The competitions, which are held on Russian-language cybercrime forums, offer prize money of up to $80,000 for the winners.

The criminal contests have their own rules to reduce the chance of cheating, Budd says. On Exploit, the rules say the entries “must not have been published elsewhere,” should be “meaningful and voluminous,” they should include technical details such as code or algorithms, and be “at least 5,000 characters (excluding spaces).” That equals out to around 1,000 words, or the rough length of this WIRED article. The rules on XSS are similar—“copy-paste = expulsion from the contest, in disgrace”—but they require articles to be longer (at least 7,000 characters) and say there should be “proper formatting, spelling, and punctuation.”

However, scammers are going to scam. In their most recent contests, Exploit had 35 entries and XSS had 38 entries. But XSS disqualified 10 of them. The winners of the competitions are decided by forum members voting on the entries, but the sites’ admins can also pick the winners, and there have been complaints of vote rigging, according to Sophos.

These competitions have evolved and grown over time, Budd says. Previous research from cybersecurity firm Digital Shadows, which has since been acquired by ReliaQuest, shows that contests on cybercrime forums started around 2006. Roman Faithfull, a cyber-threat intelligence analyst at ReliaQuest, says these earliest competitions were very simple. “At the start, they were quite low-key,” Faithfull says. “They weren't always organized by forum administrators.”

Some of the earliest competitions, he says, asked forum members to design logos or even offered a small monetary prize to the commenter on a forum thread who had the longest account history on the site. “As forums became more sophisticated, the contests in general became more sophisticated,” Faithfull says.

Since around 2015, the contests, most of which are held annually, have focused on writing and submitting articles and code, the ReliaQuest researcher says. “There's a lot of focus on stuff that will make people money,” he adds. As this has happened, the prize pots have increased too: On XSS, the total prize pot was $1,000 in 2018 and rose to $40,000 with $14,000 for the winner in 2021. “No one is going to put out their absolute best stuff into this unless they're in a really hard spot and need some quick cash,” Faithfull says. “You're unlikely to see a ransomware group, or really, someone really high up.”

The content of the entries to the most recent two contests is reasonably broad, the Sophos research found. Some were more innovative, while others were essentially repeating information found elsewhere. The winning entry in Exploit’s 2021 crypto competition was the creation of the cloned blockchain.com website, with Sophos saying it is “relatively simplistic” overall. “A cloned site like this would typically be used like any other phishing or credential-harvesting site,” the research says.

Other winning entries or those getting honorable mentions in the Exploit competition focused on targeting initial coin offerings, a guide to creating a phishing site to steal people’s cryptocurrency account details, and a tutorial on creating a cryptocurrency from scratch. However, it is worth noting that there have been free and publicly available tutorials on how to do this for several years,” the Sophos research says.

The Weird, Big-Money World of Cybercrime Writing Contests

The sabotage of more than 20 trains in Poland by apparent supporters of Russia was carried out with a simple “radio-stop” command anyone could broadcast with $30 in equipment.

Since war first broke out between Ukraine and Russia in 2014, Russian hackers have at times used some of the most sophisticated hacking techniques ever seen in the wild to destroy Ukrainian networks, disrupt the country's satellite communications, and even trigger blackouts for hundreds of thousands of Ukrainian citizens. But the mysterious saboteurs who have, over the last two days, disrupted Poland's railway system—a major piece of transit infrastructure for NATO's support of Ukraine—appear to have used a far less impressive form of technical mischief: Spoof a simple radio command to the trains that triggers their emergency stop function.

On Friday and Saturday, more than 20 of Poland's trains carrying both freight and passengers were brought to a halt across the country through what Polish media and the BBC have described as a “cyberattack.” Polish intelligence services are investigating the sabotage incidents, which appear to have been carried out in support of Russia. The saboteurs reportedly interspersed the commands they used to stop the trains with the Russian national anthem and parts of a speech by Russian president Vladimir Putin.

Poland's railway system, after all, has served as a key source of Western weapons and other aid flowing into Ukraine as NATO attempts to bolster the country's defense against Russia's invasion. “We know that for some months there have been attempts to destabilize the Polish state,” Stanislaw Zaryn, a senior security official, told the Polish Press Agency. “For the moment, we are ruling nothing out.”

But as disruptive as the railway sabotage has been, on closer inspection, the “cyberattack” doesn't seem to have involved any “cyber” at all, according to Lukasz Olejnik, a Polish-speaking independent cybersecurity researcher and consultant and author of the forthcoming book _Philosophy of Cybersecurity_. In fact, the saboteurs appear to have sent simple so-called “radio-stop” commands via radio frequency to the trains they targeted. Because the trains use a radio system that lacks encryption or authentication for those commands, Olejnik says, anyone with as little as $30 of off-the-shelf radio equipment can broadcast the command to a Polish train—sending a series of three acoustic tones at a 150.100 megahertz frequency—and trigger their emergency stop function.

“It is three tonal messages sent consecutively. Once the radio equipment receives it, the locomotive goes to a halt,” Olejnik says, pointing to a document outlining trains' different technical standards in the European Union that describes the “radio-stop” command used in the Polish system. In fact, Olejnik says that the ability to send the command has been described in Polish radio and train forums and on YouTube for years. “Everybody could do this. Even teenagers trolling. The frequencies are known. The tones are known. The equipment is cheap.”

Poland's national transportation agency has stated its intention to upgrade Poland's railway systems by 2025 to use almost exclusively GSM cellular radios, which do have encryption and authentication. But until then, it will continue to use the relatively unprotected VHF 150 MHz system that allows the “radio-stop” commands to be spoofed.

The only real limitation of the train-paralyzing radio attack, Olejnik says, would be that the saboteurs would have to be relatively close to the target trains—somewhere from hundreds of feet to miles, depending on the power of the radio equipment used in their disruption operation. (Olejnik was careful to note that he hasn't tested the attack himself.) Given that the disruptions appear to have occurred in three different Polish administrative regions across the country, getting that equipment close enough to all the target trains would likely have been the biggest challenge for the saboteurs. “It is really a cheap operation,” Olejnik says. “The biggest risk is the need of being in proximity.”

Polish State Railways didn't immediately respond to WIRED's request for comment. But a statement from the railways agency notes that the train disruptions were due to “unauthorized broadcasting of the radio-stop signal” sent “by means of a radiotelephone by an unknown perpetrator.” The statement adds that “receiving a radio-stop signal results in an immediate stop of all trains whose radios operate on a given frequency.”

Despite those automated emergency stops, the railway agency wrote that “there is no threat to rail passengers. The result of this event is only difficulties in the running of trains.” The Polish Press Agency reported no injuries or damage as a result of the radio sabotage operation.

If Russia or its supporters have in fact sabotaged the railway system of Ukraine's ally, the operation wouldn't be without precedent. In fact, Belarusian dissident hackers known as the Cyber Partisans protested Belarus's support of the Russian military by launching their own rare political ransomware attack against Belarus's Railways' IT network in January of 2022, in an attempt to prevent Belarus's participation in the invasion that came just a month later.

This disruption of Poland's rail system doesn't appear to have required any such ransomware or even a penetration of a digital network. But Olejnik cautions that the simplicity of the attack shouldn't lead anyone to underestimate its effects, which may continue to play out given the difficulty of preventing the radio attack on Polish trains' unauthenticated communication systems.

“When you’re a hub of support to war-stricken Ukraine, you’re indeed a target,” says Olejnik. “Low-hanging fruits are always the best approach.”

_Additional reporting by Lily Hay Newman._

The Cheap Radio Hack That Disrupted Poland's Railway System

A ramshackle team of American scientists scrambled to decode the Nazi cipher before the time ran out. Luckily, they had a secret weapon.

“What am I supposed to see?” Krutzler asks, staring at his screen and bouncing his knee like he has a baby on it. His T-shirt reads “Defense Nuclear Weapons School.”

“You’re supposed to see a little ladder,” explains Koeth. “Like DNA strands.”

A few minutes go by before the transmission begins again. This time, it sounds a bit different. Koeth gives the thumbs up. Holly Wilson, a student of Koeth’s who graduated with a bachelor’s in physics in 2023, gets enlisted to transcribe the code into a yellow-lined legal pad. She’s wearing a faded Fleetwood Mac T-shirt and has a massive tattoo of an octopus wrapping her arm. Wilson writes down OKTOBER 7 and DBK WSE before the signal fades.

“That’s it, that’s it!” shouts Koeth. He consults the page from the German Army Staff Machine Key Number 28 book, provided by MRHS in a link on its website. He’ll need to obtain the key setting for the Enigma machine, the first step in decoding the message. The team has been at it for almost an hour.

At last, Koeth opens the wood cover of the Enigma. Although it’s possible to purchase one for between $300,000 to $500,000, Koeth received his as a loan from a collector in California, a WWII buff who has an exact replica of Little Boy, the atomic bomb dropped on Hiroshima, in his backyard. (Ensuing calls from concerned neighbors.)

Koeth’s own workplace might be cause for similar concern. A faculty member at UMD since 2009, his second-floor office holds an impressive collection of radiological antiquities such as Fiestaware, Vaseline glass, and, under lock and key, some Lone Ranger Atomic Bomb Rings, cereal prizes from the 1950s that contained a small amount of polonium 210.

Koeth removes two rotors from the machine, turns one to 6 and the other to 12, and plops them back inside.

“We gotta do the plugboard next,” Koeth announces before closing the lid. He begins to plug and unplug a series of tubes in a way that recalls Ernestine, Lily Tomlin’s immortal phone operator.

“No wonder the Germans lost the war,” says Larry Westrick, an electrical engineer from Opelika, Alabama. “It takes too long to communicate.”

Luckily, tenacity is part of Koeth’s job description. When he was 10, Koeth laid out plans to build a nuclear reactor in his parents’ basement in Piscataway, New Jersey.

Next, entering the code in cyphertext, Koeth pushes some of Enigma’s buttons, which in turn moves the rotors like the inner workings of a clock; a lampboard lights up a corresponding letter in plaintext. “It’s a guessing game,” he says, turning quiet. “Just think,” he says after a while, “they had to do this every day.”

Krutzler, Westrick, and a few newcomers gather around Koeth and his machine. There are 100 letters in the message and so far, none of them seem to make any sense.

“Something is wrong,” they say in unison. A joke goes around that the secret message is “Drink more Ovaltine.”

Koeth refers to a set of instructions. “Basically, you key in the first set of letters, and they should match the second set of letters. Which they don’t.”

The Low-Stakes Race to Crack an Encrypted German U-Boat Message

The US Secret Service’s relationship with the Oath Keepers gets revealed, Tornado Cash cofounders get indicted, and a UK court says a teen is behind a Lapsus$ hacking spree.

“The government needs to stop these companies from packaging and selling our personal information,” US senator Ron Wyden of Oregon told 404 Media in a statement, “and the senior executives that put profit over national security and Americans' safety should be punished accordingly.”

A new report by the Citizens for Responsibility and Ethics in Washington (CREW), a nonprofit government watchdog, found that US Secret Service agents were in close contact with the leader of the far-right militant group the Oath Keepers during the final months of the Trump administration. Emails published in the report suggest a cordial relationship between agents and Stewart Rhodes, the leader of the group.

In one email, an agent wrote that they had just spoken to Rhodes about an upcoming visit by former president Donald Trump to Fayetteville, North Carolina. The agent described himself as “the unofficial liaison to the Oath Keepers (inching towards official).” The agent also said that Rhodes “had specific questions and wanted to liaison \[sic\] with our personnel,” and shared Rhodes’ cell phone number.

In May, Rhodes was found guilty of seditious conspiracy over his role in the insurrection at the Capitol on January 6. He was sentenced to 18 years in prison and 36 months of supervised release.

In an indictment unsealed on Wednesday, August 23, the US Department of Justice alleges that the developers behind Tornado Cash, a cryptocurrency mixer, laundered more than $1 billion dollars that included hundreds of millions for a North Korean hacking group. Roman Semenov and Roman Storm were charged with conspiracy to commit money laundering and sanctions violations, as well as conspiracy to run an unlicensed money-transmitting business. Storm, who lives in Washington state, was arrested on Wednesday, while Semenov, a Russian national, has not yet been taken into custody.

Tornado Cash is a privacy service that obfuscates the trail of ownership for cryptocurrency. According to the indictment, the service violated US sanctions, and its operators knowingly helped “hackers and fraudsters conceal the fruits of their crimes.”

In a statement, Storm’s lawyer, Brian Klein, characterized the charges as dangerous and unprecedented. “We are incredibly disappointed that the prosecutors chose to charge Mr. Storm because he helped develop software, and they did so based on a novel legal theory with dangerous implications for all software developers,” he said. Klein said Storm has been released on bail.

Also on Wednesday, a London court found a key member of the cybercrime group Lapsus$ responsible for several high-profile hacks targeting companies like Uber, Nvidia, and Rockstar Games. Arion Kurtaj, who is now 18, faced 12 charges, including three counts of blackmail, two counts of fraud, and six charges under the UK’s Computer Misuse Act.

From 2021 to 2022, Kurtaj, along with other members of Lapsus$, most of whom are believed to be teenagers, carried out a series of attacks focused on extorting major companies and government agencies around the world, the jury found. The Uber hack, for instance, reportedly cost the company $3 million in damages. At the time, Uber said that the hacker who took responsibility posted pornographic material to an internal information page, alongside the message, “Fuck you wankers.”

The hacking spree prompted a major review earlier this month by US authorities who warned of the rising threat of juvenile hackers.

This Tool Lets Hackers Dox Almost Anyone in the US

The first booking photo of a US president stands out among a sea of photoshops and AI-generated images online.

For months, Etsy has become littered with a new genre of T-shirt: the Donald Trump mug shot. And they’re available in two main styles: Guity AF and Not Guilty. The shirts are adorned with photos of the former US president appearing as if he’d just been booked, but until very recently, they’ve been fakes—most of them unconvincing ones. Etsy sellers have been uploading them to the platform since at least March, as Trump has been indicted for numerous alleged crimes. Even Trump’s own campaign released a fake mug shot T-shirt to raise money.

But yesterday, the 2024 Republican presidential candidate was finally subjected to the criminal tradition of a mug shot in Georgia, where he has been indicted on charges relating to attempts to overturn 2020 election results in the state. It’s the fourth indictment against Trump, who now faces 91 felony charges in four jurisdictions. Trump maintains that he committed “no crime.”

In an era where manipulated images have captured our attention, Trump’s real mug shot—a simple, poorly lit photo—has achieved historic hype. It’s not that the image alone is notable—Trump is among the most recognizable faces in the world, and he chose to pose for the shot with his eyebrows knitted in his signature, serious look.

Still, it’s the first mug shot of a US president. (Justice officials in the former president’s three other criminal cases opted to skip that part of the process.) And that image, as plain as it is, may become one of the most important photos Trump has ever taken.

“The AI-generated ones, no matter how good they are, will eventually be seen as AI-generated. Fakes will be known as fakes,” says Jonathan Finn, a professor of communication studies at Wilfrid Laurier University in Ontario, who wrote the book _Capturing the Criminal Image: From Mug Shot to Surveillance Society_. But the real mug shot “will last forever. It will have all the history and associations tied to it.”

After Trump’s mug shot was released last night, it flooded the internet, supplanting the fakes that spread before the real thing was released. It appeared on Instagram stories, as memes, and on Trump’s own social network, Truth Social. After surrendering to Georgia authorities, Trump even made his first post on X, formerly Twitter, since his account was reinstated by Elon Musk late last year. “Election interference, never surrender,” a post featuring the picture reads.

Mug shots serve a practical purpose: to identify the person accused of a crime, and document their physical status at the time of an arrest. But media coverage of crimes that included mug shots have contributed to harmful stereotypes of people of color, who are arrested at disproportionate rates. Their publication can also make a person appear guilty of the accusations against them before they’ve had a fair trial.

But Trump finds himself in a different position, where viewers of the mug shot will likely be split: Those who support Trump may see a man wrongfully accused while those who presume him guilty may see it as validation of their beliefs.

Trump's mug shot has already moved beyond its intended purpose of tying him to alleged crimes in Georgia. The different political alignments shared on social media with the mug shot, and even satirical uses, all advance the image out of its initial context. This is a common phenomenon of posts online: As images and posts move to large audiences, they can experience what is called context collapse. That’s when intent and common understanding around the source of a post disappears as it moves widely to other groups. With people giving the mug shot meme treatment or plastering it on partisan T-shirts, that’s already happening.

“I think it’s a certainty there will be context collapse around any prominent image that can be interpreted or misinterpreted by different communities, both wilfully and accidentally,” says Sam Gregory, executive director of Witness, a nonprofit organization focused on using images and videos for protecting human rights. And with numerous versions of a Trump mug shot circulating online, people may have different memories and associations of the historical event. “We’ll remember the one that we saw in a context that made it memorable to us,” Gregory says.

By this morning, a search for Trump mug shots on Etsy featured many new products sporting the real thing. Trump’s campaign is slapping the photo on mugs, T-shirts, and koozies. Fakes will remain, and some people will be duped. But the real Trump mug shot will be the one for the history books.

Donald Trump's Mug Shot Matters in a World of Fakes

Social norms—not laws—are the underlying fabric of democracy. The Georgia indictment against Donald Trump is the last tool remaining to repair that which he’s torn apart.

Donald Trump was arrested in Georgia tonight for his role in what prosecutors christened “a wide-ranging criminal enterprise” aimed at overturning the results of the 2020 election. Trump and 18 others—among them, his former lawyer, Rudolph Giuliani, and Mark Meadows, his former chief of staff—have been formally accused of 41 state-law felonies. The case is brought by Fani Willis, the district attorney of Fulton County, Georgia. Willis is not the first local prosecutor to charge a United States president with a felony, but she is the first to accuse one of trying to steal an election.

Among charges such as filing false documents and conspiracy to commit forgery, Trump is personally accused of trying to browbeat and suborn felony acts from high-ranking Georgia officials, including the chief elections supervisor, secretary of state Brad Raffensperger. Officials were pressed by Trump and other “co-conspirators” to take action to “decertify the election” and “unlawfully appoint presidential electors,” prosecutors claim. Together, the charges opened the door for Willis to pile on additional counts of racketeering. Filed under the state’s Racketeer Influenced and Corrupt Organizations Act, the charge would ask jurors to consider whether Trump and other defendants were involved in a single criminal undertaking. A conviction under RICO does not require that the defendants all know one another or be involved at the same time, so long as they’re all working toward a single corrupt goal.

RICO, which can carry up to a 20-year prison sentence, is a powerful and even dangerous legal weapon. Out of dozens of possible crimes, a prosecutor may have to prove only two to gain a conviction. The state is fairly ambiguous about what constitutes an “enterprise.” Jurors, meanwhile, may be shown a veritable tower of evidence and instructed, usually in some narrative fashion, to see a “pattern” in the defendants’ acts; something the human brain is naturally wired to do, even at a subconscious level. For Trump and his team, allowing the case to progress to the point where a jury is actually deliberating RICO is a doomsday scenario.

In addition to the Georgia prosecution, the cases against Trump include one in Manhattan over “hush money” paid to a porn star; a case filed in Florida federal court over his retention of classified documents; and a federal case in Washington, DC, for his role in the January 6 insurrectionist riot at the US Capitol and efforts to overturn the 2020 election. In total, Trump is facing 91 felony charges. He has pleaded not guilty to each one so far.

The indictment is the culmination of a political career that Trump built by ignoring checks and balances, mocking the law and the courts, and cheering on supporters who use violence in his name, including groups rooted in white nationalism and misogyny, prone to spontaneous and premeditated violence. More than 1,100 of his most committed supporters have been charged in the past 31 months with trying to physically stop Congress from certifying the results of the 2020 election. More than 80 of them have pleaded guilty to beating police officers who had ordered them to disperse. More than 140 officers were reportedly injured, and four of those would die by suicide within 200 days of the event.

These are not Trump's only casualties. Legal experts have long warned that Trump's personal brand of politics—acrimonious, wielding tools of harassment—while deceptively trivial in the face of actual death, millions in damages, and election interference—is corrosive to the very norms and conventions upon which the electoral process has long relied for stability. Prosecuting Trump may help distinguish lawful challenges in future elections from outright criminal acts. But even alone, his arrest has already made clear what norm-breaking behaviors the public will not condone—not now or in the future, regardless of the courts' own views.

In a 2018 book, Harvard University duo Steven Levitsky and Daniel Ziblatt put forward two criteria for the foundation of a healthy democracy: “social norms,” or unwritten codes of conduct upon which the people generally agree. The Trump administration, by the end of its first year, had managed to violate both with a quotidian efficiency. Levitsky and Ziblatt’s norms included “mutual tolerance” and “institutional forbearance.” The latter describes the need for politicians to show restraint in the exercise of their authority; not to gain the upper hand and immediately use that power to obliterate one’s rivals. “Think of democracy as a game we want to keep playing indefinitely,” they write.

Nothing in this century has done more to stamp out the mutual toleration of Americans than the presidency of Donald Trump. His strategy of painting political rivals as illegitimate and un-American has—for the better part of a decade—chipped away at social and democratic norms that titans of jurisprudence have—for more than a century—called indispensable to a functioning democracy. By the time President Joe Biden took office, the _Washington Post_ had cataloged a decidedly pathological 30,000 false or misleading claims uttered by his predecessor. The Trump administration's ever-broadening palette of ethics violations caused Americans to realize, perhaps for the first time on a national scale, that truly there are few if any laws against some of the most basic forms of corruption; that, instead, conventions and norms—an honor system, essentially—is all that stand between presidents and the gross abuse of their power.

Americans typically point to the US Constitution as the pinnacle of their legal system. Many modern legal theorists, and even the nation’s own founders, painted the concept of state authority in a different light. The Genevan philosopher Rousseau considered _la volonté générale_, or the “general will” of the people, the only legitimate source of state power. American revolutionaries believed that only laws written with the “consent of the governed” could be considered legitimate. Thomas Jefferson once said the only “fountain of power” is the people, and that only “from them” is power derived. Regarding politicians who believe “supreme power” resides in constitutions, early US Supreme Court justice James Wilson suggested they had perhaps neglected to consider, “with sufficient accuracy, our political system.”

Consequently, democratic institutions are effectively incapable of restraining elected autocrats by their own volition. Without robust norms, traditional checks and balances often prove useless. “The tragic paradox of the electoral route to authoritarianism,” write Levitsky and Ziblatt, “is that democracy's assassins use the very institutions of democracy—gradually, subtly, and even legally—to kill it.” The Georgia case yanks Trump and his associates out of the squishy realm of “norms violations” and drops them into the cold, hard box of criminality. The best argument for prosecuting Trump under RICO is that it seemingly leaves jurors room to consider both.

The prosecutions of Trump will do nothing to cement America’s deep partisan divide, of course. Legal scholars reasonably believe it will only further inflame hostilities and erode trust in US institutions. Republicans have meanwhile launched an aggressive PR campaign based on the notion of “letting voters decide.” But relying on the vote, rather than jurors who are obligated to consider evidence and draw inferences from facts alone, could itself create a new norm anathema to democratic values. Prosecution was not the first choice. But every other lever that might’ve been pulled to stop and counteract the damage wrought by Trump was left in its place; particularly by Republicans, who’ve never actually been deprived of the means or opportunity to hold the de facto leader of their party accountable. Relying on the very system that Trump previously poured tens of millions of dollars into destroying feels otherwise, at best, like a nation fulfilling a death wish.

For American democracy to thrive, or retain any semblance of the legitimacy it has left, the prosecutorial systems, judges, and jurors in New York, Georgia, Florida, and Washington must grind forward. The law may not always prevent people from profiting off the wrongs they commit. But it cannot be denied outright the chance to decide whether they're stripped of their ill-gotten gains.

Laws are ultimately made “real” by the people against whom they’re imposed, including state officials, who, unlike private citizens, cannot scrape by merely obeying the law. Were judges, legislators, and even presidents to consider only themselves, ignoring the actions of their supervisors, subordinates, and peers, the validity of the legal system—and eventually the system itself—would fall apart. The English legal theorist H. L. A. Hart once wrote that among the "necessary and sufficient” criteria for the existence of a legal system is the requirement that public officials consciously adopt common standards of behavior and “appraise critically their own, and each other’s deviations as lapses.”

For some observers, the concept of "norms violations" during Trump's presidency became erroneously interlinked with the perceived failures of federal oversight officials, mostly by people unaware they were a phantom bulwark all along. A lack of coherence in the mainstays of democracy during Trump’s initial years left too many too focused on the absence of criminal charges, even though equally essential but far less defensible democratic norms were being whittled into dust. Where criminals have laws and courts to contend with, and are beyond the public’s own power to prosecute, social norms are injusticiable—outside the realm of the law, defined by people, their values, and beliefs.

And it’s no secret. The only fleshed-out directive revealed thus far to be implemented by Trump’s hypothetical follow-up presidency aims to see more than 50,000 bureaucrats and civil servants fired in an effort to insulate Trump from legal scrutiny and shield him from potential prosecution down the line. Groups of lobbyists have, according to Axios’ Jonathan Swan, already compiled their “extensive” lists of individuals believed loyal to the president and who fill those ranks instead. This plan is notably the opposite of the restraint on which Levitsky and Ziblatt place so much significance in the upkeep of a healthy and functioning democracy.

Trump’s Prosecution Is America’s Last Hope

Russia tightly controls its information space—making it hard to get accurate information out of the country. But open source data provides some clues about the crash.

At around 5:30 pm Moscow time on August 23, the Embraer Legacy 600 private business jet took to the skies. Launching from an airport near the Russian capital, the 13-seater plane, which has a white body and blue tail, has been linked to Yevgeny Prigozhin, the head of the brutal Russian mercenary outfit Wagner Group.

At 5:46 pm, once the plane was clear of Moscow—an area where location-tracking GPS signals are frequently blocked—receivers belonging to flight-tracking network Flightradar24 started picking up signals from the Embraer Legacy. For the next 34 minutes, Prigozhin’s plane was sending out data about its altitude, speed, and autopilot settings that allowed its movements to be tracked.

During this time, the Embraer Legacy appeared to be fine. It reached a cruising altitude of 28,000 feet before briefly climbing to 30,000 feet, and it was traveling at around a ground speed of around 513 knots. Its flight path headed northwest, away from Moscow and in the direction of Russia’s second-largest city, St. Petersburg.

At 6:19 pm, around 30 seconds before the plane stopped transmitting data altogether, it plunged 8,000 feet toward the ground. Its last recorded altitude was 19,725, as it flew by the Kuzhenkino village in the Tver Region. The descent was “dramatic,” according to Flightradar’s analysis.

Since the plane smashed into the earth, killing all those onboard, Russian aviation services, Telegram channels linked to Wagner, and the country’s state-controlled media have reported that Prigozhin was listed as a passenger. The country’s aviation agency named the Wagner boss among 10 people on the plane, along with other senior Wagner members, including cofounder Dmitri Utkin and three crew members.

Officials, according to Russian state media, are investigating the crash and what may have caused it, and have reportedly recovered the bodies. It has been widely speculated that the plane could have been shot down by Russian air defenses, perhaps in response to Prigozhin’s attempted coup two months ago. No evidence to back this up has been presented yet, with Russian president Vladimir Putin saying he has sent his condolences to the families of the dead and investigations are looking into what happened. (One anonymous Western intelligence official told The New York Times that they believe Prigozhin was on the plane. Meanwhile, US president Joe Biden has said there is “not much that happens in Russia that Putin’s not behind.“)

Thanks to Russia’s heavy censorship and propaganda machines, the verifiable truth of what happened to the Embraer Legacy may never be known, experts say.

Amid the dramatic and unfolding incident, there has been a void of official information and a swirl of unconfirmed theories. However, the event highlights how powerful Russia’s grip on its information space is: The country controls its media, has banned independent outlets, and tightly censors the internet and online services available in the country. The episode also continues to show how useful even small amounts of open source information—such as photos or videos posted to social media and open source data, such as flight information—can be in establishing what may have happened. Open source intelligence, known as OSINT, is already being inspected by researchers.

FlightRadar is one of a tiny number of sources of verifiable information about the fate of the Embraer Legacy 600 and, by extension, those onboard the plane. Since the plane stopped transmitting data, one video has emerged on social media showing a plane in pieces dramatically falling toward Earth.

OSINT investigators have confirmed that this happened around the Tver region, the plane’s last known location, by comparing landmarks in the video, such as trees and metal pylons, with existing photos of the location. Another video of the crash site reportedly shows parts of the wreckage matching previous images of Prigozhin’s Embraer Legacy 600. (However, one false video posted to X, the platform previously known as Twitter, has been viewed around a million times.)

Elise Thomas, an investigator at the Centre for Information Resilience, a nonprofit that conducts open source research to expose human rights abuses and counter disinformation, says that within hours the FlightRadar data and confirmed videos from the site gave people a glimpse of what may have happened. “But at the end of the day, we are probably going to be dependent on Russian sources at some level,” she says. These could include Russian government agencies or Telegram channels, which may not be trustworthy. “In some ways, maybe the most likely outcome here is that we just never know the absolute truth of what happened,” she says.

Getting factual information out of Russia isn't easy—and it has become harder since the country’s full-scale invasion of Ukraine started in February 2022. “The information space has been tightening over time,” says Natalia Krapiva, tech-legal counsel at digital rights nonprofit Access Now. Over the past decade, Krapiva says, the Kremlin has passed laws and taken other measures to control the internet, censor what people can access, throttle the media, and outlaw independent reporting.

Almost all independent media in Russia has been “banned, blocked” or declared “foreign agents” since February of last year, according to media freedom organization Reporters Without Borders. “Those that survive have belonged to allies of the Kremlin for a few years, or they are forced to strict self-censorship, because of banned subjects and terms,” it says in its 2023 annual ranking. Freedom House, an organization that tracks threats to democracy and freedom, ranks Russia as one of the worst countries for online freedoms.

On top of this, Russia has for years run disinformation campaigns and appeared to lie about public incidents at home and abroad. Prigozhin ran the notorious Internet Research Agency, which created reams of fake news and meddled in the 2016 US elections. Two Russian agents who walked into the UK in 2018 and poisoned Sergei Skripal and his daughter Yulia later appeared on Russian state television and claimed that they were simply in the country to visit the British city of Salisbury to see its cathedral. And Russian officials changed their story multiple times around the downing of Malaysia Airlines flight MH17 in 2014, which killed 298 people—reams of open source evidence were presented by investigative journalism unit Bellingcat.

When it comes to Prigozhin and the crash, Russia’s informal network of so-called military bloggers is also involved. In the void of official information about Russia’s war, these military correspondents have appeared on Telegram, in some cases pushing their updates to more than a million people. These accounts are largely pro-Russia, although they often have different allegiances that further muddy the waters. “Some of these people were working for Prigozhin,” says Thomas. “Some of them we know have links to the FSB or GRU,” referring to Russia’s intelligence services. “Some of them probably have links to the Russian security services that we don’t know about.”

These channels have pushed a range of theories about the crash, claiming to have confirmed that Prigozhin is dead and suggesting that they would “march” on Moscow. There have also been reports on possible causes of the crash. According to _Meduza_, the widely read independent Russian news source, suggestions are being circulated on Telegram that investigators suspect a bomb could have been attached to the plane and that law enforcement may have a suspect in mind. Neither claim has been officially confirmed, _Meduza_ notes.

“Looking at the information that is either available or not available is not enough,” says Tanya Lokot, an associate professor in digital media and society at Dublin City University who researches internet and media freedom. Lokot says it’s essential to consider the context of any information published from official Russian sources or in Telegram channels. For instance, she says, it is important to scrutinize why certain information—such as a list of names—may have been released at a particular time.

Lokot says it is also important to understand the motives of whoever is in control of this kind of information and how and when they decide to release it, as that helps shape a bigger narrative. “How they are presenting this incident and the fallout from this incident is really important to understand because it helps us also understand how they’re trying to control the information space to make sure that it fits their broader strategic narrative,” she says. “The desired at least strategic narrative is the Russian state wants to show that it remains in control of the situation, whatever that situation is.”

The Last Hour Before Yevgeny Prigozhin's Plane Crash

Musician Alex Pall spoke with WIRED about his VC firm, the importance of raising cybersecurity awareness in a rapidly digitizing world, and his surprise that hackers know how to go hard.

On Saturday, with Hurricane Hilary looming, Alex Pall and Drew Taggart of the DJ duo The Chainsmokers performed a concert at Los Angeles State Historic Park that set an all-time attendance record for the venue. By Tuesday night, Pall was in Switzerland, speaking to WIRED on Zoom, but he had a different recent event on his mind: his and Taggart's first-ever trip earlier this month to the Black Hat security conference in Las Vegas.

On top of being DJs and electronic music producers, The Chainsmokers are also active tech investors. They founded a venture firm, Mantis VC, in 2019 with two other entrepreneurs and now have investments in a broad portfolio of fintech, machine learning, ecommerce, gaming, and healthcare startups. And though Mantis doesn't specifically focus on cybersecurity, the firm is starting to develop a reputation for identifying startups that are attempting to address esoteric yet critical digital security problems.

This morning, for example, the now-independent mobile security app iVerify announced a $4 million seed funding round that Mantis is participating in. The well-regarded app, which grew out of an incubator at the security firm Trail of Bits, aims to take on the mercenary spyware industry by making it easy for people or organizations to scan their iOS and Android devices for suspicious activity and malware. 

How did The Chainsmokers get interested in digital privacy, incident response, software supply chain security, and anti-spyware tools? And how did Pall, a celebrity DJ who performs all over the world, end up partying at Black Hat? He broke it down for us. Our conversation has been lightly edited for length and clarity.

**WIRED: I'm super curious, where does the security and privacy specialization come from?**

**Alex Pall:** I gotta give credit to Saveena \[Mandadi, a Mantis investor and director of operations\] who's definitely the leader of that space for us. She's done a terrific job building out our thesis around the space. But going back a little bit further, you look at our portfolio, and it probably seems a bit out of character for how you would imagine two musicians to be investing their time and money. And that was very much intentional. 

When you're an artist with a platform like ours, you're getting sought out for two things: distribution and marketing—consumer-related brands or creator, economy, and social. But a few years into it, we were reading the news, and you can't help but take a second look at your portfolio and be like, why are we not in companies like Palo Alto Networks and CrowdStrike? And it dawned on us that we were kind of falling victim to the consumer space in a way. We wanted to go out and invest in tools that, behind the scenes, could be the things powering society. And it was also just a challenge at first, like maybe we can be some of the first artists to show what kind of value we could bring outside of the typical ecosystem you'd imagine us investing into.

**Do you feel like you're raising awareness for other investors that security and privacy issues impact everyone's lives and everyone's work?**

People take for granted that if you type in your bank information, it's going to be secure. Or if you log in to your iPhone and send something private to somebody else, that it's not going to end up in the wrong hands. But we had a firsthand experience a number of years ago—our Twitter account got hacked while we were in London. It was a really, really awful experience to have somebody inside your system, speaking like they're you. And obviously, that was just a little taste of the larger consequences that can happen. 

You can easily invest in one really terrible cybersecurity company and say, 'We've made a huge mistake getting into this space.' So I think it's always been the strategy for us to be a part of the best businesses, even if it's not the most exciting work to the average person when you read it on paper. And hopefully, we de-risk it a bit for others by investing in people who are far more experienced than us.

**Why did you want to invest in iVerify? What's important about it and about focusing on the threat of spyware?**

Our phones aren't always as secure as people think, especially for people like journalists and politicians. Mobile device management is obviously a big issue, but there are lots of important people and organizations that probably don't focus enough on it. So it's critical that iVerify is a really powerful but also simple solution.

**What's it been like to connect with the security community? It sometimes has a reputation that it's a group of people who are really tinfoil-hat and hard to interact with or hard to break into.**

There's a lot of pressure on them. Not only do they have to make sure that everything's secure and safe and people are following the guidelines set by an organization, but the pace at which innovation is happening and you're adopting new technologies and bringing new software in—it's a lot of work while still keeping all the customers happy and hoping that the machine doesn't break down. That's a daunting task, and these things are only going to become more and more important as everything becomes more digital. 

In movies, they certainly don't paint \[hackers\] as the outgoing, fun people at the party. They're usually the ones saving the day, which is the truth. So that's something that we've kind of recognized and realized, which is, how do we, through whatever platform we have, bring more awareness to this space and get more people interested and excited about the applications of cybersecurity?

A lot of the time you're dealing with founders who are extremely technical and brilliant, but we all have our shortcomings. I'm not extremely technical or brilliant. So the idea is that we, hopefully, can come together and leverage each others' strengths to accomplish a really challenging goal.

**It sounds like you at least got to have some fun at Black Hat, right?**

We hosted an event at Black Hat for one of the companies we invest in, Chainguard \[which focuses on software supply chain security\]. And they're all wonderful, but I had no idea what kind of crowd we would be drawing on for this. I didn't think everyone was going to be terrible or boring or something, but I was surprised because everyone was awesome. We had a great night out. Eventually, I was like, I've got a show tomorrow, so we can't keep going all night!

**I think security folks are going to be** _**thrilled**_ **to hear that The Chainsmokers had fun partying with them.**

You know, growing up, I was on ClarisWorks pretending I was hacking into things, and I was a big fan of the movie _Hackers._ They were really cool to me. And this stuff is really important. As the world continues to advance with AI technology, we as a society will need more cybersecurity experts. And they deserve more recognition so they can secure all the new things that we're getting excited about. 

We all want to move as fast as possible, but at the end of the day, you can't have this system that's just jerry-rigged together. As new companies spring up and all the code that's being written—you need to have some sort of observability into this in real time to understand where the flaws are. Soon, all of our identities will just be in the metaverse or something. Who knows. So these things become more critical every day.

Why The Chainsmokers Invest in—and Party With—Niche Cybersecurity Companies

Here’s what the science really says about teens and screens—and how to start the conversation with young people of any age.

If you give a kid a smartphone, they’re going to want a social media account.

That’s not the start of a storybook. The average age for a kid getting their first smartphone is 10.3. Within a year, a child has likely made four or five social media accounts; by the age of 12, 90 percent of kids are already on social media, according to research by Linda Charmaraman, a senior research scientist who runs the Youth Media and Well-Being Research Lab at Wellesley College.

For parents and caregivers, the decision to let your youngster sign up for TikTok, Instagram, or Snapchat can feel like a daunting milestone. In May, the US surgeon general suggested that social media is contributing to a mental health crisis among the nation's youth. Around the world, lawmakers have been mounting pressure on the likes of Meta and TikTok to restrict the addictive design features that young users are subjected to. But social media can be valuable to young people too. Digital spaces can be beneficial settings to build friendships and receive social support from peers. So if your kid starts asking about social media (or you suspect that they already have secret accounts), what’s a parent to do?

“Social media is not inherently good or bad,” says Charmaraman, whose research focuses on adolescent development and social media. “It’s really about how people come to use social media, in what ways, and what kinds of supports they have to navigate it in a way that’s right for them.”

It’s absolutely possible for families to foster a healthy relationship with social media by understanding the science, starting conversations about social media and mental health, and setting boundaries on security settings and screen use. Here’s how to get started, whether your kid is 17 or approaching the age of 10.3.

What Does the Research Really Say?

It’s still too soon to determine any long-term effects of social media on youth mental health, says Charmaraman. She encourages parents to take a critical look at the popular studies that draw correlations between teens’ social media use and negative outcomes like depression and anxiety. “When you actually look at the statistical weight of how much we can explain the rise in rates of mental health difficulties due to social media or technology use, it’s less than 1 percent,” she says.

Correlational studies might also discount larger forces that contribute to mental health difficulties, like socioeconomic status or family relationships. For example, if a child is in a household where parents argue frequently, the child may turn to social media more often to seek support or distraction. That doesn’t mean social media is the problem. More restrictions on social media don’t correlate to a happier child, either, Charmaraman points out.

It’s also important to understand that much of the current research on social media and youth well-being has focused on middle-class white families. There’s still more to be learned about how social media impacts nonwhite, LGBT, or neurodivergent youth, or youth in unstable housing situations.

In other words, there’s no scientifically proven, one-size-fits-all social media rule. Tailor the following guidelines to _your_ family and _your_ kids, and be ready to adapt them as your kids grow older and their situations change. Don’t be afraid to set different guidelines for siblings too—kids in the same family could have different needs.

‘Onboard’ Your Kid Onto Social Media

You might want to start earlier than you think. “Don’t assume that your kid isn’t already on social media,” says Charmaraman. Especially if your child has an older sibling, or friends with older siblings, it’s likely that they’ve engaged with social media in some way.

Charmaraman recommends initiating a conversation about social media when a child is in late elementary or middle school, then gradually “onboarding” them onto social media with a lot of structure, rules, and oversight at first. It’s easier to be proactive about social media guidelines than to try to undo bad habits that have been cemented over years. “Prepare, as opposed to repair,” she says. (If you have an older teen, not all hope is lost—but more on that later.)

How to Talk to Your Kids About Social Media and Mental Health

Unlike web browsers, mobile apps increasingly make it difficult or impossible to see what companies are really doing with your data. The answer? An inspectability API.

In today’s digital world, injustice lurks in the shadows of the Facebook post that’s delivered to certain groups of people at the exclusion of others, the hidden algorithm used to profile candidates during job interviews, and the risk-assessment algorithms used for criminal sentencing and welfare fraud detention. As algorithmic systems are integrated into every aspect of society, regulatory mechanisms struggle to keep up.

Over the past decade, researchers and journalists have found ways to unveil and scrutinize these discriminatory systems, developing their own data collection tools. As the internet has moved from browsers to mobile apps, however, this crucial transparency is quickly disappearing.

Third-party analysis of digital systems has largely been made possible by two seemingly banal tools that are commonly used to inspect what’s happening on a webpage: browser add-ons and browser developer tools.

Browser add-ons are small programs that can be installed directly onto a web browser, allowing users to augment how they interact with a given website. While add-ons are commonly used to operate tools like password managers and ad-blockers, they are also incredibly useful for enabling people to collect their own data within a tech platform’s walled garden.

Similarly, browser developer tools were made to allow web developers to test and debug their websites’ user interfaces. As the internet evolved and websites became more complex, these tools evolved too, adding features like the ability to inspect and change source code, monitor network activity, and even detect when a website is accessing your location or microphone. These are powerful mechanisms for investigating how companies track, profile, and target their users.

I have put these tools to use as a data journalist to show how a marketing company logged users’ personal data even before they clicked “submit” on a form and, more recently, how the Meta Pixel tool (formerly the Facebook Pixel tool) tracks users without their explicit knowledge in sensitive places such as hospital websites, federal student loan applications, and the websites of tax-filing tools.

In addition to exposing surveillance, browser inspection tools provide a powerful way to crowdsource data to study discrimination, the spread of misinformation, and other types of harms tech companies cause or facilitate. But in spite of these tools’ powerful capabilities, their reach is limited. In 2023, Kepios reported that 92 percent of global users accessed the internet through their smartphones, whereas only 65 percent of global users did so using a desktop or laptop computer.

Though the vast majority of internet traffic has moved to smartphones, we don’t have tools for the smartphone ecosystem that afford the same level of “inspectability” as browser add-ons and developer tools. This is because web browsers are implicitly transparent, while mobile phone operating systems are not.

If you want to view a website in your web browser, the server has to send you the source code. Mobile apps, on the other hand, are compiled, executable files that you usually download from places such as Apple’s iOS App Store or Google Play. App developers don’t need to publish the source code for people to use them.

Similarly, monitoring network traffic on web browsers is trivial. This technique is often more useful than inspecting source code to see what data a company is collecting on users. Want to know which companies a website shares your data with? You’ll want to monitor the network traffic, not inspect the source code. On smartphones, network monitoring is possible, but it usually requires the installation of root certificates that make users’ devices less secure and more vulnerable to man-in-the-middle attacks from bad actors. And these are just some of the differences that make collecting data securely from smartphones much harder than from browsers.

The need for independent collection is more pressing than ever. Previously, company-provided tools such as the Twitter API and Facebook’s CrowdTangle, a tool for monitoring what’s trending on Facebook, were the infrastructure that powered a large portion of research and reporting on social media. However, as these tools become less useful and accessible, new methods of independent data collection are needed to understand what these companies are doing and how people are using their platforms.

To meaningfully report on the impact digital systems have on society, we need to be able to observe what’s taking place on our devices without asking a company for permission. As someone who has spent the past decade building tools that crowdsource data to expose algorithmic harms, I believe the public should have the ability to peek under the hood of their mobile apps and smart devices, just as they can on their browsers. And it’s not just me: The Integrity Institute, a nonprofit working to protect the social internet, recently released a report that lays bare the importance of transparency as a lever to achieve public interest goals like accountability, collaboration, understanding, and trust.

To demand transparency from tech platforms, we need a platform-independent transparency framework, something that I like to call an inspectability API. Such a framework would empower even the most vulnerable populations to capture evidence of harm from their devices while minimizing the risk of their data being used in research or reporting without their consent.

An application programming interface (API) is a way for companies to make their services or data available to other developers. For example, if you’re building a mobile app and want to use the phone’s camera for a specific feature, you would use the iOS or Android Camera API. Another common example is an accessibility API, which allows developers to make their applications accessible to people with disabilities by making the user interface legible to screen readers and other accessibility tools commonly found on modern smartphones and computers. An inspectability API would allow individuals to export data from the apps they use every day and share it with researchers, journalists, and advocates in their communities. Companies could be required to implement this API to adhere to transparency best practices, much as they are required to implement accessibility features to make their apps and websites usable for people with disabilities.

In the US, residents of some states can request the data companies collect on them, thanks to state-level privacy laws. While these laws are well-intentioned, the data that companies share to comply with them is usually structured in a way that obfuscates crucial details that would expose harm. For example, Facebook has a fairly granular data export service that allows individuals to see, amongst other things, their “Off-Facebook activity.” However, as the Markup found during a series of investigations into the use of Pixel, even though Facebook told users which websites were sharing data, it did not reveal just how invasive the information being shared was. Doctor appointments, tax filing information, and student loan information were just some of the things that were being sent to Facebook. An inspectability API would make it easy for people to monitor their devices and see how the apps they use track them in real time.

Some promising work is already being done: Apple’s introduction of the App Privacy Report in iOS 15 marked the first time iPhone users could see detailed privacy information to understand each app’s data collection practices and even answer questions such as, “Is Instagram listening to my microphone?”

But we cannot rely on companies to do this at their discretion—we need a clear framework to define what sort of data should be inspectable and exportable by users, and we need regulation that penalizes companies for not implementing it. Such a framework would not only empower users to expose harms, but also ensure that their privacy is not violated. Individuals could choose what data to share, when, and with whom.

An inspectability API will empower individuals to fight for their rights by sharing the evidence of harm they have been exposed to with people who can raise public awareness and advocate for change. It would enable organizations such as Princeton’s Digital Witness Lab, which I cofounded and lead, to conduct data-driven investigations by collaborating closely with vulnerable communities, instead of relying on tech companies for access. This framework would allow researchers and others to conduct this work in a way that is safe, precise, and, most importantly, prioritizes the consent of the people being harmed.

Source

Wired