Behind the scenes, companies and governments are feeding a trove of data about international travelers into opaque AI tools that aim to predict who’s safe—and who’s a threat.

Inside the Black Box of Predictive Travel Surveillance

Data WIRED collected during the 2024 Democratic National Convention strongly suggests the use of a cell-site simulator, a controversial spy device that intercepts sensitive data from every phone in its range.

A device capable of intercepting phone signals was likely deployed during the 2024 Democratic National Convention (DNC) in Chicago, WIRED has learned, raising critical questions about who authorized its use and for what purpose.

The device, known as a cell-site simulator, was identified by the Electronic Frontier Foundation (EFF), a digital rights advocacy organization, after analyzing wireless signal data collected by WIRED during the August event.

Cell-site simulators mimic cell towers to intercept communications, indiscriminately collecting sensitive data such as call metadata, location information, and app traffic from all phones within their range. Their use has drawn widespread criticism from privacy advocates and activists, who argue that such technology can be exploited to covertly monitor protesters and suppress dissent.

The DNC convened amid widespread protests over Israel’s assault on Gaza. While credentialed influencers attended exclusive yacht parties and VIP events, thousands of demonstrators faced a heavy law enforcement presence, including officers from the US Capitol Police, the Secret Service, Homeland Security Investigations, local sheriff’s offices, and Chicago police.

Concerns over potential surveillance prompted WIRED to conduct a first-of-its-kind wireless survey to investigate whether cell-site simulators were being deployed. Reporters, equipped with two rooted Android phones and Wi-Fi hot spots running detection software, used Rayhunter—a tool developed by the EFF to detect data anomalies associated with these devices. WIRED’s reporters monitored signals at protests and event locations across Chicago, collecting extensive data during the political convention.

Initial tests conducted during the DNC revealed no conclusive evidence of cell-site simulator activity. However, months later, EFF technologists reanalyzed the raw data using improved detection methods. According to Cooper Quintin, a senior technologist at the EFF, the Rayhunter tool stores all interactions between devices and cell towers, allowing for deeper analysis as detection techniques evolve.

A breakthrough came when EFF technologists applied a new heuristic to examine situations where cell towers requested IMSI (international mobile subscriber identity) numbers from devices. According to the EFF’s analysis, on August 18—the day before the convention officially began—a device carried by WIRED reporters en route a hotel housing Democratic delegates from states in the US Midwest abruptly switched to a new tower. That tower asked for the device’s IMSI and then immediately disconnected—a sequence consistent with the operation of a cell-site simulator.

“This is extremely suspicious behavior that normal towers do not exhibit,” Quintin says. He notes that the EFF typically observed similar patterns only during simulated and controlled attacks. “This is not 100 percent incontrovertible truth, but it’s strong evidence suggesting a cell-site simulator was deployed. We don’t know who was responsible—it could have been the US government, foreign actors, or another entity.”

Under Illinois law, law enforcement agencies must obtain a warrant to deploy cell-site simulators. Similarly, federal agents—including those from the Department of Homeland Security—are required to secure warrants unless an immediate national security threat exists. However, a 2023 DHS Inspector General report found that both the Secret Service and Homeland Security Investigations did not always comply with these requirements.

The Chicago Police Department tells WIRED it did not deploy a cell-site simulator during the DNC, while the Secret Service tells WIRED in a statement that, “as a matter of practice,” it does not discuss the “means and methods” of its operations for “National Special Security Events.”

Other components of DHS as well as the DNC have not responded to requests for comment.

Quintin notes that the EFF detected similar anomalous behavior in a previous test conducted in Washington, DC’s Embassy Row, an area known for its high concentration of embassies and diplomatic offices. It wouldn’t be the first time that cell-site simulators were found in the nation's capitol. In 2019, the FBI accused Israel’s government of deploying a cell-site simulator near the White House—a claim Israel denied.

While the possible deployment of a cell-site simulator at the DNC has raised more questions than answers, for privacy and civil liberties advocates the implications are troubling nonetheless.

Nate Wessler, deputy director of the ACLU’s Speech, Privacy, and Technology Project, says, “It would be a big deal if the digital artifacts you found were in fact due to the presence of a cell-site simulator deployed to identify people at a protest.” However, Wessler adds, “it is also entirely possible that law enforcement was using a cell-site simulator in the area for a lawful purpose.”

For Wessler, the lack of clarity around their use is itself a cause for concern. “The ambiguity is really chilling,” he says. “The uncertainty around their use undermines people’s ability to express themselves.”

Secret Phone Surveillance Tech Was Likely Deployed at 2024 DNC

A hack of location data company Gravy Analytics has revealed which apps are—knowingly or not—being used to collect your information behind the scenes.

Some of the world’s most popular apps are likely being co-opted by rogue members of the advertising industry to harvest sensitive location data on a massive scale, with that data ending up with a location data company whose subsidiary has previously sold global location data to US law enforcement.

The thousands of apps, included in hacked files from location data company Gravy Analytics, include everything from games like _Candy Crush_ and dating apps like Tinder to pregnancy tracking and religious prayer apps across both Android and iOS. Because much of the collection is occurring through the advertising ecosystem—not code developed by the app creators themselves—this data collection is likely happening without users’ or even app developers’ knowledge.

“For the first time publicly, we seem to have proof that one of the largest data brokers selling to both commercial and government clients appears to be acquiring their data from the online advertising ‘bid stream,’” rather than code embedded into the apps themselves, Zach Edwards, senior threat analyst at cybersecurity firm Silent Push and who has followed the location data industry closely, tells 404 Media after reviewing some of the data.

The data provides a rare glimpse inside the world of real-time bidding (RTB). Historically, location data firms paid app developers to include bundles of code that collected the location data of their users. Many companies have turned instead to sourcing location information through the advertising ecosystem, where companies bid to place ads inside apps. But a side effect is that data brokers can listen in on that process and harvest the location of peoples’ mobile phones.

“This is a nightmare scenario for privacy, because not only does this data breach contain data scraped from the RTB systems, but there's some company out there acting like a global honey badger, doing whatever it pleases with every piece of data that comes its way,” Edwards says.

Included in the hacked Gravy data are tens of millions of mobile phone coordinates of devices inside the US, Russia, and Europe. Some of those files also reference an app next to each piece of location data. 404 Media extracted the app names and built a list of mentioned apps.

The list includes dating sites Tinder and Grindr; massive games such as _Candy Crush_, _Temple Run_, _Subway Surfers_, and _Harry Potter: Puzzles & Spells_; transit app Moovit; My Period Calendar & Tracker, a period-tracking app with more than 10 million downloads; popular fitness app MyFitnessPal; social network Tumblr; Yahoo’s email client; Microsoft’s 365 office app; and flight tracker Flightradar24. The list also mentions multiple religious-focused apps such as Muslim prayer and Christian Bible apps, various pregnancy trackers, and many VPN apps, which some users may download, ironically, in an attempt to protect their privacy.

The full list can be found here. Multiple security researchers have published other lists of apps included in the data, of varying sizes. Our version is relatively larger because it includes both Android and iOS apps, and we decided to keep duplicate instances of the same app that had slight name variations to make it easier for readers to search for apps they have installed.

Although this dataset came from an apparent hack of Gravy, it is not clear whether Gravy collected this location data itself or sourced it from another company, or which location company ultimately owns it or is licensed to use it.

Much of the location data attached to these app names does not have a time stamp. But there are indications it dates from 2024. One of the apps listed is _Call of Duty: Mobile_, and specifically its Season 5 iteration, which launched in May 2024.

Gravy is a company that powers much of the rest of the location data industry. It collates mobile phone location data from various sources, then sells that to commercial companies or, through its subsidiary Venntel, to US government agencies. Norwegian outlet NRK and I previously revealed the flow of location data from a handful of ordinary apps to Gravy and then to Venntel. Venntel’s clients have included Immigration and Customs Enforcement, Customs and Border Protection, the IRS, the FBI, and the Drug Enforcement Administration.

Venntel has also provided the underlying data for another government-bought surveillance tool called Locate X. 404 Media and a group of other outlets showed last year how that tool, made by a company called Babel Street, could be used to monitor visitors to out-of-state abortion clinics.

But the newly hacked data shows for the first time just how many apps could be part of a location data supply chain, even if their developers are not aware of it. Most app developers and companies included in the list did not respond to a request for comment. Flightradar24 said in an email that it had never heard of Gravy, but that it does display ads, which “help keep Flightradar24 free.”

Tinder said in an email that “Tinder takes safety and security very seriously. We have no relationship with Gravy Analytics and have no evidence that this data was obtained from the Tinder app” but did not answer questions about ads inside the app.

Muslim Pro, one of the Muslim prayer apps included in the list, said in an email that it was not aware of Gravy. “Yes, we display ads through several ad networks to support the free version of the app. However, as mentioned above, we do not authorize these networks to collect location data of our users,” the email said. That does not necessarily mean that a member of the advertising ecosystem can’t extract such data, though. (In 2020 I revealed Muslim Pro was selling its users’ location data to a company called X-Mode, whose clients included US military contractors; Muslim Pro stopped the practice after my reporting.)

A Grindr spokesperson told 404 Media in an email that “Grindr has never worked with or provided data to Gravy Analytics. We do not share data with data aggregators or brokers and have not shared geolocation with ad partners for many years. Transparency is at the core of our privacy program, therefore the third parties and service providers we work with are listed here on our website.” Grindr was previously found to have allowed data brokers to obtain its users’ location data.

It’s important that the data appears to be sourced through real-time bidding, because that dictates who is responsible (rogue members of the advertising industry and the tech giants that facilitate that industry), how users can protect themselves (attempting to block ads), and the fact that massive app publishers may not even be aware their users’ data is being harvested and therefore might not know how to stop it. An app developer will know if it implemented location-data-gathering code itself. It might not know that some company, somewhere, is silently listening in on the advertising process and siphoning data from their app.

Surveillance firms can obtain RTB data by acquiring ad tech companies and posing as prospective advertisers. The spy-run location data company doesn’t need to successfully place an ad; instead, it is able to gather data on devices by simply being plugged into that industry. Location data in this case can also include a users’ IP address, which is then geolocated to give their coarse location.

Last January, 404 Media reported on an Israeli surveillance company called Patternz, which was sourcing masses of location data through the RTB process.

In an exposed training video, Patternz showed some of the popular apps it got location data from: 9GAG, Kik, sports app FUTBIN, caller ID apps such as CallApp and Truecaller; and various word, sudoku, and solitaire puzzle games. Every one of these apps are also in the Gravy data. This suggests that Gravy, or wherever Gravy got that data from, also sourced it from interacting with the advertising system rather than location-tracking code baked into the apps.

404 Media shared some of the location data with another security researcher with knowledge of the advertising and location data industries. “It appears that at least some of this data would likely have been sourced from advertising related, real-time bidding,” Krzysztof Franaszek, founder of Adalytics, a digital forensics firm, told 404 Media after reviewing the data. He pointed out some of the user-agents in the file, which show how a user’s device connected to a service, referenced “afma-sdk.” That is a string used by Google’s Mobile Ads SDK (software development kit). In other words, in some cases, it is Google’s advertising platform that is delivering the ads that are eventually leading to this tracking by outside companies and potentially government contractors.

Google did not respond to multiple requests for comment for this article. Neither did Apple.

Franaszek also says that “a significant amount of this geolocation dataset appears to be inferred by IP address to geolocation lookups, meaning the vendor or their source is deriving the user's geolocation by checking their IP address rather than by using GNSS \[Global Navigation Satellite System\]/GPS data. That would suggest that the data is not being sourced entirely from a location data SDK.”

“What we’re seeing here in this data appears to me to be a huge diversity of apps,” Edwards says. “That’s not what you see from an SDK ingestion; that’s what you see from bulk RTB ingestions.”

In December the Federal Trade Commission banned another location data company called Mobilewalla from collecting consumer data “from online advertising auctions for purposes other than participating in those auctions.” In other words, the agency banned Mobilewalla from participating in the RTB process for building datasets on peoples’ devices. The FTC also said Venntel and Gravy collected data without obtaining user consent, ordered the company to delete historical location data, and banned it from selling data related to sensitive areas like health clinics and places of worship, except in “limited circumstances” involving national security or law enforcement.

404 Media has verified the hacked Gravy data in various ways. Some files include credentials for Gravy’s Snowflake instances, a data warehousing tool. 404 Media checked that the URLs in the hacked files do correspond to real Snowflake instances. One file called “users” contains a long list of companies. Some of these firms denied having any relationship with Gravy; Cuebiq, another location data firm mentioned in the file, told 404 Media it “routinely evaluates available data in the market to determine if they are an appropriate fit for our business. Most do not make it past the evaluation stage to production, as was the case here. Cuebiq tested a limited data sample, which was never made available to our customers, and the data was deleted at the end of the limited trial.”

404 Media also sent a section of the data to another data broker called Datonics. “We investigated the matter described in your email, and the segment IDs in those files are those of Gravy, not Datonics,” the company said in an email.

Unacast, which merged with Gravy in 2023, did not respond to multiple requests for comment, both on the hack and whether it or any of its suppliers have derived location data from the real-time bidding process.

Candy Crush, Tinder, MyFitnessPal: See the Thousands of Apps Hijacked to Spy on Your Location

Texas has become a leading enforcer of internet rules. Its latest probe includes some platforms that privacy experts describe as unusual suspects.

Over the past decade, Texas attorney general Ken Paxton has wielded his office’s significant resources to investigate well-known tech giants including Google and Meta over how they moderate content and treat rivals. He helped win settlements against Apple for allegedly misleading users and is suing TikTok for allegedly endangering children's privacy. Now, Paxton’s latest tech investigation includes an expansive number of targets, WIRED has learned.

Rumble, Quora, and WeChat are among the 15 companies from which Texas has demanded answers by next week about their collection and use of data of people under 18 years old. Paxton announced the investigation in a press release last month but named only four of the companies being probed—Character.AI, Red­dit, Insta­gram, and Dis­cord. WIRED obtained the names of additional targeted companies through a public records request. They also include Kick, Kik, Pinterest, Telegram, Twitch, Tumblr, WhatsApp, and Whisper.

Paxton’s office did not respond to requests for comment, including about how it chose which businesses to investigate. But the variety of companies questioned highlights the sprawling reach of a new Texas law aimed at increasing oversight of minors’ use of social media and chat services.

Three experts in youth privacy regulations who have been following Paxton’s enforcement efforts say the new investigation should be treated credibly, and they believe it could result in companies agreeing to improve their practices. The alternative could be up to hundreds of millions of dollars in penalties per company. “When you bring all the statutes together, Texas has a pretty significant hammer,” says Paul Singer, a partner and section chair at the law firm Kelley Drye & Warren.

Spokespeople for Character.AI and Tumblr say they take safety issues seriously. Meta and WeChat declined to comment. Other companies under investigation did not respond to requests for comment.

Paxton launched his probe three days after the families of an 11-year-old girl and 17-year-old boy in Texas sued chatbot startup Character.AI, claiming the company designed its product in an unsafe way that exposed the kids to sexualized and violent responses. In October, a similar case was filed in Florida by the family of a 14-year-old who shot himself to death allegedly following conversations with a Character.AI chatbot. Character.AI later introduced an experience aimed at kids and plans to roll out parental controls.

Other services under investigation including Kik, Instagram, and Discord have faced public scrutiny over their use by children. But less so WeChat, a messaging app popular among Chinese Americans, and Quora, a forum for crowdsourcing information that’s recently expanded into AI chatbots.

Paxton’s interest in Rumble, a YouTube-like website popular among US conservative political commentators, is also perhaps unexpected given his track record of partisan views about social media companies. Rumble has touted itself as a haven for free expression, unlike platforms that engage in allegedly heavier content moderation. Paxton is a Republican and has criticized platforms that unfairly silence Texans.

The privacy experts who spoke with WIRED described Rumble, Quora, and WeChat as unusual suspects but declined to speculate on the rationale behind their inclusion in the investigation. Josh Golin, executive director of the nonprofit Fairplay, which advocates for digital safety for kids, says concerns aren’t always obvious. Few advocacy groups worried about Pinterest, for example, until the case of a British teen who died from self-harm following exposure to sensitive content on the platform, he says.

Paxton’s press release last month called his new investigation “a critical step toward ensuring that social media and AI companies comply with our laws designed to protect children from exploitation and harm.”

The United States Congress has never passed a comprehensive privacy law, and it hasn’t significantly updated child online safety rules in a quarter century. That has left state lawmakers and regulators to play a big role.

Paxton’s investigation centers on compliance with Texas’ Securing Children Online through Parental Empowerment Act, or SCOPE, which went into effect in September. It applies to any website or app with social media or chat functions and that registers users under the age of 18, making it more expansive than the federal law, which covers only services catering to under-13 users.

SCOPE requires services to ask for users’ age and provide parents or guardians power over kids’ account settings and user data. Companies also are barred from selling information gathered about minors without parental permission. In October, Paxton sued TikTok for allegedly violating the law by providing inadequate parental controls and disclosing data without consent. TikTok has denied the allegations.

The investigation announced last month also referenced the Texas Data Privacy and Security Act, or TDPSA, which became effective in July and requires parental consent before processing data about users younger than 13. Paxton’s office has asked the companies being investigated to detail their compliance with both the SCOPE Act and the TDPSA, according to legal demands obtained through the public records request.

In total, companies must answer eight questions by next week, including the number of Texas minors they count as users and have barred for registering an inaccurate birthdate. Lists of whom minors’ data is sold or shared with have to be turned over. Whether any companies have already responded to the demand couldn’t be learned.

Tech company lobbying groups are challenging the constitutionality of SCOPE Act in court. In August, they secured an initial and partial victory when a federal judge in Austin, Texas, ruled that a provision requiring companies to take steps to prevent minors from seeing self-harm and abusive content was too vague.

But even a complete win might not be a salve for tech companies. States including Maryland and New York are expected to enforce similar laws starting later this year, says Ariel Fox Johnson, an attorney and principal of the consultancy Digital Smarts Law & Policy. And state attorneys general could resort to pursuing narrower cases under their tried-and-true laws barring deceptive business practices. “What we see is often information gets shared or sold or disclosed in ways families didn’t expect or understand,” Johnson says. “As more laws are enacted that create firm requirements, it seems to be becoming more clear that not everybody is in compliance.”

Rumble Among 15 Targets of Texas Attorney General’s Child Privacy Probe

The fate of TikTok now rests in the hands of the US Supreme Court. If a law banning the social video app this month is upheld, it won’t disappear from your phone—but it will get messy fast.

The law says it will be “unlawful” for entities to “distribute, maintain or update” the app including its source code, or by “providing services” that allow it to keep running as it is now. This distribution, maintenance, or updates could be, the law says, by means of mobile app stores that can be accessed in the US or by “providing internet hosting services.”

“The law really deliberately avoided saying that it was illegal to have the app on your phone,” says Milton Mueller, a professor and cofounder of the Internet Governance Project at the Georgia Institute of Technology, who filed an amicus brief to the Supreme Court in opposition of the ban. “Their attempt is to say nobody new can download it from the Apple or Google stores, and nobody who has it can update it through those stores,” Mueller says. “There’s nothing in the law that says ‘TikTok you must block US users,’ which is again interesting.”

If TikTok is removed from Apple’s App Store and Google’s Play Store in the US, it will not be possible to directly install new updates that will add new features, fix bugs within the code, or quash security flaws. Over time, that means TikTok will stop functioning properly. Apple didn’t respond to WIRED’s request for comment, while Google declined to comment on what it will do if the law comes into effect.

The law’s other focus is on stopping “hosting” companies from providing services to TikTok—and the definition is pretty wide. Hosting companies “may include file hosting, domain name server hosting, cloud hosting, and virtual private server hosting,” the law says. Since the summer of 2022, as TikTok faced pressure about its Chinese ownership, the company has hosted US user data within Oracle’s cloud services. Oracle also did not respond to WIRED’s request for comment.

Even so, other systems such as content delivery networks, advertising networks, payment providers, and more are used as part of TikTok’s infrastructure. The law does not specifically mention these services, but differing legal readings could make them question whether they help to “maintain” or “distribute” TikTok’s fully functioning service.

Hall says a recent test of TikTok’s website showed 185 embedded domains on the page. “They pull in code, content from that array of third-party providers and their own domains too,” he says. “The apps will start to decay and rot as either services stop working, things like content distribution networks or services who feel like they can't take the risks of the ambiguous nature of the language or the potential enforcement by the incoming administration.”

There’s one internet infrastructure player that the ban does not specifically put pressure on: internet service providers. Countries such as Russia and China have developed censorship measures that allow them to block entire websites from being accessed through web bowsers. Mueller believes this omission by US lawmakers was likely deliberate, as it avoids setting up a Chinese-style internet firewall. “They knew that a system of ISP-based blocking and filtering would obviously be a form of First Amendment restriction,” he says.

**Avoiding a TikTok Ban**

While TikTok’s service in the US would likely degrade over time, there remain some potential ways around any ban—both for individuals and potentially also the company itself. How effective these measures would be likely depends on how motivated people are to keep using TikTok and what the company decides to do.

“TikTok has 170 million users,” says Alan Rozenshtein, an associate professor of law at the University of Minnesota, who is in favor of the law but says it is the “best of a bunch of bad options” relating to TikTok. “This law will not prevent every one of them from accessing TikTok. I don’t think that was ever the goal of the law. The law is to make it meaningfully harder to access TikTok.”

How the US TikTok Ban Would Actually Work

The inside story of the teenager whose “swatting” calls sent armed police racing into hundreds of schools nationwide—and the private detective who tracked him down.

The School Shootings Were Fake. The Terror Was Real

Misconfigured license-plate-recognition systems reveal the livestreams of individual cameras and the wealth of data they collect about every vehicle that passes by them.

In just 20 minutes this morning, an automated license-plate-recognition (ALPR) system with an IP address geolocated to Tennessee captured photographs and detailed information from nearly 1,000 vehicles as they passed by. Among them: eight black Jeep Wranglers, six Honda Accords, an ambulance, and a yellow Ford Fiesta with a vanity plate.

This trove of real-time vehicle data, collected by one of Motorola’s ALPR systems, is meant to be accessible by law enforcement. However, a flaw discovered by a security researcher has exposed live video feeds and detailed records of passing vehicles, revealing the staggering scale of surveillance enabled by this widespread technology.

More than 150 Motorola ALPR cameras have exposed their video feeds and leaking data in recent months, according to security researcher Matt Brown, who first publicized the issues in a series of YouTube videos after buying an ALPR camera on eBay and reverse engineering it.

As well as broadcasting live footage accessible to anyone on the internet, the misconfigured cameras also exposed data they have collected, including photos of cars and logs of license plates. The real-time video and data feeds don’t require any usernames or passwords to access.

Alongside other technologists, WIRED has reviewed video feeds from several of the cameras, confirming vehicle data—including makes, models, and colors of cars—have been accidentally exposed. Motorola confirmed the exposures, telling WIRED it was working with its customers to close the access.

Over the last decade, thousands of ALPR cameras have appeared in towns and cities across the US. The cameras, which are manufactured by companies such as Motorola and Flock Safety, automatically take pictures when they detect a car passing by. The cameras and databases of collected data are frequently used by police to search for suspects. ALPR cameras can be placed along roads, on the dashboards of cop cars, and even in trucks. These cameras capture billions of photos of cars—including occasionally bumper stickers, lawn signs, and T-shirts.

“Every one of them that I found exposed was in a fixed location over some roadway,” Brown, who runs cybersecurity company Brown Fine Security, tells WIRED. The exposed video feeds each cover a single lane of traffic, with cars driving through the camera’s view. In some streams, snow is falling. Brown found two streams for each exposed camera system, one in color and another in infrared.

Broadly, when a car passes an ALPR camera, a photograph of the vehicle is taken, and the system uses machine learning to extract text from the license plate. This is stored alongside details such as where the photograph was taken, the time, as well as metadata such as the make and model of the vehicle.

Brown says the camera feeds and vehicle data were likely exposed as they had not been set up on private networks, possibly by law enforcement bodies deploying them, and instead exposed to the internet without any authentication. “It’s been misconfigured. It shouldn’t be open on the public internet,” he says.

WIRED tested the flaw by analyzing data streams from 37 different IP addresses apparently tied to Motorola cameras, spanning more than a dozen cities across the United States, from Omaha, Nebraska, to New York City. Within just 20 minutes, those cameras recorded the make, model, color, and license plates of nearly 4,000 vehicles. Some cars were even captured multiple times—up to three times in some cases—as they passed different cameras.

License Plate Readers Are Leaking Real-Time Video Feeds and Vehicle Data

Plus: The FBI discovers a historic trove of homemade explosives, new details emerge in China’s hack of the US Treasury Department, and more.

It may be a new year, but the hacks, scams, and dangerous people lurking online haven’t gone anywhere.

Just a day before the ball dropped, the United States Treasury Department said it had been hacked. Officials believe the attackers are an as-yet-unidentified Advanced Persistent Threat group linked to China’s government that exploited flaws in remote tech support software made by BeyondTrust to carry out what the Treasury Department described as a “major” breach. The company told the Treasury on December 8 that the attackers stole an authentication key, which ultimately allowed them to access department computers. While the Treasury says the attackers were only able to steal “certain unclassified documents,” new details have already begun to emerge, which we’ll get into more below.

Before the murder of UnitedHealthcare CEO Brian Thompson last month, gun silencers were mostly a thing you encountered in Hollywood films—or in Facebook and Instagram ads, if you looked closely. WIRED found that someone has run thousands of ads for “fuel filters” that are, in fact, meant to be used as gun silencers, which are heavily regulated by US law. Meta, which owns Facebook and Instagram, has since removed many of the ads, but new ones keep popping up. So if you see one, keep scrolling—owning an unregistered silencer could result in felony charges.

When an Amber Alert push notification pops up on your phone, getting all the information you need to help find an abducted child can literally be a matter of life and death. That’s a lesson the California Highway Patrol learned this week when it sent out an Amber Alert that linked to a post on X, which people couldn’t access unless they were signed in. While CHP says it has linked to posts on the social network since 2018 without any issues until this week, a spokesperson tells WIRED they’re “looking into it” now.

If you’ve added better privacy and security practices to your list of 2025 goals, one easy place to start is your old chat histories. You might be surprised how much sensitive information is out there, perhaps forgotten but definitely not gone.

That’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

**Apple Will Pay $95 Million to End a Siri Privacy Lawsuit**

Apple this week agreed to pay $95 million to settle a class action over its Siri voice assistant’s alleged eavesdropping. The lawsuit, _Lopez et al v. Apple Inc._, accused Apple of recording people’s conversations without their knowledge and sharing that data with third parties to serve advertisements. The issue stemmed from Siri’s voice-activation function—”Hey, Siri”—which two plaintiffs say surreptitiously captured conversations that resulted in ads for Nike shoes and the Olive Garden. One plaintiff claimed to have been served an ad for a medical treatment after having a conversation with his doctor. People who qualify as part of the class covered by the settlement, which must be approved by a federal judge in California, could receive up to $20 per device, for as many as five devices. As Reuters points out, the settlement amount is approximately nine hours of profit for Apple, which made nearly $94 billion in the last fiscal year. The company will not admit to any wrongdoing as part of the agreement.

**FBI Unearths Historic Cache of Homemade Explosives in Virginia**

Newly unsealed court documents revealed that the FBI allegedly discovered during a search for a single illegal firearm the “largest seizure of homemade explosives in FBI history.” According to court records, the explosives arsenal was found at the Virginia home of Brad Spafford, where investigators allegedly found more than 150 pipe bombs and other explosive devices. Prosecutors say the FBI found a backpack containing pipe bombs and adorned with a grenade-shaped patch with the hashtag #NoLivesMatter—a potential reference to a far-right extremist “accelerationist” group, The New York Times reports. While prosecutors claim that Spafford—who allegedly used a photo of US president Joe Biden for target practice—aimed to “bring back political assassinations,” his attorney contends that he is a harmless “family man” who should be granted release

**China’s State-Backed Hackers Targeted US Sanctions Office, Treasury Leadership**

Following revelations earlier this week that Chinese state-backed hackers breached the US Treasury in early December, the Washington Post reported on Wednesday that the hackers specifically targeted the Office of Foreign Assets Control. The attackers may have been looking for information about the Office’s possible plans to sanction Chinese entities. Additionally, Bloomberg reported on Thursday that the attackers targeted the computers of senior Treasury officials, where they were able to access unclassified material. Thus far, investigators have reportedly identified about 100 computers compromised by the hackers. Sources told Bloomberg, though, that the attack seems to have been more of a crime of opportunity than a clandestine, long-planned operation like China’s recent infiltration of US telecom companies.

**White House Chides Telecoms for Lax Security Following China Hack**

As China’s Treasury hack comes into focus, the impact of its intrusions into American telecommunications firms is still widening. Two days after Christmas, Anne Neuberger, the White House deputy national security adviser for cyber and emerging technology, held a briefing with reporters in which she raised the count of telecoms breached by the Chinese hackers known as Salt Typhoon from eight to nine and suggested that at least some of the blame for those breaches lies with the companies’ own inadequate security. “The reality is that, from what we’re seeing regarding the level of cybersecurity implemented across the telecom sector, those networks are not as defensible as they need to be to defend against a well-resourced, capable offensive cyber actor like China,” Neuberger said. She added that the hackers had targeted the communications histories of fewer than 100 people—mostly in Washington, DC, reportedly including president-elect Donald Trump and vice president-elect JD Vance. Neuberger said that the espionage incident calls for new Federal Communications Commission cybersecurity regulations that she says might have limited the scope of the breaches had they been in place.

**Volkswagen Exposed Location Data for 800,000 Electric Vehicles**

Cars collect and transmit as much sensitive location data as any modern digital device, and the privacy pitfalls of all that tracking are becoming all too clear. Case in point: A whistleblower warned Germany’s Chaos Computer Club and the country’s Der Spiegel news outlet that Cariad, a subsidiary of Volkswagen, left exposed online a trove of 800,000 electric vehicles’ location data. The leak included cars sold by not only Volkswagen but also other brands, including Seats, Audi, and Skoda. For Audi and Skoda, that location data was accurate only to within about six miles, but Volkswagen and Seats cars could be located to within about four inches. The exposed data has since been secured, but the incident nonetheless demonstrates how far carmakers have yet to go to rein in their data collection.

Apple May Owe You $20 in a Siri Privacy Lawsuit Settlement

Many people reported they hit a screen preventing them from seeing the alert unless they signed in.

Earlier this week, the California Highway Patrol sent an Amber Alert push notification to phones in the Los Angeles area about a 14-year-old girl that authorities believed had been abducted. But instead of conveying vital information that could help locate the victim within the notification itself, the law enforcement agency linked to a post from its official X account, a practice it adopted six years ago. But this time, many people reported they could not view the alert because they hit a screen that prevents users from seeing any content on X until they sign in to their account.

The California Highway Patrol told WIRED it was aware of the issue and had reached out to X for more information. “We’re looking into it,” Sergeant Dan Keane said. X did not respond to a request for comment.

Amber Alerts are issued by local law enforcement agencies to help locate children who are believed to have been abducted and are at risk of dying or serious injury. In California, the California Highway Patrol’s Emergency Notification and Tactical Alert Center is tasked with issuing the alerts. The law enforcement agency told WIRED it has used X (formerly Twitter) to push out the notifications since 2018 without any problems, at least until this incident.

On other social platforms, including Reddit, Threads, and Bluesky, local California residents vented their frustrations about being unable to receive the details of an emergency happening in their community. “This should be illegal and everyone should be upset about this. If that alert was for my child and tons of people couldn’t see it because they don’t have a stupid X account, I would be beyond infuriated,” one person wrote on Reddit. “Why the fuck should a social media platform benefit from people wanting to be good citizens and informed about missing kids?” another asked on Threads.

Some users reported they didn’t need to log in to see the California Highway Patrol’s X post, which was sent via a URL created using the Bitly link shortener service. It’s unclear what percentage of people who received the push notification were able to view the information about the missing girl and what percentage hit X’s log-in gate. Overall, only 21 percent of US adults say they ever use X, according to the Pew Research Center, not all of whom may have the app installed on their phones.

After Elon Musk took over Twitter more than two years ago, the billionaire rapidly laid off the majority of the social media site’s existing employees and instituted sweeping changes to its moderation and verification policies. The shifts spurred concerns that Twitter would become less reliable for emergency communications. The incident this week in California suggests at least some of these fears were founded.

“Requiring a login creates accessibility challenges and raises concerns about digital equity. Everyone should be able to access life-critical information, regardless of whether they use a specific platform,” says Amanda Lee Hughes, a professor of computer science at Brigham Young University who has studied digital emergency communications tools.

People in Missouri reported encountering a similar issue in July 2023, when the Missouri Highway Patrol sent out an Amber Alert push notification with a link to an X post. Local residents similarly spoke out about how they could not see the alert unless they logged on to the platform. “It was quite a change” from how the alerts used to work, says Missouri Highway Patrol lieutenant Eric Brown, who works in the public information and education department.

But the incident ultimately didn’t prompt the Missouri Highway Patrol to abandon X as its go-to platform for Amber Alert push notifications. According to Brown, when X verified the law enforcement agency's account as an official government entity, the log-in issue problem went away, and the public could once again access its posts.

Several of the California Highway Patrol’s official X accounts have the same verification badge as the Missouri Highway Patrol, including the one devoted specifically to disseminating active alerts statewide. However, not all of the California agency’s accounts appear to be verified, including what looks like the official channel for the CHP’s Southern Division, which includes Los Angeles county.

When it was known as Twitter, X was widely viewed as an essential part of global disaster and emergency communications infrastructure. Government officials and agencies around the world relied on the service as a way to broadcast information about hurricanes, mass shootings, and other crises. Before Musk took over the platform in 2022, anyone could view public tweets in their browser regardless of whether they had an account on the site or had installed Twitter’s mobile app. (In 2015, the company reported that more than 500 million people visited Twitter’s site per month without logging in.)

In June 2023, reports that X had started locking content behind a log-in screen began popping up online. At the time, Musk called the move a “temporary emergency measure” that was put in place because X was “getting data pillaged so much it was degrading the service.” It’s unclear exactly what Musk was referring to, but that same month he expressed concerns about AI companies like OpenAI allegedly scraping Twitter posts without prior authorization.

It now looks like the decision to turn X into a more closed platform stuck. According to tests conducted this week, X has continued to limit what people without accounts can see. WIRED looked at several of its staff reporters’ X accounts without logging in, for example, and was only able to view a sampling of their popular posts rather than a comprehensive chronological feed. It does appear that accounts run by government entities are not restricted in this way; all of the posts shared by the California Highway Patrol’s alerts account can be viewed without logging in.

Aside from allowing anyone to view content shared on the platform, another way Twitter previously helped emergency communicators was by giving them free access to its API, which Musk later revoked. That allowed organizations like the US National Tsunami Warning Center to send automatic alerts about potentially deadly natural disasters. Researchers and first responders could also use the API to monitor activity across Twitter and “extract key insights, such as identifying risk hot spots or combating misinformation,” says Hughes. “The platform’s role has shifted as policies and public usage evolve, so its effectiveness today may look quite different.”

Despite these drawbacks, X still remains an important platform for relaying information during emergency situations. In October, several government information officers emergency told PRWeek they planned to continue posting updates on X despite its diminished usefulness, because they had amassed large followings on the site and their priority ultimately remains ensuring that accurate information reaches as many people as possible. But the incident in California this week highlights how government agencies can run into problems when third-party services once considered reliable later change their policies in an unpredictable ways.

Californians Say X Blocked Them From Viewing Amber Alert About Missing 14-Year-Old

A network of Facebook pages has been advertising “fuel filters” that are actually meant to be used as silencers, which are heavily regulated by US law. Even US military officials are concerned.

Thousands of ads on Facebook and Instagram have promoted “fuel filters” using videos demonstrating how they can be easily modified into gun silencers—a process that, without federal approval, could lead to felony charges. Despite Meta’s policies banning ads for silencers on the company’s social networks, the promotions have persisted for years, driven by what appears to be a single network of more than 100 Facebook pages marketing “fuel filters” that can be easily turned into gun silencers, WIRED has found. The devices sell for as little as $50.

Silencers, also known as suppressors, are heavily regulated under United States federal law. Purchasing one legally requires submitting fingerprints, passing a background check, and paying a fee to the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). Federal law allows people to build their own suppressors, provided they register the device with the ATF. But the ads don’t mention this key stipulation, marketing silencers to buyers who may not understand the legal risks.

“You know those things that are definitely not suppressors, even though they look just like suppressors,” a man says in a video that appears in many of the ads. “Well, but they’re still not suppressors, because they don’t have a hole in the other end. So, you can legally own one without going through the paperwork to own a suppressor, because it isn’t one.”

The ads often recycle the same text, referencing “light and durable air-grade aluminum,” and use videos stitched together from a handful of YouTube clips featuring firearms influencers and enthusiasts. The original creators of these videos are likely unaware their content is being used; one tells WIRED they had deleted the footage from YouTube years ago.

One ad features a suppressor engraved with the words Black Collar Arms. A co-owner of Black Collar Arms, who goes by Jeremy McSorely, tells WIRED his company has no connection to the ad. McSorely explains that the footage was taken from a blog and YouTube video he had uploaded years ago but has since removed. “The photos you saw were screenshots taken from my video,” he says, emphasizing that the suppressor was legally manufactured and engraved with their corporate information to comply with ATF regulations.

In November 2023, the ATF warned federal firearms licensees about marketing silencers as “solvent traps,” or contraptions purportedly used to collect gun oil and residue during cleaning. The agency clarified that legality depends on functionality, not what you call a product, and stressed that even incomplete parts intended for silencers are regulated under federal law.

“The test for whether an item is a silencer is not the label a manufacturer or retailer applies. Rather, it is the way the statute written by Congress applies to the item,” the ATF wrote, referring to definitions of suppressors in the Gun Control Act and the National Firearms Act.

A WIRED analysis of more than 2,800 ads revealed they are linked to a network of hundreds of ecommerce websites. These sites often reuse code, share IP addresses, and peddle the same low-quality knockoff products alongside the “fuel filters.” At least one of the sites was flagged by Google as a likely phishing scam.

Experts believe the operation is based in China and relies on a drop-shipping scheme. “It’s likely just a reshipper selling controversial or illegal products,” says Zach Edwards, a senior threat researcher at cybersecurity firm Silent Push who specializes in online data ecosystems.

Typically, Edwards explains, drop-shippers wait for a customer to place an order, then purchase the item from inexpensive online retailers, repackage it, and ship it to the customers. Edwards says that the operator behind the network is likely creating hundreds of websites, applying a moderate markup to the products, and spinning up Facebook pages to promote their items. “Even if some sites or ads get caught and taken down, others keep running,” Edwards says. “It’s a spray-and-pray method.”

Meta explicitly bans ads promoting weapons, silencers, and related modifications. According to Meta, ads are reviewed by an automated system with support from human moderators. However, enforcement has been inconsistent: While at least 74 of the ad campaigns in our analysis were removed for violating the platforms’ terms, the rest appeared to have run successfully.

After WIRED reached out to Meta, the company said that it removed the ads and associated advertising accounts. However, a quick search of Meta’s Ad Library revealed that nearly identical ones have since been published.

“Bad actors constantly evolve their tactics to avoid enforcement, which is why we continue to invest in tools and technology to help identify and remove prohibited content,” Meta spokesperson Daniel Roberts wrote in a statement.

Roberts says that many of the ads flagged by WIRED had little to no engagement, suggesting few people ever saw this content. However, at least two ads reviewed by WIRED had thousands of comments, including accusations that it was an ATF honeypot, complaints from self-identified buyers whose products never arrived, and even testimonials from others claiming the item worked as advertised. WIRED reached out to several commenters who said they had purchased the product—none responded.

The ads have also drawn the attention of US Department of Defense officials. An internal presentation to Pentagon staff, viewed by WIRED, claims that the targeted ad for a fuel filter had been served to US military personnel on a government computer at the Pentagon. The presentation, which a source says was delivered to high-ranking general officers, including the US Army’s chief information officer, raised flags over how social media algorithms are being used to target service members.

Meta’s Ad Library provides limited transparency, leaving it unclear exactly how these ads are targeted. Researchers suggest that Meta’s powerful ad tools, which allow advertisers to find niche audiences using granular targeting options, could be exploited to reach gun enthusiasts or military personnel. While Roberts confirmed that Meta did not detect any indication that these ads were targeting the military, WIRED found that advertisers can easily target users who list their job title as “US Army” or “military” on their profiles—an audience that Meta estimates includes up to 46,134 people.

Meta’s platforms have long struggled to prevent the sale of firearms and related products. An October 2024 joint report by the Tech Transparency Project found that more than 230 ads for rifles and ghost guns had run on Facebook and Instagram in nearly three months. Many of these ads directed buyers to third-party platforms like Telegram to complete transactions. In 2024, two Los Angeles County men were charged with operating an “unlicensed firearm dealing business” that used Instagram accounts to advertise and market the sale of more than 60 firearms, which included some untraceable ghost guns and weapons with scratched-off serial numbers. Both individuals have since pleaded guilty.

Silencers are rarely used in crimes, but their use is on the rise—nearly 5 million are registered in the United States, up from 1.3 million in 2017. Last month, 26-year-old software engineer Luigi Mangione allegedly used a 3D-printed gun equipped with a silencer to fatally shoot UnitedHealthcare CEO Brian Thompson on a street in midtown Manhattan.

Source

Wired