A husband, now indicted, allegedly used seven Apple AirTags to stalk his ex-wife over a period of several weeks. His trial begins this month.

Following their divorce, a husband carried out a campaign of stalking and abuse against his ex-wife—referred to only as “S.K.”—by allegedly hiding seven separate Apple AirTags on or near her car, according to documents filed by US prosecutors for the Eastern District of Pennsylvania.

The documents, unearthed by 404 Media in collaboration with Court Watch, reveal how everyday consumer tools, like Bluetooth trackers, are sometimes leveraged for abuse against spouses and romantic partners.

 “The Defendant continued to adapt and use increasingly sophisticated efforts to hide the AirTags he placed on S.K.’s car,” US attorneys said. “It is clear from the timing of the placement of the AirTags and corroborating cell-site data, that he was monitoring S.K.’s movements.”

On May 8, the US government filed an indictment against the defendant, Ibodullo Muhiddinov Numanovich, with one alleged count of stalking against his ex-wife, S.K.

The stalking at the center of the government’s indictment allegedly began around March 27, when the FBI first learned about S.K. finding and removing an AirTag from her car. Less than a month later, on April 18, the FBI found a second AirTag that “was taped underneath the front bumper of S.K.’s vehicle with white duct tape.”

The very next day, the FBI found a third AirTag. This time, it was “wrapped in a blue medical mask and secured under the vehicle near the rear passenger side wheel well.”

This pattern of finding an AirTag, removing it, and then finding another was punctuated by physical and verbal intimidation, the government wrote. After a fourth AirTag was removed, the government said that Numanovich called S.K., followed her to a car wash, and “banged on her windows, and demanded to know why S.K. was not answering his calls.” Less than one week later, during a period of just 10 minutes, the government said that Numanovich left five threatening voice mails on S.K.’s phone, calling her “disgusting” and “worse than an animal.”

During the investigation, the FBI retrieved seven AirTags in total. Here is where those AirTags were found:

1.  Found by S.K. with no detail on specific location
2.  Duct-taped underneath the front bumper of S.K.’s car
3.  Underneath S.K.’s car, near the passenger-side wheel well, wrapped in a blue medical mask
4.  Within the frame of SK’s driver-side mirror, wedged between the mirror itself and the casing around it
5.  “An opening within the vehicle’s frame” which, documents say, was previously sealed by a rubber plug that was removed
6.  Underneath the license plate on S.K.’s car
7.  Undisclosed

For two of the retrieved AirTags, the FBI deactivated the trackers and then, away from S.K., placed the AirTags at separate locations. At an undisclosed location in Philadelphia where the FBI placed one AirTag, FBI agents later saw Numanovich “exit his vehicle with his phone in his hand, and begin searching for the AirTag.” At a convenience store where the FBI placed a second AirTag, agents said they again saw Numanovich.

The FBI also received information about attempted pairings and successful unpairings with Numanovich’s Apple account for three of the Apple AirTags.

In addition to the alleged pattern of stalking, the government also accused Numanovich of abusing SK both physically and emotionally, threatening her in person and over the phone, and recording sexually explicit videos of her to use as extortion. After a search warrant was authorized on May 13, agents found “approximately 140 sexually explicit photographs and videos of S.K.” stored on Numanovich’s phone, along with records for “numerous” financial accounts that transferred more than $4 million between 2022 and 2023.

In a follow-on request from the government to detain Numanovich before his trial begins, prosecutors also revealed that S.K. may have been brought into the US through a “Russian-based human smuggling network”—a network of which Numanovich might be a member.

According to 404 Media, a jury trial for Numanovich is scheduled to start on June 8.

**Improving AirTag safety**

Just last month, Apple and Google announced an industry specification for Bluetooth tracking devices such as AirTags to help alert users to unwanted tracking. The specification will make it possible to alert users across both iOS and Android if a device is unknowingly being used to track them. We applaud this development.

**We don’t just report on threats—we remove them**

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

 Husband stalked ex-wife with seven AirTags, indictment says 

Google has announced plans to store Maps Timeline data locally on users' devices instead of their Google account effective December 1, 2024.
The changes were originally announced by the tech giant in December 2023, alongside changes to the auto-delete control when enabling Location History by setting it to three months by default, down from the previous limit of 18 months.
Google Maps Timeline,

Google Maps Timeline Data to be Stored Locally on Your Device for Privacy

Eliot Higgins and his 28,000 forensic foot soldiers at Bellingcat have kept a miraculous nose for truth—and a sharp sense of its limits—in Gaza, Ukraine, and everywhere else atrocities hide online.

How to Lead an Army of Digital Sleuths in the Age of AI

TikTok accounts are being hacked! Celebrities and brands targeted in zero-click attack. Learn more about this major security…

TikTok accounts are being hacked! Celebrities and brands targeted in zero-click attack. Learn more about this major security breach in which accounts have been compromised.

Social media, online shopping and video giant TikTok has experienced a cyberattack in which attackers managed to compromise celebrity and brand accounts, including hotel heiress Paris Hilton, Sony, and CNN. 

While specific details about the nature of the attack are scarce at the moment, VXUnderground explained in its post on X (formerly Twitter) that an unknown threat actor discovered an exploit in TikTok that allows users to hijack accounts. The payload is delivered through TikTok direct messages and executed when read, without requiring external files or user response. 

The number of affected accounts is currently unclear but according to the latest update from TikTok, only two accounts have been compromised, one being CNN’s. 

The attack was first reported by Semafor and Forbes, according to which TikTok was targeted in a zero-click account takeover campaign that allows malware to compromise brand and celebrity accounts without direct interaction. Both the outlets confirmed that CNN temporarily removed its account after being hacked.  

A search for CNN returns no results for the US-based English language account

According to TikTok’s spokesperson, Alex Haurek, the number of compromised accounts is “very small,” but refused to explain how TikTok is protecting other exposed accounts.

“We are dedicated to maintaining the integrity of the platform and will continue to monitor for any further inauthentic activity,” Haurek said, specifically referring to CNN’s account compromise. TikTok is working with the news outlet to restore account access and implement enhanced security measures to safeguard their TikTok account.

TikTok’s privacy and security team spokesperson, Jason Grosse, stated that the company is still investigating the attack and cannot comment on its scale or sophistication, but mentioned that the threat is a “potential exploit.”

For your information, Hilton’s staff and sources at TikTok have confirmed that her account was targeted but not compromised.

Hanna Basha, Partner at Payne Hicks Beach, one of the oldest and known law firms in the United Kingdom, commented on the incident highlighting the threat luring behind data sharing on social media.

_“_TikTok is the latest of many companies to be subject to a cyberattack highlighting that it is now almost impossible to avoid these sorts of attacks and therefore incredibly important that individuals consider carefully what they are sharing on social media platforms,_“_ warned Hanna.

_“_Individuals sharing private messages have legal rights in privacy, confidence and data to keep these messages private and prevent them from being published. However, the practical advice must be to try to limit what you do share, even in direct messages, and before sending consider whether it could be damaging or embarrassing if published,” Hanna emphasised.

ByteDance-owned TikTok, with over one billion users globally, has reportedly taken measures to prevent future attacks and is working with affected account owners to restore access if needed.

TikTok has long been criticized for its security practices, particularly when in January 2021 Check Point Research identified a flaw that could have allowed attackers to build a database of TikTok users and in September 2022, Microsoft discovered a one-click exploit affecting the Android app, allowing attackers to take over accounts. It is about time the company strengthens its cybersecurity mechanisms to prevent similar incidents.

1.  TikTok vulnerability allowed hackers to send SMS with malware
2.  TikTok Invisible Body Challenge Trend Abused to Drop Malware
3.  TikTokers promoted adware, earned half a million dollars in profit
4.  TikTok collected MAC addresses for Android against Google’s ToS
5.  New smishing scam spreads fake TikTok App loaded with malware

Few But High-Profile TikTok Accounts Hacked Via Zero-Click Attack in DM

A WIRED investigation, based on more than 22 million flight coordinates, reveals the complicated truth about the first full-blown police drone program in the US—and why your city could be next.

The Age of the Drone Police Is Here

These scammers are persistent and want your billing information to extort money from you.

Back in February, we reported on malicious ads related to utility bills (electricity, gas) that direct victims to call centers where scammers will collect their identity and try to extort money from them.

A few months later, we checked and were able to find as many Google ads as before, following very much the same pattern. In addition, we can see that miscreants are trying to legitimize their operations by creating fake U.S.-based entities.

**Utility-based ads targeting mobile phones**

It only took us 15 minutes to find about a dozen fraudulent ads on Google related to utility bills. This campaign is targeting mobile devices only, as far as we can tell, and U.S. residents. All the ads seen below belong to different advertisers based in Pakistan.

Some of those advertiser accounts have a fairly large footprint with several hundred ads.

Most often, the ad is not associated with a landing page (although a URL is displayed); instead clicking on the ad will bring up the phone number and prompt you to dial. Having said that, the domains used belong to the scammers and are often fairly new.

We also saw several ads that at first appear somewhat legitimate. They are registered to advertisers based in the US and their websites look almost authentic. But when you start checking the details, you realize some things don’t add up, such as an address that leads to an apartment complex.

**Consumer protection**

The Federal Trade Commission (FTC) has an article about utility scams, however the technique mentioned there is about scammers calling victims, rather than the other way around. For good reason many people won’t answer the phone when it shows an unknown number as it is likely yet another telemarketer. Certainly, there are victims that will answer the phone but the scam is much more effective when you are the one to initiate the call.

We have reported the fraudulent advertiser accounts to Google while we are also adding related domains to our blocklist. Remember to be extremely vigilant before calling anyone, especially if that number came from an advertisement. If in doubt, go directly to your utility company’s website using a computer and then look for a form or phone number that you can verify before dialing.

 Utility scams update 

Beware Macro! Ukrainian users and cyberinfrastructure are being hit by a new malware campaign in which hackers are…

Beware Macro! Ukrainian users and cyberinfrastructure are being hit by a new malware campaign in which hackers are using a multi-stage malware strategy to deliver the Cobalt Strike.

A recent cyberattack targeting Microsoft Windows-based endpoints in Ukrainian has been discovered by Fortinet’s FortiGuard Labs where attackers leverage a malicious Excel file to deploy Cobalt Strike, a notorious tool used for post-exploitation activities. 

In this attack, an apparently harmless Excel file is embedded with a VBA (Visual Basic for Applications) macro, a scripting language used in Microsoft Office applications. The attacker uses a multi-stage malware strategy to deliver the “Cobalt Strike” payload and establish communication with a command and control server.

The malicious Excel document contains Ukrainian elements to lure users into enabling its macros. The macro deploys a HEX-encoded DLL downloader, which executes the DLL (Dynamic Link Library) file using a shell command.

The DLL file, also disguised as a harmless component, is the key to deploying Cobalt Strike. The downloader examines process names for specific strings related to analysis tools and antivirus software, terminates the program if it detects a matching process, and executes the decoded file using “rundll32.exe”.

As per FortiGuard Labs’s report, The DLL Injector, “ResetEngine.dll,” is responsible for decrypting and injecting the final payload. It uses “NtDelayExecution” to evade detection of malicious activities within sandboxes and then, it decrypts the final payload using an AES algorithm. The code then injects the decrypted data into itself and uses various APIs to execute the final Cobalt Strike.

For your information, Cobalt Strike is a powerful tool that allows attackers to gain a foothold within a compromised system, steal sensitive data, deploy additional malware, and establish network persistence.

Fortinet researchers discovered a geolocation check within the VBA code, ensuring the payload is only downloaded on systems located in Ukraine. This targeted approach indicates a well-orchestrated operation with a specific goal in mind.

Attack flow (FortiGuard Labs)

This isn’t the first time a malicious Excel file was used to target Ukraine in recent years due to the ongoing geopolitical situation. In 2022, FortiGuard Labs reported a campaign using a malicious Excel document to deliver a Cobalt Strike loader, while Ukraine’s Computer Emergency Response Team confirmed UAC-0057’s involvement in an attack using a malicious XLS file to deploy PicassoLoader and Cobalt Strike Beacon.

This recent attack further highlights the evolving tactics of cybercriminals and the importance of robust cybersecurity measures. Users should be cautious of enabling macros in Excel files, especially from unknown sources and use reliable endpoint security software that can detect and prevent malicious macros.

1.  RomCom RAT Targets Pro-Ukraine Guests at NATO Summit
2.  UAC-0099 Used Old WinRAR Flaw in New Attack on Ukraine
3.  Google, Microsoft and Oracle generated most vulnerabilities
4.  AcidRain Linux Malware Variant “AcidPour” Targeting Ukraine
5.  Microsoft Office Most Exploited Software in Malware Attacks

Ukraine Hit by Cobalt Strike Campaign Using Malicious Excel Files

Generative AI tools such as OpenAI’s ChatGPT and Microsoft’s Copilot are becoming part of everyday business life. But they come with privacy and security considerations you should know about.

Generative AI tools such as OpenAI’s ChatGPT and Microsoft’s Copilot are rapidly evolving, fueling concerns that the technology could open the door to multiple privacy and security issues, particularly in the workplace.

In May, privacy campaigners dubbed Microsoft’s new Recall tool a potential “privacy nightmare” due to its ability to take screenshots of your laptop every few seconds. The feature has caught the attention of UK regulator the Information Commissioner’s Office, which is asking Microsoft to reveal more about the safety of the product launching soon in its Copilot+ PCs.

Concerns are also mounting over OpenAI’s ChatGPT, which has demonstrated screenshotting abilities in its soon-to-launch macOS app that privacy experts say could result in the capture of sensitive data.

The US House of Representatives has banned the use of Microsoft’s Copilot among staff members after it was deemed by the Office of Cybersecurity to be a risk to users due to “the threat of leaking House data to non-House approved cloud services.”

Meanwhile, market analyst Gartner has cautioned that “using Copilot for Microsoft 365 exposes the risks of sensitive data and content exposure internally and externally.” And last month, Google was forced to make adjustments to its new search feature, AI Overviews, after screenshots of bizarre and misleading answers to queries went viral.

**Overexposed**

For those using generative AI at work, one of the biggest challenges is the risk of inadvertently exposing sensitive data. Most generative AI systems are “essentially big sponges,” says Camden Woollven, group head of AI at risk management firm GRC International Group. “They soak up huge amounts of information from the internet to train their language models.”

AI companies are “hungry for data to train their models,” and are “seemingly making it behaviorally attractive” to do so, says Steve Elcock, CEO and founder at software firm Elementsuite. This vast amount of data collection means there’s the potential for sensitive information to be put “into somebody else’s ecosystem,” says Jeff Watkins, chief product and technology officer at digital consultancy xDesign. “It could also later be extracted through clever prompting.”

At the same time, there’s the threat of AI systems themselves being targeted by hackers. “Theoretically, if an attacker managed to gain access to the large language model (LLM) that powers a company's AI tools, they could siphon off sensitive data, plant false or misleading outputs, or use the AI to spread malware,” says Woollven.

Consumer-grade AI tools can create obvious risks. However, an increasing number of potential issues are arising with “proprietary” AI offerings broadly deemed safe for work such as Microsoft Copilot, says Phil Robinson, principal consultant at security consultancy Prism Infosec.

“This could theoretically be used to look at sensitive data if access privileges have not been locked down. We could see employees asking to see pay scales, M&A activity, or documents containing credentials, which could then be leaked or sold.”

Another concern centers around AI tools that could be used to monitor staff, potentially infringing their privacy. Microsoft’s Recall feature states that “your snapshots are yours; they stay locally on your PC” and “you are always in control with privacy you can trust.”

Yet “it doesn’t seem very long before this technology could be used for monitoring employees,” says Elcock.

**Self-Censorship**

Generative AI does pose several potential risks, but there are steps businesses and individual employees can take to improve privacy and security. First, do not put confidential information into a prompt for a publicly available tool such as ChatGPT or Google’s Gemini, says Lisa Avvocato, vice president of marketing and community at data firm Sama.

When crafting a prompt, be generic to avoid sharing too much. “Ask, ‘Write a proposal template for budget expenditure,’ not ‘Here is my budget, write a proposal for expenditure on a sensitive project,’” she says. “Use AI as your first draft, then layer in the sensitive information you need to include.”

If you use it for research, avoid issues such as those seen with Google’s AI Overviews by validating what it provides, says Avvocato. “Ask it to provide references and links to its sources. If you ask AI to write code, you still need to review it, rather than assuming it’s good to go.”

Microsoft has itself stated that Copilot needs to be configured correctly and the “least privilege”—the concept that users should only have access to the information they need—should be applied. This is “a crucial point,” says Prism Infosec’s Robinson. “Organizations must lay the groundwork for these systems and not just trust the technology and assume everything will be OK.”

It’s also worth noting that ChatGPT uses the data you share to train its models, unless you turn it off in the settings or use the enterprise version.

**List of Assurances**

The firms integrating generative AI into their products say they’re doing everything they can to protect security and privacy. Microsoft is keen to outline security and privacy considerations in its Recall product and the ability to control the feature in **Settings > Privacy & security > Recall & snapshots**.

Google says generative AI in Workspace “does not change our foundational privacy protections for giving users choice and control over their data,” and stipulates that information is not used for advertising.

OpenAI reiterates how it maintains security and privacy in its products, while enterprise versions are available with extra controls. “We want our AI models to learn about the world, not private individuals—and we take steps to protect people’s data and privacy,” an OpenAI spokesperson tells WIRED.

OpenAI says it offers ways to control how data is used, including self-service tools to access, export, and delete personal information, as well as the ability to opt out of use of content to improve its models. ChatGPT Team, ChatGPT Enterprise, and its API are not trained on data or conversations, and its models don’t learn from usage by default, according to the company.

Either way, it looks like your AI coworker is here to stay. As these systems become more sophisticated and omnipresent in the workplace, the risks are only going to intensify, says Woollven. “We're already seeing the emergence of multimodal AI such as GPT-4o that can analyze and generate images, audio, and video. So now it's not just text-based data that companies need to worry about safeguarding.”

With this in mind, people—and businesses—need to get in the mindset of treating AI like any other third-party service, says Woollven. “Don't share anything you wouldn't want publicly broadcasted.”

AI Is Your Coworker Now. Can You Trust It?

Cloud computing and analytics company Snowflake said a "limited number" of its customers have been singled out as part of a targeted campaign.
"We have not identified evidence suggesting this activity was caused by a vulnerability, misconfiguration, or breach of Snowflake’s platform," the company said in a joint statement along with CrowdStrike and Google-owned Mandiant.
"We have not identified

Snowflake Warns: Targeted Credential Theft Campaign Hits Cloud Customers

YouTube remains the only major US-based social media platform available in Russia. It’s become "indispensable" to everyday people, making a ban tricky. Journalists and dissidents are taking advantage.

In December 2020, Vladimir Putin held his end-of-the-year press conference as normal. Despite the Covid-19 pandemic still raging in Russia and worldwide, the president insisted that things would be OK. He had set aside 350 billion rubles ($4.8 billion) “to give social benefits to people, families, both children, doctors, and students.”

Two weeks later and nearly 1,000 miles away, the opposition Anti-Corruption Foundation uploaded a video to its YouTube channel. In it, Alexei Navalny introduces the world to “Putin’s palace,” which he dubbed “the world’s largest bribe.”

Over nearly two hours, Navalny walks viewers through the trappings of the palatial datcha, on the Black Sea coast. A 2-million-ruble sofa, a 2-million-ruble vanity, a dining table worth nearly 4 million rubles. The ubiquitous gold leafing on the walls, a private theater, a velvet-lined hookah bar, a casino, even a _Dance Dance Revolution_ room. The construction of such a lavish abode would have cost Putin and his oligarchic backers over 100 billion rubles ($1 billion) of money pilfered from the Russian state, Navalny tells the viewer. Money that could have gone to people, families, children, doctors, and students.

The Russian-language video exploded, far surpassing anything Navalany and the Foundation had ever produced. Within weeks, it blew past 100 million views, and it has added another 32 million views since then—nearing the population of Russia itself.

The Foundation’s popularity on the world’s largest video-sharing platform had been growing massively over the preceding year—particularly as Russians were stuck indoors, and as the Kremlin intensified its crackdown on the independent press.

“Twenty years of total government control have turned television into an incessant marathon of disgraceful propaganda, lies, and censorship,” as Navalny told his viewers in a 2020 video. Behind him, a stack of TVs broadcast different clips of Russian TV presenter Vladimir Solovyov, a ubiquitous face on the Russia1 channel.

In December of that year, Navalny began his regular video dispatches with a startling introduction: “Hi, it’s Navalny. I know who wanted to kill me. I know where they live. I know where they work. I know their real names.”

Working with investigative journalism outfit Bellingcat, Navalny had posed as a Kremlin official in order to coax a confession out of one of his would-be assassins. The alleged agent recounted how the team of Russian operatives applied the nerve agent Novichok to Navalny’s underwear. Navalny recorded the whole thing and posted it directly to his YouTube channel.

In a follow-up video, Navalny continues to break down the failed murder plot in front of a wall featuring each of the men’s photos, maps of the operation, and red twine connecting everything.

In the West, Navalny’s appeal was often shortened to that of simply an opposition figure—a divisive one, for some, who became the de facto alternative to Putin after the other alternatives were killed or jailed.

But in the years leading up to his 2021 imprisonment and death in February 2024, Navalny became much more than just a politician—and the media apparatus he became the face of became bigger than him.

While Russia has grown considerably more autocratic in recent years, with its elections even more tightly scripted and its media ever more controlled by the Kremlin, YouTube remains one of the few US-based social media sites still available in the country and a reliable and effective conduit to the Russian public. It could be key to determining what happens next in Moscow—if YouTubers can stay ahead of Kremlin censorship.

“With minimal resources, we were essentially able to establish a direct competitor of Putin’s propaganda television,” says Vladimir Milov. “We are still behind them, but we are breathing down their back.”

Milov is a former deputy minister with the Russian government, a longtime Navalny associate, and a YouTube creator in his own right. I caught up with him in Vilnius, where he’s been exiled since Moscow began criminal proceedings against him. Last year, Milov was convicted by the Russian courts of disseminating “war fakes” and sentenced to eight years in prison in absentia.

Milov’s regular updates, which tend to focus on economics and finance, go out to his 500,000-plus subscribers, and often rack up around a million views. Leonid Volkov, another Navalny associate who helps run the Anti-Corruption Foundation, boasts another 165,000 followers. Dasha Navalnaya, Alexei Navalny’s daughter, has her own channel where she interviews GenZ Russians about the state of their country.

Above that, independent media have found a second home on YouTube as well. Meduza, an independent media organization that had to decamp to Latvia after being declared a “foreign agent” under Russian law, has nearly 800,000 subscribers. The BBC’s Russian service, which left the country amid a 2022 media crackdown, broadcasts regularly to its 2.5 million subscribers.

Cobbling together the analytics across these various channels, Milov says these opposition YouTubers have about 10 million to 15 million dedicated viewers inside Russia—while another 20 million viewers may stumble across their content from time to time.

​”Our message gets through to the Russian people,” Milov says. “We are serving as a very effective alternative broadcasting tool that really competes with Putin's propaganda.”

VCIOM, a pollster loyal to the Kremlin, has found that a plurality of Russians still prefer to get their news from heavily censored Russian television, but their trust in the format has plummeted, from nearly 50 percent in 2016 to just 25 percent today. Meanwhile, trust in online news has jumped by roughly the same degree.

Meanwhile, as Western programming becomes rarer and rarer, many Russians are turning to YouTube for their primary source of entertainment—especially for kids’ programming. Eight of the 10 most-subscribed Russian YouTube channels, according to rankings compiled by analytics firm Socialblade, are targeted at young children.

So Russians are losing faith in the state-approved TV news, increasingly trusting of online media, and are looking to YouTube for entertainment. It has delivered tens of millions of people right at the opposition’s doorstep.

Even if most Russian YouTube users are looking for content to pacify their children, bringing them on the platform has enormous benefits, Milov says. “There's this magical black box which is called YouTube recommendations.” He says plenty of his followers don’t even watch his videos—they listen. If Russians are letting the algorithm choose their next video while they cook dinner or fold laundry, it increases the chances his voice will reach a Russian who has never heard him before.

Milov stresses that YouTube isn’t just a one-way service: Because it allows users to comment and chat anonymously, it provides an extraordinary chance for regular Russians to express themselves without fear of censorship.

“The amount of our feedback is enormous,” he says. “Just myself, alone, I literally get messages, every day, from at least hundreds of people from across the country. When something serious happens? Thousands.” Sometimes, Milov says, his first indication that something terrible has happened in Russia is seeing just how many unread messages he has in his YouTube inbox.

Milov says this feedback reinforces the idea, supported even by Kremlin-approved pollsters, that opposition to the war in Ukraine is growing. But it also provides some important details and nuance. “So this is like, I would say, an enormous focus group, with which you can also communicate. You can ask them questions back.” He chuckles, thinking of the notorious Russian security and intelligence agency: “You know, the FSB would kill for this kind of information.”

“Obviously, the question is, why didn’t Putin shut down YouTube?” Milov says. “It’s easier said than done.”

In recent years, Moscow has deployed an array of strategies to cow and kill independent media and the open internet in Russia. Platforms like Facebook, Twitter, and TikTok have been blocked altogether. Independent media like Meduza, TV Rain, and The Insider have been declared “undesirable” or labeled “foreign agents.”

Through it all, YouTube has survived.

Milov says the Kremlin was too slow to move on YouTube. By the time Moscow was banning other popular Western platforms, the Google-owned video platform had become indispensable to everyday Russians. “They kind of let the genie out of the bottle,” Milov says.

“YouTube is mommies showing cartoons to kids, teenagers are watching music videos, people are watching comedians, elderly folks watching old Soviet movies, which are widely available there, and so on,” he says. “And you shut it all down? So you have these empty evenings now, from this point on.”

Unable to disrupt YouTube, the Kremlin tried desperately to compete with it.

Moscow had high hopes for Rutube, a long-suffering YouTube clone which was relaunched in 2020 after a merger with the media arm of state-controlled energy giant Gazprom. If the site’s “top videos” section is to be believed, it hasn’t worked—some had racked up view counts in the mid-thousands.

VK, Russia’s answer to Facebook, has fared slightly better with its video-sharing platform, and it is rife with pro-Kremlin broadcasters. But even its most popular channels have just a tiny fraction of the biggest Russian-language YouTube accounts.

“It's like a big room, but it's empty,” Milov says of these Kremlin-backed alternatives.

Having failed to compete with his online critics, Milov believes Putin opted for a more direct strategy. Just days before I arrived in Vilnius, thugs appeared outside the home of Leonid Volkov, former chair of the Anti-Corruption Foundation and Nalvany chief of staff. Armed with hammers, they savagely beat him. Lithuanian intelligence believe the men arrested were operating on orders from Russia. A week after the attack, Volkov was back on YouTube, his arm in a sling, “I am not going to stop—although I will gesticulate less in the coming weeks,” he said.

Milov emailed me the day I arrived to apologize that, due to his new security protocols, he wouldn’t be able to show me around his home broadcast studio.

Last November, the YouTube channel Volgograd Watch uploaded a new video trying to answer a difficult question: “When will the mobilized be returned?”

Subscribers of the channel were asking when Russia’s conscripts on the front line might return home. Evgeny Kochegin, host of the channel, responded by providing a litany of links recommending anti-war groups and resources on how to dodge the draft. Kochegin himself fled conscription and was convicted in absentia for disseminating “fake news.”

In exile, Kochegin has tried to help others avoid being pressed into military service, and took to YouTube to do it, racking up a modest 30,000 subscribers. In May, however, Kochegin found YouTube to be an unreliable partner. His video was blocked for Russian viewers.

Agents Media, an independent Russian news outlet, reviewed four different removal notices targeting human rights and anti-war YouTube channels. The news outlet obtained emails from YouTube’s legal team, threatening to take offline an entire channel. In the email to the OVD-Info channel, YouTube wrote that the channel had violated Russian Law #149-FZ and that “if you do not remove the content, Google may be required to block it.”

According to a company transparency report, Google has received hundreds of thousands of removal requests from the Russian government since 2022, including nearly 67,000 on the grounds of “national security,” over 200 for “government criticism,” and one for violating the electoral law.

More than 1,000 applications from Moscow specifically cited Law #149-FZ, asking for the removal of nearly 1 million pieces of content—which could include channels, videos, or comments. Google reports that it approved more than 80 percent of those removal requests.

An open letter published in May, signed by major Russian NGOs and Reporters Without Borders, called on Google to stop adhering to these requests from Moscow. “We are very concerned that the company appears to be helping the Russian censor to silence human rights and anti-war voices,” they wrote.

In a statement, a spokesperson for YouTube insisted that if the company has concerns that legal requests are being used to silence dissidents, “we will push back”—noting that Russian courts have fined Google in the past for refusing to comply with its orders.

YouTube says it has removed more than 12,000 channels and over 140,000 videos relating to the war in Ukraine for violating the platform’s policies—including pro-Putin propagandists, Kremlin-controlled media outlets, and content from the Russian Ministry of Foreign Affairs.

The YouTube spokesperson, however, ignored questions as to why it has been so willing to respond to requests under Law #149-FX.

Whether their channels are at risk from legal requests from Moscow, or whether Moscow blocks their channels entirely—the Russian dissidents are always making contingency plans. “They will not kill us by just shutting down one thing and making the other cooperate with the regime,” Milov says. “We'll navigate through.”

One such plan is to wind up right where the problem began: on TV.

Not long after Russia invaded Ukraine in February 2022, a group calling itself the Denis Diderot Committee began calling on major satellite television providers to stop beaming Kremlin propaganda into Russia and Europe — and replace it with real news.

“That's the ultimate goal of our effort—to actually provide alternative media channels into the Russian television space that are not controlled by the Russian government,” Jim Phillipoff, one half of the committee, told WIRED at the time.

Two years on, the committee scored a huge win. Satellite provider Eutelsat took up the committee’s challenge and inked a deal with Reporters Without Borders to broadcast 11 channels of independent Russian news and content into the region, with the option to add 14 more. They call it the Svoboda Satellite Package—using the Russian word for “freedom.”

Phillipoff told WIRED this week that they have begun broadcasting into 4.5 million households in Russia, and another 61 million households in the broader region—and they hope to grow that number by securing space on other regional satellites.

While the satellite is simply rebroadcasting some existing channels, Philipoff says they’ve also created some channels from scratch—in some cases made up of dissident Russians’ YouTube content. They’ve been in talks with Volkov to help rebroadcast some of the work from the Anti-Corruption Foundation and other opposition groups. (They have also explored how to cooperate with eQsat, a like-minded effort to broadcast digital news files using satellites, which WIRED revealed last September.)

While Russian television remains under the thumb of the Kremlin, and Google remains willing to block content at its behest, Svoboda exists to reject the censorship altogether, Phillipoff says.

“The goal of our project is to circumvent this control.”

Tag

#google