Democratic senators lacked actionable gun data for their negotiations—so they passed mental health reform instead.

“Yeah, I think that was,” Republican senator Thom Tillis says of Cornyn’s unscientific news clipping.

JFK’s Legacy

For Tillis, what truly unified the disparate group of progressives and conservatives was data—just not gun data. Instead, he says, their negotiations were most influenced by former president John F. Kennedy.

On October 31, 1963, Kennedy signed into law the Community Mental Health Act, a measure aimed at replacing asylums with community-based mental health clinics. Three weeks later, Kennedy was gunned down, burying the promise of his vision to reform mental health care in the US. In the ensuing decades, communities nationwide ditched asylums, but robust funding for local clinics never materialized.

In 2014, Congress passed the Excellence in Mental Health Act, which promised to be the realization of JFK’s now half-century-old dream. Republican senator Roy Blunt of Missouri and Democratic senator Debbie Stabenow of Michigan teamed up to pass those mental health reforms, and they have since tracked the pilot programs their law set up, initially, in eight states. Over a five-year period, these federally supported Certified Community Behavioral Health Clinics “had 63.2% fewer emergency department visits for behavioral health issues, saw a 40.7% decrease in homelessness and spent 60.3% less time in correctional facilities,” according to the Department of Health and Human Services.

Those results and related stats proved magnetic to Washington’s fiscal conservatives and defund-the-police progressives alike.

“It was critical because other people wanted to do something and had ideas, yet none of it was developed or actionable,” Stabenow says. “People felt like it was real. It was tangible.”

A huge selling point is that to be eligible for the federal program, states are required to set up 24-hour psychiatric crisis centers. That reduces police responsibility, which was appreciated by law enforcement groups nationwide, who don’t want officers charged with mental health duties. Hence, these local efforts were nationalized this summer as a part of the compromise measure.

“There were a few around the country, but no national effort to make this happen,” Blunt says. “We had a program working, producing significant results, widely supported by law enforcement, by emergency rooms, by families who didn't have the kind of relief they needed to the mental health problems peaceful people were facing.”

The Blunt-Stabenow mental health program provided Senate negotiators with around five years of unambiguous data from states as different as Oklahoma and New York. That proved essential to its inclusion.

“We started using as much data as we could to say, ‘This is a hypothetical, this is measurable,’” Tillis says. “It was tangible.”

That’s also why Cornyn’s not wrong when he bristles at the “gun control” label. Roughly two-thirds of the funding tucked into the new federal “gun” law goes to behavioral health. Lawmakers expect, based on results from those local pilot programs, to see a trickle-up effect nationwide as cops are (on paper, at least) replaced with much-needed mental health workers.

“We ended up going, ‘What are the root causes?’” Tillis says. “If we're taking a look at reducing gun deaths and taking a look at behavioral health, which is linked to a lot of these active shooter environments, it was using data to say, ‘What decisions could we make that would most likely make the best outcome?’”

Heavy Traffic

Then there’s the US-Mexico border. Mexico estimates that some 2 million proudly made-in-America guns have flooded its streets and those of its own southern neighbors, fueling incomprehensible—and unquantifiable—bloodshed. And the violence, in return, causes hundreds of thousands to flee their homes and risk death to head north annually.

One of the most dramatic changes tucked into the new law fundamentally alters the relationship between the United States and Mexico, as well as Guatemala, El Salvador, and Honduras (aka the Northern Triangle).

Don’t Call the New Federal Gun Law a Gun Law

The DOJ vows to protect people’s ability to travel out of state for abortion care, but legal experts warn we can’t take it for granted.

Now that Congress has failed to pass a bill that would guarantee a right to travel across state lines to obtain an abortion, many are worried that conservative states that have started restricting abortion rights could soon decide to block people seeking abortions from leaving their own state for that purpose. Many Republican lawmakers are already discussing this possibility. But would such drastic restrictions even be possible—or, at the very least, legal?

The Biden administration, aware that Congress will likely not act on abortion rights before the November midterms, has been making efforts to determine what the executive branch can do to protect abortion access on its own. President Joe Biden signed an executive order at the beginning of the month that directed the Department of Health and Human Services (HHS) to expand access to abortion pills, protect patient privacy, and more.

Following that executive order, the US Department of Justice announced the establishment of a Reproductive Rights Task Force, which will “monitor and evaluate” efforts to ban abortion pills, prevent someone from obtaining an abortion in a state where it is legal, or punish federal employees who provide health care that is legal at the federal level. How much the Department of Justice can do to protect the right to travel across state lines for an abortion, and whether states can ban people from doing so remain glaring unknowns.

In terms of what the Justice Department can do if a state were to ban traveling to obtain an abortion, the most likely response would be a lawsuit against that state. Mary Ziegler, a law professor at UC Davis, says the agency would argue that such a ban is unconstitutional. (The DOJ itself did not respond to a request for comment.)

Justice Brett Kavanaugh wrote in his concurring opinion in _Dobbs v. Jackson Women's Health Organization_, which overturned _Roe v. Wade_, that states may not ban people from traveling across state lines to get an abortion. That being said, Ziegler isn’t exactly confident the right to travel will remain protected.

“What Kavanaugh said was really vague. It’s true there’s a right to travel, but I don’t know how much that gets you,” says Ziegler. “There used to be a right to abortion, and now there is not. When the court is talking about unenumerated rights, that can change. Even if you take Kavanaugh at his word about this, that doesn’t answer all of the questions.”

The right to travel is generally seen as protected by the Fourteenth Amendment, and this has been upheld by the Supreme Court in the past. However, the right to an abortion was also seen as something that was protected by the Fourteenth Amendment until _Roe_ was overturned.

“I think efforts to try and deal with the right to travel—this is uncharted territory in a lot of ways. There’s not a lot of broad precedent about the right to travel,” says Melissa Murray, a law professor at New York University. “A lot of it is going to present issues that for some courts will feel or seem like a first impression.”

In order to avoid an anti-travel law being struck down by the courts, a state could craft legislation that effectively but not explicitly bans interstate travel. Texas’ SB 8, which banned abortion after six weeks prior to _Roe_ being struck down, was able to survive judicial review because it is effectively enforced by private individuals or groups, in the form of lawsuits, instead of the state. Interestingly enough, research from the University of Texas at Austin found that out-of-state travel dramatically increased following the passage of SB 8.

Rachel Rebouché, interim dean and a professor of law at the Temple University School of Law, says a lawsuit from the Department of Justice over anti-travel legislation may not be successful.

“SB 8 in Texas was unconstitutional, and it’s still in force. It was in force while there was _Roe_ on the books. I’m not sure we can predict with any certainty what future courts are going to hold,” says Rebouché. “There’s already case law of a law that a court could interpret as unconstitutional at the time it was passed being shielded from federal court review because of the kind of enforcement mechanism it has.”

Without Congress passing a law to protect the right to travel, it will likely be difficult for the Department of Justice to defend that right. Rebouché says the department needs to look at all of the laws that are already on the books, such as laws related to interstate commerce or civil rights, and see if there are any that would allow it to enforce the right to travel.

“The DOJ is a huge entity with so many moving parts, so many different kinds of powers and responsibilities. Thinking about how it could intervene means thinking creatively about where are these touch points of DOJ powers and duties that might touch on abortion access,” Rebouché says.

What is clear is that a showdown between the Department of Justice, states, and the courts is likely fast approaching. If the DOJ is going to prioritize protecting abortion access, it will have to do a full survey of every power it has available and hope the Supreme Court doesn’t decide that it doesn’t, in fact, have those powers.

Interstate Travel Post-Roe Isn’t as Secure as You May Think

Since Vladimir Putin blocked Facebook, Instagram, and Twitter in March, Russia has been pushing away from the global internet at a rapid pace.

Finally, Shakirov says, there is the “restriction of access to information”—blocking websites. The legal ability to block websites was implemented through the adoption of Russia’s sovereign internet law in 2016, and since then, Russia has been expanding its technical capabilities to block sites. “Now the possibilities for restricting access are developing by leaps and bounds,” Shakirov says.

The sovereign internet law helps to build upon the idea of the RuNet, a Russian internet that can be disconnected from the rest of the world. Since the start of the war against Ukraine in late February, more than 2,384 sites have been blocked within Russia, according to an analysis by Top10 VPN. These range from independent Russian news websites and Ukrainian domains to Big Tech and foreign news sites.

“The Russian government is continually trying to have more control over the content that people are able to access,” says Grant Baker, a technology and democracy research associate at nonprofit Freedom House. (Roskomnadzor, the country’s media and communications regulator, did not respond to a request for comment from WIRED.) All the internet control measures and surveillance systems, Baker says, are coupled with wider societal clampdowns, including the detention of more than 16,000 peaceful protestors and the increased use of face recognition.

But building a surveillance empire isn’t straightforward. China is widely considered the most restrictive online nation in the world, with its Great Firewall blocking websites that fall outside its political vision. This Chinese “sovereign” model of the internet took years to flourish, with even the creator of China's firewall reportedly getting around it using a VPN.

As Russia has aimed to emulate this Chinese model to some degree, it’s faltered. When officials tried to block messaging app Telegram in 2018, they failed miserably and gave up two years later. Building Russia’s vision of the RuNet has faced multiple delays. However, many of Russia's most recent policy announcements aren’t designed for the short term—controlling the internet is a long-term project. Some of the measures may never exist at all.

“It is still difficult to assess in detail the impact of all these measures, given the often-blurred distinction between a clear political signal and ambition from the Kremlin, and its effective translation into concrete projects and changes,” says Julien Nocetti, senior associate fellow at the French Institute of International Relations, who studies Russia’s internet.

For instance, multiple Russian language app stores have appeared in recent months, but many of them have few apps available for download. According to the independent newspaper _The Moscow Times_, one leading app store contender, RuStore, has fewer than 1,000 apps available to download.

Other sovereign internet efforts have floundered too. RuTube, Russia’s equivalent to YouTube, has failed to gain popularity despite officials pushing its use. Meanwhile, the website of Rossgram, a potential Instagram alternative that hasn’t launched yet, displays a message saying it is “under development” and warns people not to download versions of the app they may find online as they “come from scammers.”

While many of Russia’s sovereign internet measures have struggled to get off the ground, its ability to block websites has improved since it first tried to throttle Twitter in March 2021. And other nations are watching. “Countries are learning various internet regulation practices from each other,” Shakirov says. “Russia decided to make a Chinese version of its internet, and now other countries of the post-Soviet space, Africa, or Latin America can follow this example.”

Lokot says that as more nations look to regulate the internet and do so with their national security in mind, the internet itself is put at risk. “When the conversation changes from ‘the internet as a public good’ to the ‘internet, and internet access, as a matter of national security,’ the questions change,” Lokot says. “We will potentially see some really problematic choices made by states—and not just by authoritarian states, but also by democratic states.”

Russia Is Quietly Ramping Up Its Internet Censorship Machine

The next time someone wants to borrow your device to make a call or take a picture, take these steps to protect your privacy.

From the nephew who wants to play games for a few minutes, to the friend who wants to see your vacation snaps, to the stranger who needs to make a call, there are going to be people who want to borrow your phone.

That's quite a privacy and security risk if you think about everything that your phone gives you access to: social media profiles, banking details, instant messenger conversations, photos and videos that you'd rather the world didn't see, and so on.

However, there are ways to hand over your phone to someone else without having to worry about what they might get up to on it. You just need to make sure that you've taken a few precautions before the exchange takes place.

iPhone

Guided Access is built into iOS.

Apple via David Nield

(Apple via David Nield)

The feature you need to know about on the iPhone is called Guided Access, and you can enable it by opening up iOS Settings and choosing **Accessibility** and **Guided Access**. Turn the **Guided Access** toggle switch on and the feature is ready to go—just make sure you use **Passcode Settings** to set a passcode to protect Guided Access mode.

To actually turn Guided Access on, you need to triple-tap the home button if your iPhone has one, or the side button if it doesn't. You can then tap **Options** to configure how Guided Access is going to work: You're able to restrict access to the volume buttons, for example, and the software keyboard. You can even turn off touchscreen functionality and put a limit on Guided Access mode. Tapping **Start** launches Guided Access.

Whoever is using the iPhone is then locked into the current app, so you need to open up the app in question—the Phone app, a particular game, or whatever it is—before you triple-tap the button on your device to launch Guided Access. You get out of Guided Access with another triple-tap of the same button, at which point you'll need the passcode that you set at the start.

The idea is that without the passcode, the person using your iPhone can't get out of the app you've put them in—there's no way to switch apps, open up the Control Center, or even turn the phone off. It's worth being aware of the app that they're in, though, and what they can do inside that app: If you're showing someone your photos, they'll be able to access all of them.

One extra option in the Photos app is to hide photos and videos by opening them, tapping the share button (bottom left), and choosing **Hide**. This hides these pictures and clips in a special Hidden folder. They won't be visible in normal view in the Photos app, and they won't appear in searches, but the person borrowing your smartphone can still get at them by choosing **Hidden** from the **Albums** tab.

Android

Apps can be pinned inside Android.

Google via David Nield

If you're using an Android device, you can take advantage of a feature similar to Guided Access on iOS. It's called App Pinning, and again the idea is that the person borrowing your phone is limited to one app. They're not able to get to another app or access the phone's settings without a PIN code set by you.

There are certain software variations among Android phone makers when it comes to finding and enabling App Pinning, but you should be able to find it without too much trouble. On the stock version of Android that Google puts in its Pixel phones, you can enable it by going to the main Android Settings menu, then choosing **Security**, **Advanced Settings** and **App Pinning**.

Turn on the **Use App Pinning** toggle switch, and make sure that **Ask for PIN Before Unpinning** is enabled as well—this prevents everyone but you from switching apps. To find the app you want to pin, swipe up and hold from the bottom of the screen until you see thumbnails of your recently used apps. Find the one you want, tap the app icon at the top, and choose **Pin** from the drop-down menu. 

To get out of app pinning, swipe up and hold from the bottom of the screen again. The phone will be locked, and your PIN code will be required to regain access and move between apps. Assuming that the person borrowing your phone doesn't know your PIN, you'll be able to keep them in one app.

Like Apple Photos, Google Photos can also hide photos and videos, which can help if someone is browsing through your pictures. Open an image or clip, tap the three dots (top right), then choose **Move to Locked Folder**—the photos and videos that you send here can't be accessed without unlocking your phone first, which will require a PIN, a fingerprint scan, or a face scan, depending on how you've set it up.

How to Safely Lend Someone Else Your Phone

Plus: The FCC cracks down on car warranty robocalls, Thai activists get targeted by NSO's Pegasus, and the Russia-Ukraine cyberwar continues.

As the United States midterm elections near, lawmakers and law enforcement officials are on high alert about violent threats targeted at election officials across the country—domestic threats that have taken first billing over foreign influence operations and meddling as the primary concern for the 2022 elections. In another arena, though, Congress is making progress on generating bipartisan support for sorely needed and overdue privacy legislation in the form of the American Data Privacy and Protection Act.

Iranian women’s rights activists sounded the alarm this week that Meta has not been responsive to their concerns about targeted bot campaigns flooding their Instagram accounts during a crucial moment for the country’s feminist movement. And investigators looking at attacks on internet cables in Paris have still not determined who was behind the vandalism or what their motive was, but new details have emerged about the extent of the sabotage, making the situation all the more concerning and intriguing. 

The ACLU released documents this week that detail the Department of Homeland Security’s contracts with phone-tracking data brokers who peddle location information. And if you’re worried about Big Brother snooping on your reproductive data, we have a ranking of the most popular period-tracking apps by their data privacy protections. 

And there’s more. Each week we round up the news that we didn’t break or cover in-depth. Click on the headlines to read the full stories. And stay safe out there!

The Department of Homeland Security Inspector General told the Secret Service on Thursday to halt its investigation into the deletion of January 6 insurrection-related text messages because of an “ongoing criminal investigation” into the situation. Secret Service spokespeople have said conflicting things: that data on the phones was erased during a planned phone migration or factory reset, and that the erased messages were not relevant to the January 6 investigation. The Secret Service said it provided agents with a guide to backing up their data before initiating the overhaul process, but noted that it was up to the individuals to complete this backup. 

Zero Day spoke to Robert Osgood, director of the forensics and telecommunications program at George Mason University and a former FBI digital forensics examiner, about the situation. “Osgood said that telling agents to back up their own phones ‘makes absolutely no sense’— particularly for a government agency engaged in the kind of work the Secret Service does and required to retain records. The agency is not only charged with protecting the president, vice president and others, it also investigates financial crimes and cybercrime,” reports Zero Day author Kim Zetter. “I’m pro-government, and \[telling agents to back up their own phones\] sounds strange,” Osgood told Zetter. “If that did happen, the IT manager that’s responsible for that should be censured. Something should happen to that person because that’s one of the dumbest things I’ve ever heard in my life.'”

The Federal Communications Commission’s Robocall Response Team said on Thursday that it is ordering phone companies to block robocalls that warn about expiring car warranties and offer renewal deals. The FCC said that the calls, which are familiar to people around the US, have come from “Roy Cox Jr., Aaron Michael Jones, their Sumco Panama companies, and international associates.” Since 2018 or possibly earlier, their operations have resulted in more than 8 billion prerecorded message calls to Americans, the FCC said. “We are not going to tolerate robocall scammers or those that help make their scams possible," FCC chairperson Jessica Rosenworcel said in a statement. “Consumers are out of patience and I’m right there with them.”

After Apple warned a number of Thai activists and their associates in November that their devices might have been targeted with NSO Group’s notorious Pegasus spyware, a number of them reached out to human rights groups and researchers who established a broader picture of a campaign in Thailand. In all, more than 30 Thai victims have been identified. The targets worked with the local human rights group iLaw, which found that two of its own members had been victims of the campaign, as well as University of Toronto’s Citizen Lab and Amnesty International. The researchers did not provide attribution for who was behind the Pegasus campaigns, but found that a lot of the targeting occurred in the same general time when the targets were participating in protests against government policies.

Google’s Threat Analysis Group reported this week that it has seen Russia’s digital meddling continue apace, both in Ukraine as the Kremlin’s invasion rages on and in Eastern Europe more broadly. TAG detected the Russia-linked hacking group Turla attempting to spread two different malicious Android apps through sites that masqueraded as being Ukrainian. The group tried to market the apps by claiming that downloading them would play a role in launching denial of service attacks on Russian websites, an interesting twist given the civilian efforts in Ukraine to mount cyberattacks against Russia. TAG also detected activity from other known Russian hacking groups that were exploiting vulnerabilities to target Ukrainian systems and launching disinformation campaigns in the region.

Ukrainian officials also said this week that Russia had conducted an attack on Ukraine’s TAVR Media, hacking nine popular radio stations to spread false information that Ukrainian President Volodymyr Zelensky was in intensive care because of a critical ailment. The broadcast further claimed that Ruslan Stefanchuk, chairperson of the Verkhovna Rada, was in command in Zelensky’s stead. TAVR put out a statement on Facebook saying that the broadcasts did “not correspond to reality.” And Zelensky posted a video on his Instagram attributing the attack to Russia and saying that he is in good health.

The January 6 Secret Service Text Scandal Turns Criminal

As new details about the scope of the sabotage emerge, the perpetrators—and the reason for their vandalism—remain unknown.

At present, there’s little information about who may have been behind the attacks. No groups or individuals have claimed responsibility for the damage, and French police have not announced any arrests linked to the cuts. Neither the Paris Public Prosecutor’s Office nor Anssi, the French cybersecurity agency, responded to WIRED’s requests for comment.

In June, CyberScoop reported claims that “radical ecologists” who oppose digitalization may be behind the attacks. However, multiple experts speaking to WIRED were skeptical of the suggestion. “It’s quite unlikely,” Combot says. Instead, in many potential sabotage instances he has seen, those who attack telecom infrastructure aim to target cell phone towers where damage is obvious and claim responsibility for their actions.

In France—and more widely around the world—there’s been an increase in attacks against telecom towers in recent years, including cutting cables, setting fire to cell phone towers, and attacking engineers. When the Covid-19 pandemic started in early 2020, there was an uptick in attacks against 5G equipment as conspiracy theorists falsely believed the network standard could be dangerous to people’s health.

While some caution against assuming environmentalist groups were behind the April attacks, there is a precedent for such actions in France: A December 2021 investigation by environmental news outlet _Reporterre_, as noted by CyberScoop, documented more than 140 attacks against 5G equipment and telecom infrastructure. The attacks were said to show a pattern based on “refusal of a digitized society.”

In one of the other biggest attacks against French networks, more than 100,000 people found themselves struggling to get online in May 2020 after several cables were cut. During the past three months, there have been an estimated 75 attacks against telecom networks in France. The total number of attacks has declined since 2020, however.

Combot says the April attack was one of the “biggest incidents” targeting telecom infrastructure in recent years. It also highlights the fragility of local internet cables. “Breaking the internet is not a good thing for those who have the idea to do so, because the internet is locally vulnerable but globally resilient,” Guillaume says.

While cutting cables and setting fire to cell phone towers can cause temporary internet outages or slowdowns, internet traffic can usually be rerouted relatively quickly. In short: It’s very hard to take the internet offline at scale. The internet can largely withstand human sabotage, damage from natural events, and Canadian beavers chomping through cables.

This doesn’t mean threats to connectivity can’t cause widespread disruption. “I fear that these attacks, in France and elsewhere in the world, will happen again,” Combot says. “There are vulnerable points everywhere in the world,” he adds, highlighting Egypt, where subsea cables pass between Europe and Asia. In June the EU published an in-depth review of subsea internet cables that says more should be done to protect them.

DE-CIX’s King says that most incidents around cables are usually accidents, such as damage from roadworks or earthquakes. “The solution is to introduce redundancy in the design of connectivity,” King says. This means having more connections in the internet’s backbone and systems to replace others in case of potential failures or attacks. Every system should have a backup.

Political and technical measures could decrease the chances of attacks on network connections. “The best way to fight against these attacks is to have a better threat intelligence,” says Oxford’s Laudrain. The French Telecoms Federation says it is working more closely with law enforcement to try to stop those who would attack cables. “Some companies publish confidential network information on their websites,” Lumen’s Modlin says. “They should seriously consider removing exact location data, given its sensitive nature.” (She did not name the companies.)

Meanwhile, Guillame says simple physical security measures can be taken, such as ensuring that areas where cables are accessible through the ground are covered by security cameras. Others suggest adding movement sensors to these locations. Preventing internet cables and equipment from damage and destruction is crucial, Guillame says. “Behind the digital economy, there are small businesses, artisans, schools, emergency services hard hit when they can no longer connect their service. It’s not acceptable.”

The Unsolved Mystery Attack on Internet Cables in Paris

While cybersecurity and foreign meddling remain priorities, domestic threats against election workers have risen to the top of the list.

In the lead-up to the 2018 midterm elections in the United States, law enforcement, intelligence, and election officials were on high alert for digital attacks and influence operations after Russia demonstrated the reality of these threats by targeting the presidential elections in 2016. Six years later, the threat of hacking and malign foreign influence remain, but 2022 is a different time and a new top-line risk has emerged: physical safety threats to election officials, their families, and their workplaces.

In July 2021 the Department of Justice launched a task force to counter threats against election workers, and the US Election Assistance Commission released security guidance for election professionals. But in public comments this week, lawmakers, top national security officials, and election administrators themselves all expressed concern that misinformation about the security and validity of US voting continues to shape a new threat landscape going into the midterms.

“In New Mexico, the conspiracies about our voting and election systems have gripped a certain portion of the electorate and have caused people to act,” New Mexico’s Secretary of State and top election official Maggie Toulouse Oliver testified before the House of Representatives Homeland Security Committee yesterday. “During the 2020 election cycle, I was doxxed and had to leave my home for weeks under state police protection. Since 2020, my office has certainly seen an uptick in social media trolling, aggrieved emails, and calls into our office, and other communications that parrot the misinformation circulating widely in the national discourse. But more recently, especially since our June 2022 primary election, my office has experienced pointed threats serious enough to be referred to law enforcement.”

In a discussion on Tuesday about midterm election security at the Fordham International Conference on Cyber Security in New York City, FBI director Christopher Wray and NSA director Paul Nakasone emphasized that federal intelligence and law enforcement view foreign adversaries that have been active during past US elections—including Russia, China, and Iran—as potential threats heading into the 2022 midterms. But threats against election workers now appear at the top of their list.

“We are … positioning ourselves to understand our adversaries better, so we do have a series of operations that we’re conducting now and in the future as we approach the fall,” Nakasone said on Tuesday. “But I think the other piece of it is, this isn’t episodic, this for us is a persistent engagement that we have across time, in terms of being able to understand where our adversaries are at, what they’re trying to do, where we need to impact them, understanding how they’re getting better.”

When asked how the FBI handles misinformation that stems from foreign influence operations but ultimately embeds itself in the domestic psyche, Wray said that the Bureau simply has a set of enforcement mandates around elections that it focuses on carrying out.

“We’re not the truth police,” he told the conference. “It’s not to say there isn’t an important role for calling out falsity versus truth, it’s just that our contributions are fairly specific. We’re targeting foreign malign influence. We are investigating malicious cyber actors, whether they are foreign or otherwise, that target election infrastructure—so cyber activity. We are investigating federal election crimes, and that covers everything from campaign finance violations, to voter fraud and voter suppression, to something that we’ve seen an alarming amount of over the last little bit—threats of violence against election workers, which we’re not going to tolerate.”

Wray added that threats against election officials are currently a priority for the FBI. “These are people who are engaging in tireless and really, frankly, selfless work to ensure free and fair elections for all of us, and the idea that they would become the target of threats of violence is totally unacceptable,” Wray said.

In a US Election Assistance Commission discussion on election official security last week, Sheriff Peter Koutoujian of the Middlesex Sheriff’s Office in Massachusetts noted that state and local law enforcement are also dealing with questions of how best to protect election officials.

“We all witnessed the rhetoric and the threats leveled towards officials … during the 2020 election,” he said. “You can see them still being leveled against election officials this past spring during local elections as well as in reference to upcoming state and federal elections this fall. In law enforcement, we need to make sure that we’re following up on threats of violence as appropriate and protecting these individuals and thus protecting our democracy.”

The shift in the threat landscape is significant. Election officials and security researchers have focused over the past two decades on raising awareness about the need for better coordination and stronger digital security protections across the diverse patchwork of local election systems that is a hallmark of US voting. But with that work still in progress and in need of funding, threats to election officials could undercut hard-won progress.

“While we are now on the right track to secure our election infrastructure against cyberattacks, new and different threats, many with domestic roots, have arisen, including threats of physical harm to our election officials, their families, and their staff," Elizabeth Howard, senior counsel at New York University’s Brennan Center for Justice, told the House Homeland Security Committee during yesterday's hearing. “Not surprisingly, these threats are leading to additional serious concerns, such as an alarming number of election officials leaving the profession, which are contributing to the fragility of our democracy."

In her testimony, Howard urged Congress to allocate more funds for protecting election officials and to direct federal agencies to focus on the issue and combat misinformation about election integrity in any way possible. 

John Katko, a Republican from New York and ranking member of the House Homeland Security Committee, summed up the challenge bluntly: “A lot of the problems with election security are generated, it seems like to me, from the internet and the ability of cowards to hide behind the internet and foment discontent online, and then make that discontent actionable by nutjobs locally.”

With the November midterms less than four months away, the need to protect election officials grows more urgent by the day, not only for workers and their families but also for US stability more broadly. As Koutoujian put it, “If we’re not protective and careful of what we do now—I believe we’re more fragile than we think we are.”

The 2022 US Midterm Elections' Top Security Issue: Death Threats

A bill with bipartisan support might finally give the US a strong federal data protection law.

Usually, when Congress is working on major tech legislation, the inboxes of tech reporters get flooded with PR emails from politicians and nonprofits either denouncing or trumpeting the proposed statute. Not so with the American Data Privacy and Protection Act. A first draft of the bill seemed to pop up out of nowhere in June. Over the next month, it went through so many changes that no one could say for sure what it was even designed to do. For such an important topic, the bill’s progress has been surprisingly under the radar.

Now comes an even bigger surprise: A new version of the ADPPA has taken shape, and privacy advocates are mostly jazzed about it. It just might have enough bipartisan support to become law—meaning that, after decades of inaction, the United States could soon have a real federal privacy statute.

Perhaps the most distinctive feature of the new bill is that it focuses on what’s known as data minimization. Generally, companies would only be allowed to collect and make use of user data if it’s necessary for one of 17 permitted purposes spelled out in the bill—things like authenticating users, preventing fraud, and completing transactions. Everything else is simply prohibited. Contrast this with the type of online privacy regime most people are familiar with, which is all based on consent: an endless stream of annoying privacy pop-ups that most people click “yes” on because it’s easier than going to the trouble of turning off cookies. That’s pretty much how the European Union’s privacy law, the GDPR, has played out.

“The reason I really like this bill is, it takes a data-minimization approach first,” says Sara Collins, senior policy council at Public Knowledge, a consumer advocacy group in DC. “The bill at the outset is like, ‘One, you don't collect any more data than you reasonably need, and, two, here’s a list of reasons you might need this data.’”

A major caveat is that the list of reasons includes targeted advertising, which is the economic driver of most commercial surveillance in the first place. So the bill falls well short of simply banning the practice, which is what many data-privacy advocates would prefer. On the other hand, it imposes much stricter limits on targeted advertising—and the data collection supporting it—than any law in the US and perhaps the world. It would completely prohibit targeting ads to minors, something Joe Biden called for in his 2022 State of the Union address. It would ban targeting ads based on “sensitive data.” That category includes things like health information, precise geolocation, and private communications—as well as “information identifying an individual’s online activities over time and across third-party websites or online services.” In other words, companies would no longer be allowed to follow you around the internet, gathering data on everything you do and using it to sell you stuff.

“I think it’s a pretty fundamental shift,” says Alan Butler, executive director and president of the Electronic Privacy Information Center. “It gets at the heart of what I see as the major privacy problem in the way that ad tech has developed over the last 20 years, largely because there was no privacy law in effect. What’s developed is an ad tech industry that just gorges on personal information in every possible way it can, grabbing every possible piece of data they can find about people.”

Under the new version of the ADPPA, Butler says, some forms of targeting would remain common, particularly targeting based on first-party data. If you shop for shoes on Target.com, Target could still use that information to show you ads for shoes when you’re on another site. What it wouldn’t be able to do is match your shopping history with everything else you do on the web and on your phone to show you ads for stuff you’ve never told them you wanted. Nor could Facebook and Google continue to spy on you by placing trackers on nearly every website or free app you use, in order to build a profile of you for advertisers.

“If they’re tracking your activity across third-party websites, which they certainly are, then that’s sensitive data, and they can’t be processing that for targeted advertising purpose,” says Butler.

To the extent that the new bill would still allow targeted advertising, it would require companies to give users the right to opt out—while prohibiting the sorts of tricks that companies often use to nudge users to click “Accept all cookies” under the GDPR. And it would direct the Federal Trade Commission to create a standard for a universal opt-out that companies would have to honor, meaning users could decline all targeted advertising in one click. (That’s an important feature of California’s recently adopted privacy law.)

The ad industry seems to agree that the bill would mark a fundamental shift. Yesterday, the Association of National Advertisers, a trade group, issued a statement opposing the bill on the grounds that it would “prohibit companies from collecting and using basic demographic and online activity data for typical and responsible advertising purposes.”

Apart from its data-minimization approach, the new bill contains quite a lot of provisions that data privacy experts have long called for, including transparency standards, anti-discrimination rules, increased oversight for data brokers, and new cybersecurity requirements.

Federal privacy legislation has been something of a white whale in DC over the last few years. Since 2019, a bipartisan agreement has supposedly been just around the corner. The effort kept stalling because Democrats and Republicans were divided on two key issues: whether a federal bill should preempt state privacy laws, and whether it should create a “private right of action” allowing individuals, not just the government, to sue companies for violations. Democrats are generally against preemption and in favor of a private right of action, Republicans the reverse.

The new bill represents a long-sought compromise on those issues. It preempts state laws, but with some exceptions. (Most notably, it empowers California’s brand-new privacy agency to enforce the ADPPA within the state.) And it contains a limited private right of action, with restrictions on the damages that people can sue for.

The bill has other shortcomings, inevitably. The universal opt-out requirement is nice, but it won’t mean much until the largest browsers, especially Chrome and Safari, add the feature. The bill gives the FTC new authority to issue rules and enforce them, but it doesn’t direct any new resources to the agency, which already lacks the staff and funding to handle everything on its plate.

As a result, not everyone in the privacy camp is on board. On Tuesday, a group of mostly blue-state state attorneys general sent a letter to the committee objecting to the preemption provision. And the Electronic Frontier Foundation tweeted on Wednesday that it is “disappointed” by the compromises in the bill.

On the whole, however, the ADPPA seems wildly popular both on the Hill and among advocacy organizations. It has the support of leading privacy and civil rights nonprofits, and the House Commerce Committee voted to advance it by a 53-2 margin—an overwhelmingly bipartisan consensus that bodes well for the bill’s prospects when the full House votes on it. During yesterday’s markup hearing, several members noted that while the bill isn’t perfect, it’s simply politically impossible to pass a federal privacy law that doesn’t involve compromise on those two key issues.

Even the tech industry hasn’t launched any public campaign to kill the bill. You could take this as a sign that it’s actually too weak to trouble the industry. But Adam Kovacevich, the CEO of Chamber of Progress, a Big Tech lobbying group, points out that even the bill’s liberal critics have acknowledged that it goes further than any of the state laws it would preempt—even California’s. “I don’t think anyone in industry is crazy about the idea of the private right of action, the idea of more lawsuits,” he says. But, he adds, tech companies have already spent years learning to comply with the growing web of privacy regimes around the world. A somewhat stricter law might not be so bad if it provides a clear, fixed national standard.

None of this means that the ADPPA is sure to become law, of course. In the Senate, Maria Cantwell, the top Democrat on the Commerce Committee, has not gotten behind the effort yet, though her Republican counterpart has. And time is running out for that sclerotic body to pass any major laws before next year, when Democrats will almost surely lose their governing trifecta.

Still, privacy advocates are cautiously optimistic. “You’re looking at a situation where you have bicameral, bipartisan support, with Republicans and Democrats on board on the House and Senate side,” says Butler. “I don’t think we’ve ever been this close.”

Congress Might Pass an Actually Good Privacy Bill

The ACLU released a trove of documents showing how Homeland Security contracted with surveillance companies to scour location information.

For years, people have wondered not if, but how much, the Department of Homeland Security accesses mobile location data to monitor US citizens. This week, the American Civil Liberties Union released thousands of heavily redacted pages of documents that provide a “glimpse” of how DHS agencies came to leverage “a shocking amount” of location data, apparently purchasing data without following proper protocols to ensure they had the authority to do so.

Documents were shared with the ACLU “over the course of the last year through a Freedom of Information Act (FOIA) lawsuit.” Then Politico got access and released a report confirming that DHS contracted with two surveillance companies, Babel Street and Venntel, to scour hundreds of millions of cell phones from 2017 to 2019 and access “more than 336,000 location data points across North America.” The collection of emails, contracts, spreadsheets, and presentation slides provide evidence that “the Trump administration's immigration enforcers used mobile location data to track people's movements on a larger scale than previously known,” and the practice has continued under Biden due to a contract that didn't expire until 2021.

The majority of the new information details an extensive contract DHS made with Venntel, a data broker that says it sells mobile location data to solve “the world's most challenging problems.” In documents, US Customs and Border Patrol said Venntel's location data helped them improve immigration enforcement and investigations into human trafficking and narcotics.

It's still unclear whether the practice was legal, but a DHS privacy officer was worried enough about privacy and legal concerns that DHS was ordered to “stop all projects involving Venntel data” in June 2019. It seems that the privacy and legal teams, however, came to an agreement on use terms, because the purchase of location data has since resumed, with Immigration and Customs Enforcement signing a new Venntel contract last winter that runs through June 2023.

The ACLU still describes the practice as “shadowy,” saying that DHS agencies still owed them more documents that would further show how they are “sidestepping” the “Fourth Amendment right against unreasonable government searches and seizures by buying access to, and using, huge volumes of people's cell phone location information quietly extracted from smartphone apps.” Of particular concern, the ACLU also noted that an email from DHS's senior director of privacy compliance confirmed that DHS “appeared to have purchased access to Venntel even though a required Privacy Threshold Assessment was never approved.”

DHS did not comment on the Politico story, and neither the DHS agencies mentioned nor the ACLU immediately responded to Ars' request for comment.

The ACLU says that no laws currently prevent data sales to the government, but that could change soon. The ACLU endorses a bill called the Fourth Amendment Is Not for Sale Act, which is designed to do just that. Even if that bill is passed, though, the new law would still provide some exceptions that would allow government agencies to continue tracking mobile location data. The ACLU did not immediately respond to comment on any concerns about those exceptions.

How to Stop Location Data Tracking

The main question being debated is whether a Supreme Court decision in 2017 that said police must have a warrant to search cell phone data applies to government agencies like DHS. It's a gray area, the Congressional Research Service says, because “the Supreme Court has long recognized that the government may conduct routine inspections and searches of individuals entering at the US border without a warrant” and that “some federal courts have applied the 'border search exception' to allow relatively limited, manual searches at the border of electronic devices such as computers and cell phones.”

DHS isn't the only government agency that considers itself an exception, though. In 2021, the Defense Intelligence Agency also purchased location data without a warrant, bypassing the 2017 Supreme Court decision because the Department of Defense has its own "Attorney General-approved data handling requirements."

It's all part of a troubling pattern that shows a growing preference for the practice across many government agencies that have considered themselves exempt from legal concerns over the past few years.

Now, as privacy concerns over data tracking by law enforcement have heightened in post-_Roe v. Wade_ America, more mobile phone users are considering ways to keep their data private.

The first step for many might be to stop sharing location data with untrustworthy apps or maybe even entirely. Any time an app asks to track location data, users can either opt in or out. The ACLU told Politico that this opt-in process is what gives third-party vendors like Venntel the right to grant government access to data, claiming users have given permission to share with the government just by opting in.

“It's very clear that when people are doing that, they're not expecting that that's going to be potentially creating this massive database of their entire location history that's available to the government at any time,” Shreya Tewari, the Brennan fellow for the ACLU's Speech, Privacy and Technology Project, told Politico.

For mobile phone users concerned about DHS data tracking, users can specifically opt out of Venntel data collection.

There's not enough information identifying other contracts DHS might have with other vendors selling location data. The ACLU did not comment on the next steps to retrieve the rest of the DHS documents the organization requested, but its initial FOIA request asked for all contracts “concerning government access to or receipt of data from commercial databases containing cell phone location information.” That information may come in a future document dump, as the ACLU lawsuit states, but history proves DHS is not always prompt to respond. The ACLU waited nine months for a response before suing and noted at that time that “DHS has even refused to provide its legal memorandum about these practices to US senators who have requested it.”

The Fourth Amendment Is Not for Sale Act was introduced in Congress in April last year, where it was read twice and then referred to the Committee on the Judiciary. A request for an update on the bill's progress from one of its most vocal authors, Senator Ron Wyden, Democrat of Oregon, did not yield an immediate response. The ACLU advises that officials act sooner rather than later, saying, "Lawmakers must seize the opportunity to end this massive privacy invasion without delay. Each day without action only allows the government's covert trove of our personal information to grow."

_This story originally appeared on_ _Ars Technica__._

The DHS Bought a ‘Shocking Amount’ of Phone-Tracking Data

Under increased scrutiny, certain period-tracking apps are seeing a surge of new users. Which are as safe as they claim to be?

This not only shifts the burden of risk assessment to individual users, but also makes evaluating the privacy and security of apps difficult to begin with. To do so, we consulted evaluation frameworks pioneered by the Beth Israel Deaconess Medical Center (MIND) and The Digital Standard to arrive at four core questions to guide our study.

\*A score of (0) = the app did not fulfill the privacy requirement, (1) = the app partially fulfilled the privacy requirement, (2) = the app fulfilled the privacy requirement, and (3) = the app fulfilled the privacy requirement well

\*\*’Clear specification’ is defined here as an index of third-party companies and the data they receive.

Local vs. Cloud Storage

Understanding _where_ companies store your data is pivotal to assessing the privacy risk that comes with using their products. Most popular mobile apps store user data in the cloud—across multiple servers in multiple locations—which allows them to process large amounts of easily recoverable information. It also means that your data is more vulnerable to bad actors. This is why organizations like Givens’ prefer apps that store information directly on users’ devices. If an app stores data directly on your mobile phone, you’ll have more complete control of it. None of the apps reviewed above gave users the option to store their data locally, but Euki and Mozilla Foundation-backed Drip do.

Third-Party Sharing

If you’ve used Facebook to log in to a website or app recently, you’re already familiar with some of the ways that app developers share information with third parties. Understanding which third parties a company works with and what type of data is passed on to them is a helpful way to evaluate your level of protection. For example, Period Tracker’s privacy policy admits to sharing users’ device IDs with advertising networks, which is quite risky. It also expresses their willingness to sell or transfer user data as a result of a corporate merger or sale. Typically, apps who lay out plainly who they’re providing info to and why—like Clue does —are more trustworthy.

It’s also helpful to know whether data is routinely anonymized (stripped of identifying user information) before being shared with these third parties. However, this isn’t a panacea. Stripped-down data can still lead back to individual users under certain conditions. Machine learning makes this threat even more real, since the technology can speed up shady “re-identification” processes. Despite vowing to refrain from sharing user data themselves, Clue passes on anonymized data to certain third-party research groups. While Stardust expresses a commitment to limiting the information they share with third parties, their policy states it could share information in order to “comply with or respond to law enforcement,” or to protect the “security of the Company.” Ideally, apps are extremely selective with which third-parties they’re willing to share info with—or they don't share with third-parties at all.

Data Deletion

Every app should have established protocols that allow users to delete their personal data from the developers’ systems at will. While many US-based apps include these protocols to comply with the EU’s General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), users should look out for privacy policies that _clearly_ extend these erasure privileges to all users, regardless of location. Even so this can be tricky, says Givens: “If you’re not a resident of the jurisdiction that the law is covering, there’s no guarantee that they are going to honor it.”

Even apps that invite data deletion requests may not always execute them in a timely or complete fashion. Flo, whose security practices placed them under FTC scrutiny in 2021, states specifically in their privacy policy that upon deletion of their app, they “retain your personal data for a period of 3 years in case you decide to re-activate.” Period Tracker admits to retaining users’ mobile device IDs “for up to 24 months” after receiving a request. The safest apps should retain your data for 30 days or less, and ideally submit deletion requests to third parties on your behalf, like Clue does.

Location Tracking

If an app explicitly stores location data (like Period Calendar and Period Tracker do) it presents a greater privacy issue. While three out of the five apps analyzed here didn’t appear to save location data explicitly, each app saves users’ IP addresses, which can be used to determine someone’s general location. Flo, for example, explicitly shares IP addresses with third-parties such as AppsFlyer.

Stardust’s practices decouple users’ IP addresses from their health data, which increases security. But critics say their methods fall short of true end-to-end encryption. Regardless, when IP addresses are combined with outside data, such as a user’s search history or even other publicly available information about the user, they can easily reveal that person’s identity and their activities. The CDT and other privacy advocates have warned that users’ text messages and search histories have already been used against them in legal proceedings involving their reproductive health, and the practice is likely to expand.

The Bottom Line

At the end of the day, a period-tracking app like Clue presents users with slightly less risk than apps like Flo, Stardust, Period Calendar, and Period Tracker. However, all five of these apps, chosen for their outsize popularity, falter when compared with more secure options like Euki and Drip, as corroborated by Consumer Reports. Insofar as it’s possible for users to analyze _all_ of their apps according to standards set forth in The Digital Standard, Mhealth Index, and elsewhere, users can make educated decisions about which companies to align with—but evaluating the risks of using specific apps is an imperfect science. In addition to being extremely time consuming and often confusing, it’s nowhere near a suitable replacement for a lack of widespread legal privacy protections available for all Americans.

According to privacy experts like Givens, period-tracking apps represent the tip of the iceberg when it comes to digital privacy and security post-_Roe_. The CDT recommends that people assess their own risk level in order to determine whether using a period-tracking app is even worth it. In the meantime, taking steps to secure your personal information like text messages and search histories is probably more worthwhile.

For those looking to make a difference, experts recommend advocating directly to tech companies, especially precedent-setting organizations like Google and Meta (formerly Facebook) to demand better individual protections. It’s these corporations that will eventually have to respond to requests from law enforcement for user data, and many already promise to curtail their surveillance (but also lobby aggressively against privacy legislation and regulation). To pave the way for better policy, tech companies should aim to take serious inventory of the data they’re collecting, file transparency reports regularly, and, most importantly, take public stances in defense of privacy rights early and often.

Source

Wired