machine Key Number 28 book, provided by MRHS in a link on its website. He’ll need to obtain the key setting for the Enigma machine, the first step in decoding the message. The team has been at it for almost an hour.

At last, Koeth opens the wood cover of the Enigma. Although it’s possible to purchase one for between $300,000 to $500,000, Koeth received his as a loan from a collector in California, a WWII buff who has an exact replica of Little Boy, the atomic bomb dropped on Hiroshima, in his backyard. (Ensuing calls from concerned neighbors.)

Koeth’s own workplace might be cause for similar concern. A faculty member at UMD since 2009, his second-floor office holds an impressive collection of radiological antiquities such as Fiestaware, Vaseline glass, and, under lock and key, some Lone Ranger Atomic Bomb Rings, cereal prizes from the 1950s that contained a small amount of polonium 210.

Koeth removes two rotors from the machine, turns one to 6 and the other to 12, and plops them back inside.

“We gotta do the plugboard next,” Koeth announces before closing the lid. He begins to plug and unplug a series of tubes in a way that recalls Ernestine, Lily Tomlin’s immortal phone operator.

“No wonder the Germans lost the war,” says Larry Westrick, an electrical engineer from Opelika, Alabama. “It takes too long to communicate.”

Luckily, tenacity is part of Koeth’s job description. When he was 10, Koeth laid out plans to build a nuclear reactor in his parents’ basement in Piscataway, New Jersey.

Next, entering the code in cyphertext, Koeth pushes some of Enigma’s buttons, which in turn moves the rotors like the inner workings of a clock; a lampboard lights up a corresponding letter in plaintext. “It’s a guessing game,” he says, turning quiet. “Just think,” he says after a while, “they had to do this every day.”

Krutzler, Westrick, and a few newcomers gather around Koeth and his machine. There are 100 letters in the message and so far, none of them seem to make any sense.

“Something is wrong,” they say in unison. A joke goes around that the secret message is “Drink more Ovaltine.”

Koeth refers to a set of instructions. “Basically, you key in the first set of letters, and they should match the second set of letters. Which they don’t.”

The Low-Stakes Race to Crack an Encrypted German U-Boat Message

The US Secret Service’s relationship with the Oath Keepers gets revealed, Tornado Cash cofounders get indicted, and a UK court says a teen is behind a Lapsus$ hacking spree.

“The government needs to stop these companies from packaging and selling our personal information,” US senator Ron Wyden of Oregon told 404 Media in a statement, “and the senior executives that put profit over national security and Americans' safety should be punished accordingly.”

A new report by the Citizens for Responsibility and Ethics in Washington (CREW), a nonprofit government watchdog, found that US Secret Service agents were in close contact with the leader of the far-right militant group the Oath Keepers during the final months of the Trump administration. Emails published in the report suggest a cordial relationship between agents and Stewart Rhodes, the leader of the group.

In one email, an agent wrote that they had just spoken to Rhodes about an upcoming visit by former president Donald Trump to Fayetteville, North Carolina. The agent described himself as “the unofficial liaison to the Oath Keepers (inching towards official).” The agent also said that Rhodes “had specific questions and wanted to liaison \[sic\] with our personnel,” and shared Rhodes’ cell phone number.

In May, Rhodes was found guilty of seditious conspiracy over his role in the insurrection at the Capitol on January 6. He was sentenced to 18 years in prison and 36 months of supervised release.

In an indictment unsealed on Wednesday, August 23, the US Department of Justice alleges that the developers behind Tornado Cash, a cryptocurrency mixer, laundered more than $1 billion dollars that included hundreds of millions for a North Korean hacking group. Roman Semenov and Roman Storm were charged with conspiracy to commit money laundering and sanctions violations, as well as conspiracy to run an unlicensed money-transmitting business. Storm, who lives in Washington state, was arrested on Wednesday, while Semenov, a Russian national, has not yet been taken into custody.

Tornado Cash is a privacy service that obfuscates the trail of ownership for cryptocurrency. According to the indictment, the service violated US sanctions, and its operators knowingly helped “hackers and fraudsters conceal the fruits of their crimes.”

In a statement, Storm’s lawyer, Brian Klein, characterized the charges as dangerous and unprecedented. “We are incredibly disappointed that the prosecutors chose to charge Mr. Storm because he helped develop software, and they did so based on a novel legal theory with dangerous implications for all software developers,” he said. Klein said Storm has been released on bail.

Also on Wednesday, a London court found a key member of the cybercrime group Lapsus$ responsible for several high-profile hacks targeting companies like Uber, Nvidia, and Rockstar Games. Arion Kurtaj, who is now 18, faced 12 charges, including three counts of blackmail, two counts of fraud, and six charges under the UK’s Computer Misuse Act.

From 2021 to 2022, Kurtaj, along with other members of Lapsus$, most of whom are believed to be teenagers, carried out a series of attacks focused on extorting major companies and government agencies around the world, the jury found. The Uber hack, for instance, reportedly cost the company $3 million in damages. At the time, Uber said that the hacker who took responsibility posted pornographic material to an internal information page, alongside the message, “Fuck you wankers.”

The hacking spree prompted a major review earlier this month by US authorities who warned of the rising threat of juvenile hackers.

This Tool Lets Hackers Dox Almost Anyone in the US

The first booking photo of a US president stands out among a sea of photoshops and AI-generated images online.

For months, Etsy has become littered with a new genre of T-shirt: the Donald Trump mug shot. And they’re available in two main styles: Guity AF and Not Guilty. The shirts are adorned with photos of the former US president appearing as if he’d just been booked, but until very recently, they’ve been fakes—most of them unconvincing ones. Etsy sellers have been uploading them to the platform since at least March, as Trump has been indicted for numerous alleged crimes. Even Trump’s own campaign released a fake mug shot T-shirt to raise money.

But yesterday, the 2024 Republican presidential candidate was finally subjected to the criminal tradition of a mug shot in Georgia, where he has been indicted on charges relating to attempts to overturn 2020 election results in the state. It’s the fourth indictment against Trump, who now faces 91 felony charges in four jurisdictions. Trump maintains that he committed “no crime.”

In an era where manipulated images have captured our attention, Trump’s real mug shot—a simple, poorly lit photo—has achieved historic hype. It’s not that the image alone is notable—Trump is among the most recognizable faces in the world, and he chose to pose for the shot with his eyebrows knitted in his signature, serious look.

Still, it’s the first mug shot of a US president. (Justice officials in the former president’s three other criminal cases opted to skip that part of the process.) And that image, as plain as it is, may become one of the most important photos Trump has ever taken.

“The AI-generated ones, no matter how good they are, will eventually be seen as AI-generated. Fakes will be known as fakes,” says Jonathan Finn, a professor of communication studies at Wilfrid Laurier University in Ontario, who wrote the book _Capturing the Criminal Image: From Mug Shot to Surveillance Society_. But the real mug shot “will last forever. It will have all the history and associations tied to it.”

After Trump’s mug shot was released last night, it flooded the internet, supplanting the fakes that spread before the real thing was released. It appeared on Instagram stories, as memes, and on Trump’s own social network, Truth Social. After surrendering to Georgia authorities, Trump even made his first post on X, formerly Twitter, since his account was reinstated by Elon Musk late last year. “Election interference, never surrender,” a post featuring the picture reads.

Mug shots serve a practical purpose: to identify the person accused of a crime, and document their physical status at the time of an arrest. But media coverage of crimes that included mug shots have contributed to harmful stereotypes of people of color, who are arrested at disproportionate rates. Their publication can also make a person appear guilty of the accusations against them before they’ve had a fair trial.

But Trump finds himself in a different position, where viewers of the mug shot will likely be split: Those who support Trump may see a man wrongfully accused while those who presume him guilty may see it as validation of their beliefs.

Trump's mug shot has already moved beyond its intended purpose of tying him to alleged crimes in Georgia. The different political alignments shared on social media with the mug shot, and even satirical uses, all advance the image out of its initial context. This is a common phenomenon of posts online: As images and posts move to large audiences, they can experience what is called context collapse. That’s when intent and common understanding around the source of a post disappears as it moves widely to other groups. With people giving the mug shot meme treatment or plastering it on partisan T-shirts, that’s already happening.

“I think it’s a certainty there will be context collapse around any prominent image that can be interpreted or misinterpreted by different communities, both wilfully and accidentally,” says Sam Gregory, executive director of Witness, a nonprofit organization focused on using images and videos for protecting human rights. And with numerous versions of a Trump mug shot circulating online, people may have different memories and associations of the historical event. “We’ll remember the one that we saw in a context that made it memorable to us,” Gregory says.

By this morning, a search for Trump mug shots on Etsy featured many new products sporting the real thing. Trump’s campaign is slapping the photo on mugs, T-shirts, and koozies. Fakes will remain, and some people will be duped. But the real Trump mug shot will be the one for the history books.

Donald Trump's Mug Shot Matters in a World of Fakes

Social norms—not laws—are the underlying fabric of democracy. The Georgia indictment against Donald Trump is the last tool remaining to repair that which he’s torn apart.

Donald Trump was arrested in Georgia tonight for his role in what prosecutors christened “a wide-ranging criminal enterprise” aimed at overturning the results of the 2020 election. Trump and 18 others—among them, his former lawyer, Rudolph Giuliani, and Mark Meadows, his former chief of staff—have been formally accused of 41 state-law felonies. The case is brought by Fani Willis, the district attorney of Fulton County, Georgia. Willis is not the first local prosecutor to charge a United States president with a felony, but she is the first to accuse one of trying to steal an election.

Among charges such as filing false documents and conspiracy to commit forgery, Trump is personally accused of trying to browbeat and suborn felony acts from high-ranking Georgia officials, including the chief elections supervisor, secretary of state Brad Raffensperger. Officials were pressed by Trump and other “co-conspirators” to take action to “decertify the election” and “unlawfully appoint presidential electors,” prosecutors claim. Together, the charges opened the door for Willis to pile on additional counts of racketeering. Filed under the state’s Racketeer Influenced and Corrupt Organizations Act, the charge would ask jurors to consider whether Trump and other defendants were involved in a single criminal undertaking. A conviction under RICO does not require that the defendants all know one another or be involved at the same time, so long as they’re all working toward a single corrupt goal.

RICO, which can carry up to a 20-year prison sentence, is a powerful and even dangerous legal weapon. Out of dozens of possible crimes, a prosecutor may have to prove only two to gain a conviction. The state is fairly ambiguous about what constitutes an “enterprise.” Jurors, meanwhile, may be shown a veritable tower of evidence and instructed, usually in some narrative fashion, to see a “pattern” in the defendants’ acts; something the human brain is naturally wired to do, even at a subconscious level. For Trump and his team, allowing the case to progress to the point where a jury is actually deliberating RICO is a doomsday scenario.

In addition to the Georgia prosecution, the cases against Trump include one in Manhattan over “hush money” paid to a porn star; a case filed in Florida federal court over his retention of classified documents; and a federal case in Washington, DC, for his role in the January 6 insurrectionist riot at the US Capitol and efforts to overturn the 2020 election. In total, Trump is facing 91 felony charges. He has pleaded not guilty to each one so far.

The indictment is the culmination of a political career that Trump built by ignoring checks and balances, mocking the law and the courts, and cheering on supporters who use violence in his name, including groups rooted in white nationalism and misogyny, prone to spontaneous and premeditated violence. More than 1,100 of his most committed supporters have been charged in the past 31 months with trying to physically stop Congress from certifying the results of the 2020 election. More than 80 of them have pleaded guilty to beating police officers who had ordered them to disperse. More than 140 officers were reportedly injured, and four of those would die by suicide within 200 days of the event.

These are not Trump's only casualties. Legal experts have long warned that Trump's personal brand of politics—acrimonious, wielding tools of harassment—while deceptively trivial in the face of actual death, millions in damages, and election interference—is corrosive to the very norms and conventions upon which the electoral process has long relied for stability. Prosecuting Trump may help distinguish lawful challenges in future elections from outright criminal acts. But even alone, his arrest has already made clear what norm-breaking behaviors the public will not condone—not now or in the future, regardless of the courts' own views.

In a 2018 book, Harvard University duo Steven Levitsky and Daniel Ziblatt put forward two criteria for the foundation of a healthy democracy: “social norms,” or unwritten codes of conduct upon which the people generally agree. The Trump administration, by the end of its first year, had managed to violate both with a quotidian efficiency. Levitsky and Ziblatt’s norms included “mutual tolerance” and “institutional forbearance.” The latter describes the need for politicians to show restraint in the exercise of their authority; not to gain the upper hand and immediately use that power to obliterate one’s rivals. “Think of democracy as a game we want to keep playing indefinitely,” they write.

Nothing in this century has done more to stamp out the mutual toleration of Americans than the presidency of Donald Trump. His strategy of painting political rivals as illegitimate and un-American has—for the better part of a decade—chipped away at social and democratic norms that titans of jurisprudence have—for more than a century—called indispensable to a functioning democracy. By the time President Joe Biden took office, the _Washington Post_ had cataloged a decidedly pathological 30,000 false or misleading claims uttered by his predecessor. The Trump administration's ever-broadening palette of ethics violations caused Americans to realize, perhaps for the first time on a national scale, that truly there are few if any laws against some of the most basic forms of corruption; that, instead, conventions and norms—an honor system, essentially—is all that stand between presidents and the gross abuse of their power.

Americans typically point to the US Constitution as the pinnacle of their legal system. Many modern legal theorists, and even the nation’s own founders, painted the concept of state authority in a different light. The Genevan philosopher Rousseau considered _la volonté générale_, or the “general will” of the people, the only legitimate source of state power. American revolutionaries believed that only laws written with the “consent of the governed” could be considered legitimate. Thomas Jefferson once said the only “fountain of power” is the people, and that only “from them” is power derived. Regarding politicians who believe “supreme power” resides in constitutions, early US Supreme Court justice James Wilson suggested they had perhaps neglected to consider, “with sufficient accuracy, our political system.”

Consequently, democratic institutions are effectively incapable of restraining elected autocrats by their own volition. Without robust norms, traditional checks and balances often prove useless. “The tragic paradox of the electoral route to authoritarianism,” write Levitsky and Ziblatt, “is that democracy's assassins use the very institutions of democracy—gradually, subtly, and even legally—to kill it.” The Georgia case yanks Trump and his associates out of the squishy realm of “norms violations” and drops them into the cold, hard box of criminality. The best argument for prosecuting Trump under RICO is that it seemingly leaves jurors room to consider both.

The prosecutions of Trump will do nothing to cement America’s deep partisan divide, of course. Legal scholars reasonably believe it will only further inflame hostilities and erode trust in US institutions. Republicans have meanwhile launched an aggressive PR campaign based on the notion of “letting voters decide.” But relying on the vote, rather than jurors who are obligated to consider evidence and draw inferences from facts alone, could itself create a new norm anathema to democratic values. Prosecution was not the first choice. But every other lever that might’ve been pulled to stop and counteract the damage wrought by Trump was left in its place; particularly by Republicans, who’ve never actually been deprived of the means or opportunity to hold the de facto leader of their party accountable. Relying on the very system that Trump previously poured tens of millions of dollars into destroying feels otherwise, at best, like a nation fulfilling a death wish.

For American democracy to thrive, or retain any semblance of the legitimacy it has left, the prosecutorial systems, judges, and jurors in New York, Georgia, Florida, and Washington must grind forward. The law may not always prevent people from profiting off the wrongs they commit. But it cannot be denied outright the chance to decide whether they're stripped of their ill-gotten gains.

Laws are ultimately made “real” by the people against whom they’re imposed, including state officials, who, unlike private citizens, cannot scrape by merely obeying the law. Were judges, legislators, and even presidents to consider only themselves, ignoring the actions of their supervisors, subordinates, and peers, the validity of the legal system—and eventually the system itself—would fall apart. The English legal theorist H. L. A. Hart once wrote that among the "necessary and sufficient” criteria for the existence of a legal system is the requirement that public officials consciously adopt common standards of behavior and “appraise critically their own, and each other’s deviations as lapses.”

For some observers, the concept of "norms violations" during Trump's presidency became erroneously interlinked with the perceived failures of federal oversight officials, mostly by people unaware they were a phantom bulwark all along. A lack of coherence in the mainstays of democracy during Trump’s initial years left too many too focused on the absence of criminal charges, even though equally essential but far less defensible democratic norms were being whittled into dust. Where criminals have laws and courts to contend with, and are beyond the public’s own power to prosecute, social norms are injusticiable—outside the realm of the law, defined by people, their values, and beliefs.

And it’s no secret. The only fleshed-out directive revealed thus far to be implemented by Trump’s hypothetical follow-up presidency aims to see more than 50,000 bureaucrats and civil servants fired in an effort to insulate Trump from legal scrutiny and shield him from potential prosecution down the line. Groups of lobbyists have, according to Axios’ Jonathan Swan, already compiled their “extensive” lists of individuals believed loyal to the president and who fill those ranks instead. This plan is notably the opposite of the restraint on which Levitsky and Ziblatt place so much significance in the upkeep of a healthy and functioning democracy.

Source

Wired