Your devices and apps really, really want to know where you are—whether it's to tell you the weather, recommend some restaurants you might like, or better target advertising at you. Managing what you're sharing and what you're not sharing, and when, can quickly get confusing.

It's also possible that you have inconsistencies in the various location histories logged by your devices: Times when you thought you'd switched off and blocked location sharing but you're still being tracked, or vice versa.

Here we'll cover everything you need to consider when it comes to location tracking, and hopefully simplify it along the way. Whether you want to give out access to your current location or not, you should be in control of these settings, and not be caught unawares by additional options that you missed.

How Location Tracking Gets Confusing

You can turn off Google Location History—but it's just the start.

Google via David Nield

What happens if you distinctly remember turning location tracking off on a device, yet your position is still popping up on a map? Or maybe you thought you'd left the feature on, yet you're seeing gaps in your location history? There are a few explanations, but essentially you need to remember all the different ways your location can be logged: by your devices, by your apps, and by websites you visit.

For example, you might have disabled location tracking on a phone but left it enabled on a tablet. Alternatively, you might have a laptop that's tracking where you are in the background, even though you thought you'd disabled the feature in the apps you use. If you want location tracking completely enabled or disabled, you need to factor in all these different ways of keeping tabs on where you are.

If you have a Google account, this is a good illustration. Head to your account settings on the web, then choose **Data and Privacy** and **Location History**. Select **Devices on This Account**, which may reveal some phones, tablets, and laptops that you'd forgotten about—any device with a check next to it in this list is saving your movements to your Google account for future reference.

You can click **Turn Off** to disable this, but note the caveats that are listed in the confirmation box that appears onscreen: Your location might still be logged by your mobile devices, by the Find My Device service that helps you recover lost hardware, and by Google Maps when you're navigating or searching around the area you're in. This Location History setting is more of an overall toggle switch, affecting features such as the Google Timeline and the ability to quickly look up places you visit regularly.

From the main Google account screen, there are several more places where your location gets logged and shared: Click **Data and Privacy** then **Web & App Activity** to manage location data saved by Google Maps and other apps and websites, and click **People andSharing** then **Manage Location Sharing** to see a list of specific contacts who can see where you are through various Google services.

Managing Location Tracking on Mobile

You can control location tracking for individual apps and devices as a whole.

Android via David Nield

The steps to manage your location on Android vary slightly depending on the manufacturer of your phone, but the menus and instructions involved are broadly similar. On Google Pixel devices, you can open up **Settings** then select **Location**: You'll see the **Use Location** toggle switch, and if you turn this off, none of your apps will be able to know where you are, nor will Google.

If you leave the **Use Location** toggle switch on, you can customize location access for individual apps further down on the same screen. Note that you can choose to allow apps to know where you are at all times, or only when the app in question is running in the foreground—tap on any app in the list to make changes.

Over on iOS, it's a similar setup. If you select **Privacy & Security** from **Settings**, and then tap **Location Services**, you can turn off location tracking for the phone and all the apps on it. If you choose to leave this enabled, you can manage individual app access to your location via the list underneath. As on Android, you can choose to restrict apps to knowing your location only when the particular app itself is running, or allow them to monitor it in the background too.

Erasing the location data that's been collected on you is a complex process, as you need to check the records and the settings of every app that's ever had access to your location. For Google and Google's apps, you can head to your Google account on the web, then choose either **Location History** or **Web & App Activity** under **Data and Privacy** to wipe this data from the record. You'll also find options for automatically deleting this data after 3, 18, or 36 months.

Apple doesn't log your movements in quite the same way, but it does build up a list of places you visit frequently (like your home and perhaps your office) so you can quickly get to them again. To clear this list on your iPhone, open **Settings** then choose **Privacy & Security**, **Location Services**, **System Services**, and **Significant Locations**. You can clear this list and stop it from populating in the future.

Managing Location Tracking on Desktop

You can control location tracking on Windows and its individual programs.

Windows via David Nield

Your laptop or desktop computer is unlikely to be fitted with GPS capabilities, so it won't track your location in quite the same way as your phone, but applications, websites, and the operating system will still have some idea where you are—primarily through the locations that you sign into the web from (via your home Wi-Fi, for example).

On Windows, you can open up **Settings** and then choose **Privacy & Security** and **Location**. As on Android and iOS, you'll see you can turn location tracking off for individual applications (via the toggle switches on the right) or shut it down for the entire computer (the option at the top). The same screen lets you see which apps have been using your location, and enables you to wipe the log of your travels—click **Clear** next to **Location History** to do this.

When it comes to the same process on macOS, you need to click the **Apple** menu and select **System Settings**, **Privacy & Security**, and **Location Services**. The next screen looks very similar to the Windows one, with toggle switches for individual applications as well as for macOS itself—turn off any of the switches where you don't want location access to be given. If you click **Details** next to **System Services** on this screen, you can clear the list of “significant locations” Apple has saved for you, just like on iOS.

If location tracking is on for your computer and your browser of choice, that means individual websites such as Facebook, Amazon, or the Google Search can know where you are as well. Sometimes this is useful, of course (for getting the right weather forecast), but there might be times when you want to turn it off if you're trying to keep your whereabouts private.

Every browser will have settings for managing website access to your location. In Chrome, it's **Privacy and Decurity**, **Site Settings,** and **Location** from the settings pane; if you're using Edge you need to open settings and choose **Cookies and Site Permissions** then **Location**; and on Safari on macOS, pick **Websites** and **Location** once you've got the settings dialog open. Changing these settings won't affect data these sites have collected in the past, though—you'll need to visit the options for the individual sites for that.

How to Make Sure You’re Not Accidentally Sharing Your Location

Plus: Deepfake disinformation spotted in the wild, Android privacy problems in China, Reddit gets phished, and more.

With a major United States intelligence authority set to expire at the end of the year, and a congressional showdown brewing over whether or not to renew it, new details of an internal audit show that US Federal Bureau of Investigation (FBI) personnel have repeatedly conducted unlawful searches of data collected under the imperiled surveillance authority. Agents requested information on journalists, a US congressman, and a political party as a result of what the US Department of Justice called “misunderstandings.”

This week, WIRED spoke to the creator of Sinbad.io, a cryptocurrency privacy service popular among North Korean hackers and other cybercriminals that has facilitated money laundering for tens of millions of dollars. And officials from the United Kingdom and United States announced sanctions against seven alleged members of the Conti and Trickbot ransomware groups, publishing their real-world names, dates of birth, email addresses, and photos. The two governments also took the unusual step of stating plainly that they see evidence of links between Russia-based cybercrime groups and the Kremlin’s intelligence services.  

US President Joe Biden asserted in his State of the Union address this week that ​​the US needs a bipartisan effort to “impose stricter limits on the personal data that companies collect on all of us.” Reactions in Washington after the speech were hopeful, but also realistic that getting a national privacy law on the books in the US anytime soon may prove too much of a political minefield to traverse. Meanwhile, legal experts told WIRED this week that the US’s Fair Credit Report Act should already curtail the information about Americans that data brokers can collect and sell. A new letter to the Consumer Financial Protection Bureau called on the agency to start enforcing violations.

We looked at how Moscow’s expansive smart city initiative, launched with the promise of reduced crime rates, is increasingly being used for draconian AI-assisted surveillance in the city amid Vladimir Putin’s war in Ukraine. And if you were hoping to delete your Twitter DMs through GDPR requests for erasure, the company doesn’t seem to have any plans to comply.

Plus, there’s more. Each week we round up the stories we didn’t cover in-depth ourselves. Click on the headlines to read the full stories. And stay safe out there.

North Korea’s elite state-sponsored hackers are some of the world’s most relentless—stealing millions of cryptocurrency each year to evade sanctions and fund the hermit nation’s nuclear programs. A new security alert from officials in the US and South Korea this week reveals how ruthless the country’s threat actors can be. State-backed hackers used around a dozen types of malware and ransomware to attack South Korean and US hospitals and health care systems, according to the US National Security Agency (NSA), FBI, and Cybersecurity and Infrastructure Security Agency (CISA).

John Hultquist, who leads intelligence analysis at security firm Mandiant, says the attacks are linked to the Andariel group and that several hospitals “have had to weather major disruptions” because of the attacks. In some of their operations, the advisory from the governments says, the attackers would try to “obfuscate” their involvement, use VPNs or virtual private servers to mask their location, and use common vulnerabilities to gain access to networks. The attackers used their own privately developed malware along with ransomware strains belonging to other groups, such as LockBit.

Pro-Chinese bot accounts on Twitter and Facebook have spread news videos in which presenters decry the lack of action against gun violence in the US and promote China’s world politics. The messaging isn’t exactly anything new, but there’s a twist to the propaganda: The news anchors in the videos—one man and one woman—aren’t real. They’re AI-generated characters, commonly known as deepfakes. The videos were discovered last year by disinformation research firm Graphika, which says it is the “first time we’ve seen this in the wild.” The company says it believes the videos were created using a commercial AI video software service, and were low-quality overall. None of the videos had more than 300 views.

Researchers from universities in the UK and Ireland have discovered that leading Android phones in China are hoovering up people’s personal data. The pre-installed operating systems on Xiaomi, OnePlus, and Oppo Realme devices are collecting people’s locations, call history, and profile information before sending it on to third parties, according to a study from academics at the University of Edinburgh and Trinity College Dublin. The researchers conducted the research on phones bought in China and measured the network traffic the devices generate. In many instances, they write, people aren’t notified about the data that’s collected or given any choices to opt out. The study reiterates how different privacy rules are in China compared to many other parts of the world and the myriad ways people can be tracked. “The data shared by the global version of the firmware is mostly limited to device-specific information,” the researchers conclude.

Reddit said on Thursday that hackers had accessed its source code after a successful phishing attack compromised an employee’s system credentials. The incident also exposed the contract information of hundreds of current and former Reddit employees and contacts. Reddit, which is owned by WIRED’s parent company Advance Publications, said that the incident did not impact user passwords or production systems, but suggested that users reset their passwords and ensure they have two-factor authentication turned on for their accounts. The company also said that the lessons it learned after suffering a data breach five years ago were protective and helpful in dealing with the recent incident.

North Korean Hackers Are Attacking US Hospitals

A review of the FBI’s access to foreign intelligence reveals troubling misuse of powerful surveillance tech.

An existential fight over the US government’s ability to spy on its own citizens is brewing in Congress. And as this fight unfolds, the Federal Bureau of Investigation’s biggest foes on Capitol Hill are no longer reformers merely interested in reining in its authority. Many lawmakers, elevated to new heights of power by the recent election, are working to dramatically curtail the methods by which the FBI investigates crime.

New details about the FBI’s failures to comply with restrictions on the use of foreign intelligence for domestic crimes have emerged at a perilous time for the US intelligence community. Section 702 of the Foreign Intelligence Surveillance Act (FISA), the so-called crown jewel of US intelligence, grants the government the ability to intercept the electronic communications of overseas targets who are unprotected by the Fourth Amendment.

That authority is set to expire at the end of the year. But errors in the FBI’s secondary use of the data—the investigation of crimes on US soil—are likely to inflame an already fierce debate over whether law enforcement agents can be trusted with such an invasive tool. 

Central to this tension has been a routine audit by the Department of Justice’s (DOJ) national security division and the office of the director of national intelligence (ODNI)—America’s “top spy”—which unearthed new examples of the FBI failing to comply with rules limiting access to intelligence ostensibly gathered to protect US national security. Such “errors,” they said, have occurred on a “large number” of occasions.

A report on the audit, only recently declassified, found that in the first half of 2020, FBI personnel unlawfully searched raw FISA data on numerous occasions. In one incident, agents reportedly sought evidence of foreign influence linked to a US lawmaker. In another, an inappropriate search pertained to a local political party. In both cases, these “errors” attributed to a “misunderstanding” of the law, the report says.

At some point between December 2019 and May 2020, FBI personnel conducted searches of FISA data using “only the name of a US congressman,” the report says, a query that investigators later found was “noncompliant” with legal procedures. While some searches were “reasonably likely to return foreign intelligence information,” investigators said, they were also “overly broad as constructed.”

In another incident, the FBI ran searches using the “names of a local political party,” even though a connection to foreign intelligence was “not reasonably likely.” The DOJ explained the errors away by saying FBI personnel “misunderstood” the search procedures, adding they were “subsequently reminded of how to correctly apply the query rules.” These are the mistakes that will ultimately serve as ammunition in the coming fight to diminish the FBI’s power.

Elizabeth Goitein, senior director of the Brennan Center for Justice’s national security program at New York University School of Law, says that while troubling, the misuse was entirely predictable. “When the government is allowed to access Americans’ private communications without a warrant, that opens the door to surveillance based on race, religion, politics, or other impermissible factors,” she says. 

Raw Section 702 data, much of which is derived “downstream” from internet companies like Google, is regarded as “unminimized” when it contains unredacted information about Americans. Spy agencies such as the CIA and NSA require high-level permission to “unmask” it. But in what privacy and civil liberties lawyers have termed a “backdoor search,” the FBI regularly searches through unminimized data during investigations, and routinely prior to launching them. To address concerns, the US Congress amended FISA to require a court order in matters that are purely criminal. Years later, however, it was reported that the FBI had never sought the court’s permission.

FISA surveillance came under heightened Republican criticism following revelations that, in October 2016, a secret court had authorized a wiretap on a former campaign aide of then-presidential nominee Donald Trump during the FBI’s investigation into election meddling by Russia. While an inspector general’s report later found sufficient cause for the investigation, the wiretap application was haphazardly approved in the face of numerous FBI errors. 

Section 702—notably, not used to authorize the wiretap itself—was first enacted as part of the FISA Amendments Act in 2008, and was more recently reauthorized until December 31, 2023. Congress must vote by year’s end to extend the authority any further. This deadline will provoke a debate around government surveillance likely to continue throughout the year, with the Biden administration pushing for a swift reauthorization and Republicans such as Jim Jordan, a top FBI critic, standing in its way.

Jordan, who wields significant power now as chairman of the House Judiciary Committee, signaled on Fox News before the start of the new Congress that a reauthorization bill before his committee might be dead on arrival.

DOJ investigators unearthed another incident, which in the report they say violated US attorney general guidelines: an FBI analyst using Section 702 intelligence in a way that “lacked a proper authorized purpose.” The investigators said “improper queries” were prompted by a report about an “individual of Middle Eastern descent,” whom a witness claimed “sped” into a parking lot before honking his horn. “A second individual of Middle Eastern descent” then began loading boxes into a second vehicle, said the witness, who noted some of the boxes were labeled Drano, the brand name of a drain-cleaning product.

The report does not opine on whether the tip was the result of racial profiling, and it is widely known that chemicals commonly found in drain cleaners, among other household products, can be used in the creation of homemade bombs. The report only states that the matter was closed prior to the audit, and that it is the FBI’s prerogative to destroy any unminimized data it unlawfully obtained.

The errors at the FBI aren’t likely to bolster the US intelligence community’s case that the benefits of Section 702 outweigh any risks to Americans’ civil liberties by a mile, and that allowing it to sunset would widely compromise investigations into terrorists, foreign spies, and cyberattacks on American infrastructure. “Nothing is untouched, essentially, by this authority; it is fundamental to our work,” Avril Haines, the US’s director of national security, said earlier this year.

Prominent political figures, including US Senators Ron Wyden and Rand Paul, have put forward bills in the past seeking to limit the FBI’s access to unminimized Section 702 data. A bill initially put forward by the lawmakers in 2017, known as the USA RIGHTS Act, sought to rein in the FBI’s “sweeping authority,” which they described as being “clouded in secrecy.” Hakeem Jeffries, the current House Democratic Leader, was a cosponsor of the bill.

“The intelligence community, and the FBI in particular, has unnecessarily plundered the most private, sensitive information of American citizens, treating the Fourth Amendment with contempt,” says former Republican House Judiciary chair Bob Goodlatte, now senior adviser to the Project for Privacy and Surveillance Accountability. “Congress must add impenetrable guardrails to Section 702, requiring probable cause warrants to obtain Americans’ private information.”

Other troubling incidents, previously disclosed by a redacted court ruling, are also mentioned, including FBI searches of Section 702 data during “background investigations” into repairmen who’d been given access to an FBI field office; individuals who’d requested to join the bureau’s “Citizens Academy”—a program for “business, religious, civic, and community leaders”—and “individuals who entered the field office seeking to provide a tip or to report that they were the victim of a crime.”

The FBI did not respond to a request for comment. Inquiries at the offices of the House and Senate Judiciary Committees also went unanswered.

Sean Vitka, senior policy counsel for Demand Progress, a nonprofit focused on national security reform, says it is difficult to exaggerate the danger posed by federal agents rummaging through “untold millions of emails and other communications” without a warrant, while ignoring basic safeguards. “There is something deeply wrong with FISA and the government’s out-of-control surveillance state, and it is absolutely imperative that Congress face it head-on this year, before it’s too late,” he says.

The recently disclosed errors are not the first in FBI’s history, according to research by Demand Progress. Starting in 2017 and continuing until at least 2019, the bureau is known to have conducted thousands of legally impermissible searches, according to declassified court records. The Foreign Intelligence Surveillance Court noted in a 2018 memorandum, for instance, that the FBI’s minimization procedures, “as they have been implemented,” were consistent with neither the FISA requirements nor the Fourth Amendment itself.

It has also not complied with regulations, passed in 2018, that required a court order before using Section 702 data to further domestic criminal investigations. An oversight review conducted prior to November 2020 found, for instance, that the FBI had conducted 40 queries without proper authorization related to a range of activities, from organized crime and health care fraud to public corruption and bribery.

A previous DOJ audit—declassified in August 2021—disclosed that, in one instance, an intelligence analyst had conducted “batch queries” of FISA-acquired information at the FBI’s request, using the personal information of “multiple current and former United States government officials, journalists, and political commentators.” While the analyst attempted to remove the US information, in some cases, it said, they “inadvertently failed” to do so.

The FBI’s Most Controversial Surveillance Tool Is Under Threat

The world’s most prolific crypto thieves have used Sinbad.io to launder tens of millions. Its creator, “Mehdi,” answers WIRED’s questions.

In the cryptocurrency economy, there's often a fine line between financial privacy and money laundering. Now one Bitcoin "mixer" service called Sinbad.io is walking that tightrope in full public view: Just a few months after launching on the open web, it appears to have already become the preferred money-laundering outlet for the world's most prolific state-sponsored crypto thieves.

In a portion of its annual crime report published last week, blockchain analysis firm Chainalysis noted that Sinbad—which, like other mixer services, offers to foil cryptocurrency tracing efforts by taking in users' cryptocurrency, mixing their coins with other those of other users, and returning the same amount—had received $25 million in stolen cryptocurrency from North Korean hackers in just December and January, more than any other mixing service had received.

Those funds, according to Chainalysis, include portions of the thieves' proceeds from massive heists that targeted the Harmony Bridge service, from which the North Koreans stole roughly $100 million, as well as the Ronin Bridge service, from which the hackers stole a staggering $650 million. Chainalysis' vice president of investigations, Erin Plante, says North Korea's crypto-stealing cybercriminals began funneling their profits bit by bit through Sinbad almost immediately after the mixer's October launch, in the hopes of obscuring their loot's origin before cashing it out at an exchange. Sinbad "hit the radar for North Korea quickly," Plante says, "and it's become their favorite."

That's put the new service in an awkward position: Just weeks after its debut, Sinbad became a tool that operates publicly—with a traditional website running in the open in addition to a dark-web site running on the anonymity network Tor—and yet some of its earliest, most high-volume users also happen to be the crypto world's most notorious cybercriminals. North Korean hackers, according to Chainalysis's findings, stole no less than $1.7 billion in cryptocurrency last year, helping to make the year the worst on record for total crypto thefts.

Sinbad's's founder, meanwhile, argues in an email interview with WIRED that the service has no reason to hide. "Sinbad is present in clearnet because it doesn’t do anything bad," writes the service's creator and administrator, who asked to be called "Mehdi," using the term "clearnet" to mean a website not hidden on the Tor network.

"I am against total surveillance, control over internet users, against autocracies and dictatorships," Mehdi adds. "Every living person has the right to privacy."

Mehdi, who declined to reveal his real name or where he or Sinbad are based, says that he created Sinbad as a response to the growing centralization of cryptocurrency and the erosion of the privacy promises it once appeared to offer. He named his mixer service after the fictional Middle Eastern sailor who, as Mehdi puts it, "traded goods all around the world." Mehdi describes Sinbad as a legitimate privacy-preserving technology project, comparing it to privacy-focused cryptocurrencies like Monero or Zcash, anonymity-enhancing crypto wallet software like Wasabi, and the Tor browser, which encrypts user traffic and routes it through multiple servers to hide people's identities.

As for the tens of millions of dollars that North Korean hackers laundered through Sinbad? "Your magazine is the first one to ever contact me about this issue," Mehdi writes. "In case I receive a request from \[Chainalysis\] or any other institution I will investigate the matter and make my opinion on it."

Sinbad's position highlights a strange tension in the world of cryptocurrency. The cryptocurrency obfuscation tools like Monero, Zcash, and Wasabi to which Mehdi compares Sinbad do have legitimate and legal uses—say, a retail store that wants to accept cryptocurrency payments without revealing its revenue to a competitor, or dissidents in a repressive regime who want to fund their opposition movement through international cryptocurrency donations without being tracked. Mixer services are among those privacy services. They can, in some cases, protect users' funds from being traced on blockchains, where transactions are often all too easily surveilled. But mixers also often enable money laundering by the rampant ransomware gangs, scammers, dark-web black market vendors, and thieves who have long exploited the crypto economy.

In recent years, Western law enforcement has cracked down on a series of mixer services, a law enforcement effort that's left fewer money-laundering options for cybercriminals than at any time in the past decade, according to Chainalysis. The US Department of Justice indicted the alleged administrators of mixing services Bitcoin Fog and Helix in 2020, and Dutch prosecutors late last year launched similar charges against the creator of another crypto mixing service, Tornado Cash. The US Treasury's Office of Foreign Asset Controls also imposed sanctions against Tornado Cash and the mixing service Blender, both of which Chainalysis says were previously used by North Korean hackers to launder millions of dollars in stolen crypto.

But in the US criminal cases against mixing service administrators, at least, the Department of Justice has claimed that the services knowingly conspired with criminals. In the cases of Bitcoin Fog, for instance, prosecutors say undercover agents told the service that they sought to launder profits from dark-web drug sales, and Bitcoin Fog nonetheless completed their transactions. Helix advertised its services on the homepage of dark-web drug market AlphaBay.

Mehdi, by contrast, argues that he wasn't aware that the $25 million in allegedly dirty crypto Chainalysis identified was sent to Sinbad by North Korean hackers: Those funds were stolen, Mehdi points out, in the form of the cryptocurrency Ether and only later exchanged for bitcoins, the only cryptocurrency Sinbad accepts. "I couldn't have possibly known about the funds' sources," Mehdi writes.

Chainalysis' Plante speculates that the North Korean hackers may have chosen Sinbad in part due to its newness. Because it only recently appeared online, she says many investigators may not have yet identified its Bitcoin addresses, making its mixing far harder to trace. Plante declined to say whether Chainalysis had managed to defeat the service's mixing itself, potentially tracing its users' coins in spite of Sinbad's privacy assurances—a feat the company says it's achieved with some other cryptocurrency mixing services in the past.

But Nick Carlsen, an investigator at another cryptocurrency tracing firm, TRM Labs, argues that Sinbad is likely too small to function as an effective mixer: The fewer users and the smaller their pool of funds, the easier it is to distinguish their transactions and follow the money. And that thin layer of temporary anonymity may be all that North Korean hackers are seeking, given that they're usually based in North Korea or China, far beyond the reach of Western law enforcement. "The North Koreans' typical MO isn't to obtain the kind of anonymity any other hacker would need," says Carlsen. "They're usually just trying to buy themselves a few hours of breathing room with which they can carry out the next phase of their laundering op."

As for whether Mehdi himself might be identified, indicted, arrested, or sanctioned, he told WIRED he remains relatively confident about his own fate. He shared a long list of cryptocurrency mixing services on the forum BitcoinTalk, pointing out that relatively few have faced those outcomes. "It would be silly not to worry about it at all. I take all the necessary precautions to protect my anonymity," he writes, but "I expect to remain part of the market and not become one of the unfortunate exceptions."

Amid a continuing crackdown on crypto money-laundering services, though, there's no doubt Sinbad's high-wire act is riskier than ever—particularly as its North Korean users paint an ever-larger target on its back.

Meet the Creator of North Korea’s Favorite Crypto Privacy Service

Members of the Trickbot and Conti cybercrime gangs have been sanctioned in an unprecedented wave of action against the country’s hackers.

For years, Russia-based ransomware gangs have launched crippling attacks against businesses, hospitals, and public sector bodies, extorting hundreds of millions of dollars from victims and causing untold disruption. And they’ve done so with impunity—but no more. Today, as part of a push to shut down ransomware gangs, the UK and US governments have unmasked some of the criminals behind the attacks. 

In a rare move, officials have sanctioned seven alleged members of notorious ransomware gangs and published their real-world names, dates of birth, email addresses, and photos. All seven of the named cybercriminals are said to belong to the Conti and Trickbot ransomware groups, which are linked and often jointly referred to as Wizard Spider. Moreover, the UK and US are now explicitly calling out links between Conti and Trickbot and Russia’s intelligence services.

“By sanctioning these cybercriminals, we are sending a clear signal to them and others involved in ransomware that they will be held to account,” UK foreign secretary James Cleverly said in a statement on Thursday. “These cynical cyberattacks cause real damage to people’s lives and livelihoods.”

The seven gang members named by the two governments are: Vitaly Kovalev, Maksim Mikhailov, Valentin Karyagin, Mikhail Iskritskiy, Dmitry Pleshevskiy, Ivan Vakhromeyev, and Valery Sedletski. All the members have online handles, such as Baget and Tropa, that they used to communicate with each other without using their real-world identities.

On Thursday, the UK’s National Cyber Security Center (NCSC) said it is “highly likely” that members of the Conti group have links to “the Russian Intelligence Services” and that those agencies have “likely” directed some of the gang’s actions. NCSC is part of the UK intelligence agency GCHQ, and this is the first time the UK has sanctioned ransomware criminals.

Similarly, the US Department of the Treasury has concluded that Trickbot Group members are “associated with Russian Intelligence Services.” It added that the group’s actions in 2020 were aligned with Russia’s international interests and “targeting previously conducted by Russian Intelligence Services.”

According to the US Treasury, these members were involved in malware and ransomware development, money laundering, fraud, injection of malicious code into websites to steal login details, and managerial roles. As part of the sanctions, the UK froze assets belonging to the ransomware actors and imposed travel bans on them. The US District Court for the District of New Jersey also unsealed an indictment charging Vitaliy Kovalev with conspiracy to commit bank fraud and eight counts of bank fraud against US financial institutions in 2009 and 2010.

Governments have struggled to get a handle on the growing ransomware threat, in large part because many of the criminal groups operate in Russia. The Kremlin has provided a safe haven for these bad actors—as long as they don’t target Russian companies. Last year, following a string of particularly aggressive and disruptive attacks on US and UK targets, Russian law enforcement did arrest more than a dozen alleged members of the notorious ransomware gang REvil. But Russia has continued to be the origin point for an array of cybercriminal activity, including ransomware attacks.

Alex Holden, the founder of security firm Hold Security, has tracked the Conti and Trickbot groups for the better part of a decade, mapping out their members and activities. Holden says that “unmasking” the criminals can make a difference to their actions. “Ransomware gang members should be afraid of their real names being made public, as they will be forced to run and hide even if they can’t be brought to justice in our legal system,” he says.  

The unmasking of Conti and Trickbot members follows two huge leaks from the criminal gangs in early 2022. After Vladimir Putin’s full-scale invasion of Ukraine in February 2022, members of the Conti gang declared their support for Russia. A Ukrainian cybersecurity researcher who had infiltrated the group reacted by leaking more than 60,000 of its internal chat messages, revealing key details about members and their hacking activities. This was followed by a second leak from Trickbot, weeks later. It is likely that these details have helped law enforcement agencies track down and identify members of the gangs.

Researchers have long concluded that cybercriminals working in Russia have amorphous but crucial connections to the Kremlin, but there has been little clear information, and officials have often been vague about the dynamic. 

Kimberly Goody, a senior manager in cybercrime analysis at the Google-owned security company Mandiant, says details from the leaked chatlogs in early 2022 are consistent with the US and UK linking some elements of the groups to Russian intelligence services. 

The Conti chatlog leak also revealed some potential links between Conti members and the Russian state. The logs show Conti members working on “government topics” for their hacking and illustrate their knowledge of the prominent Kremlin-sponsored hacking group Cozy Bear. Members of Conti also discussed whether they could hack someone linked to open source investigative journalism unit Bellingcat.

The cybercrime group was “inarguably not flying below the radar,” Goody says. “Russia knew about it, and they \[Russia\] have a history of tapping into their community of cyber criminals when it suits them—we saw that with the Dridex sanctions too.” Goody adds that the leaked chats show that other Trickbot members, who were not named in the most recent sanctions, may also have received instructions from people outside Trickbot.

In the summer of 2022, Google’s Threat Analysis Group and IBM’s X-Force both said Trickbot and Conti had shifted focus to attack Ukraine, a move that clearly appeared aligned with Russian interests. The IBM security researchers said they had not seen the group previously targeting Ukraine and called it an “unprecedented shift.”

Over the past decade, governments have increasingly called out state-backed hacking efforts from Russia, China, and other nations, occasionally even revealing the identities of individual government hackers. But researchers say that the focus on naming individual cybercriminals represents an important shift. “We’re now seeing these methods increasingly used with ransomware actors, reflecting the growing priority of cybercrime on national security agendas,” says Jamie Collier, a senior threat intelligence advisor at Mandiant.

But the long-term impact of unmasking ransomware groups is unclear. While the Conti group, for example, disbanded in June 2022 after hacking the government of Costa Rica, its members are thought to have continued their criminal activities, seemingly joining the Quantum, Royal, and Black Basta ransomware groups. But for victims who have faced the disruption and financial devastation of cybercrime, aggressive new action from world governments can’t come soon enough.

Russia’s Ransomware Gangs Are Being Named and Shamed

People in Europe are making GDPR requests to have their private messages erased, but Elon’s team is ignoring them.

Twitter’s direct messages have always been a security liability. The DMs you send to friends and internet strangers aren’t end-to-end encrypted, making your conversations potentially accessible if Twitter suffers a data breach, or to company staffers with the right permissions to access them. Both scenarios are arguably more likely in Elon Musk’s version of Twitter, where key security and data protection staff have departed.

Since Musk acquired Twitter and started laying off thousands of employees at the start of November, remodeling the firm in his vision, multiple waves of tweeters have abandoned the platform. When they do, they often try to download their Twitter archive and delete DMs. In the chaos, the process has often been glitchy.

However, in Europe, people have turned to the continent’s GDPR data laws, which give people rights over how their information is collected, stored, and used. This includes the right to have data deleted. However, Twitter’s response to these requests, which have been seen by WIRED, appears to show the platform ignoring detailed asks to delete DMs and just point people to generic guidance that doesn’t explain whether Twitter deletes your DMs from its servers. And now Europe’s data regulators are getting involved.

“On Twitter, the delete button does not do what users think it does,” says Michael Veale, an associate professor focusing on digital rights and regulation in the Faculty of Laws at University College London. “If you delete your direct messages within the app or on the website, it does not remove them from Twitter’s server,” Veale says.

For years, there hasn’t been any clarity around what Twitter’s inbuilt tools for deleting your messages actually do. Within the social media site, there are, theoretically, two ways to delete the DMs you’ve sent. In your inbox, you can delete entire conversations, while within messages you can delete individual posts.

Neither of these options really appears to delete your messages. If you delete entire conversations, Twitter says, they are removed from your messages inbox but still available to the person you are messaging. Meanwhile, if you delete an individual message, Twitter says the people you sent it to “will still be able to see it.” Twitter’s help center says messages and conversations are “deleted from your account only.” They don’t say messages are deleted from its systems or servers.

Previous research has found that deleted DMs are held within Twitter’s servers for years. In 2022, Twitter whistleblower and former security chief Peiter “Mudge” Zatko claimed it wasn’t possible in some cases for Twitter to delete data.

At the start of November, Veale created a guide that people in Europe can use to request that Twitter deletes DMs from its servers. In the guide, Veale says the “disaster scenario” is a data breach similar to 2015’s Ashley Madison hack, where people’s private lives were spread across the internet. Journalists, activists, protesters, and more have all relied on Twitter’s messages in the past decade to share private information and get in touch with those who may be at risk.

Both Europe’s GDPR and California’s CPPA privacy laws give people the right to ask companies to delete data they hold about them, though there are exceptions to these rules. Furthermore, if someone writes to a company under GDPR and asks it to delete their data, the firm is obliged to reply and, if refusing, explain its reasons why. Veale’s guide suggests using this language to request DM deletion: “I wish for these data to be erased from all systems, including backup systems (on an appropriate schedule).” It further suggests asking only for messages sent by your account to be deleted (not those you have received), and states there’s no obvious reason why Twitter should keep the messages.

Lari Lohikoski, a communications professional and entrepreneur based in Finland, manually deleted his DM conversations after Musk took over Twitter but also decided to request the company delete them from its systems. “I don’t see my direct messages on Twitter’s user interface, but I very much think that they are on their server still,” Lohikoski says. 

Twitter initially replied to his request with a short message advising him to delete his account to get rid of messages, which Lohikoski says is not what was asked for. (In November, the author of this article made a request for Twitter to delete their DMs and received a similar one-line response from Twitter.) Twitter, which no longer has a communications department, did not respond to WIRED’s request for comment. Its policies say: “Once your account is deleted, your account is no longer available in our systems.” It is not clear whether this means the data is deleted entirely, or is unavailable internally.

Lohikoski, who says Twitter doesn’t “seem to respect the GDPR,” complained to Finland’s data regulator and also the Irish data regulator, the body that primarily oversees Twitter in Europe. Veale received a similar message and complained to the Irish regulator as well as the UK’s Information Commissioner’s Office (ICO). TechCrunch has also reviewed complaints about deleting DMs.

The ICO told Veale that Twitter’s response “failed to comply with the requirement of the data protection legislation” as it didn’t reply properly to the request and only provided “general information” about deleting Twitter accounts. The ICO said it would write to Twitter. Companies that don’t follow GDPR rules may be liable for large fines or enforcement action—although it would be rare in this circumstance.

On January 18, Lohikoski says he received a “surprise” email from Twitter. It repeated Twitter’s help center advice about DMs. It did not directly respond to the points made in the initial request. Lohikoski says “this again does not respond to my request.” (The ICO told Veale that Twitter also replied to him around this time; however, it appears to have sent the message to an email address that doesn’t belong to Veale. The ICO told the company to explain how this happened.) An ICO spokesperson says that it is “engaged in dialog” with Twitter’s data protection officer and assessing the impacts of changes to Twitter under Musk. The ICO did not comment on any specifics of complaints about DMs being deleted. 

Since Musk took charge at Twitter, the company has been trying to reassure regulators that it is taking its obligations, particularly in Europe, seriously. European officials have criticized Twitter for suspending journalists and changing its API access in ways that could impact disinformation research. Twitter is also likely to fall under the strictest tier of Europe’s new Digital Services Act, which could see companies face large fines for not complying with its rules.

Twitter has claimed it wants to introduce end-to-end encryption to its DMs, but this could take awhile, if it ever happens at all. Until then, it is probably best not to include sensitive information in DMs. Instead, you should consider an encrypted messenger, such as Signal.

Ultimately, Veale says, Big Tech companies are trying to position themselves so that they decide what people’s information rights are and what information they should provide to people. Veale highlights tech companies’ “download your data” services, which provide people with their posts, photos, and other data, but appear to avoid providing other forms of data such as analytical information. “We don’t really know the extent of information that’s collected by these companies,” Veale says. “The real core problem is that these companies disguise things that look like information rights behind fake user interfaces.”

Want to Delete Your Twitter DMs? Good Luck With That

Biden’s speech calling for better data protections got a standing ovation from both sides of the aisle. So, where’s a federal privacy law?

When it comes to antitrust and tech, there’s a trust deficit on Capitol Hill, even as pressure to act continues to mount. And Senate Democrats trust Speaker McCarthy to do one thing: protect American-made monopolies.

“I think the sentiment is there, but we’ve had a difficult time getting Republicans to support legislation in this area,” says Senator Brian Schatz of Hawaii, a Democrat.

House Republicans may see common ground with Biden’s new tough-on-tech approach, but this is no kumbaya Congress—and the rest of Biden’s State of the Union vision, on first blush at least, has been portrayed by Republicans as a laundry list of reasons to never work with Biden, no matter their common tech foes. “What we saw tonight was Joe Biden talk about unity in one breath followed up with bashing and rolling Republicans,” says Republican congresswoman Kat Cammack of Florida. “That, to me, just shows he’s not serious about getting things done for the good of the American people.”

After dismissing the bulk of the president’s agenda, Cammack admits there was one bright spot. She calls Biden’s stern message to Silicon Valley “encouraging.”

“We have a really serious problem when it comes to our personal data being collected without warrants, being sold without our permission, and it’s time that we put people’s data and privacy back in their hands,” Cammack said. “So I was encouraged to hear that, but it’s a long road between now and then.”

Long road ahead, surely, but House members are only granted short, two-year windows of service, and the sprint to 2024 is already on. Pomp and circumstance was last night’s dress code, even if some got a different memo. But now the focus moves to legislating—and, especially on the eve of a presidential election, that means bomb-throwing and finger-pointing. 

Democrats and Republicans alike have failed to put up guard rails on the Silicon Valley donor class in recent years, even as both parties continue decrying the very tech sector Washington policymakers have refused to regulate, all while Americans’ data is mined, shared with law enforcement, or sold to other third parties. Hot air and deflated rhetoric aren’t options for this 118th Congress, according to Cammack.

“Truth be told, I don’t think we have a choice,” Cammack says. 

“We have a divided Congress, and Republicans in the House are serious about data protection for consumers, for Americans, and I think Democrats are as well. The trick is going to be putting a bill together that not just survives Congress but will avoid a veto when it gets to his desk. So that’s going to be where the rubber meets the road.”

Tech politics are different than other hot-button issues. They’re at once bipartisan—everyone has a gripe or three with Big Tech—but they’re also stubbornly stuck in Washington’s rigid partisan patterns. That’s why soaring rhetoric only goes so far, even as the mistrust is seemingly endless. Hence, the details are often the devil.  

“These are tough conversations. We all value privacy. We all want to protect our children,” says Senator Kevin Cramer of North Dakota, speaking for many of his fellow Republicans. “But we also like free enterprise. We like innovation. I always think it’s better to knock down barriers to competitors than it is to regulate the incumbents, so to speak, in business.”

Senators tend to be a little older than their House counterparts (according to Pew Research, 7.4 years older, on average). In recent years, the chamber’s octogenarians proved themselves the butt of Silicon Valley jokes, but times are changing—at Senate speed.

All five of the Republicans who captured Senate seats in November are bullish on Big Tech. While it’s unclear how quick—or successful—they’ll be in their efforts to educate their anti-regulation Republican elders, Silicon Valley’s congressional critics say Biden was wise to focus on protecting children’s private data. It’s a message that resonates far and wide, even on Speaker McCarthy’s Capitol Hill.

“But this issue of targeting our children with certain messages, using technology to basically gather data and persuade or take advantage of their habits, it’s really quite unnerving in this modern era,” Cramer says. “I think a lot of us traditionalists have to struggle a little bit with our basic individualism, with some protection.”

The Political Theater Behind the State of the Union Data Privacy Push

Legal experts say a key law should already prevent brokers from collecting and selling data that's weaponized against vulnerable people.

The letter also points to databases maintained by the British multinational RELX and the Canadian conglomerate Thomson Reuters, which, according to CUNY law professor Sarah Lamdan, author of _Data Cartels: The Companies That Control and Monopolize Our Information_, contain dossiers on roughly two-thirds of the US population, tracing their whereabouts and mapping social and familial relationships. 

In 2020 alone, data brokers extracted some $29 million while vying to undermine legislative efforts to rein in their industry, according to lobbying disclosures unearthed by The Markup. 

While many major data collectors acknowledge falling under the jurisdiction of the FCRA, others have evaded regulatory scrutiny by relying on what the lawyers petitioning Chopra deem erroneous legal analysis. Other firms partition their products and the surveillant data they gather to exempt from compliance what the credit reporting industry calls “header information,” traditionally consisting of people’s names, birth dates, and Social Security numbers, in addition to phone and residential histories. This, even when that data is derived from sources clearly subject to the law. 

“Data brokers are packaging the same personal data points about us into different products for sale and then claiming that certain products are beyond the reach of key legal protections,” says Laura Rivera, an attorney with Just Futures Law. “It’s dishonest, exploitative, and it leads to real harm to consumers of all backgrounds, but especially low-income communities of color, including immigrants.”

“In advocating for coverage of data brokers, we're simply asking the CFPB to restore the scope of the Act as Congress originally intended,” adds Chi Chi Wu, a staff attorney at the National Consumer Law Center, who identified a series of constricting court rulings over the years with watering the FCRA down. 

Historically disadvantaged communities face the brunt of the harm, Wu says, pointing to the sale of information on some of America’s poorest communities to predatory “payday” lenders. In fact, data brokers derive significant profit from businesses whose whole purpose is identifying consumers who face financial instability. A 2013 US Senate report noted, for example, that these purchases were often made by companies that “sell high-cost loans and other financially risky products”—unscrupulous businesses making bread and butter out of the economically vulnerable, including widows. 

Companies playing fast and loose with personal data have drawn the ire of consumer protectionists and Capitol Hill privacy hawks for years, leading to meager gains for consumers. In 2021, a slew of utility companies that had long pilfered cable, phone, and energy customers of sensitive data for their own profit agreed to end the practice of selling it to Thomas Reuters, which had, in turn, supplied it to government agencies and police, including US Immigration and Customs Enforcement. 

“Selling personal information that people provide to sign up for power, water, and other necessities of life, and giving them no choice in the matter, is an egregious abuse of consumers’ privacy,” Senator Ron Wyden, a Democrat of Oregon and leading government-surveillance critic, said in a letter to Chopra at the time. 

The US’s Defense Intelligence Agency, Defense Counterintelligence and Security Agency, and Customs and Border Protection (CBP) are among a wide range of federal agencies known to purchase Americans' private data, including that which law enforcement agencies would normally require probable cause to obtain. The US Supreme Court ruled in 2018 that police and intelligence agencies had no right to compel businesses to turn over location data derived from cellphones and other devices without a legal warrant. 

The decision did little to stop the government from sidestepping the courts. The Justice Department, the Office of the Director of National Intelligence, the Pentagon, and hundreds if not thousands of state and local police agencies have interpreted the ruling as having placed no restrictions on their ability to simply buy location data.

How the US Can Stop Data Brokers' Worst Practices—Right Now

Biden’s speech proves that protecting personal info is no longer a fringe issue. Now, Congress just needs to do something about it.

The European Union’s General Data Protection Regulation, enacted in 2018, provides far-from-perfect data privacy protection, but it stands in stark contrast to the legislative dearth in the United States, where there are no comprehensive federal data privacy laws on the books. In his second State of the Union address, though, US President Joe Biden devoted more attention than ever to the need for such a measure. 

With political control of the US Congress now split, Biden asserted that a data privacy law could garner bipartisan support. It's an idea that has been gaining traction in recent years, and the mention of data privacy issues in Tuesday’s State of the Union sets a precedent that the topic should be of real concern to US presidents and the public.

“We must finally hold social media companies accountable for experimenting they’re doing \[on\] children for profit,” Biden said during his speech, garnering a standing ovation from members of both parties. “It’s time to pass bipartisan legislation to stop Big Tech from collecting personal data on our kids and teenagers online. Ban targeted advertising to children and impose stricter limits on the personal data that companies collect on all of us.”

Previous US presidents rarely mentioned data privacy in the State of the Union. Former president Donald Trump never mentioned the topic in any of his annual addresses. Former president Barack Obama mentioned the topic only once during the 2014 State of the Union, following revelations about the previously undisclosed scale and scope of the National Security Agency’s bulk surveillance programs. He said then: “Working with this Congress, I will reform our surveillance programs—because the vital work of our intelligence community depends on public confidence, here and abroad, that the privacy of ordinary people is not being violated.”

In his first State of the Union, in 2022, Biden talked about data privacy as it pertains to protecting children. “It’s time to strengthen privacy protections, ban targeted advertising to children, demand tech companies stop collecting personal data on our children,” he said at the time. 

Biden’s remarks this year went further, signaling a shift in mainstream understanding about the urgency of improving data privacy protection in the US. Whether the step will lead to productive action in 2023, though, is less clear. In his remarks, Biden called for cooperation among lawmakers—a dynamic lacking in both chambers on Capitol Hill. “To my Republican friends, if we could work together in the last Congress, there is no reason we can’t work together and find consensus on important things in this Congress as well,” he said. 

All parts of the US political spectrum would likely agree that the previous Congress was not exactly a shining example of a high-functioning, collaborative legislative branch. By including a mention of data privacy in the State of the Union, Biden is adding extra pressure on his administration and lawmakers to deliver on an issue that affects everyone.

Biden’s SOTU: Data Privacy Is Now a Must-Hit US State of the Union Topic

Moscow promised residents lower crime rates through an expansive smart city project. Then Vladimir Putin invaded Ukraine.

Sergey Vyborov was on his way to the Moscow Metro’s Aeroport station last September when police officers stopped him. The 49-year-old knew that taking the metro could spell trouble. During a protest against Russia’s invasion of Ukraine, police had fingerprinted and photographed him. He’d already been detained four times in 2022. But he was rushing to his daughter’s birthday, so he took a chance.

Vyborov wasn’t arrested that day, but the police informed him that he was under surveillance through Sfera, one of Moscow’s face recognition systems, for participating in unsanctioned rallies. Considered one of the most efficient surveillance systems, Sfera led to the detention of 141 people last year. “Facial recognition, and video cameras in general in a totalitarian state, are an absolute evil,” Vyborov says. 

Vyborov finds himself at the bottom of a slippery slope that privacy advocates have long warned about. Under the guise of smart city technology, authoritarian and democratic governments have rolled out huge networks of security cameras and used artificial intelligence to try to ensure there is no place to hide. Cities have touted the ability of such systems to tackle crime, manage crowds, and better respond to emergencies. Privacy campaigners say such systems could be used as tools of oppression. In Moscow, Vyborov and countless others now face that oppression on a daily basis.

The Russian capital is now the seventh\-most-surveilled city in the world. Across Russia, there are an estimated 21 million surveillance cameras, and the country ranks among the top in the world in terms of the number of connected surveillance cameras. The system created by Moscow’s government, dubbed Safe City, was touted by city officials as a way to streamline its public safety systems. In recent years, however, its 217,000 surveillance cameras, designed to catch criminals and terrorists, have been turned against protestors, political rivals, and journalists. 

“Facial recognition was supposed to be the ‘cherry on top,’ the reason why all of this was built,” says a former employee of NTechLab, one of the principal companies building Safe City’s face recognition system.

Following Russia’s invasion of Ukraine, Safe City’s data collection practices have become increasingly opaque. The project is now seen as a tool of rising digital repression as Russia wages war against Ukraine and dissenting voices within its own borders. It is an example of the danger smart city technologies pose. And for the engineers and programmers who built such systems, its transformation into a tool of oppression has led to a moment of reckoning. 

An Innocent Start

Founded in 2015, NTechLab caught the attention of the global press with the February 2016 launch of FindFace, an app that allowed anyone to identify faces by matching them with images gathered from social network VKontakte, Russia’s Facebook equivalent. Met with warnings of the “end to public anonymity,” the app was reportedly downloaded by 500,000 people within two months of its launch. But for NTechLab, it was primarily a proof of concept for its nascent face recognition algorithm.

NTechLab still felt like a startup when one former employee, who asked not to be named for privacy reasons, joined the company. And he was drawn in by the complexity of the work.

“From \[an\] engineering point of view, it’s very interesting to work with: It’s very difficult,” he says. 

After the release of FindFace, NTechLab began selling its face recognition tech to small businesses, such as shopping malls that could use it to catch shoplifters or see how many people return to certain stores. But NTechLab was also working with the Moscow Department of IT Technology (DIT), the government department tasked with building Moscow’s digital infrastructure. In 2018, when Russia hosted the FIFA World Cup, NTechLab’s face recognition tech was connected to more than 450 security cameras around Moscow, and its tech reportedly helped police detain 180 people whom the state deemed “wanted criminals.”

At its inception, Moscow’s face recognition system was fed official watchlists, like the database of wanted people. The system uses these lists to notify the police once a person on the list is detected, but law enforcement can also upload an image and search for where a person has appeared. Over the years, security and law enforcement agencies have compiled a database of the leaders of the political opposition and prominent activists, according to Sarkis Darbinyan, cofounder of digital rights group Roskomsvoboda, which has been campaigning for a suspension of the technology. It remains unclear who is in charge of adding activists and protesters to watchlists.

In March 2019, following the success of the World Cup trial—some of Russia’s “most wanted” people were arrested while trying to attend matches—the Moscow Department of Transportation, which operates the city’s metro, launched its own surveillance system, Sfera. By October 2019, 3,000 of the city’s 160,000 cameras were enabled with face recognition tech, according to interior minister Vladimir Kolokoltsev.

NTechLab was one of many companies building the slew of systems that would later be branded Safe City. International companies, from US tech firms such as Nvidia, Intel, and Broadcom to South Korea’s Samsung and Chinese camera maker Hikvision, worked alongside local firms such as HeadPoint, Netris, and Rostelecom that have developed various components of the surveillance systems. According to procurement documents cited by the UK’s BBC, three companies besides NTechLab created face recognition tech for Moscow’s growing surveillance apparatus, including Tevian, and Kipod, and VisionLabs. Moscow's Transportation Department said in social media posts that Sfera was built using VisionLabs technology, although the company downplays its involvement.

NtechLab says it operates in compliance with local laws and does not have access to customer data or camera video streams. Nvidia and Intel say they left Russia in 2022, with Nvidia adding that it does not create software or algorithms for surveillance. Broadcom and Samsung also say they stopped doing business in Russia following the invasion. VisionLabs says it only provides the Moscow Metro with its face recognition payment system. Other companies did not respond to requests for comment. The DIT and the Moscow Department of Transportation did not respond to requests for comment.

At the end of 2018, as Russia cracked down harder on political dissent online and in the streets, the DIT started to change, says a former employee who asked to remain anonymous for safety reasons. The department used to just be the “technical guys” providing assistance to security services, with the Moscow government recruiting highly paid IT specialists to make the most efficient systems possible, according to Andrey Soldatov, an investigative journalist and Russian security services expert. But according to the former employee, the DIT was beginning to reflect the Kremlin’s authoritarian bent.

Then came Covid. 

Safe City launched in 2020, at the height of the Covid-19 pandemic. Russia, like some other countries, seemingly used the pandemic as grounds to expand its surveillance systems to catch people breaking self-isolation rules. By mid-March 2020, Safe City’s face recognition system had caught 200 people breaking lockdown restrictions. At the same time, Moscow introduced a regulatory sandbox for the development of AI applications with the participation of large IT companies, exempting authorities from the country’s already lax data protection requirements. “With Covid, \[the DIT\] essentially became a part of the repressive apparatus,” says Soldatov.

In addition to its network of more than 200,000 cameras, Safe City also incorporates data from 169 information systems, managing data on citizens, public services, transportation, and nearly everything else that makes up Moscow’s infrastructure. This includes anonymized cell phone geolocation data collection, vehicle license plate recognition, data from ride-hailing services, and voice recognition devices. As Safe City was still rolling out in 2020, the Russian government announced plans to spend $1.3 billion deploying similar Safe City systems across Russia. From the outside, the potential for the system to be abused seemed obvious. But for those involved in its development, it looked like many other smart city projects. “No one expected that the country would turn into hell in two years,” says one former NTechLab employee, who asked to remain anonymous for safety reasons.

The Black Box Problem

Attempts to break open Moscow’s digital black box have been stonewalled. Alena Popova, whose image was captured during a protest against politician Leonid Eduardovich Slutsky in April 2018, filed the first lawsuit against Moscow’s DIT for allegedly violating her privacy, seeking a ban on face recognition tech. The case was thrown out, but Popova has continued to file lawsuits, including one at the European Court of Human Rights—which Russia is no longer a part of. 

While Moscow operates one of the world’s most pervasive surveillance systems, Russian law does not safeguard individual privacy. With seemingly no hope of recourse, some activists have been forced to leave Russia altogether. Popova is now on the list of foreign agents and is living in an undisclosed overseas location. “I will not apply to any political asylum in any country because I would like to go back to my own country and fight back,” she says.

A key concern is that Moscow’s surveillance system was designed to conceal its data collection from Moscow’s 12 million residents, says Sergey Ross, founder of the Collective Action Center think tank and a former Moscow politician. Although the system is run by the Moscow government, elected members of the Moscow City Duma say they are excluded from regulating face recognition systems and have little insight into how it is being used. “It’s a complete black box,” says Ross.

“It was clear that sooner or later the technology would be used to catch activists and dissenters,” says Roskomsvoboda’s Darbinyan. 

Russia made almost 20,500 political arrests in 2022, according to data from human rights media organization OVD-Info, which characterizes the number as “unprecedented.” The arrests have sparked fears that Safe City will be expanded to catch draft dodgers—although former NTechLab employees say that doing so would be technically difficult to pull it off because of too many false positives. Still, Moscow police appear to be using face recognition to aid Russia’s war efforts in other ways.

In September 2022, just after Putin announced additional mobilization for the war against Ukraine, Viktor Kapitonov, a 27-year-old activist who’d protested regularly since 2013, was stopped by two police officers after being flagged by face recognition surveillance while he approached the turnstiles in Moscow’s marble-covered Avtozavdodskaya metro station. The officers took him to the military recruitment office, where around 15 people were waiting to enlist in Putin’s newly announced draft. 

“They let me in without waiting in line as if I were some sort of VIP person,” he says. The recruiters wanted to force Kapitonov to enlist, but he ended up escaping the draft. “I explained that I am not fit, I have a disability.”

A Guilty Conscience

From 2017 to 2020, NTechLab became one of Russia’s fastest-growing companies. Other face recognition firms have cashed in as well: The revenue of Russian face recognition developers grew between 30 and 35 percent in 2022, thanks in part to deals struck in the Middle East, Southeast Asia, India, and South America. Russia’s national AI strategy has supported such firms with grants, tax exemptions, and subsidies, which have benefited both startups and state corporations, including tech and finance giant Sber, telecom provider Rostelecom, and defense firm Rostec, which previously owned a minority stake in NTechLab. While NTechLab continues to work globally, reporting a revenue increase of 35 percent in 2022, it has also faced a backlash against its work with the Russian state.

In June of last year, a “name-and-shame” list of NTechLab employees was published \[in Russian\] with information collected from social media. The project went viral, and some employees reported being harassed online. Artem Zinnatullin, a software engineer now based in the US, says he published the list after NTechLab sold its new silhouette recognition technology to the Moscow government in June 2022. To him, it signaled support for Russia’s war in Ukraine. In the post, he called NTechLab “the blacksmith of the Digital Gulag.” Zinnatullin, who says he knew people arrested with the help of face recognition technology, believes publishing the list of NTechLab employees was only fair. “You recognize people on the street, it’s only fair if we use public data to recognize who you are,” he says.

Unlike many face recognition companies that keep a low profile, NTechLab’s splash with FindFace has turned it into a recognized brand. Employees say this high profile has made them into scapegoats. 

As arrests of activists and politicians mounted, the ethics of NTechLab’s technology became a recurring topic at company meetings. NTechLab staff have resisted the use of the company’s face recognition in rallies and refused to sell the technology to the military, according to people familiar with these discussions. Still, the NTechLab leadership concluded that the technology was ultimately positive—even if the occasional dissenting voice was arrested because of it. 

“We all saw these positive examples, we saw how it really catches criminals,” says one former NTechLab employee. “Most people in NTechLab would say they were doing something very good, technologies that can help and save people’s lives. It really did.”

As Russia furthered its march toward authoritarianism in 2021, NTechLab leadership began talking about moving the company abroad, according to people familiar with internal company discussions. But with lucrative government contracts abounding—NTechLab received a $13 million investment from the Russian Direct Investment Fund, the country’s sovereign wealth fund, in September 2020—its investors resisted the idea. The company was also changing. Its founders, Alexander Kabakov and Artem Kukharenko, stepped down from NTechLab—and both left Russia in December 2021 and February 2022, respectively, declaring their anti-war stance on social media. 

Other employees left amid an exodus of IT talent from Russia. The war changed how they viewed their work. “Looking back, we realize that we shouldn’t have done it,” says an NTechLab employee. “But even in 2017 and 2018, it was a completely different country. At least, that’s how it seemed to those who weren’t very immersed in politics.”

A Growing Threat

Russia’s Safe City projects show no sign of slowing. As more surveillance systems are deployed across the country, Moscow’s DIT is planning to centralize video streams collected across all regions into its own system. And new projects to digitize public services may make it even easier for the government to eventually create large databases where everyone can be found, according to Popova. “It is really scary,” she says. “If they digitalize all the databases and combine them to make this joint database, they can find everybody.” In July, Putin signed a federal law that funnels personal biometric data collected in the country into a single system—an effort to obtain an “almost unlimited monopoly” on the collection and storage of biometrics, says Roskomsvoboda’s Darbinyan. 

In a further expansion of the Safe City project, Rostec is also reportedly developing software that will help authorities predict riots and prevent their escalation by analyzing media reports, data from social networks, video cameras, and other sources. Rostec did not respond to a request for comment on its development of these systems.

Similar systems have been developed in some Chinese cities, and Russia is now playing catch-up. “The Russian government would probably like to move toward China, but they do not yet have the necessary technology,” says Kiril Koroteev, head of international practice at the Russia-based Agora International Human Rights Group.

For now, many activists in Russia are left to do whatever they can to skirt the country’s growing surveillance apparatus, including avoiding the Moscow Metro. Kapitonov hopes that a balaclava will keep him safe, while Vyborov aims to ride the metro early in the morning, when there are fewer police around to detain him. 

“I think that it was inevitable that such a system would be made sooner or later,” says one former NTechLab employee. Face recognition is like a knife, he says: It can be used to cut food, but it can also be used to cut innocent people. He now regrets that NTechLab played a key role in building Moscow’s Safe City project. He has left Russia and doesn’t think he will work on face recognition again. “I do not want to mess with it anymore,” he says.

_Update 9:25 am ET, February 6, 2023: Clarified the role of VisionLabs in the Sfera system and that NTechLab's founders have since left the company._

Source

Wired