2/ Beyond targeting the national election, specific Senate & House races were also a focus of efforts. As were specific figures like @SenatorBaldwin, who was apparently a perennial target.
3/ @DarrenLinvill is absolutely right here.
This campaign exposed by the @ClemsonHub team still gives off early-day vibes.
It is only going to get more sophisticated from here.
4/ Hundreds of accounts. 130,000 posts since march.
Removed... after an @NBCNews inquiry... with no comment from the company.
Bad look.
This campaign is NOT subtle. And looking at the quality of the output, I'd wager money that from @X's side, it is obvious.
Account registration patterns...IP addresses... user-agent etc.
I interpret the fact that these campaigns exist & thrive for so long as evidence that the company is really not using all available techniques to curb inauthentic bot activity.
5/ Also, big props to the @ClemsonHub team. They keep doing sold work on bot armies on @x
Like this deep dive into AI-driven pro-regime propaganda from #Rwanda in June.
A "PRO-ISRAEL TEAM WE CAN TRUST" designed to look like a #HarrisWalz campaign ad is micro-targeted to areas with a high muslim population around Dearborn, Michigan.
Meanwhile, same Musk-backed PAC has a "WHY PANDER TO PALESTINE?" ad micro-targeted to areas in Pennsylvania.
Manufacturers of networking and phone gear must follow specific standards for 'lawful interception' in different jurisdictions (e.g. CALEA & ETSI's standards)
But as we learn time & time again, the scope of potential access & harm almost never matched by efforts to detect & block malicious use.
There's constant pressure from governments to bake-in systems for access.
Failure to comply with those demands is met with big sanctions. Just look at Durov.
Yet I predict that there will be zero meaningful accountability over this breach.
BREAKING: @Microsoft & @TheJusticeDept take simultaneous action against 🇷🇺Russian FSB-backed hacking group.
#StarBlizzard/ #ColdRiver has been targeting a wide swath of US officials & civil society.
Sweet moment because civil society played a key role in the lawsuit. Thanks to @NonprofitISAC & our partner @accessnow, voices of victims from our collaborative investigation into the spear phishing operation were included. 1/
2/ Back in August we @citizenlab alongside our partners
@accessnow w/@DeptFirst, Arjuna Team & RESIDENT.ngo published a collaborative investigation into Russian gov-backed phishing.👇
3/ Quick review of some ways that the Biden Harris administration has been tackling the problem of mercenary spyware proliferation:
Targeted Actions against bad companies:
Big headache
✅@CommerceGov Entity Listing
(Now US companies can't sell you products)
Migraine
✅ @StateDept Visa Bans
(You aren't coming to the US)
Cluster Headache
✅@USTreasury Dept Sanctions
(Your assets are blocked, good luck banking anywhere)
Executive Actions
✅ The 2023 Executive Order
(The big US market is closed to spyware companies enabling human rights abuse & natsec harms)
Diplomatic Efforts
✅ 2023 Joint State on Commercial Spyware
(Wide set of norms on stopping misuse, consequences for bad companies & transparency + oversight)
✅ Participation in other countries efforts (e.g. UK/FR-led Pall Mall Process)
Investigators will eventually identify any consumer product that persistently records people's activities.
One day, they'll show up, requesting access.
If the data is consistently helpful, they'll stop asking & start demanding.
Once this happens enough the company will probably create a law enforcement portal to simplify access & save customers the trouble...🧵
2/ So many companies build consumer products with inherent pervasive surveillance collection without planning for the inevitable moment when demands begin coming in.
If you collect it, the demands will always come.
When you don't anticipate this moment in how you balance your design decisions, you expose yourself & your consumers to a lot of pressure. And introduce society to new kinds of surveillance.
It's an ethical conundrum in societies with a rule of law and judicial oversight.
And it is entirely more ominous when your product reaches countries that have none of that.
3/ Transparency: reworked the thread since folks flagged that I'm not the only person that likes "if you collect it, they will come" to describe risks from data collection:
Some spots it shows up in, there are surely more I couldn't find with a quick search:
- ISC2 contributor mgorman discussing risks from Google's Sensorvault
-Whitney Merrill(@wbm312) discussing risks from COVID data collection👇
-The Irreal Blog, in an interesting post about search warrants
-Me, quoted in "Cybersecurity and Humanitarian Organizations - On a Collision Course?" (Amaral & Verity, 2018).