Everything you need to know about the past, present, and future of data security—from Equifax to Yahoo—and the problem with Social Security numbers.

The History of Data Breaches

Data breaches have been increasingly common and harmful for decades. A few stand out, though, as instructive examples of how breaches have evolved, how attackers are able to orchestrate these attacks, what can be stolen, and what happens to data once a breach has occurred.

Digital data breaches started long before widespread use of the internet, yet they were similar in many respects to the leaks we see today. One early landmark incident occurred in 1984, when the credit reporting agency TRW Information Systems (now Experian) realized that one of its database files had been breached. The trove was protected by a numeric passcode that someone lifted from an administrative note at a Sears store and posted on an “electronic bulletin board”—a sort of rudimentary Google Doc that people could access and alter using their landline phone connection. From there, anyone who knew how to view the bulletin board could have used the password to access the data stored in the TRW file: personal data and credit histories of 90 million Americans. The password was exposed for a month. At the time, TRW said that it changed the database password as soon as it found out about the situation. Though the incident is dwarfed by last year’s breach of the credit reporting agency Equifax (discussed below), the TRW lapse was a warning to data firms everywhere—one that many clearly didn’t heed.

Large-scale breaches like the TRW incident occurred sporadically as years went by and the internet matured. By the early 2010s, as mobile devices and the Internet of Things greatly expanded interconnectivity, the problem of data breaches became especially urgent. Stealing username/password pairs or credit card numbers—even breaching a trove of data aggregated from already public sources—could give attackers the keys to someone’s entire online life. And certain breaches in particular helped fuel a growing dark web economy of stolen user data.

One of these incidents was a breach of LinkedIn in 2012 that initially seemed to expose 6.5 million passwords. The data was hashed, or cryptographically scrambled, as a protection to make it unintelligible and therefore difficult to reuse, but hackers quickly started “cracking” the hashes to expose LinkedIn users’ actual passwords. Though LinkedIn itself took precautions to reset impacted account passwords, attackers still got plenty of mileage out of them by finding other accounts around the web where users had reused the same password. That all too common lax password hygiene means a single breach can haunt users for years.

The LinkedIn hack also turned out to be even worse than it first appeared. In 2016 a hacker known as “Peace” started selling account information, particularly email addresses and passwords, from 117 million LinkedIn users. Data stolen from the LinkedIn breach has been repurposed and re-sold by criminals ever since, and attackers still have some success exploiting the data to this day, since so many people reuse the same passwords across numerous accounts for years.

Data breaches didn’t truly become dinner table fodder, though, until the end of 2013 and 2014, when major retailers Target, Neiman Marcus, and Home Depot suffered massive breaches one after the other. The Target hack, first publicly disclosed in December 2013, impacted the personal information (like names, addresses, phone numbers, and email addresses) of 70 million Americans and compromised 40 million credit card numbers. Just a few weeks later, in January 2014, Neiman Marcus admitted that its point-of-sale systems had been hit by the same malware that infected Target, exposing the information of about 110 million Neiman Marcus customers, along with 1.1 million credit and debit card numbers. Then, after months of fallout from those two breaches, Home Depot announced in September 2014 that hackers had stolen 56 million credit and debit card numbers from its systems by installing malware on the company’s payment terminals.

An even more devastating and sinister attack was taking place at the same time, though. The Office of Personnel Management is the administrative and HR department for US government employees. The department manages security clearances, conducts background checks, and keeps records on every past and present federal employee. If you want to know what’s going on inside the US government, this is the department to hack. So China did.

Hackers linked to the Chinese government infiltrated OPM’s network twice, first stealing the technical blueprints for the network in 2013, then initiating a second attack shortly thereafter in which they gained control of the administrative server that managed the authentication for all other server logins. In other words, by the time OPM fully realized what had happened and acted to remove the intruders in 2015, the hackers had been able to steal tens of millions of detailed records about every aspect of federal employees’ lives, including 21.5 million Social Security numbers and 5.6 million fingerprint records. In some cases, victims weren’t even federal employees, but were simply connected in some way to government workers who had undergone background checks. (Those checks include all sorts of extremely specific information, like maps of a subject’s family, friends, associates, and children.)

Data Breaches: The Complete WIRED Guide

And according to tracing firm Chainalysis, one very prolific scammer ran at least 264 of those scams in 2022 alone.

Over just a little more than a decade, the crypto world has exploded from a single currency to millions of coins and assets, each promising a small share in the next big thing. The challenge for anyone putting their money into that minefield-posing-as-a-goldmine is to distinguish digital treasure from the many, many scam-ridden penny stocks of the digital economy. A new study has put a number to just how prevalent those garbage assets have become: About a quarter of the new crypto tokens launched last year—counting only those that gained any value at all—were clear-cut, short-term cons, scamming buyers within a week of their release.

In a portion of its annual crime report released today, cryptocurrency tracing and blockchain analysis firm Chainalysis published a new study of so-called “pump-and-dump” scams that involve crypto tokens—blockchain-based digital assets that are, at least in theory, shares in some valuable company or project. In a pump-and-dump scam, the scammer “pumps” the price of an asset they hold, often with baseless hype, and then sells their entire holding without warning. That causes the value to crash, thus “dumping” the devalued asset on the marks they tricked into buying in. In its research, Chainalysis focused on one particular form of pump-and-dump schemes, those carried out by the creator of a new token, rather than scammers who manipulate a preexisting one for profit.

“Looking at our blockchain data, we realized the best way we could contribute is by looking at tokens created for the express purpose of a pump-and-dump by the liquidity provider,” says Kim Grauer, head of research at Chainalysis, using the term “liquidity provider” to mean the creator or issuer of a token. “There are millions of these tokens. How many are legitimate, and how many are scams?”

The answer: a whole lot of them are scams. Looking across the million-plus crypto tokens created in 2022, Chainalysis found that only a tiny fraction of them, 9,902, ever convinced anyone to buy them and thus gained any value. Of those, they found that fully 24 percent were brazen, short-term pump-and-dumps perpetrated by the token's creator, dumped within their first week on sale.

Even more shocking, perhaps, was the number of serial offenders in that world of token scams. By tracing the profits of pump-and-dumps, Chainalysis followed the money to the crypto wallets of hundreds of serial scammers. They found that 445 individuals or organizations pulled off more than one short-term pump-and-dump last year. Of those, 23 carried out more than 10. One very busy pump-and-dump entrepreneur had carried out no fewer than 264.

Despite the prevalence of those one-week scams—and the amount of effort some scammers appear to have put into carrying them out repeatedly—Chainalysis found that they weren't particularly profitable. The total haul (or loss, for the scammers' victims) was just $30 million, a mere 0.5 percent of the $5.9 billion in total scam revenue that Chainalysis measured for 2022. But the findings nonetheless highlight just how thoroughly the crypto token world has been corrupted by scammers of the most shameless sort.

Given that the average haul for pump-and-dumps that Chainalysis measured was just over $3,000, Grauer argues it's a low-risk, low-reward scam, likely carried out by people in countries where a few thousand dollars goes further than in the West. “Maybe they live in a part of the world where that’s a lot of money,” Grauer says. “These are people systemically extracting small amounts of money when they can, and it must be profitable for them or they wouldn’t do it 264 times.”

Chainalysis began looking at pump-and-dumps in late 2021 when Dutch police started using its software tools to investigate a token-based scam that victimized some of the country's citizens. (Chainalysis declined to reveal which token.) After that case, the company's researchers decided to see if they could build a filter to spot and count pump-and-dumps more broadly. “We thought, ‘Let’s build that out. Let’s take this boilerplate example and expand it,’” Grauer says.

The researchers ultimately built a tool to scan blockchain data for any token that was sold off by its creator or issuer within the first week after its release, hitting its peak and then losing at least 90 percent of its value by a day later. To further hone its filter, Chainalysis also integrated data from the service Token Sniffer, which looks at the open-source code of tokens to check for signs of scams, like code elements designed to prevent the quick sale of tokens on the decentralized exchanges where they're typically traded. That relatively strict definition means the total number of pump-and-dump scams in 2022 was likely far higher than the roughly 10,000 Chainalysis conservatively measured.

While Chainalysis was able to pinpoint many of the worst culprits in that scam ecosystem, it didn't try to find those scammers' real-world identities. But Grauer says in many cases the scams could be easily traced to accounts where their profits were cashed out on centralized exchanges, many of which have know-your-customer requirements, and thus possess identifying information they could hand over to law enforcement. That suggests a government agency could probably use Chainalysis' findings to start sending subpoenas to exchanges and identifying scammers—perhaps even the most prolific ones that Chainalysis has pointed to.

But for now, Grauer says, it's perhaps revealing enough just to see how awash in scams the token economy truly is, and exactly which con artists are the source of the problem. “With pumping and dumping, we can show: Here’s the cohort of bad actors. Here they are, 445 of them,” Grauer says. “We can identify them. We can see them. And it’s quite powerful to see how many there are.”

Crypto Buyers Beware: 1 in 4 New Tokens of Any Value Is a Scam

The social media platform helped push the story into the mainstream while also fueling misinformation and conspiracy theories.

“This is kind of the ultimate event for driving conspiracy theories and various anti-government and anti-media sentiment,” says Meghan Conroy, a US research fellow with the Atlantic Council, an international affairs think tank who has followed social media coverage of the derailment. “There’s a lack of clarity about what’s happening on the ground in Ohio.” 

While the EPA is monitoring air and water quality in East Palestine, some of the long-term health and environmental effects of the chemical burn and spill are unknown. (In fact, it wasn’t until Sunday—nine days after the derailment—that the EPA provided a full list of chemicals aboard the train, which was operated by Norfolk Southern Railway.) Investigations are underway, and the results aren’t immediately available. The situation has created what is called a data void, says Conroy. Unsatisfied with answers from the media and government, people look elsewhere for answers, and some step in to fill the gaps.

It’s typically people on the political right who are distrustful of the media and government who drive these types of conspiracy theories, but the train derailment is unique in that it has enthralled both sides. “What we are seeing here are folks across the ideological spectrum taking guesses about why we’re not getting much information,” Conroy says. 

People have insisted there’s a media blackout at play. Some, including US representative Ilhan Omar, a Minnesota Democrat, have taken to social media to slam the national news for failing to cover the disaster, despite several stories from _The New York Times_, CNN, and NPR all reporting on the derailment in the immediate aftermath. 

Then there’s the decision to burn off one of the chemicals—vinyl chloride, a carcinogen—to avoid an explosion, which Ohio governor Mike DeWine described as one of “two bad options.” The science around the chemical burn is foreign to many, and alarming. But experts say the outraged response has gone too far. Several government agencies have reported that they have not found dangerous levels of chemicals in the air and water, yet doubt continues to make its way through social media.

“Some of the social media posts are not accurate or, at minimum, overblown,” Daniel Westervelt, a research professor at Columbia University’s Lamont-Doherty Earth Observatory who focuses on ocean and climate physics, says, like posts that have compared the toxic spill to the Chernobyl disaster. After reviewing Drombosky’s viral video, Westervelt said a lot remains unknown about the derailment and suggested taking “certain claims with a grain of salt” when asked if the information presented was accurate. 

“This was a controlled burn that was carefully timed to coincide with the ideal meteorological conditions to maximize the amount of ventilation of the gases and thereby minimize the health risk,” Westervelt says in response to confusion about burning the chemicals, including vinyl chloride. “While this course of action isn't perfectly ideal, it may have been the best available option, and there is no silver bullet.” 

Sonya Lunder, a senior toxics policy adviser, found the information in Drombosky’s viral video a reliable scientific explanation. (Drombosky has noted that the content is now outdated and encouraged people to share more recent updates.) But other content, Lunder says, raises concerns by overstating the potential impact of the chemicals. “There’s this tension between calling people’s attention to a problem by telling them it could affect them, and it’s not in this case as accurate,” Lunder says. “It kind of dilutes attention from the places where these pollution hazards are bad.”

Drombosky says he had around 80,000 TikTok followers before he started making videos about the derailment, and he knew how to make a compelling one. He is disappointed with how major news outlets covered the event and thinks the same sort of criticisms about bias and lack of expert credentials that follow TikTok creators plague mainstream media too. His coverage is opinionated and lays blame on the train operator, Norfolk Southern Railway. “There’s going to be crazy people on TikTok. But have you seen Newsmax? Have you seen Fox? It’s so crazy that people are so quick to jump, well, TikTok could be a little problematic.”  

East Palestine residents face uncertainty in the wake of the chemical disaster, and it’s not clear how long a small Ohio town can hold the attention of TikTok. But TikTok’s ability to dictate the top news story is now undeniable.

_Updated at 5:30 pm ET, February 15, 2023 to clarify the number of views received by Drombosky's initial TikTok video about the derailment._

The East Palestine, Ohio Train Derailment Created a Perfect TikTok Storm

After 16 years, the agency has implemented the software to cryptographically verify digital passport data—and it’s already caught a dozen alleged fraudsters.

The United States government is notorious for taking a “better late than never” approach to its tech rollouts. Following that tradition, US Customs and Border Protection (CBP) confirmed today that after 16 years it has finally performed the necessary software upgrades to verify the cryptographic signatures stored in passport RFID chips. 

Since 2006, the United States and many other countries have embedded these little chips in the back panel of their passports, or “e-Passports” as they're known. The chip digitally stores the personally identifying information of the document's owner, including name, date of birth, passport number, and biometric data like your photo, along with a cryptographic signature meant to act as a check against tampering or forgeries. For years, the US has required that Visa Waiver countries issue e-Passports to their citizens who want to enter the US. Yet in all this time, CBP hadn't actually deployed the software to execute these validity checks.

In early 2018, US senator Ron Wyden of Oregon and former senator Claire McCaskill of Missouri wrote a letter to CBP calling on the agency to implement the cryptographic verification, given that the RFID e-Passport infrastructure had been in place for years. Last week, five years after that request, CBP informed Wyden's office that it has had the e-Passport verification system up and running since June 2022. 

CBP says that so far the validation process has checked more than 3 million passports from Visa Waiver program travelers and has “contributed” to the arrest of 12 people who were allegedly attempting to enter the US with “fraudulent” identification.

“During primary processing, the e-Passport technology alerted on the documents, and the travelers were referred to secondary where CBP officers determined that the travelers were in possession of fraudulent travel documents,” the agency says in a statement.

“Upgrading passport security is a commonsense way to ensure people entering our country are who they say they are. It is already making America safer, without resorting to invasive searches or massive databases of private data,” Wyden says in a statement to WIRED. “I commend CBP for following through and ensuring forgers and criminals can’t use fraudulent passports to skate through security at the border.”

Though the verification has been running since June, CBP says that it still can't verify e-Passports issued by Andorra, the tiny nation between Spain and France that has a population of fewer than 80,000 people. Other than that, though, CBP is running the validation checks for all Visa Waiver countries.

“This was a major investment by the US, so I'm glad to see that they’re using these capabilities and that they work the way they’re supposed to,” says Matthew Green, a cryptographer at Johns Hopkins University. “This system is really just a basic check to help catch people traveling with forged documents, which is something we have an interest in doing. And it is not nearly as intrusive as face recognition or other systems being rolled out at the border, so overall this seems like a good system to have active.”

A 2010 Government Accountability Office report laid out the case for swiftly implementing signature verification for e-Passports. The US Department of Homeland Security (DHS) “does not have the capability to fully verify the digital signatures because it … has not implemented the system functionality necessary to perform the verification,” GAO wrote at the time. “The additional security against forgery and counterfeiting that could be provided by the inclusion of computer chips on e-passports issued by the United States and foreign countries ... is not fully realized.”

More than a decade and a half later, e-Passport digital signature verification is finally something DHS can check off its to-do list.

US Border Patrol Is Finally Able to Check E-Passport Data

Eufy's recent scandal shows it's not so much about the data breach but about how a company responds. Here are a few ways to shop smart.

Own a Eufy security camera or video doorbell? The recent news exposing serious security flaws from the Anker-owned brand may have caused you some anxiety. I have been testing and reviewing security cameras for several years now. Revelations about data breaches and vulnerabilities are a regular occurrence. Arlo, Nest, Ring, Wyze—every major manufacturer you can think of has had its share of scandals. But it can be challenging to look beyond hyperbolic headlines, weigh the seriousness of each issue, and figure out whether you need to worry. 

Security cameras and video doorbells have grown popular as an easy and affordable way to keep an eye on your home. Around 28 percent of Americans protect their property with security cameras, according to a Safewise survey. The systems are easy to install and promise protection from burglars and porch pirates. (Whether they actually make you safer is a question for another day.) To get a better sense of what security camera system you should invest in, how to deal with breaches, and how to find a company you can trust, we spoke to a few experts. We also took a closer look at how Eufy handled its security woes. 

Where Eufy Went Wrong

Late last year, security researcher Paul Moore demonstrated that camera systems sold with the promise of local data storage were, in fact, uploading images to the cloud. Worse yet, it was possible to stream video from a Eufy camera without encryption. When we first asked about these issues, the company issued a strong denial, saying it “adamantly disagrees with the accusations.” A couple of months later, Eufy admitted that most of the allegations were true.

A spokesperson explained to WIRED in an email that Eufy only uploaded images (video thumbnails) to deliver push notifications to customers, and in one other case for its Video Doorbell Dual, where it uploaded a face image of the user (for face recognition) to make it easier to set up multiple doorbell devices without having to upload a new image. Eufy has updated the language around its cloud use to address the first issue and removed the upload requirement for the second.

More serious was the issue of accessible unencrypted live streams outside the Eufy system. Eufy claims this required users to log in to the web portal, enter debug mode, and share a link. It’s unlikely anyone would have stumbled upon these links, but the possibility of unencrypted camera streams is a natural cause for concern. Eufy has now applied peer-to-peer encryption to its web portal (mobile app streams were always encrypted). The company flatly denies using any fixed encryption keys, insisting videos have always been encrypted with a dynamic key.

It’s worth pointing out that this isn't Eufy’s first security scandal. A bug in May 2021 exposed the live and recorded video streams from 712 customers to other Eufy app users, which is arguably worse than the more recent security flaw. But does it matter if a flaw was unlikely to have been exploited? It’s more important to look at how the company responds to these events.

Sadly, it took more than two months for Eufy’s parent company, Anker, to admit _some_ fault and apologize. Early denials sparked deeper media scrutiny as the company tried to downplay Eufy’s security failings, shredding a hard-won reputation in the process. The multiple incidents, and the fact that Eufy was caught in a lie and forced to pedal back, make it tough to regain trust. 

Eufy’s failings feel especially egregious because the company generally ticks all the right boxes. Its cameras and doorbells strike the balance between quality and affordability. Anker is a respected brand in the accessory space. And Eufy offers support for two-factor authentication, although not by default, and promises completely local storage and on-device processing for features like facial recognition.

Understand the Risks When Shopping

Despite an abundance of security camera manufacturers, pristine reputations are rare, so how do you choose wisely? “You want to go with a brand name,” says Deral Heiland, principal security researcher for the Internet of Things at Rapid7. “One you’ve heard of, because these companies have to protect their branding.”

Big brands come under greater scrutiny. They are targets for security researchers and amateur tinkerers. And they know that bad press will hurt their business. Since regulation is negligible, many no-name or little-known brands sell untested security cameras that may harbor multiple vulnerabilities. When they run into issues, they disappear or change the brand name.

Two-factor authentication (2FA) is also vital, Heiland says. It prevents anyone who has managed to get your login details from accessing your camera. With 2FA, you need the login details and a fingerprint, facial scan, or automatically generated one-time use code from an authenticator app, text message, or email. WIRED doesn’t recommend any security cameras that don’t at least offer 2FA as an option, but we’d like to see it become the default industrywide.

When you install a security camera, it’s worth thinking about what the most compromising or embarrassing thing the camera—outside or inside your house—can see. You need to understand that no internet-connected device is 100 percent safe. 

There is always a risk someone is going to gain access to the camera—“be it hackers plugging data-breached passwords in to see if people are reusing them or police who often go to companies, even without warrants, in hopes of getting footage from people’s devices without their knowledge,” says Matthew Guariglia, a policy analyst for the Electronic Frontier Foundation.

After every security camera scandal, you might see some folks argue that they don’t care who sees footage of their front door or backyard. It’s true that there is little value in many of these video streams, which makes them an unlikely target. But Guariglia says security cameras usually have powerful microphones and often pick up more than we think.

Then there’s the issue of other people’s privacy, whether it’s neighbors, window cleaners, or passersby. Security camera footage is frequently shared online without the knowledge of the people who appear in it. Most cameras offer privacy zones so you can confine recordings to your property, and you should consider placement carefully when you install cameras. 

You should also do some research before you buy. Guariglia suggests asking questions like, “What would it take for police to get footage from the company? Where is your data going to be stored? Does this company have a history of data breaches or bad cybersecurity?” Unfortunately, answers aren’t always easy to find. Apple, Arlo, Eufy, and Wyze state that they won’t share footage without a warrant or court order. Ring, however, has a close relationship with police departments, and Google _may_ share Nest footage in emergency situations where there is a threat to life.

With a local storage system, you can potentially avoid uploading video to a company server and take it out of the manufacturer’s hands. Look for end-to-end encryption (preferably as a default). You can opt for a local system with no internet connection, but you would only be able to review video when you’re home. If you have the technical know-how to hook up internet-protocol cameras and DVRs without cloud services and connect via a Virtual Private Network (VPN) service, Heiland says that’s another potentially secure route. 

Perhaps counterintuitively, it might not be a red flag if your chosen camera brand has had problems in the past, provided the company has fixed them.“It’s better if there have been vulnerabilities reported on a camera because it gives us the ability to take a look at how a company deals with them,” Heiland says. “I’d rather go with a company that’s had multiple vulnerabilities in its cameras and shows a track record of fixing them quickly than a company that’s had no vulnerabilities. Because there’s no such thing as no vulnerabilities.” 

Room for Improvement

Where does Eufy go from here? The flaws have been patched, but it says it’s planning to bring on companies in security consulting, certification, and penetration-testing to conduct a comprehensive assessment of its products and eliminate potential risks. Eufy says there will also be an independent review of its processes and practices from an as-yet-unnamed security expert, and it plans to set up a security bounty program. These are positive steps, perhaps necessary growth for any security brand that expects to be taken seriously. It’s unfortunate that it took another scandal for Eufy to act. 

If you visit a manufacturer’s website, Heiland says it should be easy to find out how to report a vulnerability. If a company has a bug bounty program offering cash rewards to security researchers (incentivizing people to test the cameras and find flaws), all the better. Arlo, Logitech, Nest, and Wyze have some kind of bug bounty program, though the focus and rewards vary. Research should also turn up reports, like this one on Ezviz by Bitdefender, which shows the company is responsive and quick to investigate and fix flaws.

Keeping things secure is not just down to the camera manufacturer. Heiland warns against recycling passwords and strongly suggests picking long, complex passwords (16 to 24 characters) that mix alphanumeric, uppercase, lowercase, and special characters. You can use a password manager to help you keep track. He also recommends setting up security cameras and IoT devices on a network separate from your main computers, laptops, and phones. Most good routers and mesh systems offer guest or IoT network options that allow this.

If you have indoor security cameras, turn them off when you’re home. Look for cameras with shutters and privacy modes, or turn them around, unplug them, or use a scheduled smart plug. Heiland says he would not have a camera in the house but has less of an issue with carefully positioned outdoor security cameras. Just remember that even if you find a system that ticks all your boxes, there’s only so much you can verify.

What to Look for When Buying a Security Camera (2023): Tips and Risks

No, there’s not a sudden influx of unidentified objects in the skies above the US—but the government is paying closer attention.

When U.S. government officials in early February identified and eventually shot down a surveillance balloon attributed to China, the prominent acknowledgment of a spy balloon captured public attention and inflamed tensions between Washington and Beijing. But since then, the prospect of the US government intercepting unidentified flying objects has become quotidian, with three UFOs shot down in the past four days—two near Alaska and one over Lake Huron near Michigan. The spree raises the question, are there more UFOs over US airspace than usual, or is everyone just looking more closely?

Researchers say it's the latter, and they note that even before the balloon mania began, the US government tracked many UFOs in its airspace, including a number of balloons. The US Office of the Director of National Intelligence (ODNI) released a January report, for example, tracking incidents involving UFOs, which the US government calls Unidentified Anomalous Phenomena or UAPs. Between March 5, 2021, and August 30, 2022, the All-Domain Anomaly Resolution Office had 247 reports of UAPs. In a wider pool of 366 UAP reports that also includes newly discovered incidents that occurred before 2021, ODNI said that 163 were balloons “or balloon-like entities,” 26 were “Unmanned Aircraft Systems,” or drones, and six were “attributed to clutter.” So, not all UFOs are balloons, and not all unidentified balloons are spy balloons.

Additionally, CNN reported on Friday that in the past year, the US intelligence community invented a novel technique for conducting real-time tracking of spy balloons or other balloon vehicles of interest. After an incident in which a Chinese spy balloon briefly entered US airspace in 2021, US intelligence forces used data they'd collected about the balloon to look back at radar and other aerial surveillance data to search for previously unidentified past incidents. The results then allowed officials to create models for tracking balloon flights around the world in close to real time.

The heightened alert in recent days may have also led to other tweaks to US radar noise reduction methods to detect more small aircraft at altitudes where planes don't usually fly.

“This isn't new; we just hadn't been detecting them in the past,” says Brynn Tannehill, a RAND Corporation senior technical analyst and a former naval aviator. “I suspect that filters on US systems had previously been ignoring things that were too slow, high, or small to be considered threats. Now that the parameters on the filters have been adjusted, we're seeing more of what was already there for the past few years.”

US government officials said at the beginning of the month that the Chinese spy balloon was roughly the size of three buses. Meanwhile, US Defense Department officials said the UFO the US shot down on Friday was likely not a balloon and was roughly the size of a small car. The object shot down on Saturday, on orders from Canada's prime minister, Justin Trudeau, was described by Canadian officials as cylindrical and seemingly smaller than a surveillance balloon. US officials said the UFO shot down on Sunday was octagonal and didn't seem to be carrying anything.

The White House says that China has been working on a balloon surveillance initiative in recent years “that it has used to violate the sovereignty of the US and over 40 countries across five continents,” according to a statement by National Security Council spokesperson Adrienne Watson. On Sunday, the Chinese government claimed that the US illegally flew over 10 balloons in its airspace in the past year. The Biden administration denied the allegation. “Any claim that the US government operates surveillance balloons over the PRC is false,” Watson said in the statement.

“With the balloon at the beginning of February, the US caught China with its hands in the proverbial cookie jar and made the decision to make it public,” says Jake Williams, a former National Security Administration hacker and an analyst at the Institute for Applied Network Security. “There is likely a ton of statecraft happening in the background, either as a result of the decision to publicly acknowledge the first balloon or that led to the decision itself. Generally, yes, things change once a surveillance target knows they're being surveilled.”

The Biden administration has been been criticized by some Republican lawmakers and others for being slow to shoot down the Chinese spy balloon and hesitant to reveal specific details about the three other UFOs taken out in recent days. (US officials said shooting down the balloon over land would pose an unacceptable risk due to falling debris.) RAND's Tannehill says, though, that from an investigative perspective, it's difficult to process so many cases simultaneously. 

“The White House is caught between rapid response and getting the facts right,” Tannehill says. “Until the path analysis is done, we're guessing at who launched them. Getting the facts wrong publicly would be highly damaging to US credibility.” She adds that the UFO disabled on Saturday that also flew over Canadian airspace “brings another NATO country into the discussion, and it becomes a NATO problem, not just US or NORAD,” the North American Aerospace Defense Command. 

Of the object shot down on Sunday over Lake Huron, the US Defense Department said in a statement, “We did not assess it to be a kinetic military threat to anything on the ground, but assess it was a safety flight hazard and a threat due to its potential surveillance capabilities. Our team will now work to recover the object in an effort to learn more.”

Oh, and if you're still holding out for this flurry of aerial activity to be related to aliens, the White House is here to burst your bubble: “I know there have been questions and concerns about this," White House press secretary Karine Jean-Pierre said at a press conference yesterday, “but there is no, again no indication of aliens or extraterrestrial activity with these recent takedowns.” General Glen VanHerck, commander of the Air Force’s Northern Command, added during a news conference on Sunday, though, “I haven’t ruled out anything at this point.”

The More You Look for Spy Balloons, the More UFOs You’ll Find

Investment schemes are ensnaring victims with increasingly compelling narratives and believable tech.

Gallagher found that the website the scammers were using to distribute their malicious apps was set up to impersonate a real Japanese financial company and had a .com domain. It was even visible on Google as one of the top results, Gallagher says, so victims could find it if they attempted to do some basic research. “To someone who isn't particularly knowledgeable about these things, that part would be pretty convincing,” Gallagher says.

The attackers, who Sophos suspects are based in Hong Kong, developed Windows, Android, and iOS apps off of a legitimate trading service from a Russian software company. Known as MetaTrader 4, Sophos researchers have seen past examples of the platform being misused and abused for fraud. As part of joining the platform, victims had to disclose personal details including tax identification numbers and photos of government identification documents, then start moving cash into their account.

As is often the case in a wide range of scams, the attackers were distributing their iOS app using a compromised certificate for Apple's enterprise device management program. Sophos researchers have recently found pig butchering-related apps that skirted Apple's defenses to sneak into the company's official App Store, though.

The second scam Gallagher followed appears to have been run by a Chinese crime syndicate out of Cambodia. The tech for the scheme was less sleek and impressive but still expansive. The group ran a fake Android and iOS cryptocurrency trading app that impersonated the legitimate market tracking service TradingView. But the scheme had a much more developed and sophisticated social engineering arm to lure victims in and make them feel like they had a real relationship with the scammer suggesting that they invest money. 

“It starts off, ‘Hey Jane are you still in Boston?' so I messaged back, ‘Sorry, wrong number,’ and we had a standard exchange from there,” Gallagher says. The conversation started on SMS and then moved to Telegram.

The persona claimed to be a Malaysian woman living in Vancouver, British Columbia. She said that she ran a wine business and sent a photo of herself standing next to a bar, though the bar was mostly stocked with liquor, not wine. Gallagher was eventually able to identify the bar in the photo as one in the Rosewood Hotel in the Cambodian capital, Phnom Penh.

When asked, Gallagher once again said that he was a cybersecurity threat researcher, but the scammer was not deterred. He added that his company had an office in Vancouver and repeatedly tried to suggest meeting in person. The scammers were committed to the ruse, though, and Gallagher received a few audio and video messages from the woman in the photo. Eventually he even video chatted with her.

“Her English skills were pretty good, she was in a very nondescript location, it looked like a room with acoustic wall pads, kind of like an office or conference room,” Gallagher says. “She told me she was at home, and our conversation quickly steered toward whether I was going to be doing the high-frequency crypto trading with them.”

Cryptocurrency wallets associated with the scam took in roughly $500,000 in a single month from victims, according to Sophos’ monitoring. 

The researchers reported their findings on both scams to the relevant cryptocurrency platforms, tech companies, and global cybersecurity response teams, but both operations are still active and were able to continually establish new infrastructure when their apps or wallets got taken down.

Sophos is redacting all images of people from both scams in its reports, because pig butchering attacks are often staffed using forced labor, and participants may be working against their will. Gallagher says that the most sinister thing about the attacks is how their evolution and growth means more forced labor on top of more devastated and financially ruined victims. As law enforcement agencies around the world scramble to counter the threat, though, in-depth details of the mechanics of the schemes show how they work and how slippery and adaptive they can be.

Pig Butchering Scams Are Evolving Fast

Your devices and apps really, really want to know where you are—whether it's to tell you the weather, recommend some restaurants you might like, or better target advertising at you. Managing what you're sharing and what you're not sharing, and when, can quickly get confusing.

It's also possible that you have inconsistencies in the various location histories logged by your devices: Times when you thought you'd switched off and blocked location sharing but you're still being tracked, or vice versa.

Here we'll cover everything you need to consider when it comes to location tracking, and hopefully simplify it along the way. Whether you want to give out access to your current location or not, you should be in control of these settings, and not be caught unawares by additional options that you missed.

How Location Tracking Gets Confusing

You can turn off Google Location History—but it's just the start.

Google via David Nield

What happens if you distinctly remember turning location tracking off on a device, yet your position is still popping up on a map? Or maybe you thought you'd left the feature on, yet you're seeing gaps in your location history? There are a few explanations, but essentially you need to remember all the different ways your location can be logged: by your devices, by your apps, and by websites you visit.

For example, you might have disabled location tracking on a phone but left it enabled on a tablet. Alternatively, you might have a laptop that's tracking where you are in the background, even though you thought you'd disabled the feature in the apps you use. If you want location tracking completely enabled or disabled, you need to factor in all these different ways of keeping tabs on where you are.

If you have a Google account, this is a good illustration. Head to your account settings on the web, then choose **Data and Privacy** and **Location History**. Select **Devices on This Account**, which may reveal some phones, tablets, and laptops that you'd forgotten about—any device with a check next to it in this list is saving your movements to your Google account for future reference.

You can click **Turn Off** to disable this, but note the caveats that are listed in the confirmation box that appears onscreen: Your location might still be logged by your mobile devices, by the Find My Device service that helps you recover lost hardware, and by Google Maps when you're navigating or searching around the area you're in. This Location History setting is more of an overall toggle switch, affecting features such as the Google Timeline and the ability to quickly look up places you visit regularly.

From the main Google account screen, there are several more places where your location gets logged and shared: Click **Data and Privacy** then **Web & App Activity** to manage location data saved by Google Maps and other apps and websites, and click **People andSharing** then **Manage Location Sharing** to see a list of specific contacts who can see where you are through various Google services.

Managing Location Tracking on Mobile

You can control location tracking for individual apps and devices as a whole.

Android via David Nield

The steps to manage your location on Android vary slightly depending on the manufacturer of your phone, but the menus and instructions involved are broadly similar. On Google Pixel devices, you can open up **Settings** then select **Location**: You'll see the **Use Location** toggle switch, and if you turn this off, none of your apps will be able to know where you are, nor will Google.

If you leave the **Use Location** toggle switch on, you can customize location access for individual apps further down on the same screen. Note that you can choose to allow apps to know where you are at all times, or only when the app in question is running in the foreground—tap on any app in the list to make changes.

Over on iOS, it's a similar setup. If you select **Privacy & Security** from **Settings**, and then tap **Location Services**, you can turn off location tracking for the phone and all the apps on it. If you choose to leave this enabled, you can manage individual app access to your location via the list underneath. As on Android, you can choose to restrict apps to knowing your location only when the particular app itself is running, or allow them to monitor it in the background too.

Erasing the location data that's been collected on you is a complex process, as you need to check the records and the settings of every app that's ever had access to your location. For Google and Google's apps, you can head to your Google account on the web, then choose either **Location History** or **Web & App Activity** under **Data and Privacy** to wipe this data from the record. You'll also find options for automatically deleting this data after 3, 18, or 36 months.

Apple doesn't log your movements in quite the same way, but it does build up a list of places you visit frequently (like your home and perhaps your office) so you can quickly get to them again. To clear this list on your iPhone, open **Settings** then choose **Privacy & Security**, **Location Services**, **System Services**, and **Significant Locations**. You can clear this list and stop it from populating in the future.

Managing Location Tracking on Desktop

You can control location tracking on Windows and its individual programs.

Windows via David Nield

Your laptop or desktop computer is unlikely to be fitted with GPS capabilities, so it won't track your location in quite the same way as your phone, but applications, websites, and the operating system will still have some idea where you are—primarily through the locations that you sign into the web from (via your home Wi-Fi, for example).

On Windows, you can open up **Settings** and then choose **Privacy & Security** and **Location**. As on Android and iOS, you'll see you can turn location tracking off for individual applications (via the toggle switches on the right) or shut it down for the entire computer (the option at the top). The same screen lets you see which apps have been using your location, and enables you to wipe the log of your travels—click **Clear** next to **Location History** to do this.

When it comes to the same process on macOS, you need to click the **Apple** menu and select **System Settings**, **Privacy & Security**, and **Location Services**. The next screen looks very similar to the Windows one, with toggle switches for individual applications as well as for macOS itself—turn off any of the switches where you don't want location access to be given. If you click **Details** next to **System Services** on this screen, you can clear the list of “significant locations” Apple has saved for you, just like on iOS.

If location tracking is on for your computer and your browser of choice, that means individual websites such as Facebook, Amazon, or the Google Search can know where you are as well. Sometimes this is useful, of course (for getting the right weather forecast), but there might be times when you want to turn it off if you're trying to keep your whereabouts private.

Every browser will have settings for managing website access to your location. In Chrome, it's **Privacy and Decurity**, **Site Settings,** and **Location** from the settings pane; if you're using Edge you need to open settings and choose **Cookies and Site Permissions** then **Location**; and on Safari on macOS, pick **Websites** and **Location** once you've got the settings dialog open. Changing these settings won't affect data these sites have collected in the past, though—you'll need to visit the options for the individual sites for that.

How to Make Sure You’re Not Accidentally Sharing Your Location

Plus: Deepfake disinformation spotted in the wild, Android privacy problems in China, Reddit gets phished, and more.

With a major United States intelligence authority set to expire at the end of the year, and a congressional showdown brewing over whether or not to renew it, new details of an internal audit show that US Federal Bureau of Investigation (FBI) personnel have repeatedly conducted unlawful searches of data collected under the imperiled surveillance authority. Agents requested information on journalists, a US congressman, and a political party as a result of what the US Department of Justice called “misunderstandings.”

This week, WIRED spoke to the creator of Sinbad.io, a cryptocurrency privacy service popular among North Korean hackers and other cybercriminals that has facilitated money laundering for tens of millions of dollars. And officials from the United Kingdom and United States announced sanctions against seven alleged members of the Conti and Trickbot ransomware groups, publishing their real-world names, dates of birth, email addresses, and photos. The two governments also took the unusual step of stating plainly that they see evidence of links between Russia-based cybercrime groups and the Kremlin’s intelligence services.  

US President Joe Biden asserted in his State of the Union address this week that ​​the US needs a bipartisan effort to “impose stricter limits on the personal data that companies collect on all of us.” Reactions in Washington after the speech were hopeful, but also realistic that getting a national privacy law on the books in the US anytime soon may prove too much of a political minefield to traverse. Meanwhile, legal experts told WIRED this week that the US’s Fair Credit Report Act should already curtail the information about Americans that data brokers can collect and sell. A new letter to the Consumer Financial Protection Bureau called on the agency to start enforcing violations.

We looked at how Moscow’s expansive smart city initiative, launched with the promise of reduced crime rates, is increasingly being used for draconian AI-assisted surveillance in the city amid Vladimir Putin’s war in Ukraine. And if you were hoping to delete your Twitter DMs through GDPR requests for erasure, the company doesn’t seem to have any plans to comply.

Plus, there’s more. Each week we round up the stories we didn’t cover in-depth ourselves. Click on the headlines to read the full stories. And stay safe out there.

North Korea’s elite state-sponsored hackers are some of the world’s most relentless—stealing millions of cryptocurrency each year to evade sanctions and fund the hermit nation’s nuclear programs. A new security alert from officials in the US and South Korea this week reveals how ruthless the country’s threat actors can be. State-backed hackers used around a dozen types of malware and ransomware to attack South Korean and US hospitals and health care systems, according to the US National Security Agency (NSA), FBI, and Cybersecurity and Infrastructure Security Agency (CISA).

John Hultquist, who leads intelligence analysis at security firm Mandiant, says the attacks are linked to the Andariel group and that several hospitals “have had to weather major disruptions” because of the attacks. In some of their operations, the advisory from the governments says, the attackers would try to “obfuscate” their involvement, use VPNs or virtual private servers to mask their location, and use common vulnerabilities to gain access to networks. The attackers used their own privately developed malware along with ransomware strains belonging to other groups, such as LockBit.

Pro-Chinese bot accounts on Twitter and Facebook have spread news videos in which presenters decry the lack of action against gun violence in the US and promote China’s world politics. The messaging isn’t exactly anything new, but there’s a twist to the propaganda: The news anchors in the videos—one man and one woman—aren’t real. They’re AI-generated characters, commonly known as deepfakes. The videos were discovered last year by disinformation research firm Graphika, which says it is the “first time we’ve seen this in the wild.” The company says it believes the videos were created using a commercial AI video software service, and were low-quality overall. None of the videos had more than 300 views.

Researchers from universities in the UK and Ireland have discovered that leading Android phones in China are hoovering up people’s personal data. The pre-installed operating systems on Xiaomi, OnePlus, and Oppo Realme devices are collecting people’s locations, call history, and profile information before sending it on to third parties, according to a study from academics at the University of Edinburgh and Trinity College Dublin. The researchers conducted the research on phones bought in China and measured the network traffic the devices generate. In many instances, they write, people aren’t notified about the data that’s collected or given any choices to opt out. The study reiterates how different privacy rules are in China compared to many other parts of the world and the myriad ways people can be tracked. “The data shared by the global version of the firmware is mostly limited to device-specific information,” the researchers conclude.

Reddit said on Thursday that hackers had accessed its source code after a successful phishing attack compromised an employee’s system credentials. The incident also exposed the contract information of hundreds of current and former Reddit employees and contacts. Reddit, which is owned by WIRED’s parent company Advance Publications, said that the incident did not impact user passwords or production systems, but suggested that users reset their passwords and ensure they have two-factor authentication turned on for their accounts. The company also said that the lessons it learned after suffering a data breach five years ago were protective and helpful in dealing with the recent incident.

North Korean Hackers Are Attacking US Hospitals

A review of the FBI’s access to foreign intelligence reveals troubling misuse of powerful surveillance tech.

An existential fight over the US government’s ability to spy on its own citizens is brewing in Congress. And as this fight unfolds, the Federal Bureau of Investigation’s biggest foes on Capitol Hill are no longer reformers merely interested in reining in its authority. Many lawmakers, elevated to new heights of power by the recent election, are working to dramatically curtail the methods by which the FBI investigates crime.

New details about the FBI’s failures to comply with restrictions on the use of foreign intelligence for domestic crimes have emerged at a perilous time for the US intelligence community. Section 702 of the Foreign Intelligence Surveillance Act (FISA), the so-called crown jewel of US intelligence, grants the government the ability to intercept the electronic communications of overseas targets who are unprotected by the Fourth Amendment.

That authority is set to expire at the end of the year. But errors in the FBI’s secondary use of the data—the investigation of crimes on US soil—are likely to inflame an already fierce debate over whether law enforcement agents can be trusted with such an invasive tool. 

Central to this tension has been a routine audit by the Department of Justice’s (DOJ) national security division and the office of the director of national intelligence (ODNI)—America’s “top spy”—which unearthed new examples of the FBI failing to comply with rules limiting access to intelligence ostensibly gathered to protect US national security. Such “errors,” they said, have occurred on a “large number” of occasions.

A report on the audit, only recently declassified, found that in the first half of 2020, FBI personnel unlawfully searched raw FISA data on numerous occasions. In one incident, agents reportedly sought evidence of foreign influence linked to a US lawmaker. In another, an inappropriate search pertained to a local political party. In both cases, these “errors” attributed to a “misunderstanding” of the law, the report says.

At some point between December 2019 and May 2020, FBI personnel conducted searches of FISA data using “only the name of a US congressman,” the report says, a query that investigators later found was “noncompliant” with legal procedures. While some searches were “reasonably likely to return foreign intelligence information,” investigators said, they were also “overly broad as constructed.”

In another incident, the FBI ran searches using the “names of a local political party,” even though a connection to foreign intelligence was “not reasonably likely.” The DOJ explained the errors away by saying FBI personnel “misunderstood” the search procedures, adding they were “subsequently reminded of how to correctly apply the query rules.” These are the mistakes that will ultimately serve as ammunition in the coming fight to diminish the FBI’s power.

Elizabeth Goitein, senior director of the Brennan Center for Justice’s national security program at New York University School of Law, says that while troubling, the misuse was entirely predictable. “When the government is allowed to access Americans’ private communications without a warrant, that opens the door to surveillance based on race, religion, politics, or other impermissible factors,” she says. 

Raw Section 702 data, much of which is derived “downstream” from internet companies like Google, is regarded as “unminimized” when it contains unredacted information about Americans. Spy agencies such as the CIA and NSA require high-level permission to “unmask” it. But in what privacy and civil liberties lawyers have termed a “backdoor search,” the FBI regularly searches through unminimized data during investigations, and routinely prior to launching them. To address concerns, the US Congress amended FISA to require a court order in matters that are purely criminal. Years later, however, it was reported that the FBI had never sought the court’s permission.

FISA surveillance came under heightened Republican criticism following revelations that, in October 2016, a secret court had authorized a wiretap on a former campaign aide of then-presidential nominee Donald Trump during the FBI’s investigation into election meddling by Russia. While an inspector general’s report later found sufficient cause for the investigation, the wiretap application was haphazardly approved in the face of numerous FBI errors. 

Section 702—notably, not used to authorize the wiretap itself—was first enacted as part of the FISA Amendments Act in 2008, and was more recently reauthorized until December 31, 2023. Congress must vote by year’s end to extend the authority any further. This deadline will provoke a debate around government surveillance likely to continue throughout the year, with the Biden administration pushing for a swift reauthorization and Republicans such as Jim Jordan, a top FBI critic, standing in its way.

Jordan, who wields significant power now as chairman of the House Judiciary Committee, signaled on Fox News before the start of the new Congress that a reauthorization bill before his committee might be dead on arrival.

DOJ investigators unearthed another incident, which in the report they say violated US attorney general guidelines: an FBI analyst using Section 702 intelligence in a way that “lacked a proper authorized purpose.” The investigators said “improper queries” were prompted by a report about an “individual of Middle Eastern descent,” whom a witness claimed “sped” into a parking lot before honking his horn. “A second individual of Middle Eastern descent” then began loading boxes into a second vehicle, said the witness, who noted some of the boxes were labeled Drano, the brand name of a drain-cleaning product.

The report does not opine on whether the tip was the result of racial profiling, and it is widely known that chemicals commonly found in drain cleaners, among other household products, can be used in the creation of homemade bombs. The report only states that the matter was closed prior to the audit, and that it is the FBI’s prerogative to destroy any unminimized data it unlawfully obtained.

The errors at the FBI aren’t likely to bolster the US intelligence community’s case that the benefits of Section 702 outweigh any risks to Americans’ civil liberties by a mile, and that allowing it to sunset would widely compromise investigations into terrorists, foreign spies, and cyberattacks on American infrastructure. “Nothing is untouched, essentially, by this authority; it is fundamental to our work,” Avril Haines, the US’s director of national security, said earlier this year.

Prominent political figures, including US Senators Ron Wyden and Rand Paul, have put forward bills in the past seeking to limit the FBI’s access to unminimized Section 702 data. A bill initially put forward by the lawmakers in 2017, known as the USA RIGHTS Act, sought to rein in the FBI’s “sweeping authority,” which they described as being “clouded in secrecy.” Hakeem Jeffries, the current House Democratic Leader, was a cosponsor of the bill.

“The intelligence community, and the FBI in particular, has unnecessarily plundered the most private, sensitive information of American citizens, treating the Fourth Amendment with contempt,” says former Republican House Judiciary chair Bob Goodlatte, now senior adviser to the Project for Privacy and Surveillance Accountability. “Congress must add impenetrable guardrails to Section 702, requiring probable cause warrants to obtain Americans’ private information.”

Other troubling incidents, previously disclosed by a redacted court ruling, are also mentioned, including FBI searches of Section 702 data during “background investigations” into repairmen who’d been given access to an FBI field office; individuals who’d requested to join the bureau’s “Citizens Academy”—a program for “business, religious, civic, and community leaders”—and “individuals who entered the field office seeking to provide a tip or to report that they were the victim of a crime.”

The FBI did not respond to a request for comment. Inquiries at the offices of the House and Senate Judiciary Committees also went unanswered.

Sean Vitka, senior policy counsel for Demand Progress, a nonprofit focused on national security reform, says it is difficult to exaggerate the danger posed by federal agents rummaging through “untold millions of emails and other communications” without a warrant, while ignoring basic safeguards. “There is something deeply wrong with FISA and the government’s out-of-control surveillance state, and it is absolutely imperative that Congress face it head-on this year, before it’s too late,” he says.

The recently disclosed errors are not the first in FBI’s history, according to research by Demand Progress. Starting in 2017 and continuing until at least 2019, the bureau is known to have conducted thousands of legally impermissible searches, according to declassified court records. The Foreign Intelligence Surveillance Court noted in a 2018 memorandum, for instance, that the FBI’s minimization procedures, “as they have been implemented,” were consistent with neither the FISA requirements nor the Fourth Amendment itself.

It has also not complied with regulations, passed in 2018, that required a court order before using Section 702 data to further domestic criminal investigations. An oversight review conducted prior to November 2020 found, for instance, that the FBI had conducted 40 queries without proper authorization related to a range of activities, from organized crime and health care fraud to public corruption and bribery.

A previous DOJ audit—declassified in August 2021—disclosed that, in one instance, an intelligence analyst had conducted “batch queries” of FISA-acquired information at the FBI’s request, using the personal information of “multiple current and former United States government officials, journalists, and political commentators.” While the analyst attempted to remove the US information, in some cases, it said, they “inadvertently failed” to do so.

Source

Wired