Meta’s Twitter alternative promises that it will work with decentralized platforms, giving you greater control of your data. You can hold the company to that—if you don't sign up.

As Meta’s Twitter competitor, Threads, started generating buzz ahead of yesterday’s launch, curious netizens spotted a placeholder listing for the app in Apple’s App Store. Like all iOS apps, the listing included details about the user data the app is designed to collect and track. And observers couldn’t help but notice that this brand-new app was already listing a whopping 14 categories of data that “may be collected and linked to your identity.” 

It might be a jarring reminder, but this is par for the course with Meta-owned apps, which the company monetizes by selling targeted ads and personalized marketing. Facebook and Instagram’s iOS apps list even more categories than Threads, the Messenger app lists about as many, and even the secure messaging app WhatsApp discloses nine categories of “Data Linked to You.” So for people fed up with Twitter’s rapidly deteriorating platform (and vibes), a Meta-owned alternative—with its predictability and relative stability—could even potentially appeal to those who are generally concerned about data privacy. 

Early data suggests as much: Threads, which is directly linked to users’ Instagram accounts, saw 10 million sign-ups in its first seven hours, according to CEO Mark Zuckerberg. Ultimately, Meta’s pitch for Threads is simply that it’s the devil you know.

But one thing is different this time: Meta is dangling an opportunity to essentially be on Threads without signing up for the platform at all. The company announced yesterday that it is planning to make Threads interoperable with other, non-Meta social networks that support a decentralized protocol already used by WordPress and 2022’s decentralization poster child, Mastodon. This means that if Meta follows through, you’ll be able to see and interact with Threads content from other platforms and services that support the standard, which is known as ActivityPub.

Meta says that Threads will start supporting ActivityPub “soon,” a descriptor that doesn’t necessarily inspire confidence. The company has already spent years, for example, working on its longtime promise of default end-to-end encryption on Messenger. But incorporating decentralization into Threads, and specifically supporting ActivityPub, has reportedly been a core aspect of Meta’s vision for the app from the beginning. Meta has also already sketched out details of the plan in its supplemental privacy policy for Threads.

All of this means that if you’re sick of Meta’s data-gobbling ways, or you don’t already have an Instagram account and don’t want to get one, you actually have some leverage: Don’t join Threads. Use Mastodon or another ActivityPub platform until Threads comes to you. Or hang out on Bluesky, which doesn’t support ActivityPub but is working on its own vision of a decentralized, portable social network.

“The fact that large platforms are adopting ActivityPub is not only validation of the movement towards decentralized social media, but a path forward for people locked into these platforms to switch to better providers. Which in turn, puts pressure on such platforms to provide better, less exploitative services," Mastodon CEO Eugen Rochko wrote in a blog post ahead of yesterday’s Threads launch.

Easy examples of decentralized services you already intuitively understand are phones and email. You can call anyone on any number, even if you and the person you’re calling buy phone service from different companies. Same with email. Even if pretty much everyone you know uses Gmail, there’s nothing materially different about emailing with the Yahoo and Hotmail holdouts in your life. And maybe your friend Jane runs her own email server and her address is jane@janerox.com. Love that for you, Jane—doesn’t change anything for anyone else.

That’s it. That’s how “the fediverse,” or federated services, work too. You join a server, and you’re trusting that server with your data. But then you can communicate with all the other servers running the same protocol, and the only data everyone on all those other servers can see from you is the content you choose to put out there. So Gmail has all of your emails and usage history, and Jane has all of her own emails and usage history, but the only data she has about you on her server is the emails you’ve sent her. And the only data Gmail has about Jane comes from her interactions with you and any other Gmail users.

Decentralization doesn’t change the basic functions of a social network, and that’s fine. The whole point of these services is to be a platform for publicly posting and consuming information. They aren’t designed around implementing end-to-end encryption. The servers still have access to user data and can be subpoenaed by governments or hacked. But decentralization creates a model through which users can elect to entrust their information to servers based on which ones have less-predatory data practices.

Ross Schulman, senior fellow for decentralization at digital rights nonprofit the Electronic Frontier Foundation, notes that if Threads emerges as a massive player in the fediverse, there could be concerns about what he calls “social graph slurping." Meta will know who all of their users interact with and follow within Threads, and it will also be able to see who their users follow in the broader fediverse. And if Threads builds up anywhere near the reach of other Meta platforms, just this little slice of life would give the company a fairly expansive view of interactions beyond its borders.

“I am perhaps equal parts excited and apprehensive to see how things play out with Threads, but it is really underlining the beauty of the fediverse that you have every option and the opportunity to choose,” Schulman says. “If you like Meta and you want to be in there, great. Go join Threads, you’ll be happy there, and you’ll also have access to everything else. If you don’t want to be a part of Meta, but you’ve got friends or family that do or public figures or whatever, then fine. You can get an account on any number of other fediverse servers and then follow the people that you want. Or if you want nothing to do at all with Meta, then there are plenty of servers out there \[that\] have already announced that they're preemptively blocking Threads. So you can live that life, too.”

No matter who you throw your lot in with, an important concept is that the server you choose is still going to have access to your data, even though all the other servers don’t. If Threads implements ActivityPub and you use it to interact with the fediverse, you’re choosing Meta as your server and everything that comes with that. If you run your own server, like Jane, you can retain full control. But if you’re somewhere in the middle and use a server run by someone else, you need to keep an eye out for future changes. Mastodon is currently a crowdfunded platform, but it’s largely unclear what the business model will be for decentralized services like Bluesky. And future pivots could mean that your server eventually implements more user-monitoring or data-tracking practices. Then it might be time to move on—a process made easier by the portability that's built into the fediverse, allowing you to switch servers while maintaining your connections.

If you’re a Twitter user, or used to be, you have already dealt with a service that makes dramatic changes and completely upends your expectations and trust. But the Twitter case study illustrates a crucial idea. From a data privacy perspective, the worst-case scenario is no worse in the world of decentralization, the best-case scenario is much better, and, for once, you get a say in where you end up.

Don't Join Threads—Make Instagram's 'Twitter Killer' Join You

The National Defense Authorization Act may include new language forbidding government entities from buying Americans' search histories, location data, and more.

A “must-pass” defense bill wending its way through the United States House of Representatives may be amended to abolish the government practice of buying information on Americans that the country’s highest court has said police need a warrant to seize. Though it’s far too early to assess the odds of the legislation surviving the coming months of debate, it’s currently one of the relatively few amendments to garner support from both Republican and Democratic members. 

Introduction of the amendment follows a report declassified by the Office of the Director of National Intelligence—the nation’s top spy—which last month revealed that intelligence and law enforcement agencies have been buying up data on Americans that the government’s own experts described as “the same type” of information the US Supreme Court in 2018 sought to shield against warrantless searches and seizures. 

A handful of House lawmakers, Republicans and Democrats alike, have declared support for the amendment submitted late last week by representatives Warren Davidson, a Republican from Ohio, and Sara Jacobs, a California Democrat. The bipartisan duo is seeking stronger warrant requirements for the surveillant data constantly accumulated by people’s cellphones. They argue that it shouldn’t matter whether a company is willing to accept payment from the government in lieu of a judge’s permission.

“Warrantless mass surveillance infringes the Constitutionally protected right to privacy,” says Davidson. The amendment, he says, is aimed chiefly at preventing the government from “circumventing the Fourth Amendment” by purchasing “your location data, browsing history, or what you look at online.”

A copy of the Davidson-Jacobs amendment reviewed by WIRED shows that the warrant requirements it aims to bolster focus specifically on people’s web browsing and internet search history, along with GPS coordinates and other location information derived primarily from cellphones. It further encapsulates “Fourth Amendment protected information” and would bar law enforcement agencies of all levels of jurisdiction from exchanging “anything of value” for information about people that would typically require a “warrant, court order, or subpoena under law.”

The amendment contains an exception for anonymous information that it describes as “reasonably” immune to being de-anonymized; a legal term of art that would defer to a court’s analysis of a case’s more fluid technicalities. A judge might, for instance, find it unreasonable to assume a data set is well obscured based simply on the word of a data broker. The Federal Trade Commission’s Privacy and Identity Protection Division noted last year that claims that data is anonymized “are often deceptive,” adding that “significant research” reflects how trivial it often is to reidentify “anonymized data.”

The amendment was introduced Friday to defense legislation that will ultimately authorize a range of policies and programs consuming much of the Pentagon’s nearly $890 billion budget next year. The National Defense Authorization Act (NDAA), which Congress is required to pass annually, is typically pieced together from hundreds, if not thousands, of amendments. 

This year negotiations are particularly contentious, given the split chamber and a mess of interparty strife, and only one in six NDAA amendments introduced so far have apparent bipartisan support. 

Republican members Nancy Mace of South Carolina, Kelly Armstrong of North Dakota, and Ben Cline of Virginia have backed the Davidson-Jacobs amendment, according to the House Rules Committee website. They’re joined by Democrats Pramila Jayapal of Washington, Zoe Lofgren of California, and Veronica Escobar of Texas.

Jacobs previously coauthored a related amendment with Davidson that attempted to compel the US military to disclose annually how often its various spy agencies purchase Americans’ smartphone and web-browsing data. The amendment was stripped from the final version of last year’s NDAA.

The data broker report declassified last month by the US director of national intelligence, Avril Haines, stressed that neither presently, nor at any point in the past, would the government be permitted to force “billions of people to carry location-tracking devices on their persons at all times.” That is, nevertheless, what is happening today, independent of the government’s actions. The unceasing explosions of new technologies are clashing more and more frequently with the nation’s antiquated privacy laws, giving the Department of Homeland Security, Defense Intelligence Agency, and others like them an unmistakable loophole through which virtually anyone can be surveilled without a reason. 

Demand Progress senior policy counsel Sean Vitka, whose group has spent years lobbying for privacy reform in the face of the government’s growing and often secret reliance on data brokers, says the relatively untracked purchases—up to and including “turnkey lists of everyone who has gone to an abortion clinic, a place of worship, a rehab facility, or a protest”—represent an “existential threat” to the right to privacy. The Davidson-Jacobs amendment marks a “critical opportunity to get \[federal lawmakers\] on the record,” adds Vitka.

The American Civil Liberties Union intends to score how lawmakers vote on the amendment, WIRED has learned. The lawmakers’ effort is also being supported by the Electronic Frontier Foundation, National Association of Criminal Defense Lawyers, FreedomWorks, and the Brennan Center for Justice at NYU School of Law, among dozens of similar civil society organizations.  

Congressional staffers and others privy to ongoing conferencing over privacy matters on Capitol Hill say that regardless of whether the amendment succeeds, the focus on data brokers is just a prelude to a bigger fight coming this fall over the potential sunsetting of one of the spy community’s powerful tools, Section 702 of the Foreign Intelligence Surveillance Act, the survivability of which is anything but assured.

US Spies Are Buying Americans' Private Data. Congress Has a Chance to Stop It

Vulnerabilities in electric vehicle charging stations and a lack of broad standards threaten drivers—and the power grid.

_This story was co-published with_ _Grist__, a nonprofit media organization covering climate, justice, and solutions._

With his electric Kia EV6 running low on power, Sky Malcolm pulled into a bank of fast-chargers near Terre Haute, Indiana, to plug in. As his car powered up, he peeked at nearby chargers. One in particular stood out.

Instead of the businesslike welcome screen displayed on the other Electrify America units, this one featured a picture of President Biden pointing his finger, with an “I did that!” caption. It was the same meme the president’s critics started slapping on gas pumps as prices soared last year, cloned 20 times across the screen.

"It was, unfortunately, not terribly surprising,” Malcolm says of the hack, which he stumbled upon last fall. Such shenanigans are increasingly common. At the beginning of the war in Ukraine, hackers tweaked charging stations along the Moscow–Saint Petersburg motorway in Russia to greet users with anti-Putin messages. Around the same time, cyber-vandals in England programmed public chargers to broadcast pornography. Just this year, the hosts of YouTube channel The Kilowatts tweeted a video showing it was possible to take control of an Electrify America station’s operating system.

While such breaches have so far remained relatively innocuous, cybersecurity experts say the consequences would be far more severe at the hands of truly nefarious miscreants. As companies, governments, and consumers sprint to install more chargers, the risks could only grow.

In recent years, security researchers and white-hat hackers have identified sprawling vulnerabilities in internet-connected home and public charging hardware that could expose customer data, compromise Wi-Fi networks, and, in a worst-case scenario, bring down power grids. Given the dangers, everyone from device manufacturers to the Biden administration is rushing to fortify these increasingly common machines and establish security standards.

“This is a major problem,” says Jay Johnson, a cybersecurity researcher at Sandia National Laboratories. “It is potentially a very catastrophic situation for this country if we don't get this right.”

Vulnerabilities in EV charger security aren’t hard to find. Johnson and his colleagues summarized known shortcomings in a paper published last fall in the journal _Energies_. They found everything from the possibility of hackers being able to track users to vulnerabilities that “may expose home and corporate \[Wi-Fi\] networks to a breach.” Another study, led by Concordia University and published last year in the journal _Computers & Security_, highlighted more than a dozen classes of “severe vulnerabilities,” including the ability to turn chargers on and off remotely, as well as deploy malware.

When British security research firm Pen Test Partners spent 18 months analyzing seven popular EV charger models, it found five had critical flaws. For instance, it identified a software bug in the popular Chargepoint network that hackers could likely exploit to obtain sensitive user information (the team stopped digging before acquiring such data). A charger sold in the UK by Project EV allowed researchers to overwrite its firmware.

Such cracks could conceivably permit hackers to access vehicle data or consumers’ credit card information, says Ken Munro, a cofounder of Pen Test Partners. But perhaps the most worrying weakness to him was that, as with the Concordia testing, his team discovered that many of the devices allowed hackers to stop or start charging at will. That could leave frustrated drivers without a full battery when they need one, but it’s the cumulative impacts that could be truly devastating.

“It’s not about your charger, it’s about everyone’s charger at the same time,” he says. Many home users leave their cars connected to chargers even if they aren’t drawing power. They might, for example, plug in after work and schedule the vehicle to charge overnight when prices are lower. If a hacker were to switch thousands, or millions, of chargers on or off simultaneously, it could destabilize and even bring down entire electricity networks. 

“We’ve inadvertently created a weapon that nation-states can use against our power grid,” says Munro. The United States glimpsed what such an attack might look like in 2021 when hackers hijacked Colonial Pipeline and disrupted gasoline supplies nationwide. The attack ended once the company paid millions of dollars in ransom.

Munro’s top recommendation for consumers is to not connect their home chargers to the internet, which should prevent the exploitation of most vulnerabilities. The bulk of safeguards, however, must come from manufacturers.

“It's the responsibility of the companies offering these services to make sure they are secure,” says Jacob Hoffman-Andrews, senior staff technologist at the Electronic Frontier Foundation, a digital rights nonprofit. “To some degree, you have to trust the device you're plugging into.”

Electrify America declined an interview request. With regard to the issues Malcolm and the Kilowatts documented, spokesperson Octavio Navarro wrote in an email that the incidents were isolated and the fixes were quickly deployed. In a statement, the company said, “Electrify America is constantly monitoring and reinforcing measures to protect ourselves and our customers and focusing on risk-mitigating station and network design.”

Pen Test Partners wrote in its findings that companies were by and large responsive to fixing the vulnerabilities it identified, with ChargePoint and others plugging gaps in less than 24 hours (though one company created a new hole while trying to patch the old one). Project EV did not respond to Pen Test Partners but did eventually implement “strong authentication and authorization.” Experts, however, argue that it’s far past time for the industry to move beyond this whack-a-mole approach to cybersecurity.

“Everybody knows this is an issue and lots of people are trying to figure out how to best solve it,” says Johnson, adding that he has seen progress. For example, many public charging stations have upgraded to more secure methods of transmitting data. But as for a coordinated set of standards, he says, “there's not much regulation out there.”

There has been some movement toward changing that. The 2021 Bipartisan Infrastructure Law included some $7.5 billion to expand the electric vehicle charging network across the US, and the Biden administration has made cybersecurity part of that initiative. Last fall, the White House convened manufacturers and policymakers to discuss a path toward ensuring that increasingly vital electric vehicle charging hardware is properly protected.

“Our critical infrastructure needs to meet a baseline level of security and resilience,” says Harry Krejsa, chief strategist at the White House Office of the National Cyber Director. He also argued that bolstering EV cybersecurity is as much about building trust as it is mitigating risk. Secure systems, he says, “give us the confidence in our next-generation digital foundations to aim higher than we possibly could have otherwise.”

Earlier this year, the Federal Highway Administration finalized a rule requiring states to implement “appropriate” cybersecurity strategies for chargers funded under the infrastructure law. But Johnson says the regulation omits devices installed outside that expansion, not to mention the more than 100,000 units already in place nationwide. Plus, he says, states haven’t offered much detail about what they’ll do. “If you drill down into the state plans, you'll find that they are actually extremely light on cyber requirements,” he says. “The vast majority that I saw just say they will follow best practices.”

Just what constitutes best practice remains ill-defined. Johnson and his colleagues at Sandia published recommendations for charger manufacturers, and he noted that the National Institute of Standards and Technology is developing a framework for fast-charging that could help shape future regulation. But, ultimately, he would like to see something akin to the 2022 Protecting and Transforming Cyber Health Care Act that’s geared toward electric vehicles.

“Regulation is a way to drive the entire industry to improve their baseline security standards,” he says, pointing to recent laws in other countries as models or starting points for policymakers in the United States. Last year, for instance, the United Kingdom rolled out a host of requirements for EV chargers, such as enhanced encryption and authentication standards, tamper detection alerts, and randomized delay functionality.

The latter means that a charger must be able to turn on and off with a random time delay of up to 10 minutes. That would mitigate the impact of all the chargers in an area coming online simultaneously after a power outage or hack. “You don’t get that spike, which is great,” says Munro. “It removes the threat from the power grid.”

Johnson is optimistic that the industry is moving in the right direction, albeit more slowly than is ideal. “I can't imagine \[stricter standards\] won't happen. It's just taking a long time,” he says. And he certainly doesn’t want to spark undue alarm, but rather apply steady pressure for improvement.

“It's scary stuff,” he says, “but it shouldn't be fear-mongering.”

EV Charger Hacking Poses a ‘Catastrophic’ Risk

Plus: Hackers knock out Russian military satellite communications, a spyware maker gets breached, and the SEC targets a victim company's CISO.

Amid exploding AI usage, the United States Senate is mulling legislation to regulate the development of artificial intelligence, but lawmakers' comments to WIRED this week indicate that Congress' abysmal track record on tech regulation may be doomed to repeat itself. Meanwhile, in the European Union, challenges filed under the EU's GDPR data law on Thursday allege that Pornhub has been collecting user data illegally.

We looked at a common air travel booking scam that can turn real—but not ticketed—flight reservations into cash grabs for cybercriminals. And tech companies have recently released an array of critical software updates that you should install on your devices right now. Some patches published in recent weeks from the company Progress Software patch flaws in the popular file transfer service MOVEit, which has been exploited by ransomware actors to spread malware and steal data from international companies, universities, and the US government.

If you want a digital hygiene project for the weekend, we have tips on how to make your chats and messaging more secure. And if you're craving a long read, WIRED went in-depth on the 1973 US National Personnel Records Center fire that destroyed 17 million military records and prompted a massive restoration effort.

And there's more. Each week, we round up the stories we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

On Tuesday, a 7-2 decision by the US Supreme Court reversed the conviction of a man who repeatedly threatened a stranger online. Justice Elena Kagan wrote in the majority opinion that First Amendment free speech protections require such cases to show that online harassers or cyberstalkers were aware that their digital abuse could be construed as threatening. Threats of violence are not protected by the First Amendment, but the court said prosecutors must show that a defendant “consciously disregarded a substantial risk that his communications would be viewed as threatening violence.” The offender in the case the court looked at, Billy Counterman of Colorado, had “moved to dismiss the charge on First Amendment grounds, arguing that his messages were not ‘true threats’ and therefore could not form the basis of a criminal prosecution.”

Counterman had persistently and repeatedly messaged a local singer he didn't know on Facebook over two years, and when she would block him he made new accounts to continue messaging her. Victims of online harassment and digital rights advocates warned following the decision that it creates a dangerous precedent to empower cyberstalkers. “The Court just handed stalkers and harassers, including of politicians, journalists, climate scientists, doctors advocating for vaccines, you name it, a new weapon,” Soraya Chemaly, director of the Women’s Media Center Speech Project, told the _Washington Post_.

A cyberattack caused a multiday outage this week of a Russian satellite communication system from Dozor-Teleport. The platform is broadly used, including by the Russian military. Ukrainian satellite communication infrastructure suffered a similar outage more than a year ago. Dozor’s parent company, Amtel Svyaz, also grappled with significant system outages this week. Multiple hackers claimed responsibility for the attacks, including some purporting to be hacktivists and others who said they were affiliated with the Russian private mercenary army Wagner Group. In addition to the outage, one of the entities claiming responsibility for the attack said it had stolen data from Dozor and published 700 files, including documents and images, to a leak site and Telegram.

The invasive phone monitoring app LetMeSpy said on June 21 that it was itself hacked. Attackers stole names, messages, call logs, and location data collected by the service, the company said. LetMeSpy is a Polish Android app that's used around the world to monitor thousands of people. The company's notice said that “a security incident occurred involving obtaining unauthorized access to the data of website users​​.”

Years after a Russian espionage campaign launched a devastating supply chain attack against software firm SolarWinds, the US Securities and Exchange Commission sent legal notices—known as “Wells notices”—to certain current and former Solarwinds employees. Such notices warn of potential securities law violations that could lead to civil enforcement action, but they rarely relate to cybersecurity incidents. Notably, one of the SolarWinds employees who received a notice is the company's current chief information security officer, Tim Brown, who was Solarwinds' head of security architecture at the time of the attack. Company CFO Barton Kalsu also received a notice. The situation is potentially significant as the US and other countries attempt to develop appropriate accountability mechanisms for high-ranking executives who preside over breaches and other security lapses. The fear among security professionals is often that individual penalties will simply discourage talented practitioners from taking top roles.

US Supreme Court Hands Cyberstalkers a First Amendment Victory

Plus: Microsoft fixes 78 vulnerabilities, VMWare plugs a flaw already used in attacks, and more critical updates from June.

Summer software updates are coming thick and fast, with Apple, Google, and Microsoft issuing multiple patches for serious security flaws in June. Enterprise software firms have also been busy, with fixes released for scary holes in VMWare, Cisco, Fortinet, and Progress Software’s MOVEit products.

A significant number of security bugs squashed during the month are being used in real-life attacks, so read on, take note, and patch your affected systems as soon as you can.

Apple

Hot on the heels of iOS 16.5, June saw the release of an emergency iPhone upgrade, iOS 16.5.1. The latest iPhone update fixes security vulnerabilities in WebKit, the engine that underpins Safari, and in the kernel at the heart of the iOS system.

Tracked as CVE-2023-32439 and CVE-2023-32434, both issues are code-execution bugs and have been used in real-life attacks, Apple said on its support page.

While details about the already exploited flaws are limited, security outfit Kaspersky revealed how the kernel issue was used to perform “iOS Triangulation” attacks against its staff. Impactful because they require no interaction from the user, the “zero click” attacks use an invisible iMessage with a malicious attachment to deliver spyware.

Apple has also issued iOS 15.7.7 for older iPhones fixing the Kernel and WebKit issues, as well as a second WebKit flaw tracked as CVE-2023-32435—which was also reported by Kaspersky as part of the iOS Triangulation attacks.

Meanwhile, Apple released Safari 16.5.1, macOS Ventura 13.4.1, macOS Monterey 12.6.7, macOS Big Sur 11.7.8 , watchOS 9.5.2 and watchOS 8.8.1.

Microsoft

Microsoft’s mid-June Patch Tuesday includes security updates for 78 vulnerabilities, including 28 remote code execution (RCE) bugs. While some of the issues are serious, it is the first Patch Tuesday since March that doesn’t include any already exploited flaws.

The critical issues patched in the June update include CVE-2023-29357, an elevation of privilege vulnerability in Microsoft SharePoint Server with a CVSS score of 9.8. “An attacker who has gained access to spoofed JWT authentication tokens can use them to execute a network attack which bypasses authentication and allows them to gain access to the privileges of an authenticated user,” Microsoft said.

“The attacker needs no privileges, nor does the user need to perform any action,” it added.

Meanwhile, CVE-2023-32031 and CVE-2023-28310 are Microsoft Exchange Server remote code execution vulnerabilities that require an attacker to be authenticated to exploit.

Google Android

It’s time to update your Google Android device, as the tech giant has released its June Security Bulletin. The most serious issue fixed by Google is a critical security vulnerability in the System component, tracked as CVE-2023-21108, that could lead to RCE over Bluetooth with no additional execution privileges needed. Another flaw in the System tracked as CVE-2023-21130 is a RCE bug also marked as critical.

One of the flaws patched in June’s update is CVE-2022-22706, a vulnerability in Arm components that the chipmaker fixed in 2022 after it had already been used in attacks.

Apple, Google, and MOVEit Just Patched Serious Security Flaws

Complaints filed in the European Union claim the porn site fails to follow basic data-collection policies under GDPR.

There aren’t many websites bigger than Pornhub. Each month, more than 2 billion people visit the adult site, spending an average of almost eight minutes browsing and watching videos—an eternity in internet time. All that activity has the potential to generate huge volumes of data. Now Pornhub is facing a series of legal challenges across Europe over the information it collects.

Activists and researchers are filing a complaint today against Pornhub in Italy that claims the company is “illegally” handling the data of millions of people. The complaint—which is based on a technical analysis of the website and its privacy practices and builds upon previously unreported complaints in the country and in Cyprus, where Pornhub is legally based in Europe—alleges that the company falls foul of Europe’s strict GDPR rules, which govern how people’s data can and should be used.

Pornhub doesn’t allow people to easily opt out of being tracked by cookies; the site isn’t clear about the data it shares with third parties; and its algorithm “assigns” people sexual preferences, based on the videos they watch, says Alessandro Polidoro, a digital rights activist and the lead attorney of the litigation. Polidoro is representing #StopDataPorn, a collective that includes researchers and civil liberties organizations involved in the action. Polidoro spoke with WIRED about the legal complaints but did not disclose the text, due to the privacy of individuals involved.

The legal complaints, which could take years to resolve, arrive as the online adult industry faces increased scrutiny from regulators around the world, with governments blocking what is accessible online and demanding that people show ID to access adult material.

Polidoro claims that the group found “a lot” of potential issues with the way Pornhub uses people’s data but has decided to focus on three areas. First, there’s the issue of people giving consent to be tracked, Polidoro says. Under Europe’s privacy laws, if a website wants to track someone, it has to obtain consent. That’s why the web is littered with annoying cookie popups.

Open YouTube, for instance: In Europe, a big popup appears stating how cookies are used, and it gives people the option to accept, reject, or customize them. However, if you open Pornhub, a banner appears at the bottom of the page that says the website uses cookies. It includes an option to find out more information and a button that says “OK,” but it provides no way to stop cookies from tracking you. (The banner does not appear in the UK or US, according to tests by WIRED.)

“Pornhub is not asking for consent,” says Polidoro. “Pornhub is dealing with the sexual preferences of users, and they don’t ask for consent.” Polidoro says cookies are deployed whether someone clicks “OK” or doesn’t click the button.

The second element of the GDPR problems, Polidoro says, has to do with the way Pornhub shares the information it collects with other businesses owned by its parent company, MindGeek, which is based in Canada and was recently purchased by private equity firm Ethical Capital Partners. The group claims there is little transparency around what data is shared and how it is used.

The final element of the complaints claims that Pornhub uses people’s data and “unilaterally assigns sexual preferences to each individual without their knowledge,” according to statements from the group behind the action. Polidoro claims that someone only needs to watch a small number of videos to be shown more of that kind of content.

Freely available tools that monitor what trackers websites use, such as Blacklight and Privacy Badger, show that Pornhub data is transmitted to Google via its analytics platform and tag manager, and also TrafficJunky, the advertising platform owned by MindGeek. TraffickJunky claims its ads are viewed 3.2 billion times a day.

One tracking technology Pornhub uses is capable of storing IDs of the videos you watch—using the “watchedVideoStorage” and “watchedVideoIds” keys—on your computer or phone, WIRED tests found. Each time you watch a video, even if you aren’t logged in to Pornhub, an ID number for it is added to a list in your browser’s local storage. “They basically create a parallel search history kept directly on the user’s device,” Polidoro says.

A MindGeek spokesperson says the company does not comment on ongoing litigation and will respond "through the appropriate process in time." "MindGeek is committed to protecting user privacy, and is continuously implementing measures to safeguard the personal data of everyone in its community," the spokesperson says.

Pornhub's privacy policy, which details the data it can collect about people, says it uses cookies for multiple purposes. For example, it uses cookies to help people log in, to “personalize and enhance” people’s online experience, to record how many people are using its website, and to track the pages people visit and serve ads. “You can set your browser to refuse all or some browser cookies or to alert you when cookies are being sent,” the privacy policy says. It also says Pornhub has turned on Google Analytics IP anonymization so full IP addresses are not stored.

Emily van der Nagel, a lecturer in social media at Monash University, Australia, who researches social media identities, says that while Pornhub’s privacy policy does include what data it collects and uses, it is “probably unlikely” that the average user looks at this information. “If data collection appears to be happening on a technical level, from an opaque organization, with no insight into the social consequences, users are unlikely to attempt to intervene in the data collection,” Nagel says. “If there is a threat of social harm, for example, porn preferences surfacing as targeted ads that display prominently on a work computer—this is when users become aware of what data porn websites collect about them and seek to intervene in that data collection and use.”

While one new GDPR complaint is being filed in Italy today, the #StopDataPorn group also filed broader complaints with officials in Italy and Cyprus last year. Italy’s data regulator refused WIRED’s request to comment on the issues, while Cyprus’s data regulator had not responded at the time of writing. Much of the underlying research for the complaints was completed by Tracking Exposed, a digital rights group that has developed a custom browser extension to analyze Pornhub’s personalization algorithm. The group published a peer-reviewed analysis of Pornhub’s algorithm in May 2022.

The complaints are likely to draw attention to the amount of data the pornography websites collect and how they handle that information. Generally speaking, porn companies can collect huge reams of data about who visits them. In 2019, researchers analyzed 22,484 porn websites and found that 93 percent of them leak data to third parties, 44.97 percent “expose or suggest” a gender or sexual identity that is likely to be linked to the user, and 79 percent used tracking cookies from outside companies. Google’s trackers were on the vast majority of websites, the research found.

“Since Pornhub is modeled on YouTube, it isn’t a surprise that data practices characteristic, or foundational, to social media are also present,” says Susanna Paasonen, a professor of media studies at the University of Turku, Finland, who researches sexuality and pornography. “The degree to which this is obvious to casual users is, however, impossible to predict.”

Paasonen points to the fact that Pornhub has in recent years highlighted how much data it can collect through its Insights series, which details traffic trends on the website and provides some transparency. “But as there are no opt-outs—as required by GDPR—and I doubt how many users read their privacy policy that makes the tracking pretty obvious, the transparency vis-à-vis users is questionable,” Paasonen says. For most people, using privacy browsers or privacy-enhancing browser extensions can help limit what data is collected and how they’re tracked.

Pornhub Accused of Illegal Data Collection

Scammers use a booking technicality, traveler confusion, and promises of dirt-cheap tickets to offer hot deals that are anything but.

How do you tell that your plane ticket is real? If it checks out on the airline’s website, you’re good to go, right? Don’t be sure. Fraudsters are abusing a little-known but decades-old technicality in how airline reservations work to con people out of their cash.

Mevonnie Ferguson, who lives in Kent in the UK, says she was scammed out of £994 ($1,267) by someone claiming to work at a travel agency called Infinity Global Travel. A single working mother of two daughters, Ferguson says she was sold what appeared to be a valid British Airways ticket from London to Kingston, Jamaica. When she looked up the reservation on BA’s website using the confirmation number and her last name, it showed up valid and fine. But about two weeks after purchasing this ticket from Infinity Global Travel, and just days before her scheduled departure date, the reservation disappeared from BA's website without a trace.

Ferguson, who also relayed her story to the UK's Channel 5, contacted the airline and explained her situation, but she was told there were no flights booked in her name. BA would not release information to Ferguson, as she was not the party who had directly booked the reservation with the airline, she says. After some persuasion, the BA representative ultimately told Ferguson that while the reservation code she provided was correct, there was no record of an e-ticket number.

Ferguson has since tried to get a refund from the supposed travel agent, who has neither returned her money nor responded to subsequent calls and emails. A BA spokesperson asked WIRED for additional details so they could investigate but did not otherwise respond to a request for comment.

This problem isn’t unique to British Airways or any one airline in particular. In fact, it’s an intentional part of the air travel industry's reservation process that scammers can abuse. 

Hold Up

Like many travelers, Ferguson did not understand the difference between a “confirmed” and a “ticketed” reservation, travel industry jargon terms that are not synonymous. The system makes it possible to create what appears to be a valid flight reservation, but which is actually a mere temporary reservation “hold.” 

Here’s how the con works: A scammer entices customers with cheap airline tickets through email, a website, or social media. Once they have a victim's details, the scammer purchases a reservation hold—not the actual plane ticket—via a travel agency. They then pass that hold on to the victim as a legitimate ticket. The victim can check the airline’s website and see that the reservation is in the system. But once the two weeks are up the hold disappears, and the scammer makes off with the money the victim thought they were spending on a real—albeit suspiciously cheap—plane ticket.

Most airlines will not let individual passengers hold a prolonged reservation directly. As an example, Qatar Airways lets anyone hold a flight for just 72 hours for a “minimum fee,” without paying the full fare up front. This means you’ll be provided a valid passenger name record (PNR) number, but your reservation will not be “ticketed”—meaning no e-ticket number—until the full fare is paid. By contrast, travel agencies have much more power and flexibility to hold a reservation, a weak point that gives scammers an in. 

Some legitimate travel agencies will let you pay as little as $15 to $20 to “hold” a flight ticket for a couple of weeks. And there are good use cases for this. When applying for a tourist visa, for example, embassies or consulates of a destination country may ask applicants to provide proof of return travel. Rather than purchase a full ticket, applicants may instead opt to pay a travel agent a small fee and get a valid flight booking, with a real PNR that can be verified by the visa officer on an airline’s website. Should their visa application be refused for any reason, applicants lose only the small fee paid to the travel agent—a better deal than hassling with an airline to modify or cancel a full ticket or failing to get a refund entirely.

Sites like Expedia and Skyscanner are, of course, the mainstream way people book air travel. But for anyone who needs a long hold, travel agencies are their only option. These agencies advertise inexpensive reservation holds as “flight itineraries for visa applications,” which are colloquially known as “dummy tickets” and are valid for two weeks. This time window is enough for a scammer to con someone.

Test Dummy

To test how a dummy ticket scam works, I purchased a Qatar Airways reservation for $20 via a legitimate third-party travel agency. For the two weeks after I made this booking, Qatar Airways’ website would show the confirmation number as valid. But no e-ticket number is listed anywhere on the reservation—indicative of this being a mere “hold”—meaning it's a reservation that’s “confirmed” but not ticketed. Scammers do exactly the same thing by booking the hold under their victim’s name.

Scams aside, the gap between reservation holds and ticketing can cause problems for travelers all by itself. In 2019 a traveler named Alexander told his story to The Points Guy of a mishap in which his flight to Spain was merely confirmed but never ticketed—which he didn’t find out until he arrived at the airport. In this case the problem had to do with the airline’s policy of not issuing e-tickets against bookings until an identity check was completed by the passenger—something Alexander missed because the ID verification email landed in his spam folder. But the mechanism behind his and Ferguson’s scenarios are identical.

Suffice it to say, it is best to book your flight tickets directly with an airline or via a trusted travel platform. If an offer sounds too good to be true, it may be a scam. And always verify with the airline if your “confirmed” reservation indeed has a real ticket to go along with it.

How Your Real Flight Reservation Can Be Used to Scam You

Fifty years ago, a fire ripped through the National Personnel Records Center. It set off a massive project to save crucial pieces of American history—including, I hoped, my grandfather’s.

The Night 17 Million Precious Military Records Went Up in Smoke

With a poor track record on tech regulation, do lawmakers stand a chance?

While negotiations started with Young and Schumer, they didn’t end there. Rather, the pair heard input from other congressional committees and worked that into the final package.

“That was the most utilization I’ve seen of the committee process since I’ve been in Congress, and I think this has an opportunity to be even more inclusive,” Young says. “Senator Schumer and I started off with legislation, but then we drew extensively from different committees of jurisdiction. I think that this effort will be even more decentralized.”

While many senators will introduce their own AI measures, Young says the bipartisan effort is aimed at getting lawmakers on the same page.

“So some of us may have bills, but the real point of emphasis here will be on crowding in ideas from others, so I think this will be more committee-focused,” Young says.

Schumer’s Democratic partner in the AI talks is Heinrich, the New Mexico Democrat, who says the closed-door meetings in the Senate are meant to help strengthen the Senate’s long-standing committees.

“I think where we are right now is encouraging everyone through the normal processes,” Heinrich says. “Different committees are going to have very different jurisdictions.”

And there are a lot of committees and many AI-related issues to tackle. For example, the Judiciary Committee will need to sort out copyright questions, the Armed Services Committee will handle questions of war, peace, and nuclear Armageddon (concerns Senator Ed Markey, a Massachusetts Democrat, has raised). And the Education Committee will handle AI’s potential impact on public education.

Lawmakers—and their staffs—also have to pore over today’s laws to see which work and which need a reboot, like copyright law in the AI era. “Some of that, the existing law is adequate, and in other places, it’s not,” Heinrich says.

Counting Critics

For now, the AI talks have largely remained above the partisan fray. Last week, a bipartisan and bicameral group unveiled a new proposal to erect a national AI commission—comprising 10 Democrats and 10 Republicans—to address AI in a more dispassionate manner than we’ve come to expect from Congress. Even so, pro-industry critics are starting to voice their concerns over what they see as a rush to regulate.

“Putting the federal government in charge of the granular development of AI is a strategy certain to ensure that China beats us in every respect in the development of AI—and that would be catastrophic,” says Senator Ted Cruz.

Cruz is the top Republican on the Senate’s Commerce, Science & Transportation Committee, which has sweeping jurisdiction over the economy. The junior senator from Texas fears Congress is going to overstep and crush innovation in the name of digital protectionism.

“I think that’s foolhardy. Very few members of Congress have any idea what AI is, much less how to regulate it. There are—no doubt, there are risks and risks we need to take seriously, but there are also enormous potential productivity gains. And the last thing we want to do is turn technology innovation into the Department of Motor Vehicles,” Cruz says.

Like his 99 colleagues, Cruz will get his say in due time. While the bipartisan AI working group isn’t focused on producing a massive, catch-all AI bill, its members know that such legislation could be the final outcome, following on the heels of the CHIPS and Science Act of 2022.

If that happens, it will be legislation the likes of which the Senate has never seen, in part because AI appears to be all-encompassing.

“It’s going to be big. It’s going to be big, and our hope is that all of the relevant committees do the hard work of figuring out where those things are,” Heinrich says. “Hopefully, we can get on the same page on a number of those things and then package that together.”

The US Senate Wants to Reign In AI. Good Luck With That

Make sure your chats are kept as private as you want them to be.

The actual number of chat messages sent each day is hard to come by, but with WhatsApp alone accounting for billions of users, you can imagine the sheer volume of ongoing conversations.

Not all of those messages involve anything particularly sensitive or private, but a lot of them do—and you don’t want those chats to be seen by anyone other than the intended recipients.

Good messaging hygiene might involve changing apps or tweaking a setting, but it’s important that you don’t neglect it. These five recommendations can get you started.

Switch to End-to-End Encryption

When instant messenger chats are end-to-end encrypted, they’re essentially turned into impenetrable blocks of data. Only the devices of the person (or people) you’re chatting with have the codes to unlock that data, which ensures no one else can read your messages while they’re in transit.

Not even the developers behind the software you’re using can unlock that data, so if an unscrupulous employee wanted to take a peek at your chats, they wouldn’t be able to. If law enforcement requested copies of the conversations, there wouldn’t be anything useful to hand over to them.

Some instant messengers use end-to-end encryption, but not all of them do. End-to-end encryption is deployed by default for Signal, WhatsApp (for personal chats,) iMessage, and Google Messages (with RCS enabled.) It’s also available as an option on Facebook Messenger and Telegram. If you’re using anything else, check the provider’s policies and consider switching to something more secure.

Facebook Messenger lets you set messages to disappear.

Facebook via David Nield

Turn On Disappearing Messages

We mentioned that Facebook Messenger has the option of end-to-end encryption: To enable it, you need to make a conversation “secret” by tapping the info (“i”) button at the top of a chat in the mobile app, then choosing **Go to secret conversation**.

Once you’re in that secret conversation, another feature becomes available: Disappearing messages. Tap the info button again and pick **Disappearing messages**, then choose how long messages should stick around after being read. This way of tidying up after yourself protects you against someone reading through your chats if they gain access to them or physical access to your device.

Facebook Messenger isn’t the only app that offers this functionality: You can also find disappearing messages in WhatsApp, Signal, and Telegram, among others. On iPhones, you can delete older conversations in the Messages app after choosing **Messages** and **Keep Messages** from Settings.

Lock Individual Conversations

To avoid an unwelcome visitor gaining access to your phone and all of your chats, one of the best things you can do is lock some or all of those chats behind a passcode or other lock—like the protection on your phone’s lock screen.

WhatsApp makes this simple. You can lock the entire app via the **Privacy** menu in the app settings, or you can lock individual chats: Open the chat, tap the conversation name at the top of the screen, and then pick **Chat lock**. The options here will depend on the options on your phone (such as fingerprint lock and face recognition).

Other apps offer the ability to lock all of your chats, including Signal, Facebook Messenger, and Telegram, though for the moment the option to lock individual conversations is exclusive to WhatsApp.

Check Your Contact Options

Most instant messenger and social media apps let you control which other users are allowed to follow you, send friendship requests, communicate with you via direct messages, and so on. Tightening up these settings is another way to limit your exposure to the wider world and maximize the security of your chats.

Take Telegram, for example. Head to **Privacy and Security** in Settings, and you can control who is allowed to see your online status, your profile photo, the groups and channels you’re in, and more. Other apps have similar options, so make sure you know what they are and what they do.

Also, think about the temporary photo and video posts commonly known as stories if your app supports them (a lot now do). These stories have their own visibility settings and may well be public by default.

Setting visibility options in Telegram.

Telegram via David Nield

Know Where Your Chat Backups Are

You want to keep backups of some conversations, otherwise you risk losing all of those records, and all that history, if something should happen to your smartphone.

But it’s important to know what you’re backing up and where those backups live. Backups are another potential route for anyone trying to access your messages without authorization, so you should keep them as well protected and secure as anything that’s actually on your phone. Some apps back up your conversations locally, and few encrypt them, so make sure to check your favorite app’s settings.

As a final precaution, you also need to think about other devices and locations where you’re logged in—Gmail can lead to Google Chat, for example—as well as places any external backups might be stored and how these are protected (take WhatsApp on Android, which can save chat backups to Google Drive).

Source

Wired