Hamas has long touted its military drones, but little is known about the true scale of the threat. The answer may have consequences for people on both sides of the Israel-Gaza border.

When Hamas launched its attacks against Israel on October 7, it unleashed a flood of rockets as cover, while militants streamed through holes in the fence surrounding the Gaza strip. One particular clip released by Hamas, played on news stations the world over, provoked a particular bit of paranoia: video of balaclava-clad Hamas fighters standing in a desert landscape, launching a line of suicide drones.

Amid the terror and chaos, the video seems to underscore a long-held fear that Hamas—with the help of Iranian technology—had developed the ability to conduct air strikes on Israel. What’s more, these drones may prove more adept than Hamas’ supply of rockets at thwarting Israel’s sophisticated Iron Dome air defense system.

Hamas had been building this capacity for some time. In 2022, it touted its drone program with an ominous warning: Israel no longer had a monopoly on its skies. According to Hamas Telegram channels, roughly 40 suicide drones have been fired toward Israel since the war began earlier this month. Yet, besides some undated propaganda videos, there is scant evidence that these drones have actually been deployed against Israel—and, if they have, they don’t appear to have done much damage.

Drone warfare has dramatically altered the dynamics in a number of recent conflicts—from Ukraine to Nagorno-Karabakh to Yemen—but not in the war between Hamas and Israel.

Why? The answer could have significant implications for people on both sides of the Israel-Gaza border.

Since the early 2000s, Hamas, which was elected to lead Gaza’s government in 2006 and has held power ever since, has drastically scaled up its ability to hit targets inside Israel.

The earliest versions of its Qassam rocket were rudimentary: lightweight and capable of traveling just a few miles. In each successive generation of the missile, however, they became bigger, capable of flying farther, and equipped with larger warheads.

Over the past two decades, Hamas and Israel have engaged in a race—Hamas, to develop its offensive capabilities and extend its reach; and Israel, to frustrate those efforts as much as possible.

Like more than 20 non-state actors in conflict zones around the world, Hamas recognized that the drones could substantially upgrade its ability to wage war. Unlike its unguided missiles, which are designed to beat Israel’s air defenses simply by overwhelming them, drones are considerably harder to intercept. They fly low and don’t travel in a predictable, parabolic arch. As a number of countries have recently learned, thwarting an advancing drone—much less a number of them—is a tricky problem to solve.

Unlike Russia or Ukraine, Hamas couldn’t source military drones through an open tender. So it tapped Tunisian-born aerospace engineer Mohamed Zouari to, in the early 2010s, design Hamas’ first fleet of operational drones and stand up an industry to produce them. They called the first model Ababeel1, which was very similar to an Iranian drone and had three different models. One version was designed to conduct surveillance, one to deliver small munitions, and the third was a suicide drone.

Israel began targeting Hamas’ drone program before it even produced results, striking a production facility in 2012. But the program continued.

Around that time, there were ample signs that Hamas’ domestic production capacity had not grown as it had hoped. Small—probably commercial—drones were dispatched into Israel from Gaza in 2012 and 2013, according to reports of a talk by an Israeli air defense official. Israeli jets and anti-air systems soon began to intercept the drones over Israeli airspace. Around 2014, Hamas made headlines after claiming it had penetrated deep into Israeli airspace, flying over Tel Aviv. But analysts say, despite Hamas’ insistence, the drones were not locally made in the Gaza strip: They were likely the Ababil-1, a product of the Iranian drone program.

In 2016, Zouari was assassinated in his hometown of Sfax, Tunisia, in what has been described by Tunisian investigators as a multiyear operation. While Israel did not admit responsibility for the killing, then-defense minister Avigdor Lieberman said only that Israel “will continue to do in the best possible way what we know how to do—that is to protect our interests.” Fadi al-Batsh, who had written papers on drone technology and who Israeli media alleged was part of Hamas’ drone program, was assassinated in 2018. Lieberman suggested that al-Batsh was killed as part of a “settling of scores among terrorist organizations.” In January 2022, the Hamas-led Gaza Interior Ministry arrested a Gaza resident for al-Batsh’s death and alleged the man worked for Mossad, Israel’s intelligence agency.

As Hamas seemed to struggle to establish its own domestic drone industry, other non-state actors began showing just how devastating these unmanned aerial vehicles (UAVs) could be. The Islamic State leveraged a huge number of commercial and hobbyist drones to conduct reconnaissance and drop grenades on advancing forces. Houthi rebels in Yemen began deploying sophisticated attack drones in its fight against the state military—analysts noted that, despite claims that these drones were locally made, they bore striking similarities to Iranian attack drones.

Faced with the looming possibility that Hamas could leverage some of the same techniques, Israel began running drills, practicing with fighter jets to intercept UAVs. In February 2014, it announced a prototype of a new air defense system: The “Iron Beam”—a directed energy weapon which, it hoped, will be able to track and destroy incoming drones.

In 2021, Hamas again sounded the trumpets over its supposedly game-changing drone program. This time it unveiled a whole new model: the Shehab. The suicide drones starred in slickly made propaganda videos and have been lionized for years in Hamas communiques. Yet they proved woefully ineffective in the field. Some were intercepted by the Iron Dome (as was one Israeli reconnaissance UAV) while others were shot down by F-16 jets. Video footage and unverified claims from Hamas suggest that one drone may have exploded near an Israeli chemical plant in May 2014—but appeared to do little to no damage.

Despite the program’s Iranian influence, Hamas claimed some of its drones were “locally made.” It said in a May 2022 press release that its drone program had made major progress, and it touted these new drones as a “turning point” for its fight against Israel. In September 2022, Hamas inaugurated “Shehab Square,” a public square featuring a model of the suicide drone on a pillar.

Despite all this fanfare, a December 2022 report from the International Center for Counter-Terrorism (ICCT) took a dim view of Hamas’ drone program. “Hamas has not demonstrated any ability to regularly use drones successfully,” the researchers wrote. As to why Hamas would continue investing in a capability that has such a poor record, the ICCT surmised that “the association of drone technology with military status may explain the group’s continued employment of drones.”

What’s more, the ICCT noted that Hamas’ technical failures seemed to be compounded by a lack of strategy or plan for what to do with these drones. The paper suggested that Hamas may lack the technical know-how to use these drones effectively, that it may be ineffective against Israel’s defenses, or possibly that “the group is more concerned about being seen using drones than using them effectively.”

“I think it’s surprising that Hamas didn’t use more commercial and tactical drones in its invasion,” Paul Lushenko wrote on Twitter in the hours after Hamas’ October 7 assault on Israel. “For all the concern of an Israeli intelligence failure, I think the lack of Hamas’ use of drones suggests poor organizational learning.”

Lushenko is a faculty professor at the United States Army War College and an expert in the emerging field of drone warfare. Speaking with WIRED, Lushenko says there’s little sign that Hamas, despite their usual bragging, actually managed to put its drone program into action. “We haven’t seen the evidence.”

Certainly, Hamas made some targeted use of several over-the-counter drones and quadcopters—similar to how the Islamic State deployed the UAVs during its brief control of a proclaimed caliphate. Videos reportedly released by Hamas purportedly showed drones dropping explosive devices on Israeli communications towers and machine gun positions near the Gaza border. These UAVs pose a particular challenge because they are often too small and too nimble to be successfully intercepted. Instead, Israel says it is stepping up jamming efforts to break the link between those drones and their controllers within Gaza.

Beyond those short-range and lightweight UAVs, however, Hamas’ use of its homemade, Iranian-inspired suicide drones seems to be not much more than bluster.

The much-broadcast Hamas propaganda video of its fixed-wing UAVs being fired does not, in fact, show part of the assault on Israel. It was filmed before the attack—the full video shows the suicide drones crashing into a fake Israeli outpost—the explosion knocking over cardboard cutouts, as a blue-and-white Israeli flag flaps nearby.

Hamas Telegram channels have claimed repeatedly in recent weeks that their drones struck positions in Israel but offered little in the way of visual evidence or specifics. One supposed strike was conducted on “a parking lot for vehicles and personnel east of Gaza.” There has been no confirmation of any of these strikes or claims of any damage inflicted.

The Israel Defense Forces declined WIRED’s request to comment on whether it had intercepted any of these drones, writing that “the IDF is currently focused on eliminating the threat from the terrorist organization Hamas.”

There may be two possible explanations for this apparent lack of impact. One is that Hamas has opted to stockpile these drones, saving them for an anticipated Israeli ground operation. The other is that, like past attempts, Hamas’ drone program has simply failed to launch.

The first possibility could pose an enormous challenge for Israel. As we’ve seen on both sides of the Ukraine-Russia war, drones have substantially changed the reality on the ground. While analysts say Russia has used Iranian-made kamikaze drones to attack Ukrainian critical infrastructure, Ukraine has responded with Turkish-made Bayraktar TB2 drones to hammer Russian convoys and defensive positions. Smaller quadcopters have given both sides unparalleled visibility behind enemy lines and have proved remarkably deadly in urban warfare. If Hamas is sitting on a reserve of these drones, to be used if Israeli forces cross into Gaza—where they will not have the protection of the Iron Dome—it could be highly effective at frustrating a possible ground assault.

“It's not uncommon for non-states \[actors\] and states to not use all of their decisive weapons all at once,” James Patton Rogers, executive director of the Cornell Brooks Tech Policy Institute, tells WIRED. “Will this be something that happens in the coming days and weeks? Is this something that was deliberately held back en masse from being launched against Israel?”

The fact that Hamas has, on dozens of occasions over the past two years, fired these drones toward Israel with little to no effect suggests that its reach may have extended its grasp. “We don't know the full impact of those yet, if there wasn't much impact,” Rogers says. “Did they do anything more than the rockets or the mortars would do? Were they able to penetrate the Iron Dome more than a mortar or a rocket?”

Normally, these loitering munitions are more effective at beating missile defense systems, as they tend to fly low and slow, hugging the ground. But given that Israel has one of the most advanced air-defense systems in the world, Hamas may simply not have had the time, capacity, or skill to adequately learn how to overcome the Iron Dome.

“I do think it's a bit too early to tell in this one,” Rogers says.

Lushenko adds that, even if these drones do very little physical damage, the threat they pose will still loom large. “They really have a psychological effect.”

The Dangerous Mystery of Hamas’ Missing ‘Suicide Drones’

With a new emphasis on the Hamas attacks on Israel, the US Treasury has proposed designating foreign cryptocurrency “mixer” services as money launderers and national security threats.

Hamas’ attacks Against Israel on October 7 have shifted the geopolitical landscape and triggered a looming Israeli ground assault in the Gaza Strip. Now the ripple effects are reaching the cryptocurrency industry, where they’ve become the United States Department of the Treasury’s rallying cry for a crackdown on cryptocurrency anonymity services.

The US Treasury’s Financial Crimes Enforcement Network (FinCEN) today released a set of proposed rules that would designate foreign cryptocurrency “mixers”—services that blend users’ digital funds to offer more anonymity and make them harder to trace—as money laundering tools that pose a threat to national security and would thus face new sanctions and regulations. The new rules, if adopted following a 90-day period of public comment and debate, would potentially represent the broadest restrictions imposed yet on the mixing services and could make it far harder for cryptocurrency holders to put their money through the services before cashing it out at a US cryptocurrency exchange, or even at a foreign exchange that accepts US customers.

While the proposed rules were almost certainly in the works long before October 7, the Treasury’s announcement of the proposed rules tied the push for a change in policy directly to the use of cryptocurrency by Hamas and militant groups in Gaza. “The Treasury Department is aggressively combatting illicit use of all aspects of the CVC ecosystem by terrorist groups,” Wally Adeyemo, deputy secretary of the Treasury, wrote in a statement, using the term “CVC” to mean convertible virtual currency. Adeyemo says that this includes Hamas and Palestinian Islamic Jihad, a militant group that often aligns with Hamas, which Israel blamed for an explosion at a hospital in Gaza earlier this week.

Cryptocurrency mixers have existed almost as long as Bitcoin itself. They offer to take in a user’s cryptocurrency, blend it with that of other users, and return the funds so that they are harder to follow from their origin to destination on blockchains, which generally record every transaction in full public view. The Treasury’s rule change would designate those cryptocurrency-mixing services—or at least the majority of them that are based outside the US—as a “primary money laundering concern.” They would thus be considered a threat to US national security as defined by section 311 of the Patriot Act, a section of the law designed to restrict how domestic financial institutions interact with potential sources of terrorist financing.

The rule change would mean that US financial services, as well foreign ones with US customers—including cryptocurrency exchanges—would have to go through extra record-keeping and reporting requirements for funds that have touched a foreign cryptocurrency mixer, and it might even allow the Treasury to block US exchanges from handling those funds. “We’ve never seen anything like this before,” says Ari Redbord, the head of global policy for TRM Labs, a blockchain analysis firm. Redbord notes that the rule change isn’t proposing a blanket ban on foreign mixing services, only new rules for interacting with them. “The reality, however, is that 311 actions oftentimes have a sort of name-and-shame effect, where people are just not wanting to engage with these platforms out of fear of being caught up in money laundering or other type of illicit activity.”

Redbord, who previously served as an advisor to the Treasury’s undersecretary for Terrorism and Financial Intelligence, also notes that the proposal was no doubt being considered prior to the latest Hamas attacks and that the Treasury must have changed the proposal’s focus from the use of cryptocurrency by other national security threats, like North Korea and Russia, to Hamas and militant groups in recent days. “Having been at Treasury for a number of years, you don’t just roll out an action like this out over the course of 10 days,” says Redbord. “They’ve kind of shifted the narrative toward Hamas because that’s the news.”

Hamas and militant groups’ use of cryptocurrency, while significant, pales in comparison to the amount of cryptocurrency used by other illicit actors. Hamas, for instance, raised $41 million in cryptocurrency over the past two years, and Palestinian Islamic Jihad raised $91 million, according to a report last week in the _Wall Street Journal_ that cited analyses by cryptocurrency tracing firms and seizures by the Israeli government.

It’s not clear, however, how much of those funds actually made it to these groups before being seized. In fact, Hamas asked its donors to stop using cryptocurrency in April of 2023, due to the public nature of the transactions on blockchains and the risk of prosecution. Cryptocurrency tracing firm Chainalysis, which frequently works with government and law enforcement customers, went so far as to publish a blog post yesterday cautioning against mistaken analyses that overestimate the role of cryptocurrency in financing entities like Hamas and the Palestinian Islamic Jihad.

North Korean state-sponsored cybercriminals, Russian ransomware gangs, and other criminal groups, by contrast, have pocketed billions of dollars through their theft of cryptocurrency or use of the technology as a means of demanding extortion payments from victims. Thieves stole $3.8 billion in crypto last year—much of which went to the North Korean regime—and ransomware hackers extorted close to $450 million in just the first half of 2023, according to Chainalysis.

Those criminals often use cryptocurrency mixing services, funneling hundreds of millions of dollars into mixing services like ChipMixer and Sinbad.io. In fact, US law enforcement and the Treasury Department have aggressively sanctioned or shut down one mixer service after another in recent years, including Blender, TornadoCash, and Bitzlato, often citing their use in laundering the profits of those North Korean and Russian hackers.

The new FinCEN rules would be less severe than those sanctions, indictments, and busts—a new regulatory process rather than a ban—but also far wider in scope, says Jason Somensatto, Chainalysis’ head of North America public policy. “The impact can be much broader,” says Somensatto. “They can say that this applies to _all_ mixing services that people are interacting with.”

As the Treasury doubles down on its push to cut off crypto-based money laundering—and now points to Hamas as a new impetus for that crackdown—TRM Labs’ Redbord cautions that US regulators shouldn’t go too far in censuring services that do, in some cases, offer financial privacy to legitimate users. After all, without mixers, most cryptocurrency transactions are fully public in nature. “I think the challenge for regulators is, how do we thread the needle between stopping illicit actors from using these platforms but at the same time allow regular users to enable some degree of privacy?” Redbord says. “I think the concern is that this could very much be throwing the baby out with the bathwater.”

Citing Hamas, the US Wants to Treat Crypto "Mixers" as Suspected Money Launderers

A flood of false information, partisan narratives, and weaponized “fact-checking" has obscured efforts to find out who’s responsible for an explosion at a hospital in Gaza.

Yesterday evening around 7 pm local time, an explosion rocked the Al-Ahli Baptist Hospital in Gaza City. Within minutes, information about what had happened was distorted by partisan narratives, disinformation, and a rush to be first to post about the blast. Add in mainstream media outlets parroting official statements without verifying their veracity, and the result was a chaotic information environment in which no one was sure what had happened or how.

“There’s just been this massive sort of pressure to get videos out there, get your take, get your analysis, and it’s like a perfect storm for chaos,” Kolina Koltai, a senior researcher at open source intelligence (OSINT) news outlet Bellingcat, tells WIRED.

Moments after the explosion was reported, Gaza’s health ministry claimed the blast was caused by an Israeli rocket attack and that hundreds of people had died, marking what would be among the deadliest attacks of the current conflict between Israel and Hamas, which controls the Palestinian territory of Gaza. News organizations such as _The_ _New York Times_ and Reuters ran with the claim, pushing notification alerts to people’s phones with the news that Israeli rockets had killed Palestinians sheltering in a hospital in Gaza. “Breaking news: Israeli strike on hospitals kill hundreds, Palestinian officials say,” _The_ _New York Times_ alert read.

Soon after those push notifications went out, the Israeli military said its intelligence officers had tracked rockets fired by the Palestinian Islamic Jihad, an armed militant group in Gaza that is aligned with Hamas against Israel but often acts independently. Israeli military officials said they observed Islamic Jihad rockets passing the hospital at the time of the strike, adding that it was these projectiles—not an Israeli rocket—that hit the facility’s parking lot.

News organizations quickly changed their headlines to reflect the counterclaim from Israel and pushed out more notifications to their audiences. The updated headline from _The_ _New York Times_ read: “At least 500 dead in blast at Gaza hospital, Palestinians say.”

This was only the beginning of the confusion.

In the hours after the attack, @Israel, the official Israeli account on X (formerly Twitter), posted a video it claimed was proof that the explosion was the result of a misguided rocket launched by Islamic Jihad militants. But within minutes, Aric Toler, a former Bellingcat researcher who now works for _The_ _New York Times_, pointed out that the time stamp on the video showed 8 pm local time, a full hour after the explosion took place.

“When you see people in such a capacity putting out a claim, walking it back, putting out a video, deleting the video, it makes it tough, not just for us to do our job, but even for the public to find out what’s going on,” Koltai says.

The post on Israel’s official account was subsequently edited to remove the video while maintaining its claim that the attack was not the result of an Israeli strike.

Meanwhile, social media was flooded with videos and images that claimed to provide proof of the origin of the attacks, with many accounts making definitive judgments about those they claimed were responsible for the attack, all without any actual proof.

For experts in the OSINT community who have spent years working on incidents just like this, the confusion and misinformation were frustrating. Figuring out what happened takes time, and the deluge of misinformation only made that work more difficult.

“It’s because we are trying to track a rocket, at night, via a couple of livestreams, a security camera, and a phone camera,” an OSINT researcher, who posts anonymously on social media using the handle OSINTtechnical, tells WIRED. “Oh, and there are bad actors purposely trying to muddy the waters. I would say we still have an acceptable number of resources to see into Gaza, but it takes some time to parse everything to a complete degree.”

The researcher adds that their job was made infinitely more difficult by media outlets running with the claim that Israel was responsible. “That blows everything out of the water,” OSINTtechnical says.

Koltai says she began trying to figure out what had happened within hours of the incident, before her colleagues in Europe took over today. Despite being among the first to begin investigating the incident, as of this afternoon Bellingcat had still not confirmed how the attack happened or who was responsible.

Similarly, the BBC Verify team published its analysis of the explosion based on the available information but has been unable to conclude what exactly happened. A number of videos captured with mobile phones and circulated on social media appear to show the moment of the explosion from different angles. A livestream operated by Al Jazeera shows two flashes, one further away from the camera and one much closer, which some claim shows the rocket launching, followed by the explosion. Footage captured this morning shows the hospital’s parking lot, and what appears to be a small impact crater. Footage shows damage to a number of cars, but only minor damage to the exterior of the hospital building.

Today, _The New York Times_ reported that US officials said they have “multiple strands of intelligence,” including infrared satellite imagery, indicating that the deadly blast was caused by the Islamic Jihad group, though that evidence has not been released publicly. US president Joe Biden, who is meeting with officials in Israel today, echoed Israel’s claim that its military did not fire the rocket that hit the hospital. “Based on the information we have seen today, it appears the result of an errant rocket fired by a terrorist group in Gaza,” he said.

In the days since Hamas attacked Israel on October 7, people claiming to be OSINT practitioners have emerged on social media who are much more willing to make conclusive findings almost immediately than people who have a long history of conducting OSINT work.

This new group is “publishing analysis as quickly as possible when events are taking place, in an attempt to compete for public attention,” ​​Francesco Sebregondi, a forensic architect who helps investigate human rights abuses through a technique known as forensic architecture, tells WIRED. “This is of course detrimental to the fundamental goal of citizen-led open source investigations.”

The purpose of OSINT investigations is to independently verify information “and to enable counter-investigations of authoritative arguments and sometimes misleading official accounts,” Sebregondi says.

Sebregondi says OSINT accounts that rush to post analyses prematurely not only mislead their followers but help bolster the narrative of political actors who may be “counting on the eagerness of some OSINT actors to use any image, material, or data to quickly publish new content or ‘analysis’—and thereby more or less directly support its version of the events.”

Aside from the apparent bragging rights of being first, there is also now a financial incentive to post updates before anyone else because if you’re “first and put out a hot take even if you’re maybe not correct you can actually get paid out for it,” Koltai says, referring to X’s revenue-sharing program.

Fact-checking and open source investigations have long been seen as a way to hold platforms accountable by debunking disinformation that spreads unchecked on social media, but the Israel-Hamas war has shown how the language of OSINT investigators has been co-opted by self-interested parties, says Caroline Orr, a behavioral scientist and postdoctoral researcher at the University of Maryland who tracks disinformation online.

“I think one of the most disturbing aspects of studying disinfo is when you realize that even fact-checking has become weaponized,” Orr wrote on X. “Most people don’t care about the truth about the hospital being bombed; they just care about finding a truth to use against the other side.”

Who’s Responsible for the Gaza Hospital Explosion? Here’s Why It’s Hard to Know What’s Real

X is promoting Community Notes to solve its disinformation problems, but some former employees and people who currently contribute notes say it’s not fit for that purpose.

Community Notes, the crowdsourced fact-checking program launched a year ago to tackle disinformation on X (formerly Twitter), has flown under the radar for much of its existence. But in the past week it has been heralded by Elon Musk and X CEO Linda Yaccarino as a key tool in tackling the toxic deluge of disinformation that has flooded social media, and in particular X, during the ongoing Israel-Hamas war.

On Saturday, the company wrote on its own platform that “notes across the platform are now being seen tens of millions of times per day, generating north of 85 million impressions in the last week.” It added that thousands of new contributors had been enrolled in the system. However, a WIRED investigation found that Community Notes appears to be not functioning as designed, may be vulnerable to coordinated manipulation by outside groups, and lacks transparency about how notes are approved. Sources also claim that it is filled with in-fighting and disinformation, and there appears to be no real oversight from the company itself.

“I understand why they do it, but it doesn't do anything like what they say it does,” one Community Notes contributor tells WIRED. “It is prone to manipulation, and it is far too slow and cumbersome. It serves no purpose as far as I can see. I think it's probably making the disinformation worse, to be honest.”

This contributor, who was granted anonymity for this story because of concerns about retaliation from Musk or his supporters, should know about platform manipulation, because he is one of those engaging in it.

He is one member of a group of about 25 Community Notes contributors who actively coordinate on a daily basis in order to upvote or downvote particular notes. He is a member of the North Atlantic Fella Organization (NAFO), a decentralized online volunteer movement that emerged following Russia’s invasion of Ukraine and uses humor to counter Russian disinformation and propaganda while raising funds in support of Ukraine.

“We have a group so we can coordinate who writes what Community Notes, and if you write one, you can coordinate so you get one voted as helpful, and there's no validation on any of that,” the contributor says. The contributor claims that Russian embassies have engaged in similar tactics and alleges that they “will downvote anything that's anti-Russian.” A WIRED review of unpublished notes accompanying contested Russian embassy posts written by NAFO members shows they have all been repeatedly downvoted.

A contributor based in the southern hemisphere tells WIRED that he has two accounts on X, and he alleges that both of them have been approved for access to the Community Notes system—evidence that the program may be vulnerable to even broader manipulation, just as Kremlin trolls were able to operate multiple Twitter accounts impersonating US citizens and influence the 2016 election.

Community Notes began life as Birdwatch, first announced in October 2020 before going live in a pilot project in January 2021, weeks after Donald Trump supporters attacked the United States Capitol. Envisioned as a way of harnessing the power of the crowd to debunk misinformation in near real time, Birdwatch was never fully embraced by the company, which was criticized in March last year, soon after the Russian invasion of Ukraine, for failing to roll it out more broadly.

At the time, there was trepidation within the company about how effective the tool would be at controlling the quality of information on the platform, Yoel Roth, Twitter's former head of Trust and Safety, tells WIRED.

“There was a belief amongst the Trust and Safety team that people would not do uncompensated labor at scale, and that the things that would attract attention in a Birdwatch format didn't necessarily correspond with the harmful things that constituted violations of policies,” says Roth.

This truth was later borne out, at least in part. A study presented at a conference in April 2022 by researchers at MIT found that Birdwatch users were much more likely to fact-check posts expressing political views that differ from their own. David Rand, the study’s lead researcher and a professor at MIT’s Sloan School of Management, says that while around 80 percent of the tweets that users chose to annotate were, in fact, misleading, users overwhelmingly tended to prioritize political content. Users were also likely to flag a piece of content based on whether it seemed “reasonable.” It is unclear whether these users had the knowledge and skills to debunk misinformation or offer alternative, correct information.

“In a situation like what is happening in Israel and Gaza right now, where there's a massive amount of unknowns, that gut-check of ‘Does this seem reasonable?’ is not great. Even professional journalists, as I understand it, are having a lot of trouble understanding what's true and what's not true,” says Rand. With such a fast-moving and volatile situation, “what I expect the crowd to produce is a lot of noise,” he says.

Almost immediately after Musk took control of the company in late October 2022, he renamed Birdwatch “Community Notes,” claiming that the system had “incredible potential for improving information accuracy.” In the months that followed, X systematically eradicated almost all of the teams and individuals overseeing content moderation and trust and safety at the company, putting even greater emphasis on the role of Community Notes.

Joe Benarroch, head of business operations at X, tells WIRED that the company has contributors across 44 countries, and while he would not give an exact number, he noted that more than 10,000 people had joined the program in the past week. Alongside contributors who volunteer for the program, some contributors are invited by X itself, WIRED has learned, according to one contributor we spoke to and a search of X, where contributors say X invited them to join.

Benarroch did not address whether there is any form of moderation for Community Notes. And while Benarroch says “Community Notes were designed to tackle misinformation on X,” Roth says their original intention was not to perform that task alone.

“The intention of Birdwatch was always to be a complement to, rather than a replacement for, Twitter's other misinformation methods,” says Roth. “The company fired the entire curation team, without whom misinformation enforcement can't operate, even if the policies are still on the books,” he says, referring to the former employees who would create the collections of tweets for corrections or produce the labels to let users know if something was misinformative.

“Community Notes is an imperfect replacement for Trust and Safety staff,” says one former Twitter Trust and Safety employee who spoke to WIRED on the condition of anonymity for fear of retaliation. “You can’t just outsource that work to the community.”

While X claims Community Notes is having a significant impact on tackling disinformation on the platform, the notes system itself can also spread disinformation. Last week WIRED revealed that a note appended to a post from Donald Trump Jr. wrongly claimed a video he posted about the Hamas attack on Israel was fake. The original note has since been replaced with one citing WIRED’s report.

Many notes written by contributors are never seen by the public. A WIRED examination of these unpublished notes shows that just like the main X platform, the Community Notes community is similarly riven by in-fighting and misinformation.

On Saturday, the official Israel account on X posted a picture of what looks like a child’s bedroom with blood covering the floor. “This could be your child’s bedroom. No words,” the post reads. There is no suggestion the picture is fake, and publicly there are no notes on the post. However, in the Community Notes backend, viewed by WIRED, multiple contributors are engaging in a conspiracy-fueled back-and-forth.

“Deoxygenated blood has a shade of dark red, therefore this is staged,” one contributor wrote. “Post with manipulative intent that tries to create an emotional reaction in the reader by relating words and pictures in a decontextualized way,” another writes.

“There is no evidence that this picture is staged. A Wikipedia article about blood is not evidence that this is staged,” another contributor writes.

“There is no evidence this photo is from the October 7th attacks,” another claims.

These types of exchanges raise questions about how X approves contributors for the program, but this, along with precisely what factors are considered before each note is approved, remains unknown. X’s Benarroch did not respond to questions about how contributors are chosen.

None of those approved for the system are given any training, according to all contributors WIRED spoke to, and the only limitation placed on the contributors initially is an inability to write new notes until they have rated a number of other notes first. One contributor claims this approval process can take fewer than six hours.

In order for notes to become attached to a post publicly, they need to be approved as “helpful” by a certain number of contributors, though how many is unclear. X describes “helpful” notes as ones that get “enough contributors from different perspectives.” Benarroch did not say how X evaluates a user’s political leanings. However, the system at least previously employed a technique known as bridge-based ranking to favor notes that receive positive interactions from users estimated to hold differing viewpoints. Still, how this works is not clear to at least some Community Notes contributors. 

“I don't see any mechanism by which they can know what perspective people hold,” Anna, a UK-based former journalist whom X invited to become a Community Notes contributor, tells WIRED. “I really don't see how that would work, to be honest, because new topics come up that one could not possibly have been rated on.” Anna asked only to be identified by her first name for fear of backlash from other X users.

For all the notes that do become public, there are many more that remain unseen, either because they are deemed unhelpful, or in the majority of cases reviewed by WIRED, they simply didn’t get enough votes from other contributors. One contributor tells WIRED that 503 notes he had rated in the last week remained in limbo because not enough people had voted on them.

“I think one of the issues with Community Notes at its core, it's not really scalable for the amount of media that's being consumed or posted in any given day,” the contributor, who is known online as Investigator515, tells WIRED. They asked to only be identified by their handle because of fears of damage to their professional reputation.

All of the contributors who spoke to WIRED feel that Community Notes is not up to the task of policing the platform for misinformation, and none of them believed that the program would improve at all in the coming months if it remains in its current form.

“It's much harder to deal with misinformation when there isn't the top-down moderation that Twitter used to have, because accounts willfully spreading misinformation would get suspended before they could really do a lot of harm,” the longtime contributor says. “So a reliance on Community Notes is not good. It's not a replacement for proper content moderation.”

_Updated at 7:10 pm ET, October 17, 2023, to add further context about how the Community Notes system may gauge the viewpoint diversity of contributors._

Insiders Say X’s Crowdsourced Anti-Disinformation Tool Is Making the Problem Worse

Myanmar’s military junta is increasing surveillance and violating basic human rights. The combination of physical and digital surveillance is reaching dangerous new levels.

Since taking power in a coup two years ago, Myanmar’s military junta has suppressed people's rights, cracked down on opposition, and used deadly force against civilians. To enable this, officials have clamped down on people’s communications and rolled out extensive digital surveillance systems. Now, new evidence shows how people are being tracked online and offline simultaneously.

In April this year, the military junta launched one of its deadliest air strikes—killing more than 160 people in the Kanbalu region in a single day. Following the strike, pro-junta Telegram channels systematically doxed people who showed support for the victims on social media, new research shared with WIRED shows. Their names, photos, and other personal information were all shared. Days after the doxing, which also revealed the real-world movements of some of the individuals, people were arrested and imprisoned.

The revelations from Myanmar Witness, a project run by the digital investigations group Centre for Information Resilience, demonstrates how oppressive forces can use people’s social media posts against them. It also shows the intense surveillance faced by people living under Myanmar’s military junta, which includes rolling internet shutdowns and increasing CCTV.

“The military regime and their supporters in Myanmar have weaponized the internet, and doxing has become the tip of the spear—the most aggressive way of intimidating people into silence, online and offline,” says Lu Aye, the lead investigator at Myanmar Witness. The group investigated the incident using open source intelligence techniques, comparing on-the-ground reports with digital evidence.

The air strike hit the village of Pa Zi Gyi, in central Myanmar, on the morning of April 11 as hundreds of people celebrated the opening of a new village building, which had been backed by Myanmar’s pro-democratic National Unity Government. More than 160 people, including women and children, died in the air strike, with reports from CNN and the _Guardian_ describing bodies burning on the ground and medical teams not immediately able to access the site due to planes flying overhead. (A military spokesperson told local press it was targeting “terrorists.”)

In the days following the incident, locals changed their Facebook profile pictures to black images and shared messages of support for the victims. According to reports in the state-owned Myanmar Alin newspaper that were analyzed by Myanmar Witness, 68 people were arrested. (One other arrest was reported by the BBC.) People were arrested for spreading propaganda, cooperating with the pro-democracy government, and public disturbance, according to the analysis. All the of arrests mention people’s social media profiles.

A series of 19 Telegram channels that appear to support the State Administration Council, the official name of the military junta, shared the personal details and Facebook posts of 20 people who supported air strike victims, the Myanmar Witness research says. Of these, 11 were arrested after being doxed. “Revealing the identities, addresses, and other details of dissenters online is a powerful weapon of suppression,” Lu Aye says. “It leaves individuals vulnerable and intimidated and scares off many more from calling out the military and standing up for democracy.”

It is “highly likely” that the doxing and subsequent arrests are related, Lu Aye says. Messages sent alongside the doxing posts were often similar to the published reasons for the arrest, and the timelines overlap, Lu Aye says. On average, according to the analysis, an arrest happened six and a half days after the doxing post appeared—and in all the instances, the doxing happened at least one day before the arrest. Some people were doxed multiple times, with a total of 59 doxing posts for the 20 people targeted.

Lu Aye says that the researchers have, for the “first time,” found evidence to show the “coordination of online and offline surveillance and suppression.” “We found a shop owner who was named and targeted by seven different pro-junta Telegram channels in one day,” Lu Aye says. “The victim fled her home and shop, movements which were reported on by two of the channels who also called for the shop owner’s arrest and \[said\] they would continue to report on the individual.”

Myanmar’s embassy in Washington, DC did not respond to WIRED’s request for comment about the arrests and doxing. Telegram has also not responded to a request for comment at the time of writing. Doxing on Telegram isn’t new. As WIRED has previously reported, politically motivated doxing is now rife across the Middle East, Southeast Asia, and Eastern Europe. Telegram previously said it moderates the publication of private information on its platform.

Of the 19 Telegram channels highlighted by Myanmar Witness, five no longer appear to exist. The largest has 112,000 followers, while others have more than 10,000. Several seem to still be posting screenshots of people’s Facebook profiles and other personal information, a WIRED review of the channels found.

Manny Maung, a Myanmar researcher at nongovernmental organization Human Rights Watch, says that while doxing has been increasing in the country in the past two years, it is hard to document. Maung says she has seen lawyers “go to ground” after having their personal details, as well as their home address and details about family members, spread online. “That is enough to scare people right now,” she says.

Since the military junta took power, people’s digital and physical rights have been eroded, Maung says. There have been frequent internet shutdowns, which keep people from organizing and prevent information from getting out of Myanmar. Several laws have also been amended, giving authorities greater powers, such as the ability to clamp down on civil society and snoop on people’s communications.

Andrea Calderaro, a senior lecturer in international relations at Cardiff University who has worked on Myanmar’s internet connectivity, says the digital activists he knows have had to flee. “All the telecom operators are under the control of the military junta,” he says. “The connectivity that has been built over the years is clearly now being turned against the population. It’s now a tool that the government is using to control and repress populations.”

Myanmar Witness has verified and mapped more than 750 incidents in the three years from October 2020 to this month. Each one is based on photos or videos that have come out of the country, and researchers have checked their location and the events recorded. These include houses being destroyed and burnt, bombs caught exploding on CCTV footage, and dead bodies on the street.

“Among the litany of atrocities and abuses, the military is abusing their own people’s rights: rights to access of information, the right to organize, the right to live without fear of being attacked or killed,” Maung says. “All of this is happening in a widespread context where the military is clamping down on all aspects of life.”

Myanmar Witness’s Lu Aye says that since the doxing and the wider arrests, at least five of the people apprehended were released within four months of their arrest. These individuals were mostly well-known in local communities, and their release was reported by people on the ground, Lu Aye says. “We do not know the fate of the more than 60 other people who were arrested.”

They Supported Air Strike Victims. Then They Were Doxed and Arrested

New research shows the number of deepfake videos is skyrocketing—and the world's biggest search engines are funneling clicks to dozens of sites dedicated to the nonconsensual fakes.

Google’s and Microsoft’s search engines have a problem with deepfake porn videos. Since deepfakes emerged half a decade ago, the technology has consistently been used to abuse and harass women—using machine learning to morph someone’s head into pornography without their permission. Now the number of nonconsensual deepfake porn videos is growing at an exponential rate, fueled by the advancement of AI technologies and an expanding deepfake ecosystem.

A new analysis of nonconsensual deepfake porn videos, conducted by an independent researcher and shared with WIRED, shows how pervasive the videos have become. At least 244,625 videos have been uploaded to the top 35 websites set up either exclusively or partially to host deepfake porn videos in the past seven years, according to the researcher, who requested anonymity to avoid being targeted online.

Over the first nine months of this year, 113,000 videos were uploaded to the websites—a 54 percent increase on the 73,000 videos uploaded in all of 2022. By the end of this year, the analysis forecasts, more videos will have been produced in 2023 than the total number of every other year combined.

These startling figures are just a snapshot of how colossal the issues with nonconsensual deepfakes has become—the full scale of the problem is much larger and encompasses other types of manipulated imagery. A whole industry of deepfake abuse, which predominantly targets women and is produced without people’s consent or knowledge, has emerged in recent years. Face-swapping apps that work on still images and apps where clothes can be “stripped off a person” in a photo with just a few clicks are also highly prominent. There are likely millions of images being created with these apps.

“This is something that targets everyday people, everyday high school students, everyday adults—it's become a daily occurrence,” says Sophie Maddocks, who conducts research on digital rights and cyber-sexual violence at the University of Pennsylvania. “It would make a lot of difference if we were able to make these technologies harder to access. It shouldn't take two seconds to potentially incite a sex crime.”

The new research highlights 35 different websites, which exist to exclusively host deepfake pornography videos or incorporate the videos alongside other adult material. (It does not encompass videos posted on social media, those shared privately, or manipulated photos.) WIRED is not naming or directly linking to the websites, so as not to further increase their visibility. The researcher scraped the websites to analyze the number and duration of deepfake videos, and they looked at how people find the websites using the analytics service SimilarWeb.

Many of the websites make it clear they host or spread deepfake porn videos—often featuring the word _deepfakes_ or derivatives of it in their name. The top two websites contain 44,000 videos each, while five others host more than 10,000 deepfake videos. Most of them have several thousand videos, while some only list a few hundred. Some videos the researcher analyzed have been watched millions of times.

The research also identified an additional 300 general pornography websites that incorporate nonconsensual deepfake pornography in some way. The researcher says “leak” websites and websites that exist to repost people’s social media pictures are also incorporating deepfake images. One website dealing in photographs claims it has “undressed” people in 350,000 photos.

Measuring the full scale of deepfake videos and images online is incredibly difficult. Tracking where the content is shared on social media is challenging, while abusive content is also shared in private messaging groups or closed channels, often by people known to the victims. In September, more than 20 girls aged 11 to 17 came forward in the Spanish town of Almendralejo after AI tools were used to generate naked photos of them without their knowledge.

“There has been significant growth in the availability of AI tools for creating deepfake nonconsensual pornographic imagery, and an increase in demand for this type of content on pornography platforms and illicit online networks,” says Asher Flynn, an associate professor at Monash University, Australia, who focuses on AI and technology-facilitated abuse. This is only likely to increase with new generative AI tools.

The gateway to many of the websites and tools to create deepfake videos or images is through search. Millions of people are directed to the websites analyzed by the researcher, with 50 to 80 percent of people finding their way to the websites via search. Finding deepfake videos through search is trivial and does not require a person to have any special knowledge about what to search for.

The issue is global. Using a VPN, the researcher tested Google searches in Canada, Germany, Japan, the US, Brazil, South Africa, and Australia. In all the tests, deepfake websites were prominently displayed in search results. Celebrities, streamers, and content creators are often targeted in the videos. Maddocks says the spread of deepfakes has become “endemic” and is what many researchers first feared when the first deepfake videos rose to prominence in December 2017.

Since the tools needed to create deepfake videos emerged, they’ve become easier to use, and the quality of the videos being produced has improved. The wave of image-generation tools also offers the potential for higher-quality abusive images and, eventually, video to be created. And five years after the first deepfakes started to appear, the first laws are just emerging that criminalize the sharing of faked images.

The proliferation of these deepfake apps combined with a greater reliance on digital communications in the Covid-19 era and a "failure of laws and policies to keep pace" has created a “perfect storm,” Flynn says.

Experts say that alongside new laws, better education about the technologies is needed, as well as measures to stop the spread of tools created to cause harm. This includes action by firms that host the websites and also search engines, including Google and Microsoft’s Bing. Currently, Digital Millennium Copyright Act (DMCA) complaints are the primary legal mechanism that women have to get videos removed from websites.

Henry Ajder, a deepfake and generative AI expert who has monitored the spread of the technologies, says adding more “friction” to the process of people finding deepfake porn videos, apps to change people’s faces, and tools that specifically allow the creation of nonconsensual images can reduce the spread. “It's about trying to make it as hard as possible for someone to find,” he says. This could be search engines down-ranking results for harmful websites or internet service providers blocking sites, he says. “It's hard to feel really optimistic, given the volume and scale of these operations, and the need for platforms—which historically have not taken these issues seriously—to suddenly do so,” Ajder says.

“Like any search engine, Google indexes content that exists on the web, but we actively design our ranking systems to avoid shocking people with unexpected harmful or explicit content they don't want to see,” says Google spokesperson Ned Adriance, pointing to its page on when it removes search results. Google’s support pages say it is possible for people to request that “involuntary fake pornography” be removed. Its removal form requires people to manually submit URLs and the search terms that were used to find the content. “As this space evolves, we're actively working to add more safeguards to help protect people, based on systems we've built for other types of nonconsensual explicit imagery,” Adriance says.

Courtney Gregoire, chief digital safety officer at Microsoft, says it does not allow deepfakes, and they can be reported through its web forms. “The distribution of nonconsensual intimate imagery (NCII) is a gross violation of personal privacy and dignity with devastating effects for victims,” Gregoire says. “Microsoft prohibits NCII on our platforms and services, including the soliciting of NCII or advocating for the production or redistribution of intimate imagery without a victim’s consent.”

While the number of videos and pictures continues to skyrocket, the impact on victims can be long-lasting. “Gender-based online harassment is having an enormous chilling effect on free speech for women,” Maddocks says. As reported by WIRED, female Twitch streamers targeted by deepfakes have detailed feeling violated, being exposed to more harassment, and losing time, and some said the nonconsensual content found its way to family members.

Flynn, the Monash University professor, says her research has found “high rates” of mental health concerns—such as anxiety, depression, self-injury, and suicide—as a result of digital abuse. “The potential impacts on a person’s mental and physical health, as well as impacts on their employment, family, and social lives can be immense,” Flynn says, “regardless of whether the image is deepfaked or ‘real.’”

Deepfake Porn Is Out of Control

Plus: Hamas raised millions in crypto, Exxon used hacked data, and more.

The media consortium, along with security researchers from Amnesty International and Google’s Threat Analysis Group, were able to show Vietnam’s connection to the Predator hacking campaign through documents they obtained that detail the Vietnamese government’s contract with Intellexa in 2020, and later an extension of the deal to allow the use of the Predator software. The internal documents went so far as to capture the response of Intellexa’s founder, Israeli former military hacker turned entrepreneur Tal Dilian, when the deal was announced: “Wooow!!!!” Vietnam’s government would later target French officials with Predator before this year’s campaign targeting US congressmen.

Despite efforts by Israel and other nations to cut off funding to Hamas in recent years, the group raised millions of dollars worth of cryptocurrency before the past weekend’s attack that killed more than a thousand Israelis. An analysis by _The Wall Street Journal_ found that Hamas, Palestinian Islamic Jihad, and Hezbollah had collectively raised hundreds of millions in crypto over the past several years, with $41 million going to Hamas specifically. Given that the _Journal_ learned of that funding in part through Israeli seizures of crypto accounts, however, it’s not clear how much of that money was frozen or seized versus how much might have actually been successfully laundered or liquidated by Hamas and other groups. 

In response to the weekend’s attacks, the Israeli government and the world’s largest crypto exchange, Binance, both announced that a new round of Hamas crypto accounts had been frozen. Though crypto has helped Hamas and other groups move funds across borders, its traceability on blockchains has presented a challenge for designated terrorist groups. In 2021, for instance, Hamas asked its supporters to stop making donations via cryptocurrency, due to the ease of tracking those transactions and unmasking contributors.

Last year, _Reuters_ reporters Chris Bing and Raphael Satter published an investigation into Aviram Azari, an Israeli private investigator who is accused of using mercenary hackers to gather intelligence on the critics of major corporations involved in lawsuits against them. 

Now, prosecutors in the Southern District of New York, where Azari has been convicted on criminal charges, have filed a sentencing memo that notes that activists’ communications stolen by Azari’s hackers were later used by Exxon in the company’s attempts to head off investigations and lawsuits by state attorneys general. The memo still doesn’t name Exxon as Azari’s client, but it implicitly suggests a link between the company and Azari: Prosecutors point in their memo to leaks of climate activists’ private emails to media, which were later cited by Exxon in their responses to state attorney generals as evidence of underhanded tactics by activists as they tried to prove that Exxon knew and covered up the role of fossil fuels in climate change. A Massachusetts lawsuit against Exxon that resulted from the state’s investigation is ongoing.

Internet giant Akamai warned this week that the infamous Magecart hacker crew, long focused on credit card fraud, has developed a clever new technique for spoofing credit card payment fields. The hackers managed to hide their malicious scripts in the 404 “page not found” error pages of ecommerce sites, then trigger those pages to load a spoofed payment field that impersonates a checkout page to steal credit card information. “The idea of manipulating the default 404 error page of a targeted website can offer Magecart actors various creative options for improved hiding and evasion,” warned Akamai researcher Roman Lvovsky. Akamai noted that the technique was used on the website of significant brands in the food and retail industries but declined to name them.

The US Congress Was Targeted With Predator Spyware

The rapid spread of violent videos and photos, combined with a toxic stew of mis- and disinformation, now threatens to spill over into real-world violence.

Yesterday, FBI director Christopher Wray attempted to assure the Jewish community in the US that his agency is taking any threats seriously. “I am not, in any way, trying to alarm you, but I want you to be confident that the FBI is most assuredly paying attention,” he said during an update on domestic security guidance following the Hamas attacks. “We remain vigilant to the potential of this event to inspire violence.”

The terms “jihad” and “day of rage” were both trending on X this morning, having been boosted by prominent accounts, including one belonging to hard-right representative Marjorie Taylor-Greene of Georgia. “If we are not going to vote today for a Speaker, why don't we just go home and regroup next week? I’ll buy ammo while I’m home,” Greene wrote on X.

Rogan O’Handley, a former Hollywood lawyer who has become a influential far-right figure under the pseudonym DC Draino, falsely claimed that Hamas had called for “an international day of terrorism.” O’Handley, who has 1.1 million followers on X, added, “I will not be changing 1 thing about my daily life b/c I will not let terrorism win,” he wrote. “I will, however, be carrying an extra mag. Be safe y’all.”

A WIRED review of Facebook, Instagram, and TikTok found dozens of posts highlighting Meshaal’s comments and the potential threat from the “day of jihad” but little evidence of threats against Muslims posted on those platforms. On Instagram yesterday, popular right-wing podcaster Charlie Kirk wrote: “Day of Jihad? Arm up.” The post has received 34,000 likes. Meta did not respond to a request for comment about Kirk’s post.

Amidst the flurry of threats, disinformation, and real acts of violence, it appears that X is attempting to limit search results for the terms “global day of jihad” and “jihad,” both of which returned no results when WIRED searched on mobile, desktop, and in different countries. While a search for the term “jihad” on X didn’t return any posts, it did suggest three people to follow, the first of which was US president Joe Biden.

X did not respond to WIRED’s request for comment about the violent threats on its platform or the lack of search results for terms related to jihad.

The calls for violence from right-wing accounts online echo violent responses from extremist groups in the days following the outbreak of the war.

While many right-wing groups have posted Islamophobic content and calls for violence against Muslims, many others have doubled down on their antisemitic worldview and are posting violent threats against Jews.

In a post on Telegram, the Texas chapter of the extremist group the Proud Boys, using multiple antisemitic slurs to describe Jews, called for the “extermination” of the Jewish people.

Rumors of a ‘Global Day of Jihad’ Have Unleashed a Dangerous Wave of Disinformation

In an attempt to wrest control from raucous far-right hardliners amid the fight for a new House speaker, Republican Party leaders are instituting phone bans to keep backroom deals secret.

Last week, after helping foment the eight-person coup that ended Kevin McCarthy’s 269-day reign as speaker of the United States House of Representatives Matt Gaetz’s signature smirk was everywhere. The 41-year-old Florida congressman peacocked through a slew of must-see Beltway cable news shows, dancing on McCarthy’s political grave, and generally basking in the brilliance of his successful scheme—one he openly doubted would work just the night before it did.

This week, Gaetz shut up—or, more accurately, he was shut up.

It’s not just Gaetz. All week long, unidentified Republican Party puppet masters have muzzled House members, scrambling to portray unity in the face of the disarray emanating from today’s leaderless House GOP. This includes the rare step of confiscating Republican’s electronic devices in an attempt to prevent leaks in the midst of their secret meetings to pick McCarthy’s replacement.

“I don't know who keeps talking in real time, because that's what they're concerned about,” Chris Smith, a New Jersey Republican, tells WIRED.

Nothing seems to be going right for House Republicans. Just ask the party’s handpicked majority leader, Steve Scalise. To the surprise of most, on Thursday night, he bowed out of the speaker race just a day after the majority of the conference tapped him to replace McCarthy. Even after disconnecting members and stopping real-time leaks, a minority of the majority party scuttled Scalise in less than 48 hours. Despite the wishes of party leaders, this revolt isn’t leaving our screens anytime soon.

It’s impossible to mute contemporary lawmakers for very long. The more party leaders try, the more the Republican base erupts with accusations of secret side deals. Still, party leaders are scrambling to regain control—if only momentarily and only in the Capitol’s plethora of backrooms.

“They're a little either whiplashed or gun shy from the McCarthy stuff. Gaetz and others knew they could blow up the Congress, but they didn't know how to rebuild it,” David Jolly, a former Florida Republican congressman, tells WIRED. “And in the rebuilding phase, they're sensitive to some of the negative press and the negative impressions.”

Today’s members of Congress are beholden to their online followings, not some party leader. Even one picked by the overwhelming majority—some 96 percent, in McCarthy’s case—of their peers. Regaining control of the seemingly uncontrollable seems to, once again, be proving a fool’s errand.

“The power centers no longer go up through leadership,” Jolly says. “Go back as far as you want—20 years, 30 years, whatever—all power structures funneled through leadership. Now they're all these independent power structures that reward and stabilize members regardless of if they've been there a year or 30 years. In fact, in many ways, the people who have been there 30 years probably have less security than the ones that just got there.”

Stripping members of their electronic devices is punishment for leaks and Gaetz-style boasting. It's being lauded by many members annoyed that their internal party deliberations often make headlines before they even hit the exits. But it’s backfiring.

Republican Party deliberations are staying secret longer—mere minutes longer, really—but the digital time-out isn’t fostering party unity. Following one of the party’s daily secret meetings this week, Republicans announced that Louisiana congressman Steve Scalise would be their nominee for the new House speaker, beating out Ohio’s Jim Jordan. Now the real trouble begins. In the wake of McCarthy’s speakership—the third-shortest in US history—the Republican Party’s right flank is emboldened, empowered, and feeling more justified than ever in their self-righteous quest to rid Washington of what they view as the federal government’s biggest problems.

The far-right Freedom Caucus and its allies began the House speaker fight in January, demanding more transparency, like the ability to review bills 72 hours before voting. Just last week, as he was moving his motion to vacate the speaker, Gaetz accused McCarthy of making "secret side deals" with US president Joe Biden. It seems calls for transparency withered alongside McCarthy’s short-lived speakership. If anything, the party seems mostly unified in embracing a new level of secrecy.

Phoneless in Washington

It’s still unclear who is running things among House Republicans. WIRED reached out to a slew of Republican leaders—former speaker McCarthy, speaker pro tem Patrick McHenry, former speaker-designate Scalise, majority whip Tom Emmer, and GOP conference chair Elise Stefanik—asking who made the call to temporarily confiscate member’s phones this week. None responded.

With no one in charge, everyone’s in charge. Each member of Congress is coached to run their office like a business, with each serving as the CEO, CFO, and mascot. Who’s Cupid without a bow and arrow? Ask a phoneless politician.

“Oh, wow. Really?” John Larson, a Connecticut Democrat, says after WIRED informs him of his rowdy Republican neighbor’s new no-phone rule. “It goes to show you the level of trust in this place, huh?”

It’s not unheard of for lawmakers to be stripped of their devices. US senators had to check their phones and tablets when they sat as the jury for former US president Donald Trump’s two impeachments. They were also only allowed to drink water and milk (yeah, it’s a thing).

Lawmakers also turn over their personal and government-issued devices before heading into classified briefings, like the one House members had Wednesday morning on the Israel-Hamas war. Most of the time, like the rest of us, lawmakers’ fingers are all but one with their screens.

“One of the members said to me—I won’t say who she was—she goes, ‘I need my phone!’” Smith, the New Jersey lawmaker, says with a laugh. “It is a different world. For a while there, all of us went to our grandkids or kids to figure out how to use these things. Now we got it down, and we can't stop it!”

But stop they did. Many Republicans report that these deviceless—and largely staffless—meetings are a welcome change. “I think it does help. Looking over at your colleague, wondering if he's the one livestreaming it, it foments mistrust,” Thomase Massie, a Republican Kentuckian, tells WIRED. “I think you have more direct, but coarser, conversations if there aren’t witnesses in the room. You’re missing the good stuff!”

Still, Massie is attuned to the complaints from the base about secret meetings. “If we don't have some kind of public vote on the floor, or in conference, where everybody accounts for their own vote, I feel like they can claim this is a stolen election,” Massie says. “If you come out of a secret room, with a secret ballot, and say, ‘This is our choice. Take our word for it,’ I think a lot of people want to know how their congressmen voted, and they want them to prove it, either in a roll call here or on the floor.”

But confiscating rank-and-file Republicans’ devices didn’t heal the internet-fueled internal GOP rift barely hiding underneath the party’s near universal hatred of Joe Biden, love of tax cuts, and fear of Donald Trump. It merely paused the cage match again. And, as usual, some of McCarthy’s fiercest opponents are now the loudest critics of the clampdown on devices.

“It’s ridiculous, really,” Tim Burchett—the Tennessee Republican who partnered with Gaetz in orchestrating McCarthy’s demise—tells WIRED. “You know someone’s gonna walk out and tell it.”

If anything, the no-phone rule is only fueling the Republican Party’s new ranks of conspiracy-laden conservatives. Burchett doesn’t know who made the call—but he blames McCarthy anyway. “That’s part of his leadership team that’s in place still,” Burchett says. “It'll work for a little while, and then somebody will figure something out.”

That Escalated Quickly—and Is Far From Over

Burchett, Gaetz, Marjorie Taylor Greene, and their fellow GOP hardliners were leaders of the transparency pack ahead of McCarthy’s ouster. Problem is, the public is now locked out of their private feeding frenzy at the feet of the party’s next generation of potential power brokers.

Just as McCarthy did in January, Scalise hosted holdouts and opponents alike for private meetings. While Republicans were encouraged to personally air their concerns and demands alike to his face, something was different this time, at least according to former speaker-designate Scalise.

“No side deals,” Scalise told reporters huddled outside an impromptu Thursday afternoon GOP conference meeting. “Let’s have this in full view of everybody. No side deals. No secret meetings.”

Full view? Just no phones allowed. No side deals either? Just private one-on-one conversations with some of the most expensive—morally speaking, at the very least—votes to buy on Capitol Hill.

Just as McCarthy did in January, Scalise moved further right—or at least did all he could to placate holdouts. It seemed to be working, just as it did for McCarthy—until it didn’t.

The towel came flying in after just one day of private confabs with the farthest-flung rightward wing of today’s rightward-tilting GOP. Scalise flipped at least one vote, but at what cost? Freshman Anna Paulina Luna is a Floridian who was slingshotted into this 118th Congress via her previous perch as a so-called social media influencer. Scalise denies doling out promises, and Luna refuses to say how the majority leader won her trust and met her demand.

All we know is, Scalise flipped her from a no to a yes. And she left the private meeting satisfied, feeling confident he met each one of the three bright red lines she’s publicly drawn in the proverbial political sands: impeaching Biden, slapping his son Hunter Biden with a subpoena, and defunding special counsel Jack Smith, thus halting the two federal cases he’s spearheading against Trump.

"After talking to Representative Scalise, I feel very confident that he's going to allow me to aggressively pursue justice for this country and this nation," Luna told reporters after meeting with Scalise on Wednesday. "He will be aggressively allowing me to pursue and do my job."

That’s a lot of weighty demands for anyone to placate in one day. One down, but Scalise still had 106 or so to go. Many were adamantly unbudgeable, even if they did go through the formal motions of sitting down with Scalise. The de-phoning experiment failed to unite the GOP’s new ranks of partisans, so vulnerable members are now demanding party leaders try other out-of-the-box options.

“We have to have something that takes the personality and emotion out of it,” says Marc Molinaro, a freshman Republican from New York. “At the end of the day, in the conference, we have to have a deliberative effort to get from whatever number the top vote getter has to 217. That has to happen in a deliberative way. We didn't have that the last few days.”

Frustration turned to anger after McCarthy was pushed out. Now, after more than a week of the House being ground to a halt by the majority party, embarrassment is now transforming into desperation. Ineptitude is not a good look, which speaker pro tem Patrick McHenry understands. When WIRED asks if Molinaro’s got any new ideas to try next, the former government relations consultant’s mind darts to a recent closed-door conversation he had with McHenry.

“Patrick McHenry suggested we don't get food or water, and maybe that will help,” Molinaro tells WIRED. “That was a joke. I don't want people to think he's gonna starve us.”

Like good policy, all good humor is grounded in reality, no? The unanswered question—one hovering ominously over all US politics these days—is, do Republicans live in the same reality as, well, Republicans? MAGA’s now passé—a distinction without a difference, really. That is, unless centrist Republicans actually declare the difference. That’s a step too far for most tenets cramped in Trump’s new small-tent GOP. Scalise gets the distinction, but he stops short of defining the difference.

"There's some folks that really need to look in the mirror over the next couple of days and decide are we going to get back on track, or if they're going to pursue their own agenda," Scalise told reporters at the Capitol Thursday night. That’s the same tightrope McCarthy—who only was granted his recently retired gavel in the 15th bruising round of speaker votes back in January—teetered on throughout his tenuous nine-month tenure. It’s also much like the one Senate minority leader Mitch McConnell has delicately maneuvered around—or sidestepped—on the other side of the Capitol. Center-right Republicans seem to finally be standing up to minority rule of their majority.

“It shows a structural problem,” Michael Waltz, a third-term Floridia Republican, tells WIRED. “You have to, in a republic, be able to rule by majority vote, and when we have a structural problem that came out of January where we can't, then I think that's gotta be fixed.”

Scalise’s surrender seems to have dislodged something. Some Republicans say it’s time to call on the House parliamentarian—the chamber’s procedural brain trust—to see if there’s an obscure loophole they can use to bypass this latest Republican blockade of Republicans. “There’s suggestion of that, but I don't see consensus around that,” Waltz says, even as he says tweaking internal party rules is different than overhauling House rules. “We're gonna be addressing our rules.” For now, the majority of the GOP don’t dare tamper with House rules, in no small part because Trump’s base is enlivened, engaged, and digitally screaming at the party’s rank and file.

Thing is, all of this was inevitable. “We knew this. I felt this in November when we, sadly, won with such a slim majority,” Chuck Fleischmann, a seven-term Tennessean, tells WIRED. “You could feel the difficulties of that slim majority present at that time. It just came into fruition 10 months later.”

Inevitable sure; painful nonetheless. Scalise is affable, genuine, and beloved by many, especially as he currently battles cancer after surviving a mass shooting just six years ago.

“The mood is pensive. There was a little bit of surprise there,” Fleischmann says. “This is not going to be an easy process. We had an historic event last week—a first, the vacating of the chair—so moving forward in these uncharted waters, in these uncharted times, is going to be difficult with a very slim majority.”

Slim and divided. Moments after Scalise and his entourage of aides and suit-donning officers left the Capitol Thursday evening, his inglorious departure was already a distant memory to second-term Michelle Fischbach of Minnesota.

“I’m looking for my phone,” the flustered congresswoman fretted, rifling through the huge handbag she set on a bronze-rimmed trash can in the Capitol’s dingy basement. When asked if she was frustrated by how the day ended, with Scalise’s walk of shame before his political family and the press corps, Fischbach spoke up on behalf of the minority of the minority of the majority party, telling WIRED, “It’s more frustrating that I can’t find my phone.”

The frustration is palpable.

US House Republicans Had Their Phones Confiscated to Stop Leaks

Dubbed “HTTP/2 Rapid Reset,” the flaw requires issuing patches to virtually every web server around the world before the problem can be eradicated.

Google, Amazon, Microsoft, and Cloudflare revealed this week that they battled massive, record-setting distributed denial of service attacks against their cloud infrastructure in August and September. DDoS attacks, in which attackers attempt to overwhelm a service with junk traffic to bring it down, are a classic internet menace, and hackers are always developing new strategies to make them bigger or more effective. The recent attacks were particularly noteworthy, though, because hackers generated them by exploiting a vulnerability in a foundational web protocol. This means that while patching efforts are well underway, fixes will need to essentially reach every web server globally before these attacks can be fully stamped out.

Dubbed “HTTP/2 Rapid Reset,” the vulnerability can only be exploited for denial of service—it doesn't allow attackers to remotely take over a server or exfiltrate data. But an attack doesn't need to be fancy to cause major problems—availability is vital for access to any digital service, from critical infrastructure to crucial information.

“DDoS attacks can have wide-ranging impacts to victim organizations, including loss of business and unavailability of mission-critical applications,” Google Cloud's Emil Kiner and Tim April wrote this week. “Time to recover from DDoS attacks can stretch well beyond the end of an attack.”

Another facet of the situation is where the vulnerability came from. Rapid Reset isn't in a particular piece of software but in the specification for the HTTP/2 network protocol used for loading webpages. Developed by the Internet Engineering Task Force (IETF), HTTP/2 has been around for about eight years and is the faster, more efficient successor to the classic internet protocol HTTP. HTTP/2 works better on mobile and uses less bandwidth, so it has been extremely widely adopted. IETF is currently developing HTTP/3.

“Because the attack abuses an underlying weakness in the HTTP/2 protocol, we believe any vendor that has implemented HTTP/2 will be subject to the attack,” Cloudflare's Lucas Pardue and Julien Desgats wrote this week. Though it seems that there are a minority of implementations that are not impacted by Rapid Reset, Pardue and Desgats emphasize that the problem is broadly relevant to "every modern web server.”

Unlike a Windows bug that gets patched by Microsoft or a Safari bug that gets patched by Apple, a flaw in a protocol can't be fixed by one central entity because each website implements the standard in its own way. When major cloud services and DDoS-defense providers create fixes for their services, it goes a long way toward protecting everyone who uses their infrastructure. But organizations and individuals running their own web servers need to work out their own protections.

Dan Lorenc, a longtime open source software researcher and CEO of the software supply chain security company ChainGuard, points out that the situation is an example of a time when the availability of open source and the prevalence of code reuse (versus always building everything from scratch) is an advantage, because many web servers have likely copied their HTTP/2 implementation from somewhere else rather than reinvent the wheel. If these projects are maintained, they will develop Rapid Reset fixes that can proliferate out to users.

It will take years to reach full adoption of these patches, though, and there will still be some services that did their own HTTP/2 implementation from scratch and don't have a patch coming from anywhere else.

“It's important to note that the big tech companies discovered this while it was being actively exploited,” Lorenc says. “It can be used to take a service down like operational tech or industrial control. That’s scary.”

Though the string of recent DDoS attacks on Google, Cloudflare, Microsoft, and Amazon raised the alarm for being so large, the companies were ultimately able to repel the attacks, which didn't cause lasting damage. But just by carrying out the assaults, hackers revealed the existence of the protocol vulnerability and how it could be exploited—a cause and effect known in the security community as “burning a zero day.” Even though the patching process will take time, and some web servers will remain vulnerable long term, the internet is safer now than if attackers hadn't shown their cards by exploiting the flaw.

“A bug like this in the standard is unusual, it's a novel vulnerability and was a valuable finding for whoever first discovered it,” Lorenc says. “They could have saved it or even probably sold it for a lot of money. I'm always going to be curious about the mystery of why someone decided to burn this one.”

Source

Wired