An indictment against three Americans suggests that at least some of the culprits behind the theft of an FTX crypto fortune may be in custody.

When more than $400 million worth of crypto was mysteriously pulled out of the coffers of what was once the world's biggest cryptocurrency exchange, FTX, on the very day that it declared bankruptcy in November of 2022, many initially suspected insiders at the company—including, potentially, then CEO Sam Bankman-Fried, now convicted of fraud. But clues left across blockchains over the past year suggested instead that external thieves had chosen a particularly inconvenient moment during FTX's meltdown to pull off an enormous heist.

Now, new clues revealed in a US Department of Justice indictment suggest something even more surprising: Some of those suspected thieves appear to have been in the United States and have now been arrested.

An indictment filed last week details charges against three people—Robert Powell, Carter Rohn, and Emily Hernandez—who are accused of running a massive cybercriminal theft ring. The group, which authorities say was known as the “Powell SIM Swapping Crew,” allegedly used SIM swaps—tricking phone companies into switching a user's mobile phone registration to the thieves' SIM card so that they can gain access to authentication codes sent to the victim's phone—to steal hundreds of millions of dollars from victims' accounts.

Most notably, the gang is accused of siphoning $400 million in virtual currency from the accounts of a company—named in the indictment only as Victim Company-1—on the night of November 11, 2022, continuing into November 12. As first spotted by cybersecurity journalist Brian Krebs, that is also the exact timing of FTX's theft, which the company itself has pegged at between $415 million and $432 million in stolen crypto.

The blockchain analysis firm Elliptic corroborated Krebs' inference that the $400 million theft described in the report is almost certainly the FTX heist. “We are not aware of any other thefts from crypto businesses on this scale, on these dates,” Elliptic wrote in a blog post. “It therefore appears likely that FTX is the ‘Victim Company-1’ named in the indictment.”

FTX didn't immediately respond to WIRED's request for comment on whether it is the SIM-swapping victim described in the indictment.

If the indictment does, in fact, describe the FTX theft—and given the relative rarity of nine-figure crypto thefts and the exact timing of this one—then the charging document reveals key details about how the FTX heist was pulled off. It describes how Powell allegedly asked Hernandez to target a specific phone number for SIM-swapping. According to prosecutors, Hernandez then obtained a fake ID with her photo but the name of her victim—potentially an FTX staffer—and presented it at an AT&T retail store in Texas to prove her identity as she requested that the staffer's account be transferred to her own phone.

That allowed the group to hijack messages intended for the victim, including authentication codes for his or her account, according to the indictment. Given that those codes usually represent a second-factor authentication mechanism required after a user enters their username and password, it’s not clear how those other credentials might have been stolen, though cybercriminals typically obtain them through phishing, credential-stealing malware, or trying credentials leaked in other database dumps and potentially reused across accounts.

The possibility that the FTX thieves have been identified as Americans, within reach of US law enforcement, comes as a surprise following Elliptic’s discovery in October of last year that the crypto stolen from FTX had moved across blockchains and through cryptocurrency swapping services in a way that suggested Russia-linked money launderers. Portions of the funds, for instance, moved through mixing services—which take in users’ funds and return others to muddy the trail of any blockchain tracing—that are popular with Russian cybercriminals, such as ChipMixer and Sinbad.

Both mixers, in fact, have been sanctioned by the US Treasury Department for their illicit use, including by Russian ransomware gangs. “It’s looking increasingly likely that the perpetrator has links to Russia,” Elliptic’s chief scientist and cofounder Tom Robison told WIRED in October. “We can’t attribute this to a Russian actor, but it’s an indication it might be.”

If the money is FTX's, those blockchain footprints suggest that the $400 million that the hackers allegedly stole is long gone, moved into the hands of international money launderers. “It is therefore not clear whether any of the stolen assets are under their control, and might be recovered,” Elliptic wrote in its blog post today. Nonetheless, if the alleged hackers were paid a portion of that sum in exchange for their work to steal it, that money might still be seized and repaid as restitution to FTX’s many creditors.

Either way, it suggests that another mystery in the story of FTX’s implosion and the billions of dollars in missing funds that disappeared with it may be at least partially solved. If so, it would seem this FTX-related crime, at least, can’t be blamed on Sam Bankman-Fried.

The Mystery of the $400 Million FTX Heist May Have Been Solved

A loose coalition of anti-censorship voices is working to highlight reports of one Indian company’s hacker-for-hire past—and the legal threats aimed at making them disappear.

Hacker-for-hire firms like NSO Group and Hacking Team have become notorious for enabling their customers to spy on vulnerable members of civil society. But as far back as a decade ago in India, a startup called Appin Technology and its subsidiaries allegedly played a similar cyber-mercenary role while attracting far less attention. Over the past two years, a collection of people with direct and indirect links to that company have been working to keep it that way, using a campaign of legal threats to silence publishers and anyone else reporting on Appin Technology’s alleged hacking past. Now, a loose coalition of anti-censorship voices is working to make that strategy backfire.

For months, lawyers and executives with ties to Appin Technology and to a newer organization that shares part of its name, called the Association of Appin Training Centers, have used lawsuits and legal threats to carry out an aggressive censorship campaign across the globe. These efforts have demanded that more than a dozen publications amend or fully remove references to the original Appin Technology’s alleged illegal hacking or, in some cases, mentions of that company’s cofounder, Rajat Khare. Most prominently, a lawsuit against Reuters brought by the Association of Appin Training Centers resulted in a stunning order from a Delhi court: It demanded that Reuters take down its article based on a blockbuster investigation into Appin Technology that had detailed its alleged targeting and spying on opposition leaders, corporate competitors, lawyers, and wealthy individuals on behalf of customers worldwide. Reuters “temporarily” removed its article in compliance with that injunction and is fighting the order in Indian court.

As Appin Training Centers has sought to enforce that same order against a slew of other news outlets, however, resistance is building. Earlier this week, the digital rights group the Electronic Frontier Foundation (EFF) sent a response—published here—pushing back against Appin Training Centers’ legal threats on behalf of media organizations caught in this crossfire, including the tech blog Techdirt and the investigative news nonprofit MuckRock.

No media outlet has claimed that Appin Training Centers—a group that describes itself as an educational firm run in part by former franchisees of the original Appin Technology, which reportedly ceased its alleged hacking operations more than a decade ago—has been involved in any illegal hacking. In December, however, Appin Training Centers sent emails to Techdirt and MuckRock demanding they too take down all content related to allegations that Appin Technology previously engaged in widespread cyberspying operations, citing the court order against Reuters.

Techdirt, Appin Training Centers argued, fell under that injunction by writing about Reuters' story and the takedown order targeting it. So had MuckRock, the plaintiffs claimed, which hosted some of the documents that Reuters had cited in its story and uploaded to MuckRock's DocumentCloud service. In the response sent on their behalf, the EFF states that the two media organizations are refusing to comply, arguing that the Indian court's injunction “is in no way the global takedown order your correspondence represents it to be.” It also cites an American law called the SPEECH Act that deems any foreign court’s libel ruling that violates the First Amendment unenforceable in the US.

“It's not a good state for a free press when one company can, around the world, disappear news articles,” Michael Morisy, the CEO and cofounder of MuckRock, tells WIRED. “That's something that fundamentally we need to push back against.”

Techdirt founder Mike Masnick says that, beyond defeating the censorship of the Appin Technology story, he hopes their public response to that censorship effort will ultimately bring even more attention to the group’s past. In fact, 19 years ago, Masnick coined the term “the Streisand effect” to describe a situation in which someone's attempt to hide information results in its broader exposure—exactly the situation he hopes to help create in this case. “The suppression of accurate reporting is problematic,” says Masnick. “When it happens, it deserves to be called out, and there should be more attention paid to those trying to silence it.”

The anti-secrecy nonprofit Distributed Denial of Secrets (DDoSecrets) has also joined the effort to spark that Streisand Effect, “uncensoring” Reuters' story on the original Appin Technology as part of a new initiative it calls the Greenhouse Project. DDoSecrets cofounder Emma Best says the name comes from its intention to foster a “warming effect”—the opposite of the “chilling effect” used to describe the self-censorship created by legal threats. “It sends a signal to would-be censors, telling them that their success may be fleeting and limited,” Best says. “And it assures other journalists that their work can survive.”

Neither Appin Training Centers nor Rajat Khare responded to WIRED's request for comment, nor did Reuters.

The fight to expose the original Appin Technology’s alleged hacking history began to reach a head in November of 2022, when the Association for Appin Training Centers sued Reuters based only on its reporters’ unsolicited messages to Appin Training Centers’ employees and students. The company’s legal complaint, filed in India’s judicial system, accused Reuters not only of defamation, but “mental harassment, stalking, sexual misconduct and trauma.”

Nearly a full year later, Reuters nonetheless published its article, “How an Indian Startup Hacked the World.” The judge in the case initially sided with Appin Training Centers, writing that the article could have a “devastating effect on the general students population of India.” He quickly ordered an injunction stating that Appin Training Centers can demand Reuters take down their claims about Appin Technology.

That ruling has preceded any legal arguments over the truth of Reuters’ reporting, which the news agency has promised to bring up in an appeal. In fact, Reuters wrote that it based its story on interviews with dozens of Appin Technology's former staff and hundreds of alleged targets, as well as thousands of its internal documents. Those files include Appin Technology's marketing pitch documents that remain publicly available on DocumentCloud thanks to MuckRock, and appear to show the company explicitly offering to hack targets on behalf of clients via “phishing,” “social engineering,” “trojan” infections, and even discussing specific cases when clients hired them for hacking operations.

Appin Training Centers, for its part, argues that it’s merely a collection of educational institutions whose brand has been tarnished by Reuters’ reporting. Reuters has responded in a legal filing arguing that Appin Training Centers was created “solely for purposes of this lawsuit, with ulterior motive,” and pointed out, through an exhibit attached to a court filing, that it was incorporated only months _after_ it named itself as the plaintiff suing Reuters.

Even so, a little more than two weeks after publishing its investigation into Appin Technology, on December 5, Reuters complied with the Indian court's injunction, removing its story. Soon, in a kind of domino effect of censorship, others began to take down their own reports about Appin Technology after receiving legal threats based on the same injunction. SentinelOne, the cybersecurity firm that had helped Reuters in its investigation, removed its research on an Appin Technology subsidiary’s alleged hacking from its website. The Internet Archive deleted its copy of the Reuters article. The legal news site Lawfare and cybersecurity news podcast Risky Biz both published analyses based on the article; Risky Biz took its podcast episode down, and Lawfare overwrote every part of its piece that referred to Appin Technology with Xs. WIRED, too, removed a summary of Reuters' article in a news roundup after receiving Appin Training Centers' threat.

Aside from the injunction that Appin Training Centers has used to demand publishers censor their stories, Appin cofounder Rajat Khare has separately sent legal threats to another collection of news outlets based on a court order he obtained in Switzerland. Two Swiss publications have publicly noted that they responded to court orders by removing Khare’s name from stories about alleged hacking. Others have removed Khare’s name or removed the articles altogether without a public explanation, including the Bureau of Investigative Journalism, the UK’s _Sunday Times_, several Swiss and French news outlets, and eight Indian ones.

“This is an organization throwing everything against the wall, trying to make as many allegations in as many venues as possible in the hopes that something, somewhere sticks,” says one person at a media outlet that has received multiple legal threats from people connected to Appin Technology, who declined to be named due to the legal risks of speaking out. “Sometimes it works, sometimes it doesn’t. Unfortunately, in India, it’s worked.”

Even before the EFF, Techdirt, MuckRock, and DDoSecrets began to push back against that censorship, some had immediately resisted it. _The New Yorker_, for instance, had mentioned a subsidiary of Appin Technology and Rajat Khare in a feature about India's hacker-for-hire industry in June of last year. It was sued by Appin Training Centers, but has kept its piece online while the lawsuit proceeds. (_The New Yorker_ and WIRED are both published by Condé Nast.) Ronald Deibert, a well-known security researcher and founder of the University of Toronto's Citizen Lab, a group that focuses on exposing hackers who target members of civil society, had also mentioned Appin Technology in a blog post. Deibert received and refused Appin Training Centers' takedown threat, posting a screenshot of its email to his X feed in December along with his response: seven middle-finger emojis.

As the backlash to the censorship of reporting on Appin Technology's alleged hacking snowballs, however, it may now be going beyond a few cases where Appin Training Centers’ and Rajat Khare’s censorship attempts have failed, says Seth Stern, director of advocacy for the Freedom of the Press Foundation, who has written about the censorship campaign. Instead, it may be backfiring, he says, particularly for Appin Technology cofounder Rajat Khare. “It does seem like a sort of dubious strategy to be stirring this up now, and I do wonder if he is starting to regret that given the coverage it's getting,” says Stern. “You could easily see that it'll do more reputational harm than good for Khare and for Appin.”

MuckRock's Morisy says that attention is exactly the intention of his move, along with Techdirt and the EFF, to put a spotlight on the legal threats they've received. “It’s leveraging the Streisand effect to an extent. But also just finding ways to push back,” says Morisy. “There needs to be a cost for groups that are trying to silence journalists.”

A Startup Allegedly ‘Hacked the World.’ Then Came the Censorship—and Now the Backlash

For nearly two years, police have been tracking down the culprit behind a wave of hoax threats. A digital trail took them to the door of a 17-year-old in California.

A California teenager prosecutors say is responsible for hundreds of swatting attacks around the United States was exposed after law enforcement pieced together a digital trail left on some of the internet’s largest platforms, according to court records released this week.

Alan Winston Filion, a 17-year-old from Lancaster, California, faces four felony charges in Florida’s Seminole County related to swatting, or fake threats called into the police to provoke a forceful response, according to Florida state prosecutors. Police arrested Filion on January 18, and he was extradited to Seminole County this week.

Filion’s arrest, first reported by WIRED on January 26, marks the culmination of a multi-agency manhunt for the person police claim is responsible for swatting attacks on high schools, historically black colleges and universities, mosques, and federal agents, and for threats to bomb the Pentagon, members of the United States Senate, and the US Supreme Court. Ultimately, a YouTube channel, Discord chats, and usernames related to _The Lord of the Rings_ helped lead authorities to Filion’s doorstep.

Florida prosecutors charged Filion with four felony counts, including three related to allegedly making false reports to law enforcement and one for unlawful use of a two-way radio for “facilitating or furthering an act of terrorism” that authorities say targeted people based on race, religion, or other protected classes. While prosecutors alleged that Filion “is responsible for hundreds of swatting and bomb threat incidents throughout the United States,” the charges Filion faces relate to a single May 12, 2023, swatting attack against the Masjid Al Hayy Mosque in Sanford, Florida.

An attorney for Filion was not immediately available to respond to WIRED’s request for comment.

More than a year before the swatting attack on the Florida mosque, agents with the US Federal Bureau of Investigation interviewed Filion’s father, William, at his home in Lancaster, California, according to court documents made public on Wednesday. The interview took place on April 21, 2022, the same day the owner of a Telegram channel linked to swatting activity posted, “SOMEONE JUST REPORTED ME TO THE FBI… LOL!”

In October 2022, authorities investigating swatting incidents involving calls made to a school in Anacortes, Washington, came across a Telegram user associated with multiple swatting and doxing channels. The user, “Nazgul Swattings,” had claimed responsibility in one of these channels for the threats to the Washington schools, according to the same court documents.

Over the following months, court records say, the FBI monitored channels linked to this user. One of those, a channel called Torswats (formerly Nazgul Swats), had shared recordings of nearly 20 hoax calls threatening locations around the country, including schools in Iowa, Louisiana, Maryland, Oklahoma, Pennsylvania, and Texas.

As the FBI tracked Torswats’ public channels, Brad “Cafrozed” Dennis, a private investigator, was running his own parallel investigation on behalf of high-profile Twitch streamers who’d been swatted. In December, Dennis reached out to a user behind Torswats and asked to chat on a peer-to-peer chatting service called Tox under the guise of ordering a swat. According to records shared with WIRED, not mentioned in the arrest warrant, while interacting on Tox, Dennis used Wireshark to monitor his network traffic. In the process, he uncovered an IP address and the username “Paimon Arnum,” which was previously unknown to law enforcement.

YouTube, Discord, and ‘Lord of the Rings’ Led Police to a Teen Accused of a US Swatting Spree

Plus: Google fixes dozens of Android bugs, Microsoft rolls out nearly 50 patches, Mozilla squashes 15 Firefox flaws, and more.

Later in January, Google released Chrome 121 to the stable channel, fixing 17 security issues, three of which are rated as having a high impact. These include CVE-2024-0807, a use-after-free flaw in WebAudio, and CVE-2024-0812, an inappropriate implementation vulnerability in accessibility. The final high-impact vulnerability is CVE-2024-0808, an integer underflow in WebUI.

Obviously, these updates are important, so check and apply them as soon as you can.

Microsoft

Microsoft’s January Patch Tuesday squashes nearly 50 bugs in its popular software, including 12 remote code execution (RCE) flaws.

No security holes included in this month’s set of updates are known to have been used in attacks, but notable flaws include CVE-2024-20677, a bug in Microsoft Office that could allow attackers to create malicious documents with embedded FBX 3D model files to execute code.

To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint, and Outlook for Windows and Mac. Versions of Office that had this feature enabled will no longer have access to it, Microsoft said.

Meanwhile, CVE-2024-20674 is a Windows Kerberos security feature bypass vulnerability rated as critical with a CVSS score of 8.8. In one scenario for this vulnerability, the attacker could convince a victim to connect to an attacker-controlled malicious application, Microsoft said. “Upon connecting, the malicious server could compromise the protocol,” the software giant added.

Mozilla Firefox

Hot on the heels of its market-dominant competitor Chrome, Mozilla’s Firefox has patched 15 security flaws in its latest update. Five of the bugs are rated as having a high severity, including CVE-2024-0741, an out-of-bounds write issue in Angle that could allow an attacker to corrupt memory, leading to an exploitable crash.

An unchecked return value in TLS handshake code tracked as CVE-2024-0743 could also cause an exploitable crash.

CVE-2024-0755 covers memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. “Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code,” Mozilla said.

Cisco

Enterprise software giant Cisco has patched a vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products that could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device.

Tracked as CVE-2024-20253 and with a whopping CVSS score of 9.9, Cisco said an attacker could exploit the vulnerability by sending a crafted message to a listening port of an affected device.

“A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user,” Cisco said. “With access to the underlying operating system, the attacker could also establish root access on the affected device,” it warned.

SAP

SAP has issued 10 new security fixes as part of its January Security Patch Day, which includes several issues with a CVSS score of 9.1. CVE-2023-49583 is an escalation-of-privilege issue in applications developed through SAP Business Application Studio, SAP Web IDE Full-Stack, and SAP Web IDE for SAP HANA.

Meanwhile, CVE-2023-50422 and CVE-2023-49583 are escalation-of-privilege issues in SAP Edge Integration Cell.

Another notable flaw is CVE-2024-21737, a code injection vulnerability in SAP Application Interface Framework, which has a CVSS score of 8.4. “A vulnerable function module of the application allows an attacker to traverse through various layers and execute OS commands directly,” security firm Onapsis said. “Successful exploits can cause considerable impact on confidentiality, integrity, and availability of the application.”

Apple and Google Just Patched Their First Zero-Day Flaws of the Year

Aerial drones have changed the war in Ukraine. Now, both Russia’s and Ukraine’s militaries are deploying more unmanned ground robots—and the two are colliding.

Near the Ukrainian city of Avdiivka, a boxy robot zips along the rocky, cracked road. Snaking from side to side, the robot—a four-wheeled machine, around knee height—carries cargo and ammunition for Russian troops. However, it’s being watched. Hovering above the road, tracking the movements of the robot, is a Ukrainian drone. Suddenly, another drone smashes into the robot, blowing it to pieces.

The attack, which happened in early December and was claimed by the Ukrainian military’s 110th Mechanized Brigade, is one of a small but growing number of incidents where unsophisticated robots have been used against other robots in Russia’s war in Ukraine. Aerial drones have been used to surveil or attack ground robots, soldiers have attached weapons to land-based robots, and other small unmanned bots are being fitted with jamming technology to knock drones from the sky.

Since Russia’s full-scale invasion in February 2022, small aerial drones have played an outsize role in the war in Ukraine—with thousands of drones being used to monitor the battlefield, watch enemy movements, and carry explosives. Videos produced by Ukrainian and Russian soldiers show the drones, which are often first-person view (FPV) drones, being used to attack tanks and troops. As the war has raged on, another kind of robot has increasingly appeared in recent months: the unmanned ground vehicle, or UGV.

“There’s lots of unmanned ground vehicle development happening,” says Samuel Bendett, a Russia analyst at the think tank Center for Naval Analyses who tracks military drone and robotics technology use. Most of the UGVs being developed or used are small robots, Bendett says, as larger vehicles will be tracked, observed, and attacked with FPV and other aerial drones. “The Ukrainian battlefield is saturated with aerial sensors that basically track and attack anything that moves,” he says. That includes other robots.

The UGVs being developed within the war are typically four- or six-wheeled machines that can be kitted out for multiple purposes. There are logistics robots, which can carry supplies to the front lines; evacuation robots that carry injured people; and robots linked to combat such as those that can place or destroy landmines and have explosives or weapons attached. These robots are largely remote-controlled by humans—there’s little autonomy—and operate over ranges of a few kilometers.

UGVs themselves are not new. Some of the earliest UGVs were created in World War II and used as explosive devices, while they have also appeared in other conflicts. Most Russian UGV developments so far have been homemade or DIY, Bendett says, with troops or volunteers creating robots for specific tasks or needs. Ukraine has, to date, put more military effort into developing ground robots, with the government stating its ambition to build an “army of robots.”

Videos from within Ukraine, first shared on Telegram channels and reviewed by analysts such as Bendett, show a Russian drone monitoring a Ukrainian UGV as it trundles along laying mines. In another video, a small six-wheeled robot approaches a downed drone, lifting up its wings, before troops approach it. A third shows drones trying to destroy UGVs moving along the ground. In one demonstration, a person is dragged behind a UGV along the ground. Earlier in January, Mykhailo Fedorov, Ukraine’s deputy prime minister, announced a UGV with an “automated turret” that, he said, can also transport ammunition and provisions to fighters.

Robots Are Fighting Robots in Russia's War in Ukraine

Members of Congress say the DOJ is funding the use of AI tools that further discriminatory policing practices. They're demanding higher standards for federal grants.

The United States Department of Justice has failed to convince a group of US lawmakers that state and local police agencies aren't awarded federal grants to buy AI-based “policing” tools known to be inaccurate, if not prone to exacerbating biases long observed in US police forces.

Seven members of Congress wrote in a letter to the DOJ, first obtained by WIRED, that the information they pried loose from the agency had only served to inflame their concerns about the DOJ’s police grant program. Nothing in its responses so far, the lawmakers said, indicates the government has bothered to investigate whether departments awarded grants bought discriminatory policing software.

“We urge you to halt all Department of Justice grants for predictive policing systems until the DOJ can ensure that grant recipients will not use such systems in ways that have a discriminatory impact,” the letter reads. The Justice Department previously acknowledged that it had not kept track of whether police departments were using the funding, awarded under the Edward Byrne Memorial Justice Assistance Grant Program, to purchase so-called predictive policing tools.

Led by Senator Ron Wyden, a Democrat of Oregon, the lawmakers say the DOJ is required by law to “periodically review” whether grant recipients comply with Title VI of the nation’s Civil Rights Act. The DOJ is patently forbidden, they explain, from funding programs shown to discriminate on the basis of race, ethnicity, or national origin, whether that outcome is intentional or not.

Independent investigations in the press have found that popular “predictive” policing tools trained on historical crime data often replicate long-held biases, offering law enforcement, at best, a veneer of scientific legitimacy while perpetuating the over-policing of predominantly Black and Latino neighborhoods. An October headline from The Markup states bluntly: “Predictive Policing Software Terrible At Predicting Crimes.” The story recounts how researchers at the publication recently examined 23,631 police crime predictions—and found them accurate roughly 1 percent of the time.

“Predictive policing systems rely on historical data distorted by falsified crime reports and disproportionate arrests of people of color,” Wyden and the other lawmakers wrote, predicting—as many researchers have—that the technology serves only to create “dangerous” feedback loops. The statement notes that “biased predictions are used to justify disproportionate stops and arrests in minority neighborhoods,” further biasing statistics on where crimes occur.

Senators Jeffrey Merkley, Ed Markey, Alex Padilla, Peter Welch, and John Fetterman also cosigned the letter, as did Representative Yvette Clarke.

The lawmakers have requested that an upcoming presidential report on policing and artificial intelligence investigate the use of predictive policing tools in the US. “The report should assess the accuracy and precision of predictive policing models across protected classes, their interpretability, and their validity,” to include, they added, “any limits on assessing their risks posed by a lack of transparency from the companies developing them.”

Should the DOJ wish to continue funding the technology after this assessment, the lawmakers say, it should at least establish “evidence standards” to determine which predictive models are discriminatory—and then reject funding for all those that fail to live up to them.

US Lawmakers Tell DOJ to Quit Blindly Funding ‘Predictive’ Police Tools

Plus: North Korean hackers get into generative AI, a phone surveillance tool that can monitor billions of devices gets exposed, and ambient light sensors pose a new privacy risk.

Police took a digital rendering of a suspect's face, generated using DNA evidence, and ran it through a facial recognition system in a troubling incident reported for the first time by WIRED this week. The tactic came to light in a trove of hacked police records published by the transparency collective Distributed Denial of Secrets. Meanwhile, information about United States intelligence agencies purchasing Americans' phone location data and internet metadata without a warrant was revealed this week only after US senator Ron Wyden blocked the appointment of a new NSA director until the information was made public. And a California teen who allegedly used the handle Torswats to carry out hundreds of swatting attacks across the US is being extradited to Florida to face felony charges.

The infamous spyware developer NSO Group, creator of the Pegasus spyware, has been quietly planning a comeback, which involves investing millions of dollars lobbying in Washington while exploiting the Israel-Hamas war to stoke global security fears and position its products as a necessity. Breaches of Microsoft and Hewlett-Packard Enterprise, disclosed in recent days, have pushed the espionage operations of the well-known Russia-backed hacking group Midnight Blizzard back into the spotlight. And Amazon-owned Ring said this week that it is shutting down a feature of its controversial Neighbors app that gave law enforcement a free pass to request footage from users without a warrant.

WIRED had a deep dive this week into the Israel-linked hacking group known as Predatory Sparrow and its notably aggressive offensive cyberattacks, particularly against Iranian targets, which have included crippling thousands of gas stations and setting a steel mill on fire. With so much going on, we've got the perfect quick weekend project for iOS users who want to feel more digitally secure: Make sure you've upgraded your iPhone to iOS 17.3 and then turn on Apple's new Stolen Device Protection feature, which could block thieves from taking over your accounts.

And there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

After first disclosing a breach in October, the ancestry and genetics company 23andMe said in December that personal data from 6.9 million users was impacted in the incident stemming from attackers compromising roughly 14,000 user accounts. These accounts then gave attackers access to information voluntarily shared by users in a social feature the company calls DNA Relatives. 23andMe has blamed users for the account intrusions, saying that they only occurred because victims set weak or reused passwords on their accounts. But a state-mandated filing in California about the incident reveals that the attackers started compromising customers’ accounts in April and continued through much of September without the company ever detecting suspicious activity—and that someone was trying to guess and brute-force users' passwords.

North Korea has been using generative artificial intelligence tools “to search for hacking targets and search for technologies needed for hacking,” according to a senior official at South Korea's National Intelligence Service who spoke to reporters on Wednesday under the condition of anonymity. The official said that Pyongyang has not yet begun incorporating generative AI into active offensive hacking operations but that South Korean officials are monitoring the situation closely. More broadly, researchers say they are alarmed by North Korea's development and use of AI tools for multiple applications.

The digital ad industry is notorious for enabling the monitoring and tracking of users across the web. New findings from 404 Media highlight a particularly insidious service, Patternz, that draws data from ads in hundreds of thousands of popular, mainstream apps to reportedly fuel a global surveillance dragnet. The tool and its visibility have been marketed to governments around the world to integrate with other intelligence agency surveillance capabilities. “The pipeline involves smaller, obscure advertising firms and advertising industry giants like Google. In response to queries from 404 Media, Google and PubMatic, another ad firm, have already cut-off a company linked to the surveillance firm,” 404's Joseph Cox wrote.

Researchers from MIT’s Computer Science and Artificial Intelligence Laboratory have devised an algorithm that could be used to convert data from smart devices' ambient light sensors into an image of the scene in front of the device. A tool like this could be used to turn a smart home gadget or mobile device into a surveillance tool. Ambient light sensors measure light in an environment and automatically adjust a screen's brightness to make it more usable in different conditions. But because ambient light data isn't considered to be sensitive, these sensors automatically have certain permissions in an operating system and generally don't require specific approval from a user to be used by an app. As a result, the researchers point out that bad actors could potentially abuse the readings from these sensors without users having recourse to block the information stream.

23andMe Failed to Detect Account Intrusions for Months

A California teenager who allegedly used the handle Torswats to carry out a nationwide swatting campaign is being extradited to Florida to face felony charges, WIRED has learned.

For more than a year, the United States Federal Bureau of Investigation has been hunting the person whom experts say is one of the most prolific swatters in American history. Law enforcement now believes they have finally arrested the person responsible.

A 17-year-old from California is allegedly the swatter known as Torswats, according to sources familiar with the investigation. The teenager is currently in custody and awaiting extradition from California to Seminole County, Florida. The Florida State Attorney’s Office tells WIRED that he faces four felony counts.

Seminole County, located in central Florida, had two high-profile swatting incidents within the last 12 months, including one targeting a mosque and another targeting a courthouse. Todd Brown, a spokesperson for Florida’s Office of the State Attorney in the 18th Circuit, confirmed the charges against the teen and his extradition. Brown says he will be prosecuted as an adult under Florida law. WIRED is withholding the 17-year-old’s name because he is a minor.

The teenager’s arrest comes in the midst of a nationwide swatting surge. Swatting attacks typically involve someone calling in fake attacks to 911 in an attempt to solicit an overwhelming police response. Since Christmas, swatters have targeted the homes of prominent politicians from both parties, judges handling cases involving former US president Donald Trump, and the director of the US Cybersecurity and Infrastructure Security Agency.

Prior to these high-profile swats, a relentless campaign from different, potentially foreign, swatting groups targeted hundreds of schools and universities around the US over the past year and a half. Last May, an officer in Danvers, Massachusetts, accidentally fired his service weapon while responding to a school swat. In February, an officer in Saginaw Township, Michigan, rammed his vehicle through the school’s locked door to get inside the building following a swatting call.

According to the Florida State Attorney’s Office, the charges against the California teenager include making false reports concerning the planting of a bomb or the use of firearms, causing a law enforcement response. All charges are described as related to acts of terrorism and showing prejudice based on race, color, ancestry, ethnicity, or religion.

In private Telegram chats witnessed by WIRED over the past year, a person operating the Torswats handle claimed responsibility for hundreds of false reports of bomb threats and active shootings called into schools, politicians’ homes, courthouses, and religious institutions around the US.

Brad “Cafrozed” Dennis, a private investigator who works for high-profile Twitch streamers who've been swatted, has been hunting Torswats for nearly two years and actively helping the FBI’s investigation. “It’s a beautiful day,” Dennis says. “I am very relieved Tor will no longer be able to conduct his reign of terror on our schools and public officials just doing their jobs.”

According to records shared with WIRED, Dennis engaged someone using the Torswats handle on a peer-to-peer chatting service called Tox under the guise of ordering a swat in December 2022. By recording his network traffic, the investigator surreptitiously captured the swatter’s IP address along with a username that at the time was unknown to law enforcement. According to Dennis, in January 2023, he handed the evidence to the FBI special agents in charge of Torswats’ case. In emails shared with WIRED, the FBI told Dennis this information was used in subpoenas sent to YouTube and Discord. Court records related to the case against the California teen have not yet been made public.

Police Arrest Teen Said to Be Linked to Hundreds of Swatting Attacks

US spy agencies purchased Americans’ phone location data and internet metadata without a warrant but only admitted it after a US senator blocked the appointment of a new NSA director.

United States officials fought to conceal details of arrangements between US spy agencies and private companies tracking the whereabouts of Americans via their cell phones. Obtaining location data from US phones normally requires a warrant, but police and intelligence agencies routinely pay companies instead for the data, effectively circumventing the courts.

Ron Wyden, the US senator from Oregon, informed the nation’s intelligence chief, Avril Haines, on Thursday that the Pentagon only agreed to release details about the data purchases, which had always been unclassified, after Wyden hindered the Senate's efforts to appoint a new director of the National Security Agency. “The secrecy around data purchases was amplified,” Wyden wrote, “because intelligence agencies have sought to keep the American people in the dark."

Wyden's office says it’s been investigating sales of location data to the government for years, uncovering multiple ties between the Department of Defense and what the senator refers to as “shady companies" committing “flagrant violations” of people's privacy. The companies' practices are “not just unethical, but illegal,” he says.

Pentagon offices known to have purchased location data from these companies include the Defense Intelligence Agency and the NSA, among others. Wyden's letter, first reported by _The New York Times_, indicates that the NSA is also “buying Americans' domestic internet metadata.”

Wyden's disclosure comes amid a fight in the US House of Representatives over efforts to outlaw the purchases entirely. Last month, members of the House Judiciary Committee attached legislation doing so, known as the _Fourth Amendment Is Not For Sale Act_, to a bill reauthorizing a contentious surveillance program known as Section 702.

The bill, originally coauthored by Wyden, nearly received a vote last month during a showdown with rival legislation introduced by the House Intelligence Committee that does not seek to ban the purchases. Congressional sources tell WIRED the vote was called off at the last minute after Biden administration officials and members of the intelligence committee staged a campaign against the privacy-enhancing measures.

Intelligence officials in the House held separate meetings with members and their aides aiming to discourage support for the judiciary bill—the _Protect Liberty Act_—alleging that new warrant requirements would be overly burdensome for law enforcement, despite a slew of exemptions for cyberwarfare, terrorism, and espionage threats.

Six sources who attended the meetings told WIRED that intelligence committee members used images of Hamas militants in presentations to drive home its argument for relaxing limits on domestic surveillance. The message, Republican aides said, was, “it could happen here.” Three Democrats who attended meetings with representatives from the FBI, CIA, and NSA, among other agencies, described the presentation as a “scare tactic.”

The home surveillance debate, which has exploded in recent months, hampering the passing of routine legislation, has largely focused on Section 702, an authority under which the government monitors the calls, texts, and emails of foreign nationals. Section 702 is set to expire in under four months.

Both the _Protect Liberty Act_ and its intelligence committee rival—the _FISA Reform and Reauthorization Act_—aim to reauthorize Section 702 into the future. In how that's accomplished the bills are radically different. With access by the FBI to foreign intelligence for domestic investigations being the biggest point of contention, federal lawmakers can now effectively be divided into two factions: people who support surveillance warrants and people who don't.

The pro-warrant _Protect Liberty Ac_t could receive a vote as early as next month, with its provisions banning the government from buying data as a means of evading warrant requirements. Republicans on the Hill say they can't be sure whether House Speaker Mike Johnson will allow a vote, however, due to the intense amount of pressure he faces from the intelligence system.

“There is a lot of baloney going around about surveillance reform," Wyden says. “Probably because some surveillance supporters are worried they won’t win an honest debate.”

The Pentagon Tried to Hide That It Bought Americans’ Data Without a Warrant

Newly disclosed breaches of Microsoft and Hewlett-Packard Enterprise highlight the persistent threat posed by Midnight Blizzard, a notorious Russian cyber-espionage group.

Microsoft and Hewlett-Packard Enterprise (HPE) both recently disclosed that they suffered corporate email breaches at the hands of Russia's “Midnight Blizzard” hackers.

The group, which is tied to the Kremlin's SVR foreign intelligence, is specifically linked to SVR's APT 29 Cozy Bear, the gang that meddled in the United States 2016 presidential election, has conducted aggressive government and corporate espionage around the world for years, and was behind the infamous 2021 SolarWinds supply chain attack. While both HP's and Microsoft's breaches came to light within days of each other, the situation mainly illustrates the ongoing reality of Midnight Blizzard's international espionage activities and the lengths it will go to to find weaknesses in organizations' digital defenses.

“We shouldn't be surprised that Russian intelligence-backed threat actors, and SVR in particular, are targeting tech companies like Microsoft and HPE. With organizations that size, it would be a much bigger surprise to learn they weren't,” says Jake Williams, a former US National Security Agency hacker and current faculty member at the Institute for Applied Network Security.

HP Enterprise said in a US Securities and Exchange Commission submission posted on Wednesday that Midnight Blizzard gained access to its “cloud-based email environment” last year. The company first learned about the situation on December 12, 2023, but said that the attack began in May 2023. Hackers “accessed and exfiltrated data … from a small percentage of HPE mailboxes belonging to individuals in our cybersecurity, go-to-market, business segments, and other functions,” the company wrote in the SEC filing. HP Enterprise said the breach likely came about as the result of another incident, discovered in June 2023, in which Midnight Blizzard also accessed and exfiltrated company “SharePoint” files beginning as early as May 2023. SharePoint is a much-targeted cloud collaboration platform made by Microsoft that integrates with Microsoft 365.

“The accessed data is limited to information contained in the HPE users’ email boxes,” HP Enterprise spokesperson Adam Bauer told WIRED in a statement. “We continue to investigate and analyze these mailboxes to identify information that could have been accessed and will make appropriate notifications as required.”

Meanwhile, Microsoft said on Friday that it detected a system intrusion on January 12 tied to a November 2023 breach. The attackers targeted and compromised some historic Microsoft system test accounts that then allowed them to access “a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions.” From there the group was able to exfiltrate “some emails and attached documents.” Microsoft noted in its disclosure that the attackers appeared to be seeking information about Microsoft's investigations and knowledge of Midnight Blizzard itself.

“The attack was not the result of a vulnerability in Microsoft products or services. To date, there is no evidence that the threat actor had any access to customer environments, production systems, source code, or AI systems,” the company wrote in its disclosure. “This attack does highlight the continued risk posed to all organizations from well-resourced nation-state threat actors like Midnight Blizzard.”

In an August 2022 report from the threat intelligence firm Mandiant, incident response leader Doug Bienstock wrote that the firm “continues to identify APT29 operations targeting the United States' (US) interests, and those of NATO and partner countries.” He noted that even though the hacking group is widely known, it has continued to be “extremely prolific” and returns to target certain victims multiple times over months or even years. “This persistence and aggressiveness are indicative of sustained interest in this information and strict tasking by the Russian Government,” Bienstock wrote, adding, “Mandiant has observed APT29 continue to demonstrate exceptional operational security and advanced tactics targeting Microsoft 365.”

While Midnight Blizzard is far from a new threat, researchers point out that it's always productive to have renewed attention on the issue of persistent state-backed espionage. Williams, of the Institute for Applied Network Security, also highlights the hackers' counterintelligence goals in the recent Microsoft breach—that Midnight Blizzard appeared to be specifically interested in learning what company executives know about their group and methods.

"I'm not surprised that the threat actors were observed looking for what information Microsoft had on them,” Williams says. “But it's a great piece of evidence to remind us that threat actors are regularly monitoring our own investigative efforts as defenders.”

Source

Wired