Cyber Week in Review: September 13, 2024

Justice Department indicts two leaders of domestic extremism “Terrorgram” network  

The U.S. Justice Department announced criminal charges against two individuals, who it alleges are leaders of the transnational terrorist group known as the Terrorgram Collective. Dallas Humber and Matthew Allison were charged in a fifteen-count indictment with soliciting hate crimes, soliciting the murder of federal officials, and conspiring to provide material support to terrorists, among other allegations. The Terrorgram Collective is a series of group chats and channels hosted on the messaging app Telegram and centered around the idea of white supremacist accelerationism: a loose ideology built around belief in the superiority of the white race and the necessity of violence and terrorism to bring about a white ethnostate. Terrorgram channel members have shared videos and publications on white supremacism, encouraged attacks against black, immigrant, LGBT, and Jewish people, and maintained a list of prominent targets for assassination, including government officials and business leaders. The Justice Department indictment alleged that Humber and Allison inspired or guided an individual who stabbed five people near a mosque in Turkey, an individual who shot three people outside of an LGBT bar in Slovakia, and an individual who planned attacks on critical infrastructure in New Jersey. Terrorgram has previously been linked to terrorist incidents, including a racially-motivated attack in the German city of Hanau in February 2020 that killed nine people. If convicted of the charges, Humber and Allison face nearly 220 years in prison. 

Predator spyware infrastructure reappears, targeted against organizations and individuals in Africa 

Predator, a spyware system built by Intellexa Consortium, has seen several key pieces of its infrastructure reactivated recently, and is likely being used by customers in the Democratic Republic of The Congo (DRC) and Angola. Intellexa had previously curtailed the use of Predator after several of its employees were sanctioned for their role in the development of Predator and its use against American citizens. Recorded Future, a cybersecurity company based in the United States, found that Predator’s operators have made significant upgrades to Predator’s infrastructure, allowing them to better anonymize customer operations. A 2023 investigation co-led by Amnesty International found that Predator spyware was used to target academics, activists, and journalists across the world; the investigation found that operators targeted several prominent individuals, including U.S. Senator John Hoeven and the German Ambassador to the United States. Predator makes use of so-called zero-click exploits, which allow attackers to remotely execute code on a target system without active interaction from the target, to embed powerful spyware in target systems. The new activity from Predator appears aimed at individuals in Africa, although, given the spyware’s new layer of obfuscation, determining its targets has become more difficult. 

European Commission publishes report on economic competitiveness in the EU 

The European Commission released a report chaired by Mario Draghi, the former president of the European Central Bank, on addressing slowing economic growth in Europe across several different sectors. The report contains more than 150 recommendations oriented around fixing Europe’s productivity gap with the United States and China, and is especially focused on creating a competitive digital economy while pushing Europe toward climate change resilience and mitigation. Draghi argues that Europe must deepen its investment in research and development in emerging technologies, change the way it evaluates mergers of large companies within Europe, and better integrate members of the EU into a whole-of-EU approach to industrial policy. The report also outlines how Europe’s venture capital model has largely failed to catalyze the creation of major digital companies: venture capital funding of early stage companies is nearly 73 percent lower in the EU than in the United States. The EU also lags the United States in measures of research and innovation, and the report says that fragmentation within the EU single market significantly reduces the ability of companies to scale their product or services. Draghi was tasked with writing the report by European Commission President Ursula von der Leyen last year who was reelected as EU president this year, and has argued that innovation and competition are essential to Europe’s success in the long-term. 

Australian politicians criticize Meta’s scraping of user data for AI models 

Meta’s global privacy director Melinda Claybaugh testified during a hearing in the Australian Parliament that the company used all public Facebook posts by Australians going back to 2007 to train some of its AI models. Claybaugh added that accounts of users under age 18 were not included in the scraping regime, and that users in the European Union and United States had also had much of their data scraped. Users in the EU were offered an option to opt out of the program, with Meta citing the EU’s strict data privacy rules as the reason for the opt out option. Australian politicians criticized Meta’s policy, with several saying that they expected the Australian government to “do something” about the scraping. Meta had previously announced the scraping for users in the EU on June 26, but it appears that the company has been scraping user data in the United States before that. Scraping web content has become a common mode of gathering enough data to train AI models, which often demand huge amounts of data before they can become functional. Several organizations have sued AI developers over their use of data for training AI models, including a lawsuit the New York Times filed against OpenAI earlier this year. The Australian government has previously taken action against AI developers, including bringing a lawsuit against Clearview AI in 2021 over its scraping of photos to train facial recognition software, although the suit was later dropped. 

CISA director says agency will step away from communicating with social media companies on content moderation 

Jen Easterly, the director of the U.S. Cybersecurity and Infrastructure Security Agency (CISA), said that the agency will not report false or misleading posts to social media platforms ahead of the 2024 U.S. election. CISA still plans to engage in a variety of other election-protection initiatives in the runup to the November elections, including cyber threat monitoring programs and capacity building initiatives for state and local officials. The change follows years of controversy over whether or how the U.S. government should engage with social media platforms regarding content on their sites; the controversy had prompted agencies, including the FBI, to stop discussing foreign influence campaigns with social media platforms entirely. The U.S. Justice Department’s Office of the Inspector General conducted a review of government agencies’ engagement with social media platforms. The Inspector General’s review found that information-sharing between social media platforms and government agencies did not amount to a violation of the First Amendment right to free speech; nevertheless, the report recommended that agencies establish clearer policies and strategies around engaging with social media platforms to avoid the appearance of impropriety. After the release of the policy, agencies like the FBI began to reengage with social media platforms on disinformation campaigns, although it remains to be seen if the collaboration will be able to effectively combat foreign interference in the 2024 U.S. elections.