A bill to prevent cops and spies from buying Americans’ data instead of getting a warrant has a fighting chance in the US Congress as lawmakers team up against surveillance overreach.

United States lawmakers are moving with uncommon speed to close a loophole in federal law that police and intelligence agencies use to collect sensitive information on US citizens—up to and including their physical whereabouts—all without the need for a warrant.

The Federal Bureau of Investigation (FBI) and the Defense Intelligence Agency are among several government entities known to have solicited private data brokers to access information for which a court order is generally required. A growing number of lawmakers have come to view the practice as an end run around the US Constitution’s Fourth Amendment guarantees against unreasonable government searches and seizures. 

“This unconstitutional mass government surveillance must end,” Warren Davidson, Republican congressman from Ohio, says. 

Members of the House Judiciary Committee, led by Ohio’s Jim Jordan, a Republican, will hold a markup hearing tomorrow to consider a Davidson bill aimed at restricting purchases of Americans’ data without a subpoena, court order, or warrant. If passed into law, the legislation's restrictions would apply to federal agencies as well as state and local police departments. Known as the Fourth Amendment Is Not For Sale Act, the bill is cosponsored by four Republicans and four Democrats, including the committee’s ranking member, Jerry Nadler,  a Democrat, who first introduced it alongside California Democrat Zoe Lofgren in 2021. 

Notably, the bill's protections extend to data obtained from a person's account or device even if hacked by a third party, or when disclosure is referenced by a company's terms of service. The bill's sponsors note this would effectively prohibit the government from doing business with companies such as Clearview AI, which has admitted to scraping billions of photos from social media to fuel a facial recognition tool that's been widely tested by local police departments.

“The principle here is simple,” Nadler said when the legislation was first introduced two years ago. “The government should not be allowed to purchase its way around the rules Congress has enacted to protect the privacy of American citizens.”

In addition to Davidson, Nadler, and Lofgren, the bill is cosponsored by Republicans Andy Biggs, Ken Buck, and Thomas Massie, joining two other Democrats, Pramila Jayapal and Sara Jacobs.

An aide to Jim Jordan, the Judiciary Committee's Republican chairman, signaled that he would likewise support the bill, highlighting the degree to which domestic surveillance fears have risen to supersede fractious politics. The bill had been previously introduced by a bipartisan group of senators in 2021 and had acquired more than 20 cosponsors, including Chuck Schumer, the Senate majority leader. However, the legislation ultimately failed to make much headway in Congress.

A report declassified last month by the nation’s top intelligence official, Avril Haines, stated that a “large amount” of “sensitive and intimate information” has been purchased by the intelligence community, including information that the US Supreme Court has previously ruled is protected by the Fourth Amendment. Senior congressional sources say many lawmakers were taken aback by the apparent breadth of the collection and of the warnings in the report about its potential to “facilitate blackmail, stalking, harassment, and public shaming.” 

Other lawmakers are alarmed by the FBI’s disclosure of having purchased location information derived from people’s cell phones. During a hearing in March, the FBI director, Christopher Wray, told senators that the bureau had “previously—as in the past—purchased some such information for a specific national security pilot project.”

Americans have a reasonable expectation of privacy, the US Supreme Court says, when it comes to certain digital information, including that which could reveal “the whole of their physical movements.” Such data—which the court describes as “detailed, encyclopedic, and effortlessly compiled”—need not be GPS-precise merely to justify a warrant. Nevertheless, the government has widely adopted the view that the Fourth Amendment does not apply when that same data is available to it commercially. 

When provided, the government's reasoning typically hinges on analysis of the landmark 2018 _Carpenter v. United States_ decision, in which the Supreme Court ruled that the government’s warrantless acquisition of cellular records, which can be used to track a person’s movements, had violated the rights of a 32-year-old man who'd been convicted of carrying out a string of robberies.

In its 5–4 opinion, the court refers to police demanding or “compelling” access to data, something that literal interpreters of the law say places commercial arrangements with data brokers squarely outside the scope of the court opinion. What's more, government lawyers have pointed to acknowledgment from the court that the debate over _Carpenter_ did not consider “collection techniques involving foreign affairs or national security.”

The Supreme Court has erstwhile framed the Fourth Amendment as a means to “plac\[ing\] obstacles in the way of a too permeating police surveillance,” something that the Constitution’s authors deemed a “greater danger to a free people than the escape of some criminals from punishment.” Oft-cited by the court is a passage by a 19th-century American jurist: “Of all the rights of the citizen, few are of greater importance or more essential to his peace and happiness than the right of personal security, and that involves not merely protection of his person from assault, but exemption of his private affairs, books, and papers, from the inspection and scrutiny of others. Without the enjoyment of this right, all others would lose half their value.”

What rules or guidelines do exist within the intelligence community for purchasing commercial data often justify the activity by deeming the information “publicly available,” pointing to the fact that it may be open for purchase by not only private companies but foreign governments as well. While true and worrying, that is also irrelevant, says Bob Goodlatte, the former chairman of the House Judiciary Committee who now works as a senior policy adviser for the Project for Privacy & Surveillance Accountability, a pro-privacy group.

“None of those other entities can arrest you, can charge you with a crime, try you, sentence you, imprison you, restrain you, enjoin you, fine you, tax you,” Goodlatte says. “All of those are powers of government, and any American should be concerned about the ease with which the federal government can gather information about people.”

Sean Vitka, a senior attorney at the nonprofit Demand Progress, whose slate of issues encompasses privacy and national security reforms, says domestic surveillance was proving to be one of the most bipartisan issues today in Congress, pointing not only to tomorrow’s markup hearing but a concurrent battle being fought over similar purchases by the US military. The House of Representatives last week voted to support an amendment to a defense spending bill requiring a warrant for all data typically protected by the Fourth Amendment, regardless of whether it's for sale. (The amendment was narrowed earlier in the week to exclude non-military agencies, including state and local police departments, which do not fall under the committee of jurisdiction's purview.)

The defense measure, and even the Fourth Amendment Is Not For Sale Act, is a mere prelude to a much bigger fight coming this fall over what's considered the “crown jewel” of the US intelligence community: Section 702 of the Foreign Intelligence Surveillance Act. 

“We are now seeing momentous alignment of powerful political actors in favor of enacting major privacy protections for people in the United States,” says Vitka, “on the eve of the biggest fight over warrantless surveillance in generations.”

Fourth Amendment Is Not for Sale Act Goes Back to Congress

Plus: A fitness app may have leaked the location of a murdered submarine captain, the privacy risks of filing taxes online, and how Facebook data was used in an abortion trial.

IPVM disputes this allegation and says it promptly contacted the FBI upon discovering the crimes.

A murdered Russian submarine captain may have been tracked by his killer through the Strava fitness app. According to the BBC, the commander, Stanislav Rzhitsky, kept a public Strava profile that detailed his jogging routes—including one that took him through the park where he was killed early this week.

Privacy experts have been concerned about the dangers posed by social fitness apps like Strava for years. In 2018, for example, researchers exposed several secret US military installations using public data from soldiers tracking their fitness with the app.

While the killer’s motivations are currently unclear, Russian investigators say they arrested a man named Serhiy Denysenko, born in Ukraine, in connection with the murder. According to several Russian Telegram channels, Denysenko was the former head of the Ukrainian Karate Federation.

Ukrainian media reported that Rzhitsky commanded a Russian Kilo-class submarine that may have carried out a deadly missile attack on the Ukrainian city of Vinnytsia last year. Rhitsky’s personal information had previously been uploaded to the Ukrainian website Myrotvorets (Peacemaker), an unofficial database of people considered to be enemies of Ukraine, according to CNN.

Ukraine’s Defense Intelligence did not take responsibility for the commander’s death. “Obviously, he was eliminated by his own men for refusing to continue to carry out combat orders from his command regarding missile attacks on peaceful Ukrainian cities,” the agency wrote in a statement.

A congressional investigation, led by US senator Elizabeth Warren, found that millions of Americans who file their taxes online with H&R Block, TaxSlayer, and TaxAct had financial information shared with Google and Facebook. The investigation was spurred by a 2022 report by The Markup that revealed how the three companies were transmitting sensitive data to Facebook through a tool called the Meta Pixel. The data was sent as taxpayers filed their taxes and contained personal information, including income and refund amounts.

Warren and six other lawmakers wrote to the US Justice Department this week, asking for criminal charges against the tax companies for breaking laws forbidding them from sharing their clients’ personal information. “The tax prep firms were shockingly careless with their treatment of taxpayer data,” the lawmakers wrote.

A third of the 80,000 most popular websites on the internet use the Meta Pixel, a 2020 investigation by The Markup found. Website operators include the pixel to measure clicks from their ads on Facebook’s platforms, but at the expense of their users’ privacy. Crisis Pregnancy Centers, Suicide Hotlines, and hospitals and have all been caught sending sensitive user data to Meta in the past few years.

The seven Democrats called on the US Internal Revenue Service to build its own free tax preparation software, though government services have also been caught using the Pixel to send data to Meta.

A Nebraska woman has pleaded guilty to criminal charges after helping her 17-year-old daughter with a medication abortion last year; key evidence against her included her Facebook messages. In mid-June of 2022, Nebraska police sent a warrant to Meta requesting private messages from the mother and daughter as part of an investigation into an illegal abortion, court documents show. The chats appear to show the mother instructing her daughter about how to take the pills. “Ya the 1 pill stops the hormones an rhen u gotta wait 24 HR 2 take the other,” reads one of her messages.

Since the US Supreme Court overturned _Roe v. Wade_ in June 2022, experts have raised serious concerns about the variety of ways data will be weaponized by law enforcement who want to prosecute people seeking abortions. Because Facebook Messenger doesn’t default to end-to-end encryption (E2EE) the way messaging services like Signal, WhatsApp, and iMessage do, people are especially vulnerable to criminal investigations if they use the platform.

According to a recent report from Reuters, prosecutors told a London court that a teenager associated with the hacking group Lapsus$ was responsible for high-profile hacks of Uber and fintech company Revolut in September of last year. Arion Kurtaj, who is 18, faces 12 charges, including three counts of blackmail, two counts of fraud, and six charges under the UK’s Computer Misuse Act.

The Uber hack reportedly cost the company $3 million in damages. At the time, Uber said the hacker who took responsibility posted pornographic material to an internal information page alongside the message: “Fuck you wankers.”

Kurtaj, along with an unnamed 17-year-old, is also facing allegations of blackmailing BT Group, EE, and Nvidia. Prosecutors described the pair as “key players” in Lapsus$. Kurtaj has been deemed not fit to stand trial by medical professionals; the jury will decide whether he is responsible for the hacking incidents rather than guilty of them.

Nude Videos of Kids From Hacked Baby Monitors Were Sold on Telegram

The FBI has collected sensitive data on millions of Americans without warrants, drawing intense scrutiny from Congress and turning the agency into a punching bag across the political divide.

Fears over the death of privacy in the United States are turning some of Washington’s most pronounced enemies into the strangest of bedfellows. Lawmakers usually thought incapable of reconciling even the smallest of differences are finding rare common ground over a shared mistrust of the Federal Bureau of Investigation, and a mutual disdain for domestic spying.

At a committee hearing Wednesday, US Representative Zoe Lofgren of California called out the FBI's director, Christopher Wray, over a disclosure he’d reluctantly made in March: Not long ago, he said, the FBI had circumvented the need to obtain search warrants by buying commercial data that revealed the whereabouts of an unknown number of Americans. Buying this data, rather than compelling its disclosure, allowed the FBI to forgo asking a judge’s permission—a requirement as of 2018, thanks to the Supreme Court decision _Carpenter v. United States._

Disturbed by this revelation, Lofgren—a 14-term Democrat and leader of past efforts to curb government surveillance on US soil—used the hearing to take a deeper interest in Wray’s claim that the data was originally collected for advertising purposes. Wray showed resistance to revealing anything new, saying only that the deal was legal and that his staff would follow up with Lofgren; that way, he added, “I don’t leave something important out.”

With limited time, Lofgren moved on to other concerns. But as her time expired she ended with a warning: “We’ll be looking into those warrant requirements later.” Jim Jordan, the committee's Republican chair, chimed in as Lofrgen’s microphone went dead. “We sure will,” he said. “We sure will.”

Since last year's raid on ex-president Donald Trump’s Mar-a-Lago residence, the FBI has been persona non grata in most conservative circles. Widely despised on the right, the bureau is a boogeyman featured in many right-wing conspiracy theories, largely designed to explain away Trump’s election defeat and the role of his supporters in the insurrection that followed. Many of the questions that top Republicans put to Wray on Wednesday were seemingly designed to lend credence to these theories. A few members, like Matt Gaetz of Florida, dove deep into InfoWars-like waters.

One line of questioning was plainly meant to implicate the FBI in helping to plant a bomb outside of a Democratic Party building on the day of the insurrection. Unfortunately, it’s the bureau’s own troubled history that makes it so difficult to defend against such claims.

It fell mostly on Democrats like Lofgren to point out the irony in labeling an organization known for its Christian conservative leanings of being secretly chock-full of anarchists. Congressman Ken Buck of Colorado noted that Wray’s Wikipedia page lists him as a registered Republican. “I hope," he said, "you don’t change your party affiliation after this hearing is over.”

One of the farthest-right members in the House, Gaetz took his turn questioning Wray immediately after Lofgren. His first words were in her defense. “The American people need to understand what just happened,” he railed. “My Democratic colleague just asked the director of the FBI whether or not they are buying information about our fellow Americans, and the answer is, ‘Well, we’ll just have to get back to you.’”

In an exchange overheard by an Associated Press reporter present for the hearing, Gaetz also heaped praise on another political rival moments after she, too, laid into the director. (“That was terrific," he reportedly said.)

Congresswoman Pramila Jayapal of Washington had dedicated much of her time to drawing attention to a report declassified last month by Avril Haines, the director of national intelligence and America’s “top spy.” The report states that the purchasing of personal information typically protected under the US constitution—GPS data pulled largely from cell phones, in particular—is a widespread practice throughout the intelligence community (of which, notably, the FBI is a member).

The report deems the data being actively collected by the US government to be both “sensitive and intimate.” In the wrong hands, a group of former spies turned advisers to Haines wrote, Americans would be vulnerable to serious crimes like harassment, identity theft, and blackmail. Intelligence agencies collect this data, nevertheless, the report states, using a legal theory that paying for it removes any need to obtain a search warrant.

Privacy experts at digital rights groups, including Demand Progress and the American Civil Liberties Union, consider this practice a legal loophole at odds with the US Constitution's goal of protecting against unlawful searches and seizures. Many lawmakers, including Jayapal and Lofgren, feel similarly.

Wray went on to explain that his story had not changed since he first disclosed the purchases in March and that the FBI was not actively purchasing location data at this moment. It is unclear what exactly became of the data it did purchase or how it was used, if at all. The FBI has said the data was collected by private companies for advertising purposes and that it was acquired by the government for a vague “pilot project.” An FBI spokesperson did not immediately respond to a request for comment.

The protection of location and web browsing data were not the only concern raised by lawmakers Wednesday. Republican Thomas Massie would also pepper Wray with questions about another FBI request for “gun purchase records” reportedly issued to a major US bank. The records, Massie claimed, had “no geographical boundaries,” meaning the request was likely not limited to a particular area, city, or state.

Wray resisted the questions, as he had for most of the hearing. “What I do know,” the director said, “is that a number of business community partners all the time—including financial institutions–share information with us about possible criminal activity.” Massie then asked Wray to clarify whether the bank had volunteered the data or whether the FBI had requested it first.

Wray declined to respond to the question, saying he could not “speak to specifics.”

Wray was not entirely opposed to the idea of bettering privacy protections for at least some Americans. Law enforcement officers, he noted, face threats of violence every day as a result of being doxed online. “The more information, personalized information, about law enforcement professionals that is on the internet, the more people who may be unstable or inclined to violence there are out there who can choose to act on it,” he said.

But police officers, who are armed and trained to defend themselves from a variety of dangers, are not the only people who face such threats. As past reporting has shown, however, they are, on occasion, the ones who are doing the doxing.

Separately, another House committee on Thursday advanced an amendment to a “must-pass” defense spending bill that would order all US military departments to forgo purchasing data that would “otherwise require a warrant, court order, or subpoena.” This would include the same type of location-based purchases previously acknowledged by the FBI, though the FBI itself is not bound by the amendment. The new law would, instead, cover roughly half of the US intelligence community’s 17 members—those, such as the National Security Agency and Office of Naval Intelligence, that fall under the Defense Department’s umbrella.

Previously, several agencies reporting to the Defense Department, including special operations teams and the Defense Intelligence Agency, have acknowledged purchasing commercial data that would normally have required a warrant.

Whether the defense amendment—introduced by Warren Davidson, a Republican—will survive Congress and eventually become law is impossible to say at this juncture. But the fact that it was adopted by the House of Representatives at all is nothing short of a watershed moment for privacy defenders; a reflection of the growing unease among US lawmakers with the government's current outlook on its authority to warrantlessly surveil its own citizens.

FBI Surveillance Fears Are Uniting a Badly Broken Congress

Microsoft says hackers somehow stole a cryptographic key, perhaps from its own network, that let them forge user identities and slip past cloud defenses.

For most IT professionals, the move to the cloud has been a godsend. Instead of protecting your data yourself, let the security experts at Google or Microsoft protect it instead. But when a single stolen key can let hackers access cloud data from dozens of organizations, that trade-off starts to sound far more risky.

Late Tuesday evening, Microsoft revealed that a China-based hacker group, dubbed Storm-0558, had done exactly that. The group, which is focused on espionage against Western European governments, had accessed the cloud-based Outlook email systems of 25 organizations, including multiple government agencies.

Those targets encompass US government agencies including the State Department, according to CNN, though US officials are still working to determine the full scope and fallout of the breaches. An advisory from the US Cybersecurity and Infrastructure Security Agency says the breach, which was detected in mid-June by a US government agency, stole unclassified email data “from a small number of accounts.”

China has been relentlessly hacking Western networks for decades. But this latest attack uses a unique trick: Microsoft says hackers stole a cryptographic key that let them generate their own authentication “tokens”—strings of information meant to prove a user’s identity—giving them free rein across dozens of Microsoft customer accounts.

“We put trust in passports, and someone stole a passport-printing machine,” says Jake Williams, a former NSA hacker who now teaches at the Institute for Applied Network Security in Boston. “For a shop as large as Microsoft, with that many customers impacted—or who could have been impacted by this—it’s unprecedented.”

In web-based cloud systems, users’ browsers connect to a remote server and, when they enter credentials like a username and password, they’re given a bit of data, known as a token, from that server. The token serves as a kind of temporary identity card that lets users come and go as they please within a cloud environment while only occasionally reentering their credentials. To ensure that the token can’t be spoofed, it’s cryptographically signed with a unique string of data known as a certificate or key that the cloud service possesses, a kind of unforgeable stamp of authenticity.

Microsoft, in its blog post revealing the Chinese Outlook breaches, has described a kind of two-stage breakdown of that authentication system. First, hackers were somehow able to steal a key that Microsoft uses to sign tokens for consumer-grade users of its cloud services. Second, the hackers exploited a bug in Microsoft’s token validation system, which allowed them to sign consumer-grade tokens with the stolen key and then use them to instead access enterprise-grade systems. All of this occurred despite Microsoft’s attempt to check for signatures from different keys for those different grades of token.

Microsoft says it has now blocked all tokens that were signed with the stolen key and replaced the key with a new one, preventing the hackers from accessing victims’ systems. The company adds that it has also worked to improve the security of its “key management systems” since the theft occurred.

But exactly how such a sensitive key, allowing such broad access, could be stolen in the first place remains unknown. WIRED contacted Microsoft, but the company declined to comment further.

In the absence of more details from Microsoft, one theory of how the theft occurred is that the token-signing key wasn’t in fact stolen from Microsoft at all, according to Tal Skverer, who leads research at the security Astrix, which earlier this year uncovered a token security issue in Google’s cloud. In older setups of Outlook, the service is hosted and managed on a server owned by the customer rather than in Microsoft’s cloud. That might have allowed the hackers to steal the key from one of these “on-premises” setups on a customer’s network.

Then, Skverer suggests, hackers might have been able to exploit the bug that allowed the key to sign enterprise tokens to gain access to an Outlook cloud instance shared by all the 25 organizations hit by the attack. “My best guess is that they started from a single server that belonged to one of these organizations,” says Skverer, “and made the jump to the cloud by abusing this validation error, and then they got access to more organizations that are sharing the same cloud Outlook instance.”

But that theory doesn’t explain why an on-premises server for a Microsoft service inside an enterprise network would be using a key that Microsoft describes as intended for signing consumer account tokens. It also doesn’t explain why so many organizations, including US government agencies, would all be sharing one Outlook cloud instance.

Another theory, and a far more troubling one, is that the token-signing key used by the hackers was stolen from Microsoft’s own network, obtained by tricking the company into issuing a new key to the hackers, or even somehow reproduced by exploiting mistakes in the cryptographic process that created it. In combination with the token validation bug Microsoft describes, that may mean it could have been used to sign tokens for any Outlook cloud account, consumer or enterprise—a skeleton key for a large swath, or even all, of Microsoft’s cloud.

The well-known web security researcher Robert “RSnake” Hansen says he read the line in Microsoft’s post about improving the security of “key management systems” to suggest that Microsoft’s “certificate authority”—its own system for generating the keys for cryptographically signing tokens—was somehow hacked by the Chinese spies. “It’s very likely there was either a flaw in the infrastructure or configuration of Microsoft’s certificate authority that led an existing certificate to be compromised or a new certificate to be created,” Hansen says.

If the hackers did in fact steal a signing key that could be used to forge tokens broadly across consumer accounts—and, thanks to Microsoft’s token validation issue, on enterprise accounts, too—the number of victims could be far greater than 25 organizations Microsoft has publicly accounted for, warns Williams.

To identify enterprise victims, Microsoft could look for which of their tokens had been signed with a consumer-grade key. But that key could have been used to generate consumer-grade tokens, too, which might be far harder to spot given that the tokens might have been signed with the expected key. “On the consumer side, how would you know?” Williams asks. “Microsoft hasn’t discussed that, and I think there’s a lot more transparency that we should expect.”

Microsoft’s latest Chinese spying revelation isn’t the first time state-sponsored hackers have exploited tokens to breach targets or spread their access. The Russian hackers who carried out the notorious Solar Winds supply chain attack also stole Microsoft Outlook tokens from victims’ machines that could be used elsewhere on the network to maintain and expand their reach into sensitive systems.

For IT administrators, those incidents—and particularly this latest one—suggest some of the real-world trade-offs of migrating to the cloud. Microsoft, and most of the cybersecurity industry, has for years recommended the move to cloud-based systems to put security in the hands of tech giants rather than smaller companies. But centralized systems can have their own vulnerabilities—with potentially massive consequences.

“You’re handing over the keys to the kingdom to Microsoft,” says Williams. “If your organization is not comfortable with that now, you don’t have good options.”

How a Cloud Flaw Gave Chinese Spies a Key to Microsoft’s Kingdom

Ransomware attacks tumbled in 2022, offering hope that the tide was turning against the criminal gangs behind them. Then things got a whole lot worse.

Amid a concerted effort by global law enforcement to crack down on ransomware attacks, payments to hackers and even the volume of attacks fell in 2022. But the trend doesn’t seem to be holding for 2023, and attacks have shot up again.

Data from cryptocurrency tracing firm Chainalysis indicates that victims have paid ransomware groups $449.1 million in the first six months of this year. For all of 2022, that number didn’t even reach $500 million. If this year’s pace of payments continues, according to the company’s data, the total figure for 2023 could hit $898.6 million. This would make 2023 the second biggest year for ransomware revenue after 2021, in which Chainalysis calculates that attackers extorted $939.9 million from victims.

The findings track with general observations from other researchers that the volume of attacks has spiked this year. And they come as ransomware groups have become more aggressive and reckless about publishing sensitive and potentially damaging stolen information. In a recent attack against the University of Manchester, hackers directly emailed the UK university’s students telling them that seven terabytes of data had been stolen and threatening to publish "personal information and research" if the university didn’t pay up.

“We think as a result of their budgetary shortfalls in 2022 we’ve seen these more extreme extortion techniques, ways to kind of twist the knife,” says Jackie Burns Koven, head of cyber threat intelligence at Chainalysis. “In 2022 we were very surprised to find that decline. Then we talked to external partners—incident response firms, insurance companies—and they all said, yeah, we’re paying less, and we’re also seeing fewer attacks.”

Chainalysis and other organizations attributed the slump in 2022 to a number of factors. Expanded security protections and preparedness played a role, as did the availability of decryption tools offered by private companies and the FBI to help ransomware victims unlock their data without paying attackers. Chainalysis also believes that Russia’s invasion of Ukraine impacted the day-to-day operations of a number of prominent ransomware groups, which are primarily based in Russia.

Improvements in how potential victims defend themselves along with government deterrence initiatives haven’t fallen off in 2023. But Chainalysis researchers suspect that the evolving state of Russia’s war in Ukraine must explain this year’s increased ransomware activity, or at least be playing a role.

“I really think the tide of the Russia-Ukraine conflict has impacted these numbers,” Chainalysis’ Koven says. “Whether that’s actors have settled into safe locations, whether their year of military service has finished, or whether perhaps there’s a mandate to release the hounds.”

Chainalysis specializes in cryptocurrency surveillance and tracking, so researchers at the company are well positioned to capture the scope and scale of ransomware payments. The company says it takes a conservative approach and is rigorous about continuing to retroactively update its annual totals and other figures as new data comes to light about historic transactions. In general, though, many researchers emphasize that true totals for ransomware attacks or payments are virtually impossible to calculate given available information, and that numbers like those from Chainalysis or government tracking can be used only as broad characterizations of trends.

"We still have such poor insights on the actual number of attacks," says Pia Huesch​, a research analyst at the British defense and security think tank Royal United Services Institute. She adds that companies are still reluctant to talk about attacks, fearing reputational harm.

In May, officials at the UK's National Cybersecurity Center and data regulator the Information Commissioner's Office said they were increasingly concerned about companies not reporting ransomware attacks and “the ransoms paid to make them go away.” They warned that if incidents are “covered up,” the number of attacks will only increase.

"Individuals who engage in cybercrime, to them the benefits still massively outweigh the risks of perhaps being prosecuted," Huesch says.

Regardless of their ability to independently validate ransomware revenue totals like those put forward by Chainalysis, researchers agree that ransomware represents a dire threat in 2023 and that the most prolific groups, most of whom are based in Russia, are evolving to counter defenses and meet the current moment.

“The ransomware groups who are still around are really good at what they do, and it is hard for organizations to secure against all possible points of entry,” says Allan Liska, an analyst for the security firm Recorded Future who specializes in ransomware. “And what’s worse, the groups seem to be mastering new techniques.”

One such tactic that researchers and governments have their eye on is mass exploitation campaigns in which a ransomware group finds a vulnerability in a widely used product that they can exploit to launch extortion campaigns against many organizations at once. The Russia-based gang Clop, in particular, has refined this technique.

All of this bodes poorly for anyone who hoped after last year that the tide was turning against ransomware actors.

Ransomware Attacks Are on the Rise, Again

Roger Thomas Clark, also known as Variety Jones, will spend much of the rest of his life in prison for his key role in building the world’s first dark-web drug market.

Nearly ten years ago, the sprawling dark-web drug market known as the Silk Road was torn offline in a law enforcement operation coordinated by the FBI, whose agents arrested the black market's boss, Ross Ulbricht, in a San Francisco library. It would take two years for Ulbricht's second-in-command—an elusive figure known as Variety Jones—to be tracked down and arrested in Thailand. Today, a decade after the Silk Road's demise, Clark has been sentenced to join his former boss in federal prison.

In a Manhattan courtroom on Tuesday, Roger Thomas Clark—also known by his online handles including Variety Jones, Cimon, and Plural of Mongoose—was sentenced to 20 years behind bars for his role in building and running Silk Road. Clark, a 62-year-old Canadian national, will now likely spend much of the rest of his life incarcerated for helping to pioneer the anonymous, cryptocurrency-based model for online illegal sales of drugs and other contraband that still persists on the dark web today. The sentence is the maximum Clark faced in accordance with the plea agreement he made with prosecutors.

Clark “misguidedly turned his belief that drugs should be legal into material assistance for a criminal enterprise,” Judge Sidney Stein said in his sentencing statement. “These beliefs crossed over into patently illegal behavior.”

Stein added that Clark was “clear-eyed and intentional” in his work as Ulbricht's “right-hand man” in the Silk Road's operations. “The sentence must reflect the vast criminal enterprise of which he was a leader,” Stein said.

In his own statement, Clark said that his work on the Silk Road had always been motivated by his political belief that drugs should be legalized, and the hundreds of millions of dollars' worth of dark-web drug sales he helped to facilitate were safer than drug deals that took place in the physical world. He argued in his sentencing statement that the site helped reduce violence in the drug trade, and that the Silk Road's ratings and reviews prevented the sale of adulterated drugs that would have caused greater harm.

“I just kept preaching to myself ‘harm reduction.’ That's how I got to sleep at night,” Clark told the judge, standing before a sparse audience in the courtoom looking thin and gaunt in baggy khaki clothes. “I'm proud and ashamed at the same time.”

Clark was, as prosecutors noted in their memo arguing for the two-decade sentence, more than a lieutenant on the Silk Road. He served as the site's security consultant, PR adviser, and even a kind of executive coach and friend to the site's boss, Ulbricht. Clark, who Ulbricht initially encountered as a marijuana seeds dealer on the market, was “the biggest and strongest-willed character I had met through the site thus far,” Ulbricht wrote in his journal. 

“He has advised me on many technical aspect of what we are doing, helped me speed up the site and squeeze more out of my current servers," Ulbricht wrote. “He also has helped me better interact with the community around Silk Road, delivering proclamations, handling troublesome characters, running a sale, changing my name, devising rules, and on and on. He also helped me get my head straight regarding legal protection, cover stories, devising a will, finding a successor, and so on. He’s been a real mentor.”

Clark was pivotal in key moments of the Silk Road’s history—including a particularly dark incident when he and Ulbricht resorted to violence, which loomed large in Clark’s sentencing. Clark played a crucial role in convincing Ulbricht that it was necessary to commission the murder of one of his employees who he believed had betrayed him and stolen bitcoins from the market. “At what point in time do we decide we’ve had enough of someones shit and terminate them?” Clark wrote to Ulbricht at one point following the discovery of the theft, as recorded in chat logs that were recovered from Ulbricht's computer after his arrest. “We’re playing with big money with serious people, and that’s the world they live in.”

After Ulbricht agreed to have the staffer killed—in a bizarre turn, his death was instead faked by US federal agents investigating the Silk Road—Clark told Ulbricht that he had made the right move. "If you had balked, I would have seriously re-considered our relationship," he wrote. “We’re playing for keeps, this just drives it home. I’m perfectly comfortable with the decision, and I’ll sleep like a lamb tonight, and every night hereafter.”

Countering Clark's claims of interest in “harm reduction,” assistant US attorney Michael Neff pointed to those comments as evidence of Clark's “complete disregard for human life,” as he put it in Tuesday's sentencing hearing. For Clark, “the question of whether to end another man's life was simple and stress-free,” Neff told the judge in the prosecution's sentencing statement.

In his own remarks, Clark didn't comment on that murder-for-hire conversation—which he at one point claimed had been fabricated by Ulbricht but later conceded was real. Instead, he focused on his benevolent intentions in running the Silk Road, which he argued had saved thousands of lives through its prevention of overdoses from adulterated drugs. At the same time, he acknowledged that at least six people named by prosecutors had in fact overdosed and died from Silk Road narcotics.

“If the Silk Road hadn't existed, would those people be alive today? Probably yes,” Clark said. “Did we save thousands of lives? Yes, but we took some too.”

He compared his actions to the so-called “trolley problem” thought experiment in ethical philosophy, in which someone must choose which track a train will take when people are tied to both tracks. “It's not Philosophy 101 for me,” he told the judge. “I pulled the switch.”

Clark and his defense attorney also spent much of their sentencing statements describing the abysmal conditions of his detention over the past several years in Thailand and then a New York jail. His attorney told the court he was traumatized by witnessing torture and sexual assault in a Thai jail, was denied basic health care, and arrived in the US weighing just 93 pounds. At the Metropolitan Detention Center in Brooklyn, Clark described corruption and neglect, which led to his falling from his bunk while experiencing vertigo in 2021, breaking his pelvis, and being left to suffer overnight despite his pleas for help.

Judge Stein acknowledged those years of suffering and mistreatment but concluded that he was “not persuaded they afford a substantial reduction” in Clark's sentence.

Separately, Clark made strange new claims in his statement—without evidence—that he had spent $800,000 of Silk Road’s revenue to buy hacking tools that could be used to de-anonymize users of the dark web engaged in child sexual exploitation and had then provided those tools to the UK and US governments. One Bangkok-based hacker who Clark says sold him a hacking tool, who goes by the handle the Grugq, denied any such sale to WIRED. “I never sold such an exploit and certainly wouldn’t have sold it to him,” the Grugq writes. The judge didn’t appear to factor these unsubstantiated claims into Clark’s sentence, but suggested that he should provide his computer skills to the US government.

Clark's strange story of hacking pedophiles should perhaps be taken with a grain of salt given his long history of apparent misdirection. Prior to his extradition from Thailand, he made claims of a corrupt FBI agent hunting him and secret information he could provide to the Thai government, ostensibly in exchange for his release—claims which were never borne out or mentioned by his defense prior to sentencing.

In his chats with Ulbricht prior to the Silk Road takedown, too, Clark had a tendency to grandiose ideas. At one point he suggested ways that he might rescue Ulbricht from prison should he ever be identified and arrested. “One of the things i’d like us to look at investing in is a helicopter tour company … seriously, with the amount of $ we’re generating, I could hire a small country to come get you.” he wrote. “And remember that one day when your in the exercise yard, I’ll be the dude in the helicopter coming in low and fast, I promise.”

No such rescue operation ever appeared for Ulbricht. And no such salvation appears to be coming for Clark either.

“Everybody take a good look,” Clark said at one point during his sentencing statement, dramatically turning to the courtroom’s small audience. “This is probably the last time you see me before I get killed.”

Silk Road’s Second-in-Command, Variety Jones, Gets 20 Years in Prison

The popular communication platform launched a new child safety tool for parents. Here’s what the feature does (and doesn’t) include.

Discord started in 2015 as a communication platform for gamers. It’s now a sprawling hub of active servers where users can do everything from online dating to AI art creation. It goes much further than text and image-based chats. Discord users are able to form intimate connections with each other through live broadcasts of their audio and video, as well.

Anyone 13 or older is allowed to sign up, and parents are right to be concerned about who their children are befriending. According to NBC News, predators use the app to groom, kidnap, and extort minors as well as share child sexual abuse materials.

Discord’s new family center is a step toward protecting those young users, but it won’t prevent every instance of child exploitation, especially for teens whose parents are too busy to monitor their online activity. Other social media companies, like Snapchat, have also released security tools for parents.

Curious about signing up alongside your teen for this new safety tool? Here’s how to set up Family Center on Discord and a breakdown of what information is provided to parents.

How Do I Set Up Family Center?

As a parent, you will need to sign up for your own account before you can start using Family Center. Confused about how Discord works, exactly? Our beginner’s guide has tips to help you get started and navigate around (Android, Apple.)

After you’ve created an account, consider talking with your child about the importance of online safety and why these security settings are important. For Family Center to work, both the parent’s and the child’s account must opt in.

Go to **User Settings**, and then choose **Family Center**. Here, your teen will need to share a time-sensitive QR code for you to scan and complete the activation process. QR codes can be regenerated, if multiple parents want to sign up for Family Center.

What Information Do Parents Receive?

Once Family Center is activated, parents can use the Discord app to see who their teens added as friends in the past week. The tool also lists all of the servers they just joined and the servers they actively participate in. Whoever the teen called or messaged, whether directly or by group chats, is included as well.

You can check on this information during the week inside of the app, and Discord will send you an email every week with a summary of the data. Keep in mind that an archive of this activity isn’t available to you in the long term, so parents should save these weekly emails.

Does This Let Me Read Their Messages?

Nope! Even though parents are now able to see who their teens are chatting with on Discord, whatever is happening in their DMs, voice calls, and video chats remains hidden.

It can be quite hard for parents to balance giving their child more autonomy as they mature and the necessity of online safety precautions. Parents of teenagers who use Discord should consider activating Family Center, even if it doesn’t provide complete peace of mind. For more parenting advice, check out WIRED’s guide to the basics of protecting your kids online.

How to Use Discord’s Family Center With Your Teens

Cities across the US have established RTCCs that police say protect the rights of innocent people, but critics warn of creeping surveillance.

In the 1990s, London built the Ring of Steel—a network of concrete barriers, checkpoints, and thousands of video cameras around the historic City of London—after bombings by the Irish Republican Army. The idea was to monitor everyone entering and leaving the Square Mile, what the _The New York Times_ later called “fortress urbanism.”

After the September 11, 2001, attacks, city planners looking to defend New York from terrorism turned to London and fortress urbanism for inspiration. Fusion centers, where US law enforcement agencies share intelligence at a federal level to be analyzed and build a bigger picture of crime, had been around for a few years. But officials began asking, what if fusion centers could be localized? What if local law enforcement could analyze and gather masses of intelligence from one city?

In 2005, they answered with the first “real-time crime center” (RTCC), a sprawling network of CCTV and automatic license plate readers (ALPR) linked to a central hub in the New York Police Department headquarters costing $11 million. Since then, from Miami to Seattle, RTCCs have steadily expanded across the US. The Atlas of Surveillance, a project from the digital rights nonprofit the Electronic Frontier Foundation (EFF), which monitors police surveillance technology, has counted 123 RTCCs nationwide—and that number is rising.

Each RTCC is slightly different, but their function is the same: gather surveillance data across a city and use that to build a live picture of crime in the city. Police departments have an array of technologies available to them that span from CCTV, gunshot sensors, and social media monitoring to drones and body cameras. In Ogden, Utah, police even floated the idea of a 30-foot “crime blimp.” In many cases, images that police systems collect are run through facial recognition technology, and the data gathered is often used in predictive policing. In Pasco County, Florida, which operates an RTCC, the sheriff’s office’s predictive policing system encouraged officers to continuously monitor and harass residents for minor code violations such as missing mailbox numbers and overgrown grass.

Erik Lavigne is a detective at the Fort Worth Police Department in Texas and communications director at the National RTCC Association. He says there has been a boom in RTCCs over the past year because officers believe they help with more precise policing. He likens the scattered approach to policing in previous years to throwing out a fishnet and hoping to catch something. “For what we had at the time, that worked. But what inevitably happens is, you end up alienating the community because you're not just stopping the bad guys, you're also stopping innocent people that are just trying to live their lives,” he says. “A real-time crime center is a scalpel. We aren't catching the wrong people anymore.”

Lavigne says RTCCs are also a cheaper alternative to hiring more boots on the ground because each camera becomes, in effect, a stationary officer keeping watch over an area. Lavigne says this has proved so effective that analysts at RTCCs have been recording more crime than they can deal with, and  the Fort Worth RTCC has significantly helped decrease vehicle thefts.

Most evidence for RTCC effectiveness, however, is anecdotal, and there is a real lack of studies into how effective they really are. In Detroit, a National Institute of Justice study concluded that Project Green Light—a part of the Detroit Police Department RTCC that established cameras at more than 550 locations, including schools, churches, private businesses, and health centers—helped decrease property violence in some areas but did nothing to prevent violent and other crimes. But police departments argue they do work.

Few people know RTCCs even exist, let alone the extent of the surveillance they entail, so they can receive little public scrutiny and often operate without much oversight. There have long been concerns around how surveillance technologies could affect First and Fourth Amendment rights in the US, but Beryl Lipton, an investigative researcher at the EFF, says RTCCs “hyper-charge” these worries by collating all this data in one place.

“It’s perpetuating this mass collection of people's private information from a whole bunch of different video streams,” Lipton says. “They're really lowering the bar on the ways police can access that information … When there are these types of large databases without proper audit and oversight mechanisms, law enforcement officials and individuals can use them for their own purposes, which can be very scary.”

Regulations around the storage and usage of this data are patchy at best. For example, RTCC-collected data may be shared across jurisdictions because third parties contracted for the hardware or software will also collect data and share it, Lipton says. “Some of these companies will, in good faith, delete data in accordance with retention schedules, but we've seen them not do that,” she says. “With large databases like license plate reader databases, that information is sometimes shared without police departments realizing it and in violation of jurisdictional rules.”

While companies will argue this data is being stored securely, this is no guarantee. In 2020, hackers stole internal memos, financial records, and more from over 200 local, state, and federal agencies from web development firm Netsential, which provided data storage for fusion centers across the US. The trove of leaked data later became known as #BlueLeaks.

“There are real concerns around having this amount of information stored somewhere,” says Lipton, “I have no reason to believe these are somehow more secure systems than we have in other situations. And we know that those get breached all the time, law enforcement agencies in this country get hacked all the time.”

Lipton’s biggest worry is that this ability to follow people remotely and share that data across state lines could instead be used to target people involved in protests and political organizing, which has already happened, or those accessing reproductive health care. “Those issues become compounded because there’s the frightening ‘real time’ element to it,” she says. “That means that if you leave your house, there’s a very good chance that law enforcement could jump into a feed that is just following you around.”

In addition to police setting up their own technology, RTCCs draw on wider existing surveillance networks. Cooperation of public institutions like schools and colleges and privately owned cameras have been crucial to developing RTCCs by giving officers access to cameras that might otherwise need a warrant. In Atlanta, which has seen the number of cameras integrated into their RTCC treble to 15,329 in the past year, four higher-education institutions—Clark Atlanta University, Spelman College, Morehouse College, and the Morehouse School of Medicine—installed $700,000 worth of cameras, including five ALPRs, that were linked to the Atlanta RTCC.

Fusus, which claims to be “the most widely used & trusted Real-Time Crime Center platform in U.S. Public Safety,” sells hardware that can be connected to private CCTV cameras and linked up to the local RTCC. Fusus sells a solution that brings all the various technologies under “a single pane of glass,” as the company describes it. Through partnerships with companies that provide surveillance technology, including a $21 million investment from Axon, which produces Tasers and body cams, Fusus promises to integrate these technologies into one RTCC platform for analysts.

Police departments that use Fusus, like the Memphis Police Department, have been encouraging homeowners and local businesses to purchase fususCORE bundles—hardware that connects cameras to an RTCC—ranging from $350 to $7,300, plus an annual $150 subscription. Fusus has even gone as far as developing technology that allows Amazon’s Ring doorbells to livestream to an RTCC.

Amid a push for policing to harness new technologies and become “smarter,” Lipton is quick to point out that more technology doesn’t necessarily equal smarter. “It almost always just means that they're going to keep heavily policing poor and minority areas,” she says. Despite Lavigne’s claims that RTCCs mean the wrong people aren’t getting arrested anymore, in a recent lawsuit, the New Orleans Police Department was sued for arresting a Black man after watching him for 15 minutes through their RTCC and wrongly concluding he had a gun. The department ultimately settled for $10,000 in damages.

Lipton believes relentless surveillance is an infringement of citizens rights and would like to see the use of these technologies limited—aside from facial recognition, which she says should be banned. “There are certain elements we just shouldn't be using at all,” she says. “We should never be applying facial recognition to almost anything … As soon as you apply any really individualizing technology like that, I mean, it's kind of over for people's privacy.” Communities and organizations like EFF and ACLU have been arguing for Community Control Over Police Surveillance (CCOPS) laws that bring surveillance technologies under the control of elected officials and communities. Cities like Oakland have found success with this, but without nationwide restrictions, the rise of RTCCs will likely continue on the periphery of the public eye.

The Quiet Rise of Real-Time Crime Centers

Plus: A French bill would allow spying via phone cameras, ATM skimmers target welfare families, and Japan’s largest cargo port gets hit with ransomware.

When Yevgeny Prighozin, the head of the notorious mercenary army known as the Wagner Group, staged an aborted coup against the Russian government, his brief revolt led to the deaths of 13 Russian fighter pilots and a serious blow to Vladimir Putin's sense of invulnerability. Now the fallout of that strange story has also apparently taken another casualty: the most notorious troll farm in the world, known as the Internet Research Agency.

But we'll get to that. First, Elon Musk is having a tough week. After Twitter’s baffling decision to temporarily limit the number of tweets users can read each day, Mark Zuckerberg sucker-punched the self-sabotaged platform with the launch of Threads. The Instagram-linked microblogging app surged to the top of the app store charts, gaining a staggering 30 million users in 24 hours—a clear sign that many people are willing to ignore Meta’s privacy-invading ways.

If you want to get in on the Threads action but don't want to share all your data with Meta, there's a better way: Don't join. Instead, wait until Threads connects to the broader decentralized social media ecosystem enabled by the ActivityPub protocol, which is also used by Mastodon. It should enable you to interact with Threads without signing up for an account or downloading the app. And if you're still trying to pick which Twitter alternative to jump on—or just want to see what data each platform collects—we've broken down the privacy policies of Threads, Bluesky, Mastodon, and more.

Even if you don't share your data with Meta, the information about you that's already out there is likely up for sale. But it's not just companies buying up your personal details—cops and spies are purchasing that data too. That is, unless the US Congress puts a stop to it. A bipartisan group of lawmakers has submitted an amendment to the National Defense Authorization Act, which Congress must pass each year, that would forbid intelligence agencies from buying sensitive data about Americans. The amendment has to survive a long debate before it can become law, but if Congress keeps it intact, US spies will no longer be able to buy your location data and search histories on the open market.

Finally, our partners at Grist investigated the risks posed by electric vehicle charging stations. Due to a variety of security vulnerabilities and a lack of industry standards for protecting EV chargers from hackers, both drivers and the entire power grid could be at risk.

But that's not all. Each week, we round up the security news we didn't report in depth ourselves. Click on the headlines to read the full stories. And stay safe out there.

For years, the St. Petersburg-based Internet Research Agency embodied many Americans’ worst fears of Russia’s disinformation influences across Western social media. The operation, created by Vladimir Putin ally and oligarch Yevgeny Prighozin, fueled scandals, spewed fake news, and meddled in US elections deeply enough to warrant an indictment from the Justice Department against a group of its staff and even a disruptive hacking operation from US Cyber Command targeting its network.

Now, after the US government's attempts to cripple or kill Prighozin’s troll factory, he’s managed to do it himself. In the wake of the bizarre, brief mutiny of Prighozin’s mercenary Wagner Group, contracted to take part in Russia’s invasion of Ukraine, Prighozin has been stripped of assets in Russia, including the media group of which the Internet Research Agency was a part. Initially, the troll farm sought a new owner, but Reuters reported ahead of the July 4 holiday that the infamous influence machine will instead be disbanded. Prighozin, meanwhile, was said to have been exiled to Belarus—but has now returned to Russia, according to the Belarusian president Alexander Lukashenko.

A highly controversial surveillance bill in France, making its way through the country’s parliament, would allow law enforcement to surreptitiously spy on criminal suspects via their devices’ cameras and microphones. The legislation, which would apply to smartphones, connected cars, laptops, and other devices, was passed by the French National Assembly earlier this week as part of wider changes to the French justice system. In response to criticism, French president Emmanuel Macron’s party made changes to the law that would only allow it to be used “when justified by the nature and seriousness of the crime,” only for an appropriate duration, and only for a maximum of six months, regardless of the suspected criminal conduct. Both the right and left political parties of the country continue to protest the bill.

In recent years, American credit cards have been far harder to defraud, as banks have added security features like authentication chips. But EBT cards, the debit cards provided to many of the poorest Americans in the welfare system, have lagged behind in those protections, instead continuing to store their numbers in a simple magnetic strip. The result has been millions of dollars in irreversible theft from some of the country’s most needy and vulnerable families, as captured in a _Bloomberg BusinessWeek_ feature in this week’s “Heist Issue” of the magazine. California alone, according to the report, saw an average of $10 million a month stolen in the first three months of this year. The fraud scheme is carried out by criminals who plant “skimmer” devices on grocery store point-of-sale systems and ATMs that record credit card numbers, which are then used to drain accounts of funds as soon as they’re refreshed at midnight on the first of the month. _BusinessWeek_ tells the story of a mother of five whose welfare funds were stolen in this way four times in less than a year.

The Japanese port of Nagoya—the country’s biggest cargo port. handling roughly 10 percent of its total shipping—on Tuesday revealed that it had been the victim of a ransomware attack. The attack, apparently carried out by the prolific Russia-linked ransomware group LockBit, prevented companies like Toyota from loading and unloading manufacturing components from ships and led to a traffic jam of truck drivers picking up and offloading containers at the port. To the Nagoya shipping port’s credit, however, it recovered quickly from the attack, resuming operations just two days later.

Russia’s Notorious Troll Farm Disbands

Want to try out Meta’s new social media app? Here’s more context on what personal data is collected by Threads and similar social media apps.

Meta's long-awaited Twitter alternative is here, and it's called Threads. The new social media app launches at a time when alternatives, like Bluesky, Mastodon, and Spill, are vying for users who are dissatisfied with Elon Musk's handling of Twitter's user experience, with its newly introduced rate limits and an uptick in hate speech.

Meta owns Facebook, Instagram, and WhatsApp, so the company’s attempt to recreate an online experience similar to Twitter is likely to attract plenty of normies, lurkers, and nomadic shitposters. Threads uses the AT Protocol developed by Bluesky, and Meta is working to incorporate Threads as part of the online Fediverse, a group of shared servers where users can interact across multiple platforms.

If you’re hesitant to share your personal data with a company on the receiving end of a billion dollar fine, that’s understandable. For those who are curious, however, here’s what we know about the service’s privacy policy, what data you hand over when you sign up, and how it compares to the data collected by other options.

Threads

Threads (Android, Apple) potentially collects a wide assortment of personal data that remains connected to you, based on the information available in Apple’s App Store, from your purchase history and physical address to your browsing history and health information. “Sensitive information” is also listed as a type of data collected by the Threads app. Some information this could include is your race, sexual orientation, pregnancy status, and religion as well as your biometric data.

Threads falls under the larger privacy policy covering Meta’s other social media platforms. Want to see the whole thing? You can read it for yourself here. There’s one caveat, though. The app has a supplemental privacy policy that’s also worth reading. A noteworthy detail from this document is that while you’re able to deactivate your Threads account whenever, you must delete your Instagram if you fully want to delete your Threads account.

Below is all the data collected by Threads that’s mentioned in the App Store. Do you have the Facebook or Instagram app on your phone? Keep in mind that this data collection by Meta is comparable to the data those apps collect about you.

For Android users, the Google Play Store doesn’t require you to hand over the same amount of extensive data to try out Threads. You have more control than Apple users, since you can granularly toggle what personal data is shared with apps.

Data Linked to You

**Third-Party Advertising:**

*   _Purchases_ (Purchase History)
*   _Financial Info_ (Other Financial Info)
*   _Location_ (Precise Location, Coarse Location)
*   _Contact Info_ (Physical Address, Email Address, Name, Phone Number, Other User Contact Info)
*   _Contacts_
*   _User Content_ (Photos or Videos, Gameplay Content, Other User Content)
*   _Search History_
*   _Browsing History_
*   _Identifiers_ (User ID, Device ID)
*   _Usage Data_ (Product Interaction, Advertising Data, Other Usage Data)
*   _Diagnostics_ (Crash Data, Performance Data, Other Diagnostic Data)
*   _Other Data_

**Developer's Advertising or Marketing:**

*   _Purchases_ (Purchase History)
*   _Financial Info_ (Other Financial Info)
*   _Location_ (Precise Location, Coarse Location)
*   _Contact Info_ (Physical Address, Email Address, Name, Phone Number, Other User Contact Info)
*   _Contacts_
*   _User Content_ ( Photos or Videos, Gameplay Content, Other User Content)
*   _Search History_
*   _Browsing History_
*   _Identifiers_ (User ID, Device ID)
*   _Usage Data_ (Product Interaction, Advertising Data, Other Usage Data)
*   _Diagnostics_ (Crash Data, Performance Data, Other Diagnostic Data)
*   _Other Data_

**Analytics:**

*   _Health & Fitness_ (Health, Fitness)
*   _Purchases_ (Purchase History, Financial Info, Payment Info, Other Financial Info)
*   _Location_ (Precise Location, Coarse Location)
*   _Contact Info_ (Physical Address, Email Address, Name, Phone Number, Other User Contact Info)
*   Contacts
*   _User Content_ (Photos or Videos, Audio Data, Gameplay Content, Customer Support, Other User Content)
*   _Search History_
*   _Browsing History_
*   _Identifiers_ (User ID, Device ID)
*   _Usage Data_ (Product Interaction, Advertising Data, Other Usage Data)
*   _Sensitive Info_
*   _Diagnostics_ (Crash Data, Performance Data, Other Diagnostic Data)
*   _Other Data_

**Product Personalization:**

*   _Purchases_ (Purchase History)
*   _Financial Info_ (Other Financial Info)
*   _Location_ (Precise Location, Coarse Location)
*   _Contact Info_ (Physical Address, Email Address, Name, Phone Number, Other User Contact Info)
*   Contacts
*   _User Content_ (Photos or Videos, Gameplay Content, Other User Content)
*   _Search History_
*   _Browsing History_
*   _Identifiers_ (User ID, Device ID)
*   _Usage Data_ (Product Interaction, Advertising Data, Other Usage Data)
*   _Sensitive Info_
*   _Diagnostics_ (Crash Data, Performance Data, Other Diagnostic Data)
*   _Other Data_

**App Functionality:**

*   _Health & Fitness_ (Health, Fitness)
*   _Purchases_ (Purchase History)
*   _Financial Info_ (Payment Info, Credit Info, Other Financial Info)
*   _Location_ (Precise Location, Coarse Location)
*   _Contact Info_ (Physical Address, Email Address, Name, Phone Number, Other User Contact Info)
*   _Contacts_
*   _User Content_ (Emails or Text Messages, Photos or Videos, Audio Data, Gameplay Content, Customer Support, Other User Content)
*   _Search History_
*   _Browsing History_
*   _Identifiers_ (User ID, Device ID)
*   _Usage Data_ (Product Interaction, Advertising Data, Other Usage Data)
*   _Sensitive Info_
*   _Diagnostics_ (Crash Data, Performance Data, Other Diagnostic Data)
*   _Other Data_

**Other Purposes:**

*   _Purchases_ (Purchase History)
*   _Financial Info_ (Other Financial Info)
*   _Location_ (Precise Location, Coarse Location)
*   _Contact Info_ (Physical Address, Email Address, Name, Phone Number, Other User Contact Info)
*   _Contacts_
*   _User Content_ (Photos or Videos, Gameplay Content, Customer Support, Other User Content)
*   _Search History_
*   _Browsing History_
*   _Identifiers_ (User ID, Device ID)
*   _Usage Data_ (Product Interaction, Advertising Data, Other Usage Data)
*   _Diagnostics_ (Crash Data, Performance Data, Other Diagnostic Data)
*   _Other Data_

Bluesky

Looking for an app that collects less personal data? Bluesky (Android, Apple) is a buzzy Twitter alternative started by Twitter founder Jack Dorsey and managed by CEO Jay Graber. Bluesky uses the AT Protocol that it created. Like Mastodon already does and Threads soon will, Bluesky incorporates the Fediverse servers as its backbone. The app is currently invite-only, but it does not currently collect anywhere near as much information as Threads or Twitter.

For Bluesky, the data that’s linked to you is focused on app functionality, like remembering your email and user ID, or access to photos and videos on your device so you can post memes. Here’s where you can find more info about Bluesky’s privacy policy. Keep in mind the service is still new and adding features, so there will likely be changes as it evolves.

Below is all the data collected by Bluesky that’s mentioned in the App Store. (Remember that this is only for iPhone owners. If you use an Android smartphone, you have more control over what data is shared.)

Data Linked to You

**App Functionality:**

*   _Contact Info_ (Email Address)
*   _User Content_ (Photos or Videos, Customer Support, Other User Content)
*   _Identifiers_ (User ID)

Data Not Linked to You

**Analytics:**

*   _Diagnostics_ (Crash Data, Performance Data, Other Diagnostic Data)

**App Functionality:**

*   _Diagnostics_ (Crash Data, Performance Data, Other Diagnostic Data)

Mastodon

What if you want a social media app that doesn’t suck up all your personal data? **Mastodon** (Android, Apple) might be a good option for you. Originally launched in 2016 by Eugen Rochko, Mastodon uses a decentralized protocol that’s different from Threads and Bluesky, called ActivityPub. It’s part of the Fediverse of shared servers. Mastodon is not exactly a new pick; it has positioned itself for years as an alternative to Twitter. (Remember, 2023 isn’t the first time users have considered ditching Twitter for something new and exciting.)

Are you trying it out for the first time? Here’s a great guide to getting started on Mastodon. There’s a bit of a learning curve with this one.

Below is all the data collected by Mastodon that’s mentioned in the App Store.

_\*In the style of Taylor Swift.\*_

\[Blank Space\]

That's right, the Mastodon app for iOS won't collect any data from your device. For Android owners, the app may share your name and email address with other companies.

If you don't like the official Mastodon apps for any reason, you can always try alternative apps with unique interfaces and features. Just be on the lookout for the privacy policies and data collection for those apps, since they don't have to commit to zero-data collection the way the official ones do.

Spill

Are you part of (or a fan of) Black Twitter and on the search for a new posting platform, preferably one that’s inclusive and voicey? Spill (Apple) is a Black-owned social media app that’s made with diverse communities in mind, specifically people of color. It was founded by Alphonzo “Phonz” Terrell and Devaris Brown, who both used to work at Twitter, and it launched earlier this year. Spill is not part of the Fediverse of shared servers.

Spill is currently invite-only, but you can sign up for the waiting list. While Spill does gather sensitive info, the other aspects of its data collection are not as extensive as Threads. Here’s the full privacy policy you can read over.

Below is all the data collected by Spill that’s mentioned in the App Store. It’s worth noting that Spill’s dev team is working on an Android app, but it’s not yet available to use.

Data Linked to You

**Developer's Advertising or Marketing:**

*   _Location_ (Coarse Location)
*   _Contact Info_ (Email Address, Name, Phone Number)
*   _User Content_ (Emails or Text Messages, Photos or Videos, Audio Data)
*   _Sensitive Info_

**Analytics:**

*   _Location_ (Coarse Location)
*   _Contact Info_ (Email Address, Name, Phone Number)
*   _User Content_ (Emails or Text Messages, Photos or Videos, Audio Data)
*   _Sensitive Info_

**Product Personalization:**

*   _Location_ (Coarse Location)
*   _Contact Info_ (Email Address, Name, Phone Number)
*   _Contacts_
*   _User Content_ (Emails or Text Messages, Photos or Videos, Audio Data)
*   _Sensitive Info_

**App Functionality:**

*   _Location_ (Coarse Location)
*   _Contact Info_ (Email Address, Name, Phone Number)
*   _Contacts_
*   _User Content_ (Emails or Text Messages, Photos or Videos, Audio Data)
*   _Sensitive Info_

**Other Purposes:**

*   _Contact Info_ (Email Address, Phone Number)

Hive Social

It’s a bit smaller than other platforms, but Hive Social (Android, Apple) is another contender for your attention span that’s particularly popular with gamers. This app is not part of the Fediverse. Nostalgic for the days when curated music would automatically play when a person visited your profile? This feature is one way Hive differentiates itself from Twitter, along with a built-in Q&A feature that lets your followers ask you questions (sometimes anonymously) that you can answer in posts to your feed. Want to give Hive a try? Check out our guide with tips for getting started.

The app collects information about you for functionality and analytics, but it’s not connected specifically to you. Learn more about what data the app uses by taking a look at its privacy policy.

Below is all the data collected by Hive Social that’s mentioned in the App Store for iPhone owners. (Have a Google Pixel or other Android device in your pocket? You can go into your privacy settings for more control over what data Hive collects.)

Data Not Linked to You

**Analytics:**

*   _Contact Info_ (Email Address, Name, Phone Number)
*   _User Content_ (Photos or Videos, Customer Support, Other User Content)
*   _Identifiers_ (User ID)
*   _Usage Data_ (Product Interaction, Other Usage Data)
*   _Diagnostics_ (Crash Data, Performance Data, Other Diagnostic Data)

**App Functionality:**

*   _Contact Info_ (Email Address, Name, Phone Number)
*   _User Content_ (Photos or Videos, Customer Support, Other User Content)
*   _Identifiers_ (User ID)
*   _Usage Data_ (Product Interaction, Other Usage Data)
*   _Diagnostics_ (Crash Data, Performance Data, Other Diagnostic Data)

What About Twitter?

It may seem like Threads collects a ton of personal data. (Because it does!) For more context, let’s go over what Twitter asks for as well. Twitter (Android, Apple) keeps plenty of data that’s linked to users and used to track you, like your purchase history and browsing history. With that in mind, the app does not list “sensitive information” as one of the disclosed categories of data collection. Check out its full privacy policy for an in-depth breakdown.

Below is all the data collected by Twitter that’s mentioned in the App Store. (Escaped from Apple’s walled garden? The Android app for Twitter still collects some personal data, like your precise location and web browsing history, unless you adjust your privacy settings.)

Data Used to Track You

*   _Purchases_ (Purchase History)
*   _Location_ (Precise Location, Coarse Location)
*   _Contact Info_ (Email Address)
*   _User Content_
*   _Browsing History_
*   _Identifiers_ (User ID, Device ID)
*   _Usage Data_ (Product Interaction, Advertising Data)

Data Linked to You

**Third-Party Advertising:**

*   _Purchases_ (Purchase History)
*   _Location_ (Precise Location, Coarse Location)
*   _Contact Info_ (Email Address)
*   _Browsing History_
*   _Identifiers_ (User ID, Device ID)
*   _Usage Data_ (Product Interaction, Advertising Data)
*   _Diagnostics_ (Performance Data)

**Developer's Advertising or Marketing:**

*   _Purchases_ (Purchase History)
*   _Location_ (Precise Location, Coarse Location)
*   _Contact Info_ (Email Address)
*   _User Content_
*   _Browsing History_
*   _Identifiers_ (User ID, Device ID)
*   _Usage Data_ (Product Interaction, Advertising Data)

**Analytics:**

*   _Purchases_ (Purchase History)
*   _Location_ (Precise Location, Coarse Location)
*   _Contacts_
*   _User Content_ (Photos or Videos, Audio Data, Other User Content)
*   _Search History_
*   _Browsing History_
*   _Identifiers_ (User ID, Device ID)
*   _Usage Data_ (Product Interaction, Advertising Data)
*   _Diagnostics_ (Crash Data, Performance Data)

**Product Personalization:**

*   _Purchases_ (Purchase History)
*   _Location_ (Precise Location, Coarse Location)
*   _Contact Info_ (Email Address, Phone Number)
*   _Contacts_
*   _User Content_
*   _Search History_
*   _Browsing History_
*   _Identifiers_ (User ID, Device ID)
*   _Usage Data_ (Product Interaction, Advertising Data)
*   _Diagnostics_ (Crash Data, Performance Data, Other Diagnostic Data)

**Other Purposes:**

*   _Location_ (Precise Location, Coarse Location)
*   _Contact Info_ (Email Address, Name, Phone Number)
*   _Contacts_
*   _User Content_ (Photos or Videos)
*   Search History
*   _Identifiers_ (User ID)

Data Not Linked to You

**Third-Party Advertising:**

*   _Other Data_

**Developer's Advertising or Marketing:**

*   _Other Data_

**Analytics:**

*   _User Content_ (Emails or Text Messages)
*   _Other Data_

**App Functionality:**

*   _Contact Info_ (Physical Address)
*   _User Content_ (Emails or Text Messages)
*   _Other Data_

Source

Wired