Experts are finding thousands of examples of AI-created content every week that could allow terrorist groups and other violent extremists to bypass automated detection systems.

Extremist groups have begun to experiment with artificial intelligence, and in particular generative AI, in order to create a flood of new propaganda. Experts now fear the growing use of generative AI tools by these groups will overturn the work Big Tech has done in recent years to keep their content off the internet.

“Our biggest concern is that if terrorists start using gen AI to manipulate imagery at scale, this could well destroy hash-sharing as a solution,” Adam Hadley, the executive director of Tech Against Terrorism, tells WIRED. “This is a massive risk.”

For years, Big Tech platforms have worked hard to create databases of known violent extremist content, known as hashing databases, which are shared across platforms to quickly and automatically remove such content from the internet. But according to Hadley, his colleagues are now picking up around 5,000 examples of AI-generated content each week. This includes images shared in recent weeks by groups linked to Hezbollah and Hamas that appear designed to influence the narrative around the Israel-Hamas war.

“Give it six months or so, the possibility that \[they\] are manipulating imagery to break hashing is really concerning,” Hadley says. “The tech sector has done so well to build automated technology, terrorists could well start using gen AI to evade what's already been done.”

Other examples that researchers at Tech Against Terrorism have uncovered in recent months have included a neo-Nazi messaging channel sharing AI-generated imagery created using racist and antisemitic prompts pasted into an app available on the Google Play store; far-right figures producing a “guide to memetic warfare” advising others on how to use AI-generated image tools to create extremist memes; the Islamic State publishing a tech support guide on how to securely use generative AI tools; a pro-IS user of an archiving service claiming to have used an AI-based automatic speech recognition (ASR) system to transcribe Arabic language IS propaganda; and a pro-al-Qaeda outlet publishing several posters with images highly likely to have been created using a generative AI platform.

Beyond detailing the threat posed by generative AI tools that can tweak images, Tech Against Terrorism has published a new report citing other ways in which gen AI tools can be used to help extremist groups. These include the use of autotranslation tools that can quickly and easily convert propaganda into multiple languages, or the ability to create personalized messages at scale to facilitate recruitment efforts online. But Hadley believes that AI also provides an opportunity to get ahead of extremist groups and use the technology to preempt what they will use it for.

“We're going to partner with Microsoft to figure out if there are ways using our archive of material to create a sort of gen AI detection system in order to counter the emerging threat that gen AI will be used for terrorist content at scale,” Hadley says. “We're confident that gen AI can be used to defend against hostile uses of gen AI.”

The partnership was announced today, on the eve of the Christchurch Call Leaders’ Summit, a movement designed to eradicate terrorism and extremist content from the internet, to be held in Paris.

“The use of digital platforms to spread violent extremist content is an urgent issue with real-world consequences,” Brad Smith, vice chair and president at Microsoft said in a statement. “By combining Tech Against Terrorism’s capabilities with AI, we hope to help create a safer world both online and off.”

While companies like Microsoft, Google, and Facebook all have their own AI research divisions and are likely already deploying their own resources to combat this issue, the new initiative will ultimately aid those companies that can’t combat these efforts on their own.

“This will be particularly important for smaller platforms that don't have their own AI research centers,” Hadley says. “Even now, with the hashing databases, smaller platforms can just become overwhelmed by this content.”

The threat of AI generative content is not limited to extremist groups. Last month, the Internet Watch Foundation, a UK-based nonprofit that works to eradicate child exploitation content from the internet, published a report that detailed the growing presence of child sexual abuse material (CSAM) created by AI tools on the dark web.

The researchers found over 20,000 AI-generated images posted to one dark web CSAM forum over the course of just one month, with 11,108 of these images judged most likely to be criminal by the IWF researchers. As the IWF researchers wrote in their report, “These AI images can be so convincing that they are indistinguishable from real images.”

Here’s How Violent Extremists Are Exploiting Generative AI Tools

Omegle connected strangers to one another and had a long-standing problem of pairing minors with sexual predators. A legal settlement took it down.

Omegle, the video and text chat site that paired strangers together to talk, ultimately shut down as part of a legal mediation with a female user who sued the company, claiming its defective and negligent design enabled her to be sexually abused through the site.

Omegle’s chatting service was shut down Wednesday, just a week after it settled a court case with a plaintiff identified as A.M. Her lawsuit, filed in 2021, alleged that she met a man in his thirties on Omegle who forced her to take naked photos and videos over a three-year period. She was just 11 when it began in 2014.

“The permanent shutdown of Omegle was a term negotiated between Omegle and our client in exchange for Omegle getting to avoid the impending jury trial verdict,” Carrie Goldberg, an attorney who represented A.M., tells WIRED. Attorneys for Omegle did not respond to a request for comment on the settlement. Emails to Omegle were not returned.

Omegle, founded in 2009, regained popularity during 2020 as Covid-19 lockdowns kept people at home. That popularity was, at least in part, driven by it becoming a place where lonely people could chat and also a place for sexual exploration. But its very design was different from other social apps: It instantaneously paired strangers on camera.

“Virtually every tool can be used for good or for evil, and that is especially true of communication tools, due to their innate flexibility,” Leif K-Brooks, Omegle’s founder, wrote in a note announcing the site’s end. “The telephone can be used to wish your grandmother ‘happy birthday’, but it can also be used to call in a bomb threat. There can be no honest accounting of Omegle without acknowledging that some people misused it, including to commit unspeakably heinous crimes.” K-Brooks’ note did not mention the settlement in his statement, but blamed the closure of Omegle on unspecified “attacks” against communication services.

There’s a flaw in K-Brooks’ argument: The telephone doesn’t connect children and teens directly to sexual predators with the click of a button. Omegle’s model allowed sexual predators to sign on and click through a roulette of people, continuously jumping from one to another until they were face-to-face with who they were looking for.

Omegle has a long, problematic history of sexual abuse issues. In August, a man was sentenced to 16 years in prison after admitting to chatting with approximately 1,000 minors on Omegle and recording many of them undressing. The recent settlement with A.M. stems from a $22 million lawsuit which claims the man who abused her had saved thousands of sexually exploitative images of children, including some of A.M. In 2022, a CBC reporter spent time on Omegle and found that the majority of the people she matched to chat with appeared to be men who were either naked or off-camera.

In 2022, there were 608,601 reports of child exploitation on Omegle to the nonprofit National Center for Missing and Exploited Children’s CyberTipline. Of all the sites the center tracked, only Facebook, Google, Instagram, and WhatsApp ranked higher.

In the US, social platforms are often protected by Section 230, a broad act that shields them from liability for the content their users post. But the judge in A.M.’s case found last July that Omegle’s design was at fault and it was not protected by Section 230: It could have worked to prevent matches between minors and adults before sexual content was even sent, the judge said.

K-Brooks wrote that he took a “good Samaritan” approach “to implement reasonable measures to fight crime and other misuse.” That included “basic safety and anonymity,” as well as “a great deal of moderation behind the scenes” that used both AI and human moderators. “Omegle punched above its weight in content moderation, and I’m proud of what we accomplished,” he wrote.

Omegle ultimately was brought down by a lawsuit from a sexual abuse survivor. But abusive content will still circulate around the web, and it shows how far away a long-term solution is. “We’ve got to ask ourselves some pretty good questions about how we even permitted this for so long,”  said Signy Arnason, associate executive director of the Canadian Centre for Child Protection, a charity focused on reducing sexual abuse and exploitation of children. “If we don’t address things at the regularity level, we’re just waiting for another site to backfill what Omegle.”

Omegle Was Forced to Shut Down by a Lawsuit From a Sexual Abuse Survivor

Meta now offers users an ad-free option, but it’s only available in Europe for those who can afford the €10-a-month subscription.

Meta just launched its first ad-free option for Facebook and Instagram. The update is in response to the European Union’s General Data Protection Regulation, passed in 2018. Subscriptions for the ad-free experience are only available to users located in the EU as well as Iceland, Liechtenstein, Norway, and Switzerland.

In these locations, anyone 18 and older on Facebook or Instagram now gets to decide whether they want to use the social media platforms for free or pay €10 every month for ad-free access. Meta provides the ad-free option without charge to users who are younger than 18.

What happens if you sign up? “We don't use any data for ad purposes at all. That turns off first-party data as well as stopping any third parties, like Nike, sending us information about you,” says Alex Dziedzan, a policy communication spokesperson at Meta. While it won’t be used for targeted advertising, Meta confirms that first-party data about you will still be used for functions not related to advertising.

Users who choose the free option allow Meta to perform targeted advertising by tracking their information. The company previously argued that consent was not required to target adults in the EU with hyper-specific advertising—before changing course and rolling out this new subscription tier for Facebook and Instagram. Earlier in 2023, Meta received a billion dollar fine for transferring data on European users to the United States.

When will this option roll out in the US? It’s unlikely Meta will ever offer an ad-free experience for users in the US, unless American lawmakers pass more aggressive legislation to regulate data privacy.

How to Get Ad-Free Facebook

If it’s an option that’s available in your region, you can expect to see a pop-up the next time you log in to Facebook or Instagram with a sign-up option for the ad-free social media. “This is part of our process for getting consent under the GDPR,” says Dziedzan. “It's a requirement for us to make sure that everyone sees the choice that they can make.” He emphasizes that Meta is not hiding this new option from users.

A subscription to ad-free Facebook or Instagram costs €10 per month if you sign up on your desktop. Anyone who signs up through the smartphone app pays €3 more a month for the subscription. No matter where your subscription starts, the ad-free plan includes both in-app and web browsing.

Want to sign up later? You can find the option in the Settings of your Facebook or Instagram account. Return to the same place if you ever want to get rid of your Meta subscription.

Your subscription can cover multiple profiles in your accounts center, for now. Meta plans to increase the price for users with more than one Facebook or Instagram in March of next year. After the company’s introductory pricing ends, each additional account will cost €6 a month if you sign up in your browser or €8 if you sign up in-app.

“If you have, let's say, a Facebook account and an Instagram account you would have to pay for both,” he says. “The reason for that is they’re two separate services.” So a person who signs up in a browser for ad-free access in their Facebook and Instagram accounts can soon expect to pay around €192 a year.

Why Is This Change Controversial?

It’s common for services, like Netflix, to offer ad-free versions of their products at a higher price. So why are privacy experts critical of Meta’s subscription plan?

“When you’re buying Netflix, you’re buying the convenience of not seeing ads,” says Thorin Klosowski, a security and privacy activist at the Electronic Frontier Foundation. “Buying into not being tracked is more about a pay-for-privacy scheme.” If Meta tracks the browsing habits of every adult user, except those who cough up €10 or more a month, then aspects of online privacy are out of reach for people without disposable income.

Dziedzan disagrees with the characterization of Meta’s ad-free subscription as a pay-for-privacy plan. He points out the privacy options that are available to all Facebook and Instagram users, like the ability to turn off aspects of third-party advertising. “The GDPR still applies to everybody who chooses to use the free version of our service, as do all the other privacy laws,” says Dziedzan.

Privacy advocates continue to push back against Meta’s advertising. “We already disagree with behavioral advertising to begin with,” says Klosowski. “Paying to get out of that just adds a second layer of confusion for users and grossness from the company.”

How to Get Facebook Without Ads—if It’s Available for You

Russia's most notorious military hackers successfully sabotaged Ukraine's power grid for the third time last year. And in this case, the blackout coincided with a physical attack.

The notorious unit of Russia's GRU military intelligence agency known as Sandworm remains the only team of hackers to have ever triggered blackouts with their cyberattacks, turning off the lights for hundreds of thousands of Ukrainian civilians not once, but twice within the past decade. Now it appears that in the midst of Russia's full-scale war in Ukraine, the group has achieved another dubious distinction in the history of cyberwar: It targeted civilians with a blackout attack at the same time missile strikes hit their city, an unprecedented and brutal combination of digital and physical warfare.

Cybersecurity firm Mandiant today revealed that Sandworm, a cybersecurity industry name for Unit 74455 of Russia's GRU spy agency, carried out a third successful power grid attack targeting a Ukrainian electric utility in October of last year, causing a blackout for an unknown number of Ukrainian civilians. In this case, unlike any previous hacker-induced blackouts, Mandiant says the cyberattack coincided with the start of a series of missile strikes targeting Ukrainian critical infrastructure across the country, which included victims in the same city as the utility where Sandworm triggered its power outage. Two days after the blackout, the hackers also used a piece of data-destroying "wiper" malware to erase the contents of computers across the utility's network, perhaps in an attempt to destroy evidence that could be used to analyze their intrusion.

Mandiant, which has worked closely with the Ukrainian government on digital defense and investigations of network breaches since the start of the Russian invasion in February of 2022, declined to name the targeted electric utility or the city where it was located. Nor would it offer information like the length of the resulting power loss or the number of civilians affected.

Mandiant does note in its report on the incident that as early as two weeks before the blackout, Sandworm's hackers appear to have already possessed all the access and capabilities necessary to hijack the industrial control system software that oversees the flow of power at the utility's electrical substations. Yet it appears to have waited to carry out the cyberattack until the day of Russia's missile strikes. While that timing may be coincidental, it more likely suggests coordinated cyber and physical attacks, perhaps designed to sow chaos ahead of those air strikes, complicate any defense against them, or add to their psychological effect on civilians.

"The cyber incident exacerbates the impact of the physical attack," says John Hultquist, Mandiant's head of threat intelligence, who has tracked Sandworm for nearly a decade and named the group in 2014. "Without seeing their actual orders, it's really hard on our side to make a determination of whether or not that was on purpose. I will say that this was carried out by a military actor and coincided with another military attack. If it was a coincidence, it was a terribly interesting coincidence."

Nimbler, Stealthier Cybersaboteurs

The Ukrainian government's cybersecurity agency, SSSCIP, declined to fully confirm Mandiant's findings in response to a request from WIRED, but it didn't dispute them. SSSCIP's deputy chair, Viktor Zhora, wrote in a statement that the agency responded to the breach last year, working with the victim to "minimize and localize the impact." In an investigation over the two days following the near-simultaneous blackout and missile strikes, he says, the agency confirmed that the hackers had found a "bridge" from the utility's IT network to its industrial control systems and planted malware there capable of manipulating the grid.

Mandiant's more detailed breakdown of the intrusion shows how the GRU's grid hacking has evolved over time to become far more stealthy and nimble. In this latest blackout attack, the group used a "living off the land" approach that has become more common among state-sponsored hackers seeking to avoid detection. Instead of deploying their own custom malware, they exploited the legitimate tools already present on the network to spread from machine to machine before finally running an automated script that used their access to the facility's industrial control system software, known as MicroSCADA, to cause the blackout.

In Sandworm's 2017 blackout that hit a transmission station north of the capital of Kyiv, by contrast, the hackers used a custom-built piece of malware known as Crash Override or Industroyer, capable of automatically sending commands over several protocols to open circuit-breakers. In another Sandworm power grid attack in 2022, which the Ukrainian government has described as a failed attempt to trigger a blackout, the group used a newer version of that malware known as Industroyer2.

Sandworm Hackers Caused Another Blackout in Ukraine—During a Missile Strike

Face recognition technology has been controversial for years. Cops in the UK are drastically increasing the amount they use it.

A Beyoncé gig, the coronation of King Charles, and the British Formula One Grand Prix all have one thing in common: Thousands of people at the events, which all took place earlier this year, had their faces scanned by police-operated face recognition tech.

Backed by the Conservative government, police forces across England and Wales are being told to rapidly expand their use of the highly controversial technology, which globally has led to false arrests, misidentifications, and lives derailed. Police have been told to double their use of face searches against databases by early next year—45 million passport photos could be opened up to searches—and police are increasingly working with stores to try to identify shoplifters. Simultaneously, more regional police forces are testing real-time systems in public places.

The rapid expansion of face recognition comes at a time when trust in policing levels are at record lows, following a series of high-profile scandals. Civil liberties groups, experts, and some lawmakers have called for bans on the use of face recognition technology, particularly in public places, saying it infringes on people’s privacy and human rights, and isn’t a “proportionate” way to find people suspected of committing crimes.

“In the democratic world, we are an outlier at the moment,” says Madeleine Stone, a senior advocacy officer with Big Brother Watch, a privacy-focused group that has called for a ban and “immediate stop” on live face recognition, a proposal backed by 65 UK lawmakers. The EU, which the UK left in 2016, may ban the real-time use of face recognition systems, and one of its highest courts has called the technology “highly intrusive.” Various US states have banned police from using the technology.

Cops in England and Wales can hunt for potential criminals using two main kinds of face recognition. First, there are live face recognition systems (LFR): These usually include cameras mounted on police vans that scan people’s faces as they walk by and check them against a “watchlist” of wanted people. The LFR technology is deployed for some big events and announced in advance by the police. Second, there’s retrospective face recognition (RFR), where images from CCTV, smartphones, and doorbell cameras can be fed into a system that tries to identify the person based on millions of existing photos. Police use of both systems is increasing.

Two police forces in England and Wales—London’s Metropolitan Police and South Wales Police—have embraced LFR, using the technology for multiple years. (Police in Scotland, where policing is overseen locally, don’t use live systems but are reportedly increasing their use of RFR). So far this year, the Met and South Wales Police have used LFR on 22 separate occasions, according to statistics published on their websites.

Across 13 deployments, an estimated 247,764 people have passed the Met’s cameras this year, including at the King’s coronation and a soccer match between Arsenal and Tottenham. In 2023 so far, the Met’s system has pinged 18 times when it has matched a person with someone on the predetermined watchlist. Twelve of those people have been arrested. South Wales Police has used LFR nine times this year, scanning an estimated 705,290 faces and arresting two people.

Researchers and academics have long shown face recognition technologies to be biased or less accurate for people of color, particularly Black people. In all of the LFR uses by the Met and South Wales police forces this year, their figures show, there have been no false alerts or misidentifications. In short, every time the system made a match, it was correct, according to the departments’ data. The data published by the police forces show the LFR systems they are using are set to an accuracy threshold of either 0.6 or 0.64. A study conducted by the National Physical Laboratory, a UK public sector research organization, recommended the threshold setting of 0.64 as a way to reduce biased and incorrect matches.

Pete Fussey, a professor at the University of Essex who previously audited the Met’s face recognition, says that the report shows the algorithms may still be discriminatory and biased, but setting the thresholds neutralizes the system entirely. “If you desensitize the system, then you'll get fewer matches and fewer of those will be wrong,” Fussey says. Big Brother Watch’s Stone says it “brings into question the necessity and proportionality of the whole endeavor if you’re having dozens of police officers standing around the street looking at iPads just to make one arrest.” Stone argues “it’s not a good use of time.”

A spokesperson for the Home Office, the government department responsible for policing in England and Wales, says it is “committed” to giving police the technology they need to help solve crimes. “Technology such as facial recognition helps the police quickly and accurately identify those wanted for serious crimes, as well as missing or vulnerable people,” the spokesperson says, claiming it “frees up police time and resources.” They point to a blog post about police use of face recognition technologies.

“Live facial recognition isn't just deployed on its own. It's in support of wider policing operations,” says detective chief inspector Jamie Townsend, who is the operational lead for the Met's face recognition. A policing operation may make 30 arrests in an area with face recognition contributing two or three of them, he says.

Townsend says that the biometric data of people isn’t stored when they are scanned by LFR cameras, and he considers the system to be “precision policing” as it allows for the identification of specific individuals. The Home Office’s blog post claims LFR has led to the arrest of sex offenders and someone wanted for possessing a knife. South Wales Police did not respond to WIRED’s request for comment at the time of writing.

Two other UK police forces have tried LFR in recent months, raising concerns about how the technology will be used going forward and who is put on the watchlists of people the systems are looking for. There are more than 30 police forces that have not used LFR, although the government has said it is “very supportive” of more forces using it.

Around 380,000 people had their faces scanned by Northamptonshire police over three days at the British Grand Prix in July, according to public records requests. No arrests were made. A Freedom of Information Act request from Big Brother Watch revealed the force had placed 790 people on the watchlist for the event while only 234 were wanted for arrest. “It was largely individuals who were not wanted for any criminal reasons, which leads us to believe that these were protesters who were being put on watchlists,” Stone says. The previous year’s British Grand Prix was disrupted by protesters.

A statement from Northamptonshire Police says the watchlist “included a range of offences from organized crime to aggravated trespass, which had the potential of leading to the death or serious injury of the public, racing drivers and staff, especially if there was a repeat of the 2022 track incursion. We were not targeting those taking part in lawful, peaceful protests.”

Police forces are also being encouraged to ramp up the use of after-the-fact, retrospective face recognition. All police forces across the UK have the ability to run searches for faces against the Police National Database, which has more than 16 million photos and includes millions of images that should have been deleted years ago. In 2022, according to data from freedom of information requests, there were 85,158 face searches—up 330 percent on the previous year. Policing minister Chris Philp said in October that he wants the number of searches to double by May 2024.

Fussey, the University of Essex professor, says retrospective face recognition is often thought to be more “benign” than live face recognition, but he doesn't believe it is the case. “The issues and harms and human rights implications are the same, whether it's live or retrospective,” he says, adding there is a lot of ambiguity around how the technology is being used.

In August 2020, the UK’s Court of Appeal ruled that South Wales Police’s use of LFR was unlawful. Since then, police forces using the technology say they have changed their procedures in response to the court decision, and the Home Office spokesperson says there is a “comprehensive legal framework in the UK” that requires police to use the technology only when it is “necessary, proportionate, and fair.”

Many disagree. A wide-ranging review from the Ada Lovelace Institute, a nonprofit, says there is “legal uncertainty” about the use of LFR. Another report by University of Cambridge academics, from the Minderoo Centre for Technology and Democracy, concluded that three examined police deployments of face recognition “failed to meet the minimum ethical and legal standards.”

“It’s wholly legitimate for police to use technology to keep the public safe,” says Fussey, who recently completed a report on proposals to change the oversight of biometrics in the UK. “The question is about how lawful and necessary it is,” he says. “At the moment, we’re in a situation where the legal basis isn’t clear. There’s no external oversight of how it’s used, how it’s authorized, who’s on the watchlist.”

Police Use of Face Recognition Is Sweeping the UK

The third GOP debate is sponsored by the Republican Jewish Coalition and will be livestreamed on a platform favored by one of America’s most notorious white nationalists.

Tonight, the third GOP presidential primary debate will take place in Miami. The event is sponsored by the Republican Jewish Coalition (RJC) at a time when antisemitic incidents in the US, according to the Anti-Defamation League, have risen by nearly 400 percent since the Israel-Hamas war erupted last month.

While the Republican National Committee (RNC) has partnered with NBC to broadcast the debate on TV, the event will also be livestreamed for the third time on Rumble, the YouTube alternative that is home to what the Southern Poverty Law Center says is one of America’s most notorious white nationalists, Nick Fuentes.

For the past month, Fuentes has used the Israel-Hamas conflict to push antisemitic hate speech and Holocaust denial conspiracies on his Rumble channel, racking up hundreds of thousands of views. Fuentes has hailed Rumble for reviving his audience, which has gained thousands of followers since Hamas attacked Israel on October 7.

“I think the show is bigger than it's been in a really long time,” Fuentes told his more than 40,000 viewers last week during one of his frequent livestreams on the platform. “If you look at the viewership on Rumble, it’s crazy. I’ve been getting really good viewership on Rumble like I haven’t since I was on YouTube … The replays have been insane.”

Fuentes is a white nationalist leader of the Groyper movement. He attended the neo-Nazi Unite the Right rally in Charlottesville in 2017, has openly praised Hitler, and repeatedly denied the Holocaust. He has also had dinner with former president Donald Trump.

Fuentes’ YouTube account was terminated in 2020 as Google demonetized it, and he initially struggled to retain his audience on a number of other platforms, including DLive and his own Cozy.tv streaming service. Fuentes joined Rumble in March 2021, and he was initially critical of the platform’s failure to promote his videos. He claims he was briefly suspended from the platform in July after posting the livestream of a rally where he called for a “holy war” against non-Christians. Now, less than four months later, he claims his channel is flourishing.

Since the outbreak of the Israel-Hamas war in early October, Fuentes has used his channel on Rumble, which has 42,600 followers, to spread antisemitic conspiracies, claiming in one video that the Israeli government had created the Hamas attack as “atrocity propaganda” to advance “Jewish interests.”

Fuentes compared the Hamas attack to the Holocaust, claiming both were created to “elicit a certain emotional response \[to give the government\] the popular mandate to do whatever it is the government wants to do.”

While it portrays itself as a free speech network, Rumble does have specific policies in place against racism and antisemitism. The platform removed two of Fuentes’ videos on Tuesday evening after WIRED flagged the antisemitic comments made in them, but many others remain. Rumble declined WIRED’s request to comment on whether or not it had an antisemitism problem on its platform.

Fuentes’ is one of many accounts that researchers at Media Matters, a left-leaning media watchdog group, have identified as not only spreading antisemitic content on Rumble, but also monetizing it.

“There is a plethora of antisemitic content on the platform as well as other violent content, conspiracy theories, and bigotry,” Kayla Gogarty, research director at Media Matters, tells WIRED. “We found about 16 far-right figures and groups who have made antisemitic content and have run advertisements on the platform, including Keith Woods, Elijah Schaffer, Stew Peters, and other accounts like Vincent James Foxx.”

Fuentes’ account has not monetized his own channel, but clips of his content have been monetized on Rumble, Gogarty says.

Fuentes did not respond to WIRED’s request for comment, nor did Woods, Schaefer, Peters, and Fox.

The RNC told WIRED in an emailed statement that “hate, bigotry and violence is unfortunately prevalent on every social media platform, and the RNC condemns it entirely, but the RNC does not manage content or pages outside of our own.”

The RJC did not respond to multiple requests from WIRED about the presence of Fuentes and antisemitism on Rumble. At the announcement of the RJC’s sponsorship of the debate last month, the group’s chairman, former US senator Norm Coleman from Minnesota, told NBC: “As the horrific events of the last week have unfolded in Israel, the issue of American foreign policy has taken on an even greater role. American strength and American resolve—and our candidates’ vision for America’s role in the world—are more important than ever.”

Founded in 2013, Rumble has in recent years become a home for many right-wing extremists, conspiracy peddlers, and election deniers who have been banned from mainstream platforms like YouTube, Facebook, and Instagram, or who have had their ability to monetize their content removed.

Rumble, which went public in 2022 and has seen significant growth in users over the past 18 months, has also partnered with Trump’s struggling social media platform Truth Social to provide video services. Donald Trump Jr., the former president’s son, and his wife, Kimberly Guilfoyle, both have exclusive deals with the platform where they post video podcast series.

The GOP Presidential Debate Is Livestreaming on Rumble, Home to White Nationalist Nick Fuentes

For the first time, guerrilla animal rights group Direct Action Everywhere reveals a guide to its investigative tactics and toolkit, from spy cams to night vision and drones.

In recent years, the animal liberation group Direct Action Everywhere has carried out some of the most brazen and tech-savvy operations and investigations to ever target the animal agriculture industry. It has rescued pigs, goats, ducks, and chickens from factory farms and slaughterhouses in midnight intrusions; captured virtual reality footage with custom-built 360-degree video rigs inside massive pig barns; and used hidden cameras to record some of the meat industry's most disturbing practices, from the carbon dioxide gas chambers that are increasingly used in pig slaughterhouses to the “ventilation shutdowns” designed to cull thousands of farm animals through overheating and suffocation.

To pull off all those revelatory and often highly controversial actions, Direct Action Everywhere (which uses the abbreviation DxE) has also spent years evolving its toolkit and operational rigor—from communications security and physical stealth, to penetration tactics for getting inside factory farms and slaughterhouses. It has also long maintained a manual of its own methods for those operations. Now, for the first time, it's publicly releasing that guide.

The document is a rare glimpse into the detailed tech and tactics of a group that carries out sophisticated and often illegal acts of intrusion and espionage, turning a playbook that might otherwise be used by spies or thieves into one for grassroots activism. “To spend so much time thinking about the vulnerabilities in these facilities, how to get in, avenues of approach,” says Lewis Bernier, a longtime investigator at DxE who has led or participated in hundreds of operations inside farms and slaughterhouses around the country, “I think it's really changed the way I see security as a whole.”

A note of warning: Despite the “how-to” tone of the guide itself, do not try this at home. DxE investigators frequently face criminal charges, and DxE's critics in the agriculture industry and in law enforcement describe the group as radicals with extreme tactics. Despite the group’s nonviolent approach, the agribusiness trade group WATT Global Media wrote in 2018 that DxE “could very well be the most dangerous animal rights organization out there.” Even some other animal rights organizations have balked at their risky methods, especially given the potential for prison sentences under some US states’ severe laws protecting animal agriculture businesses.

DxE goes as far as to welcome those criminal charges, often willingly identifying themselves after an investigation's findings are released in an effort to draw more attention to their revelations and argue the justice of their cause. In fact, the group's cofounder, Wayne Hsiung, was convicted just last week on a felony charge of conspiracy to commit trespassing related to the removal of ducks and chickens from a California poultry farm. He now potentially faces years in prison.

Bernier says that DxE decided to publicly release its guide, even in the wake of Hsiung’s conviction, to help activists who are already committed to carrying out covert investigations do their work more safely and effectively. “More and more people around the world want to do this stuff, or at least are just interested in how it works,” he says. “I think this guide will offer an opportunity for people to understand what's really involved.”

Drones, Night Vision, and Spy Cams

Much of the guide is focused less on spy tricks and espionage gear than on effective activism: team building, creating a chain of command, understanding the media, logistics, planning, biosecurity to avoid contaminating farms with disease, and creating a “security culture” that avoids the gossip, bragging, prying, and infighting that can lead to operations being blown or infiltrated by law enforcement.

But other elements of the manual offer specific descriptions of surveillance tools like drones, hidden cameras, and thermal and night vision scopes. For stealthy after-hours intrusions into factory farms and other facilities, for instance, the guide describes assigning a team member as a scout, equipped with night vision and thermal imaging tools. The guide specifically names the Sionyx Aurora Sport as its recommended night vision camera for both reconnaissance and capturing images in the dark, but notes that thermal imaging tools like the Flir Scout TK offer its scouts other advantages. Thermal imaging can reveal which parts of a facility are active, the guide notes, given that those buildings will be running heating or fans, and also show from a distance which vehicles outside a building have their engines running or have recently moved, revealed in heat traces on a car or truck's brakes.

This Is the Ops Manual for the Most Tech-Savvy Animal Liberation Group in the US

The Government Surveillance Reform Act of 2023 pulls from past privacy bills to overhaul how police and the feds access Americans’ data and communications.

In 1763, the radical journalist and colonial sympathizer John Wilkes published issue no. 45 of _North Briton_, a periodical of anonymous essays known for its virulent anti-Scottish drivel—and for viciously satirizing a British prime minister until he quit his job. The fallout from the subsequent plan of the British king, George III, to see Wilkes put in irons for the crime of being too good at lambasting his own government reverberates today, particularly in the nation whose founders once held Wilkes up as an idol, plotting a revolt of their own.

Wilkes’ arrest boiled the Americans’ blood. Reportedly, the politician-cum-fugitive had invited the king’s men into his home to read the warrant for his arrest aloud. He quickly tossed it aside. At trial, Wilkes explained its most insidious feature: “It named nobody,” he said, “in violation of the laws of my country.” This so-called general warrant, which subsequent lawsuits by Wilkes would see permanently banned, vaguely described some criminal allegations, but not a single place to be searched nor suspect to be arrested was named. This ambiguity granted the king's men near blanket authority to arrest anyone they wanted, raid their homes, and ransack and destroy their possessions and heirlooms, confiscating large bundles of private letters and correspondence. When the Americans later passed an amendment to ban vague legal warrants describing neither "the place to be searched" nor "persons or things to be seized," it was Wilkes's home, historians say, that they pictured.

This morning, a group of United States lawmakers introduced bicameral legislation aimed, once again, at reining in a government accused of arbitrarily snatching up the private messages of its own citizens—not by breaking down doors and seizing handwritten notes, but by tapping into the power of internet directly to collect an endless ocean of emails, calls, and texts. The Government Surveillance Reform Act of 2023 (GSRA)—introduced in the US House by representatives Zoe Lofgren and Warren Davidson, and in the US Senate by Ron Wyden and Mike Lee—is a Frankenstein bill more than 200 pages long, combining the choicest parts of a stack of cannibalized privacy bills that rarely made it past committee. The patchwork effect helps form a comprehensive package, targeting various surveillance loopholes and tricks at all levels of government—from executive orders signed by the president, to contracts secured between obscure security firms and single-deputy police departments in rural areas.

“Americans know that it is possible to confront our country’s adversaries ferociously without throwing our constitutional rights in the trash can,” Wyden tells WIRED, adding that for too long surveillance laws have failed to keep up with the growing threats to people’s rights. The GSRA, he says, would not strip US intelligence agencies of their broad mandate to monitor threats at home or abroad, but rather restore warrant protections long recognized as core to democracy’s functioning.

The GSRA is a Christmas list for privacy hawks and a nightmare for authorities who rely on secrecy and circumventing judicial review to gather data on Americans without their knowledge or consent. A US Justice Department requirement that federal agents obtain warrants before deploying cell-site simulators would be codified into law and extended to cover state and local authorities. Police in the US would need warrants to access data stored on people’s vehicles, certain categories of which should already require one when the information is stored on a phone. The government could also no longer buy sensitive information about people that would require a judge’s consent, had they asked for it instead.

What’s more, the bill will end a grandfather clause that’s keeping alive expired portions of the USA Patriot Act that’s allowed the FBI to continue employing surveillance techniques that have technically been illegal for two years. Petitioners in federal court seeking relief due to privacy violations will also no longer be shown the door for having no more than a “reasonable basis” to believe they’ve been wrongfully searched or surveilled.

Not to be outstripped by the sheer variety of smaller pet reforms—such as yanking the security clearances of anyone caught abusing a classified database (a crime that’s commonly punished with a slap on the wrist), or ensuring that the government can’t simply store people’s data for the rest of their lives because it hasn’t been decrypted—the GSRA principally takes aim at Section 702 of the Foreign Intelligence Surveillance Act, the government’s most promiscuous surveillance program through which it captures a large but _indeterminate_ amount of messages en route to and from Americans’ phones each day.

After 9/11, the US government commenced with some of the most extensive domestic surveillance in modern history, a monument achieved on the back of the internet’s technological revolution that redefined what it meant for people to communicate. Exposed by journalists and leakers at the height of America’s recent wars in the Middle East, the extent of the surveillance, once publicly acknowledged, unleashed bad memories of corrupt intelligence agencies relentlessly bugging anyone with a phone—actors, comedians, civil rights leaders, and even one another.

The US Congress, fearful of foreign threats, enacted only piecemeal reforms in response to these revelations, which kicked off in the early aughts and crescendoed in 2013 with Edward Snowden’s polemic leaks. The government’s sporadic but incessant updating of agency rules and procedures have done little to stymie routine abuses of the 702 data—which is currently fathomless. The first thing to know about the program, and how many Americans it ensnares each year, is that the government doesn't know the number and has little interest in learning it. A key defense, in fact, of the government's lack of transparency in this area is that examining the data to determine who is and is not an American would technically commit the very violation its procedures are designed to prevent.

While the program is strictly authorized for the surveillance of foreigners on foreign soil, wiretapping internet communications is neither accurate nor precise. In 2008, Congress was forced to effectively recognize that the collateral surveillance of Americans was the inevitable byproduct of operating an intelligence program with Big Brother–like proportions. Faced with growing privacy fears at home and emerging national security threats abroad, Congress took stock of the situation and then resigned to split the baby.

Nearly 60 years ago, in the face of overwhelming evidence that police interrogations are inherently coercive, the US Supreme Court did not ban the practice in _Miranda v. Arizona_ but rather ruled that the threat to people's rights could be reasonably mitigated by cops reading “collared” suspects a brief statement of rights—a “warning” that has much the same purpose as legal disclaimers read aloud on customer care calls. Similarly, Congress chose not to put an end to the surveillance of Americans' communication despite the enormous scale of rights violations accumulating steadily each day. Instead, it ordered the creation of many byzantine rules and procedures designed to ameliorate constitutional risks to some reasonable degree—by merely lessening the odds of a federal employee laying eyes on any illicitly gained information.

“Incidental” is a surveillance term of art referring to communications of Americans not _accidentally_ intercepted by their own government, but _unavoidably_. In a report last month, a federal privacy watchdog stressed that while the word “incidental” made the collection sound small, “it should not be understood as occurring infrequently.”

The GSRA takes aim at the use of incidental data by federal law enforcement agents, who are not bound by the same rules against spying on Americans as are analysts at the Pentagon, whose purview lies strictly overseas. While it is illegal to target US persons under 702, once they have been surveilled, the communications become accessible nevertheless to the Federal Bureau of Investigation, which has its own procedures for “querying” the nebulous database—rules that can permit, for example, the reading of emails marked “attorney-client privilege” so long as the subject isn’t wanted for a crime.

An inspector general’s investigation last year found the FBI’s own legal experts at variance over “key legal principles” tied to rules governing 702's use. Findings like these have served only to repeatedly injure the FBI, nurturing a cycle of disappointment and distrust in its capacity to behave as a competent surveillant.

The GSRA could work positively to solve many problems at the FBI. Trust in the bureau among lawmakers is only likely to grow, once its unfettered access to a digital black box filled with everyone's secrets becomes subject to court review. The GSRA removes the ability entirely for the FBI to run queries on US persons without probable cause, that is, “a reasonable amount of suspicion, supported by circumstances sufficiently strong to justify a proven and cautious person's belief that certain facts are probably true.” (In contrast, the current standard is this: Be looking for evidence of a crime, don't go fishing, and be “reasonably” confident the information you're after is “likely” to be found.)

“For too long, intelligence and law enforcement agencies have had unchecked access to Americans’ personal data,” says Lofgren, the representative from California who issued a warning to colleagues on Tuesday against the “unwise” move of reauthorizing the 702 program without “carefully considering and enacting surveillance reforms.”

The GSRA is currently the only bill in Congress that could reauthorize the 702 statute that’s set to expire by the end of the year. The statute is what allows the government to apply for “certifications” issued by the secret Foreign Intelligence Surveillance Court (FISC). These certifications, which all last for one year, allow the government to compel the cooperation of communications services providers for three purposes: foreign intelligence, counterterrorism, and the tracking of nuclear proliferation—with an array of threats, from cybercrime to narco-trafficking, all couched within those categories.

Whether or not Congress reauthorizes 702 before it expires, the collection will continue unabated until at least April, when the certifications expire. Hypothetically, the government could reapply for new certifications, which the FISC could grant before April, thereby extending the program's life into 2025 without Congress lifting a finger. That is unlikely, however, says Bob Goodlatte, former chairman of the House Judiciary Committee, who says any attempt to wrest control away from Congress will be viewed as a “hostile gesture,” further imperiling Section 702's survivability.

“The FISA Court and the Director of National Intelligence have confirmed that our government conducted warrantless surveillance of millions of Americans’ private communications,” says Senator Mike Lee.

In remarks to WIRED, Lee pointed to high-level confirmations that the US government is conducting “warrantless surveillance of millions of Americans” each day. “It is imperative that Congress enact real reforms to protect our civil liberties,” he says, including “statutory penalties for privacy violations,” a precondition of his support for “reauthorizing Section 702.”

Government Surveillance Reform Act of 2023 Seeks to End Warrantless Police and FBI Spying

Israel has said it’s prepared to disrupt internet service in Gaza, signaling a new age of warfare. In the past two weeks, the Palestinian territory has already suffered three communications shutdowns.

Since Hamas’ tragic October attack on Israel that killed at least 1,400 people, the country’s retaliation in Gaza has led to more than 10,000 deaths, according to unverified claims from the Hamas-run Gazan Health Ministry, and broad destruction of the community's basic utilities and infrastructure. This includes its internet and communication systems, with dwindling connectivity largely cutting off 2.2 million Gazans from the outside world.

On October 27, Israel reportedly imposed a full internet shutdown in the area, cutting off the last remaining connectivity for about 34 hours as its troops moved into the Gaza Strip. After what’s left of Gaza’s internet access was restored—data shows it stands at around 15 percent or less of usual connectivity—the area has suffered two other, similar connectivity blackouts. The most recent lasted for about 15 hours on Sunday as Israel was carrying out an intense operation to cut off Gaza City in the north from southern Gaza

While researchers and technologists who monitor internet connectivity can’t conclusively say that Israel was behind the blackouts—or that they were imposed using technical controls rather than physical destruction of infrastructure—the fact that some connectivity could be restored so rapidly seems to indicate deliberate shutdowns over incidental destruction.

“In the last 10 days, there have been three periods of time that connectivity has gone to completely zero,” says Doug Madory, director of internet analysis at monitoring firm Kentik. He notes that from the data he is able to see, it's only possible to determine whether internet service providers in Gaza are communicating with the outside world and not the specific cause of an outage. One “aggressor in the conflict that's taking place in Gaza happens to have the ability to turn off service in the region that they're doing military operations in,” Madory says.

Throughout the Gaza Strip, there are around a dozen internet service providers and cell phone companies that get people online—although cell networks only use 2G technologies, as opposed to the faster 3G, 4G, and 5G connections available across much of Israel. These companies are heavily reliant on Israeli infrastructure to connect to the global internet, with open internet advocacy nonprofit the Internet Society classing Palestine as having “poor” connections to the wider internet. Since the start of the war, mobile and internet providers’ offices, cables, and cell towers have been destroyed. Many are now totally offline.

“Israel controls the telecommunication and internet that comes to Gaza,” says Husam Mekdad, a telecoms engineer living in southern Gaza in a message to WIRED. He says “most” of the main internet service providers are down, and the mobile operators that can still operate 2G connections have hugely congested networks.

“No company can repair or do anything right now,” Mekdad says. Many firms, he says, are waiting until the war is over to see the status of their infrastructure and evaluate it. The United Nations Office for the Coordination of Humanitarian Affairs said last week that 65 percent of households and businesses have lost access to the internet and half of networks have been damaged.

The Palestinian territories’ biggest internet provider, Paltel, has retained the most connectivity, according to internet analysts. But during the three complete blackouts, even Paltel has been knocked offline. “When Paltel is offline, then I think everybody's down,” Madory says.

Paltel alleges that during the three blackouts its services were being “disconnected” by Israel. The Ministry of Communications and Information Technology of the State of Palestine has also claimed there has been “systematic targeting” of networks and urged countries to “put pressure on the Israeli government” to restore connections. Paltel has not returned WIRED’s multiple requests for comment in recent weeks.

The Israeli Defense Forces declined to comment when asked whether they were behind the recent internet shutdowns in Gaza. Israel’s Ministry of Communications did not respond to WIRED’s request for comment. However, on October 17, ahead of the total blackouts, the Israeli communications ministry published an update on the war that appeared to detail its plans. “There is an ongoing examination and preparation for the shutting down of cellular communications and internet services to Gaza,” the update said.

In recent years, internet shutdowns have become a dystopian reality for millions of people in India, Iran, Pakistan, Iraq, and other countries. Last year there were 187 internet shutdowns in 35 countries, according to Access Now, a digital rights nonprofit. Internet shutdowns can do huge damage to a country’s economy as well as people’s ability to communicate with friends and loved ones and access medical care and other essential information. Typically, internet shutdowns are initiated by repressive governments trying to control protests, stop people organizing, and quell dissent. The approach is widely condemned by democratic countries, the United Nations, and human rights groups.

After internet service came back in Gaza the first time in late October, the White House wrote in a statement that “the restoration of communications in Gaza was critical. Aid workers, civilians, and journalists need to be able to communicate to each other and the rest of the world. Our Administration cared about this, worked on it, and are glad to see it restored.” The US State Department and White House National Security Council did not return requests for comment from WIRED about the implications of the two subsequent internet shutdowns in Gaza.

“Seeing intermittent shutdowns reiterates where the power to shut down actually lies,” says Helga Tawil-Souri, a digital communication and media researcher focused on Israel-Palestine at New York University. “Every major bombing campaign that Israel has taken on sees with it new strategies of what media or communication forms are allowed and what is not allowed, as in the 2008-2009 bombing of Gaza, where there was a crackdown on foreign journalists for the first time, and the 2014 bombing. The kinetic warfare, the starving, the lack of communication, lack of water, targeting solar panels—all of it just kind of works together for the total incapacitation of normal life on every possible level.”

For people living in Gaza, it’s likely that as the war continues there will be more total internet shutdowns. Some have been able to find spots of connectivity, people with access to expensive satellite phones can communicate with the outside world, and others have used eSIMs to access Israeli or Egyptian networks that reach into Gaza. These and other circumvention techniques, while a critical lifeline, have been unreliable, though, as the war rages on.

Mekdad, the network engineer in Gaza, says that with little electricity or fuel to use generators, some people are using small solar chargers to power their devices. He showed WIRED a photo of nine phones connected to a series of power outlets. “The situation is very bad. We are running out of electricity, clean water, food, and medical supplies,” Mekdad says. His relatives have fled from the north looking for safe shelter in southern Gaza. “We expected to die every second,” he says. “We just hope to stay alive.”

Internet Blackouts in Gaza Are a New Weapon in the Israel-Hamas War

A complaint filed with the EU’s independent data regulator accuses YouTube of failing to get explicit user permission for its ad blocker detection system, potentially violating the ePrivacy Directive.

Privacy campaigner Alexander Hanff claims that YouTube’s new ad blocker detection is illegal under European law, and he's taking the fight to the European Commission.

On November 6, German Pirate Party MEP Patrick Breyer addressed Hanff’s claim to the European Commission, formally requesting a legal position as to whether “protection of information stored on the device (Article 5(3) ePR) also cover information as to whether the user's device hides or blocks certain page elements, or whether ad-blocking software is used on the device” and—critically—if this kind of detection is “absolutely necessary to provide a service such as YouTube.”

YouTube began rolling out ad block detection to Europe earlier this year and is now preventing some European users from viewing its content if they have an ad blocker enabled. The EU’s ePrivacy Directive requires online service providers to get explicit permission to “gain access to information stored in the terminal equipment of a subscriber or user.” Hanff, an expert advisor to the European Data Protection Board, alleges that YouTube’s use of JavaScript-based detection scripts to look for specific HTML page elements rendered by a user’s browser is subject to that requirement and he believes it is failing to abide by it.

In a complaint lodged with Ireland's Data Protection Commissioner (DPC), Hanff called on the DPC to “take action against YouTube … for this breach of the law and demand YouTube cease their unlawful deployment of adblocker detection tools.”

Hanff, who helped to draft the forthcoming update to the EU’s ePrivacy regulations, says he believes YouTube’s JavaScript violates EU citizens' privacy.

“The script that \[YouTube\] deploys is detecting what software people are running on their machines or what behaviour their browser is exhibiting in relation to their private activities. It's not okay. It's illegal,” Hanff claims, echoing his complaint. We have a fundamental right to privacy under Article 7 of the European Charter of Fundamental Rights. We have a fundamental right to data protection under Article 8.”

YouTube reportedly started implementing anti-adblock measures in May 2023, and in June was still describing its ad blocker detection as a “experiment.” European users have reported seeing detection messages since at least mid-October. Not every user is affected, and you’ll only see these anti-adblocker messages if you’re signed into your YouTube account.

When YouTube detects an ad blocker or other privacy tool that blocks ads as part of its functions, you'll see a warning stating that “Ad blockers violate YouTube's Terms of Service” or “Ad blockers are not allowed on YouTube.” There are a few different versions of this message, including some that entirely prevent you from playing videos and others that allow you to view a number of videos with your blocker enabled before streaming is blocked.

A pop-up asking you to turn off your ad blocker is hardly an unusual sight on the internet, but could it be against the law?

All versions of YouTube's ad blocker detection that WIRED is aware of use a JavaScript program that runs in the client browser, although YouTube says that it could use non-invasive server-side methods to identify if a video ad served to a user has not been played.

Hanff’s complaint claims that YouTube’s client-side detection code meets the description, in Article 5(3) of the ePrivacy directive 2002/58/EC, of a process used to “gain access to information stored in the terminal equipment of a subscriber or user." If that’s the case, the user must be provided with “clear and comprehensive information” about what this information will be used for and given the “right to refuse such processing.”

You'll be familiar with this process from the cookie consent forms that appear whenever a website wishes to capture non-essential information about you and your browser. Right now, neither an explicit notification nor an opt-out are displayed when YouTube obtains data about whether ad blocking tools may be active on your device or network connection.

YouTube representative Christopher Lawton tells WIRED that “ads support a diverse ecosystem of creators globally and allow billions to access their favorite content on YouTube. The use of ad blockers violate\[s\] YouTube’s Terms of Service.”

YouTube’s current terms, last updated on January 5, 2022, don’t explicitly mention the use of ad blocking tools, nor any detection measures, although a Permissions and Restrictions clause that forbids user activity to “circumvent, disable, fraudulently engage, or otherwise interfere with the Service” could be read as covering this scenario.

But Hanff, who holds an advanced master of laws in privacy, cybersecurity and data management from Maastricht University, maintains that, “under EU Consumer Protection Law, you're not legally allowed to enforce any terms in the contract which infringe on the fundamental rights and freedoms of an EU resident.” The reason cookie consent forms are so intrusive is because consent for device access can’t be bundled up with other terms and conditions.

Breyer, the German MEP, echoes Hanff’s beliefs, telling WIRED that "ad blockers protect us from illegal tracking of our online life and online harms. YouTube's terms and conditions likely violate EU law. YouTube should offer surveillance-free advertising and stop its anti-adblock campaign now."

YouTube obviously wants to make money—that server bandwidth isn't going to pay for itself. In 2022, ad-free YouTube Music and Premium had 80 million subscribers, while YouTube reported ad revenue of $7.95 billion in the third quarter of 2023 alone.

Priced at $13.99 (or €12.99 in Europe), YouTube Premium's primary benefit is ad-free video and music streaming. But if you can use an ad blocker to obtain most of the benefits of a subscription, there's little incentive to pay.

YouTube also needs its content creators to make enough money to justify their efforts. If you don't watch the ads on a video, and aren’t paying for YouTube Premium, the video you’re watching doesn't make any money for its uploader. That includes if you have ads enabled but press the “skip ad” button as soon as it appears on a skippable ad.

YouTube also reserves the right to serve ads on videos by creators who are not in the YouTube Partner Program or under a monetizing agreement, without sharing any revenue from those ads with said creators.

The arguments in favor of ad blocking range from reducing bandwidth consumption to avoiding psychologically harmful ads. (YouTube, for example, runs ads for alcohol, diets, and online casinos.) But the most compelling argument in favor of ad blocking is online security. Security researchers regard online ad networks as a key threat vector when it comes to cybersecurity, and ads on YouTube have previously been cited as serving crypto-mining malware and links to scams and pornographic content.

Most ad-blocking browser extensions look for specific file paths and filenames (such as those in the ad blocking Easylist) being called from within a page, and remove them from the version of the page that is rendered in your browser.

For example, a JavaScript program called “clever\_ads.js” (the name of a script produced by the Clever Ads advertising automation service, which embeds ads in your page) would be identified by the ad blocker and removed, along with any content it would normally load. In the case of YouTube, the ad API returned JSON files, which the ad blockers would replace.

There are a few methods of detecting whether a user is blocking ads, most of which involve another JavaScript program that checks the rendered page for evidence that ad content has been removed. A frequent approach is to have your ad-loading script also insert a JavaScript variable or an HTML element that can be checked for.

Of course, ad blockers can look for and remove the anti-adblocker scripts as well, and that’s what’s happening in the case of blocking tools, such as Adblock Plus and uBlock Origin, that regularly provide extra filters to download and add to the blocker so that it can remove the latest scripts.

But as its anti-adblocker scripts are added to the filter lists, YouTube releases updated versions of those scripts. So now there’s an adblock detection arms race going on, embodied by the “Is YouTube Anti-Adblock Fixed” website, which monitors whether the uBlock Origin browser plugin is successfully circumventing YouTube’s adblock detection or not by comparing a list of YouTube anti-adblocker script IDs with the list of script IDs that are blocked by the plugin.

Fundamentally, the EU says that random websites aren't allowed to rummage around in your stuff without permission. That’s something most people agree on. Google itself forbids Android app developers from using the QUERY\_ALL\_PACKAGES permission, describing a user's installed apps as “personal and sensitive information.”

The question facing the DPC is whether YouTube’s adblock detection scripts are invasive enough to qualify: Is downloading and running a JavaScript routine equivalent to downloading and storing a cookie?

It looks like YouTube intends to argue that it isn’t, and is emphatic that it only seeks to identify whether ads have been served but not played. When WIRED asked the company if it was using or testing server-side ad blocker detection, YouTube’s Lawton said that it was currently carrying out ad blocker detection within YouTube and not on users’ devices. That doesn’t line up with our observations or those of the ad blocker developers, as a JavaScript detection routine on a website has to be run by the browser to function.

Lawton says that YouTube “will of course cooperate fully with any questions or queries from the DPC.”

The Irish Data Protection Commissioner’s office did not provide a comment for this feature, but Hanff says that the DPC has confirmed to him that it’s investigating the case.

Source

Wired