The encrypted-email company, popular with security-conscious users, has a plan to go mainstream.

Since its founding in 2014, ProtonMail has become synonymous with user-friendly encrypted email. Now the company is trying to be synonymous with a whole lot more. On Wednesday morning, it announced that it’s changing its name to, simply, Proton—a nod at its broader ambitions within the universe of online privacy. The company will now offer an “ecosystem” of linked products, all accessed via one paid subscription. Proton subscribers will have access not just to encrypted email, but also an encrypted calendar, file storage platform, and VPN.

This is all part of CEO Andy Yen’s master plan to give Proton something close to a fighting chance against tech giants like Google. A Taiwanese-born former particle physicist, Yen moved to Geneva, Switzerland, after grad school to work at CERN, the nuclear research facility. Geneva proved a natural place to pivot to a privacy-focused startup, thanks to both Switzerland’s privacy-friendly legal regime and to a steady crop of poachable physicists. Today, Yen presides over a company with more than 400 employees and nearly 70 million users. He recently spoke to WIRED about the enduring need for greater privacy, the dangers of Apple's and Google's dominance, and how today’s attacks on encryption recall the rhetorical tactics of the War on Terror.

This interview has been condensed and lightly edited.

**WIRED: You're in the online privacy business. To start super broadly, how do you define privacy?**

**Andy Yen**: These days, all Google and Apple and Big Tech talk about is privacy, so the best way to give our definition is to give the contrast. The way Google defines privacy is, “Nobody can exploit your data, except for us.” Our definition is cleaner, more simple, and more authentic: Nobody can exploit your data—period. We literally want to build things that give us access to as little data as possible. The use of end-to-end encryption and zero-access encryption allows that. Because fundamentally, we believe the best way to protect user data is to not have it in the first place.

**If you ask someone, “Would you like more privacy or less?” they always say more. But if you watch how people actually behave, for most people, data privacy is not a very high priority. Why do you think that is?**

Privacy is inherent to being human. We have curtains on the windows, we have locks on our doors. But we tend to disconnect the digital world from the physical world. So if you take the analogy of Google, it's someone that's following you around every single day, recording everything that you say and every place you visit. In real life, we would never tolerate that. On the internet, somehow, because it's not visible, we tend to think that it's not there. But the surveillance that you don't notice tends to be far more insidious than the one that you do.

**Your company has come out in support of reforms to strengthen antitrust enforcement. But a lot of people argue that privacy and competition are in conflict. Apple will say, “If you force us to allow more competition on the platform that we run, then that will reduce our control over the security and the privacy of the user. So if you make us increase competition, that will bring privacy down.” And then you see the flip side of the argument, which is when Apple or Google implements some new privacy feature that may hurt competitors. How do you think about these potential conflicts?**

What Apple is basically claiming is, you need to let us continue our use of app store practices because we're the only company in the world that can get privacy right. It’s an attempt to monopolize privacy, which I don’t think makes any sense.

If you look at the FTC lawsuit against Facebook, the theory is that privacy and competition are two sides of the same coin. If you're not happy with Facebook's privacy practices, what is the alternative social media that you can go to other than Facebook and Instagram? You don't really have that many options. We need more players out there. If they had to compete, then competition would force privacy to be a selling point.

The same is true for other services that we offer. Today, Google controls the Android operating system, which is used by the majority of people, and they can preload all their applications as a default on your user devices. So they have a massive advantage already because users don't change the defaults. So even though their privacy practices are quite terrible for most people, there's no real pressure to change it because the alternatives don't really exist. And if they do exist, Google's able to hide them, because they set the defaults on their devices. So if you want to fix the privacy issue, the best way to do it is to have more competition, because then there will be user choice, and users tend to choose what is more private, because, as you said, everybody wants more privacy.

**Europe’s new Digital Market Act has a controversial section requiring the biggest messaging platforms to let competitors interoperate with them, while still preserving end-to-end encryption. But quite a lot of people** **argue** **that you can't actually do both of those things. So here's a place where privacy and competition really do seem to be conflicting with each other technologically.**

I have to say, this has been around since the early '90s. PGP is basically interoperable encryption, based on the email standard. So it may not be technologically the easiest to do. But to say it’s technologically impossible is also not correct.

**Another EU proposal** **would require companies to implement methods of detecting child sex abuse material, or CSAM, on their platforms. People are very alarmed about the implications of that for encryption.**

We're still in the process of analyzing it, so I can’t comment specifically on the details of the proposal. But these proposals are not new. In fact, they've been coming up in various forms over the past decade. What is novel and different this time is that these proposals used to be packaged under “terrorism.” Now, they’re packaged under CSAM. It was very clever to repackage this idea into a topic that is even more toxic, which makes informed debate difficult. Obviously, CSAM is a horrible problem, something that the world is better without. But a wholesale attack on encryption can have unforeseeable consequences that are not always completely understood or considered by the drafters of these proposals.

**Do you think that this** _**is**_ **a wholesale attack on encryption, though? The people making these proposals say, “We're not attacking encryption. You just have to figure out a way to monitor for CSAM.”**

Well, there is really no practical way in today's technology to do that in a way that doesn't weaken encryption.

**The analogy to terrorism is interesting because, during the Bush-era War on Terror, there was a sense of literally anything being justified in the name of stopping terrorism. The US government was secretly spying on its own citizens. It was really hard to argue that we have to accept that some terrorism is going to happen. It's even harder to say, look, we've got to accept that some amount of child exploitation is going to happen and people are going to use digital tools to spread it. But at some point, I think you do have to defend the principle that we have to tolerate a certain amount of even the very worst things if we want to have meaningful civil liberties.**

If there was no privacy in the world, that world would be more “secure.” But that world does exist; it's called North Korea. And the people that live there probably don't feel very secure. As a democracy, you have to strike the right balance. The balance is not total mass surveillance of everybody, because we know that there are serious consequences to democracy and freedom as a result of that. It's not easy to find the right balance. But during the Bush years, with terrorism, I think they went to an extreme that really was a backsliding on democracy. And this is something that we need to avoid.

**But then on the flip side,** **you read stories** **about law enforcement catching really bad criminals, and in a lot of those stories, if that person had used a Tor browser and a ProtonMail account and a VPN, and so on, they might not have been caught. Do you ever worry about a future where all the bad guys get smart enough to use the best privacy tools, and it becomes too easy to evade the legal system entirely?**

Well, encryption and privacy technologies are what I would call dual-use. What is law enforcement also concerned about these days? People’s information being stolen, sensitive communications being hacked, emails of political campaigns being stolen by state actors and disseminated to shift the political balance. In order to prevent all of those potential ills, you need privacy, encryption, and good security. So, the same tools that people in law enforcement criticize are actually the same things that are shielding a lot of the internet ecosystem and the economy from a disastrous outcome. If you were to weaken or prohibit all of these security tools and privacy tools, then you would open the floodgate to a massive amount of cybercrime and data breaches.

**Proton has grown a lot over the years, but it’s still basically a rounding error compared to something like Google. We’ve talked about competition from a regulatory perspective, but on a practical level, how do you even try to compete with your massive rivals?**

The current plan is the launch of the Proton ecosystem. It's one account that gives you access to four privacy services: Proton Mail, Proton Calendar, Proton Drive, and Proton VPN. One subscription that gives you access to all those services. It's the first time anybody has taken a series of privacy services and combined them to form a consolidated ecosystem. That doesn't match all of Big Tech’s offerings, of course. But I think it provides, for the first time, a viable alternative that lets people say, “If I really want to get off of Google, I can now do it, because I have enough components to live a lot of my daily life.” For the first time, you’ll have a privacy option that’s not fully competitive with Google, but reasonably competitive, and that will start to break the dam. I don't know how it will go, but I think this is the future of privacy, and that’s why we're doing it.

**This is probably the first time I have ever thought about having an encrypted calendar.**

A calendar is essentially a record of your life: everybody you've met, everywhere you’ve been, everything that you have done. It's extremely sensitive. So you don't intuitively think about protecting that, but actually, it's essential.

**And by making that encrypted, who am I protecting that information from?**

Maybe it's the government requesting information on you. Maybe it's a data leak. Maybe it's a change in business model of your cloud provider at some point in the future that decides that they want to monetize user data in a different way. Your data is just one acquisition away from going across the border to a country that you didn't expect when you signed up for the service.

**Right. Elon Musk is about to own all my Twitter DMs.**

Exactly right. And with end-to-end encryption, no matter what happens, it's your data; you control it. It's just a mathematical guarantee.

**But what if I move all my stuff to the Proton ecosystem, and then like four years from now, you go out of business? What happens to my stuff?**

Proton has been around for eight years now. In the tech space, that's a long time. I think an indicator of what is sustainable in the long term is alignment between the business and the customers. Our business model is simple: Premium users pay us to keep theie data private, and our only incentive is to keep it private. Sometimes the easiest and simplest models are the ones that are the most durable. I strongly believe that Proton will be a company that outlives us.

Proton Is Trying to Become Google—Without Your Data

Intelligence collected from public information online could be impacting traditional warfare and altering the calculus between large and small powers.

An open source panopticon—from commercial big data aggregation to information infrastructure across mobile, smart devices, and social media—is reshaping the way intelligence is collected and used in conventional war.

Open source intelligence is information that can be readily and legally accessed by the general public. It was used in war and diplomacy long before the internet—alongside information stolen or otherwise secretly obtained and closely held. But its prevalence today means what was once cost-prohibitive to many is now affordable to myriad actors, whether North Korea, the CIA, journalists, terrorists, or cybercriminals.

One consequence of widely available open source information is that anonymity is eroding, not only for ordinary civilians, but also for members of law enforcement, military, and the intelligence community. Even missing information can alert an adversarial spy service, says a former US intelligence official who spoke on background. When the US State Department unfolded a public diplomacy strategy in 2008 that emphasized the use of social media, a foreign counterpart joked to the former US intelligence official that CIA officers, working under nonofficial cover at US embassies, were easily deduced because they lacked Facebook profiles. The US government has a gargantuan effort underway to address similar issues brought on by an absence or expectation of digital exhaust associated with intelligence officers’ cover identities.

When it comes to modern intelligence collection, closed societies like North Korea, Russia, and Iran have an advantage against open ones. Both secrecy and transparency—or the control of information, whether by individuals or governments—are integral to the freedom and security of those individuals and societies. Closed societies can collect an open one’s information with ease, all the while preventing access to similar information from domestic political opponents or hostile foreign actors.

But too much secrecy on the part of governments and militaries—including those of Russia’s Vladimir Putin—can also prevent them from knowing themselves, which may contribute to strategic blunders. Information technology, by its nature, disintegrates boundaries. It erodes barriers to markets across sectors and societies: from journalism to intelligence, crime to terrorism—and now it seems, with Russia’s invasion of Ukraine, conventional war.

Intelligence isn’t just information, says Jeff Rogg, a historian of US intelligence whose work focuses on civil-intelligence relations. The objective of intelligence, compared to just information, is obtaining or maintaining an advantage over one’s adversaries—whether that intelligence is secret or open source. This principle is at play when the Biden administration declassifies intelligence in an unprecedented manner in order to counter Russian misinformation or shares secret intelligence with Ukrainian counterparts.

“Given the emphasis placed on open sources in the war in Ukraine, it’s easy to forget how successful intelligence outcomes can also depend on secrecy, and even a bit of deception. Attributing successes in Ukraine to open sources can also offer a cover of sorts for more closely held sources and methods,” says Rogg.

British scholar Matthew Ford, coauthor of an upcoming book on the impact information infrastructure and connected devices have on conventional military conflicts, calls the phenomenon “radical war.”

Ford says that the high level of mobile connectivity among Ukrainians and a notable absence of combat footage from smartphones and headcams, especially in the early phases of the war, suggest an effective information operation may be underway. “No doubt the Ukrainians fear such images will reveal their tactics, techniques, and procedures,” says Ford. So Ukrainians may simply be censoring themselves.

Social media platforms and cell phones are also a force multiplier for traditionally weaker military powers, like Ukraine, especially when it comes to coordinating intelligence collection for targeting activities. “Targeting information is now being exchanged online,” Ford says. “Successful kills have been celebrated on Telegram. Chatbots have been established, helping Ukrainians share target coordinates with their smartphones. Identifying targets doesn’t involve complex military systems; it works from civilian information infrastructures.”

“The problem with crowdsourced intelligence in a war like Ukraine is standardizing the reporting,” Ford says. For example: “You want to be able to identify the vehicle, geo-locate it, then map against any available signals or satellite imagery, or other collection disciplines, fusing it into actionable target information.”

The Russian invasion of Ukraine is not only the 21st century’s first conventional war in Europe, it is the “most digitally connected in history,” according to Ford. “If the Ukrainians can make that intelligence actionable quicker than the Russians, they can use their limited remote fires, artillery, drones, and maybe even missiles or air power effectively. The objective, therefore, is to find, fix, and finish Russian forces more quickly than the Russians can do this themselves.”

When Russia launched its full-scale invasion in late February, the US, its allies, and Russia concluded that Ukraine’s forces were asymmetrically disadvantaged against Putin’s endowed and historically brutal counterpart. US officials expected the country to fall in days. Yet despite the US’s monumental success predicting Russia’s intentions and plans and offering warnings, American intelligence agencies incorrectly assessed Ukraine’s prospects—the current subject of an internal review.

Facing the full onslaught of Russia's armed forces, Ukraine’s military resilience may even have come as a bit of a surprise to Ukrainians themselves, Ford suspects. Yet mistaken judgments about the expected balance between strong and weak powers, accompanied by strategic surprise, may be a common occurrence in the information age. Before the acknowledged role of social media in fueling the Arab Spring, or the reported significance of thumb drives in more recent counterintelligence failures—telecommunications, open source infrastructure, and cheap and accessible consumer technology have impacted the parity calculus for state and non-state actors alike.

Indeed, it was the worldwide growth of telecommunications in the 1990s that empowered Al-Qaeda to conduct its successful covert military attacks on US soil on September 11, 2001. But in the run-up to those attacks, the US Department of Defense hadn’t drafted a net assessment on the military or intelligence capabilities of what was later described by the 9/11 Commission as America’s “most dangerous foreign enemy.” The concept was unimaginable then, but it shouldn’t be now.

Similarly, the intelligence community had not authored a national estimate that comprehensively evaluated or articulated the strategic threat posed by Al-Qaeda before its 2001 attack. This category of cognitive bias is called the “paradox of expertise.” Genuine experts may communicate incredible nuance and understanding of a subject but overlook indicators of seismic changes within the domains of their knowledge.

It’s also possible to make analytical errors by overstating or inflating the impact or outcomes of technology and information on civil society—or any domain—including conventional war. The internet, which promised us a techno-utopian commune of open source information, has arguably turned large swaths of civil society into psychedelic hellscapes, much like the Charles Manson murders after the Summer of Love.

Civilian noncombatants’ use of open source platforms and consumer devices in support of hostile military actions raise serious questions about blurred lines between civilian and combatant—lawful or otherwise—leading to the same subjects becoming legitimate targets or tried for espionage under the laws of war. Civilians are legally protected under international humanitarian law, as long as they are not party to military conflicts.

According to recent reports, US intelligence support led to the successful targeting of Russian generals and the _Moskva_, Russia’s flagship in the Black Sea. “One of the intelligence concerns people have voiced is that these leaks unnecessarily raise the risks of escalation,” Rogg says. “But consider the Javelins, Stingers, and military hardware we are publicly providing. The US and its allies are fighting an overt—as compared to covert—proxy war against Russia. That’s one of the key distinctions in this conflict from, for example, US support to the mujahideen in Afghanistan in the 1980s, which is one of the popular comparisons you read about today: The US is taking a risk by abandoning some of the hallmarks of intelligence and advantages of covert action, like plausible deniability. That being said, there is still plenty that we do not know. Putting aside all the reporting, leaks, and official disclosures, the exact role and impact of US intelligence in Ukraine will be a source of study and debate for years to come.”

Open Source Intelligence May Be Changing Old-School War

A new report lays out existing US police surveillance capabilities that can easily be repurposed to monitor pregnant people.

In the three weeks since a draft opinion leaked from the United States Supreme Court promising to roll back the federal constitutional right to abortion in the United States, reproductive rights activists and privacy advocates have been working to understand the reality of how such a shift will impact Americans. And a new report from the Surveillance Technology Oversight Project, published on Tuesday, lays out the ways in which police, prosecutors, and private litigants will be able to lean on existing data-access mechanisms and tracking tools to enforce state abortion bans.

The research underscores what privacy advocates have been warning about for decades: A surveillance state built to track certain types of behavior can easily, and inevitably, be adapted to other ends.

“None of the tactics we will see used to target pregnant people will be new,” says Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project. “We’ve seen these same surveillance techniques developed in the name of immigration enforcement, national security, combatting drugs, and so many other law enforcement priorities. And the truth is that when you develop those techniques, you are at the whim of those in power and whatever they next decide to call a crime.”

Without a federally recognized right to abortion in the United States, massive quantities of data generated and collected about consumers, web users, and anyone who interacts with digital systems can be tapped by investigators seeking information about pregnant people. And tech companies will face law enforcement requests for user data related to abortion investigations. STOP emphasizes that geofence warrants—the investigative technique in which law enforcement requests data from devices used in a set area during a specified time range—are a prime example of a controversial surveillance mechanism that can, and likely will, be easily repurposed to investigate people who may be seeking or may have gotten abortions. Similarly, investigators could use keyword search warrants to identify and track people who use search engines to find information about abortion, providers, or abortifacients.

STOP, which is based in New York, is advocating that the state pass proposed legislation to ban keyword and geofence warrants, a law which would be the first of its kind in the US and could offer a template for other states to follow.

The research also points out that pro-choice states will need to reexamine local, inter-state, and federal data-sharing initiatives—including participation in “fusion centers” that allow multiple law enforcement groups to share information. These and other controversial policing initiatives to combat terrorism and track undocumented Americans could quickly be expanded to investigate pregnant people, reproductive healthcare workers, and others. A recent investigation by Georgetown Law's Center on Privacy & Technology showed just how far the US Immigration and Customs Enforcement agency has been able to expand its surveillance powers by partnering with local and state agencies and combining numerous data sources into what the researchers dubbed the “American Dragnet.”

STOP also warns that the law enforcement tactic of creating fake social media accounts to trick people into revealing their interests or intentions will slot into abortion investigations easily. 

“In digital security and data privacy, we always say that it's all about how motivated your adversary is,” says Andrea Downing, founder of the nonprofit Light Collective and a security and privacy researcher focused on patient populations and social media. “And in this case, so much of our data as individuals is already out there. Some kind of combination of your fertility data, your dating app history, your location data, your shopping—you can see how that can paint a picture without you realizing it. And that's not any one person's fault.”

The STOP research echoes the idea that while individuals can take steps to protect themselves and their data from prying eyes, ultimately structural change and legislation is needed to shield individuals.

“Just because we’ve had years of this seemingly endless government surveillance, it doesn’t mean it’s inevitable. It’s not the technology that makes the choice, it’s the lawmakers," STOP's Fox Cahn says. "But for now, what we keep saying to each other in the office is that after _Roe_, things won’t look like 1973. It'll look like _1984_.”

The Surveillance State Is Primed for Criminalized Abortion

The world-leading data law changed how companies work. But four years on, there’s a lag on cleaning up Big Tech.

One thousand four hundred and fifty-nine days have passed since data rights nonprofit NOYB fired off its first complaints under Europe’s flagship data regulation, GDPR. The complaints allege Google, WhatsApp, Facebook, and Instagram forced people into giving up their data without obtaining proper consent, says Romain Robert, a program director at the nonprofit. The complaints landed on May 25, 2018, the day GDPR came into force and bolstered the privacy rights of 740 million Europeans. Four years later, NOYB is still waiting for final decisions to be made. And it’s not the only one.

Since the General Data Protection Regulation went into effect, data regulators tasked with enforcing the law have struggled to act quickly on complaints against Big Tech firms and the murky online advertising industry, with scores of cases still outstanding. While GDPR has immeasurably improved the privacy rights of millions inside and outside of Europe, it hasn’t stamped out the worst problems: Data brokers are still stockpiling your information and selling it, and the online advertising industry remains littered with potential abuses.

Now, civil society groups have grown frustrated with GDPR’s limitations, while some countries’ regulators complain the system to handle international complaints is bloated and slows down enforcement. By comparison, the information economy moves at breakneck speed. “To say that GDPR is well enforced, I think it’s a mistake. It's not enforced as quickly as we thought,” Robert says. NOYB has just settled a legal case against the delays in its consent complaints. “There’s still what we call an enforcement gap and problems with cross-border enforcement and enforcement against the big players,” adds David Martin Ruiz, a senior legal officer at the European Consumer Organization, which filed a complaint about Google’s location tracking four years ago.

Lawmakers in Brussels first proposed reforming Europe’s data rules back in January 2012 and passed the final law in 2016, giving companies and organizations two years to fall in line. GDPR builds upon previous data regulations, super-charging your rights and altering how businesses must handle your personal data, information like your name or IP address. GDPR doesn’t ban the use of data in certain cases, such as police use of intrusive facial recognition; instead, seven principles sit at its heart and guide how your data can be handled, stored, and used. These principles apply equally to charities and governments, pharmaceutical companies and Big Tech firms.

Crucially, GDPR weaponized these principles and handed each European country’s data regulator the power to issue fines of up to 4 percent of a firm's global turnover and order companies to stop practices that violate GDPR's principles. (Ordering a company to stop processing people’s data is arguably more impactful than issuing fines.) It was never likely that GDPR fines and enforcement were going to flow quickly from regulators—in competition law, for instance, cases can take decades—but four years after GDPR started, the total number of major decisions against the world’s most powerful data companies remains agonizingly low.

Under the dense series of rules that make up GDPR, complaints against a company that operates in multiple EU countries are usually funneled to the country where its main European headquarters are based. This so-called one-stop-shop process dictates that the country leads the investigation. The tiny nation of Luxembourg handles complaints against Amazon; the Netherlands deals with Netflix; Sweden has Spotify; and Ireland is responsible for Meta’s Facebook, WhatsApp, and Instagram, plus all of Google’s services, Airbnb, Yahoo, Twitter, Microsoft, Apple, and LinkedIn.

A glut of early and complex GDPR complaints has led to backlogs at regulators, including the Irish body, and international cooperation has been slowed down by paperwork. Since May 2018, the Irish regulator has completed 65 percent of cases involving cross-border decisions—400 are outstanding, according to the regulator's own stats. Other cases, launched by NOYB against Netflix (Netherlands), Spotify (Sweden), and PimEyes (Poland) have all also dragged on for years.

Europe’s data regulators claim GDPR enforcement is still maturing and that it is working well and improving over time. (Officials from France, Ireland, Germany, Norway, Luxembourg, Italy, the UK, and Europe’s two independent bodies, the EDPS and EDPB, were all interviewed for this article.) The number of fines has ramped up as the legislation has aged, hitting a running total of €1.6 billion (around $1.7 billion). The biggest? Luxembourg fined Amazon €746 million ($790 million), and Ireland fined WhatsApp €225 million ($238.5 million) last year. (Both companies are appealing the decisions). At the same time, one lesser-known Belgian fine could change how the entire ad tech industry works. However, officials concede that changes to the way GDPR is enforced could speed up the process and ensure swifter action.

Helen Dixon is at the heart of Europe’s GDPR enforcement, with the Irish Data Protection Commission (DPC) responsible for an outsized number of Big Tech firms. The DPC has faced criticism for struggling to keep up with the number of complaints under its purview, drawing ire from fellow regulators and calls to reform the body. “If everything comes at you at the same time, clearly there’s going to be a lag in terms of prioritizing and dealing sequentially with the issues while standing up what is a very significant legal framework,” Dixon says, defending her office’s performance. Dixon says the DPC has had to handle GDPR’s complexity from scratch, leading to many cases and new processes, and there aren’t simple answers for many of them.

“I would classify the DPC as being very effective in the first four years of application of the GDPR,” Dixon says. “The fact that DPC has stood up a new legal framework that many described as 'the law of everything' in a couple of short years, and implemented what are very significant sanctions in the form of fines and corrective measures already in that time period” shows its success, Dixon says. The organization has enforced measures against Twitter, WhatsApp, Facebook, and Groupon, among thousands of national cases, during this time.

“There should be an independent review of how to reform and strengthen the DPC,” says Johnny Ryan, a senior fellow at the Irish Council for Civil Liberties. “We cannot know from outside what the problems are.” Ryan adds that blame can’t just be leveled at the Irish regulator. “The European Commission has immense power. The GDPR is supposed to be an immense project. And the Commission has neglected the GDPR,” he says. “It doesn't just propose the laws, it also has to see that they are applied.”

So far, the European Commission has backed enforcement of GDPR in Ireland and across the continent. “The Commission has consistently called on data protection authorities to continue stepping up their enforcement efforts,” Didier Reynders, the European Commissioner for Justice, says in a statement. “We have launched six infringement procedures under the GDPR.” These legal cases include action against Slovenia for failing to import GDPR into its national law and questioning the independence of the Belgian data authority.

However, following a complaint from Ryan in February, the EU Ombudsman, a watchdog for European institutions, opened an inquiry into how the Commission has been monitoring data protection in Ireland. (The Ombudsman says the Commission has until May 25 to reply, after asking for its initial deadline to be extended. Reynders says the Commission does not comment on ongoing inquiries). If the Commission does look into Ireland, it could make recommendations, says Estelle Massé, the global data protection lead at Access Now, a technology-focused civil rights organization. “There is an issue, and if you don't intervene in this way, I don’t really see how the situation will resolve,” Massé says. “It has to go through an infringement procedure.”

Despite clear enforcement problems, GDPR has had an incalculable effect on data practices broadly. EU countries have made decisions in thousands of local cases and issued guidance to organizations to say how they should use people’s data. Spain’s LaLiga soccer league was fined after its app spied on users, retailer H&M was fined in Germany after it saved details about employees’ personal lives, the Netherlands’ tax body was fined over its use of a ‘blacklist,’ and these are just a handful of the successful cases.

Some of GDPR’s impact is also hidden—the law isn’t just about fines and ordering companies to change—and it has improved company behaviors. “If you compare the awareness about cybersecurity, about data protection, about privacy, as it looked like 10 years ago and it looks today, these are completely different worlds,” says Wojciech Wiewiórowski, the European Data Protection Supervisor, who oversees GDPR cases against European institutions, such as Europol.

Companies have been put off using people’s data in dubious ways, experts say, when they wouldn’t have thought twice about it pre-GDPR. One recent study estimated that the number of Android apps on Google’s Play store has dropped by a third since the introduction of GDPR, citing better privacy protections. “More and more businesses have allocated significant budgets to doing data protection compliance,” says Hazel Grant, head of the privacy, security, and information group at London-headquartered law firm Fieldfisher. Grant says that when GDPR decisions are made—such as Austria’s decision to make the use of Google Analytics unlawful—companies are concerned about what it means for them. “Four or five years ago, that enforcement wouldn't have happened,” Grant says. “And if it had happened, maybe a few data protection lawyers would have known about it—it wouldn't have been out there with clients coming to us saying we need advice on this.”

But at Big Tech levels where data is plentiful, the scale of complying with GDPR is different. One recent internal Facebook document obtained by Motherboard hints that the company doesn't really know what it does with your data—an assertion Facebook denied at the time. Equally, a WIRED and _Reveal_ joint investigation at the end of 2021 found serious shortcomings in the ways Amazon handles customer data. (Amazon said it had an “exceptional” track record in protecting data.)

Microsoft declined a request to comment. Neither Google nor Facebook provided comment in time for publication.

“There is a lag, especially on Big Tech, enforcing the law on Big Tech—and Big Tech means cross-border cases, and that means the one-stop-shop and the cooperation among the data protection authorities,” says Ulrich Kelber, the head of the German federal data protection regulator. The one-stop-shop allows all of Europe’s regulators to have a say on the final decision of the lead regulator in that case, which can then be challenged. Ireland’s fine against WhatsApp grew from the original proposed penalty of as little as €30 million ($31.8 million) to €225 million ($238.5 million) after other regulators weighed in. Another Irish case against Instagram is currently being discussed, Dixon says, which will add months to its final outcome.

The one-stop-shop was created under GPDR, meaning the process has started with teething problems, but four years in, a lot still needs to be improved. Tobias Judin, the head of international at Norway’s data protection authority, says that each week several drafts of decisions are circulated among Europe’s data regulators. “In the vast majority of those cases, we actually agree,” Judin says. (German authorities object the most.) Decisions can face a lot of back and forth between regulators, wrapped up in bureaucracy. “We do question whether, in those cases that have a European-wide impact, it makes sense and whether it is feasible that these cases are solely dealt with by one data protection authority until we reach the decision stage,” Judin says.

Luxembourg’s data regulator hit Amazon with a record-breaking €746 million ($790.6 million) fine last year, its first case against the retailer. Amazon is contesting the fine in court—in a statement to WIRED, the company repeated its assertion that “there has been no data breach, and no customer data has been exposed to any third party”—but Luxembourg’s regulator says investigations will always be lengthy despite it bringing in new ways to investigate companies. “I think under one year or one-half year, I think it’s almost impossible to have it closed before such a delay,” says Alain Herrmann, one of Luxembourg’s four data protection commissioners. “There are huge \[amounts of\] information to deal with.” Herrmann says Luxembourg has a few other international cases ongoing, but national secrecy laws prevent it from talking about them. “It’s just the \[one-stop-shop\] system, the lack of resources, the lack of clear law and procedure, which makes their job even more difficult,” Robert says.

The French data regulator has, in some ways, sidestepped the international GDPR process by directly pursuing companies’ use of cookies. Despite common beliefs, annoying cookie pop-ups don’t come from GDPR—they’re governed by the EU’s separate E-Privacy law, and the French regulator has taken advantage of this. Marie-Laure Denis, the head of French regulator CNIL, has hit Google, Amazon, and Facebook with hefty fines for bad cookie practices. Perhaps more importantly, it has forced companies to change their behavior. Google is altering its cookie banners across the whole of Europe following the French enforcement.

“We are starting to see really concrete changes to the digital ecosystems and evolution of practices, which is really what we are looking \[for\],” Denis says. She explains that CNIL will next look at data collection by mobile apps under the E-Privacy law, and cloud data transfers under GDPR. The cookie enforcement effort wasn’t to avoid GDPR’s protracted process, but it was more efficient, Denis says. “We still believe in the GDPR enforcement mechanism, but we need to make it work better—and quicker.”

In the last year, there have been growing calls to change how GDPR works. “Enforcement should be more centralized for big affairs,” Viviane Redding, the politician who proposed GDPR back in 2012, said of the data law in May last year. The calls have come as Europe passed its next two big pieces of digital regulation: the Digital Services Act and the Digital Markets Act. The laws, which focus on competition and internet safety, handle enforcement differently from GDPR; in some instances, the European Commission will investigate Big Tech companies. The move is a nod to the fact that GDPR enforcement may not have been as smooth as politicians would have liked.

There appears to be little appetite to reopen GDPR itself; however, smaller tweaks could help improve enforcement. At a recent meeting of data regulators held by the European Data Protection Board, a body that exists to guide regulators, countries agreed that some international cases will work to fixed deadlines and timelines and said they would try to “join forces” on some investigations. Norway’s Judin says the move is positive but questions how effective it will be in practice.

Massé, from Access Now, says a small amendment to GDPR could significantly address some of the biggest current enforcement problems. Legislation could ensure data protection authorities handle complaints in the same way (including using the same forms), explicitly lay out how the one-stop-shop should work, and make sure that procedures in individual countries are the same, Massé says. In short, it could clarify how GDPR enforcement should be handled by every country.

The view is also shared by data regulators, at least to some degree. France’s Denis says regulators should share more information, more quickly on cross-border cases so they can build up an informal consensus around a potential decision. “The Commission could also, for example, look at resources given to data protection authorities,” Denis says. “Because it’s a member state’s obligation to give sufficient resources to data protection authorities to carry out their duties.” The staff and resources regulators have to investigate and enforce is dwarfed by those of Big Tech.

“Potentially, if there was the possibility for some kind of an instrument specific to the GDPR—being a legal instrument—that would specify certain process and procedural issues, that might assist,” Ireland’s Dixon says. She adds that complications that could be ironed out include issues around access to files during investigations, whether those making the complaints are given access to the investigation process, and problems in translations. “There’s a whole range of inconsistencies around that, giving rise to delays and dissatisfaction on all sides,” Dixon says.

Without some changes—and strong enforcement—civil society groups warn that GDPR could fail to stop the worst practices of Big Tech companies and improve people’s sense of privacy. “The immediate thing that needs to be addressed is the Big Tech firms,” Ryan says. “If we cannot deal with Big Tech, we will create a permanence to the fatalism that people feel about privacy and data.” Four years in, Massé says she still has hope for GDPR enforcement. “It's really not what we had hoped for. But it’s also not in a place that I think we can start digging a grave for the GDPR and forget about it.”

How GDPR Is Failing

You don't want just anyone in your inbox. Here's how to take control.

When it comes to Facebook, most of us will have a contacts list covering years and even decades of our lives—recent acquaintances among people we've known since high school, neighbors we saw yesterday right next to old family friends we haven't seen since we were much younger.

Whatever you think about Facebook, there's no doubting its reach, and with billions of people on the platform it's important that you're contactable only to the people that you'd like to hear from.

The good news is that Facebook has plenty of tools and options to help you with this, and we've outlined the most important below. This is best done in a desktop web browser, where you can easily access all of the relevant Facebook settings.

Limiting Who Can Find You

It's possible to limit who can find you on Facebook.

Facebook via David Nield

(Facebook via David Nield)

If other people can't find you, they can't contact you. If you go to the Facebook Privacy Checkup page and choose **How people can find you on Facebook**, you can go step by step through the relevant settings. With friend requests, for example, you can allow anyone on Facebook to ask to be connected to you, or limit it to friends of friends—that means only those people who already know someone you're linked to will be able to send you a friend request.

You can also set whether people can find you via your email address and phone number. (If your details are in someone's phone contacts, Facebook might suggest you as a friend to them.) If you want to, you can keep these details private, so no one can find you via these pieces of information.

The final option in this particular section of the Facebook settings lets you decide whether you want your profile to be visible on search engines. If you'd rather your Facebook profile didn't pop up when someone types your name into Google, turn off the toggle switch next to **Do you want search engines outside Facebook to link to your profile?** before clicking on **Next** to review your settings.

Limiting Who Can See What You Share

You can set the audience for each Facebook post you share.

Facebook via David Nield

If other people can't see what you're sharing on Facebook, they can't comment on it or react to it. Every time you post something on the social network, you get what's called an audience selector menu—the drop-down just above the area where you compose the message that you want to post.

From the Facebook Privacy Checkup page on the web, you can click **Who can see what you share** to choose what the default setting is for this audience selector. If you want your posts to be seen only by a certain group of people, or by everyone on Facebook except for a few contacts, you can configure this here.

There's also a section called **Limit past posts**. If you click the **Limit** button underneath it, any older posts that were shared with an audience of friends of friends or indeed anyone on the web will be locked down so only your current Facebook friends can view them.

Facebook Messenger

Choose what happens with messages from people you don't know.

Facebook via David Nield

Anyone you’re Facebook friends with can send you a direct message via Facebook Messenger, so if you don't want this to happen then you need to unfriend or block them. (See below for more details on this.)

Anyone else who's on Facebook can message you too, but these messages don't go directly to your inbox: Instead, they go to a message requests folder. On the desktop interface or inside the mobile app, click or tap your profile picture (top left), then pick **Message requests** to see these messages. You can reply to these messages to continue the conversation, or ignore or delete them.

From the mobile Messenger app, tap your profile picture then **Privacy** and **Message delivery** to decide whether friends of friends and non-friends on Facebook can send you message requests at all.

Unfriending and Blocking

Blocking someone on Facebook takes only a few minutes.

Screenshot: Facebook via David Nield

Friends that you are connected to on Facebook can contact you much more easily than people who aren't. To sever a connection with someone, visit their profile page on Facebook and click **Friends** then **Unfriend**.

For people who you absolutely do not want to hear from on Facebook, use the block feature. Blocked individuals won't be able to see what you post on Facebook, they won't be able to tag you, they won't be able to message you, and they won't be able to add you to events. If you block someone, they won't be notified, but they may notice they can no longer be friends with you or get in touch with you.

To block someone, from the Facebook settings page click **Blocking**, then choose **Edit** next to **Block users**. Select **Add to Blocked List**, then enter the name of the person you no longer want to hear from, then choose **Block**. You can unblock people if you change your mind, but you'll have to then manually add them as friends again.

How to Limit Who Can Contact You on Facebook

Plus: The Conti ransomware gang shuts down, Canada bans Huawei and ZTE, and more of the week’s top security news.

As Russia’s full-scale war in Ukraine heads towards its hundredth day, opposition from Ukrainian forces is as strong as ever. At the same time, hacktivists all around the world continue to breach Russian institutions and publish their files and emails. This week one hacktivist collective took a different—and slightly peculiar—approach: launching a service to prank-call Russian government officials. The new website uses leaked details to put two random Russian officials on a call with each other. It obviously won't make any difference to the outcome of the war, but the group that created it hopes the tool will cause some confusion and annoy those in Moscow.

New research from Google’s Threat Analysis Group has delved into the surveillance-for-hire industry and found that spyware vendors are targeting Android devices with zero-day exploits. State-sponsored actors in Egypt, Armenia, Greece, Madagascar, Côte d’Ivoire, Serbia, Spain, and Indonesia have all purchased hacking tools from the North Macedonian firm Cytrox, the Google team says. The malware has used five previously unknown Android exploits, alongside unpatched vulnerabilities. Overall, Google’s researchers say they’re tracking more than 30 surveillance-for-hire firms around the world.

In other malware news, academics at Germany’s Technical University of Darmstadt have figured out a way to track an iPhone’s location even when it is turned off. When you switch your iPhone off it doesn’t fully power down—instead chips inside run in a low-power mode. The researchers were able to run malware that can track the phone in this low-power mode. They believe their work is the first of its kind, but the method is unlikely to be much of a threat in the real world, as it first requires jailbreaking the targeted iPhone, which has generally become harder to do in recent years.

But wait, there's more. We’ve rounded up all the news that we didn’t break or cover in depth this week. Click on the headlines to read the full stories. And stay safe out there.

International sanctions imposed against North Korea, for its continued development of nuclear weapons and ballistic missiles, mean the nation can’t trade with other countries or bring outside money within its borders. To get around this, in recent years Pyongyang has allowed its state-affiliated hackers to raid cryptocurrency platforms and rob banks. Now the FBI, the US Department of State, and the US Treasury have warned that thousands of North Korea’s IT workers—including app and software developers—have been freelancing at businesses around the world and sending money home. Many of them are based in China or Russia, the officials say. The risks of hiring North Korean workers range from “theft of intellectual property, data, and funds to reputational harm and legal consequences, including sanctions under both US and United Nations authorities.”

In a significant public move, the US Department of Justice says it will stop prosecuting security researchers under the Computer Fraud and Abuse Act. “Computer security research is a key driver of improved cybersecurity,” deputy attorney general Lisa Monaco said in a statement. For years the anti-hacking CFFA law has been criticized for its broad scope and its potential to be abused by prosecutors. While the DOJ’s explicit shift in policy will be welcomed by researchers, as _Motherboard_ reports, the policy doesn’t go far enough and still can put legitimate researchers at risk.

The mostly Russia-based Conti ransomware gang has had a dreadful few months. After backing Vladimir Putin’s war in Ukraine, thousands of its internal messages and innermost secrets were published online. While the gang has continued to target victims, including Costa Rica’s government, researchers now say Conti has officially shut down its operations. Conti’s Tor admin panels have been taken offline, and the group’s members are splintering off into other ransomware groups, according to security firm Advanced Intel. The shutdown comes after the US government offered a $15 million reward for information about Conti's members.

Canada has become the final country in the Five Eyes intelligence group—which also includes the US, UK, Australia, and New Zealand—to ban the use of Huawei’s telecoms equipment in its 5G networks. Fellow Chinese telecom firm ZTE is also included in the ban. The Canadian government, in an announcement, cited national security concerns and the fact that companies could be forced to comply with orders from “foreign governments.” Starting in September, Canadian firms will be banned from buying new 4G and 5G equipment from the Chinese companies. They must remove all existing 5G equipment by the summer of 2024, and 4G equipment must be removed by the end of 2027.

North Korean IT Workers Are Infiltrating Tech Companies

New research from Google's Threat Analysis Group outlines the risks Android users face from the surveillance-for-hire industry.

NSO Group and its powerful Pegasus malware have dominated the debate over commercial spyware vendors who sell their hacking tools to governments, but researchers and tech companies are increasingly sounding the alarm about activity in the wider surveillance-for-hire industry. As part of this effort, Google's Threat Analysis Group is publishing details on Thursday of three campaigns that used the popular Predator spyware, developed by the North Macedonian firm Cytrox, to target Android users.

In line with findings on Cytrox published in December by researchers at University of Toronto’s Citizen Lab, TAG saw evidence that state-sponsored actors who bought the Android exploits were located in Egypt, Armenia, Greece, Madagascar, Côte d’Ivoire, Serbia, Spain, and Indonesia. And there may have been other customers. The hacking tools took advantage of five previously unknown Android vulnerabilities, as well as known flaws that had fixes available but that victims hadn’t patched.

“It's important to shine some light on the surveillance vendor ecosystem and how these exploits are being sold,” says Google TAG director Shane Huntley. “We want to reduce the ability of both the vendors and the governments and other actors who buy their products to throw around these dangerous zero-days without any cost. If there’s no regulation and no downside to using these capabilities, then you’ll see it more and more.”

The commercial spyware industry has given governments that don’t have the funds or expertise to develop their own hacking tools access to an expansive array of products and surveillance services. This allows repressive regimes and law enforcement more broadly to acquire tools that enable them to surveil dissidents, human rights activists, journalists, political opponents, and regular citizens. And while a lot of attention has been focused on spyware that targets Apple’s iOS, Android is the dominant operating system worldwide and has been facing similar exploitation attempts.

 “We just want to protect users and find this activity as quickly as possible,” Huntley says. “We don’t think we can find everything all the time, but we can slow these actors down.”

TAG says it currently tracks more than 30 surveillance-for-hire vendors that have ranging levels of public presence and offer an array of exploits and surveillance tools. In the three Predator campaigns TAG examined, attackers sent Android users one-time links over email that looked like they had been shortened with a standard URL shortener. The attacks were targeted, focusing on just a few dozen potential victims. If a target clicked on the malicious link, it took them to a malicious page that automatically began deploying the exploits before quickly redirecting them to a legitimate website. On that malicious page, attackers deployed “Alien,” Android malware designed to load Cytrox's full spyware tool, Predator.

As is the case with iOS, such attacks on Android require exploiting a series of operating system vulnerabilities in sequence. By deploying fixes, operating system makers can break these attack chains, sending spyware vendors back to the drawing board to develop new or modified exploits. But while this makes it more difficult for attackers, the commercial spyware industry has still been able to flourish.

“We can’t lose sight of the fact that NSO Group or any one of these vendors is just one piece of a broader ecosystem,” says John Scott-Railton, a senior researcher at Citizen Lab. “We need collaboration between platforms so that enforcement actions and mitigations cover the full scope of what these commercial players are doing and make it harder for them to continue.”

Spyware Vendors Target Android With Zero-Day Exploits

To protest the war in Ukraine, WasteRussianTime.today auto-dials Russian government officials, connects them to each other, and lets you listen in to their confusion.

Robocalls have become a modern scourge, the destroyer of focus, the nuisance that somehow cannot be eradicated. But perhaps they can, at least, be repurposed to strike a very small and slightly absurd blow against the Russian government's unprovoked invasion of Ukraine.

Today, a group of international hacktivists launched a website, WasteRussianTime.today, designed to combine prank calling and robocalling into an automated weapon of telephonic annoyance targeted at the Russian state. Visit the site, click a button, and it will cycle through a leaked list of Russian government, military, and intelligence phone numbers to connect two random Russian officials—and allow the site's visitor to silently listen in as those officials waste their time trying to figure out why they're speaking to each other and who initiated the call.

“We’re hoping for confusion, that they get annoyed, and that these might even be interesting calls to listen to for people who speak Russian,” says one of the site's creators who goes by the name Shera. The group of artists, activists, and coders behind the site is, according to Shera, called the Obfuscated Dreams of Scheherazade. “This war started inside Moscow and St. Petersburg, within the power circle of Putin, and that’s who we want to annoy and disturb.”

Since Russia began its full-scale war in Ukraine on February 24, hacktivists working independently and even rallied by the Ukrainian government have carried out an unprecedented campaign of hacking operations targeting Russian organizations, some of which have resulted in the theft and leak of hundreds of gigabytes of Russians' emails and other private information. The Ukrainian government itself at one point released a list of what it said were the names and contact details of 620 Russian intelligence agents. 

Now, by combing through that pile of leaked information, scraping phone numbers from emails, and combining the results with those found in other public sources, the creators of WasteRussianTime.today say they've assembled more than 5,000 Russian government phone numbers, both landlines and cell phones, including members of the Russian military police, staff of its parliament, known as the Duma, and even Russia's Federal Security Service, or FSB—all of which are now targets of its automated robo-dialing campaign.

WasteRussianTime.today is designed to work by starting a VoIP call, automatically dialing 40 of the leaked phone numbers, and merging the user into a three-way call with the first two Russian officials' phones that connect. The site's creators say they decided not to let visitors to the site actually speak on the calls, for fear that they might say something that could identify and endanger themselves. So instead, the site functions as a kind of performance art installation, allowing visitors to silently observe and enjoy its spam calls. "Join the civil intervention against war," a message on the site reads. "If you're on the phone, you can't drop bombs or coordinate soldiers."

In WIRED's dozen or so test calls on the site just before its launch, the site's creators still seemed to be ironing out some bugs. The site only worked on desktop, and most of the calls resulted in at least one non-working number audio message. In about half the calls, at least one confused Russian-speaking did pick up. But in only one call did two people pick up the phone, and one hung up before the other started speaking. Shera says the site's developers will be tweaking it over time to identify and weed out non-working numbers.

The site's creators say the idea for WasteRussianTime.today came about 24 hours after Russia launched its full-scale invasion of Ukraine in late February. As the hacktivist group discussed ways of protesting or disrupting the war, their brainstorming eventually turned to how they might be able to create a site that used leaked Russian phone numbers to allow visitors to call ordinary Russian citizens and speak to them about the invasion. But as more Russian government numbers leaked in the post-invasion hacking wave—and as they realized most visitors wouldn't be able to speak Russian, and the calls might create safety concerns—they instead pivoted to making Russian officials essentially prank call each other, with the site's visitors as the audience.

Bringing that idea to fruition took nearly three months, in part, the site's creators say, because they were designing it to be resilient against the inevitable response from the site's targets. They've prepared a broad range of numbers to call from, to make their calls more difficult to block or ignore. And they've engaged a service that offers defense against distributed denial of service attacks that might otherwise be used to knock their site offline with bombardments of junk traffic. (They declined to name the service.) “We think the whole system will not live forever; someday, it will get blocked probably,” says Shera, suggesting that the site may manage to stay online and functional for anywhere from hours to weeks.

WasteRussianTime.today's creators say they took care to screen the numbers they included to make sure they're all government or military staff, rather than random Russian civilians. For the cell phone numbers they're including, for instance, they're only using numbers leaked in recent months, since cell phone numbers are often recycled from one user to the next. But they also admit they didn't do much actual testing of the numbers for fear of alerting their targets to the project too early, which would lead to their calls being blocked. In a message posted online, they called on Russians to share any more government or military phone numbers they may have, but ask that those supplying them share verification where possible so they can avoid harassing civilians. “We’re doing our best not to call some random grandma in Siberia,” Shera says.

The hacktivists say their idea was partly inspired by journalists at Bellingcat and Russian news site The Insider who have called Russian officials and even intelligence agents, pretending to be their colleagues or superiors, to trick them into revealing sensitive information. That technique was most famously used by Alexei Navalny, working with Bellingcat, when he dialed up an FSB agent and duped him into confessing to trying to assassinate him with the Novichok nerve agent in a nearly hour-long phone call.

But Christo Grozev, the Bulgarian Bellingcat researcher and journalist who helped Navalny spoof that FSB call, points out that the WasteRussianTime.today project does come at a cost. “Whenever something like this becomes public, the whole department changes their numbers, and that's not good for investigations, including journalistic investigations,” says Grozev.

All the same, Grozev says he does appreciate the prankster spirit in which the project was conceived, and he says that it may discourage and demotivate Russian government staffers who feel their private information isn't being protected. “It’s a great psychological operation,” he says. “It’s just more of a radio morning show prank, rather than a journalistic operation.”

The site's cocreator, Shera, for his part, says that many of the numbers are already leaked and public to varying degrees. But more broadly, if the effect of the project is little more than a prank, so be it. “We just want to do our part and annoy the Russian military-industrial complex,” he says. “And make people laugh a bit.”

This Hacktivist Site Lets You Prank-Call Russian Officials

Researchers found a way to exploit the tech that enables Apple’s Find My feature, which could allow attackers to track location when a device is powered down.

When you turn off an iPhone, it doesn’t fully power down. Chips inside the device continue to run in a low-power mode that makes it possible to locate lost or stolen devices using the Find My feature or use credit cards and car keys after the battery dies. Now researchers have devised a way to abuse this always-on mechanism to run malware that remains active even when an iPhone appears to be powered down.

It turns out that the iPhone’s Bluetooth chip—which is key to making features like Find My work—has no mechanism for digitally signing or even encrypting the firmware it runs. Academics at Germany’s Technical University of Darmstadt figured out how to exploit this lack of hardening to run malicious firmware that allows the attacker to track the phone’s location or run new features when the device is turned off.

This video provides a high overview of some of the ways an attack can work.

The research is the first—or at least among the first—to study the risk posed by chips running in low-power mode. Not to be confused with iOS’s low-power mode for conserving battery life, the low-power mode (LPM) in this research allows chips responsible for near-field communication, ultra wideband, and Bluetooth to run in a special mode that can remain on for 24 hours after a device is turned off.

“The current LPM implementation on Apple iPhones is opaque and adds new threats,” the researchers wrote in a paper published last week. “Since LPM support is based on the iPhone’s hardware, it cannot be removed with system updates. Thus, it has a long-lasting effect on the overall iOS security model. To the best of our knowledge, we are the first who looked into undocumented LPM features introduced in iOS 15 and uncover various issues.”

They added: “Design of LPM features seems to be mostly driven by functionality, without considering threats outside of the intended applications. Find My after power off turns shutdown iPhones into tracking devices by design, and the implementation within the Bluetooth firmware is not secured against manipulation.”

The findings have limited real-world value, since infections required first jailbreaking an iPhone, which in itself is a difficult task, particularly in an adversarial setting. Still, targeting the always-on feature in iOS could prove handy in post-exploit scenarios by malware such as Pegasus, the sophisticated smartphone exploit tool from Israel-based NSO Group, which governments worldwide routinely employ to spy on adversaries.

It may also be possible to infect the chips in the event hackers discover security flaws that are susceptible to over-the-air exploits similar to this one that worked against Android devices.

Besides allowing malware to run while the iPhone is turned off, exploits targeting LPM could also allow malware to operate with much more stealth since LPM allows firmware to conserve battery power. And, of course, firmware infections are extremely difficult to detect since it requires significant expertise and expensive equipment.

The researchers said Apple engineers reviewed their paper before it was published, but company representatives never provided any feedback on its contents. Apple representatives didn’t respond to an email seeking comment for this story.

Ultimately, Find My and other features enabled by LPM help provide added security, because they allow users to locate lost or stolen devices and lock or unlock car doors even when batteries are depleted. But the research exposes a double-edged sword that, until now, has gone largely unnoticed.

“Hardware and software attacks similar to the ones described have been proven practical in a real-world setting, so the topics covered in this paper are timely and practical,” said John Loucaides, senior vice president of strategy at firmware security firm Eclypsium. “This is typical for every device. Manufacturers are adding features all the time, and with every new feature comes a new attack surface.”

_This story originally appeared on_ _Ars Technica__._

Your iPhone Is Vulnerable to a Malware Attack Even When It’s Off

A newly unsealed opinion is likely the first decision from a US federal court to find that cryptocurrencies can't be used to evade sanctions.

Cryptocurrencies have long been seen as the Wild West of money transfers, but few online payment and money transfer platforms have been as blatant in appealing for illicit cash as one highlighted but not named in a memorandum opinion unsealed on May 13 in the US District Court in Washington, DC. The platform is apparently based in a “comprehensively sanctioned country”—likely North Korea, according to those within the crypto law space—and advertised its services as evading US financial sanctions. It was built using a US front company that facilitated the purchase of domain names, according to court records.

The platform, which was designed to sidestep financial bans aimed at crippling pariah countries, handled more than $10 million worth of bitcoin that was transferred between the United States and the sanctioned country using a US-based crypto exchange, which, the opinion implies, was not aware that it was helping users avoid sanctions.

The opinion, written by Magistrate Judge Zia Faruqui, was likely unsealed because someone has been arrested for operating the crypto platform. It all marks a shift in the way US law enforcement—and the law—handles cryptocurrencies.

“Issue One: virtual currency is untraceable? WRONG. ... Issue Two: sanctions do not apply to virtual currency? WRONG,” Faruqui concludes in his opinion, directly citing two _Saturday Night Live_ skits parodying TV host and political commentator John McLaughlin, who was known for his direct style.

“For some time, we’ve heard a narrative that cryptocurrency could potentially be used for sanctions evasion,” says Ari Redbord, head of legal and governmental affairs at TRM Labs, which monitors crypto fraud and financial crime. “What we see here is the first time that the Department of Justice has charged a criminal case involving the use of cryptocurrency to evade sanctions.”

The decision puts crypto exchanges on notice that they can be liable for enabling users to sidestep sanctions—intentionally or not—and is a warning to those trying to evade such sanctions that law enforcement is coming for them.

For years, cryptocurrency has been seen as a safe haven for criminal gangs and enterprises looking to launder ill-gotten gains. Unlike a bank account, cryptocurrency doesn’t require a name attached to transactions, which are recorded on a public blockchain ledger. This apparent anonymity attracted criminal enterprises in the early days of cryptocurrencies like bitcoin. “You had the Silk Roads of the world and the AlphaBays,” says Jessie K. Liu, partner at law firm Skadden, Arps, Slate, Meagher & Flom. A former deputy general counsel at the US Treasury who also served in the Justice Department, Liu has prosecuted several crypto cases. “The early reporting on bitcoin made it out to be some sort of secretive, anonymous currency that bad guys used to do bad things.” The founding principles of the platform—and the libertarian, privacy-loving, decentralized attitude that gave birth to it—contributed to the perception that virtual currencies can’t be traced.

What all of those groups and individuals overlooked was that the underpinning of cryptocurrencies—the immutable blockchain that keeps a record of every transaction made—was building a stockpile of evidence for prosecutors. “The thing that’s so unique about crypto is you can actually trace and track the flow of these funds on an entirely open ledger,” says Redbord. “It’s only because crypto moves and lives on an open ledger on the blockchain that allowed for this type of investigation.”

In the opinion, Faruqui explains how the defendant’s identifying information and IP address were tracked and linked to the payments platform they operated. “The striking point is that cryptocurrency quickly became this dark asset used for illegal activity, which was never the purpose, and that is now being turned on its head and will just as quickly become more transparent than traditional asset classes,” says Nimesh Shah, CEO of London-based accountancy company Blick Rothenberg. Others go further: “Judge Faruqui's opinion pours cold water on the idea that cryptocurrencies mean the death of sanctions,” says Anupam Chander, professor of law at Georgetown University in Washington, DC. Chander says the opinion is good for cryptocurrencies as they seek to shake off their early bad reputation and gain mainstream traction: “Judge Faruqui treats the virtual objects as if they are dollars or dinars.”

While the court’s opinion sets a legal precedent that crypto transactions can and should be traced by authorities, in other ways it’s wholly unremarkable. “Judge Faruqui is, as far as I’m aware, the first judge who has actually said explicitly that cryptocurrency can run afoul of sanctions,” says Liu. “But that’s been the Treasury Department’s view for a number of years.” What’s significant about the decision is that it codifies what has long been an informal attitude toward crypto.

“The question is no longer whether virtual currency is here to stay (i.e., FUD) but instead whether fiat currency regulations will keep pace with frictionless and transparent payments on the blockchain,” Faruqui writes. (Chander says that while Faruqui isn’t the first judge to use “FUD”—meaning fear, uncertainty, and doubt—in a federal opinion, he may well be the first to use it without defining it, showing just how much crypto has burrowed its way into the mainstream.)

In the last year or so, the Treasury Department has designated three Russia-based cryptocurrency exchanges as subject to sanctions, and the Office of Foreign Assets Control (OFAC), which implements sanctions regimes, has operated under the assumption that crypto is subject to sanctions, just as fiat currencies are.

“What really strikes me is that this opinion puts all those pieces together,” says Liu. “Though all those pieces are out there in the DOJ’s approach to enforcement already, this opinion really crystallizes that.” Liu believes there will be an increased focus on tackling the use of cryptocurrency to evade sanctions—and with that, a need for those operating crypto platforms to make sure their house is in order. “This opinion really underscores the importance for anybody involved in the cryptocurrency space or any of the adjacent spaces to have a very good compliance program,” says Liu, “and to recognize that they’re in an area that can be used for problematic purposes.” Crypto companies could otherwise open themselves to civil and potentially criminal action.

It’s all part of what Redbord calls a “cat and mouse game.” Payment platforms will come and go, trying to evade sanctions, but law enforcement will always be looking to catch them. “Cases like this send a message to bad actors that law enforcement can trace and track the flow of funds, and regulators like OFAC are going to continue to sanction bad entities in the space—and are clearly looking to go after bad entities,” says Redbord. “I think judges are going to see more and more warrants, and they’re going to see more and more cases.”

Source

Wired