The interrogation of CEO Shou Zi Chew highlighted US lawmakers’ own failure to pass privacy legislation.

In one sense, today’s US congressional hearing on TikTok was a big success: It revealed, over five hours, how desperately the United States needs national data-privacy protections—and how lawmakers believe, somehow, that taking swipes at China is a suitable alternative. 

For some, the job on Thursday was casting the hearing's only witness, TikTok CEO Shou Zi Chew, as a stand-in for the Chinese government—in some cases, for communism itself—and then belting him like a side of beef. More than a few of the questions lawmakers put to Chew were vague, speculative, and immaterial to the allegations against his company. But the members of Congress asking those questions feigned little interest in Chew’s responses anyway. 

Attempts by Chew, a 40-year-old former Goldman Sachs banker, to elaborate on TikTok’s business practices were frequently interrupted, and his requests to remark on matters supposedly of considerable interest to members of Congress were blocked and occasionally ignored. These opportunities to get the CEO on record, while under oath, were repeatedly blown in the name of expediency and for mostly theatrical reasons. Chew, in contrast, was the portrait of patience, even when he was being talked over. Even when some lawmakers began asking and, without pause, answering their own questions.

The hearing might’ve been a flop, had lawmakers planned to dig up new dirt on TikTok, which is owned by China-based ByteDance, or even hash out what the company could do next to allay their concerns. But that wasn't the aim. The House Energy and Commerce Committee was gathered, it said, to investigate “how Congress can safeguard American data privacy and protect children from online harms.” And on that, the hearing revealed plenty.

For one thing, it’s clear that the attempts to isolate TikTok from its competitors—to treat it differently than dozens of other companies with atrocious records of endangering kids and abusing private data—is a pointless exercise. Asking about TikTok's propensity for surveilling its own users, Chicago congresswoman Jan Schakowsky warned Chew against using legal, typical industry practices as a defense against these wrongs. “You might say, ‘not more than other companies,’” she said, adding that she preferred not to “go by that standard.” 

OK. But why not? 

The truth is that if TikTok were to vanish tomorrow, its users would simply flock to any number of other apps that have no qualms about surveilling the most private moments of their lives and amassing, manipulating, and selling off sensitive information about them. Excluding the most serious but largely unsubstantiated allegations leveled at TikTok—that it is acting or will act in coordination with Chinese intelligence services—there wasn’t a concern about privacy raised by lawmakers Thursday that couldn't be addressed by existing legislation supporting a national privacy law. 

Ensuring that companies and the data brokers they enrich face swift reprisals for blatantly abusing user trust would have the benefit of addressing not only the accusations levied against TikTok, but deceitful practices common across the entire social media industry. 

The irony of US lawmakers pursuing a solution to a problem that’s already been solved by draft legislation—but not actually fixed due to its own inaction—wasn’t entirely lost on the members. While primarily focused on a single company, the hearing, Florida congresswoman Kathy Castor said, should really serve as a broader call to action. “From surveillance, tracking, personal data gathering, and addictive algorithmic operations that serve up harmful content and have a corrosive effect on our kids’ mental and physical well-being,” she said, Americans deserve protection, no matter the source.

The TikTok Hearing Revealed That Congress Is the Problem

The embattled social media company brought out the checkbook to ensure at least 30 of its biggest assets—creators—were in DC to help fend off critics.

Ahead of TikTok CEO Shou Zi Chew’s much-anticipated testimony in the United States House of Representatives today, the embattled tech firm conducted a full-court press on Capitol Hill. This included paying to bring TikTok influencers face-to-face with their home state lawmakers, staffers, and journalists, as well as sharing their journey with their collective audience of some 60 million followers. 

TikTok covered travel, hotels, meals, and shuttle rides to and from the Capitol for dozens of influencers, according to the creators and the company itself. Each social media star was also invited to bring a plus one—whether they flew in from Oklahoma, hopped the Acela from New York, or drove in from their suburban Washington home. TikTok spokesperson Jamal Brown confirms that “TikTok covered travel expenses for all creators and a guest.”

“Any barriers to getting here they helped cover,” says Tiffany Yu, a Los Angeles-based influencer and disability advocate tapped to speak yesterday at a highly orchestrated press conference under the Capitol’s majestic dome.

While some influencers report paying their own airfare to Washington, everyone we talked to took the free hotel. It’s unclear precisely what folks were offered as part of the trip to Washington, but seemingly everyone got one perk or another. Beyond the more than 30 influencers in attendance, along with their travel buddies, WIRED counted 10 other people who were, in one way or another, at the Capitol on behalf of TikTok.

"More than 150 million Americans, including 5 million US businesses, rely on TikTok to innovate, find community, and support their livelihoods,” spokesperson Brown says. “A US ban on TikTok could have a direct impact on the livelihoods of millions of Americans. Lawmakers in Washington debating TikTok should hear firsthand from people whose lives would be directly affected by their decisions.” 

The nearly dozen influencers WIRED spoke with did not hide the fact that TikTok brought them to Washington to support the company. (The plan was first reported by Politico and The Information.) “They took us here, but we’re not being paid,” says Jorge Alverez, a mental health advocate from New Jersey. TikTok “paid for transportation—that’s also public information.” 

Alexandra Doten, an expert in space communications who goes by @astro\_alexandra on the app, is based near Washington, DC. But she says she also received support from the company. “I got the hotel too!” she says. “I don’t know. They just shuttle me there.”

While Doten was able to meet with her congressman, Maryland’s Glenn Ivey, this week, the highlight for her was meeting astronaut-turned-senator Mark Kelly of Arizona. She also got a true taste of life at the Capitol when the state’s other senator, Kirsten Synema, sent a staffer to meet with the influencers on her behalf. It’s unclear if their goodwill tour will sway any of TikTok’s countless congressional critics, who claim the app poses a threat to US national security.

Chew is the latest in a line of Big Tech executives who’ve had to face hostile (if often uninformed) lawmakers. But unlike Meta’s Mark Zuckerberg or Alphabet’s Sundar Pichai, Chew is the only CEO who has had technology banned on US government devices or been accused of being a puppet for the Chinese Communist Party. 

TikTok’s response to lawmakers asserting that the CCP could use the app for everything from espionage to election-influence operations is to launch a PR offensive on Washington. In addition to the more than $10 million the company has dropped on lobbyists over the past two years, this week it also tapped the Los Angeles-based Hotline Agency, “a Black and queer-owned boutique creative communications agency,” to help retell its story. Hence, the company spending lavishly this week to ensure its best assets—its diverse group of creators—get private face time with Washington power brokers before members of the House Energy and Commerce Committee accuse Chew of being an operative for Chinese communists.

At TikTok’s press conference yesterday, the enthusiasm emanating from the crowd of more than 140 people was tangible; influencer stories were deeply personal. After a brutal month for the beleaguered tech firm, all the cheering and sign-waving for Yu and other speakers, including three sympathetic Democratic lawmakers, made it seem like TikTok had finally turned the tide and gotten organic momentum on its side. That tone soon clashed with the TikTok signs held by members of the crowd that had a glossy (but not too glossy) sheen indicative of a high-priced PR firm.

Much as the app’s users are addicted to its unparalleled For You feature, TikTok’s team carefully manicured this press conference to appeal to journalists’ most basic instincts. A taco influencer, with a cake served up for dessert; a nurse; a “patriot”; artists; musicians; and a model. The press corps, which made up roughly half the crowd, couldn’t look away. 

The tech company isn’t just throwing money at its image problems. It also announced new safety features ahead of today’s hearing, including acquiescing to pressure to drastically limit the time children are allowed to spend on the app daily, from unlimited to 60 minutes. 

TikTok also enjoyed the vocal support of some lawmakers. Advocates for the app say the company poses no more of a threat to America’s children than, say, Facebook did when it allegedly buried research showing Instagram was a health risk to children, according to one whistleblower.

“My question is, why the hysteria and the panic and the targeting of TikTok?” Congressman Jamaal Bowman asked yesterday’s crowd. “As we know, Republicans, in particular, have been sounding the alarm creating a red scare around China.”

But it’s not just Republicans calling for a TikTok crackdown. Senate Majority Leader Chuck Schumer has spoken out against the app, and House Minority Leader Hakeem Jeffries appointed Raja Krishnamoorthi of Illinois—one of TikTok’s loudest foes in the Capitol—as the top Democrat on Republicans’ new, high-profile select committee on China. Senator Mark Warner, a Virginia Democrat, recently introduced bipartisan legislation that could lead to a full TikTok ban in the US. 

While the anti-TikTok furor marks one of the most bipartisan policy areas in today’s divided capital, Congressman Bowman says the rush to punish TikTok is distracting lawmakers from the serious privacy concerns he has with Silicon Valley’s finest. “It poses about the same threat that companies like Facebook and Instagram and YouTube and Twitter pose, so let’s not marginalize and target TikTok,” Bowman told the crowd. “Let’s have a comprehensive conversation about legislation that we need—federal legislation—to make sure people who use social media platforms are safe and their information is secure and their information is not being shared or sold to third parties.” 

Bowman also correctly pointed out that “there are still data brokers who sell our data to other countries and businesses. In other countries, they sell to the highest bidder.” He concluded: “Let’s not be racist toward China and express our xenophobia when it comes to TikTok because American companies have done tremendous harm to American people.”

As for the influencers, they say it’s hard even to have a dialog with many members of Congress because fear of China has blinded them to what the influencers see as the beauty of TikTok’s social platform. In her remarks, influencer and Ohio native Nichole Baedri (aka @Backinthekitchenwithbae) invited the nation’s political class to join the wild ride that is TiKTok. “Connect with us on another level,” she said. Baedri further implored lawmakers to recognize the value of the app, like how it has helped marginalized individuals connect and share their stories in an impactful way. “Use the app as intended.”

When House Energy and Commerce Committee member Marc Veasey, a Texas Democrat, learned that TikTok had footed the bill for more than 30 influencers and hired a PR firm to polish its image, he says he was “not surprised”—even if his reaction suggested otherwise.

“I did not know that,” he said. “Wow. Wow.” 

During the hearing, Veasey pressed Chew on all the voter disinformation on the platform, but he says the CEO’s response was guarded and off-putting. As you might expect, Veasey’s takeaway is the opposite of what TikTok influencers and staffers were selling to lawmakers on Capitol Hill all week.

“He came here today to be very careful, instead of transparent,” Veasey says. “He came to be careful and evasive. He did not come to be forthcoming.”

TikTok Paid for Influencers to Attend the Pro-TikTok Rally in DC

Image-editing tools from Google and Microsoft contain the “aCropalypse” bug, which can reveal information users intentionally removed.

At the beginning of March, Google released an update for its flagship Pixel smartphones to patch a vulnerability in the devices’ default photo-editing tool, Markup. Since its 2018 introduction in Android 9, Markup’s photo-cropping tool had been quietly leaving data in a cropped image file that could be used to reconstruct some or all of the original image beyond the confines of the crop. Though now fixed, the vulnerability is significant because Pixel users have for years been making, and in many cases presumably sharing, cropped images that may still contain the private or sensitive data the user was attempting to eliminate. But it gets worse.

The bug, dubbed “aCropalypse,” was discovered and originally submitted to Google by security researcher and college student Simon Aarons, who collaborated on the work with fellow reverse engineer David Buchanan. The pair were stunned to discover this week that a very similar version of the vulnerability is also present in other photo-cropping utilities from a totally separate yet equally ubiquitous codebase: Windows. The Windows 11 Snipping Tool and Windows 10 Snip & Sketch tool are vulnerable in cases where a user takes a screenshot, saves it, crops the screenshot, and then saves the file again. Photos cropped with Markup, meanwhile, retained too much data even when the user applied the crop before first saving the photo. 

Microsoft told WIRED on Wednesday that it is “aware of these reports” and that it is “investigating,” adding, “we will take action as needed.”

“It was pretty mind-blowing really, it was as if lightning had just struck twice,” says Buchanan. “The original Android vulnerability was already surprising enough that it hadn’t been discovered already. It was quite surreal.”

Now that the vulnerabilities are out in the open, researchers have started uncovering old discussions on programming forums where developers noticed the odd behavior of the cropping tools. But Aarons seems to have been the first to recognize the potential security and privacy implications—or at least the first to bring the findings to Google and Microsoft.

“I actually noticed it at about 4 in the morning by total accident when I spotted that a small screenshot I sent of white text on a black background was a 5 MB file, and that didn’t seem right to me,” Aarons says.

Images impacted by aCropalypse often can’t be completely recovered, but they can be substantially reconstructed. Aarons provided examples, including one in which he was able to recover his credit card number after he attempted to crop it out of a photo. In short, there is a population of photos out there that contain more information than they should—specifically, information that someone intentionally tried to remove.

Microsoft hasn’t issued any fixes yet, but even those released by Google don’t mitigate the situation for existing image files cropped in the years when the tool was still vulnerable. Google points out, though, that image files shared on some social media and communication services may automatically strip out the errant data.

“As part of their existing compression process, apps and websites that recompress images, like Twitter, Instagram, or Facebook, delete extra data automatically from images uploaded. Images posted to sites like these are not at risk,” Google spokesperson Ed Fernandez says in a statement.

The researchers point out, though, that this is not true of all platforms, including Discord.

As a Discord user, Buchanan say he kept seeing people posting cropped screenshots, and it was really hard to not say anything before the vulnerability was publicly disclosed.

Steven Murdoch, a professor of security engineering at University College London, notes that in 2004 he discovered a vulnerability in which an older version of an image was stored in the thumbnail data for the image even after it had been altered.  

“This isn’t the first time I’ve seen this sort of vulnerability,” Murdoch says. “And I think the reason is because when software is written, it’s tested to make sure that the thing you expect is there. You save an image, you can open the image, and then you’re done. What is not checked is whether there is accidentally extra data stored.”

The thumbnail vulnerability Murdoch found in 2004 was conceptually similar to aCropalypse from a data privacy standpoint but had very different technical underpinnings because of issues in application programming interface design. And Murdoch emphasizes that while he sees aCropalypse as a problem for users whose affected photos are already out in the world, its biggest impact may come from the discussions it has raised about how to promote better security practices in API development and implementation.

“This has triggered some interesting conversations about API design and what do you do to teach people to avoid this sort of vulnerability in the future? This is not something that we train people to deal with,” Murdoch says. “It’s not one of these ‘sky is falling’ vulnerabilities, but it’s not good.”

Bug in Google Markup, Windows Photo-Cropping Tools Exposes Removed Image Data

On Thursday, Shou Zi Chew will meet a rare united front in the US Congress against the Chinese-owned social media app that has lawmakers in a tizzy.

March has been brutal for TikTok. Last week, the UK joined the US, Canada, and Belgium in banning TikTok on government devices. And FBI director Christopher Wray warned lawmakers that misinformation spread through the app can “divide Americans.” At the start of the month, Senate intelligence chair Mark Warner unveiled a new measure, the Restrict Act, which would enable the US commerce secretary to ban TikTok and any other tech from six “hostile” nations that the US intelligence community deems a national security threat.

The White House supports Warner’s bill, and the multi-agency Committee on Foreign Investment in the United States told TikTok it would be banned unless it’s completely divested from ByteDance. Lawmakers in both parties welcomed that announcement. “It’s a step toward banning them,” says senator Roger Wicker, a Mississippi Republican.

While many lawmakers embraced White House pressure, they aren’t sitting on the sidelines as they did when former president Donald Trump tried to ban TikTok through executive orders, which the courts ultimately shot down.

“I think it's absolutely a good first step. I'm not sure it's going to get us everywhere we want to be,” says senator John Hickenlooper, a Colorado Democrat. “I don't think we want to have a Chinese-owned company to have that kind of access to not just our kids, our culture.”

It’s not just espionage that worries lawmakers, who argue the app has a vulnerable captive audience among young people in the US. TikTok recently unveiled new efforts to limit users’ exposure to the app, including an hour-per-day time limit for children under 18, but it fails to address lawmaker’s concerns. “I'm not sure TikTok is a healthy ingredient to add to our children's psychological diet,” Hickenlooper says.

TikTok did not respond to WIRED's request for comment.

More than half of states prohibit TikTok’s use on government devices, and it’s banned by dozens of public schools, from grade schools to some of the nation’s largest universities. Tennessee attorney general Jonathan Skrmetti is leading an investigation on behalf of 46 states into whether the app is detrimental to children’s mental health. The US Department of Justice, meanwhile, is investigating reports that TikTok staffers spied on US journalists.

In short, Chew faces a daunting assignment given the hostility that awaits him at 10 am ET tomorrow. 

The debate at the Capitol is now over _how_ to punish TikTok, not _whether_ to punish TikTok. After supporting the Senate’s unanimous consent agreement to ban the app on government devices in December, senator Rand Paul, a Kentucky Republican, is one of the few lawmakers opposed to an outright ban. “I’m against banning TikTok. I think it violates the First Amendment. I think it also violates the prohibition on bills of attainder where one company is targeted by government,” Paul says. 

Other lawmakers dismiss claims that a TikTok ban would be unconstitutional. “We're not regulating the speech of the company, we're regulating the way it uses its data and its ownership on how it creates a national security vulnerability,” says Marco Rubio, the Senate Intelligence Committee vice chair and Florida Republican. 

With the Senate in Democrats’ hands and the House controlled by Republicans, TikTok is one of the few areas where the two chambers seem to agree. 

“TikTok in its current construct is unacceptable,” says senator Lindsey Graham, a South Carolina Republican. “I'd like to come up with a construct that people could enjoy the service, like 100 million people do, and not empower communist China. That's my preferred outcome.”  

With broader data privacy measures stalled in Congress and antitrust measures shelved by the new House Republican majority, TikTok has become the Big Tech bogeyman for both parties. And both parties seem fine with that—at least for now. “The reason why this is a good place to start is because we’re all agreed,” Krishnamoorthi says. “You may disagree about which American companies handle our data best, but nobody disagrees that the Chinese Communist Party should not have access to our private data.”

The TikTok CEO’s Face-Off With Congress Is Doomed

Doctored images of the former US president went viral on Twitter. These are the telltale signs that they aren’t what they seem.

The viral, AI-generated images of Donald Trump’s arrest you may be seeing on social media are definitely fake. But some of these photorealistic creations are pretty convincing. Others look more like stills from a video game or a lucid dream. A Twitter thread by Eliot Higgins, a founder of Bellingcat, that shows Trump getting swarmed by synthetic cops, running around on the lam, and picking out a prison jumpsuit was viewed over 3 million times on the social media platform.

What does Higgins think viewers can do to tell the difference between fake, AI images, like the ones in his post, from real photographs that may come out of the former president’s potential arrest? 

“Having created a lot of images for the thread, it's apparent that it often **focuses on the first object** described—in this case, the various Trump family members—with everything around it often having more flaws,” Higgins said over email. Look outside of the image’s focal point. Does the rest of the image appear to be an afterthought?

Even though the newest versions of AI-image tools, like Midjourney (version 5 of which was used for the aforementioned thread) and Stable Diffusion, are making considerable progress, mistakes in the smaller details remain a common sign of fake images. As AI art grows in popularity, many artists point out that the algorithms still struggle to replicate the human body in a consistent, natural manner. 

Looking at the AI images of Trump from the Twitter thread, the face looks fairly convincing in many of the posts, as do the hands, but his **body proportions may look contorted** or melted into a nearby police officer. Even though it’s obvious now, it’s possible that the algorithm might be able to avoid peculiar-looking body parts with more training and refinement.

Need another tell? Look for odd writing on the walls, clothing, or other visible items. Higgins points toward **messy text** as a way to differentiate fake images from real photos. For example, the police wear badges, hats, and other documents that appear to have lettering, at first glance, in the fake images of officers arresting Trump. Upon closer inspection, the words are nonsensical.

An additional way you can sometimes tell an image is generated by AI is by noticing **over-the-top facial expressions**. “I've also noticed that if you ask for expressions, Midjourney tends to render them in an exaggerated way, with skin creases from things like smiling being very pronounced,” Higgins said. The pained expression on Melania Trump’s face looks more like a re-creation of Edvard Munch’s _The Scream_ or a still from some unreleased A24 horror movie than a snapshot from a human photographer.

Keep in mind that world leaders, celebrities, social media influencers, and anyone with large quantities of photos circulating online may appear more convincing in deepfaked photos than AI-generated images of people with less of a visible internet presence. “It's clear that the more famous a person is, the more images the AI has had to learn from,” Higgins said. “So very **famous people are rendered extremely well**, while less famous people are usually a bit wonky.” For more peace of mind about the algorithm’s ability to re-create your face, it might be worth thinking twice before posting a photo dump of selfies after a fun night out with friends. (Though it’s likely that the AI generators have already scraped your image data from the web.)

In the lead-up to the next US presidential election, what is Twitter’s policy about AI-generated images? The social media platform’s current policy reads, in part, “You may not share synthetic, manipulated, or out-of-context media that may deceive or confuse people and lead to harm (‘misleading media’).” Twitter carves out multiple exceptions for memes, commentary, and posts not created with the intention to mislead viewers. 

Just a few years ago, it was almost unfathomable that the average person would soon be able to fabricate photorealistic deepfakes of world leaders at home. As AI images become harder to differentiate from the real deal, social media platforms may need to reevaluate their approach to synthetic content and attempt to find ways of guiding users through the complex and often unsettling world of generative AI.

How You Can Tell the AI Images of Trump’s Arrest Are Deepfakes

Amid ongoing protests, the Iranian regime has lost control of its image, pushing it to employ increasingly drastic tactics where everyone loses.

In the early hours of January 5, a popular anonymous Iranian dissident account called Jupiter announced on Twitter that his friends had killed Abolqasem Salavati, a maligned magistrate nicknamed the “Judge of Death.” The tweet went viral, and thousands of jubilant people poured into the account’s Twitter Space to thank them for assassinating the man responsible for sentencing hundreds of political prisoners to die.

Soon, however, a few attendees voiced doubts over the veracity of the claim. They were cursed at and kicked out of the room, as the host insisted, “Tonight is about celebration!” while repeatedly encouraging viewers to make the Space go viral. The next day, activists on the ground and Iranian media confirmed that Salavati was, in fact, alive. Several experts suspect Jupiter to have been an Islamic Republic of Iran cyber operation aimed at distracting people, while the Iranian government executed two protesters the same night as the Twitter Space.

Within its borders, the Iranian regime controls its population through one of the world’s toughest internet filtering systems, physical crackdowns, and mass arrests carried out with impunity. However, the IRI is vulnerable beyond its physical and virtual borders, as the regime struggles to contain the discourse and silence dissidents. To combat opposition narratives in the West and among VPN-armed domestic activists online, the IRI cyber army deploys multifaceted, devious, and sometimes clumsy tactics. With the ongoing political unrest in Iran, old cyber tactics have been ramped up, and new tricks that aim to distract, discredit, distort, and sow distrust have come to the fore as the regime finds itself in a critical moment.

Desperate Times, Desperate Measures

Among the tactics used by the IRI’s cyber agents—known colloquially as Cyberi—is old-school hacking. The Iran-linked hacker group Charming Kitten gained notoriety in 2020 for its spear-phishing attempts on journalists, scholars, and policy experts in the West. The group was recognized by its signature strategy of pretending to be reporters or researchers and feigning interest in their targets’ work as a pretext for setting up interview requests embedded with a spear-phishing link. Recent reports from the UK government’s National Cyber Security Center and security firm Mandiant found that such spear-phishing activities cyber groups TA453 and APT42, which are affiliated with the Iranian Revolutionary Guard Corps, have been increasingly prevalent. Last month, the popular anti-regime account RKOT claimed to have received an interview request geolocated to an IRGC department in Shiraz from an individual purporting to be a journalist from _The New York Times_. 

According to Amin Sabeti, founder of CERTFA, a cybersecurity collective specializing in uncovering state-backed Iranian cyber activities, these operations have shifted their methods over the past few months, since most targets of interest are aware of the threat and have learned to protect themselves from spear-phishing. Instead, Sabeti says, they now use a “domino effect” strategy by taking aim at low-profile targets, whose credentials they harvest in order to build trust and gain access to higher-profile targets in their network. Early this month, for example, the Iranian Canadian human rights activist Nazanin Afshin Jam said that she received a spear-phishing link from a trusted colleague who had been hacked.

“Right now, they go after everyone who they are interested in, in terms of this revolution, especially people who are working in nonprofits,” Sabeti says. 

Notably, some of these state actors establish credibility and trust over time by masking themselves as anti-regime voices and ardent supporters of the protest movement, or by building relationships with targets. One account by the name of Sara Shokouhi was created in October 2022 and claimed to be a Middle East scholar. The account spent months boosting opposition voices and writing heartfelt tributes to protesters before finally being outed by Iran experts as a state-sponsored phishing operation.

The ongoing protest movement in Iran has also given rise to more intense disinformation campaigns on social media. It is difficult to attribute the activities of anonymous accounts to the Iranian regime with certainty, since many regular Iranians are anonymous for security reasons. Occasionally, however, sloppiness—failing to delete old tweets or accidentally posting pro-regime messages on opposition sock puppet accounts—have revealed their likely affiliation with IRI intelligence.

The fast-paced, chaotic environment during protests within Iran has been ripe for disinformation and information pollution, making it too overwhelming to verify every claim even for researchers, says Simin Kargar, a nonresident fellow at the Atlantic Council’s Digital Forensic Research Lab. 

According to Kargar, the prospects of IRI disinformation operations shifting the narrative in the regime’s favor are slim. However, its cyber activity has had the effect of sowing doubt, where no one is sure what is true and who is trustworthy.

“Iranian information operations haven’t been successful in terms of the region and the type of attention they tend to draw,” she says. “But if their sole accomplishment in this situation is to make everyone doubt whatever is said, even by credible people, that's a big accomplishment for them. It's about creating a climate of fear and intimidation more than making people believe them. Because at this point of 44 years of the Islamic Republic, no one believes what they say.”

No One to Trust

Although widespread vigilance against IRI state actors has made the public less susceptible to propaganda tactics, it has simultaneously created an environment of distrust, where anybody is potentially a regime goon.

A recent study by Hossein Kermani, a political communications researcher at the University of Vienna, outlines the various tactics deployed by the Iranian cyber army that muddy the waters: “Downgrading discussions to the level of the government, justifying the state’s policies, cheering up other users, portraying that everything is normal, redirecting debates, spreading fake news, trending misleading hashtags, and mocking dissidents and activists.”

Some of these strategies were used to accuse the two journalists who covered the death of Mahsa Amini of being Mossad agents, portraying the prominent Iran-based activist Sepideh Qolian as “mentally ill and hysterical,” and pretending to be activists calling for violent uprisings in order to justify violent crackdowns. Pro-regime accounts also mimicked and hijacked anti-regime hashtags, which were subsequently flooded with pro-regime misinformation. And IRI cyber forces boosted the “Do execute” hashtag in response to activists trending “Do not execute” against the string of death penalty verdicts against protesters.

Beyond causing confusion, discrediting and undermining opposition has been an essential component of Iranian cyber activity. This has partially been pursued by hacking opposition figures directly but also through sock puppet accounts, which pit one faction of the opposition against another.

Kargar, of the Atlantic Council, believes that the Iranian cyber response to the recent anti-regime movement signals a smarter and more prudent approach. She describes how regime-affiliated cyber groups hack as much as possible and hold onto their material, sometimes for years, only to release it when it can have maximum effect. These efforts are part of a wider effort to create the impression that nobody is trustworthy and nobody is credible, she says. 

In late 2022, for instance, actress and activist Nazanin Boniadi began publicly collaborating with the son of the former shah, Reza Pahlavi, another popular opposition figure. Amid their attempts to present a unified front against the regime, the IRGC-affiliated hacker group Adl-e Ali sought to sow division by leaking old emails of Boniadi criticizing Pahlavi’s base of staunch monarchist supporters. With Pahlavi seeing a surge of popularity and credibility in the eyes of Western media in recent months, the hacker group has attempted to embarrass and discredit him by leaking old private photos and videos of Pahlavi snoring in his sleep, lying on the beach, and attending parties.

“If you can't win the hearts and minds, you might as well try to make everyone lose hearts and minds in one another. If you can’t win—make everyone else lose. That’s basically how they have been operating,” Kargar says.

While the regime might have lost the battle for the narrative, it has still had some successes, such as the “Judge of Death” distraction. Sabeti, the cybersecurity expert, believes that the case was an attempt by IRI cyber forces to test the waters toward future activities.

“I think it was to maybe the test the waters, to see how they can manage to change the narrative for the next \[execution\],” Sabeti says. “Because everyone knows it’s not the end of the story.”

The Scorched-Earth Tactics of Iran’s Cyber Army

Open source intelligence researchers are verifying and debunking opaque claims about who ruptured the gas pipelines in the Baltic Sea.

It’s been six months since the Nord Stream gas pipelines were ruptured by a series of explosions, leaking tons of methane into the environment and igniting an international whodunit. Russia, the United States, the United Kingdom, and an unnamed pro-Ukrainian group have all been accused of planting explosives on the Baltic Sea pipelines in recent months. But half a year since the sabotage took place, the mystery remains unsolved.

Digital sleuths are stepping in to help provide clarity around bombshell claims about who was behind the attacks. Open source intelligence (OSINT) researchers are using public sources of data in their efforts to verify or debunk the snippets of information published about the Nord Stream explosions. They’re providing a glimpse of clarity to an incident that’s shrouded by secrecy and international politics.

Since early February, multiple media reports have claimed to provide new information about who could have attacked the Nord Stream 1 and 2 pipelines on September 26. However, the reports have largely been based on anonymous sources, including unnamed intelligence officials and leaks from government investigations into the attacks.

First, American investigative journalist Seymour Hersh published claims that the US was behind attacks in a post on Substack. This was followed by reports in _The New York Times_ and German publication _Die Zeit_ claiming a pro-Ukrainian group was responsible. (European leaders have previously speculated Russia could be behind the attacks, and Russia has blamed the United Kingdom.) No country has claimed responsibility for the blasts so far, and official investigations are ongoing.

Each of the recent reports has provided little hard evidence to show what may actually have happened, while helping to fuel speculation. Jacob Kaarsbo, a senior analyst at Think Tank Europa, who previously worked in Danish intelligence for 15 years, says the claims have been “remarkable” but also “speculative” in nature. “In my mind, they don’t really alter the picture,” Kaarsbo says, adding the attacks look highly complex and would likely be “very hard to pull off without it being a state actor or at least with state sponsorship.”

In the absence of official information, OSINT researchers have been trying to plug the gaps by examining the claims of the new reports with public data. OSINT analysis is a powerful way to determine how an event may have unfolded. For instance, flight- and ship-tracking data can reveal movements around the world, satellite images show Earth in near real-time, while small clues in the backgrounds of photos and videos can reveal where they were taken. The techniques have uncovered Russian assassins, spotted North Korea evading international trading sanctions, identified potential war criminals, and documented pollution.

For the Nord Stream blasts, there was little OSINT available. Researchers identified “dark ships” in the area. But underwater, there are obviously limited data sources that can be tapped into—cameras and sensors don’t monitor every inch of the pipelines. “OSINT probably won’t break this case open, but it can be used to verify or strengthen other hypotheses,” says Oliver Alexander, an analyst who focuses on OSINT and has been closely looking at the Nord Stream blasts. “I do think that it’s more of a verification tool.”

Alexander and others have been examining the claims made so far. _The New York Times_ and _Die Zeit_ both published stories on March 7 claiming a Ukrainian group was behind the sabotage. (Ukraine has denied any involvement.) _Die Zeit_ published more details, claiming German investigators searched a yacht rented from a company based in Poland, knew where the yacht sailed from, and that six people were involved in the operation, including two divers. All of them used forged passports, the publication reported.

The details were enough for OSINT researchers to start tracking down which yacht could have been used. Alexander, as well as contributors to the open-source investigative outlet Bellingcat, started following the breadcrumbs, narrowing down potential vessels. A follow-up report soon named the boat under suspicion as the _Andromeda_, a 15-meter-long yacht. Webcam footage from the harbor where it is believed the _Andromeda_ was docked shows the movement of a boat around the time reported by the publications. (The _Andromeda_ is reportedly too small to be required to use ship-tracking systems.) Years-old videos and photos of the boat have surfaced. The sleuthing adds public details to the reports.

Similarly, OSINT has been used to debunk Hersh’s story claiming the United States was behind the explosions. (Hersh has defended his article, while US officials have said it was false.) Alexander has used, among other things, ship-tracking data to show Norwegian ships were “accounted for” and not in a “position to have placed the explosives on the Nord Stream pipeline, as claimed by Hersh.” Another detailed article from Norwegian journalists has similarly poured cold water on Hersh’s claims, partly using satellite data.

The sabotage was always likely to be controversial and surrounded by rumors: Russia’s full-scale invasion of Ukraine in February 2022 has heated global tensions and put pressure on diplomats around the world. There has been a whirlwind of disinformation around the blasts, further muddying the waters. Mary Blankenship, a disinformation researcher at the University of Nevada, Las Vegas, who has analyzed online conversations around the war, says the “high uncertainty and high stakes” of the incident help to fuel the spread of disinformation. 

“This is an issue that exploits existing worries, tensions, and grievances within European audiences,” Blankenship says. Initially, the earliest disinformation on Twitter about the explosions came from conspiracy theorists, Blankenship says, who shared a pre-war statement from US president Joe Biden, where he said there would be an “end” to Nord Stream 2 if Russia invaded Ukraine. Since then, Russia and China have taken to sharing unproven theories about the sabotage, the researcher says.

“Disinformation actors, but also official representatives of the \[Russian\] regime, stepped up their efforts on every news story that was published on this—however contradictory about the origins of the blast—be it a blog post by Seymour Hersh or a _New York Times_ article,” says Peter Stano, an EU spokesperson, adding most disinformation narratives have circled around the idea that “the US is to blame.” The EU’s disinformation monitoring project, EUvsDisinfo, has flagged more than 150 pieces of disinformation linked to the Nord Stream explosions, including those building on Hersh’s story. “EUvsDisinfo experts also found that Moscow considers the recent materials in German-language media a hoax,” Stano says.

While OSINT is helping to provide bits of extra detail on the claims about the Nord Stream attacks, it is likely that reports debunking dubious claims reach fewer people than disinformation or claims that are hard to verify. “It does not nearly get the same level of engagement,” Blankenship says. “You can have a book’s worth of evidence for it, and they would still find a way to discount it.”

And while OSINT research can answer some questions, it has its limits and can also raise new ones. Kaarsbo, the former Danish intelligence official, and other experts have pointed out that the _Andromeda_ is a relatively small yacht, and it may have been unable to carry the amount of explosives needed to blow the pipelines. “The _Andromeda_ is quite likely a piece of the puzzle, but I don’t think it’s a bigger piece of the puzzle that everyone makes it out to be,” Alexander says. “I think there are a lot of the big pieces missing.” Detailed sonar imagery of the damaged pipes would help people to understand what happened underwater, Alexander adds.

Ultimately, there is still very little hard public evidence—either from governments or publicly available online—about who may have been behind the attacks. Behind closed doors, intelligence agencies likely have more data and theories on the potential culprits. However, investigators in Sweden and Denmark refused to comment on their progress, while Germany’s Office of the Federal Prosecutor confirmed it had searched a yacht and is continuing to examine for explosives. German officials have also said there could be a chance of a “false flag” operation to smear Ukraine. And when the countries complete their investigations, there’s no guarantee they will publish their findings or evidence to back them up. The mystery continues.

Online Sleuths Untangle the Mystery of the Nord Stream Sabotage

In the spring of 2022, I was sitting in my college apartment studying for an exam when I received a call from an unfamiliar number. Not thinking anything of it, I answered and was stunned to meet a Secret Service agent asking about an unsavory tweet I’d posted about former president George W. Bush four months earlier. 

“When making that tweet,” asked the federal agent on the line, “were you talking about George Bush Sr. or George Bush Jr.?”

My eyes darted between the Detroit Field Office’s list of contacts on its website and my friend in my room, afraid that I’d be indicted on a federal crime at 20 years old. 

“George Bush Jr.,” I responded. “Cause he’s still alive.”

It was unbelievable to me that a federal agent saw my old drunken tweet and considered it important enough to be investigated, much less to find my contact information and call me to confirm whether or not I was a threat. 

Back then, I had an unhealthy relationship with Twitter. I’d hoped to grow an audience on the social media site so I could sell my Substack like my favorite internet micro-celebrities. But drunk one night, after arguing with my roommates about 9/11 and the unjust war in Iraq, I tweeted that George Bush should be dead, and I went to bed. It wasn’t uncommon for me to throw out inflammatory remarks. My roommates, usually more cautious and forward-thinking than I was, advised me to delete it. Ignoring them, I kept it up for reasons like ego and fallacious integrity. Four months later it came back to bite me. 

While my college classmates and I were worried about the federal government interfering in the lives of everyday citizens, it’s not the only area of surveillance I should have been concerned about. Internet service providers and platforms like Twitter and Facebook all regularly moderate their service in ways that can either thrust users into the eyes of law enforcement or keep them safe from surveillance. That’s a distinction that’s often left up to those in power to make. Whether it’s a stupid tweet or a legitimate complaint depends heavily on who’s in charge of making that call.

“Governments in Iran and China are centralized and control service providers, or have very strict rules on who is operating them and how,” says University of Michigan computer science professor Roya Ensafi, founder of Censored Planet. “In a lot of other countries, though, service providers are commercial entities like Comcast and Verizon, so the government has to rule through policy to figure out how to implement censorship. Although it's different, the government always has a good idea of what the ISPs are doing,” she elaborates. 

The US government isn’t usually inclined to release data on its own surveillance activities, but the American Civil Liberties Union, along with other similar organizations, have a mountain of data about the often racist and invasive activities of American intelligence agencies. Plus, social media companies have a long history of cooperating with intelligence agencies in gathering information on their users.

Unfortunately, my thought process wasn’t that complex when I suddenly had to talk to a federal agent on my phone about what I’d posted to Twitter.

“Can I take a second just to verify that you are, in fact, calling me?” I stammered out, recalling that I had a right to verify the agent’s identity–or perhaps call a lawyer before responding with anything that may be incriminating. An investigation by the Secret Service goes through the federal judicial system, after all. I hoped I didn’t need to pay for a fancy-pants federal defense attorney.

“Sure, but if you don’t call me back,  we would have to show up to your address in Ann Arbor,” he replied. 

I called the Chicago Field Office, as the Detroit Field Office was closed that day. “Hi, I’d like to request some information,” I said to the man on the phone. 

“May I ask you why?” he asked. 

What was I supposed to say to this guy? This wasn’t a FOIA request. I swallowed the lump in my throat and nervously capitulated. “I’m currently being investigated, and I wanted to verify that this agent works at the Detroit Field Office from this number before I give any information.”

The investigator checked. This agent did indeed work for the Secret Service. I called him back and was met with more dejected quasi-threats. He listed my father’s name and occupation, my (deceased) mother’s name and occupation, and my sister’s age. He dropped the first four numbers of my social security number before I told him I understood he was legit. As the debacle continued,  I realized I’d accrued the equivalent of a seditious parking ticket.

“Alright, I’ve got no more questions for you. If you pull anything like that again, though, we will not hesitate to show up armed at your door. Can I call a friend to corroborate the information you’ve given me?” the agent asked. I obliged. I thought to myself that it was probably better not to let this thing escalate.

Returning from my exam later that day, I finally told my roommates what had transpired. _They_ were surprised that all of my posturing and bloviating about the “Feds” actually came to bite me. _I_ was embarrassed that I actually ended up in this situation. 

When I told my father what happened, he was hysterical.“Is this going to cost you a job?” he finally asked. It was a good question. I wasn’t sure of the answer, and even though I hoped the whole thing was over, I had no way to know if I were on some kind of watch list going forward. 

So was there any real way to monitor my digital footprint so I wouldn’t be targeted, or to keep myself safe in the future so this wouldn’t happen again?  When I asked Ensafi, she brought up the General Data Protection Regulation in the EU, and California’s Consumer Privacy Act. However, both laws aim to make individuals aware of what commercial entities can and can’t do with your data, not what they can and can’t hand over to law enforcement or government bodies.

“I don’t know whether the day-to-day lives of Americans are affected by surveillance, but I can assure you that one thing we found in our VPN study was that vast numbers of users in the United States using VPNs think that they’re protecting their privacy and security from service providers,” Ensafi says. The presence of internet influencers advertising VPN software has long made me wary of how effective they actually were. Ensafi agrees. 

“Years ago my students and I decided to look into the ecosystem through systematic investigation on how weak implementations are, how weak VPN services are, if they’re leaking DNS data or implementing a kill switch properly or not, as well as understanding users’ perspective better as to why they use VPN services. Do they know what a VPN actually provides? Where do they find VPNs from? They think VPNs are a tool to save the day, but that isn’t always the case.”

I know for a fact that a VPN probably wouldn’t have helped in my case. I have identifiable information publicly available, and a link to some other stuff in my Twitter profile and bio. But Twitter does hand over user information—usually at the behest of a subpoena, but other times whenever it chooses to. Take for example, the case of @PRGuy17. Twitter was ordered to hand over the user’s personal information by a court in Australia during a defamation case. That’s not even considering any actual data-sharing agreements the platform—or other platforms—may have for their own purposes, and who knows what the third parties do with your information. 

VPNs are helpful, but they aren’t especially useful if you find yourself in my situation. One easy solution, of course, is to simply be careful what you say publicly, regardless of whether you’re identifiable or not. Another simple internet hygiene tip I recommend is to avoid suspicious users. I’m not joking. The FBI spends millions of dollars on user surveillance of social media. If it seems like a user is trying to coerce information out of you, especially that of the illicit kind, don’t comply. Don’t click suspicious links, either. These are viruses most of the time, but it’s not just scammers and con artists that set up fake websites to “honeypot” users and grab their IP addresses and other personal information. I don’t expect any of you to be criminals, but you can’t be too careful. If you absolutely must, use secure and encrypted messaging clients like Signal.

I still post opinionated takes on social media, and I try to use sarcasm and satire to comment on government surveillance and conspiracy theories. But I stopped joking about the demise of presidents. Do I know exactly how to avoid this in the future, or how to put a stop to it entirely? Not entirely. It’s hard to offer tips when your words are stuck between private companies and the global surveillance complex. I think I did the right thing by cooperating and trying to minimize the potential fallout from a drunken tweet. But what if the agent—or anyone who potentially reported my tweet—had more dirt on me, or had some kind of personal or political vendetta? 

What I can say for sure is that it’s always good to be careful. I know now to watch what I say and only say things I truly mean. So, above all else, exercise caution. And remember that when you speak on the internet, you never know who’s listening.

I Got Investigated by the Secret Service. Here's How to Not Be Me

Plus: A SpaceX supplier ransom, critical vulnerabilities in dozens of Android phones, and more.

What’s more controversial than a popular surveillance camera maker that has an uncomfortably cozy relationship with American police? When ransomware hackers claim to have breached that company—Amazon-owned camera maker Ring—stolen its data, and Ring responds by denying the breach.

But we’ll get to that.

Five years ago, police in the Netherlands caught members of Russia’s GRU military intelligence red-handed as they tried to hack the Organization for the Prohibition of Chemical Weapons in The Hague. The team had parked a rental car outside the organization’s building and hid a Wi-Fi snooping antenna in its trunk. Within the GRU group was Evgenii Serebriakov, who was caught with further Wi-Fi hacking tools in his backpack.

Since then, surprisingly, Serebriakov has only risen in status. This week, Western intelligence sources told WIRED that Serebriakov is now the new leader of one of the world’s most aggressive hacking units. Serebriakov took over Sandworm, which is responsible for some of the worst cyberattacks in history, in the spring of 2022. His elevation to the senior role, experts say, shows how small the pool of skilled nation-state hackers is likely to be and demonstrates Serebriakov’s value to Russia.

Nowhere on the internet is free from threats—and that includes LinkedIn. This week we looked at how spies, scammers, and hackers from Iran, North Korea, Russia, and China are using the professional network to scout and approach intelligence targets. In addition, LinkedIn is plagued with thousands of suspicious accounts; it removed hundreds from WIRED’s profile when we reported them.

The Western clampdown on TikTok is continuing—this week the UK joined the US, Belgium, Canada, and the European Union in banning the social media app from being used on government devices. But in the US, Senator Mark Warner is trying to pass legislation, in the guise of the bipartisan Restrict Act, that will allow officials to ban apps and services from six “hostile” nations: China, Russia, North Korea, Iran, Cuba, and Venezuela. We sat down with Warner and asked about the plans.

A WIRED analysis of “cybercrime” cases across the US shows how vague and wide-ranging the term can be. Without a clear and universal definition of cybercrime, human rights and civil liberties issues may expand globally. Speaking of criminals, scammers are getting better at using voice deepfakes to con people. And ransomware gangs are sinking to a new deplorable low. As more and more companies and organizations refuse to pay ransoms, criminal gangs are increasingly using extortion as leverage: they are now releasing photos stolen from cancer patients and sensitive student records. 

But wait, there's more. Each week, we round up the security news we didn’t cover in-depth ourselves. Click the headlines to read the full stories, and stay safe out there.

ALPHV, a prolific group of hackers who extort companies with ransomware and leak their stolen data, said earlier this week that it had breached security camera maker Ring and threatened to dump the company’s data online if it doesn’t pay. “There’s always an option to let us leak your data …” the hackers wrote in a message to Ring on their leak site. Ring has so far responded with a denial, telling Vice’s Motherboard, “We currently have no indications of a ransomware event,” but it says it’s aware of a third-party vendor that has experienced one. That vendor, Ring says, doesn’t have access to any customer records. 

Meanwhile, ALPHV, which has previously used its BlackCat ransomware to target companies like Bandai Namco, Swissport, and hospital firm Lehigh Valley Health Network, stands by its claim to have breached Ring itself, not a third-party vendor. A member of the malware research group VX-Underground shared with WIRED screenshots of a conversation with an ALPHV representative who says that it’s still in “negotiations” with Ring.

Amid the ongoing ransomware epidemic, it’s no surprise that Ring isn’t alone in facing extortion problems. So too is Maximum Industries, a supplier of rocket parts for Elon Musk’s SpaceX. The hackers, a well-known ransomware gang known as LockBit, taunted Musk on their website, threatening to sell the stolen information to the highest bidder if Maximum doesn’t pay by their March 20 deadline. “I would say we were lucky if Space-X contractors were more talkative. But I think this material will find its buyer as soon as possible,” the hackers wrote. “Elon Musk we will help you sell your drawings to other manufacturers.”

Google’s Project Zero, its security research team devoted to finding unknown vulnerabilities in widely used tech products, warned Thursday that it had discovered severe hackable flaws in Samsung chips used in dozens of Android devices. In total, the researchers found 18 distinct vulnerabilities in Samsung’s Exynos modems for smartphones, but they say that four of them are particularly critical and would allow a hacker to “remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim’s phone number.” Project Zero only rarely publishes information on unpatched vulnerabilities. But it says that it gave Samsung 90 days to fix the flaws, and it hasn’t yet. A bit of public shaming, perhaps, might spur Samsung to move faster to protect Google’s users from an insidious form of attack.

Since 2017, the cryptocurrency “mixer” service ChipMixer quietly grew into a powerhouse of cryptocurrency money laundering, taking in users’ coins, mixing them with others and then sending them back to obscure the money’s trail across blockchains. In the process, the Department of Justice says it laundered $3 billion worth of criminal funds, including ransomware payments, North Korean hackers’ stolen loot, and even profits from the sale of child sexual exploitation materials. Now, in a bust carried out by multiple European law enforcement agencies and coordinated by Europol as well as the FBI and DHS, ChipMixer has been taken offline and its infrastructure seized. The site’s alleged creator, 49-year-old Vietnamese national Minh Quốc Nguyễn, remains out of reach: He’s been charged with money laundering only in absentia. 

But the most intriguing result of the case may have more to do with the meltdown of the now notorious cryptocurrency exchange FTX: A portion of FTX’s funds that were stolen in the midst of its bankruptcy proceedings in November were funneled into ChipMixer. Seizing the servers of that mixing service may well foil the FTX thieves’ attempt to evade tracing and help solve one of the central mysteries of that high-profile heist.

Only in the cryptocurrency world, where thefts of more than half a billion dollars now occur multiple times a year, does the stealing of $200 million merit the lowest spot on a news roundup. Early this week, the distributed trading protocol Euler Finance lost nearly $200 million in cryptocurrency to hackers who found a vulnerability in its code. At first, Euler, the company behind that protocol, offered to let the hackers keep $20 million if they returned the rest of the funds. But after that offer was ignored—in fact, the hackers have sent the funds to the Tornado Cash mixing service in the hopes of covering their tracks—the firm has announced a $1 million bounty on the hackers’ heads.

Security News This Week: Ring Is in a Standoff With Hackers

WIRED spoke with the coauthor of the Restrict Act, a bipartisan bill to crack down on tech from six “hostile” countries.

In the future, it might be a new mobile game or an algorithm helping students study at home. It could be the latest graphics card or exercise bike, or an app that pairs families with puppies. With fewer and fewer aspects of life going untouched by technology, it could be practically anything. Right now, it's TikTok, with its billions of users worldwide. 

US Senator Mark Warner (D-Virginia) wants the United States armed with the ability to take swift action against technology companies suspected of cavorting with foreign governments and spies, to effectively vanish their products from shelves and app stores when the threat they pose gets too big to ignore. His new bill, the Restrict Act, would give that responsibility to the US commerce secretary, charging their office with reviewing and, under certain conditions, banning technologies flagged by US intelligence as a credible threat to US national security. Though the technology's owners and manufacturers would have every right to dispute any outcome in court if the Restrict Act becomes law, it is nevertheless an enormous authority to bestow—one with boundless implications for America's competitors overseas. 

The thought that such decisions could be wildly unpopular at home or elicit misgivings from global allies has not escaped Warner. Without sufficient transparency around the process, the government's moves could result in chaos. Warner says the intelligence community should be held to account for the decisions it influences, providing not only to Americans but also the world the information it needs to understand how and why this new power is being used. He knows it may not always be at liberty to do so.

TikTok's ties to China have more or less spooked authorities in several countries, with numerous officials in the US alone claiming to have spoken directly with whistleblowers who offered tales about abuses of personal data. Today, the United Kingdom joined several other nations, including the US, in banning the app across all government devices. 

The British, like their American, Belgian, and Canadian counterparts, are fearful that the app may offer Beijing's intelligence agencies the ability to track key officials' movements and intercept the sensitive information they keep. Other countries already have laws to accomplish what Warner is seeking to do. In 2020, for instance, India's ministry of electronics banned TikTok entirely, citing authority intended to safeguard the “safety and sovereignty of Indian cyberspace.” 

The Restrict Act's future is unknown, but it's gathered considerable bipartisan support in Congress, and there are very few reasons for America's tech giants to get in the way. To understand more about Warner's position on security, invasive tech, and privacy concerns that hit closer to home, WIRED spoke with the Virginia Democrat this week. Our conversation has been edited for length and clarity.

**WIRED: Tell us about the Restrict Act and its purpose.**

Mark Warner: Over the past few years, we've seen challenges coming from foreign-based technology. Originally it was Kaspersky, a Russian software company, then it was Huawei, a Chinese telecom provider, and more recently, the discussion has been about this Chinese-owned social media app, TikTok. We seem to have a whack-a-mole approach to foreign-based technology, and I think instead we need a comprehensive rules-based approach that recognizes national security is no longer simply tanks and guns, but is really a question about technology and technology competition. In the case of Kaspersky, it was software that kept getting updated from Moscow, and with Huawei, it was a way for the Communist Party in China to listen in. In the case of TikTok, it's the enormous amounts of data being collected that potentially could end up in China or, given the fact that a hundred million Americans a day are using it an average 90 minutes a day, it could be an enormous propaganda tool. Let me be clear: Because China changed its law in 2016 to make sure that, at the end of the day, every company's ultimate master is the Communist Party of China. It's not the shareholders, it's not the employees, it's sure not the customers. And this is a national security risk.

Source

Wired