Earlier this year, Google ditched its plans to abolish support for third-party cookies in its Chrome browser. While privacy advocates called foul, the implications for users is not so clear cut.

The apparent death of cookies also won’t matter much to Google, which has a ton of data from multiple services in addition to Chrome and can target people without cookies.

According to Google's 2023 earnings report, $237.86 billion of the firm’s $307.39 billion in revenue came from ads. Ads on its search engine results page and other products including Gmail, Google Maps, and Google Play are the highest earner at a collective $175.03 billion, or 56.9 percent of overall revenue. YouTube ads bring in $31.51 billion (10.3 percent of the total), and Google Network ads including ads on Google’s partner sites come in at $31.31 billion, 10.2 percent of revenue. Network ad revenues were down by 4.5 percent last year, showing Google reliance on this area is reducing.

Google knows it’s quite possible privacy-conscious users will opt out of Chrome cookies, just as they did with Apple’s ATT, which saw Facebook taking a $10 billion hit. Now, ATT opt-in rates range from 12 percent to 40 percent across different app categories.

The mobile advertising industry has boomed over recent years, even with Apple’s ATT in place, says Jake Moore, global cybersecurity adviser at security outfit ESET. He calls the results of ATT “impressive” and suggests Google has been watching the outcome of Apple’s rules before implementing its own version.

Meanwhile, Google is already advising developers to act as if they don’t have cookies. The tech giant is working under the assumption that even if 80 percent do opt out, 20 percent of Chrome’s more than 3 billion users isn’t a bad result.

Ensuring users have a conscious choice over whether they use cookies or not is “a good step in practice,” says Simon Bain, CEO at data and analytics platform OmniIndex. But Google needs to consider how easy it is to opt out, he says.

“And is there a negative impact on opting out for users?” Bain says. “These are crucial because if opting out is buried in the privacy settings and there is a reduction in functionality or workflow as a result of not having them, then it is not really a fair or legitimate choice.”

**Informed Choice**

Google says its updated approach allows people to “make an informed choice that applies across their web browsing,” and says you’ll be able to “adjust that choice at any time.”

The plan is for this to be as usable as possible. Sources familiar with the matter confirmed Google’s current plan would be a prominent global prompt, meaning users would not be asked to make choices on a site-by-site basis.

Yet some experts question Google’s motives. Sean Wright, an independent security researcher, points out that Google has “an enormous amount of data on individuals,” which gives a lot of power to “a single entity.”

This level of control could put user privacy at risk, Wright says. “My concern is that you have a large company that is already well established, developing its own ecosystem with little competition. There seems little incentive to enhance the privacy of users.”

But Google argues that it has received feedback from “a wide variety of stakeholders,” including regulators such as the UK’s Competition and Markets Authority, publishers, web developers and standards groups, civil society, and participants in the advertising industry. “This has helped us craft solutions that aim to support a competitive and thriving marketplace that works for publishers and advertisers, and encourage the adoption of privacy-enhancing technologies,” the company says.

Even so, privacy is a difficult balance to strike for the world’s biggest browser whose business model is designed to rely on advertising.

This is already well known, and if you care about your privacy, it’s possible you’ve already ditched Chrome for another browser. If you haven’t, Chrome alternatives include Apple’s Safari, Brave, Vivaldi, Firefox, and the DuckDuckGo browser. Brave and Vivaldi and based on the same Chromium engine as Chrome, so they include some of the same functionality.

What Google's U-Turn on Third-Party Cookies Means for Chrome Privacy

Perfctl malware is hard to detect, persists after reboots, and can perform a breadth of malicious activities.

Thousands of machines running Linux have been infected by a malware strain that’s notable for its stealth, the number of misconfigurations it can exploit, and the breadth of malicious activities it can perform, researchers reported Thursday.

The malware has been circulating since at least 2021. It gets installed by exploiting more than 20,000 common misconfigurations, a capability that may make millions of machines connected to the internet potential targets, researchers from Aqua Security said. It can also exploit CVE-2023-33426, a vulnerability with a severity rating of 10 out of 10 that was patched last year in Apache RocketMQ, a messaging and streaming platform that’s found on many Linux machines.

****Perfctl Storm****

The researchers are calling the malware Perfctl, the name of a malicious component that surreptitiously mines cryptocurrency. The unknown developers of the malware gave the process a name that combines the perf Linux monitoring tool and ctl, an abbreviation commonly used with command line tools. A signature characteristic of Perfctl is its use of process and file names that are identical or similar to those commonly found in Linux environments. The naming convention is one of the many ways the malware attempts to escape notice of infected users.

Perfctl further cloaks itself using a host of other tricks. One is that it installs many of its components as rootkits, a special class of malware that hides its presence from the operating system and administrative tools. Other stealth mechanisms include:

*   Stopping activities that are easy to detect when a new user logs in
*   Using a Unix socket over TOR for external communications
*   Deleting its installation binary after execution and running as a background service thereafter
*   Manipulating the Linux process pcap\_loop through a technique known as hooking to prevent admin tools from recording the malicious traffic
*   Suppressing mesg errors to avoid any visible warnings during execution.

The malware is designed to ensure persistence, meaning the ability to remain on the infected machine after reboots or attempts to delete core components. Two such techniques are (1) modifying the ~/.profile script, which sets up the environment during user login so the malware loads ahead of legitimate workloads expected to run on the server and (2) copying itself from memory to multiple disk locations. The hooking of pcap\_loop can also provide persistence by allowing malicious activities to continue even after primary payloads are detected and removed.

Besides using the machine resources to mine cryptocurrency, Perfctl also turns the machine into a profit-making proxy that paying customers use to relay their internet traffic. Aqua Security researchers have also observed the malware serving as a backdoor to install other families of malware.

Assaf Morag, Aqua Security’s threat intelligence director, wrote in an email:

> Perfctl malware stands out as a significant threat due to its design, which enables it to evade detection while maintaining persistence on infected systems. This combination poses a challenge for defenders and indeed the malware has been linked to a growing number of reports and discussions across various forums, highlighting the distress and frustration of users who find themselves infected.
> 
> Perfctl uses a rootkit and changes some of the system utilities to hide the activity of the cryptominer and proxy-jacking software. It blends seamlessly into its environment with seemingly legitimate names. Additionally, Perfctl’s architecture enables it to perform a range of malicious activities, from data exfiltration to the deployment of additional payloads. Its versatility means that it can be leveraged for various malicious purposes, making it particularly dangerous for organizations and individuals alike.

****“The Malware Always Manages to Restart”****

While Perfctl and some of the malware it installs are detected by some antivirus software, Aqua Security researchers were unable to find any research reports on the malware. They were, however, able to find a wealth of threads on developer-related sites that discussed infections consistent with it.

This Reddit comment posted to the CentOS subreddit is typical. An admin noticed that two servers were infected with a cryptocurrency hijacker with the names perfcc and perfctl. The admin wanted help investigating the cause.

“I only became aware of the malware because my monitoring setup alerted me to 100% CPU utilization,” the admin wrote in the April 2023 post. “However, the process would stop immediately when I logged in via SSH or console. As soon as I logged out, the malware would resume running within a few seconds or minutes.” The admin continued:

> I have attempted to remove the malware by following the steps outlined in other forums, but to no avail. The malware always manages to restart once I log out. I have also searched the entire system for the string "perfcc" and found the files listed below. However, removing them did not resolve the issue. as it keep respawn on each time rebooted.

Other discussions include: Reddit, Stack Overflow (Spanish), forobeta (Spanish), brainycp (Russian), natnetwork (Indonesian), Proxmox (Deutsch), Camel2243 (Chinese), svrforum (Korean), exabytes, virtualmin, serverfault and many others.

After exploiting a vulnerability or misconfiguration, the exploit code downloads the main payload from a server, which, in most cases, has been hacked by the attacker and converted into a channel for distributing the malware anonymously. An attack that targeted the researchers’ honeypot named the payload httpd. Once executed, the file copies itself from memory to a new location in the /temp directory, runs it, and then terminates the original process and deletes the downloaded binary.

Once moved to the /tmp directory, the file executes under a different name, which mimics the name of a known Linux process. The file hosted on the honeypot was named sh. From there, the file establishes a local command-and-control process and attempts to gain root system rights by exploiting CVE-2021-4043, a privilege-escalation vulnerability that was patched in 2021 in Gpac, a widely used open source multimedia framework.

The malware goes on to copy itself from memory to a handful of other disk locations, once again using names that appear as routine system files. The malware then drops a rootkit, a host of popular Linux utilities that have been modified to serve as rootkits, and the miner. In some cases, the malware also installs software for “proxy-jacking,” the term for surreptitiously routing traffic through the infected machine so the true origin of the data isn’t revealed.

The researchers continued:

> As part of its command-and-control operation, the malware opens a Unix socket, creates two directories under the /tmp directory, and stores data there that influences its operation. This data includes host events, locations of the copies of itself, process names, communication logs, tokens, and additional log information. Additionally, the malware uses environment variables to store data that further affects its execution and behavior.
> 
> All the binaries are packed, stripped, and encrypted, indicating significant efforts to bypass defense mechanisms and hinder reverse engineering attempts. The malware also uses advanced evasion techniques, such as suspending its activity when it detects a new user in the btmp or utmp files and terminating any competing malware to maintain control over the infected system.

By extrapolating data such as the number of Linux servers connected to the internet across various services and applications, as tracked by services such as Shodan and Censys, the researchers estimate that the number of machines infected by Perfctl is measured in the thousands. They say that the pool of vulnerable machines—meaning those that have yet to install the patch for CVE-2023-33426 or contain a vulnerable misconfiguration—is in the millions. The researchers have yet to measure the amount of cryptocurrency the malicious miners have generated.

People who want to determine if their device has been targeted or infected by Perfctl should look for indicators of compromise included in Thursday’s post. They should also be on the lookout for unusual spikes in CPU usage or sudden system slowdowns, particularly if they occur during idle times. Thursday’s report also provides steps for preventing infections in the first place.

_This story originally appeared on_ _Ars Technica._

Stealthy Malware Has Infected Thousands of Linux Systems for Years

Plus: Harvard students pack Meta’s smart glasses with privacy-invading face-recognition tech, Microsoft and the DOJ seize Russian hackers’ domains, and more.

Pig butchering, the crypto-based scammer scourge that has pulled in an estimated $75 billion from victims globally, is spreading beyond its roots in Southeast Asia, with operations proliferating across the Middle East, Eastern Europe, Latin America, and West Africa.

The UK's National Crime Agency disclosed new details about the identities of the Russian ransomware group known as Evil Corp—as well as the group's ties to Russian intelligence agencies and even its direct participation in espionage operations targeting NATO allies.

A WIRED investigation revealed how car-mounted automatic license plate reader cameras are capturing far more than just license plates, including campaign yard signs, bumper stickers, and other politically sensitive text, all examples of how a system for tracking vehicles threatens to become a broader surveillance tool.

In other news, ICE signed a $2 million contract with Paragon Solutions, a known vendor of spyware including the hacking tool Graphite. And the Pentagon is increasingly adopting handheld controllers for weapons systems in an effort provide more intuitive interfaces to soldiers who have grown up playing Xbox and PlayStation consoles.

And there's more. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

As the politics of America's biggest city have been turned upside down by the criminal charges against New York mayor Eric Adams, there's still a “significant wild card” in the corruption case against him, prosecutors said in court this week: The FBI can't manage to get into his phone.

Prosecutors in the case against Adams, which centers on alleged illegal payments the mayor received from the Turkish government, revealed that the FBI still hasn't cracked the encryption on Adams' personal phone, nearly a year after it was seized. That phone is one of three that the bureau has taken from Adams, but agents seized Adams' personal phone a day later than the other two devices he used in an official capacity. By that time, Adams had not only changed the passcode on the phone from a four digit PIN to six digits—a measure he says he took to prevent staffers from intentionally or unintentionally deleting information from the device. He also claims he immediately “forgot” that code to unlock it.

That very convenient amnesia may leave the FBI and prosecutors in a situation similar to their investigation into the San Bernardino mass shooting carried out by Syed Rizwan Farook in 2016, when the US government demanded Apple help unlock the shooter's encrypted iPhone, leading to a high-profile standoff between the Apple and the FBI. In that case, the cybersecurity firm Azimuth eventually used a closely guarded—and expensive—hacking technique to unlock the device. In Adams' case, prosecutors hinted that the FBI may have to resort to similar measures. “Decryption always catches up with encryption,” a prosecutor in the case, Hagan Scotten, told the judge.

Face recognition is one of only a few technologies that even Facebook and Google have hesitated to integrate into products like Google Glass and the Ray-Ban Meta smart glasses—and rightly so, given the privacy implications of a device that would allow anyone to look at a stranger on the street and immediately determine their phone number and home address. Now, however, a group of Harvard students has shown how easy it is to bolt that face recognition onto Meta's augmented-reality eyewear. The project, known as I-XRAY, integrates with the face-recognition service Pimeyes to let Ray-Ban Meta wearers learn the name of virtually anyone they see and then immediately scour databases of personal information to determine other info about them, including names of family members, phone numbers, and home addresses. The students say they're not releasing the code for their experiment, instead intending it as a demonstration of the privacy-invasive potential of augmented-reality devices. Point made.

If that warning about the privacy risks of AR eyewear needed more reinforcement, Meta this week also conceded to TechCrunch that it will use input from users' smart glasses to train its AI products. Initially, Meta declined to answer TechCrunch's questions about whether and how it would collect information from Ray-Ban Meta smart glasses for use as AI training data, in contrast to companies like OpenAI and Anthropic that explicitly say they don't exploit user inputs to train their AI services. A couple of days later, however, Meta confirmed to TechCrunch that it does in fact use images or video collected through its smart glasses to train its AI, but only if the user submits them to Meta's AI tools. That means anything that a user sees and asks Meta's AI chatbot to comment on or analyze will become part of Meta's massive AI-training data trove.

If you can't arrest Russian hackers, at least you can nab their web domains. That, at least, is the approach this week of the US Justice Department, which along with Microsoft and the NGO Information Sharing and Analysis Center used a lawsuit to take control of more than a hundred web domains that had been used by Russian hackers working for the Kremlin's intelligence and law enforcement agency known as the FSB. Those domains had been exploited in phishing campaigns by the Russian hacker group known as Star Blizzard, which has a history of targeting the typical victims of geopolitical spying such as journalists, think tanks, and NGOs. The domain seizures seem designed in part to head off threats of foreign interference in next month's US election. “Rebuilding infrastructure takes time, absorbs resources, and costs money,” Steven Masada, the assistant general counsel of Microsoft’s Digital Crimes Unit, said in a statement. “Today’s action impacts \[the hackers'\] operations at a critical point in time when foreign interference in US democratic processes is of utmost concern.”

The FBI Still Hasn’t Cracked NYC Mayor Eric Adams’ Phone

After decades of relying on buttons, switches, and toggles, the Pentagon has embraced simple, ergonomic video-game-style controllers already familiar to millions of potential recruits.

In a future conflict, American troops will direct the newest war machines not with sprawling control panels or sci-fi-inspired touchscreens, but controls familiar to anyone who grew up with an Xbox or PlayStation in their home.

Over the past several years, the US Defense Department has been gradually integrating what appear to be variants of the Freedom of Movement Control Unit (FMCU) handsets as the primary control units for a variety of advanced weapons systems, according to publicly available imagery published to the department’s Defense Visual Information Distribution System media hub.

Those systems include the new Navy Marine Corps Expeditionary Ship Interdiction System (NMESIS) launcher, a Joint Light Tactical Vehicle–based anti-ship missile system designed to fire the new Naval Strike Missile that’s essential to the Marine Corps’ plans for a notional future war with China in the Indo-Pacific; the Army’s new Maneuver-Short Range Air Defense (M-SHORAD) system that, bristling with FIM-92 Stinger and AGM-114 Hellfire missiles and a 30-mm chain gun mounted on a Stryker infantry fighting vehicle, is seen as a critical anti-air capability in a potential clash with Russia in Eastern Europe; the Air Force’s MRAP-based Recovery of Air Bases Denied by Ordnance (RADBO) truck that uses a laser to clear away improvised explosive devices and other unexploded munitions; and the Humvee-mounted High Energy Laser-Expeditionary (HELEX) laser weapon system currently undergoing testing by the Marine Corps.

The FMCU has also been employed on a variety of experimental unmanned vehicles, and according to a 2023 Navy contract, the system will be integral to the operation of the AN/SAY-3A Electro-Optic Sensor System (or “I-Stalker”) that’s designed to help the service’s future Constellation-class guided-missile frigates track and engage incoming threats.

Produced since 2008 by Measurement Systems Inc. (MSI), a subsidiary of British defense contractor Ultra that specializes in human-machine interfaces, the FMCU offers a similar form factor to the standard Xbox or PlayStation controller but with a ruggedized design intended to safeguard its sensitive electronics against whatever hostile environs American service members may find themselves in. A longtime developer of joysticks used on various US naval systems and aircraft, MSI has served as a subcontractor to major defense “primes” like General Atomics, Boeing, Lockheed Martin, and BAE Systems to provide the handheld control units for “various aircraft and vehicle programs,” according to information compiled by federal contracting software GovTribe.

“With the foresight to recognize the form factor that would be most accessible to today’s warfighters, \[Ultra\] has continued to make the FMCU one of the most highly configurable and powerful controllers available today,” according to Ultra. (The company did not respond to multiple requests for comment from WIRED.)

The endlessly customizable FMCU isn’t totally new technology: According to Ultra, the system has been in use since at least 2010 to operate the now-sundowned Navy’s MQ-8 Fire Scout unmanned autonomous helicopter and the Ground Based Operational Surveillance System (GBOSS) that the Army and Marine Corps have both employed throughout the global war on terror. But the recent proliferation of the handset across sophisticated new weapon platforms reflects a growing trend in the US military towards controls that aren’t just uniquely tactile or ergonomic in their operation, but inherently familiar to the next generation of potential warfighters before they ever even sign up to serve.

“For RADBO, the operators are generally a much younger audience,” an Air Force spokesman tells WIRED. “Therefore, utilizing a PlayStation or Xbox type of controller such as the FMCU seems to be a natural transition for the gaming generation.”

An Xbox game controller used to maneuver the photonic mast aboard the USS _Colorado_ submarine in 2018.Photograph: Courtesy of U.S. Navy/Mass Communication Specialist First Class Steven Hoskins

Indeed, that the US military is adopting specially built video-game-style controllers may appear unsurprising: The various service branches have long experimented with commercial off-the-shelf console handsets for operating novel systems. The Army and Marine Corps have for more than a decade used Xbox controllers to operate small unmanned vehicles, from ground units employed for explosive ordnance disposal to airborne drones, as well as larger assets like the M1075 Palletized Loading System logistics vehicle. Meanwhile, the “photonics mast” that has replaced the traditional periscope on the Navy’s new Virginia-class submarines uses the same inexpensive Xbox handset, as does the service’s Multifunctional Automated Repair System robot that’s employed on surface warships to address everything from in-theater battle damage repair to shipyard maintenance.

This trend is also prevalent among defense industry players angling for fresh Pentagon contracts: Look no further than the LOCUST Laser Weapon System developed by BlueHalo for use as the Army’s Palletized-High Energy Laser (P-HEL) system, which explicitly uses an Xbox controller to help soldiers target incoming drones and burn them out of the sky—not unlike the service’s previous ventures into laser weapons.

"By 2006, games like _Halo_ were dominant in the military," Tom Phelps, then a product director at iRobot, told Business Insider in 2013 of the company’s adoption of a standard Xbox controller for its PackBot IED disposal robot. "So we worked with the military to socialize and standardize the concept … It was considered a very strong success, younger soldiers with a lot of gaming experience were able to adapt quickly."

Commercial video game handsets have also proven popular beyond the ranks of the US military, from the British Army’s remote-controlled Polaris MRZR all-terrain vehicle to Israel Aerospace Industries’ Carmel battle tank, the latter of which had its controls developed with feedback from teenage gamers who reportedly eschewed the traditional fighter jet-style joystick in favor of a standard video game handset. More recently, Ukrainian troops have used PlayStation controllers and Steam Decks to direct armed unmanned drones and machine gun turrets against invading Russian forces. And these controllers have unusual non-military applications as well: Most infamously, the OceanGate submarine that suffered a catastrophic implosion during a dive to the wreck of the Titanic in June 2023 was operated with a version of a Logitech F710 controller, as CBS News reported at the time.

“They are far more willing to experiment, they are much less afraid of technology … It comes to them naturally,” Israeli Defense Forces colonel Udi Tzur told The Washington Post in 2020 of optimizing the Carmel tank’s controls for younger operators. “It’s not exactly like playing _Fortnite_, but something like that, and amazingly they bring their skills to operational effectiveness in no time. I’ll tell you the truth, I didn’t think it could be reached so quickly.”

There are clear advantages to using cheap video-game-style controllers to operate advanced military weapons systems. The first is a matter of, well, control: Not only are video game handsets more ergonomic, but the configuration of buttons and joysticks offers tactile feedback not generally available from, say, one of the US military’s now-ubiquitous touchscreens. The Navy in particular learned this the hard way following the 2017 collision between the Arleigh Burke-class destroyer USS _John S. McCain_ and an oil tanker off the coast of Singapore, an incident that prompted the service to swap out its bridge touchscreens for mechanical throttles across its guided-missile destroyer fleet after a National Transportation Safety Board report on the accident noted that sailors preferred the latter because “they provide\[d\] both immediate and tactile feedback to the operator.” Sure, a US service member may not operate an Xbox controller with a “rumble” feature, but the configuration of video-game-style controllers like the FMCU does offer significant tactile (and tactical) advantages over dynamic touchscreens, a conclusion several studies appear to reinforce.

But the real advantage of video-game-style controllers for the Pentagon is, as military officials and defense contractors have noted, their familiarity to the average US service member. As of 2024, more than 190.6 million Americans of all ages, or roughly 61 percent of the country, played video games, according to an annual report from the Entertainment Software Association trade group, while data from the Pew Research Center published in May indicates that 85 percent of American teenagers say they play video games, with 41 percent reporting that they play daily.

In terms of specific video games systems, the ESA report indicates that consoles and their distinctive controllers reign supreme among Gen Z and Gen Alpha—both demographic groups that stand to eventually end up fighting in America’s next big war. The Pentagon is, in the words of military technologist Peter W. Singer, “free-riding” off a video game industry that has spent decades training Americans on a familiar set of controls and ergonomics that, at least since the PlayStation introduced elongated grips in the 1990s, have been standard among most game systems for years (with apologies to the Wii remote that the Army eyed for bomb-disposal robots nearly two decades ago).

“The gaming companies spent millions of dollars developing an optimal, intuitive, easy-to-learn user interface, and then they went and spent years training up the user base for the US military on how to use that interface,” Singer said in a March 2023 interview. “These designs aren’t happenstance, and the same pool they’re pulling from for their customer base, the military is pulling from … and the training is basically already done.”

At the moment, it’s unclear how exactly many US military systems use the FMCU. When reached for comment, the Pentagon confirmed the use of the system on the NMESIS, M-SHORAD, and RADBO weapons platforms and referred WIRED to the individual service branches for additional details. The Marine Corps confirmed the handset’s use with the GBOSS, while the Air Force again confirmed the same for the RADBO. The Navy stated that the service does not currently use the FMCU with any existing systems; the Army did not respond to requests for comment.

How far the FMCU and its commercial off-the-shelf variants will spread throughout the ranks of the US military remains to be seen. But controls that effectively translate human inputs into machine movement tend to persist for decades after their introduction: After all, the joystick (or “control column,” in military parlance) has been a fixture of military aviation since its inception. Here’s just hoping that the Pentagon hasn’t moved on to the Power Glove by the time the next big war rolls around.

How This Video Game Controller Became the US Military’s Weapon of Choice

From Trump campaign signs to Planned Parenthood bumper stickers, license plate readers around the US are creating searchable databases that reveal Americans’ political leanings and more.

While people place signs in their lawns or bumper stickers on their cars to inform people of their views and potentially to influence those around them, the ACLU’s Stanley says it is intended for “human-scale visibility,” not that of machines. “Perhaps they want to express themselves in their communities, to their neighbors, but they don't necessarily want to be logged into a nationwide database that’s accessible to police authorities,” Stanley says.

Weist says the system, at the very least, should be able to filter out images that do not contain license plate data and not make mistakes. “Any number of times is too many times, especially when it's finding stuff like what people are wearing or lawn signs,” Weist says.

“License plate recognition (LPR) technology supports public safety and community services, from helping to find abducted children and stolen vehicles to automating toll collection and lowering insurance premiums by mitigating insurance fraud,” Jeremiah Wheeler, the president of DRN, says in a statement.

Weist believes that, given the relatively small number of images showing bumper stickers compared to the large number of vehicles with them, Motorola Solutions may be attempting to filter out images containing bumper stickers or other text.

Wheeler did not respond to WIRED's questions about whether there are limits on what can be searched in license plate databases, why images of homes with lawn signs but no vehicles in sight appeared in search results, or if filters are used to reduce such images.

“DRNsights complies with all applicable laws and regulations,” Wheeler says. “The DRNsights tool allows authorized parties to access license plate information and associated vehicle information that is captured in public locations and visible to all. Access is restricted to customers with certain permissible purposes under the law, and those in breach have their access revoked.”

**AI Everywhere**

License-plate-recognition systems have flourished in recent years as cameras have become smaller and machine-learning algorithms have improved. These systems, such as DRN and rival Flock, mark part of a change in the way people are surveilled as they move around cities and neighborhoods.

Increasingly, CCTV cameras are being equipped with AI to monitor people’s movements and even detect their emotions. The systems have the potential to alert officials, who may not be able to constantly monitor CCTV footage, to real-world events. However, whether license plate recognition can reduce crime has been questioned.

“When government or private companies promote license plate readers, they make it sound like the technology is only looking for lawbreakers or people suspected of stealing a car or involved in an amber alert, but that’s just not how the technology works,” says Dave Maass, the director of investigations at civil liberties group the Electronic Frontier Foundation. “The technology collects everyone's data and stores that data often for immense periods of time.”

Over time, the technology may become more capable, too. Maass, who has long researched license-plate-recognition systems, says companies are now trying to do “vehicle fingerprinting,” where they determine the make, model, and year of the vehicle based on its shape and also determine if there’s damage to the vehicle. DRN’s product pages say one upcoming update will allow insurance companies to see if a car is being used for ride-sharing.

“The way that the country is set up was to protect citizens from government overreach, but there’s not a lot put in place to protect us from private actors who are engaged in business meant to make money,” Nicole McConlogue, an associate professor of law at the Mitchell Hamline School of Law, who has researched license-plate-surveillance systems and their potential for discrimination.

“The volume that they’re able to do this in is what makes it really troubling,” McConlogue says of vehicles moving around streets collecting images. “When you do that, you're carrying the incentives of the people that are collecting the data. But also, in the United States, you’re carrying with it the legacy of segregation and redlining, because that left a mark on the composition of neighborhoods.”

License Plate Readers Are Creating a US-Wide Database of More Than Just Cars

US Immigration and Customs Enforcement’s one-year contract with Paragon’s US subsidiary comes amid the Biden administration’s years-long crackdown on commercial spyware vendors.

US Immigration and Customs Enforcement has signed a $2 million contract with Israeli commercial spyware vendor Paragon Solutions, according to documents reviewed by WIRED.

The one-year contract between the company’s US subsidiary in Chantilly, Virginia, and ICE’s Homeland Security Investigations Division 3 was signed on September 27 and covers a “fully configured proprietary solution including license, hardware, warranty, maintenance and training.”

Paragon has received the award under the FAR 6.302-1 rule reserved for unique and innovative services not otherwise available to the government and not via the typical competitive process.

It is unknown whether the contract is for the deployment of Paragon’s flagship product, Graphite—a spyware that reportedly extracts data primarily from cloud backups—or another of the company’s products or services. ICE and Paragon did not immediately respond to WIRED’s requests for comment.

This is not Paragon’s first government agency contract. The New York Times reported in December 2022 that the US Drug Enforcement Administration had used Graphite. Similarly, an intelligence publication reported in March 2023 that Paragon had landed a major contract in Singapore worth “tens of millions of dollars.”

Paragon’s contract comes amid a comprehensive effort by the US government to reshape the commercial spyware market over the past three years. Measures have included placing spyware vendors like NSO Group and Intellexa on the so-called Entity List to prevent any US companies from doing business with them; enacting a visa restriction policy against multiple individuals “who have been involved in the development and sale of commercial spyware or who are immediate family members of those involved,” and imposing consecutive rounds of sanctions against spyware vendors.

Many of these efforts followed President Joe Biden signing an executive order in March 2023 that effectively restricted the US government’s use of commercial spyware technology while promoting its “responsible use” that aligns with the protection of human rights.

On a global level, the US is leading an initiative stipulated in the “Joint Statement on Efforts to Counter the Proliferation and Misuse of Commercial Spyware,” which now counts 21 signatories, including Germany, France, UK, Japan, and South Korea, while it recently announced that it would fund governments and civil society groups around the world to develop spyware-related research and regulation.

Paragon, which characterizes itself as a scrupulous kind of spyware maker, is likely responding to the US government’s global push for responsible surveillance. On the website of its US subsidiary, the company boasts that it provides its customers with “ethically based tools,” while one of its investors maintains that the company’s software provides “cutting-edge capabilities that make the world safer.”

Elsewhere, Paragon states that it limits its extraction of information from targeted devices “to conversations on chat apps” and that it “works solely with police forces and intelligence agencies that meet the standards of an enlightened democracy, which includes only 39 countries.”

Paragon was founded in 2019 by veterans from the Israel Defense Forces’ powerful intelligence Unit 8200 with the active involvement of former Israeli prime minister Ehud Barak as an investor who is estimated to own a sizable slice of the company.

The company has received investment from the Boston-headquartered Battery Ventures, “considered to be one of the world’s top venture capital firms,” and two of its founders formerly worked for Blumberg Capital, another large US venture capital firm.

Israeli media reported in June that a US private equity fund with a portfolio of security companies has been in talks to acquire control of Paragon, estimating its valuation at $1 billion.

To secure its unique US-approved, “ethical” positioning, Paragon has made “deliberate efforts” since its establishment to break into the US market, notes the Atlantic Council.

In 2019, as Paragon was developing Graphite, the company enlisted WestExec Advisors, a prominent Washington, DC, consulting firm cofounded by former Obama administration officials, including current US secretary of state Antony Blinken, to advise on its “strategic approach to the US and European markets,” a company executive told the Financial Times. Avril Haines, a former WestExec staffer, is now the US director of national intelligence.

To remain in the US government’s “good graces,” Paragon in February 2023 hired another DC-based lobbying firm, Holland & Knight, “with a good track record in avoiding sanctions,” as some reports point out. Lobbying expenditure disclosure reveals a spend of a minimum $280,000 in 2023 and 2024 for this campaign.

The fact that the spyware vendor has neither been placed on an entity list nor have any of its executives been sanctioned by the Biden administration suggests that Paragon’s lobbying efforts have been successful.

In addition, Biden’s executive order leaves enough margin for the deployment of tools like Graphite. When a senior US administration official was asked specifically about potential abuses of Paragon’s flagship product, they said that the executive order “requires the heads of agencies to review any activity that might be relevant,” without excluding the possibility of lawful use.

Meanwhile, the company continues to grow and is advertising several roles in Israel. In the US, Paragon boosted its presence in the wake of the signing of the executive order and started hiring intelligence veterans, including former CIA and FBI officers at its subsidiary, “hoping it would pick up new business.” Fresh reports from February 2024 confirmed the steady growth.

Paragon’s $2 million contract with ICE is tangible proof that the company’s approach is paying off. It remains to be seen whether Graphite's deployment will align with the protection of human rights, privacy, and democracy.

ICE Signs $2 Million Contract With Spyware Maker Paragon Solutions

UK law enforcement and international partners have released new details about the cybercriminal gang Evil Corp, including its use of the Lockbit ransomware platform and ties to Russian intelligence.

International law enforcement has worked for years to disrupt the cybercriminal gang Evil Corp and its egregious global crime spree. But in a crowded field of prolific Russian cybercriminals, Evil Corp is most notable for its singular relationship with Russian intelligence.

On Tuesday, the United Kingdom's National Crime Agency released new details about the real-world identities of alleged Evil Corp members, the group's connection to the LockBit platform, and the gang's ties to the Russian state. Researchers have increasingly established that there are loose, quid pro quo connections between Russian cybercriminals and the country's government. But NCA officials emphasize that Evil Corp is an unusual example of a gang that has direct relationships with multiple Russian intelligence agencies—including Russia's Federal Security Service, or FSB; Foreign Intelligence Service, or SVR; and military intelligence agency known as the GRU. And the NCA reports that before 2019, Evil Corp was specifically “tasked” by Russia's intelligence services with conducting espionage operations and cyberattacks against unidentified “NATO allies.”

For more than a decade, Evil Corp has used its Dridex malware and other hacking tools to compromise thousands of bank accounts around the world and steal funds. In 2017, the group expanded into ransomware, using strains like Hades and PhoenixLocker, and then using the LockBit platform as an affiliate beginning in 2022. The group has extorted at least $300 million from victims on tops of its other spoils, and the United States Department of State is offering a $5 million reward for information leading to the arrest of the gang's alleged leader, Maksim Yakubets.

“Evil Corp’s story is a prime example of the evolving threat posed by cybercriminals and ransomware operators,” the NCA wrote on Tuesday in a joint report with the FBI and Australian Federal Police. “In their case, the activities of the Russian state played a particularly significant role, sometimes even co-opting this cybercrime group for its own malicious cyber activity.”

Unlike many Russian cybercrime groups that have evolved a distributed leadership structure online, NCA officials say that Evil Corp is organized like a more traditional crime syndicate around Yakubets' family and friends. His father, Viktor Yakubets, allegedly has a background in money laundering, and Maksim's brother Artem, along with cousins Kirill and Dmitry Slobodskoy, are all allegedly involved with the group. Officials also allege that the group has operated out of physical locations, including Chianti Café and Scenario Café in Moscow.

Officials say that Maksim Yakubets has always been the primary liaison between Evil Corp and Russian intelligence. But other members, including his father-in-law, Eduard Benderskiy, also allegedly contribute to the relationships. Benderskiy is reportedly a former FSB official who worked in the mysterious ‘Vympel’ unit and, according to Bellingcat, may have been involved in a series of overseas assassinations. NCA officials say that after the US's 2019 sanctions and indictments against Evil Corp members, Benderskiy worked to protect the gang's senior members within Russia.

In spite of its longtime dominance, Evil Corp has had to continue evolving to keep making money. While it denies a relationship, the group seemed to have used the notorious ransomware-as-a-service platform LockBit to conduct attacks since 2022. And Yakubets’ alleged second in command, whom NCA officials named on Tuesday as Aleksandr Ryzhenkov, was apparently overseeing this work. After international law enforcement launched a major disruption of LockBit in February, the gang has been operating in a diminished capacity, according to the NCA.

“Born out of a coalescing of elite cybercriminals, Evil Corp’s sophisticated business model made them one of the most pervasive and persistent cybercrime adversaries to date,” the NCA wrote. “After being hampered by the December 2019 sanctions and indictments, the group have been forced to diversify their tactics as they attempt to continue causing harm whilst adapting to the changing cybercrime ecosystem.”

Notorious Evil Corp Hackers Targeted NATO Allies for Russian Intelligence

Scamming operations that once originated in Southeast Asia are now proliferating around the world, likely raking in billions of dollars in the process.

More than 200,000 people in Southeast Asia have been forced to run online scams in recent years, often being enslaved and brutalized, as part of criminal enterprises that have netted billions in stolen funds. Such “pig butchering” operations have largely been concentrated in Myanmar, Cambodia, and Laos, typically rooted in Chinese organized crime groups exploiting instability and poor governance in the region. Though they come at great humanitarian cost, pig butchering scams are undeniably lucrative and, perhaps inevitably, similar operations are now being uncovered on multiple continents and in numerous countries around the world.

A WIRED review of law enforcement and civil society action as well as interviews with numerous researchers show that pig butchering operations that are offshoots of the Southeast Asian activity have emerged in the Middle East, Eastern Europe, Latin America, and West Africa. Many of these expanded operations apparently have links to Chinese-speaking criminals or have evolved in parallel to Chinese Belt and Road Initiative investments, the country’s massive international infrastructure and development initiative.

In 2023, the FBI had reports of nearly $4 billion in losses from the scams, and some researchers put all-time total global losses at $75 billion or more. Beijing has made a concerted effort in recent months to crack down on pig butchering schemes and human trafficking to scamming centers in the Southeast Asian region, but the activity is proliferating around the world nonetheless.

“As all sorts of attackers learn that they can make serious money doing this, they’re going to make those pivots,” says Ronnie Tokazowski, a longtime pig butchering researcher and cofounder of the nonprofit Intelligence for Good. “So pig butchering is cropping up in more and more countries. Even with all the interventions researchers and law enforcement have done there is little to no sign of this stopping.”

Pig butchering emerged in the last five years and is a type of scam that involves building seemingly intimate relationships with victims. Attacks often start by texting potential targets out of the blue and getting them talking. Then attackers begin to build a rapport and introduce the idea of a special or unique investment opportunity. Finally, victims send funds—typically cryptocurrency—through a malicious platform meant to look like a legitimate money management service, and attackers must launder the money from there. All of this takes time and careful planning from a large workforce. Experts say people from more than 60 countries have been abducted and trafficked to Southeast Asian scamming compounds that typically operate with thousands of forced workers. And in recent months, scam centers have been detected around the world as well in different configurations and sizes, but with the same goal.

“Organized crime groups have basically taken advantage of a favorable situation, a favorable environment for them related to governance challenges, limited enforcement capacities, limited regulations and legislative frameworks,” says Benedikt Hofmann, the deputy head of the United Nations Office on Drugs and Crime’s Southeast Asia and Pacific office. “All these ingredients you also find in some other places of the world.”

“What we’ve seen is criminal groups who are invested in this region here, looking beyond this region for establishing similar operations,” Hofmann says of the international expansion.

The wealthy, authoritarian city of Dubai, within the United Arab Emirates, has emerged since 2021 as the largest epicenter of pig butchering outside Southeast Asia. According to the UN, international migrants comprise more than 88 percent of the UAE’s population, making a uniquely diverse, and potentially vulnerable, workforce readily available.

“Dubai is both a destination and also a transition country,” says Mina Chiang, the founder and director of Humanity Research Consultancy, a social enterprise focusing on human trafficking. “We can see lots of compounds that are actually operating in Dubai itself.”

In July, Humanity Research Consultancy identified at least six alleged scam compounds believed to be operating around Dubai. The research—based on testimony from forced laborers, data leaked from a cyberattack, and social media posts—identified potential compounds around industrial and investment parks. These operations “to the best of our knowledge are managed by Chinese-speaking criminals,” the research says, adding that they operate in a similar way to compounds in Southeast Asia.

“They call it a typing center. But a huge scam call center,” reads a one-star review left for a location in Dubai on Google Maps. Another says: “Mostly poor people from Africa working there and mosltly jailed in Dubai. No matter how much they offer you everything is scammed. Highly suggest never ever go there.”

Dubai’s police force did not respond to WIRED’s request for comment about potential scam centers located in the city.

Pig butchering operations may have emerged in Dubai because of immigration and workforce dynamics, but in multiple African countries the activity has started to appear because of an existing culture of organized scamming.

In Nigeria, where digital scamming has been a prominent illicit industry for years across numerous platforms, it was all but inevitable that attackers would adopt the conceits and tactics of pig butchering. The scheme is mature enough that there are now readily available prefab cryptocurrency investment platforms, templates, and scripts available for sale online to anyone who wants to get started. A gang that is already used to carrying out romance scams or business email compromise schemes could easily adapt to the premise and cadence of pig butchering.

“If you look at West Africa’s history with social engineering stuff, it’s a potent mix,” says Sean Gallagher, principal threat researcher at Sophos. “You’ve got a lot of people who have seen this as a way to make a living, especially in Nigeria. And the technology is easily transferable. We’ve seen pig butchering packages for sale that include fake crypto sites and scripts that appear to be tailored to targeting African victims.”

Nigerian law enforcement have been increasingly pursuing cases and even securing convictions related specifically to pig butchering. Gallagher and Intelligence for Good’s Tokazowski also say that in studying and interacting with scammers, they have seen technical indicators that pig butchering attacks may be coming out of Ghana as well. The US Embassy in Ghana has warned about the potential for financial scams originating in the country.

Pig butchering has cropped up in other regions of Africa as well, with ties to Chinese-speaking criminals. In June, 88 people in Namibia were rescued from a scam center, which had links to Chinese nationals who were reportedly arrested. Meanwhile, local reports also indicated that 22 Chinese nationals were sentenced to jail time in Zambia for their links to local scam centers.

Stephanie Baroud, a criminal intelligence analyst in Interpol’s human trafficking unit, says the policing organization, which has been coordinating law enforcement actions, has seen an increase in international scam centers. Not all of them are linked to criminal groups from Asia.

“While sometimes we are noting a link to Asian groups, there are cases where there haven't been,” Baroud says. In some situations, she says, new pig butchering activity around the world seems to be an offshoot of Southeast Asian operations, but unrelated actors appear to be taking the model and adapting it to their resources and expertise.

The scams have emerged in Eastern Europe as well. At least two “fraudulent call centers” trying to con people into investing in cryptocurrency were uncovered by law enforcement in Georgia this month, with reports saying men from Taiwan were forced into working in the country. Local officials, who did not respond to WIRED’s request for comment, have said in recent years they have prosecuted seven companies involved in call center operations.

Scam compounds have also been broken up in Peru and Sri Lanka. And there has even been alleged trafficking in truly unexpected places like the Isle of Man, a British territory where almost 100 people were working between 2022 and 2023 as part of a pig butchering operation, according to a BBC investigation from August.

“The People’s Republic of China–origin criminal groups that are behind these sophisticated forms of scamming are looking to build networks and hubs all around the globe simply because this is so lucrative,” says Jason Tower, the country director for Burma and a long-time security analyst covering China and Southeast Asia at the United States Institute of Peace.

Pig butchering scam centers rely upon multiple layers of criminality to operate, encompassing the recruitment of trafficked people, running scam centers on a day-to-day basis, the development of technology to scam thousands of people, and the sophisticated money laundering required to process billions of dollars. As Chinese authorities have cracked down on Chinese-speaking criminal organizations operating scam centers across Southeast Asia, the groups have likely continued to spread their operations, albeit at a smaller scale.

“I would say it was an intentional hedging strategy, seemingly to diversify the geographic basis of operation and ultimately ensure business continuity,” says John Wojcik, an organized crime analyst at the United Nations Office on Drugs and Crime. “But at the same time, I think it’s also an immediate reaction to mounting law enforcement pressure and regulatory tightening in this region.”

In addition to the geographic spread of pig butchering operations, researchers note that there has also been a shift in the people targeted by traffickers to “work” in scam compounds. “Over the past two years, the countries targeted for recruitment have gradually shifted westward,” says Eric Heintz, a global analyst at human rights organization International Justice Mission.

Many trafficking victims within the early years of pig butchering were based in Southeast Asian countries, but this soon shifted to South Asian nations such as India and Nepal, Heintz says. “We have since seen recruitment posts targeting East African nations like Kenya and Uganda, and then West African countries like Morocco, and then, most recently, we have seen posts targeting El Salvador.”

As always, the spread and evolution of pig butchering is driven by how profitable it can be. Researchers say that another alarming trend involves people from around the world choosing to go work in scam centers or even being liberated from forced labor and returning to keep working voluntarily. As long as the money keeps coming in, pig butchering will keep spreading around the world.

“Fraud is not being seen as a serious crime—not like drugs, not like terrorism,” Humanity Research Consultancy’s Chiang says. “Globally, we need to start shifting that idea, because it creates the same kind of damage, and maybe even more because the amount of money we're talking about is so huge. We are racing against time.”

The Pig Butchering Invasion Has Begun

Plus: The US Justice Department indicts three Iranians over Trump campaign hack, EU regulators fine Meta $100 million for a password security lapse, and the Tor Project enters a new phase.

Researchers found a vulnerability in a Kia web portal that allowed them to track millions of cars, unlock doors, honk horns, and even start engines in seconds, just by reading the car's license plate. The findings are the latest in a string of web bugs that have impacted dozen of carmakers. Meanwhile, a handful of Tesla Cybertrucks have been outfitted for war and are literally being-battle tested by Chechen forces fighting in Ukraine as part of Russia’s ongoing invasion.

As Israel escalates its attacks on Lebanon, civilians on both sides of the conflict have been receiving ominous text messages—and authorities in each country are accusing the other of psychological warfare. The US government has increasingly condemned Russia-backed media outlets like RT for working closely with Russian intelligence—and many digital platforms have removed or banned their content. But they’re still influential and trusted alternative sources of information in many parts of the world.

And there's more. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

**New Digital Identity Guidelines Strike Back at Dreadful Password Policies**

A new draft of the US National Institute of Standards and Technology's “Digital Identity Guidelines” finally takes steps to eliminate reviled password management practices that have been shown to do more harm than good. The recommendations, which will be mandatory for US federal government entities and serve as guidelines for everyone else, ban the practice of requiring users to periodically change their account passwords, often every 90 days.

The policy of regularly changing passwords evolved out of a desire to ensure that people weren't choosing easily guessable or reused passwords; but in practice, it causes people to choose simple or formulaic passwords so they will be easier to keep track of. The new recommendations also ban “composition rules,” like requiring a certain number or mix of capital letters, numbers, and punctuation marks in each password. NIST writes in the draft that the goal of the Digital Identity Guidelines is to provide “foundational risk management processes and requirements that enable the implementation of secure, private, equitable, and accessible identity systems.”

**DOJ Indicts Alleged Iranian Hackers Over Trump Campaign Breach**

The US Department of Justice unsealed charges on Friday against three Iranian men who allegedly compromised Donald Trump’s presidential campaign and leaked stolen data to media outlets. Microsoft and Google warned last month that an Iranian state-sponsored hacking group known as APT42 had targeted both the Joe Biden and Donald Trump presidential campaigns, and successfully breached the Trump campaign. The DOJ claims the hackers compromised a dozen people as part of its operation, including a journalist, a human rights advocate, and several former US officials. More broadly, the US government has said in recent weeks that Iran is attempting to interfere in the 2024 election.

“The defendants’ own words made clear that they were attempting to undermine former President Trump’s campaign in advance of the 2024 U.S. presidential election,” Attorney General Merrick Garland said at a press conference on Friday. "We know that Iran is continuing with its brazen efforts to stoke discord, erode confidence in the US electoral process, and advance its malign activities.”

**Irish Regulator Fines Meta More Than $100 Million Over 2019 Password Lapse**

The Irish Data Protection Commission fined Meta €91 million, or roughly $101 million, on Friday for a password storage lapse in 2019 that violated the European Union's General Data Protection Regulation. Following a report by Krebs on Security, the company acknowledged in March 2019 that a bug in its password management systems had caused hundreds of millions of Facebook, Facebook Lite, and Instagram passwords to be stored without protection in plaintext in an internal platform. Ireland's privacy watchdog launched its investigation into the incident in April 2019.

“It is widely accepted that user passwords should not be stored in plaintext, considering the risks of abuse that arise from persons accessing such data," Irish DPC deputy commissioner Graham Doyle said in a statement. “It must be borne in mind that the passwords, the subject of consideration in this case, are particularly sensitive, as they would enable access to users’ social media accounts.”

**The Tor Project and the Tails Privacy Operating System Are Merging**

The digital anonymity nonprofit the Tor Project is merging with privacy- and anonymity-focused Linux-based operating system Tails. Pavel Zoneff, the Tor Project’s communications director, wrote in a blog post on Thursday that the move will facilitate collaboration and reduce costs, while expanding both groups' reach. “Tor and Tails provide essential tools to help people around the world stay safe online,” he wrote. “By joining forces, these two privacy advocates will pool their resources to focus on what matters most: ensuring that activists, journalists, other at-risk and everyday users will have access to improved digital security tools.”

The US Could Finally Ban Inane Forced Password Changes

A handful of Tesla’s electric pickup trucks are armed and ready for battle in the hands of Chechen forces fighting in Ukraine as part of Russia’s ongoing invasion. Can the EV take the heat?

The Greeks had their chariots. Patton had his tanks. Now, a handful of soldiers are riding into combat in one of the most unusual-looking vehicles in the history of warfare: an armed Cybertruck.

In a video posted to messaging platform Telegram last week, Ramzan Kadyrov, the leader of Russia’s Chechnya region, showed off a pair of Tesla’s distinctive boxy electric pickup trucks painted forest green and armed with what appear to be Soviet-era DShK 12.7 x 108 mm heavy machine guns—vehicles he claimed had been sent to fight alongside Russian forces taking part in the country’s ongoing invasion of Ukraine.

The footage shows the vehicles patrolling down a dirt road as part of a four-vehicle platoon, with several soldiers manning their weapons mounted on their truck beds and blasting airborne targets out of the sky.

“Mobility, convenience, maneuverability: such qualities of an electric vehicle are in great demand here,” Kadyrov wrote on Telegram.

The new footage came just over a month after Kadyrov published an initial video to Telegram showing off a Cybertruck armed with a Russian Kord 12.7 x 108 mm heavy machine gun. That Cybertruck, Kadyrov claimed in a separate Telegram post made the day before unveiling the fresh pair of vehicles, had recently been disabled “remotely” by Tesla chief Elon Musk, who had previously denied gifting the notorious warlord the vehicle in the first place, likely because it’s prohibited under US sanctions on Russia.

“This is not manly,” Kadyrov seethed on Telegram over the remote shutoff. (Tesla did not immediately respond to WIRED’s request for comment.)

It was only a matter of time before some enterprising combatant somewhere slapped a machine gun on a Cybertruck. Both regular militaries and irregular forces around the world have been whipping up “technicals”—or “nonstandard tactical vehicles” improvised from civilian rides—for more than a century. While the general concept of armored cars outfitted with firearms presaged the outbreak of World War I by at least a decade, the conflict accelerated their production and fielding—and, in moments of necessity, innovation. In one of the earliest documented manifestations of the technical, French navy lieutenant Maxime François Émile Destremau prepared a defense of the strategically important coaling station in the city of Papeete in Tahiti against a pair of German cruisers in September 1914 by tearing six 37 mm cannons off the warship under his command and mounting them on six Ford trucks to repel potential landing parties, according to the 2004 book _On Armor_. As long as the automobile has existed, so has the technical.

The technical as most defense observers know it, built on commercial flatbed pickup trucks like the rugged and reliable Toyota Hilux and Land Cruiser, became a fixture of modern irregular warfare during the so-called “Toyota War” of the 1980s that saw militia forces from Chad achieve a decisive victory over the Libyan military thanks to the superior mobility and maneuverability afforded by their lightweight vehicles. (Chadian forces discovered that, at an appropriately high speed, technicals could traverse open areas mined with Soviet-era munitions without risk of setting them off.)

Since then, technicals have become a fixture of conflicts like the US military campaigns in Afghanistan and Iraq, the Syrian and Libyan Civil Wars, and now the Russian invasion of Ukraine. And those conflicts continued to prompt a flurry of novel innovations when it comes to improvised fighting vehicles. Examples include Libyan militants mounting a S-5 rocket pod meant for an aircraft on the back of a truck and a Land Cruiser outfitted with a Russian-made 14.5 mm ZPU-2 antiaircraft gun that American soldiers traded two cans of chewing tobacco for to secure Hamid Karzai International Airport in Kabul during the US withdrawal from Afghanistan in 2021—the latter of which is now in a US military museum. (Does a DShK on a shopping cart count as a technical? That’s up for debate.)

All of those innovations open up the question: Will an armed Cybertruck actually make for a good technical on the battlefield?

Despite the many issues that have plagued the Cybertruck since its release, the vehicle isn’t necessarily the worst option. While the Cybertruck currently has a maximum range of 340 miles (or 500 miles with an extra battery pack)—well behind the roughly 570- to 700-mile range of the Hilux—the former is actually quicker, capable of accelerating up to 60 mph between 2.6 and 3.9 seconds, depending on the model, a noteworthy achievement given the vehicle’s size and weight.

In terms of safeguarding its occupants from external threats like small arms fire, the Cybertruck’s steel “exoskeleton” offers purportedly superior protection to that of the conventional pickup truck, a feature that Tesla has been quick to flaunt on promotional materials. Finally, the Cybertruck, as an electric vehicle, is freakishly quiet, offering an element of stealth that the US Defense Department in particular has eyed in recent years compared to other fossil-fuel-powered ground vehicles.

“There are some attributes that work,” David Tracy, a cofounder of the car website The Autopian and a former auto engineer, tells WIRED. “It’s off-road capable and has big 35-inch tires and good ground clearance. It has stainless steel panels that can take some amount of abuse. From a defense standpoint—as in, ‘How safe am I in the vehicle?’—if you were to take a stock Hilux or a stock Cybertruck, the Cybertruck would probably be the better choice in a firefight.”

If technicals are built for speed and maneuverability, then the Cybertruck “offers significant benefits over the Hilux,” Tracy says.

“It is absolutely, absurdly quick,” he says. “In a drag race between the two, the Hilux would be an ant in the Cybertruck’s rearview mirror. If you need speed and agility, and it isn’t necessarily going through rigorous off-roading or being fired upon regularly, then it could actually work fine.”

Despite these potential tactical benefits, defense analysts aren’t convinced the Cybertruck has a place on the modern battlefield. As retired Marine colonel Mark Cancian, a senior adviser at the Center for Strategic and International Studies think tank, tells WIRED, the armed vehicles flaunted by Kadyrov on Telegram “are totally cool and totally useless.”

“They are cool because they look like something out of a video game and portray Kadyrov as a sort of futuristic warlord,” Cancian tells WIRED in an email. “They are useless because they don't provide a new capability, except perhaps a bit of stealth.”

Indeed, the Cybertruck is not totally suited for hostile and chaotic environments like the front lines of the Russian invasion of Ukraine. First, the EV’s exoskeleton actually consists of steel panels attached to a standard “unibody” frame that’s more akin to the chassis of a conventional car rather than the “body-on-frame” design of most pickup trucks like the Hilux. This design, according to Motor Trend, makes the former a weaker and less resilient vehicle. Second, while the Cybertruck is certainly off-road capable, it’s still significantly heavier than Hilux, which can make maneuverability and traction on rough terrain a challenge. Third, while its armor portends to offer at least some additional coverage compared to the conventional pickup truck-based technical, the vehicle’s bulletproofing only appears to work with subsonic rounds like the .45 ACP ammo used in Tesla’s tests and not the ubiquitous NATO-standard 5.56 mm round or, say, a shot from a .50 caliber rifle. (Though, to be fair, aftermarket armor packages for the vehicle do exist.)

Beyond design and engineering challenges, there’s also the critical matter of maintenance and logistics, the lifeblood of any motorized conflict. As Tracy points out, the Cybertruck’s unique complexity and software-forward design (like the lack of a physical connection between steering wheel and wheels) means a distinct lack of spare parts and higher potential for catastrophic system failures, challenges that all but guarantee that the vehicle is unable to operate reliably and ensure consistent uptime—not necessarily ideal for troops whose lives may depend on them.

“Simplicity is everything; simplicity and parts availability,” Tracy says. “If you’re driving a complex vehicle and there’s a failure of some sort and you need someone to flash it with a computer, you’re hosed if you’re in the middle of nowhere. The beauty of the Hilux is that they’re very tough, for one, but they can be repaired with simple tools and fairly ubiquitous parts. The Cybertruck does not really make a whole lot of sense in that regard.”

“It’s great that it is safe in a crash and can take a bullet,” he adds. “But if you break a control arm and can’t get the part, it’s pretty useless.”

Plus, the Cybertruck’s reliance on charging stations would make a fleet of armed vehicles “likely impossible to support” in any sort of protracted conflict like that taking place in Ukraine, according to CSIS’s Cancian.

“I doubt there are garages or mechanics near the front lines who can fix these complex devices, which are so unlike the fossil fuel vehicles that the region is accustomed to,” he says. “Further, I doubt there are many recharging stations in the battle area. Unlike with fossil fuel vehicles, where the fuel can be brought to the vehicle if necessary, the Cybertrucks must go to the recharging point.”

How the Cybertruck will actually perform in a combat situation remains to be seen. But if the Kadyrov video is any indication, it’s only a matter of time before an armed Cybertrucks makes the transition from YouTube sensation to tried-and-true, battle-tested technical.

Source

Wired