The world’s most prolific crypto thieves have used Sinbad.io to launder tens of millions. Its creator, “Mehdi,” answers WIRED’s questions.

In the cryptocurrency economy, there's often a fine line between financial privacy and money laundering. Now one Bitcoin "mixer" service called Sinbad.io is walking that tightrope in full public view: Just a few months after launching on the open web, it appears to have already become the preferred money-laundering outlet for the world's most prolific state-sponsored crypto thieves.

In a portion of its annual crime report published last week, blockchain analysis firm Chainalysis noted that Sinbad—which, like other mixer services, offers to foil cryptocurrency tracing efforts by taking in users' cryptocurrency, mixing their coins with other those of other users, and returning the same amount—had received $25 million in stolen cryptocurrency from North Korean hackers in just December and January, more than any other mixing service had received.

Those funds, according to Chainalysis, include portions of the thieves' proceeds from massive heists that targeted the Harmony Bridge service, from which the North Koreans stole roughly $100 million, as well as the Ronin Bridge service, from which the hackers stole a staggering $650 million. Chainalysis' vice president of investigations, Erin Plante, says North Korea's crypto-stealing cybercriminals began funneling their profits bit by bit through Sinbad almost immediately after the mixer's October launch, in the hopes of obscuring their loot's origin before cashing it out at an exchange. Sinbad "hit the radar for North Korea quickly," Plante says, "and it's become their favorite."

That's put the new service in an awkward position: Just weeks after its debut, Sinbad became a tool that operates publicly—with a traditional website running in the open in addition to a dark-web site running on the anonymity network Tor—and yet some of its earliest, most high-volume users also happen to be the crypto world's most notorious cybercriminals. North Korean hackers, according to Chainalysis's findings, stole no less than $1.7 billion in cryptocurrency last year, helping to make the year the worst on record for total crypto thefts.

Sinbad's's founder, meanwhile, argues in an email interview with WIRED that the service has no reason to hide. "Sinbad is present in clearnet because it doesn’t do anything bad," writes the service's creator and administrator, who asked to be called "Mehdi," using the term "clearnet" to mean a website not hidden on the Tor network.

"I am against total surveillance, control over internet users, against autocracies and dictatorships," Mehdi adds. "Every living person has the right to privacy."

Mehdi, who declined to reveal his real name or where he or Sinbad are based, says that he created Sinbad as a response to the growing centralization of cryptocurrency and the erosion of the privacy promises it once appeared to offer. He named his mixer service after the fictional Middle Eastern sailor who, as Mehdi puts it, "traded goods all around the world." Mehdi describes Sinbad as a legitimate privacy-preserving technology project, comparing it to privacy-focused cryptocurrencies like Monero or Zcash, anonymity-enhancing crypto wallet software like Wasabi, and the Tor browser, which encrypts user traffic and routes it through multiple servers to hide people's identities.

As for the tens of millions of dollars that North Korean hackers laundered through Sinbad? "Your magazine is the first one to ever contact me about this issue," Mehdi writes. "In case I receive a request from \[Chainalysis\] or any other institution I will investigate the matter and make my opinion on it."

Sinbad's position highlights a strange tension in the world of cryptocurrency. The cryptocurrency obfuscation tools like Monero, Zcash, and Wasabi to which Mehdi compares Sinbad do have legitimate and legal uses—say, a retail store that wants to accept cryptocurrency payments without revealing its revenue to a competitor, or dissidents in a repressive regime who want to fund their opposition movement through international cryptocurrency donations without being tracked. Mixer services are among those privacy services. They can, in some cases, protect users' funds from being traced on blockchains, where transactions are often all too easily surveilled. But mixers also often enable money laundering by the rampant ransomware gangs, scammers, dark-web black market vendors, and thieves who have long exploited the crypto economy.

In recent years, Western law enforcement has cracked down on a series of mixer services, a law enforcement effort that's left fewer money-laundering options for cybercriminals than at any time in the past decade, according to Chainalysis. The US Department of Justice indicted the alleged administrators of mixing services Bitcoin Fog and Helix in 2020, and Dutch prosecutors late last year launched similar charges against the creator of another crypto mixing service, Tornado Cash. The US Treasury's Office of Foreign Asset Controls also imposed sanctions against Tornado Cash and the mixing service Blender, both of which Chainalysis says were previously used by North Korean hackers to launder millions of dollars in stolen crypto.

But in the US criminal cases against mixing service administrators, at least, the Department of Justice has claimed that the services knowingly conspired with criminals. In the cases of Bitcoin Fog, for instance, prosecutors say undercover agents told the service that they sought to launder profits from dark-web drug sales, and Bitcoin Fog nonetheless completed their transactions. Helix advertised its services on the homepage of dark-web drug market AlphaBay.

Mehdi, by contrast, argues that he wasn't aware that the $25 million in allegedly dirty crypto Chainalysis identified was sent to Sinbad by North Korean hackers: Those funds were stolen, Mehdi points out, in the form of the cryptocurrency Ether and only later exchanged for bitcoins, the only cryptocurrency Sinbad accepts. "I couldn't have possibly known about the funds' sources," Mehdi writes.

Chainalysis' Plante speculates that the North Korean hackers may have chosen Sinbad in part due to its newness. Because it only recently appeared online, she says many investigators may not have yet identified its Bitcoin addresses, making its mixing far harder to trace. Plante declined to say whether Chainalysis had managed to defeat the service's mixing itself, potentially tracing its users' coins in spite of Sinbad's privacy assurances—a feat the company says it's achieved with some other cryptocurrency mixing services in the past.

But Nick Carlsen, an investigator at another cryptocurrency tracing firm, TRM Labs, argues that Sinbad is likely too small to function as an effective mixer: The fewer users and the smaller their pool of funds, the easier it is to distinguish their transactions and follow the money. And that thin layer of temporary anonymity may be all that North Korean hackers are seeking, given that they're usually based in North Korea or China, far beyond the reach of Western law enforcement. "The North Koreans' typical MO isn't to obtain the kind of anonymity any other hacker would need," says Carlsen. "They're usually just trying to buy themselves a few hours of breathing room with which they can carry out the next phase of their laundering op."

As for whether Mehdi himself might be identified, indicted, arrested, or sanctioned, he told WIRED he remains relatively confident about his own fate. He shared a long list of cryptocurrency mixing services on the forum BitcoinTalk, pointing out that relatively few have faced those outcomes. "It would be silly not to worry about it at all. I take all the necessary precautions to protect my anonymity," he writes, but "I expect to remain part of the market and not become one of the unfortunate exceptions."

Amid a continuing crackdown on crypto money-laundering services, though, there's no doubt Sinbad's high-wire act is riskier than ever—particularly as its North Korean users paint an ever-larger target on its back.

Meet the Creator of North Korea’s Favorite Crypto Privacy Service

Members of the Trickbot and Conti cybercrime gangs have been sanctioned in an unprecedented wave of action against the country’s hackers.

For years, Russia-based ransomware gangs have launched crippling attacks against businesses, hospitals, and public sector bodies, extorting hundreds of millions of dollars from victims and causing untold disruption. And they’ve done so with impunity—but no more. Today, as part of a push to shut down ransomware gangs, the UK and US governments have unmasked some of the criminals behind the attacks. 

In a rare move, officials have sanctioned seven alleged members of notorious ransomware gangs and published their real-world names, dates of birth, email addresses, and photos. All seven of the named cybercriminals are said to belong to the Conti and Trickbot ransomware groups, which are linked and often jointly referred to as Wizard Spider. Moreover, the UK and US are now explicitly calling out links between Conti and Trickbot and Russia’s intelligence services.

“By sanctioning these cybercriminals, we are sending a clear signal to them and others involved in ransomware that they will be held to account,” UK foreign secretary James Cleverly said in a statement on Thursday. “These cynical cyberattacks cause real damage to people’s lives and livelihoods.”

The seven gang members named by the two governments are: Vitaly Kovalev, Maksim Mikhailov, Valentin Karyagin, Mikhail Iskritskiy, Dmitry Pleshevskiy, Ivan Vakhromeyev, and Valery Sedletski. All the members have online handles, such as Baget and Tropa, that they used to communicate with each other without using their real-world identities.

On Thursday, the UK’s National Cyber Security Center (NCSC) said it is “highly likely” that members of the Conti group have links to “the Russian Intelligence Services” and that those agencies have “likely” directed some of the gang’s actions. NCSC is part of the UK intelligence agency GCHQ, and this is the first time the UK has sanctioned ransomware criminals.

Similarly, the US Department of the Treasury has concluded that Trickbot Group members are “associated with Russian Intelligence Services.” It added that the group’s actions in 2020 were aligned with Russia’s international interests and “targeting previously conducted by Russian Intelligence Services.”

According to the US Treasury, these members were involved in malware and ransomware development, money laundering, fraud, injection of malicious code into websites to steal login details, and managerial roles. As part of the sanctions, the UK froze assets belonging to the ransomware actors and imposed travel bans on them. The US District Court for the District of New Jersey also unsealed an indictment charging Vitaliy Kovalev with conspiracy to commit bank fraud and eight counts of bank fraud against US financial institutions in 2009 and 2010.

Governments have struggled to get a handle on the growing ransomware threat, in large part because many of the criminal groups operate in Russia. The Kremlin has provided a safe haven for these bad actors—as long as they don’t target Russian companies. Last year, following a string of particularly aggressive and disruptive attacks on US and UK targets, Russian law enforcement did arrest more than a dozen alleged members of the notorious ransomware gang REvil. But Russia has continued to be the origin point for an array of cybercriminal activity, including ransomware attacks.

Alex Holden, the founder of security firm Hold Security, has tracked the Conti and Trickbot groups for the better part of a decade, mapping out their members and activities. Holden says that “unmasking” the criminals can make a difference to their actions. “Ransomware gang members should be afraid of their real names being made public, as they will be forced to run and hide even if they can’t be brought to justice in our legal system,” he says.  

The unmasking of Conti and Trickbot members follows two huge leaks from the criminal gangs in early 2022. After Vladimir Putin’s full-scale invasion of Ukraine in February 2022, members of the Conti gang declared their support for Russia. A Ukrainian cybersecurity researcher who had infiltrated the group reacted by leaking more than 60,000 of its internal chat messages, revealing key details about members and their hacking activities. This was followed by a second leak from Trickbot, weeks later. It is likely that these details have helped law enforcement agencies track down and identify members of the gangs.

Researchers have long concluded that cybercriminals working in Russia have amorphous but crucial connections to the Kremlin, but there has been little clear information, and officials have often been vague about the dynamic. 

Kimberly Goody, a senior manager in cybercrime analysis at the Google-owned security company Mandiant, says details from the leaked chatlogs in early 2022 are consistent with the US and UK linking some elements of the groups to Russian intelligence services. 

The Conti chatlog leak also revealed some potential links between Conti members and the Russian state. The logs show Conti members working on “government topics” for their hacking and illustrate their knowledge of the prominent Kremlin-sponsored hacking group Cozy Bear. Members of Conti also discussed whether they could hack someone linked to open source investigative journalism unit Bellingcat.

The cybercrime group was “inarguably not flying below the radar,” Goody says. “Russia knew about it, and they \[Russia\] have a history of tapping into their community of cyber criminals when it suits them—we saw that with the Dridex sanctions too.” Goody adds that the leaked chats show that other Trickbot members, who were not named in the most recent sanctions, may also have received instructions from people outside Trickbot.

In the summer of 2022, Google’s Threat Analysis Group and IBM’s X-Force both said Trickbot and Conti had shifted focus to attack Ukraine, a move that clearly appeared aligned with Russian interests. The IBM security researchers said they had not seen the group previously targeting Ukraine and called it an “unprecedented shift.”

Over the past decade, governments have increasingly called out state-backed hacking efforts from Russia, China, and other nations, occasionally even revealing the identities of individual government hackers. But researchers say that the focus on naming individual cybercriminals represents an important shift. “We’re now seeing these methods increasingly used with ransomware actors, reflecting the growing priority of cybercrime on national security agendas,” says Jamie Collier, a senior threat intelligence advisor at Mandiant.

But the long-term impact of unmasking ransomware groups is unclear. While the Conti group, for example, disbanded in June 2022 after hacking the government of Costa Rica, its members are thought to have continued their criminal activities, seemingly joining the Quantum, Royal, and Black Basta ransomware groups. But for victims who have faced the disruption and financial devastation of cybercrime, aggressive new action from world governments can’t come soon enough.

Russia’s Ransomware Gangs Are Being Named and Shamed

People in Europe are making GDPR requests to have their private messages erased, but Elon’s team is ignoring them.

Twitter’s direct messages have always been a security liability. The DMs you send to friends and internet strangers aren’t end-to-end encrypted, making your conversations potentially accessible if Twitter suffers a data breach, or to company staffers with the right permissions to access them. Both scenarios are arguably more likely in Elon Musk’s version of Twitter, where key security and data protection staff have departed.

Since Musk acquired Twitter and started laying off thousands of employees at the start of November, remodeling the firm in his vision, multiple waves of tweeters have abandoned the platform. When they do, they often try to download their Twitter archive and delete DMs. In the chaos, the process has often been glitchy.

However, in Europe, people have turned to the continent’s GDPR data laws, which give people rights over how their information is collected, stored, and used. This includes the right to have data deleted. However, Twitter’s response to these requests, which have been seen by WIRED, appears to show the platform ignoring detailed asks to delete DMs and just point people to generic guidance that doesn’t explain whether Twitter deletes your DMs from its servers. And now Europe’s data regulators are getting involved.

“On Twitter, the delete button does not do what users think it does,” says Michael Veale, an associate professor focusing on digital rights and regulation in the Faculty of Laws at University College London. “If you delete your direct messages within the app or on the website, it does not remove them from Twitter’s server,” Veale says.

For years, there hasn’t been any clarity around what Twitter’s inbuilt tools for deleting your messages actually do. Within the social media site, there are, theoretically, two ways to delete the DMs you’ve sent. In your inbox, you can delete entire conversations, while within messages you can delete individual posts.

Neither of these options really appears to delete your messages. If you delete entire conversations, Twitter says, they are removed from your messages inbox but still available to the person you are messaging. Meanwhile, if you delete an individual message, Twitter says the people you sent it to “will still be able to see it.” Twitter’s help center says messages and conversations are “deleted from your account only.” They don’t say messages are deleted from its systems or servers.

Previous research has found that deleted DMs are held within Twitter’s servers for years. In 2022, Twitter whistleblower and former security chief Peiter “Mudge” Zatko claimed it wasn’t possible in some cases for Twitter to delete data.

At the start of November, Veale created a guide that people in Europe can use to request that Twitter deletes DMs from its servers. In the guide, Veale says the “disaster scenario” is a data breach similar to 2015’s Ashley Madison hack, where people’s private lives were spread across the internet. Journalists, activists, protesters, and more have all relied on Twitter’s messages in the past decade to share private information and get in touch with those who may be at risk.

Both Europe’s GDPR and California’s CPPA privacy laws give people the right to ask companies to delete data they hold about them, though there are exceptions to these rules. Furthermore, if someone writes to a company under GDPR and asks it to delete their data, the firm is obliged to reply and, if refusing, explain its reasons why. Veale’s guide suggests using this language to request DM deletion: “I wish for these data to be erased from all systems, including backup systems (on an appropriate schedule).” It further suggests asking only for messages sent by your account to be deleted (not those you have received), and states there’s no obvious reason why Twitter should keep the messages.

Lari Lohikoski, a communications professional and entrepreneur based in Finland, manually deleted his DM conversations after Musk took over Twitter but also decided to request the company delete them from its systems. “I don’t see my direct messages on Twitter’s user interface, but I very much think that they are on their server still,” Lohikoski says. 

Twitter initially replied to his request with a short message advising him to delete his account to get rid of messages, which Lohikoski says is not what was asked for. (In November, the author of this article made a request for Twitter to delete their DMs and received a similar one-line response from Twitter.) Twitter, which no longer has a communications department, did not respond to WIRED’s request for comment. Its policies say: “Once your account is deleted, your account is no longer available in our systems.” It is not clear whether this means the data is deleted entirely, or is unavailable internally.

Lohikoski, who says Twitter doesn’t “seem to respect the GDPR,” complained to Finland’s data regulator and also the Irish data regulator, the body that primarily oversees Twitter in Europe. Veale received a similar message and complained to the Irish regulator as well as the UK’s Information Commissioner’s Office (ICO). TechCrunch has also reviewed complaints about deleting DMs.

The ICO told Veale that Twitter’s response “failed to comply with the requirement of the data protection legislation” as it didn’t reply properly to the request and only provided “general information” about deleting Twitter accounts. The ICO said it would write to Twitter. Companies that don’t follow GDPR rules may be liable for large fines or enforcement action—although it would be rare in this circumstance.

On January 18, Lohikoski says he received a “surprise” email from Twitter. It repeated Twitter’s help center advice about DMs. It did not directly respond to the points made in the initial request. Lohikoski says “this again does not respond to my request.” (The ICO told Veale that Twitter also replied to him around this time; however, it appears to have sent the message to an email address that doesn’t belong to Veale. The ICO told the company to explain how this happened.) An ICO spokesperson says that it is “engaged in dialog” with Twitter’s data protection officer and assessing the impacts of changes to Twitter under Musk. The ICO did not comment on any specifics of complaints about DMs being deleted. 

Since Musk took charge at Twitter, the company has been trying to reassure regulators that it is taking its obligations, particularly in Europe, seriously. European officials have criticized Twitter for suspending journalists and changing its API access in ways that could impact disinformation research. Twitter is also likely to fall under the strictest tier of Europe’s new Digital Services Act, which could see companies face large fines for not complying with its rules.

Twitter has claimed it wants to introduce end-to-end encryption to its DMs, but this could take awhile, if it ever happens at all. Until then, it is probably best not to include sensitive information in DMs. Instead, you should consider an encrypted messenger, such as Signal.

Ultimately, Veale says, Big Tech companies are trying to position themselves so that they decide what people’s information rights are and what information they should provide to people. Veale highlights tech companies’ “download your data” services, which provide people with their posts, photos, and other data, but appear to avoid providing other forms of data such as analytical information. “We don’t really know the extent of information that’s collected by these companies,” Veale says. “The real core problem is that these companies disguise things that look like information rights behind fake user interfaces.”

Want to Delete Your Twitter DMs? Good Luck With That

Biden’s speech calling for better data protections got a standing ovation from both sides of the aisle. So, where’s a federal privacy law?

When it comes to antitrust and tech, there’s a trust deficit on Capitol Hill, even as pressure to act continues to mount. And Senate Democrats trust Speaker McCarthy to do one thing: protect American-made monopolies.

“I think the sentiment is there, but we’ve had a difficult time getting Republicans to support legislation in this area,” says Senator Brian Schatz of Hawaii, a Democrat.

House Republicans may see common ground with Biden’s new tough-on-tech approach, but this is no kumbaya Congress—and the rest of Biden’s State of the Union vision, on first blush at least, has been portrayed by Republicans as a laundry list of reasons to never work with Biden, no matter their common tech foes. “What we saw tonight was Joe Biden talk about unity in one breath followed up with bashing and rolling Republicans,” says Republican congresswoman Kat Cammack of Florida. “That, to me, just shows he’s not serious about getting things done for the good of the American people.”

After dismissing the bulk of the president’s agenda, Cammack admits there was one bright spot. She calls Biden’s stern message to Silicon Valley “encouraging.”

“We have a really serious problem when it comes to our personal data being collected without warrants, being sold without our permission, and it’s time that we put people’s data and privacy back in their hands,” Cammack said. “So I was encouraged to hear that, but it’s a long road between now and then.”

Long road ahead, surely, but House members are only granted short, two-year windows of service, and the sprint to 2024 is already on. Pomp and circumstance was last night’s dress code, even if some got a different memo. But now the focus moves to legislating—and, especially on the eve of a presidential election, that means bomb-throwing and finger-pointing. 

Democrats and Republicans alike have failed to put up guard rails on the Silicon Valley donor class in recent years, even as both parties continue decrying the very tech sector Washington policymakers have refused to regulate, all while Americans’ data is mined, shared with law enforcement, or sold to other third parties. Hot air and deflated rhetoric aren’t options for this 118th Congress, according to Cammack.

“Truth be told, I don’t think we have a choice,” Cammack says. 

“We have a divided Congress, and Republicans in the House are serious about data protection for consumers, for Americans, and I think Democrats are as well. The trick is going to be putting a bill together that not just survives Congress but will avoid a veto when it gets to his desk. So that’s going to be where the rubber meets the road.”

Tech politics are different than other hot-button issues. They’re at once bipartisan—everyone has a gripe or three with Big Tech—but they’re also stubbornly stuck in Washington’s rigid partisan patterns. That’s why soaring rhetoric only goes so far, even as the mistrust is seemingly endless. Hence, the details are often the devil.  

“These are tough conversations. We all value privacy. We all want to protect our children,” says Senator Kevin Cramer of North Dakota, speaking for many of his fellow Republicans. “But we also like free enterprise. We like innovation. I always think it’s better to knock down barriers to competitors than it is to regulate the incumbents, so to speak, in business.”

Senators tend to be a little older than their House counterparts (according to Pew Research, 7.4 years older, on average). In recent years, the chamber’s octogenarians proved themselves the butt of Silicon Valley jokes, but times are changing—at Senate speed.

All five of the Republicans who captured Senate seats in November are bullish on Big Tech. While it’s unclear how quick—or successful—they’ll be in their efforts to educate their anti-regulation Republican elders, Silicon Valley’s congressional critics say Biden was wise to focus on protecting children’s private data. It’s a message that resonates far and wide, even on Speaker McCarthy’s Capitol Hill.

“But this issue of targeting our children with certain messages, using technology to basically gather data and persuade or take advantage of their habits, it’s really quite unnerving in this modern era,” Cramer says. “I think a lot of us traditionalists have to struggle a little bit with our basic individualism, with some protection.”

The Political Theater Behind the State of the Union Data Privacy Push

Legal experts say a key law should already prevent brokers from collecting and selling data that's weaponized against vulnerable people.

The letter also points to databases maintained by the British multinational RELX and the Canadian conglomerate Thomson Reuters, which, according to CUNY law professor Sarah Lamdan, author of _Data Cartels: The Companies That Control and Monopolize Our Information_, contain dossiers on roughly two-thirds of the US population, tracing their whereabouts and mapping social and familial relationships. 

In 2020 alone, data brokers extracted some $29 million while vying to undermine legislative efforts to rein in their industry, according to lobbying disclosures unearthed by The Markup. 

While many major data collectors acknowledge falling under the jurisdiction of the FCRA, others have evaded regulatory scrutiny by relying on what the lawyers petitioning Chopra deem erroneous legal analysis. Other firms partition their products and the surveillant data they gather to exempt from compliance what the credit reporting industry calls “header information,” traditionally consisting of people’s names, birth dates, and Social Security numbers, in addition to phone and residential histories. This, even when that data is derived from sources clearly subject to the law. 

“Data brokers are packaging the same personal data points about us into different products for sale and then claiming that certain products are beyond the reach of key legal protections,” says Laura Rivera, an attorney with Just Futures Law. “It’s dishonest, exploitative, and it leads to real harm to consumers of all backgrounds, but especially low-income communities of color, including immigrants.”

“In advocating for coverage of data brokers, we're simply asking the CFPB to restore the scope of the Act as Congress originally intended,” adds Chi Chi Wu, a staff attorney at the National Consumer Law Center, who identified a series of constricting court rulings over the years with watering the FCRA down. 

Historically disadvantaged communities face the brunt of the harm, Wu says, pointing to the sale of information on some of America’s poorest communities to predatory “payday” lenders. In fact, data brokers derive significant profit from businesses whose whole purpose is identifying consumers who face financial instability. A 2013 US Senate report noted, for example, that these purchases were often made by companies that “sell high-cost loans and other financially risky products”—unscrupulous businesses making bread and butter out of the economically vulnerable, including widows. 

Companies playing fast and loose with personal data have drawn the ire of consumer protectionists and Capitol Hill privacy hawks for years, leading to meager gains for consumers. In 2021, a slew of utility companies that had long pilfered cable, phone, and energy customers of sensitive data for their own profit agreed to end the practice of selling it to Thomas Reuters, which had, in turn, supplied it to government agencies and police, including US Immigration and Customs Enforcement. 

“Selling personal information that people provide to sign up for power, water, and other necessities of life, and giving them no choice in the matter, is an egregious abuse of consumers’ privacy,” Senator Ron Wyden, a Democrat of Oregon and leading government-surveillance critic, said in a letter to Chopra at the time. 

The US’s Defense Intelligence Agency, Defense Counterintelligence and Security Agency, and Customs and Border Protection (CBP) are among a wide range of federal agencies known to purchase Americans' private data, including that which law enforcement agencies would normally require probable cause to obtain. The US Supreme Court ruled in 2018 that police and intelligence agencies had no right to compel businesses to turn over location data derived from cellphones and other devices without a legal warrant. 

The decision did little to stop the government from sidestepping the courts. The Justice Department, the Office of the Director of National Intelligence, the Pentagon, and hundreds if not thousands of state and local police agencies have interpreted the ruling as having placed no restrictions on their ability to simply buy location data.

How the US Can Stop Data Brokers' Worst Practices—Right Now

Biden’s speech proves that protecting personal info is no longer a fringe issue. Now, Congress just needs to do something about it.

The European Union’s General Data Protection Regulation, enacted in 2018, provides far-from-perfect data privacy protection, but it stands in stark contrast to the legislative dearth in the United States, where there are no comprehensive federal data privacy laws on the books. In his second State of the Union address, though, US President Joe Biden devoted more attention than ever to the need for such a measure. 

With political control of the US Congress now split, Biden asserted that a data privacy law could garner bipartisan support. It's an idea that has been gaining traction in recent years, and the mention of data privacy issues in Tuesday’s State of the Union sets a precedent that the topic should be of real concern to US presidents and the public.

“We must finally hold social media companies accountable for experimenting they’re doing \[on\] children for profit,” Biden said during his speech, garnering a standing ovation from members of both parties. “It’s time to pass bipartisan legislation to stop Big Tech from collecting personal data on our kids and teenagers online. Ban targeted advertising to children and impose stricter limits on the personal data that companies collect on all of us.”

Previous US presidents rarely mentioned data privacy in the State of the Union. Former president Donald Trump never mentioned the topic in any of his annual addresses. Former president Barack Obama mentioned the topic only once during the 2014 State of the Union, following revelations about the previously undisclosed scale and scope of the National Security Agency’s bulk surveillance programs. He said then: “Working with this Congress, I will reform our surveillance programs—because the vital work of our intelligence community depends on public confidence, here and abroad, that the privacy of ordinary people is not being violated.”

In his first State of the Union, in 2022, Biden talked about data privacy as it pertains to protecting children. “It’s time to strengthen privacy protections, ban targeted advertising to children, demand tech companies stop collecting personal data on our children,” he said at the time. 

Biden’s remarks this year went further, signaling a shift in mainstream understanding about the urgency of improving data privacy protection in the US. Whether the step will lead to productive action in 2023, though, is less clear. In his remarks, Biden called for cooperation among lawmakers—a dynamic lacking in both chambers on Capitol Hill. “To my Republican friends, if we could work together in the last Congress, there is no reason we can’t work together and find consensus on important things in this Congress as well,” he said. 

All parts of the US political spectrum would likely agree that the previous Congress was not exactly a shining example of a high-functioning, collaborative legislative branch. By including a mention of data privacy in the State of the Union, Biden is adding extra pressure on his administration and lawmakers to deliver on an issue that affects everyone.

Biden’s SOTU: Data Privacy Is Now a Must-Hit US State of the Union Topic

Moscow promised residents lower crime rates through an expansive smart city project. Then Vladimir Putin invaded Ukraine.

Sergey Vyborov was on his way to the Moscow Metro’s Aeroport station last September when police officers stopped him. The 49-year-old knew that taking the metro could spell trouble. During a protest against Russia’s invasion of Ukraine, police had fingerprinted and photographed him. He’d already been detained four times in 2022. But he was rushing to his daughter’s birthday, so he took a chance.

Vyborov wasn’t arrested that day, but the police informed him that he was under surveillance through Sfera, one of Moscow’s face recognition systems, for participating in unsanctioned rallies. Considered one of the most efficient surveillance systems, Sfera led to the detention of 141 people last year. “Facial recognition, and video cameras in general in a totalitarian state, are an absolute evil,” Vyborov says. 

Vyborov finds himself at the bottom of a slippery slope that privacy advocates have long warned about. Under the guise of smart city technology, authoritarian and democratic governments have rolled out huge networks of security cameras and used artificial intelligence to try to ensure there is no place to hide. Cities have touted the ability of such systems to tackle crime, manage crowds, and better respond to emergencies. Privacy campaigners say such systems could be used as tools of oppression. In Moscow, Vyborov and countless others now face that oppression on a daily basis.

The Russian capital is now the seventh\-most-surveilled city in the world. Across Russia, there are an estimated 21 million surveillance cameras, and the country ranks among the top in the world in terms of the number of connected surveillance cameras. The system created by Moscow’s government, dubbed Safe City, was touted by city officials as a way to streamline its public safety systems. In recent years, however, its 217,000 surveillance cameras, designed to catch criminals and terrorists, have been turned against protestors, political rivals, and journalists. 

“Facial recognition was supposed to be the ‘cherry on top,’ the reason why all of this was built,” says a former employee of NTechLab, one of the principal companies building Safe City’s face recognition system.

Following Russia’s invasion of Ukraine, Safe City’s data collection practices have become increasingly opaque. The project is now seen as a tool of rising digital repression as Russia wages war against Ukraine and dissenting voices within its own borders. It is an example of the danger smart city technologies pose. And for the engineers and programmers who built such systems, its transformation into a tool of oppression has led to a moment of reckoning. 

An Innocent Start

Founded in 2015, NTechLab caught the attention of the global press with the February 2016 launch of FindFace, an app that allowed anyone to identify faces by matching them with images gathered from social network VKontakte, Russia’s Facebook equivalent. Met with warnings of the “end to public anonymity,” the app was reportedly downloaded by 500,000 people within two months of its launch. But for NTechLab, it was primarily a proof of concept for its nascent face recognition algorithm.

NTechLab still felt like a startup when one former employee, who asked not to be named for privacy reasons, joined the company. And he was drawn in by the complexity of the work.

“From \[an\] engineering point of view, it’s very interesting to work with: It’s very difficult,” he says. 

After the release of FindFace, NTechLab began selling its face recognition tech to small businesses, such as shopping malls that could use it to catch shoplifters or see how many people return to certain stores. But NTechLab was also working with the Moscow Department of IT Technology (DIT), the government department tasked with building Moscow’s digital infrastructure. In 2018, when Russia hosted the FIFA World Cup, NTechLab’s face recognition tech was connected to more than 450 security cameras around Moscow, and its tech reportedly helped police detain 180 people whom the state deemed “wanted criminals.”

At its inception, Moscow’s face recognition system was fed official watchlists, like the database of wanted people. The system uses these lists to notify the police once a person on the list is detected, but law enforcement can also upload an image and search for where a person has appeared. Over the years, security and law enforcement agencies have compiled a database of the leaders of the political opposition and prominent activists, according to Sarkis Darbinyan, cofounder of digital rights group Roskomsvoboda, which has been campaigning for a suspension of the technology. It remains unclear who is in charge of adding activists and protesters to watchlists.

In March 2019, following the success of the World Cup trial—some of Russia’s “most wanted” people were arrested while trying to attend matches—the Moscow Department of Transportation, which operates the city’s metro, launched its own surveillance system, Sfera. By October 2019, 3,000 of the city’s 160,000 cameras were enabled with face recognition tech, according to interior minister Vladimir Kolokoltsev.

NTechLab was one of many companies building the slew of systems that would later be branded Safe City. International companies, from US tech firms such as Nvidia, Intel, and Broadcom to South Korea’s Samsung and Chinese camera maker Hikvision, worked alongside local firms such as HeadPoint, Netris, and Rostelecom that have developed various components of the surveillance systems. According to procurement documents cited by the UK’s BBC, three companies besides NTechLab created face recognition tech for Moscow’s growing surveillance apparatus, including Tevian, and Kipod, and VisionLabs. Moscow's Transportation Department said in social media posts that Sfera was built using VisionLabs technology, although the company downplays its involvement.

NtechLab says it operates in compliance with local laws and does not have access to customer data or camera video streams. Nvidia and Intel say they left Russia in 2022, with Nvidia adding that it does not create software or algorithms for surveillance. Broadcom and Samsung also say they stopped doing business in Russia following the invasion. VisionLabs says it only provides the Moscow Metro with its face recognition payment system. Other companies did not respond to requests for comment. The DIT and the Moscow Department of Transportation did not respond to requests for comment.

At the end of 2018, as Russia cracked down harder on political dissent online and in the streets, the DIT started to change, says a former employee who asked to remain anonymous for safety reasons. The department used to just be the “technical guys” providing assistance to security services, with the Moscow government recruiting highly paid IT specialists to make the most efficient systems possible, according to Andrey Soldatov, an investigative journalist and Russian security services expert. But according to the former employee, the DIT was beginning to reflect the Kremlin’s authoritarian bent.

Then came Covid. 

Safe City launched in 2020, at the height of the Covid-19 pandemic. Russia, like some other countries, seemingly used the pandemic as grounds to expand its surveillance systems to catch people breaking self-isolation rules. By mid-March 2020, Safe City’s face recognition system had caught 200 people breaking lockdown restrictions. At the same time, Moscow introduced a regulatory sandbox for the development of AI applications with the participation of large IT companies, exempting authorities from the country’s already lax data protection requirements. “With Covid, \[the DIT\] essentially became a part of the repressive apparatus,” says Soldatov.

In addition to its network of more than 200,000 cameras, Safe City also incorporates data from 169 information systems, managing data on citizens, public services, transportation, and nearly everything else that makes up Moscow’s infrastructure. This includes anonymized cell phone geolocation data collection, vehicle license plate recognition, data from ride-hailing services, and voice recognition devices. As Safe City was still rolling out in 2020, the Russian government announced plans to spend $1.3 billion deploying similar Safe City systems across Russia. From the outside, the potential for the system to be abused seemed obvious. But for those involved in its development, it looked like many other smart city projects. “No one expected that the country would turn into hell in two years,” says one former NTechLab employee, who asked to remain anonymous for safety reasons.

The Black Box Problem

Attempts to break open Moscow’s digital black box have been stonewalled. Alena Popova, whose image was captured during a protest against politician Leonid Eduardovich Slutsky in April 2018, filed the first lawsuit against Moscow’s DIT for allegedly violating her privacy, seeking a ban on face recognition tech. The case was thrown out, but Popova has continued to file lawsuits, including one at the European Court of Human Rights—which Russia is no longer a part of. 

While Moscow operates one of the world’s most pervasive surveillance systems, Russian law does not safeguard individual privacy. With seemingly no hope of recourse, some activists have been forced to leave Russia altogether. Popova is now on the list of foreign agents and is living in an undisclosed overseas location. “I will not apply to any political asylum in any country because I would like to go back to my own country and fight back,” she says.

A key concern is that Moscow’s surveillance system was designed to conceal its data collection from Moscow’s 12 million residents, says Sergey Ross, founder of the Collective Action Center think tank and a former Moscow politician. Although the system is run by the Moscow government, elected members of the Moscow City Duma say they are excluded from regulating face recognition systems and have little insight into how it is being used. “It’s a complete black box,” says Ross.

“It was clear that sooner or later the technology would be used to catch activists and dissenters,” says Roskomsvoboda’s Darbinyan. 

Russia made almost 20,500 political arrests in 2022, according to data from human rights media organization OVD-Info, which characterizes the number as “unprecedented.” The arrests have sparked fears that Safe City will be expanded to catch draft dodgers—although former NTechLab employees say that doing so would be technically difficult to pull it off because of too many false positives. Still, Moscow police appear to be using face recognition to aid Russia’s war efforts in other ways.

In September 2022, just after Putin announced additional mobilization for the war against Ukraine, Viktor Kapitonov, a 27-year-old activist who’d protested regularly since 2013, was stopped by two police officers after being flagged by face recognition surveillance while he approached the turnstiles in Moscow’s marble-covered Avtozavdodskaya metro station. The officers took him to the military recruitment office, where around 15 people were waiting to enlist in Putin’s newly announced draft. 

“They let me in without waiting in line as if I were some sort of VIP person,” he says. The recruiters wanted to force Kapitonov to enlist, but he ended up escaping the draft. “I explained that I am not fit, I have a disability.”

A Guilty Conscience

From 2017 to 2020, NTechLab became one of Russia’s fastest-growing companies. Other face recognition firms have cashed in as well: The revenue of Russian face recognition developers grew between 30 and 35 percent in 2022, thanks in part to deals struck in the Middle East, Southeast Asia, India, and South America. Russia’s national AI strategy has supported such firms with grants, tax exemptions, and subsidies, which have benefited both startups and state corporations, including tech and finance giant Sber, telecom provider Rostelecom, and defense firm Rostec, which previously owned a minority stake in NTechLab. While NTechLab continues to work globally, reporting a revenue increase of 35 percent in 2022, it has also faced a backlash against its work with the Russian state.

In June of last year, a “name-and-shame” list of NTechLab employees was published \[in Russian\] with information collected from social media. The project went viral, and some employees reported being harassed online. Artem Zinnatullin, a software engineer now based in the US, says he published the list after NTechLab sold its new silhouette recognition technology to the Moscow government in June 2022. To him, it signaled support for Russia’s war in Ukraine. In the post, he called NTechLab “the blacksmith of the Digital Gulag.” Zinnatullin, who says he knew people arrested with the help of face recognition technology, believes publishing the list of NTechLab employees was only fair. “You recognize people on the street, it’s only fair if we use public data to recognize who you are,” he says.

Unlike many face recognition companies that keep a low profile, NTechLab’s splash with FindFace has turned it into a recognized brand. Employees say this high profile has made them into scapegoats. 

As arrests of activists and politicians mounted, the ethics of NTechLab’s technology became a recurring topic at company meetings. NTechLab staff have resisted the use of the company’s face recognition in rallies and refused to sell the technology to the military, according to people familiar with these discussions. Still, the NTechLab leadership concluded that the technology was ultimately positive—even if the occasional dissenting voice was arrested because of it. 

“We all saw these positive examples, we saw how it really catches criminals,” says one former NTechLab employee. “Most people in NTechLab would say they were doing something very good, technologies that can help and save people’s lives. It really did.”

As Russia furthered its march toward authoritarianism in 2021, NTechLab leadership began talking about moving the company abroad, according to people familiar with internal company discussions. But with lucrative government contracts abounding—NTechLab received a $13 million investment from the Russian Direct Investment Fund, the country’s sovereign wealth fund, in September 2020—its investors resisted the idea. The company was also changing. Its founders, Alexander Kabakov and Artem Kukharenko, stepped down from NTechLab—and both left Russia in December 2021 and February 2022, respectively, declaring their anti-war stance on social media. 

Other employees left amid an exodus of IT talent from Russia. The war changed how they viewed their work. “Looking back, we realize that we shouldn’t have done it,” says an NTechLab employee. “But even in 2017 and 2018, it was a completely different country. At least, that’s how it seemed to those who weren’t very immersed in politics.”

A Growing Threat

Russia’s Safe City projects show no sign of slowing. As more surveillance systems are deployed across the country, Moscow’s DIT is planning to centralize video streams collected across all regions into its own system. And new projects to digitize public services may make it even easier for the government to eventually create large databases where everyone can be found, according to Popova. “It is really scary,” she says. “If they digitalize all the databases and combine them to make this joint database, they can find everybody.” In July, Putin signed a federal law that funnels personal biometric data collected in the country into a single system—an effort to obtain an “almost unlimited monopoly” on the collection and storage of biometrics, says Roskomsvoboda’s Darbinyan. 

In a further expansion of the Safe City project, Rostec is also reportedly developing software that will help authorities predict riots and prevent their escalation by analyzing media reports, data from social networks, video cameras, and other sources. Rostec did not respond to a request for comment on its development of these systems.

Similar systems have been developed in some Chinese cities, and Russia is now playing catch-up. “The Russian government would probably like to move toward China, but they do not yet have the necessary technology,” says Kiril Koroteev, head of international practice at the Russia-based Agora International Human Rights Group.

For now, many activists in Russia are left to do whatever they can to skirt the country’s growing surveillance apparatus, including avoiding the Moscow Metro. Kapitonov hopes that a balaclava will keep him safe, while Vyborov aims to ride the metro early in the morning, when there are fewer police around to detain him. 

“I think that it was inevitable that such a system would be made sooner or later,” says one former NTechLab employee. Face recognition is like a knife, he says: It can be used to cut food, but it can also be used to cut innocent people. He now regrets that NTechLab played a key role in building Moscow’s Safe City project. He has left Russia and doesn’t think he will work on face recognition again. “I do not want to mess with it anymore,” he says.

_Update 9:25 am ET, February 6, 2023: Clarified the role of VisionLabs in the Sfera system and that NTechLab's founders have since left the company._

Inside Safe City, Moscow’s AI Surveillance Dystopia

Plus: The FTC cracks down on GoodRx, Microsoft boots “verified” phishing scammers, researchers disclose EV charger vulnerabilities, and more.

If you heard rumblings this week that Netflix is finally cracking down on password sharing in the United States and other markets, you heard wrong—but only for now. The company told WIRED that while it plans to make an announcement in the next few weeks about limiting account sharing, nothing has happened yet. Meanwhile, lawmakers in Congress are eager to overhaul systems for dealing with secret US government data as classified documents keep turning up in the wrong places.

We did a deep dive this week into a ransomware attack that crippled the digital infrastructure of London’s Hackney Council. The assault happened more than two years ago, but it was so impactful that the local authority is still working to recover. A project that’s looking far into the future, meanwhile, is developing prototype pursuit satellites for real-world testing that could someday be used in space battles.

In other military news from the skies, we examined the situation with the apparent Chinese spy balloon over the US and the pros and cons of using balloons as espionage tools. And if you want to improve your personal digital security this weekend, we’ve got a roundup of the most important software updates to install right away, including fixes for Android and Firefox vulnerabilities.

Plus, there’s more. Each week we round up the stories we didn’t cover in-depth ourselves. Click on the headlines to read the full stories. And stay safe out there.

If you’re looking for legit software downloads by searching Google, your clicks just got riskier. The spam- and malware-tracking nonprofit Spamhaus says it has detected a “massive spike” in malware spread via Google Ads in the past two months. This includes “malvertizing” that appears to be authentic downloads of tools like Slack, Mozilla’s Thunderbird email client, and the Tor Browser. Security firm SentinelOne further identified a handful of malicious loaders spread through Google Ads, which researchers collectively dubbed MalVirt. They say MalVirt loaders are used to distribute malware like XLoader, which an attacker can use to steal data from an infected machine. Google told Ars Technica in a statement that it is aware of the malvertizing uptick. “Addressing it is a critical priority, and we are working to resolve these incidents as quickly as possible,” the company said.

The Federal Trade Commission this week issued its first-ever fine under the Health Breach Notification Rule (HBNR). Online pharmacy GoodRx was ordered to pay a $1.5 million fine for allegedly sharing its users’ medication data with third parties like Meta and Google without informing those users of the “unauthorized disclosures,” as is required under the HBNR. The FTC’s enforcement action follows investigations by Consumer Reports and Gizmodo into GoodRx’s data-sharing practices. In addition to violating the HBNR, GoodRx misrepresented its claims of HIPAA compliance, the FTC alleges. GoodRx claims it fixed the issues at the heart of the FTC’s complaint years ago and rejects any admission of guilt. “We do not agree with the FTC’s allegations and we admit no wrongdoing,” a spokesperson told Gizmodo. “Entering into the settlement allows us to avoid the time and expense of protracted litigation.” 

Microsoft this week announced that it had disabled accounts of threat actors who managed to get verified under the Microsoft Cloud Partner Program. Posing as legitimate businesses, the threat actors used their verified account status to create malicious OAuth applications. “The applications created by these fraudulent actors were then used in a consent phishing campaign, which tricked users into granting permissions to the fraudulent apps,” Microsoft said in a blog detailing the issue. “This phishing campaign targeted a subset of customers primarily based in the UK and Ireland.” The company says the people behind the phishing attacks likely used their access to steal emails and that it has notified all victims.

Researchers at the security firm Saiflow this week exposed two vulnerabilities in versions of the open source protocol used in the operation of many electric-vehicle charging stations, called the Open Charge Point Protocol (OCPP). By exploiting vulnerable instances of the OCPP standard, which is used to communicate between chargers and management software, an attacker could take over a charger, disable groups of chargers, or siphon off electricity from a charger for their own use. Saiflow says it’s working with EV charger companies to mitigate the risks of the vulnerabilities.

The 37 million customers exposed by the most recent T-Mobile hack may not be the only people impacted by the breach. Google this week informed customers of the Google Fi mobile service that hackers had obtained “limited” account information, including phone numbers, SIM serial numbers, and information about their accounts. The hackers did not access payment information, passwords, or the contents of communications, like text messages. Still, it’s possible the information could have been used for SIM swap attacks. TechCrunch reports that the intrusion was detected by Google Fi’s “primary network provider,” which noticed “suspicious activity relating to a third-party support system.” The timing of the hack, which comes two weeks after the latest T-Mobile breach, suggests the two are related.

Googling for Software Downloads Is Extra Risky Right Now

A popular military tool during the Cold War, spy balloons have since fallen out of favor—for good reason.

On Friday, United States secretary of state Antony Blinken said he was canceling a high-profile diplomatic visit to Beijing following the discovery of a large, high-altitude Chinese balloon that has been drifting over the US this week. The Chinese Ministry of Foreign Affairs said in a statement on Friday that the airship is an off-course weather balloon and has denied that it is an espionage tool. A senior US Department of Defense official told reporters on Thursday, though, that “clearly the intent of this balloon is for surveillance.”

Spy balloons are a historic technology and were widely utilized before the development of low-Earth and geosynchronous satellites, including extensive use in the 1950s by the US during the Cold War. But these days, their use has largely fallen out of favor. Spy balloons have some advantages over satellites. They are cheap to deploy, fly relatively close to their targets, and can continuously monitor a location for longer stints. But balloons have weight restrictions, which also limit how powerful and diverse their onboard sensors can be. And unlike satellites, which are out of sight and out of mind for people on Earth, the situation currently playing out with the Chinese balloon illustrates the biggest limitation of surveillance balloons. 

“You may have noticed that this balloon has caused a massive international incident, and it’s got everyone looking at China and demanding that the US government do something. In terms of surveillance, this is the kind of attention you don't want,” says Brynn Tannehill, a RAND Corporation senior technical analyst and a former naval aviator. “My assessment is that the advantages a balloon offers versus the amount of unwanted attention it creates—I can't answer why the Chinese did this. It attracts ill will.”

Sensor-equipped balloons have onboard steering capabilities but are transported by wind currents. US officials said on Thursday that the spy balloon was floating above commercial air traffic at roughly 60,000 feet and that it does not pose a threat to people or activity on the ground. The senior DOD official noted that the balloon is big enough to cause a potentially dangerous debris field if the US shot down the balloon over an inhabited area. The official added that the military considered taking kinetic action on Wednesday while the balloon was moving over “sparsely populated areas in Montana,” but concluded that the risks weren't low enough. RAND's Tannehill points out that an additional risk of such an operation is that the missile aimed at the balloon will miss “and now you’ve created an even bigger problem,” she says.

Brigadier General Pat Ryder, the Pentagon press secretary, said on Thursday that, "instances of this kind of balloon activity have been observed previously over the past several years. Once the balloon was detected, the US government acted immediately to protect against the collection of sensitive information."

Reports increasingly indicate that the vehicle is part of a broader Chinese spy balloon initiative, and the senior DoD official said of spy balloon US flyovers on Thursday that “it has happened a handful of other times over the past few years, to include before this administration.” The current incident has apparently been the most visible to the US public, though.

Consistently deploying spy balloons is a strategy that the US and other countries may not be fully prepared to counter given that balloons have been less popular as espionage tools in recent decades. The senior Defense Department official said on Thursday, though, “We assess that this balloon has limited additive value from an intelligence-collection perspective” versus what China could get from satellite imagery. Still, the balloon has flown near a few US military bases and other sensitive sites. 

Tannehill says that countersurveillance measures for spy balloons would typically include physically moving equipment or personnel out of sight, rearranging equipment, and if possible, jamming the balloon's sensors.

The Defense Department declined WIRED's request to elaborate on the steps it took to prevent espionage activities.

“The fact is we know that it's a surveillance balloon, and I'm not going to be able to be more specific than that,” Brigadier General Pat Ryder said in additional remarks to reporters on Friday. “And we do know that the balloon has violated US airspace and international law, which is unacceptable. And so we've conveyed this directly to the PRC at multiple levels.” 

The Chinese Ministry of Foreign affairs said of the balloon: “The Chinese side regrets the unintended entry of the airship into US airspace due to force majeure. The Chinese side will continue communicating with the US side and properly handle this unexpected situation.”

But even with this concession, the extremely public nature of the incident can only exacerbate tensions between the US and China. As RAND's Tannehill puts it, “It’s tough to pretend the spying isn’t happening when it’s floating over Kansas City and regular people are like, ‘Oh look, it’s the Chinese spy balloon.’”

The Chinese Spy Balloon Shows the Downsides of Spy Balloons

As unsecured docs pile up, a bipartisan group of lawmakers is itching to overhaul the nation’s secret secret-sharing operation.

The fear and trepidation over accidentally letting a secret slip is also hammered into lawmakers’ intelligence staffers, who handle the classified material as further protection against absent-minded members of Congress. To get a security clearance, these staffers undergo purposefully intimidating, invasive, and multi-stepped background checks conducted by either the Pentagon or FBI, and sometimes both. Even after being cleared, new hires are forbidden to start until they sign a nondisclosure agreement—effectively sealing their lips for life. 

“Only certain staffers are allowed to possess classified information in the Capitol. Usually, they keep it in our Intelligence Committee, and they walk around with a locked bag that has them in them,” says Rubio, the vice chair of the Senate Intelligence Committee. “So you can’t make a photocopy and send it to you as an attachment in email.”

When it comes to viewing America’s secrets, even leaders at the Capitol don’t get special access. “They would bring them in. I would read them. They take them out. So they couldn’t even stay on my desk,” says Durbin. “I can’t understand why the executive branch has such a lax approach to this that we have three major elected officials with these documents in their possession and not explaining why.”

Other committees can request to see classified materials in the Intelligence Committee’s possession. If the request is approved by the select panel, the materials are ferried—under lock and key—to other lawmakers with a stern warning: “Such material shall be accompanied by a verbal or written notice to the recipients advising of their responsibility to protect such materials.” Each night, sensitive materials must be returned to a secure SCIF. A written record of the secret’s travels is required.

That’s why the confusion at the Capitol is so bipartisan these days: How does one misplace such a sensitive document? Let alone batches of them?  

“I don’t know how you actually do that. That’s the question, but we're talking about the president and vice president, and that’s a little different,” says Republican senator Lyndsey Graham of South Carolina, the top Republican on the Judiciary Committee. “I don’t know. I don’t know.”

Restrictions are so tight that Rubio doesn’t even believe news stories claiming classified documents were found dating back to Biden’s Senate days. He calls those reports “puzzling.”

“I’ve heard that in the media. It has never been confirmed to me … that one would be bizarre,” Rubio says. “So, frankly, I don’t know, on the Senate piece, how that could be possible.”

The other perplexing thing is, the technology employed at the Capitol is widespread in Washington, especially the secure rooms used to protect the materials. “The Situation Room is a SCIF. There’s SCIFs in the military. There’s SCIFs in the FBI,” says Representative Mike Quigley of Illinois. “I can’t explain—there’s no excuse for it. There’s no excuse for mishandling documents ever.”

A Democrat who teaches a course at the University of Chicago called “Contemporary US Intelligence,” Quigley says the scandal reveals a cavalier attitude in the executive branch that’s unacceptable. As Quigley points out, classified materials are securely handled by agencies all around the US, far beyond the Beltway. The FBI shares sensitive intel with local police departments from coast to coast. Classified documents are also housed in some academic institutions. And Quigley says some documents are shared with the private sector, like military contractors. In short, this appears to be an executive branch problem, and he wants Congress to be bullish as it moves to rein in the White House’s willy-nilly handling of classified materials.

“Of course we have to because we’re the ones who do laws and allow people to have classified information,” Quigley says.

The numerous security procedures at the Capitol are in place to keep lawmakers from doing exactly what Biden, Trump, and Pence did. It seems to be working. “There’s a reason we have classification,” Warner told reporters at the Capitol. “Maybe we overclassify, but unless the rules change, you’ve got to.”

Warner says his committee’s job is now to make sure what’s working at the Capitol is replicated in the executive branch. “We got a broken system,” Warner said, “and we got to fix this.”

Source

Wired