The Infowars host now knows the cost of “free speech”—but does the landmark judgment signal a crackdown on disinformation?

Anyone could have seen the blow coming. What the world didn’t expect was quite how much Alex Jones would have to pay for weaponizing disinformation and piling misery onto the Sandy Hook families as they mourned their lost loved ones. 

Jones was found liable for defaming the parents of children killed at Sandy Hook Elementary almost a year ago, in November 2021, when Connecticut judge Barbara Bellis issued a default judgment against the world’s most notorious shock jock and conspiracy theorist. In reality, most knew Jones had crossed a line after he floated the idea that the 2012 mass murder of 20 children, six educators, and the attacker’s mother was a “government operation” while speaking on an Infowars broadcast in April 2013. It would be the first of many times he repeated the lie. Yesterday, the Connecticut jury decided it would cost him everything.

Decisions against Jones in Texas and Connecticut courts add up to $1.014 billion in damages to the families of Sandy Hook victims and an FBI agent who responded to the shooting at the elementary school in Newtown, Connecticut—with attorney fees to be added to that total in a month. Jones is rapidly learning the cost of “free speech” that allowed him to warp reality in a web of lies—and it’s a staggering sum. But there may also be lessons for the platforms that for years enabled Jones’ rise—and potential consequences for them too.

“By any standard, this is an enormous jury award in a defamation case,” says Lyrissa Lidsky, a US constitutional law scholar at the University of Florida Law School. “It seems to reflect the jury’s outrage over Jones’ behavior in profiting from lies about murdered children.”

The judgment also sends a message to anyone thinking of deliberately deploying disinformation to disrupt people’s lives for financial gain: Think twice—or risk being hit with a similarly large damages payment. “There has to be some message sent here to people like him that this is simply not acceptable in a civilized society,” says Stephen D. Solomon, a journalism professor at New York University and the founding editor of online news and educational resource site First Amendment Watch.

The jury that decided Jones’ level of financial punishment certainly seems to have taken to heart the words of Christopher Mattei, a lawyer representing the Sandy Hook families in Connecticut. “It is your job to make sure he understands the extent of the wreckage that he caused,” Mattei said in his closing argument, “because you know damn well he doesn’t get it.”

This decision could mark the end of a decade of users spreading disinformation on social media with few consequences, as platforms were reluctant to step in and censure them.

It took more than five years for Facebook, Twitter, YouTube, Apple, and Spotify to ban Jones for spreading wild conspiracy theories to his audience of millions. One report at the time covered social media’s inaction as “a timeline of vacillation.” By the time platforms acted, Jones had already built Infowars into an alternative media powerhouse, and his army of adherents was prepared to follow him to fringe social media platforms. Court documents surfaced in a concurrent trial in Texas showed that at his peak in 2018, Jones was making $800,000 a day from his Infowars acolytes, and at one point he paid himself $6 million a year. That cash was—of course—built on falsehoods and enabled by social media platforms that turned a blind eye because it brought them their most prized metric: attention. Jones put a particular focus on the families of Sandy Hook victims, claiming without any evidence or credibility that their children were crisis actors and the losses were not real. Jones turned his mass audience against them in perpetual campaigns of harassment that denied their children’s existence, even as they tried to grieve their losses.

The amount awarded to Sandy Hook families has already spooked those who see the decision as an attempt to silence someone simply because they disagree with the individual’s views. In the immediate aftermath of the decision, US representative Marjorie Taylor Greene warned that the ruling was “political persecution.” “Were his words wrong and did he apologize? Yes,” Greene tweeted. “That’s what freedom of speech is. Freedom to speak words.” Meanwhile, Jack Posobiec, an alt-right conspiracist, asked his followers on Truth Social: “How much money can we get awarded for suing every media figure who said the vaccine would stop transmission?” Underneath the bombast and false threat to weaponize the US legal system is a telling truth: Jones’ defenders recognize that such judgments can bring people to heel in a way platform bans can’t.

Those who fear the erosion of First Amendment rights may be misguided. “The United States provides robust protection for freedom of expression,” says Joseph A. Tomain, senior lecturer at the Maurer School of Law at Indiana University. “That robust protection is critical for a functional self-governing democracy. At the same time, that robust protection is not absolute, and this case demonstrates the limits of free speech under US law. For the vast majority of speakers, I do not see this case as a harbinger of things to come or something that is going to result in self-censorship to avoid legal risk.”

Ken Paulson, director of the Free Speech Center at Middle Tennessee State University, also believes that the decision won’t have the detrimental impact on free speech some fear, but he says the outsized value of the damages in the case is meant to make a point. “I’ve monitored libel cases for 40 years, and I’m not sure I’ve ever seen a less sympathetic defendant,” he says. “What he did was just despicable, and at a level that would be hard to rival. The jury is just conveying its utter disgust and anger and attaching a really big number like a billion dollars to their outrage.” Yet Paulson does believe something has changed post-judgment—not least because of the ongoing debate around the future of Section 230 of the Communications Decency Act, the shield that protects social media platforms from liability for content their users post. The Supreme Court is scheduled to hear two cases that could rewrite Section 230’s power, potentially leaving platforms liable for such content.

“If there were no Section 230, this would send a massive chill through every online organization in the US that hosts comments of any sort,” Paulson says. It would signal a huge shift in platforms’ approach to policing the content posted on their sites, in large part because they’d want to avoid a massive financial punishment of the type Jones has just been walloped with. “For various reasons, including legal risk and a platform’s own standards regardless of legal risk, companies will continue to engage in content moderation,” says Indiana University’s Tomain. “At the same time, individuals will continue to seek redress in courts when they believe that the law provides a remedy based on the speech of others.”

“Large platforms have an important role to play in not giving extra oxygen to false claims that cause concrete injuries,” says Mathias Vermeulen, a disinformation expert and director of AWO, a digital rights agency. “Some of them have taken good steps to prevent such claims from being monetized on their platforms. But that never has been a real deterrent for mass-disinformation producers like Jones, who continued to thrive financially even when they were banned from these platforms.”

Now the billion-dollar judgment sets a precedent that not only can cases be won, but those who are found liable could be on the hook for monumental damages. “The lesson that anyone should take away from this is that if you use your freedom of speech to defame or to engage in fraud, you will face consequences,” says Paulson.

This could mark a sea change in how people speak on social media. For decades, shock jocks and conspiracy quacks wanted to be the next Alex Jones, rich atop a sea of true believers. Now his name is permanently associated with that landmark financial figure—one that stands to ruin him. No one will aspire to that. “Some speakers seem to be under a false impression that defamation law doesn’t apply to social media and that they can say anything they want without consequence,” says the University of Florida’s Lidsky. “This damages award is a corrective to that false impression.”

The $1 Billion Alex Jones Effect

By releasing half a million users’ transactions in a bankruptcy court filing, the company has opened a vast breach in its users’ financial privacy.

The paradoxical nature of cryptocurrency's privacy is that the blockchain, that unchangeable ledger of all a cryptocurrency's transactions, serves as both a map and a mask: Bitcoin are easy enough to follow from one address to the next. But only a few entities, like the cryptocurrency exchanges that allow users to trade their crypto for traditional currency, are able to match the inscrutable strings of numbers and letters in those addresses to real-world identities. So when one of those exchanges suddenly dumps a massive internal user database online, they haven't just spilled their own data. They've offered a key to decipher a vastly larger set of financial secrets.

That's what happened last week when Celsius, a cryptocurrency exchange facing bankruptcy, leaked an enormous collection of its users' transaction data through an unusual sort of privacy breach: a court filing. As part of its bankruptcy proceedings—in which the company's owners are accused of pulling tens of millions of dollars worth of crypto out of the exchange before revealing its insolvency—the company's attorneys released a document that appears to include the transaction data of half a million of its users from April of this year until it ceased trading in June. That database was briefly posted as a 14,500-page PDF to the court records website PACER before being taken down—but not before Gizmodo copied it to the Internet Archive, where it was widely downloaded before being removed there, too.

The data dump includes the names and transaction details of Celsius' users along with the dates and amounts of each payment. The database doesn't include the cryptocurrency addresses that directly identify senders and recipients on cryptocurrencies' blockchains, but the unique payment amounts, detailed down to more than a dozen decimal places of precision in many cases, nonetheless make it possible to match the payments to blockchains' records.

All of that means that the Celsius leak offers a rare gift to both professional and amateur cryptocurrency tracers, allowing them to not only see Celsius users' transactions, but also identify and trace those users' funds across the blockchains. That could potentially open new possibilities to identify scammers, hackers, or any other illicit users who might have exploited Celsius as a cash-out service for ill-gotten coins. But it also opens Celsius' users to exploitation by any rip-off artist or thief who combs through the data, connects it to other accounts, and identifies their cryptocurrency holdings as a ripe target.

"This is really one of the worst exchange data breaches since Mt. Gox," says Nick Bax, head of research at security consultancy and asset recovery firm Convex Labs. But even as he compares the Celsius leak to the disastrous breach of the early Bitcoin exchange Mt. Gox, which was bankrupted by hackers in 2014 and had its transaction database leaked online, he also calls it a "dream come true for analysts" focused on cryptocurrency tracing.

“You can find someone’s balance, deposits, and withdrawals and then correlate all that to the blockchain,” Bax says. “We can use it for good, but it can absolutely be misused too. Criminals are going through this right now, looking for whoever has the biggest balances.” Once they’re identified, Bax warns, those wealthy crypto holders could be targeted with spear-phishing, scams, and even physical extortion.

Cryptocurrency tracers in law enforcement, government regulators, and private firms are no doubt already following flows of funds to and from Celsius, scouring it for leads in their own research. "This is data we'll ingest, analyze, and have available as part of our investigations, and I suspect others will too," says Matt Edman, cofounder of the security startup Naxo. Edman previously worked as an FBI contractor at the Mitre Corporation, where he helped trace cryptocurrency in the criminal case of Ross Ulbricht, the creator of the Silk Road dark web market.

"When it comes to cryptocurrency tracing, following the flow of funds is not really the hard part," Edman adds. "The tricky part in those investigations is the attribution—associating an address or transaction with an individual. That's where datasets like this are key."

Celsius didn't respond to WIRED's request for comment.

In just the days following Celsius' disclosure of the database in court records, internet sleuths have already begun posting findings from the data. One well-known independent cryptocurrency tracer, who goes by the Twitter handle ZachXBT, posted evidence from the leak that a Celsius user and influencer named Lark Davis had promoted Celsius after pulling his own $2.5 million worth of crypto out of the exchange. (Davis didn't immediately respond to WIRED's request for comment.) The website Celsiusnetworth.com already claims to allow anyone to search the data for individuals' holdings at the exchange.

Meanwhile, a cryptocurrency tracer and developer for decentralized finance firm Viper Labs, who goes by the name Federico Notte, converted the PDF from Celsius' court filing into a spreadsheet and posted a link to his public Twitter account. He tells WIRED he hopes to use the database in combination with blockchain analysis to figure out the transactions of major trading funds, in hopes of learning their tactics. "It's something you can definitely do," says Notte. "It's also a major privacy concern for these people, too."

But even as legitimate analysts and investigators dig into the data, some cryptocurrency tracers emphasize that it will be of far more value to criminals. "The amount of private information is quite scary, really," says Thibaud Madelin, who leads research at cryptocurrency-tracing firm Elliptic. "Scammers will be scouting this list, and they’ll know how much people have spent, how much they’ve lost, how much they hope to make back."

"They’re ruthless," Madelin adds, referring to scammers. "And this will give them thousands of opportunities."

Celsius Exchange Data Dump Is a Gift to Crypto Sleuths—and Thieves

The company says it hardened the security of its new flagship phones—and plans to release a built-in Android VPN.

When Google launched its flagship Pixel 6 and 6 Pro smartphones last year, the company touted its Tensor “system on a chip” and dedicated Titan M2 security chip as being designed to underpin a new generation of security and privacy features. Now, as it releases Pixel 7 and 7 Pro, the company said on Tuesday that it is building on that foundation with the new Tensor G2 processor, expanded independent security certifications for Titan M2, and software features like an upcoming built-in Android VPN to protect user privacy while maintaining performance.

Google spent three years subjecting Titan M2 to testing by the third-party lab SGS Brightsight. The chip now has an array of Common Criteria hardware security certifications, the same process that smartcards, SIM cards, and bank card chips go through. Titan M2 passed the highest hardware vulnerability assessment, meaning that it is highly resistant to physical attacks, an area that has been increasingly important to chip makers in recent years.

“This testing emulates the sophistication of state-sponsored attacks, someone who’s got almost unlimited resources and determination,” says Dave Kleidermacher, vice president of engineering for Android security and privacy. “At Google and for Pixel, we talk a lot about the exploit cost. Nothing is ever perfect—there are going to be vulnerabilities and exploits—but we want to always continually raise the cost to the attacker.”

With Pixel 7 and 7 Pro, Google is continuing to expand its efforts on what the company calls Protected Computing. The goal is to restrict how and when user data can be accessed, de-identify and anonymize data when it must be used, minimize the amount of identifying data that is generally produced about a user, and keep as much processing out of the cloud and on users’ devices as possible. On Pixel devices, Google has control of both hardware and software, which the company says allows it to plan strategically and maximize security and performance rather than having to make tradeoffs.

Though the privacy and security benefits of VPNs are somewhat debated for the average user, VPN by Google One will be released as a built-in service for Pixel 7 and 7 Pro by the end of this year for users who want to encrypt their network traffic and shield their IP address from mobile networks and internet providers. Google points out that, historically, users who wanted to add a VPN on mobile needed to download a third-party option instead of having an optimized and integrated service.

VPN by Google One is open source and aims to address some classic concerns about VPNs by separating authentication and key management for encryption onto distinct servers that can't access each other. In essence, the service is set up to blind itself such that even a rogue insider would not be able to determine who you are and what your browsing history is by compromising the service. Google also says that it does not log user browsing data, though the company says it does record some anonymized, aggregate metrics. In addition to publishing a breakdown of how the service works, Google also commissioned and published an independent audit from NCC Group on VPN by Google One’s security. 

“We’re investing quite a lot in making sure we have extensive first-party and third-party audits, reviews, certification, and analysis to see that we really are providing verifiable security and privacy guarantees,” says Jesse Seed, Google’s product manager lead for silicon security.

Just as Pixel 7 and 7 Pro have logged mostly incremental improvements in their feature sets, the security and privacy changes aren’t revolutionary. But Kleidermacher and Seed emphasize that the changes this year are hard-won—and with so many digital threats to contend with, both for high-risk targets and regular users, every little bit counts.

Google’s Pixel 7 and Pixel 7 Pro Pack New Android VPN and Tensor G2, Titan M2 Chips

The latest September 2022 version 22H2 update for Windows 11 includes a new feature designed to keep you even safer than before from phishing attacks: the practice of bad actors attempting to get you to reveal your usernames and passwords so they can log in rather than break in to your accounts.

These sneaky deceptions are usually carried out over email, but they don't always have to be. Requests for your login details—made up to look like they're from genuine, respected sources—can also arrive over instant messengers, social media platforms, and SMS texts (which is then known as smishing rather than phishing).

The new protections don't need much in the way of setup or configuration—the idea is they just work when required. It's still important to be aware of how they work, and how they keep you safe.

How Phishing Works

Phishing attacks often arrive over email.

Photograph: Silas Stein/Getty Images

Phishing has been going on for a long, long time and takes many different forms. What phishing scams all have in common, however, is that they try to get you to part with your username and password details for a particular account. This is typically done through some smart subterfuge to make it look as though you're dealing with someone credible (at your bank, on a social media platform, or at your work) rather than a hacker.

For example, you might get an email that looks as though it's from your credit card company and asks for changes to be made to your account: It would redirect you to a scam website mocked up to look authentic. Once you innocently log in with your normal details, they're then in the hands of the phishers.

Or you might get an email purporting to be from your boss in the office several floors above you. It could ask you to log in to a particular company website (which again would be a fraudulent copy of the actual site), for instance, or it might ask you to simply email over a list of usernames and passwords as a matter of urgency.

Phishing attacks shape-shift to maximize their chances of success: They typically contain warnings and often put a time limit on responses (giving you less time to think about what you're doing.) Recent scams focusing on the coronavirus pandemic involved emails that hid malevolent purposes behind health and safety information.

Many phishing attempts are cleverly done and difficult to spot, but by taking your time and being cautious about any kind of digital communication that comes your way, you can usually steer clear of them—if something seems suspect, then it probably is. We've written more about staying safe in our guide to avoiding phishing scams.

Enhanced Phishing Protection

You'll see warnings like this from the new enhanced phishing protection.

Screenshot: Microsoft

One way to stay safe against phishing attacks is to keep your computer's software—from the operating system to your web browser—up to date. Modern-day applications are built with security in mind and should throw up warnings when the majority of phishing attacks are detected.

This brings us to the enhanced phishing protection now available in Windows 11. As we mentioned above, a lot of it works in the background: Whenever you enter a password into any application or website, Windows will check whether or not there's a secure connection to a trusted place on the web receiving that information.

If not—if your username and password data have been sent somewhere unknown and potentially untrustworthy—you'll see a message onscreen advising you to change your password to something different. The idea is that you'll be able to modify your login credentials before anyone has been able to exploit them.

That's not all. The new enhanced phishing protection built into Windows will also keep an eye on passwords that you use for programs and websites and warn you if any of them match the password you also use to sign into Windows: Keeping each of your passwords separate and unique is important for keeping your accounts safe.

As you might already know, you can also ditch the password for your Microsoft and Windows accounts and use a prompt on your phone to log in instead. This is an option that's becoming increasingly popular—while it's not 100 percent perfect (no security solution is), it's theoretically harder for someone to physically steal your phone off you than it is to steal a password through phishing.

Windows 11 Now Offers Automatic Phishing Protection

Colleges and K-12 campuses increasingly monitor student emails, social media, and more. Here’s how to secure your (or your child’s) privacy.

There are more eyes on students today than just a teacher’s watchful gaze. Thousands of school districts use monitoring software that can track students’ online searches, scan their emails, and in some cases, send alerts of perceived threats to law enforcement. A recent investigation by _The Dallas Morning News_ revealed that colleges have been using an AI social-media-monitoring tool to surveil student protesters.

While technology companies claim to be able to prevent violence, there’s little proof that surveillance can actually protect students. Meanwhile, monitoring software has been used to eveal students' sexuality without their consent. Low-income, Black, and Hispanic students are also disproportionately exposed to surveillance and discipline.

If your school (or your child’s school) uses monitoring software, there are a couple of steps you can take to protect your privacy—and start a conversation with your school.

Ask Your School These Questions

It’s important first to understand why your school is using monitoring software in the first place. In the US, schools _are_ required by the Children’s Internet Protection Act to have some kind of web filtering in place to prevent students from accessing obscene or harmful material online. Schools are _not_ required to implement sophisticated technologies that can scan the content of students’ emails and send alerts to police.

Next, find out your specific school’s exact monitoring practices. “A lot of these student activity monitoring tools are different. You don’t actually know the full scope of what it is until you’re able to have a conversation with someone,” says Marika Pfefferkorn, cofounder of the Twin Cities Innovation Alliance and executive director of the Midwest Center for School Transformation. Pfefferkorn also helps to lead the No Data About Us Without Us Institute, where she works to educate parents and students about data, privacy, and equity issues in their school district.

She suggests starting with a trusted teacher or counselor. If they don’t know specifics, or don’t have any documentation to answer your questions, that can be a red flag—and an indication that you may need to approach school or district leadership.

Here are some questions you can ask:

*   What software is being used? Does it operate on school devices, over the school Wi-Fi network, or both?
*   If it’s student monitoring software, what kind of information does the algorithm scan for? If the algorithm detects a “threat” or “inappropriate content,” who does the alert go to? At what point does content get flagged to a third party, such as law enforcement?
*   How is student data secured?
*   Where can students and parents report violations of privacy in the district? What processes does the district have to repair harm?
*   How much of the budget is used for surveillance technology?

Pfefferkorn also encourages asking your school to perform an audit of its monitoring software, which could reveal what kind of content the algorithm is tracking and how. An audit might reveal whether the software is truly effective or is picking up on false alarms. Encourage your school to document and inform parents of exactly what they track, how they store, and when they delete student data. Ask if you can have your child’s data deleted, or at least see what has been collected.

Act Like You’re Being Watched, Even After School

Whether you’re using your phone on your school’s Wi-Fi, or you’re using a school laptop at home, assume that everything you do is being scanned and logged by monitoring software. Did you plug in your personal phone to your school laptop? The photos on your phone might be scanned too.  Nude photos sent from students’ personal phones, if plugged into school devices to charge, have triggered alerts to school administrators.

“You should assume that anything touching your school-issued device is going to be monitored in some way,” says Jason Kelley, associate director of digital strategy at the nonprofit Electronic Frontier Foundation. Monitoring doesn’t stop after school or off-campus either.

If you’re a student, practice the basics of digital privacy. Don’t use your school laptop or Wi-Fi to search for anything sensitive, such as medical information. Remember that any kind of data or content on a school communications platform can be scanned and flagged: your school email address, the documents you type into your school Google Drive, your online searches, the images you download, the videos you watch. Even content that is completely safe might be flagged by the algorithm: For example, the software Gaggle can flag keywords related to LGBTQ identity such as ”gay” and “queer” as instances of bullying.

Even if you trust a handful of teachers or counselors, remember that your activity could be seen by other adults in the school, or even law enforcement. Don’t do anything on your device that you wouldn’t want them to see as well.

Others might advise students to “just use your personal device, on your family’s personal network.” It’s important to note that this kind of guidance isn’t accessible to all students. For low-income students, who might rely more on school technology, it may be more difficult to sidestep a school’s surveillance structures.

Mind Your Social Media

Schools might also use AI tools to track social media posts. This is particularly relevant for college students. While colleges generally don’t use content monitoring software, it’s likely they’ll monitor students’ social media for potential risk of violence or protest.

Just as you would assume that anything you type on your school-issued device can be seen and scanned by an algorithm, assume that your public social profiles can be, too. Even private accounts aren’t completely safe, says Kelley. (Yes, even your super-locked-down Finsta.) If you comment on a public account, for example, that might be scanned and subjected to social-media-monitoring algorithms as well.

If you’re in doubt, send text messages rather than using a social media platform. You might consider using an encrypted messaging app like Signal. If you’re discussing topics that might be more sensitive (such as reproductive rights access), the safest way to communicate is with a trusted person, in person.

Team Up With Other Students and Parents

After gathering your research, you might feel that your school isn’t using monitoring software fairly or appropriately. Pfefferkorn recommends having conversations with other students and parents. Listen to what they’re experiencing and how they’re thinking through it, especially if you want to push back against your school’s use of monitoring software.

If you feel you need legal support, reach out to a local agency. Pfefferkorn recommends your local ACLU, NAACP, or Restore the Fourth as good options for advocacy assistance.

Your school’s response will depend on whether you go to a public or private school. For example, a public school might be required to disclose more information, for example, about how much it spends on monitoring software. A private school would not be obliged to give that same information. As another example, while public schools must abide by the recent ruling that room-scanning proctoring software is unconstitutional, private schools do not.

Now is a critical moment for students, parents, and communities to help shape the future of safety in schools, according to Pfefferkorn. Congress passed a law that directs $300 million for schools to strengthen security infrastructure, in addition to the funding to schools through the American Rescue Plan. She hopes that communities can be more involved in how schools invest that funding, and can help shape more proactive solutions. “It’s really critical right now for us to prioritize our values as a community of what safety means,” she says. “For me, safety is not being surveilled.”

How to Protect Yourself If Your School Uses Surveillance Tech

Plus: The US warns of a mysterious military contractor breach, a "poisoned" version of the Tor Browser is tracking Chinese users, and more.

As A Swatting spree spreads across the US, in which false reports of active shooters send police charging into schools, WIRED investigated more than 90 of the incidents and found potential connections between many of them. “In speaking to a number of people who experienced it, I can tell you that the anxiety and fear—it was real to them for 15 minutes,” Amanda Klinger, director of programs and cofounder of the Educator’s School Safety Network, told WIRED. “There’s a period of time in these incidents where people are literally running for their lives, law enforcement is responding with their weapons, and people think it's the real thing.”

Even after extensive sanctions meant to isolate Russia from the global economy amidst its ongoing war with Ukraine, investigators around the world are working to curb the ongoing influx of capital to Russian military and paramilitary groups. Former Uber executive Joe Sullivan was convicted this week of obstructing a Federal Trade Commission investigation and failure to report a felony, a development that is being watched closely by the tech industry because it is likely the first time a corporate executive has faced criminal charges related to a data breach. The Biden administration's new executive order addressing privacy seems like more of a Band-Aid than a panacea, as it attempts to reassure Europeans that their data is safe when stored in the US, despite government surveillance. 

Meanwhile, Meta released findings on more than 400 malicious Android and iOS apps that it says were harvesting Facebook credentials to take over users' accounts. And we took a look at the toll of living your life online, the potential erosion of privacy that comes with consistent social media posting, and the ways it can impact your sense of self. 

Plus, there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

Another day, another massive hack in the cryptocurrency industry. But this one is strange.

Binance revealed Friday that unidentified hackers managed to exploit a flaw in the company's BNB Chain crypto token, allowing them to mint 2 million of the company’s decentralized tokens worth a total of $569 million. That money wasn’t actually stolen from Binance, in other words, but rather fabricated out of thin air thanks to a flaw in the security of Binance’s cryptocurrency. But the hack nonetheless seemed poised to flood the market with BNB and thus reduce its value for legitimate owners, while allowing the hackers to walk away with half a billion dollars.

Unfortunately for those hackers, even they didn’t seem prepared for their sudden windfall. Cryptocurrency-tracing firm Elliptic found that they quickly traded away some fraction of their tokens for a variety of other cryptocurrencies. That allowed them to obtain about $53 million in Ethereum-based tokens. But other cryptocurrencies that they traded their BNB for, like Tether and USDC, are more centrally controlled, allowing the funds to be frozen. Binance, meanwhile, managed to temporarily shut down its BNB blockchain to prevent the hackers’ newly mined currency from moving further. “So we have a very sophisticated exploit, managing to mint yourself $569 million,” says Elliptic research lead Thibaud Madelin. “But what followed was a complete shambles, to be honest.”

In the end, Elliptic believes the hackers kept hold of less than 10 percent of their loot—not bad for a day’s work but little more than a blip in the wild world of digital money.

A joint advisory from the Cybersecurity and Infrastructure Security Agency, the FBI, and the NSA warned that the network of an unnamed military agency or contractor had been breached by a so-called “advanced persistent threat” hacker group, an industry code phrase for state-sponsored hackers. According to the alert, the spies maintained their access inside the network for around 10 months, penetrating a Microsoft Exchange server where they installed a commonly used backdoor known as China Chopper. The hackers also used a tool called Impacket to move from machine to machine and another tool called CovalentStealer to siphon data from their targets. As is often the case with government alerts, the advisory didn't attribute the breach to any particular country's government, nor even a known hacker group. The eagle-eyed (or vulture-eyed) Register spotted that the advisory initially included a box at the top suggesting organizations “protect against Russian-state sponsored malicious cyber activity,” which was later deleted. But others, like cybersecurity firm AttackIQ, point to Chinese calling cards in the intrusion.

Since early this year, hackers have been distributing a tainted version of the Tor Browser that collects personal data about Chinese users including form data they submit, browsing history, location data, and computer name, according to security firm Kaspersky. The Tor Browser is meant to be an anonymity-focused tool that is often used in countries like China where users are seeking to circumvent government-imposed internet restrictions, tracking, and censorship. Kaspersky found that the attackers advertised the malicious app by including a link to download it in a video posted to a popular Chinese-language YouTube channel. The video has more than 64,000 views. The installer for the malicious browser includes a compromised version of Tor that siphons victim data and sends it to attackers.

Isabela Fernandes, executive director of the nonprofit Tor Project, told CyberScoop that there is now a patch available. “Basically this ‘poisoned’ Tor Browser modifies the update URL so it cannot be updated normally. What we did was to add a redirect so we are responding to the modified URL, this way people will update. Now their URL is a working update URL.”

As part of its push to crack down on robocalling, the US Federal Communications Commission said this week that it is taking seven voice over IP services off of its trusted carriers list unless they add legally required robocall protections. The move would essentially block the services from being able to complete calls in the US. “Fines alone aren’t enough,” the FCC wrote in its announcement. “Providers that don’t follow our rules and make it easy to scam consumers will now face swift consequences.”

Binance Hackers Minted $569M in Crypto—Then It Got Complicated

Former Uber security chief Joe Sullivan’s conviction is a rare criminal consequence for an executive’s handling of a hack.

Uber's Former chief security officer, Joe Sullivan, was found guilty this week of actively hiding a data breach from the US Federal Trade Commission (FTC) and concealing a felony. The case has reverberated through the security and tech worlds because it is seemingly the first time that an individual executive has faced criminal prosecution for charges related to a data breach against the executive's company. As alarming as Sullivan's conviction may be to some, gauging the fallout for security executives is anything but straightforward.

Chief security officers are sometimes wryly referred to as “chief scapegoat officers” or “chief sacrificial officers,” because the practical challenges of securing massive organizations are so great. It is all but inevitable that companies will suffer hacks and breaches, and CSOs preside over the aftermath. Many now worry that Sullivan's conviction will make the already daunting role even less appealing to top talent. But the United States Department of Justice is positioning the case as an opportunity to set guardrails around what behavior is—and isn't—acceptable in the fraught balancing act of corporate breach response.

“This definitely will have a chilling effect,” says Anthony Vance, a professor and researcher at Virginia Tech who focuses on how individuals and organizations can improve cybersecurity practices. “Most people aren’t clear about the nuance that is involved here, but more generally, it does show that someone could be held accountable and convicted for a data breach, which has never happened. It’s possible even if this is an extreme case.”

Sullivan’s trouble goes back to November 2016, when Uber suffered a data breach that compromised personal information of more than 57 million users, including drivers and passengers. The rideshare giant didn't disclose the breach until November 2017, when its current chief executive officer, Dara Khosrowshahi, took over and fired Sullivan along with a company lawyer, Craig Clark. In 2018, Uber paid $148 million to settle with attorneys general across the United States for violating state data breach disclosure laws.

The delayed notification in itself isn't what brought Sullivan into the Justice Department's crosshairs, though. When Sullivan learned about the 2016 hack, he was already working with the FTC on its ongoing investigation into another, unrelated 2014 Uber data breach. Among other things, Sullivan gave a sworn deposition to the FTC about the incident and steps Uber had since taken to improve its digital security practices. 10 days after providing this testimony, he learned of the new data breach. The hackers attempted to extort the company by threatening to publish the data they had stolen if they didn't receive payment. 

Sullivan is now convicted of spearheading the effort to cover up this breach by paying the hackers $100,000 through the company's bug bounty program. As part of the deal, authorities say, he required the hackers to delete the stolen data and sign a nondisclosure agreement about the incident. These actions amounted to a failure to report a felony, according to the DOJ, and resulted in a “misprision of felony” charge. He was also charged in 2020 and convicted this week of obstruction of proceedings of the FTC for failing to amend his testimony to the agency about Uber's security conditions once he learned of the 2016 breach.

“This is a unique case because there was that ongoing FTC investigation,” says Shawn Tuma, a partner in the law firm Spencer Fane who specializes in cybersecurity and data privacy issues. “He had just given sworn testimony and was most certainly under a duty to further supplement and provide relevant information to the FTC. That’s how it works.”

Tuma, who frequently works with companies responding to data breaches, says that the more concerning conviction in terms of future precedent is the misprision of felony charge. While the prosecution was seemingly motivated primarily by Sullivan's failure to notify the FTC of the 2016 breach during the agency's investigation, the misprision charge could create a public perception that it is never legal or acceptable to pay ransomware actors or hackers attempting to extort payment to keep stolen data private.

“These situations are highly charged and CSOs are under immense pressure,” Vance says. “What Sullivan did seems to have succeeded at keeping the data from coming out, so in their minds, they succeeded at protecting user data. But would I personally have done that? I hope not.”

Sullivan told _The New York Times_ in a 2018 statement, “I was surprised and disappointed when those who wanted to portray Uber in a negative light quickly suggested this was a cover-up.”

The facts of the case are somewhat specific in the sense that Sullivan didn't simply lead Uber to pay the criminals. His plan also involved presenting the transaction as a bug bounty payout and getting the hackers—who pleaded guilty to perpetrating the breach in October 2019—to sign an NDA. While the FBI has been clear that it doesn't condone paying hackers off, US law enforcement has generally sent a message that what it values most is being notified and brought into the process of breach response. Even the Treasury Department has said that it can be more flexible and lenient about payments to sanctioned entities if victims notify the government and cooperate with law enforcement. In some cases, as with the 2021 Colonial Pipeline ransomware attack, officials working with victims have been able to trace payments and attempt to recoup the money. 

“This is the one that gives me the most concern, because paying a ransomware attacker could be viewed out in the public as criminal wrongdoing, and then over time that could become a sort of default standard,” Tuma says. “On the other hand, the FBI highly encourages people to report these incidents, and I’ve never had an adverse experience with working with them personally. There’s a difference between making that payment to the bad guys to buy their cooperation and saying, ‘We’re going to try to make it look like a bug bounty and have you sign an NDA that’s false.’ If you have a duty to supplement to the FTC, you could give them relevant information, comply with breach notification laws, and take your licks.”

Tuma and Vance both note, though, that the climate in the US for handling data extortion situations and working with law enforcement on ransomware investigations has evolved significantly since 2016. For executives tasked with protecting the reputation and viability of their company—in addition to defending users—the options for how to respond a few years ago were much murkier than they are now. And this may be exactly the point of the Justice Department's effort to prosecute Sullivan.

“Technology companies in the Northern District of California collect and store vast amounts of data from users. We expect those companies to protect that data and to alert customers and appropriate authorities when such data is stolen by hackers,” US attorney Stephanie Hinds said in a statement about the conviction on Wednesday. “Sullivan affirmatively worked to hide the data breach from the Federal Trade Commission and took steps to prevent the hackers from being caught. Where such conduct violates the federal law, it will be prosecuted.”

Sullivan has yet to be sentenced—another chapter in the saga that security executives will no doubt be watching extremely closely.

The Uber Data Breach Conviction Shows Security Execs What Not to Do

A new executive order tries to reassure Europeans that their data is safe on US soil, despite government surveillance.

The United States is not going to stop spying on Europeans’ data, but it is going to make sure that spying is “proportionate.” This was the reassurance that US President Joe Biden offered concerned citizens across the Atlantic today by signing an executive order designed to restart the easy flow of data between Europe and the US.

For years, companies have been shuttling customer information between the two regions. “Transatlantic data flows are critical to enabling the $7.1 trillion EU-US economic relationship,” the White House said today. But two years ago, the EU Court of Justice in Luxembourg ruled that Europeans’ data sent to the US risked being snooped on by intelligence agencies, such as the US National Security Agency. As a result, the agreement that allowed companies to easily transfer data between the US and Europe was ripped up. Businesses instead had to make do with a costly and complex temporary replacement.

Biden’s executive order brings a new EU-US data privacy agreement one step closer and aims to restore trust among Europeans’ concerned by US government surveillance. The order creates a new body within the US Department of Justice that will oversee how US national security agencies access both Europeans’ and Americans’ data. But privacy campaigners say the order simply copies the wording of European law (adding in terms like _proportionate_ and _necessary_) without making any real changes. “We do not see a ban on bulk surveillance and no actual limitations,” says Max Schrems, the Austrian privacy activist whose legal complaint against Facebook eventually dismantled the transatlantic data pact back in 2020.

Before then, around 5,000 businesses had been sending data back and forth across the Atlantic under a system called Privacy Shield. “The pre-Schrems system worked,” says Morgan Reed, president of the App Association, which represents small- and medium-size companies, mostly app developers. But the EU court ruling made the Privacy Shield system suddenly invalid, plunging thousands of companies into legal limbo.

Although the court decision did not stop transfers, it made them more complicated. “What the Schrems decision did was raise costs and concern for a lot of small companies that don't have giant compliance departments’ and fleets’ worth of lawyers to do what are called standard contractual clauses,” says Reed. Standard contractual clauses are time-consuming data transfer agreements that force companies to take steps to assess whether they are safely moving data around the world. 

Companies that have spent the past two years wrestling with these clauses are pleased by the order; they want to get back to business as usual. The executive order is the next step in the US and EU reaching a new privacy agreement. “We appreciate President Biden’s action to keep data flowing between the US and EU, underpinning one of our deepest and most mutually beneficial trading relationships,” says Matt Schruers, president of the Computer and Communications Industry Association (CCIA), a lobbying group that represents tech giants including Google, Amazon, and Apple.

At Workday, a California-based HR software provider with more than 2,000 customers headquartered in Europe, the mood is optimistic. Chandler Morse, vice president of corporate affairs, believes this is evidence that the US and EU can reach an agreement on more than just the privacy shield problem. “There's a number of other tech issues that are pending in the EU-US bilateral, so for many of us this is a positive sign that the EU and the US can work together,” he says, adding that the EU AI Act and Data Act could also be beneficiaries of this new cooperation.

Yet privacy campaigners are not impressed—either by greater collaboration or Biden’s offer of a so-called Data Protection Review Court, which will allow EU citizens to challenge how US security agencies use their data.

“However much the US authorities try to paper over the cracks of the original Privacy Shield, the reality is that the EU and US still have a different approach to data protection which cannot be canceled out by an executive order,” says Ursula Pachl, deputy director general of the European Consumer Organization (BEUC). “The moment EU citizens’ data travels across the Atlantic, it will not be afforded similar protections as in the EU.”

Biden’s executive order will now be sent to Brussels, where EU officials could spend up to six months scrutinizing the details. A new data agreement is expected to be ready around March 2023, although privacy activists are expected to challenge the ruling in court. “The order is never going to be enough for the privacy community in Europe,” says Tyson Barker, head of technology and global affairs at the German Council on Foreign Relations.

The European Commission believes the new agreement could survive a court challenge. But the US has been quietly hedging its bets, says Barker. At a conference in October 2021, Christopher Hoff, deputy assistant secretary for services in the Biden Administration, said he supported the global expansion of a rival privacy agreement—the Asia-Pacific Economic Cooperation Cross-Border Privacy Rules system. “The United States wants to say, actually, we have an alternative and we'd like to set this as the global standard,” Barker adds.

Schrems, however, is not worried about another privacy agreement curbing the EU’s influence. “I don’t personally care what standards other countries prefer,” he says. “I know the law in the EU.”

Biden’s Privacy Order Slaps a Band-Aid on the EU-US Data Crisis

The company plans to alert 1 million Facebook users that their account credentials may have been compromised by malicious software.

Both Apple and Google have struggled for years to keep malicious apps out of their official mobile app stores and away from users' phones. Simple programs like flashlight apps, photo editing tools, and games can mask efforts to grab user data, authorize rogue charges, or steal login credentials to a legitimate service. Today, Meta said it has found and reported more than 400 apps this year in official app stores that were set up to steal victims' Facebook credentials.

Meta will notify 1 million users that they may have been exposed to one of the rogue applications. That doesn't mean all those users had their Facebook accounts compromised, but Meta researchers say they are being cautious and casting a wide net because they have limited visibility beyond their own platform to know exactly what went on with each user. Of the 400 programs Meta flagged and reported, 45 were iOS apps. The company says that the activity didn’t appear to be targeted toward a particular geographic region or subset of people.

“It's a highly adversarial space, and some of these apps manage to evade detection,” says David Agranovich, Meta's director of threat disruption. “Flashlight apps, photo editors, mobile games. There are many legitimate applications on the Apple and Google stores, but cybercriminals know how popular these types of apps are and use that to their advantage. We want to deter threat actors and keep people safe.”

Agranovich says that this group of 400 apps from 2022 targeted only Facebook, not Instagram and WhatsApp, the company's other popular platforms. But the company has tracked threats from similar credential-stealing apps that are focused on those services.

Google Play and Apple's App Store each have their own vetting systems, but some malicious apps still slip by. Credential theft is a classic focus of developers of these rogue apps, and attackers often craft their ploys to take over high-value accounts like Facebook profiles that both contain a lot of data themselves and are also used as single sign-on platforms to log in to other services. Nearly 47 percent of the apps Meta flagged masqueraded as photo editing services. About 15 percent claimed to be business utilities. And nearly 12 percent pretended to be VPNs, while “phone utilities,” games, and lifestyle made up the remaining categories.

Google says that the Android apps Meta identified have all been taken down from Google Play and that the company had independently caught and removed many of them throughout the year before Meta's disclosures.

Apple said that it doesn't tolerate fraudulent or malicious apps in the App Store and that the 45 iOS apps Meta researchers flagged have already been removed.

Both companies have struggled to police their official app stores, and each faces its own version of the same challenges. For Google, Android's open ecosystem means that users can download apps from third-party app stores beyond Google's control. This makes it even more problematic when malicious apps show up in Play, but it also gives users leeway to source apps where they want to (ideally, if they know they can trust a particular developer). The closed iOS ecosystem has far fewer threats from rogue apps outside the App Store, but as a result all users must get their apps from Apple, making it even more valuable for attackers to sneak their malicious apps in.

“Apple is usually quick to respond once scam apps are reported, but potentially unwanted programs are absolutely a big problem on iOS, and nobody other than Apple has the ability to do anything about it,” says Thomas Reed, director of Mac and mobile platforms at the antivirus maker Malwarebytes.

The apps Meta flagged steal credentials by prompting unsuspecting victims to log into Facebook. Instead of using a secure deployment of the single-sign-on service Sign in With Facebook, though, the apps would simply present Facebook’s browser login flow while capturing whatever credentials users entered, including usernames, passwords, and two-factor authentication codes. In the majority of cases, Meta says, the apps immediately prompted users to log in and didn’t offer any functionality, like a game or flashlight tool, before or after the user completed the login.

Meta researchers say that while Facebook accounts are far from the only ones targeted in this way, they wanted to publish findings on the issue to raise awareness about malicious mobile apps both among users and in the tech industry more broadly. Meta suggests that users think about three factors to protect themselves against potentially malicious apps. First, carefully consider why an app might be requesting credentials for another service. A flashlight app shouldn't need to be linked to a social media account at all, and you should be able to play a game or use a photo editing app without a login requirement. Second, consider the app's reputation as best you can. Check to make sure you're downloading the exact app you intend to and not a lookalike. And third, think about whether an app offers the features it promises before—and certainly after—“logging in” to a required account. If your photo editor isn't doing much photo editing, there's probably a problem.

Meta Says It Has Busted More Than 400 Login-Stealing Apps This Year

Blockchain investigators have uncovered at least $4 million—and counting—in cryptocurrency fundraising has reached Russia's violent militia groups.

As Russian troops have flooded into Ukraine’s borders for the past eight months—and with an ongoing mobilization of hundreds of thousands more underway—the Western world has taken drastic measures to cut the economic ties that fuel Russia’s invasion and occupation. But even as those global sanctions have carefully excised Russia from global commerce, millions of dollars have continued to flow directly to Russian military and paramilitary groups in a form that’s proven harder to control: cryptocurrency.

Since Russia launched its full-blown invasion of Ukraine in February, at least $4 million worth of cryptocurrency has been collected by groups supporting Russia’s military in Ukraine, researchers have found. According to analyses by cryptocurrency-tracing firms Chainalysis, Elliptic, and TRM Labs, as well as investigators at Binance, the world’s largest cryptocurrency exchange, recipients include paramilitary groups offering ammunition and equipment, military contractors, and weapons manufacturers. That flow of funds, often to officially sanctioned groups, shows no sign of abating and may even be accelerating: Chainalysis traced roughly $1.8 million in funding to the Russian military groups in just the past two months, nearly matching the $2.2 million it found the groups received in the five months prior. And despite the ability to trace those funds, freezing or blocking them has proven difficult, due largely to unregulated or sanctioned cryptocurrency exchanges—most of them based in Russia—cashing out millions in donations earmarked for invaders.

“Our aim is to identify all the crypto wallets being used by Russian military groups and the people helping them; to find, seize and block all this activity that is helping to buy the bullets, the ammunition of this occupation,” says Serhii Kropyva, who until recently served as deputy of Ukraine’s Cyber Police and advisor to the country’s prosecutor general. “With the close cooperation of companies like Chainalysis and Binance, we can see all the wallets involved in this criminal activity, these money flows of millions of dollars. But we can, unfortunately, see that the transfer is continuing all the time.”

In separate reports, the cryptocurrency-tracing firms and Binance’s investigations team each tracked donations to the Russian war effort that very often began with public posts on the messaging app Telegram soliciting crowdfunded donations. Chainalysis, for instance, found Telegram posts from organizations including the pro-Russian media sites Rybar and Southfront, as well as the paramilitary group Rusich—which has ties to the notorious Wagner mercenary group—all posting cryptocurrency donation addresses to Telegram. These posts told followers that the money raised there would be used for everything from weaponized drones to radios, rifle accessories, and body armor. In another instance, Chainalysis points to a fundraiser by a group called Project Terricon that attempted to auction NFTs to support pro-Russian militia groups in Eastern Ukraine, though the NFTs were removed from the marketplace they were hosted on before any bids were placed.

Binance’s investigations team, in its own report, found that a total of $4.2 million in crypto had been funneled to Russian military groups since February. The groups named in its research didn’t entirely overlap with those named in Chainalysis’ report, suggesting that the overall funding could be far greater than either Binance’s or Chainalysis’ total. Binance, for instance, points to a pro-Russian “cultural heritage” group known as MOO Veche that has carried out fundraisers for military equipment similar to the kinds funded by the groups Chainalysis flagged. While Binance, TRM Labs, and Elliptic all name MOO Veche as a major fundraiser, Elliptic traced $1.7 million in crypto donations to the group, far more than the other researchers.

A screenshot of a Russian-language Telegram post from the pro-Russian military MOO Veche group, describing equipment paid for with its fundraising, including “thermal imagers, binoculars with rangefinders, spotting scopes, car radios, collimators and first aid kits.“

Telegram via Andy Greenberg

Other organizations that Binance spotted raising money through cryptocurrency crowdfunding on Telegram include the pro-Russian nationalist groups Save Donbas and REAR, as well as the Russian arms manufacturer Lobaev, which it saw directly soliciting donations on the platform. Yet another group, known as Romanov Light, whose fundraising was spotted by TRM Labs and Elliptic, claimed to be collecting crypto for Russian special forces. Romanov Light raised as much as $330,000 worth of donations, according to Elliptic, which it told donors it spent on military equipment like weapon accessories, flashlights, and armor plates.

Despite the relative clarity of all that financial tracing, preventing cryptocurrency from continuing to bolster Russia’s unprovoked incursion into Ukraine hasn’t been simple. Exchanges can block or freeze funds at the points where they’re exchanged for traditional currency. But according to Chainalysis, the majority of the crypto funds the groups have raised have been cashed out through Russian exchanges, including Chatex, Suex, and Garantex—all of which have already been targeted with Western sanctions for their extensive use by criminals. Chatex and Garantex did not respond to WIRED’s request for comment. Suex no longer appears to have a public website, and no contact information for the exchange could be found.

Not every exchange that has served as an ATM for Russian military crypto crowdfunding is hosted in Russia, however. Blockchain analysts who spoke to WIRED pointed to seven other exchange services, some hosted in India and China, that have received funds from the pro-Russian groups they tracked, though they declined to name them on the record, in part because the amounts of those funds in most cases were in the single-digit thousands or less.

In one telling example of how hard it is to prevent these cash-outs, however, analysts saw MOO Veche send more than $150,000 worth of bitcoin to an exchange hosted on the infrastructure of the Chinese cryptocurrency exchange Huobi—a “nested” exchange that essentially uses Huobi as its trading platform. But any responsibility that Huobi might have for blocking or freezing those funds was complicated by another unknown intermediary service that analysts saw the money travel through before entering the Huobi-hosted service. When WIRED reached out to Huobi for comment, it wrote in a statement that it has a “know-your-customer” process “which ensures to the best of our ability that our clients’ source of funds are above board.”

Binance, for its part, says its exchange accounts were also used by four of the groups it tracked and received more than $208,000 worth of cryptocurrencies. It tells WIRED that it froze all four accounts it discovered. “We’re making sure that no harm comes to civilians as a result of the fundraising that happens in these extremist spaces,” says Jennifer Hicks, who manages Binance’s intelligence and investigations team. “When cryptocurrency exchanges know that something illicit is happening that will end in real-world, kinetic effects like this, it’s the exchange’s responsibility to put a stop to it as fast as possible.”

Even when exchanges do monitor for crypto sent from sanctioned groups like these pro-Russian fundraisers, that dirty money won’t always be straightforward to detect, warns Thibaud Madelin, who leads research at Elliptic. He says he’s increasingly seeing Russian sources of illicit funds use “bridges” or “coin swaps”—services that allow easy trading of one cryptocurrency for another, often without offering any identifying information—as money-laundering techniques. He’s watched those tools grow in popularity among dark-web black markets and cybercriminal users and expects the same will happen with those seeking to launder illicit arms funding. “It’s a bit early to say definitively. But what we’re seeing is that it’s likely to become a bigger problem,” says Madelin. “They’re likely to mirror the methodologies seen across dark net services users, enabling large-scale money laundering and potentially sanctions evasion.”

An image in Chainalysis’s report pulled from a pro-Russian social media fundraiser that shows items funded through cryptocurrency donations, including targeting equipment, drone components, and satellite radios.

Courtesy of Chainanalysis

Millions of dollars in cryptocurrency funding to Russian troops may be the least of Ukraine’s problems in a war where Russia has thrown billions into its invasion force. Ukraine, it’s worth noting, has also vastly out-raised Russia in cryptocurrency: By Elliptic’s count, the Ukrainian government has collected more than $77 million in crypto donations since the war began. But that is to be expected, given the West’s broad support of Ukraine following Russia’s unprovoked aggression and the global sanctions placed on Russia. And even the smaller amount of cryptocurrency Russian forces have raised demonstrates cryptocurrency’s ongoing potential to circumvent those sanctions and offer another financial lifeline to Russia’s war machine.

“It’s not like Russia is buying new tanks with this money. They’re paying for thermal imaging scopes and UAVs,” says Andrew Fierman, a sanctions-focused Chainalysis researcher. “But for grassroots facilitation of these militia efforts, any amount of money that they receive to bolster their gear is going to have an impact.” And despite all the light that cryptocurrency tracers can shine on that funding—and the West’s best efforts to stop it—the crypto flow into Russia’s war chest continues.

Source

Wired