But as Ukrainians retake ground, some of the firms are erasing their online presence.

For six months, people in occupied Ukrainian cities have lived under the gloom of Russian rule. Across the south and east of Ukraine, Vladimir Putin’s forces have tried to legitimize makeshift administrations: Newly announced referendums would see occupied areas officially join the Russian Federation; citizens have been previously handed Russian passports; and troops have tried taking over the internet, potentially submitting people to the Kremlin’s powerful censorship machine.

As part of these efforts, in recent months two new Russian mobile and internet companies have appeared seemingly from nowhere in occupied Ukraine—claiming to provide cell phone coverage across “liberated territories.” At the same time, existing Russian internet companies in the separatist areas of the Donbas claimed to have expanded their mobile coverage, experts say. These are some of the latest efforts to convert areas of Ukraine to Russian infrastructure and control, with the actions mimicking a playbook similar to Russia’s annexation of Crimea in 2014.

“All this seems to be so obviously priming customers for taking away this impression that they’re bringing connection and peace and liberation to these areas,” says Olena Lennon, a national security practitioner in residence at the University of New Haven who has looked at the new mobile companies. “The language is very propagandist and manipulative,” says Lennon, who is from eastern Ukraine. She compares the actions to an act of “soft power.”

The two mobile providers—7Telecom and MirTelecom—have both been visible since around June, when people spotted new, unbranded SIM cards being sold in occupied Ukraine for the first time. Both companies use the +7 Russian mobile code, and their websites are registered on Russian domains. They claim to provide mobile coverage over Ukrainian towns and cities in the Kherson, Melitopol, and Zaporizhzhia regions.

The 7Telecom operator says people need to register for its services at one of its offices and must bring ID when they do. Lennon says the mobile tariffs she has seen show MirTelecom charging more for calls to Ukrainian phone numbers than for calls to Russian numbers. (Internet companies in Ukraine have previously said Russian occupying forces have taken over their equipment to run services. In some cases, Ukrainians have purposefully destroyed equipment to stop it from falling into Russian hands.)

The new Russian companies claim to offer both 2G and 4G cell service in the regions. Cathal Mc Daid, the chief technology officer at mobile security company Enea AdaptiveMobile Security, is researching the companies and says this approach makes sense. The 2G mobile spectrum will allow for a wide coverage for calls, while 4G coverage, where available, will let people use data to get online.

This, Mc Daid says, suggests Russian forces expect to occupy the areas for some time. “\[In\] contested areas, you don’t generally have two or three new operators coming to a place,” Mc Daid says. “I would say also, that’s a sign that they expect to be there for a while.” Mc Daid says the networks may also have been created for Russian troops to use.

Since the companies emerged earlier this year, they claim to have expanded their services. Their websites list dozens of claimed locations, including shops, where people can buy SIM cards and internet access. In one online post, 7Telecom says it’s hiring a recruitment manager, office administrator, sales manager, and IT specialist to work in the Kherson region.

It isn’t clear how popular the networks are. Maps showing areas receiving cell phone signals cannot be verified, nor can Russian media claims that 7Telecom has more than 100,000 subscribers. MirTelecom and a Gmail account linked to 7Telecom’s Kherson recruitment efforts did not respond to WIRED’s request for comment. There have been a few sporadic online posts showing posters or advertising flyers for the companies, but it’s not clear how widespread they are. 7Telecom has the larger social media presence of the two, with around 8,600 followers of its account on VKontakte, Russia’s version of Facebook. While there are unofficial Telegram channels for both companies, linked to a firm that allows people to top up SIM cards, each has only a few dozen subscribers. (Although this has not stopped people from complaining about poor connections.)

While the scale of their presence is uncertain, both MirTelecom and 7Telecom appear to have some links to existing mobile companies, which were created following Russia’s annexation of Crimea in 2014 and have formed part of its long-term occupation in the area. “The main Russian operators are not operating a commercial presence in this part, and this is the same as what they did in Crimea,” says Mc Daid. In Crimea and the Donbas, Russian forces created new internet providers. In recent months, Mc Daid says, existing Russian mobile providers in the Donbas have updated their coverage maps claiming that new areas of Ukraine fall under their service.

Analysis shared with WIRED, which Mc Daid is due to present at a conference later this month, shows MirTelecom and 7Telecom appear to be linked to Crimean mobile companies KrymTelecom and K-Telecom, respectively. Details posted publicly by MirTelecom and reporting by Russian media also appear to show some links. (Neither KrymTelecom nor K-Telecom responded to requests for comment.)

Being able to control the internet gives occupying forces the power to shape what people read, watch, and hear. In parts of Ukraine where Russian forces have control, reports have indicated that internet censorship is more heavily enforced than in Russia, where there have been widespread crackdowns on freedom of expression. Lennon says that controlling mobile networks could also allow Russian forces to “pacify” local populations, as it may “disincentivize people from resisting and potentially protesting against new local authorities.”

However, the tide of the war in Ukraine has started to turn. Russian troops are no longer making as many gains as they were at the start of the full invasion, and successful Ukrainian counteroffensives are pushing Putin’s forces back toward Russia’s borders. President Volodymyr Zelensky has claimed Russian troops are “clearly in a panic” during their retreats. Russian officials have downplayed any retreats.

Large parts of the Kharkiv region have been retaken by Ukraine’s forces, the country’s troops are making important gains in Luhansk, and a long-awaited counteroffensive in the Kherson region has begun. The Ukrainian victories have revealed mass graves and potential Russian war crimes, but they also mark one small step toward Ukraine regaining control. For instance, Ukraine claims it has arrested Russian teachers who had been shipped into occupied areas.

As Ukraine has retaken occupied areas, some of its mobile and internet connectivity has returned. On September 11, one of Ukraine’s biggest internet providers, Kyivstar, announced that “communication” in the city of Balaklia in the Kharkiv region had been restored. Since then it tweeted that its engineers have brought connectivity back in the cities of Izyum and Chkalovskoe, along with multiple towns and villages in retaken areas. The company said in a post that it restored 195 base stations in one area during a single week and tweeted: “Where the armed forces go, we go there too!”

While some people’s connectivity is being restored—allowing them to reunite with loved ones and let them know they are alive—the newly created Russian-linked mobile internet firms appear to be scrubbing some of their presence in occupied areas. Until the middle of September, MirTelecom’s web page showing its claimed cell coverage included three maps: the Kherson region, the Zaporizhzhya region, and the Kharkiv region. Then Ukrainian troops retook Kharkiv.

MirTelecom has now removed its coverage map of Kharkiv, only displaying the other two areas. MirTelecom also appears to have wiped news pages from its website: A page introducing the director of MirTelecom’s Kharkiv branch is no longer live, and an article about its “first sales office” in the area is also dead. An archived version of that page claims the company exists to help “erase borders.”

Shadowy Russian Cell Phone Companies Are Cropping Up in Ukraine

The encrypted messaging app is a haven for politically motivated vitriol, but users are increasingly bringing threats to targets’ doorsteps.

Burmese influencer Han Nyein Oo rose to prominence in 2020, posting memes and gossip about Burmese celebrities on Facebook to an audience that grew to several hundred thousand people in Myanmar by early 2021. Then, after the country’s military seized power that February, he lurched rightwards, becoming a full-blooded supporter of the junta, which has killed more than 1,500 people and arrested thousands more in bloody crackdowns.

He was soon banned from Facebook for violating its terms of service, so he moved to Telegram, the encrypted messaging app and social sharing platform. There, he posted messages of support for the military, graphic pictures of murdered civilians, and doctored pornographic images purporting to be female opposition figures. Often, these were cross-posted in other channels run by a network of pro-junta influencers, reaching tens of thousands of users.

This year, Han Nyein Oo moved on to direct threats. Opponents of the junta planned to mark the anniversary of the coup on February 1 with a “silent strike,” closing businesses and staying home to leave the streets abandoned. On his Telegram channel, Han Nyein Oo raged, asking his followers to send him photos of shops and businesses that were planning to shut. They obliged, and he began posting the images and addresses to his 100,000 followers. Dozens of premises were raided by police. Han Nyein Oo claimed credit. He did not respond to a request to comment.

“That was the start of the doxing campaign,” says Wai Phyo Myint, a Burmese digital rights activist. “Since then there’s been an escalation.”

Over the past eight months, Han Nyein Oo’s Telegram channels, and those of other pro-coup figures, including self-defined journalist Thazin Oo and influencers Kyaw Swar and Sergeant Phoe Si, have doxed hundreds of people that they accuse of siding with the resistance movement, from high-profile celebrities to small business owners and students. Dozens have since been arrested or been killed in vigilante violence.

Han Nyein Oo’s channel was taken down in March after it was reported for breaching Telegram’s rules on disseminating pornography, but within days he had started another. It now has more than 70,000 followers. 

Telegram’s doxing problem goes far beyond Myanmar. WIRED spoke to activists and experts in the Middle East, Southeast Asia, and Eastern Europe who said that the platform has ignored their warnings about an epidemic of politically motivated doxing, allowing dangerous content to proliferate, leading to intimidation, violence, and deaths.

In a Telegram message, company spokesperson Remi Vaughn said: “Since its launch, Telegram has actively moderated harmful content on its platform—including the publication of private information. Our moderators proactively monitor public parts of the app as well as accepting user reports in order to remove content that breaches our terms.”

Telegram, which now claims more than 700 million active users worldwide, has a publicly stated philosophy that private communications should be beyond the reach of governments. That has made it popular among people living under authoritarian regimes all over the world (and among conspiracy theorists, anti-vaxxers, and “sovereign citizens” in democratic countries.)

Telegram Has a Serious Doxing Problem

Despite having one of the strongest data-protection policies in Africa, the country’s enforcement and disclosure practices remain dangerously broken.

On April 3, Website Planet was running a web-mapping project when it discovered unsecured AWS S3 data buckets belonging to a state health agency in Nigeria. These buckets contained some 75,000 entries on an estimated 37,000 people—about 45 GB in all, including identification documents and photos of people registered with the agency. The buckets dated from January 2021, and they were live and being updated at the time of discovery, according to Website Planet.

The agency, known as the Plateau State Contributory Healthcare Management Agency (PLASCHEMA), had been launched in September 2020 by the state's governor, Simon Bako Lalong, and it was geared toward providing cheap and accessible health care for residents of Nigeria's Plateau state.

On April 5, Website Planet contacted Nigerian authorities, informing them of the exposed data buckets. But Website Planet says the data buckets remained live and unsecured until late July. It’s unknown if malicious actors found the data before they were secured, says a spokesperson for Website Planet, but “the longer it was left open, the more likely it could be caught by malicious parties.” Personal information like that found in the buckets could be exploited for identity theft, which could be used to open social media and virtual bank or credit accounts.

On July 23, days after the unsecured buckets were locked down, Fabong Yildam, director general of PLASCHEMA, denied any data breach or exposure in a press conference.

The incident, sadly, is typical of widespread cybersecurity issues in Nigeria, where regulations are ineffective, bad practices run rampant, and public disclosures of security breaches are often slow and insuffient.

“Many organizations in developed countries communicate when they have cases of cyberattacks, which encourages cyber-resilience and widespread incident response," says Confidence Staveley, a Nigerian security analyst and executive director of the Cybersafe Foundation, a security consultancy and advocacy group. “Back here, however, we see that generally, a lot of organizations absolutely deny the occurrence of cyberattacks and data breach incidents, even in the presence of undeniable evidence. That, or they drastically play down the incident.”

In August 2020, two major Nigerian banks were reported to have suffered data breaches, exposing the financial details of their customers. Neither bank responded until days later, and then their press releases were vague, neither denying nor admitting to the occurrence of any data breach.

Earlier this year, in July, David Hundeyin, an independent Nigerian journalist, also reported a possible compromise of emails belonging to the Lagos state government and the sale of these emails in the dark market. The Lagos state government and Nigeria’s cybersecurity agencies remained quiet over Hundeyin’s claims, neither responding nor denying the alleged breach.

By not communicating, these agencies fail to equip their customers and other stakeholders with the information they need to protect themselves and provide actionable advice to anyone exposed by a potential breach. The lack of communication, Staveley says, along with many bad cybersecurity practices, undermines cybersecurity and data protection in Nigeria, and creates a severe lack of trust and capacity.

The Deep Roots of Nigeria’s Cybersecurity Problem

Tired of advertisers spying on your private communications? This beta promises to kick tracking technology to the curb.

Having offered a privacy-focused search engine since 2008, DuckDuckGo is now turning its attention to email: Its new Email Protection service gives you an @duck.com email address, which you can use as a buffer between your actual email inbox and the outside world.

As well as forwarding your incoming messages to your main email address, DuckDuckGo Email Protection strips them of the tracking technologies so often embedded in the emails that inform the senders of when and where you're viewing your messages, and even which links you're clicking through.

You can also use the service to create email aliases, temporary addresses that you can use with sign-up forms on the web and then delete if you find they're attracting too much spam or too many marketing missives. (The Hide my Email service offered by Apple works in a similar way.)

All of this is being offered free of charge, although the service is still in beta—so you might notice the occasional bug or hiccup. Also, some features might change before the product gets a full launch.

Getting Started

The DuckDuckGo app automatically puts your new address into web forms.

DuckDuckGo via David Nield

To access DuckDuckGo Email Protection, you first need to download the DuckDuckGo Privacy Browser app for Android or iOS. With a browser tab open, tap the menu button (the three dots), then choose **Settings** and **Email Protection**. Tap **Get Started**, then follow the instructions to pick your @duck.com address and specify which address emails sent to it should be forwarded to.

Once you've chosen your address, it will start to appear automatically in forms in the DuckDuckGo Privacy Browser. If you need to get to your account settings from inside the app, tap the menu button (the three dots), then **Settings** and **Email Protection**—only this time you'll be taken to your email settings. Under **Account,** you can change your forwarding address.

Tap **Autofill**, and as well as seeing your main (public) DuckDuckGo email address, you'll see a private DuckDuckGo address has been generated for you: Tap **Copy** if you want to use it in a web form, or **Generate Private Duck Address** if you need to create another one. The same forwarding rules apply to your private email addresses as to your public one, but they're easier to dispose of.

You can use DuckDuckGo Email Protection in a desktop web browser as well, but you need the DuckDuckGo Privacy Essentials extension for Google Chrome, Mozilla Firefox or Microsoft Edge installed. As well as giving you access to your email addresses and settings, the add-on helps you search anonymously on the web, blocks hidden trackers on websites, and improves site connection security.

Using Email Protection

You can change your forwarding address whenever you need to.

DuckDuckGo via David Nield

You can start using your public and private DuckDuckGo email addresses straight away. Anything that comes through to your main inbox via the Email Protection service will be stripped of tracking technologies, and you'll see a message at the top of each email providing a summary of the work that DuckDuckGo has done.

Click **More** on this summary to get more detail, including the specific tracking tools that have been stripped out of the message. If the service has been able to upgrade any of the links to secure HTTPS—another perk of Email Protection—then again this will be outlined on the same page. At the bottom there's a feedback form you can use to report any problems with the service (remember, it's still in beta.)

To delete one of your private email addresses—perhaps if you're getting too much spam sent to it or you've stopped using the app that you used it to sign up for—you need to find an email sent to this address, then click **More** on the summary at the top of the message, then choose **Deactivate** next to the email address. It's not the most elegant way of managing your email addresses, but it does the job.

There aren't many settings for Email Protection, but you can get to them in the mobile DuckDuckGo app by tapping the menu button (the three dots) and then **Settings** and **Email Protection**. In your desktop web browser, click the DuckDuckGo extension icon, then the cog button, then **Settings** and **Email Protection**. There's also a quick link to **Create new Duck Address** when you open the extension.

How to Use DuckDuckGo’s Privacy-First Email Service

Snipers on buildings. Drone no-fly zones. Temporary CCTV. The security plan is even more complex than it was for the London 2012 Olympics.

Inside a Special Operations Room in central London’s Lambeth borough are representatives from the Metropolitan Police, emergency services, intelligence agencies such as GCHQ and MI5, and local authorities. They’ve gathered there for the queen.

“It's an enormous room,” says Nick Aldworth, the UK’s former counterterrorism national coordinator, who has spent 36 years in policing and the military. Teams will work in various “pods” and feed information to a senior police officer who will be in charge and make final decisions, Aldworth adds. Every hour there will be two main meetings, where the latest updates are shared. “The overall commander will have tactical advisers sitting with them,” the former counterterrorism director says.

The SOR is the main hive of a sprawling security and surveillance operation meant to protect mourners of Queen Elizabeth II, who died on September 8 at the age of 96, after more than 70 years on the throne. The Met, the country’s biggest police force, says the policing operation is “enormous,” “extraordinary,” and the largest one it has ever conducted.

From the moment the queen's coffin left Balmoral, in Scotland, people have followed its journey and paid their respects to the monarch. Five million people tracked the queen’s final flight from Scotland to London. Thousands filled roads and sidewalks, dozens deep in places, to glance at the queen’s coffin as it passed. And for days, tens of thousands of people have joined a miles-long queue in London, waiting in line for more than 24 hours, to see the queen lying in state in Westminster Hall. Millions have watched along online.

The mourning culminates on Monday, September 19, as hundreds of world leaders join the royal family for the queen’s state funeral. More than a million people are expected to descend on London for all the funeral events. More than 10,000 police officers are estimated to be involved in the events, with hundreds drafted from across the country to London and the town of Windsor. Military staff will also be on standby.

“Probably every element of policing in London will be involved,” says Aldworth.

During the funeral, which runs for most of the day Monday, the queen’s coffin will be moved the short distance from Westminster Hall to Westminster Abbey, where the state funeral will take place, attended by 2,000 guests. This will be followed by a procession, where members of the royal family will walk behind the coffin before it is driven about 20 miles to the town of Windsor. A further procession and ceremony will take place there before the queen is laid to rest.

The Met’s SOR has a wall of TVs, broadcasting video footage. “It is a little bit like you might see in the movies,” Aldworth says. Videofeeds within the room include CCTV of Buckingham Palace and the surrounding areas. (There are around 1 million CCTV cameras in London, making it one of the most surveilled cities in the world. Extra mobile CCTV cameras have been put in place for the queen’s funeral.) If the SOR can’t operate for any reason, such as a power outage, there is a backup center around 10 miles away, Aldworth says.

Even ahead of the funeral, the security operation around the queen’s death has been huge. Mourners who queued across London for days—with the length of the queue being tracked via a YouTube livestream—have faced airport-style security checks before being allowed in the same room as the queen’s coffin, and extra policing patrols have been put in place around the capital. Roads around central London are closed to unauthorized vehicles.

As the queen’s coffin has been moved around London, including during processions, the royal family has been incredibly visible. They have walked in front of crowds, meeting members of the public, and shaking their hands. They haven’t hidden behind bulletproof glass. Instead, police officers have lined these procession routes, often spaced about 5 meters apart. At the same time, officers trained in crowd management have scanned crowds for security threats and suspicious behavior. Undercover police are mixed in the crowds. Sniffer dogs trained to detect explosives and firearms are also working around crowds.

Advanced security checks have taken place around Westminster Abbey, where the largest part of the funeral ceremony will take place. All nearby manhole covers are being lifted and checked for explosives, the BBC reported. Every lamp post is being opened and searched. Police spotters and snipers will be stationed on top of buildings around central London, while the Met has three helicopters at its disposal. Drones have been banned from flying over a large part of central London and Windsor, as part of a clampdown on air traffic in the areas.

Experts say the security operation is comparable to the London 2012 Olympics, but there are some big differences. The Olympics were more predictable: Officials knew when and where events were taking place, plus how many people could fit into stadiums and venues. Security checks could take place before people entered a venue. This time, an unknown number of people will attend the queen’s funeral events, and there aren’t any security checks for people lining the streets.

Peter Williams, a senior lecturer at Liverpool John Moores University’s Centre for Advanced Policing Studies and a former police officer, says under “mutual aid” agreements, police officers from around the UK have been drafted into London to support the Met. “It will be 12-hour shifts—a day and a night shift,” Williams says. “The management of that is actually really complex.” The right amount of police officers, with the correct skills, need to be in the right places at the right time.

Ahead of the funeral, police arrested several protesters who criticized the monarchy, and they demanded the details of a lawyer who held up a blank piece of paper. The moves have been severely criticized by civil liberties groups, with police officials eventually backtracking and saying they would only get involved in protests if it was “absolutely necessary.”

The largest looming threat around the funeral is a potential terrorist attack. “The crowds themselves will be a target for terrorists,” former Met police chief superintendent Parm Sandhu has said. “The funeral itself will be a target for terrorists.” The terror threat across the UK and Europe has changed significantly in the past decade, shifting from organized large-scale terror attacks, such as those coordinated by the Islamic State, to the threat of “lone actors” who may attack people with knives or vehicles. Ahead of the queen’s funeral arriving in Windsor, police installed extra metal and concrete security barriers, part of a tactic known as hostile vehicle mitigation, to stop people deliberately driving vehicles into crowds of mourners.

At the moment, the UK government’s official terror threat level is classed as “substantial,” meaning an attack is “likely”—the middle of five different threat levels. But this threat level, which was lowered in February, applies to the entire country. “What they will also do for an event of this magnitude is an event-specific threat level,” Aldworth says. This will cover specific threats to the events around the queen's funeral, and intelligence agencies will be monitoring people they have identified as potential risks.

The funeral also has armed police in high demand. “There’s a massive ­requirement for firearms, more than for routine officers, because of the amount of dignitaries,” Ken Marsh, the chairman of the Metropolitan Police Federation said last week. Police officers authorized to carry firearms have been called in from around the UK. Overall, the UK has 6,192 armed police officers, according to the most recent statistics—that’s 4.3 percent of the country’s total 142,526 police.

The world leaders attending the event provide another security headache. A full list of those in attendance has not been published at the time of writing, but it is expected that some of the world’s most powerful leaders will be traveling to London. US president Joe Biden is due to attend, alongside Emperor Naruhito of Japan, France’s president Emmanuel Macron, plus royalty and political leaders from around the world. (Officials from Russia, Belarus, North Korea and a handful of other nations have not been invited. China’s president, Xi Jinping, has been invited, although Chinese officials have reportedly been blocked from seeing the queen’s coffin lying in state.)

The UK government has asked foreign leaders and royals to travel to the events using commercial aircraft, rather than their own private planes. When they are in London, they’ve also been asked to travel to the funeral on government-provided buses, which will leave from an unknown location in west London. The move is creating a diplomatic backlash. Five countries have pushed back against the official plans, according to _Politico_. One exception to the rule is Biden. UK officials have said he can travel to the funeral in the Beast, the highly armored Cadillac designed to keep the president safe.

The Queen’s Funeral Sets Off the Biggest UK Police Operation Ever

Plus: An AI artist exposes surveillance of Instagram users, the US charges Iranians over a ransomware campaign, and more.

Welp, Uber got hacked. The attacker, who claims to be 18 years old, appears to have gained full access to Uber’s systems. And while the company has confirmed the breach, it’s downplaying the incident by claiming it “has no evidence” that the attacker accessed users’ trip logs or other sensitive data. For a breach of this severity, relatively few details were available as of late Friday afternoon, so be ready for the other shoe to drop.

Earlier in the week, former Twitter security chief Peiter “Mudge” Zatko testified before the US Senate Judiciary Committee to further detail his claims against the company. Blowing the whistle carries serious security risks, but Zatko’s efforts appear to be having the intended effect. As WIRED contributor Matt Laslo reported, the hearing has reignited US lawmakers’ ambitions to better regulate Big Tech.

This week also saw the release of Apple’s iOS 16, which has two new security features that we hope you’ll never need to use. We spoke with Ukraine’s cyberwar chief, Yurii Shchyhol, who provided an optimistic update on the digital battlefront in the country’s war with Russia. And we dove into the contentious fight in the US Congress over the passage of a new federal privacy law that has some unexpected opposition.

But wait, there’s more! Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

If you’ve crossed a US border in recent years, there’s a chance all your text messages, contacts, call records, and more are now stored in a database built by Customs and Border Protection—even if you’re a US citizen. Senator Ron Wyden, an Oregon Democrat, revealed this week that CBP copies data from as many as 10,000 devices per year. Agents search these phones, tablets, and computers without warrants. And the content taken off the devices is stored in a central database accessible to 2,700 Department of Homeland Security personnel, according to information CBP commissioner Chris Magnus provided to Wyden. CBP defended the practice as being “in accordance with statutory and regulatory authorities,” while Wyden condemned it as an “egregious violation” of citizens’ constitutional rights.

The fact that we are constantly being surveilled—and surveilling ourselves—shouldn’t be a shocker. But it’s one thing to know you’re being watched and quite another to see it in action. That eerie feeling is at the center of Belgian artist Dries Depoorter’s new project, _The Follower_. Using AI, geotagged Instagram photos, and publicly accessible surveillance cameras, Depoorter found CCTV video footage of the exact moments people snapped their Instagram pics. It’s a potent reminder that someone, somewhere could be spying on you anytime you’re out in public (and another reason to not add geotags to photos you share online).

The US Department of Justice this week indicted three Iranian nationals for allegedly carrying out a series of ransomware attacks that targeted a swath of entities in at least five countries, including the US, UK, Russia, Israel, and Iran. Victims in the US include utility companies in Mississippi and Indiana, according to the Justice Department, as well as a township and an accounting firm, both in New Jersey. Other targets include entities in the health care sector and a domestic violence center. The people accused of the ransomware attacks—Mansur Ahmadi, Ahmad Khatibi, and Amir Hossein Nickaein—are now on the FBI’s Most Wanted list, and the US State Department has issued a $10 million reward for information that helps lead to their “identification or location.”

Parents and teachers were aghast this week after a prankster hacked the popular school messaging app Seesaw and spammed users with the infamous image known as “goatse.” (Don’t Google it.) While the company didn’t say how many of its millions of users were affected, NBC News reports that school districts in Illinois, New York, Oklahoma, and Texas said they were exposed to the image. Seesaw spokesperson Sunniya Saleem confirmed that “specific user accounts were compromised by an outside actor” and that the company is taking the matter “extremely seriously” as it attempts to “prevent further spread of these images from being sent or seen by any Seesaw users.”

US Border Agents May Have a Copy of Your Text Messages

An alleged teen hacker claims to have gained deep access to the company’s systems, but the full picture of the breach is still coming into focus.

On Thursday evening, ride-share giant Uber confirmed that it was responding to “a cybersecurity incident” and was contacting law enforcement about the breach. An entity that claims to be an individual 18-year-old hacker took responsibility for the attack, bragging to multiple security researchers about the steps they took to breach the company. The attacker reportedly posted, “Hi @here I announce I am a hacker and Uber has suffered a data breach,” in a channel on Uber's Slack on Thursday night. The Slack post also listed a number of Uber databases and cloud services that the hacker claimed to have breached. The message reportedly concluded with the sign-off, “uberunderpaisdrives.”

The company temporarily took down access on Thursday evening to Slack and some other internal services, according to _The New York Times_, which first reported the breach. In a midday update on Friday, the company said that “internal software tools that we took down as a precaution yesterday are coming back online.” Invoking time-honored breach-notification language, Uber also said on Friday that it has “no evidence that the incident involved access to sensitive user data (like trip history).” Screenshots leaked by the attacker, though, indicate that Uber's systems may have been deeply and thoroughly compromised and that anything the attacker didn't access may have been the result of limited time rather than limited opportunity.

“It’s disheartening, and Uber is definitely not the only company that this approach would work against,” says offensive security engineer Cedric Owens of the phishing and social engineering tactics the hacker claimed to use to breach the company. “The techniques mentioned in this hack so far are pretty similar to what a lot of red teamers, myself included, have used in the past. So, unfortunately, these types of breaches no longer surprise me.”

The attacker, who could not be reached by WIRED for comment, claims that they first gained access to company systems by targeting an individual employee and repeatedly sending them multifactor authentication login notifications. After more than an hour, the attacker claims, they contacted the same target on WhatsApp pretending to be an Uber IT person and saying that the MFA notifications would stop once the target approved the login. 

Such attacks, sometimes known as “MFA fatigue” or “exhaustion” attacks, take advantage of authentication systems in which account owners simply have to approve a login through a push notification on their device rather than through other means, such as providing a randomly generated code. MFA-prompt phishes have become more and more popular with attackers. And in general, hackers have increasingly developed phishing attacks to work around two-factor authentication as more companies deploy it. The recent Twilio breach, for example, illustrated how dire the consequences can be when a company that provides multifactor authentication services is itself compromised. Organizations that require physical authentication keys for logins have had success defending themselves against such remote social engineering attacks.

 The phrase "zero trust" has become a sometimes meaningless buzzword in the security industry, but the Uber breach seems to at least show an example of what zero trust is not. Once the attacker had initial access inside the company, they claim they were able to access resources shared on the network that included scripts for Microsoft's automation and management program PowerShell. The attackers said that one of the scripts contained hard-coded credentials for an administrator account of the access management system Thycotic. With control of this account, the attacker claimed, they were able to gain access tokens for Uber's cloud infrastructure, including Amazon Web Services, Google's GSuite, VMware's vSphere dashboard, the authentication manager Duo, and the critical identity and access management service OneLogin.

Screenshots leaked by the attacker support the claims of this deep access, including to OneLogin. In an analysis on Friday, researchers from the cybersecurity firm Group IB suggested that the attacker may have first breached Uber earlier this week and only made their presence known on Thursday.

One independent security engineer described the OneLogin account access the Uber hacker seems to have had access to as “the golden ticket jackpot.”

“That’s God—they own that there’s nothing they can’t access," the security engineer added. "It’s Disneyland. It’s a blank check at the candy shop and Christmas morning all rolled up together. But sure, customer ride data wasn’t impacted. OK.” 

The situation at Uber comes on the heels of congressional testimony on Wednesday from Twitter’s former security chief Peiter “Mudge” Zatko, who has invoked whistleblower protections as part of accusations alleging deplorable security practices within the social media giant. Zatko's testimony this week got senators fired up about the importance of security within Big Tech. But in the past, even the direst and rattling hacks have led only to incremental progress on the most basic best practices. Zatko's testimony did not seem to impact Twitter's stock price at all on Wednesday. Uber's stock had a small dip Friday morning, but it had partly recovered by the closing bell.

For now, the full scope of the situation inside the ride-sharing giant remains unknown.

"I think there are a lot of opportunities to work on detections and preventions proactively," offensive security engineer Owens says. “This can be difficult to execute in practice, though, when you have lots of other fires to put out, political challenges inside of an organization, et cetera. Maybe I’m slowly becoming jaded since I’ve been around in this space for a while.”

The Uber Hack’s Devastation Is Just Starting to Reveal Itself

The American Data Privacy and Protection Act could protect people across the country. But first, it has to get past Nancy Pelosi.

In this new post-_Roe_ world, where millions are waking up to how vulnerable virtually unfettered access to their health and location data has made them, congressional Democrats face increased pressure to protect the data of people forced to travel out of state for abortion services. Still, that’s not persuading House Speaker Nancy Pelosi and other members of California’s congressional delegation who continue to oppose a broadly bipartisan privacy bill because it would supersede their own robust state privacy law.

The House of Representatives returned to Washington this week after taking a month off. But with this fall’s midterm elections rapidly approaching, the window for congressional action on federal privacy legislation is shrinking daily. Beyond the California delegation, the potential for a national privacy law also faces challenges from some Republicans, as well as Democrats who want something better than the current frontrunner legislation has to offer, particularly when it comes to Americans’ reproductive data.

“_Roe_ has changed everything on privacy and tech,” says Senator Elizabeth Warren of Massachusetts. “The pressure is on for immediate action for a whole lot of reasons, including there are people who are pregnant today who are deeply frightened by the idea that some bounty hunter out of Texas could buy their location information and track them down.”

The House Energy and Commerce Committee seems to have gotten the memo. Before leaving town for the summer, chair Frank Pallone of New Jersey ushered the American Data Privacy and Protection Act (ADPPA) through his committee by the wildly lopsided margin of 53-2. The only two “No” votes were cast by California Democrats.

1 vs. 49

The California Consumer Privacy Act (CCPA) empowers citizens to review what personal data a company has on them, to track who their data is sold to, and to sue tech companies for violating their privacy rights. But it only empowers Californians. That does little for people in the other 49 states—a potent imbalance now that the Supreme Court has effectively eradicated the right to reproductive privacy, leaving a void that’s rapidly filling with myriad creepy Big Brothers.

Are Speaker Pelosi and her California allies willing to risk harm to women nationwide in order to protect their own state law?

“No, no, no, no. It’s, ‘How do we ensure that all Americans enjoy the same modicum of protections that Californians do?’” says Senator Alex Padilla, California’s junior Democratic senator. “I wouldn’t want to go backward.”

Many longtime abortion rights advocates in Congress were caught flatfooted by the Supreme Court’s ruling, including Democratic Party leaders who have yet to lay out a blueprint for how they plan to reinstate _Roe’s_ reproductive protections, even as they fundraise and organize off that idea. The stakes keep rising as new cases pop up nationwide—from a 10-year-old Ohio rape victim traveling to Indiana for treatment to Facebook handing the private chats of a teen and her mother to Nebraska law enforcement—and these cases have changed the conversation in Congress.

“There’s a lot of incoming fire. That’s for sure. There’s a lot of incoming fire, and a reexamination of what some of the concerns were previous to the court’s decision,” says Representative Anna Eshoo.

The Democrat was one of those two Californians—53-2—on the Energy Committee who voted against ADPPA. “We really have to be precise and focused and direct our efforts very clearly to where these concerns are, because this walks right into people’s lives,” Eshoo says.

It’s not just California Democrats. One of the main gatekeepers of all things privacy-related in the US Senate is Commerce Committee Chair Maria Cantwell of Washington state. ADPPA is “not strong enough. You can’t weaken California and then try to pass a bill,” Cantwell says. “You can’t pass a weak federal standard.”

Cantwell’s opposition—of course, she introduced her own measure, the Comprehensive Online Privacy Rights Act (COPRA), which is closer to California’s privacy law than other proposals floating around Capitol Hill—empowers Pelosi’s continued blockade of a federal privacy measure. But earlier this summer, the Washington state Democrat told WIRED she sensed a change afoot for data privacy.

“We’ve had a breakthrough on the fact that there are people in the private sector who are stepping up and saying, ‘we want a strong privacy bill,’ that they're willing to be regulated and create a bright line for the bad actors within the sector,” Cantwell said in June. “So that’s been a big breakthrough.”

That breakthrough—along with privacy measures like ADPPA—all predated _Roe_’s fall.

Adapting to a Post-_Roe_ Reality

Once the Supreme Court issued its opinion overturning _Roe_, Pelosi’s veteran Democratic allies led a march from the Capitol to the purposefully intimidating eight-foot-tall fence then encasing the court; picked up their landline phones; and fired off physical letters emblazoned with congressional seals and signatures, asking data brokers questions that were first raised ages ago. Old-school Democrats waited and watched as the full scope of the Supreme Court decision took root across America, but younger members of Congress stepped up with actionable (if disagreeable) solutions.

“As a millennial—as someone who’s lived my entire adult life online—I’m glad that many of my colleagues are now seeing the importance of these issues,” says California Democrat Sara Jacobs. “I think many in my generation have been thinking about this for a long time.”

Jacobs isn’t on the House Energy and Commerce Committee, which passed ADPPA in July, but once _Roe_ was ripped away, she introduced the My Body, My Data Act.

“The post-_Roe_ world is not going to look like the pre-_Roe_ world, and we now have a digital surveillance architecture that can be used to go against people who are seeking abortions and people who are helping those who are seeking abortions,” Jacobs says. “It needs special protections that you wouldn’t necessarily need for all other kinds of data.”

Jacobs’ measure explicitly prohibits the collection and sharing of reproductive health information, including info related to contraceptives, pregnancies and terminations, surgeries, menstruation, and even basal body temperatures. Over in the Senate, one of the main sponsors of that chamber’s companion bill is Finance Committee Chair Ron Wyden of Oregon. He says the Supreme Court went further than people realize by directly challenging the notion of a right to privacy.

“If you look at how sweeping the Alito opinion is with respect to privacy, I believe it’s uterus surveillance,” Wyden says. “It is women having their personal data weaponized against them.”

While ADPPA has the most momentum on Capitol Hill at the moment, it doesn’t go far enough for critics like Jacobs—even as she desperately wants Congress to pass privacy legislation. She says it’s not targeted enough at the issues now plaguing women coast to coast.

“We do need a big federal approach around data privacy and protection,” Jacobs says. “There’s an urgency to do protections now that are very specific to the kinds of things you would need for this kind of data.”

O HIPAA, Where Art Thou?

The Department of Health and Human Services issued new HIPAA guidelines this June intended to safeguard women’s reproductive data, and those were reinforced by an executive order President Biden signed in July. While appreciated, those efforts are not nearly enough for many Democrats, let alone people who are pregnant and in need of reproductive care.

“At the end of the day, this is not HIPAA-protected,” Congresswoman Raja Krishnamoorthi of Illinois says of the health-related data collected by many apps.

The Democrat serves on the Oversight Committee and is a part of an investigation looking into what health apps do with women’s data. This May, a study by JMIR Mhealth Uhealth examined the 23 most popular women’s mHealth apps and found 61 percent relied on geolocators, while only 52 percent even asked for users’ consent. A full 87 percent—20 of 23 tested—“shared user data with third parties.” The other three apps didn’t provide any information on data-sharing.

Krishnamoorthi finds that unacceptable.

“Women whose data is being shared widely for various reasons—often having to do with money in the pre-_Roe_ world—never consented to having that data shared by the companies to which they entrusted the information,” Krishnamoorthi says. “So you have a lot more apps sharing data with third parties than the number of apps, or the percentage of apps, that are actually asking for consent, and that’s disquieting.”

As women nationwide continue getting digitally groped in this conundrum of an era, Democrats want a rethinking of the ever-so-intimate relationships with our phones, tablets, watches, and laptops.

For the past few years, New York’s Kirsten Gillibrand has called for the creation of a new Data Protection Agency. The Democratic senator says it’s no longer a novelty—it’s a necessity.

“The whole theory behind the Data Protection Agency is we wanted to actually create a privacy harm—a definition of a privacy harm—and then create an agency that was going to oversee different platforms to make sure they weren’t undermining people’s privacy or stealing their data without their permission,” Gillibrand says. “It takes that out of Congress—which is slow and less informed—and creates an overseeing body that can do the thoughtful and nuanced work of, ‘How do you create oversight and accountability over different platforms?’”

Republicans Have Bedrooms Too

Gillibrand’s question raises another: How do you convince anti-abortion Republicans to help your party protect reproductive rights? The key seems to be avoiding abortion politics while focusing on the sweeping implications of the Supreme Court’s ruling.

“I think people can understand the right to privacy as a meta issue that they care deeply about, whether you’re a libertarian, whether you’re conservative, or whether you’re a liberal,” Gillibrand says.

New York’s junior senator says Republicans aren’t “connecting all the dots about what it means for them.”

“It is so expansive and so harmful, I don’t think people have fully understood what this could impact,” Gillibrand says. “I think for many people, they’re just putting their heads in the sand and saying, ‘Oh, this doesn’t relate to me.’ Unfortunately, that’s not what the language of the decision says.”

With Pelosi and Senate Majority Leader Chuck Schumer fully embracing the status quo they inherited via an apathetic congressional fiat, it’s still unclear which, if any, of these competing privacy measures could attract the necessary bipartisan support. But some in the GOP say they’re all in. In fact, even as more libertarian-leaning Republicans opposed _Roe v. Wade_, they also oppose some of the fallout sparked by its absence.

“I hate the idea of these apps tracking us and selling the data and doing any of that without consumers’ permission for any reason at all,” says Senator Josh Hawley of Missouri.

Unlike Democrats, Hawley agrees with the Supreme Court ruling that there’s no constitutional right to privacy for abortions. That’s a separate question altogether for Hawley.

“There are rights to privacy in the Constitution—Fourth Amendment, Fifth Amendment—but they’re the ones that actually exist in the Constitution and are spelled out there, and they’re long protected under case law,” says Hawley, a member of the Judiciary Committee.

Those underlying privacy rights, Hawley argues, are what Congress now must explicitly apply to the repositories of personal information most people never intended to be seen by anyone. Hawley says the debate goes well beyond reproductive data.

“And this is why—and I’m a former prosecutor—but a lot of prosecutors, they don’t like encrypted anything because it does make it harder to prosecute crimes, and I understand that,” Hawley says. “But I’m a pretty big fan of encryption because otherwise you don’t have any ability to control your own data.”

Madam Speaker

In this dystopian post-_Roe_ reality—one where the most intimate reproductive details of millions of Americans are being sold to brokers for portions of pennies or being passed from Mark Zuckerberg’s lawyers to local cops—Democratic leaders, from Pelosi and Schumer to Senate Commerce Chair Maria Cantwell, continue imperiling the chances of this Congress passing even basic data privacy protections. And, unlike recent sessions of Congress, failure isn’t an option for the Democratic rank and file.

“Many people were not aware exactly how much information is collected about their movements, and, frankly, they’re a little freaked out when they hear about it in the context of overturning _Roe_,” says Senator Warren. “If companies can make money by trading in your health information, your economic information, or your social preference information, then the implications of that echo throughout everything that’s happening in our lives.”

Schumer seems to have outsourced his opinion to Cantwell and Pelosi, who won’t back any measure that infringes on California’s privacy law. With California voters taken care of, in terms of access to _Roe v. Wade_\-era reproductive health, the pleading eyes of millions of Americans are now fixed on Pelosi.

“Well, she certainly schedules things on the floor,” Mississippi senator Roger Wicker—the top Republican on Cantwell’s Commerce Committee—told reporters as he boarded a streetcar at the Capitol last week. “She’s capable of blowing up the whole deal if she chooses to.”

The Shaky Future of a Post-Roe Federal Privacy Law

Peiter “Mudge” Zatko’s allegations about the social media platform renewed a sense of urgency for lawmakers to rein in Big Tech.

Many of Silicon Valley’s fiercest watchdogs on Capitol Hill are now snarling. Yesterday’s arresting testimony by Twitter’s former security chief, Peiter “Mudge” Zatko, has lawmakers in both parties redoubling their efforts to rein in the tech titans.

Zatko’s testimony before the Senate Judiciary Committee follows a detailed report he submitted to the US Department of Justice, the Securities and Exchange Commission, and the Federal Trade Commission late last month. His allegations, which were the central subject of yesterday’s hearing, range from claims of lax security protocols to negligent leadership—all of which Twitter denies.

Even as senators were left seething—guess they aren’t fans of Twitter’s 4,000 or so employees having easy access to their accounts and millions of others, as Zatko alleges—there’s also a sense of renewal in the air at the Capital.

“That was a fun one,” Republican senator Mike Lee told WIRED after the hearing.

The anger cloaked in elation is, in part, because many senators feel they now found the proverbial smoking gun.

“My guess is that this testimony today will trigger a lot of class actions,” Senator John Kennedy of Louisiana said after questioning the witness on Tuesday. “And it should.”

The Republican is referring to Zatko’s allegation that the social media platform lacks basic security measures, such as tracking which of the company’s hundreds of engineers are inside the platform making changes. This includes, according to Zatko, the potential mining of a United States senator’s own account.

“I’m assuming they have,” Kennedy said.

Hence the snarling. Like the rest of us, US senators are protective of their private data. And a growing consensus in Washington is that the FTC is ill-suited to take on social media giants who, according to Zatko, laugh off $150 million fines and all the demands the FTC places on bad tech actors.

“Maybe the thing to do is put it in the hands of private litigants,” Senator Josh Hawley of Missouri said. “Lawsuits are powerful things, so maybe it’s, we let the folks who are getting doxed and the folks who are getting hacked and whatever—we give them the power to go into court. Then you get discovery.”

While senators plan to ask Twitter officials to testify—likely with an assist from subpoenas—in response to the accusations from their former executive, they also don’t seem to be waiting. Senator Hawley is now trying to breathe new life into his out-of-the-box proposal to move the FTC’s tech portfolio to the Department of Justice, though he’s open to many reform ideas floating around Washington.

Hawley and outspoken senator Lindsey Graham, of South Carolina are renewing their calls to eradicate Section 230—the law, passed by Congress in the internet’s infancy, that protects online companies from certain kinds of litigation for content users publish on their platforms.

“You’ve got to license the people. Apparently, money doesn’t matter to them. Losing your ability to operate would matter,” Graham said. “So if you were licensed, then you have something you could lose.”

Graham has teamed up with Senator Elizabeth Warren of Massachusetts in calling for the creation of a new federal regulatory body focused on tech companies. While the two agree the FTC is currently incapable of overseeing Silicon Valley, they disagree on Section 230, which Graham has wanted to be reformed for some time.

The Twitter Whistleblower’s Testimony Has Senators Out for Blood

Yurii Shchyhol gives WIRED a rare interview about running the country’s Derzhspetszviazok and the state of the online conflict with Russia.

Yurii Shchyhol doesn’t have a lot of time to spare.

The head of the Derzhspetszviazok, Ukraine’s version of the US Cybersecurity and Infrastructure Security Agency, can be forgiven for working speedily. His country is under attack—and with it, the world order. “This is the first time ever in history that we’ve had such a full-fledged cyberwar happening right now in Ukraine,” says Shchyhol, who’s tasked with keeping Ukraine’s cyber territory safe in the same way president Volodymyr Zelensky oversees the country’s physical armed forces.

Skirmishes on the internet against Russian hackers weren’t new to Shchyhol, nor to the people he oversees as part of of the Derzhspetszviazok, also known as the State Service of Special Communications and Information Protection. Before invading Ukraine on February 24, Russia had been testing the defenses of Ukraine’s cybersecurity. Mostly it was persistent, low-level attacks, but one larger attack was launched on January 14, when Russia targeted more than 20 Ukrainian government institutions. The attack, designed to disrupt government-linked websites, leeched out into the wider Ukrainian internet. “We also identified that around 90 websites were not accessible as a result of that attack,” says Shchyhol. “The goal of the Russian hackers was to sow panic among the Ukrainian population, and to demonstrate to the outside world that Ukraine is a weak state that couldn’t handle the attacks,” he says. This is why the Derzhspetszviazok rushed to relaunch the sites affected. “The longest it took us for one site was close to one week,” he says. “No data was lost, and the outcome of this attack was more psychological warfare.”

When Russian soldiers began intruding into Ukraine’s physical territory, the attacks in cyberspace stepped up. For a full month, Russia targeted communications nodes, media, logistics, and railways, says Shchyhol. “At that time, there were lots of civilians—noncombatant Ukrainians fleeing to safer places,” he adds. “That’s why the goal of those attacks was to disrupt the work of communications lines, and railways in particular.”

We’re now in the third stage of Russia’s cyberwar against Ukraine, says Shchyhol—one that’s ongoing and perpetrated “mostly against civilian infrastructure: utilities and companies that render services to civilians, since they failed to destroy in the second phase our communication lines and our ability to keep people abreast of what’s going on.” Russia’s digital war playbook is similar to its physical warfare strategy, says the cybersecurity chief. “Our attitude remains the same,” he says. “We treat them as criminals trying to destroy our country, invading it on the land but also trying to disrupt and destroy our lifestyle in cyberspace. And our job is to help defend our country.”

Ukraine’s defense of its cyber assets has surprised some, who feared Russia’s much-hyped hacker army could quickly wipe out the country digitally—just as many in the international community worried Russia’s ground invasion was a foregone conclusion. But Vladimir Putin has already played his hand when it comes to cyberattacks, says Shchyhol, and Ukraine learned lessons. A 2017 attack launched by Russia using the NotPetya virus decimated the country—and broke out into the wider world, causing chaos wherever it spread. “Afterward, there was a couple of years when they were quiet,” says Shchyhol. “We recognized that’s because they were getting themselves prepared for more active attacks against our country, so we used that pause time to get ourselves prepared for the potential attacks.” Ukraine’s success in repelling the worst of Russia’s cyberattacks in 2022 demonstrates well how much the country analyzed and learned from previous skirmishes, says the cyber chief.

One thing that helped Ukraine learn Russia’s cyber MO was creating a database of attributed Russian attacks that were specified to particular hacker groups. Shchyhol says the Derzhspetszviazok learned that most groups were sponsored by either Russia’s intelligence service—the FSB, Russia’s post-Soviet successor to the KGB—or the Russian army. Shchyhol refutes the term “hacktivist” when used in relation to Russia. “A hacktivist is a person who does it from the generosity of his heart, free of charge,” he says. “These guys are sponsored by the state and receive a mandate to perpetrate crimes.” Knowing who was behind the attacks helped, Shchyhol says. “By virtue of realizing who is attacking us, it allowed us to be better and more successfully get prepared to repel those attacks,” he says.

The database Shchyhol and his institution developed helped Ukraine repel an attack against a Ukrainian energy-generating company Russia launched earlier this year. “They used the same virus for that that they used back in 2017,” he says. Back then, Russia used the Industroyer virus; the country deployed an updated version, called Industroyer 2, earlier this year. “Since we were ready for this type of attack, we were successful in repelling it, and thus prevented damage being caused to this company,” Shchyhol says. This prevented power blackouts for 2 million people, he adds.

Ukraine’s cybersecurity lead admits that at least one Ukrainian database has been wiped as a result of Russia’s reported widespread use of wiper malware: the government’s motor insurance policy bureau, responsible for issuing coverage for Ukrainian drivers. “For two weeks, this bureau wasn’t able to issue the insurance policies to their clients,” says Shchyhol. But the bureau—like many in Ukraine—was warned about the risks and had a backup that enabled it to return to normal operations relatively quickly.

“The efficiency of any cyber combat efforts should be judged not by the fact that we make it impossible for the attackers to attack us,” says Shchyhol. “The real test of how well we perform is the \[speed\] with which services can be relaunched, and the fact no important data is stolen by perpetrators.”

Ukraine’s defenses have also been bolstered by covering fire in the cyberwarfare field by pro-Ukraine hacktivists—here, he’s more willing to use the term. “I’m talking not only about the Ukrainian IT Army,” a Telegram group set up at the start of the invasion that had at its peak more than 300,000 subscribers, “but other hacktivists worldwide that joined the effort at the beginning of the invasion.” Shchyhol says that those hacktivists have provided much-needed help—even if there’s little proof that the hacktivist army made any meaningful impact. Indeed, one recent academic analysis compared their work to breaking into a disused shopping center in a small city and spray-painting “Putin sux” on the walls.

“Being a military person, I believe anything that weakens our enemy is good for us,” he says. But Shchyhol is keen to make it clear that’s his personal opinion—wanting to avoid any suggestion of collusion or organization by the Ukrainian state. “They are a self-organized community, operating by setting their own goals,” he says. “There is no coordination of their activities coming from the government of Ukraine, and no sponsoring of their activities. We, as the government of Ukraine, are not giving them any direct order to target, for instance, infrastructure.” Even if they were to do so, Shchyhol says, Russia and its infrastructure would be lawful targets because of “all the crimes they perpetrated here.”

But rather than targeting key infrastructure for offensive attacks from hacktivists, Shchyhol suggests that targeted moves by IT businesses can cause as much damage. In July, he called for international companies servicing Russia to withdraw from the country. “Our enemy currently employs tactics like hordes did back in the Middle Ages,” he says. “Trying to attack territory and modify countries to how they want them to look using blunt force. In order for them to continue using this blunt force, they rely on continuous access to modern technologies.”

Without that access, Shchyhol says, “they will be thrown back to the Middle Ages. Any technology that comes into Russian hands, they’ll immediately try to use it for military purposes.” He estimates that 95 percent of tech companies his agency, Ukraine’s vice-president, and other government officials have approached have already withdrawn from the Russian market. Those that have include Cisco, HP, IBM, and Dell.

As for companies that haven’t, Shchyhol has a simple message. “The whole civilized world needs to recognize that the threat goes beyond Ukraine,” he says. “Cyberspace has no boundaries. If there’s any attack perpetrated against the cyberspace of one country, by default it’s affecting and attacking other countries as well.”

Source

Wired