More stories

  • in

    Revelations of Israeli spyware abuse raise fears over possible use by Trump

    Even as WhatsApp celebrated a major legal victory in December against NSO Group, the Israeli maker of one of the world’s most powerful cyberweapons, a new threat was detected, this time involving another Israel-based company that has previously agreed contracts with democratic governments around the world – including the US.Late in January, WhatsApp claimed that 90 of its users, including some journalists and members of civil society, were targeted last year by spyware made by a company called Paragon Solutions. The allegation is raising urgent questions about how Paragon’s government clients are using the powerful hacking tool.Three people – an Italian journalist named Francesco Cancellato; the high-profile Italian founder of an NGO that aids immigrants named Luca Casarini; and a Libyan activist based in Sweden named Husam El Gomati – announced they were among the 90 people whose mobile phones had probably been compromised last year.More is likely to be known soon, when researchers at the Citizen Lab at the University of Toronto, which investigates digital threats against civil society and has worked closely with WhatsApp, is expected to release a new technical report on the breach.Like NSO Group, Paragon licenses its spyware, which is called Graphite, to government agencies. If it is deployed successfully, it can hack any phone without a mobile phone user’s knowledge, giving the operator of the spyware the ability to intercept phone calls, access photographs, and read encrypted messages. Its purpose, Paragon said, was in line with US policy, which calls for such spyware to only be used to assist governments in “national security missions, including counterterrorism, counter-narcotics, and counter-intelligence”.In a statement to the Guardian, a Paragon representative said the company had “a zero-tolerance policy for violations of our terms of service”. “We require all users of our technology to adhere to terms and conditions that preclude the illicit targeting of journalists and other civil society leaders,” the representative said.The company does appear to have acted swiftly in response to the cases that have emerged so far. The Guardian reported last week that Paragon had terminated its contract with Italy for violating the terms of its contract with the group. Italy had – hours before the Guardian’s story broke – denied any knowledge of or involvement in the targeting of the journalist and activists, and said it would investigate the matter.David Kaye, who previously served from 2014 to 2020 as a special rapporteur on freedom of expression and opinion said the marketing of military-grade surveillance products, such as the kind made by Paragon, comes with “extraordinary risks of abuse”.“Like the NSO Group’s Pegasus spyware, it is easy for governments easily to avoid basic principles of rule of law. Though not all the details are known, we are seeing the likelihood of scandalous abuse in the case of Italy, just as we have seen that in other contexts across Europe, Mexico and elsewhere,” Kaye said.The issue seems particularly relevant in the US. In 2019, during the first Donald Trump administration, the FBI acquired a limited license to test NSO Group’s Pegasus. The FBI said the spyware was never used in a domestic investigation and there is no evidence that either the Trump or Joe Biden administrations used spyware domestically.In the face of increasing reports of abuse, including use of NSO’s spyware against American diplomats abroad, the Biden administration put NSO on a blacklist in 2021, saying the company’s tools had enabled foreign governments to conduct transnational repression and represented a threat to national security.Biden also signed an executive order in 2023 that discouraged the use of spyware by the federal government and allowed it to be used in limited circumstances.It was therefore a surprise when it was reported by Wired last year that the US Immigration and Customs Enforcement (Ice) agency had – under the Biden administration – signed a $2m one-year contract with Paragon. The contract was reportedly paused after the news became public and its current status is unclear. Ice did not respond to a request for comment.A Paragon representative said the company was “deeply committed to following all US laws and regulations” and that it was fully compliant with the 2023 executive order signed by Biden. The person also pointed out that Paragon was now a US-owned company, following its takeover by AE Industrial Partners. It also has a US subsidiary based in Virginia, which is headed by John Fleming, a longtime veteran of the CIA who serves as executive chair.Unlike its predecessor, however, the new US administration has publicly stated that it will seek to use the levers of government against Trump’s perceived political enemies. Trump has repeatedly said he would try to use the military to take on “the enemy from within”. He has also singled out career prosecutors who have investigated him, members of the military, members of Congress, intelligence agents and former officials who have been critical of him, for potential prosecution. He has never explicitly stated that he would use spyware against these perceived rivals.Researchers like those at Citizen Lab and Amnesty Tech are considered the leading experts in detecting illegitimate surveillance against members of civil society, which have occurred in a number of democracies, including India, Mexico and Hungary. More

  • in

    Chinese hackers collected audio from a Trump campaign adviser’s calls – report

    Chinese state-affiliated hackers intercepted audio from the phone calls of US political figures, including an unnamed campaign adviser of Donald Trump, the Washington Post reported Sunday.Various media outlets reported on Friday that the Trump campaign was made aware last week that the Republican presidential candidate and his running mate JD Vance were among a number of people inside and outside of government whose phone numbers were targeted through the infiltration of Verizon phone systems.The FBI and the US cybersecurity and infrastructure security agency confirmed they were investigating unauthorized access to commercial telecommunications infrastructure by people associated with China, though they did not not name the Trump campaign in the statement.Reuters later reported that Chinese hackers also targeted phones used by people affiliated with the campaign of Kamala Harris.The Post now reports that the hackers were able to access audio from a phone call from a Trump campaign adviser, as well as unencrypted communications such as text messages of the individual.Trump’s campaign and the FBI did not immediately respond to a request for comment.The Trump campaign was hacked earlier this year. The US justice department charged three members of Iran’s Revolutionary Guard Corps with the hack, accusing them of trying to disrupt the 5 November election.Verizon said on Friday it was aware of a sophisticated attempt to target US telecoms and gather intelligence and is working with law enforcement.Congress is also investigating and earlier this month US lawmakers asked AT&T, Verizon and Lumen Technologies to answer questions about reports Chinese hackers accessed the networks of US broadband providers.The Chinese embassy in Washington DC said last week it was unaware of the specific situation but said China opposes and combats cyberattacks and cyber thefts in all forms. More

  • in

    Chinese believed to have targeted Trump’s and Vance’s phones in US telecommunications breach

    Chinese government-linked hackers are believed to have targeted phones used by Donald Trump and his running mate, JD Vance, as part of a larger breach of US telecommunications networks, according to a New York Times report.The Trump campaign was informed this week that the phone numbers of the Republican presidential and vice-presidential nominee were among those targeted during a breach of the Verizon network, the paper said, citing sources.Investigators are working to determine what data, if any, was accessed by the “sophisticated” hack, the sources said. Other current and former government officials were also targeted, according to the report.The FBI and the Cybersecurity and Infrastructure Security Agency confirmed an investigation was under way into the “unauthorized access to commercial telecommunications infrastructure by actors affiliated with the People’s Republic of China”. It did not name the Trump campaign in the statement.“After the FBI identified specific malicious activity targeting the sector, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) immediately notified affected companies, rendered technical assistance, and rapidly shared information to assist other potential victims,” the agency said.The Trump campaign did not directly address whether the phones used by Trump and Vance had been targeted.In a statement, a Trump campaign spokesperson, Steven Cheung, criticized the White House and Trump’s opponent, Kamala Harris, and sought to blame them for allowing a foreign adversary to target the campaign, the Times reported.A Wall Street Journal report last month said a cyber-attack linked to the Chinese government had infiltrated multiple US telecommunications firms and may have gained access to systems used by the federal government in court-approved wiretapping efforts.The hackers accessed at least three telecommunication companies – AT&T, Verizon and Lumen Technologies – in what may have been an attempt to find sensitive information related to national security, according to the report.The Trump campaign earlier this year revealed it had been hacked and said Iranian actors had stolen and distributed sensitive internal documents.skip past newsletter promotionafter newsletter promotionThe US justice department unsealed criminal charges in September against three members of Iran’s Revolutionary Guards Corps suspected of hacking the Trump campaign.Justice department officials said hackers were trying to undermine Trump’s campaign and intended to sow discord, exploit divisions within American society and potentially influence the outcome of the 5 November election.With the election under two weeks away, Trump and Kamala Harris are locked in a tight race. In both national head-to-head polls and surveys in the crucial swing states where the election will be decided, the pair seem almost deadlocked. More

  • in

    The leaked dossier on JD Vance is revealing in all the things it doesn’t say | Moira Donegan

    The public got a peek into the inner workings of the Trump campaign last week, when the independent journalist Ken Klippenstein did what major news outlets refused to: he published the opposition research dossier on JD Vance’s electoral vulnerabilities that was written by the Trump campaign in the lead-up to the VP announcement.The dossier, which was obtained in a hack thought to have been perpetrated by Iranian state interests, would have been compiled by Donald Trump’s camp as part of a routine vetting process as the Republican campaign surveilled possible VP picks and assessed their strengths and weaknesses. It is thorough: at 271 pages, it contains a robust and factual accounting of the vice-presidential candidate’s public statements and associations going back years. As such, it offers a unique perspective into how the Trump campaign views the race – and how they understand the controversial man who is now in their No 2 spot.But the document, a litany of everything the Trump camp thinks is wrong with Vance, is maybe most revealing for what it omits: there is almost nothing about his comments on women, and nothing at all about his extensive, repeated and impassioned hatred for childless women, including the “cat ladies” comment that has been Vance’s stickiest scandal and perhaps his greatest contribution to the campaign thus far. The comments that provoked the ire of thousands of women – including no less influential a figure than Taylor Swift – and turned the race partly into a referendum on the purpose and value of women’s lives were nowhere to be found in the document.Instead, the dossier was largely focused on comments by Vance that make him vulnerable with an audience of one: that is, his past negative statements about Trump.The mainstream news organizations that declined to publish this hacked document justified this decision by saying that much of the information was not newsworthy. If this is their standard, it seems to be a new one: in 2016, when Russian-backed hackers obtained emails from the Hillary Clinton campaign, one of the disclosures included risotto cooking tips from campaign chair John Podesta. (He says that adding the liquid slowly helps the rice become creamier, in case you’re interested.) But the Vance dossier is newsworthy, though not because of what it reveals about Vance. What the document says about Vance himself is largely a matter of public record. What is newsworthy, instead, is what the document exposes about the Trump campaign’s priorities.The dossier concerns many worries that Vance is not conservative enough. It also seems preoccupied with how the Ohio senator has wounded Trump’s ego. The absence of Vance’s extreme gender views from the document suggests that the Trump campaign did not understand his comments on women to even be controversial: they don’t seem to have thought that it would come up.Maybe the Trump campaign is staffed with people, including the apparatchiks who do its vetting, who have so little exposure to feminism (or, perhaps, to women more broadly) that it simply did not occur to them that anyone would find Vance’s ravings about women offensive. Maybe the Trump camp made the calculation – one certainly not exclusive to the political right – that women’s investment in their own rights is partial and unserious, and that they would not be moved by gendered insults to their dignity in anything like meaningful numbers. Maybe they assumed that gender politics is now a man’s game, and that appeals to masculine woundedness and grievance now carry much more sway than appeals to women’s rights do. If this is what they think – that misogyny can be an asset for them but never a liability – it would certainly explain some of their actions.But the salience of the comments also signals something else that has changed this election: Trump no longer solely sets the terms of the conversation. Trump’s ability to command attention and to dictate the news cycle has noticeably waned this term – think, for instance, of how quickly and decisively each of his not one but two assassination attempts disappeared from the front pages, and how little an impact they seem to have ultimately had on his support. Trump has been unable to get a nickname to stick to Kamala; he has been unsuccessful in his efforts to generate vulgar distractions about her sexual history or the authenticity of her racial identity.So far, all he has managed to do is spread lurid and racist lies that have made life hell for the residents of Springfield, Ohio. Trump’s vulgarity, his hysterics, his domineering indifference to the truth – all these used to fascinate voters, or at least the national media. But Trump has lost his juice.Which brings us to the other reason why the dossier may not have contained many of Vance’s most potent vulnerabilities: perhaps Trump’s staff overlooked them because they assumed that they would be able to generate the narrative on their own, assuming that it was they, and they alone, who would dictate what the media covered and what the public cared about. Those days are over. Just ask your local cat lady.

    Moira Donegan is a Guardian US columnist More

  • in

    Trump campaign’s suspected Iranian hack may still be happening

    A suspected Iranian hack of Donald Trump’s presidential campaign has continued within the last 10 days and may still be happening, according to a journalist who received illegally obtained documents from the Republican nominee’s election effort.Judd Legum, the publisher of the progressive newsletter Popular Information, revealed that he was sent a letter that Trump’s lawyer had written to the New York Times on 15 September from a source called “Robert”, as well as dossiers on three potential running mates, including JD Vance, the current GOP vice-presidential nominee.The letter was verified to be authentic. “Robert” appeared to be the same source who had leaked other Trump materials to Politico, the New York Times and the Washington Post in August. The FBI has said it is investigating that leak as a suspected Iranian hack. The source known as “Robert” has been linked by a Microsoft threat analysis to a group within the theocratic regime’s Islamic Revolutionary Guard Corps (IRGC), which sent out phishing emails to presidential campaigns.US intelligence agencies revealed last week that Iranian hackers passed sensitive information stolen from Trump’s campaign to Joe Biden’s now-defunct presidential campaign in June and July. Legum’s disclosure suggests that the breach may have been more extensive than previously known and could still be under way despite the efforts of US security agencies.Legum said that he received a message from “Robert” on 18 September containing the cover page of a dossier on Vance. “Robert refused to identify himself,” Legum wrote, except to suggest it was the same “Robert” from the previous leaks.Legum – whose own communications were made public after the 2016 Russian hack of Hillary Clinton’s then campaign chair John Podesta – described then receiving a 271-page file on Vance, along with thick dossiers on Doug Burgum, the South Dakota governor, and Marco Rubio, the Florida senator, both of whom were considered by Trump as possible running mates. All documents were marked “Privileged & Confidential”.He said he was also sent a dozen emails purporting to be from senior Trump advisers Susie Wiles and Dan Scavino and pollster John McLaughlin, dated from October 2023 until last August.Legum said he also received a four-page letter sent by a Trump lawyer to three individuals at the New York Times just nine days ago, further evidence that the breach had not been plugged.“The letter has not been made public by either the Trump campaign or the paper,” Legum wrote.Legum then provided a copy of the letter to Ben Smith, the editor-in-chief of Semafor, who confirmed it as genuine after checking with a source at the New York Times who had already seen it. The letter complained about a Times article that questioned Trump’s validity as a successful businessman, Smith wrote in a separate piece.“The legitimacy of the letter proves that the person or people representing themselves as Robert has stolen electronic communications from people associated with the Trump campaign within the last 10 days,” Legum concluded.During a rally in New York last Wednesday, Trump referred to the disclosure of the breach from US intelligence agencies, saying: “Iran hacked into my campaign. I don’t know what the hell they found, I’d like to find out. Couldn’t have been too exciting.”skip past newsletter promotionafter newsletter promotionThe campaigns of Biden and Kamala Harris, as well as the media outlets that have received stolen Trump materials, have all declined to make them public – a stark contrast to the 2016 hack of Clinton, the results of which were published in multiple outlets, while Trump vocally encouraged Russia to continue hacking.Legum said he would stick to the current policy of non-publication.“It was tempting to use this opportunity to turn the tables on the Trump campaign and publish the stolen campaign materials provided to me by Robert,” he wrote. “But I believe that is the wrong approach.”A Trump campaign spokesman, Steven Cheung, said the hack showed that Iran is “terrified of the strength and resolve of Donald J Trump”.Suspected Iranian-backed plots to kill Trump – who has already survived two assassination attempts during the campaign – prompted the Secret Service in July to step up additional security at his rallies. The following month, a Pakistani national with suspected links to Iran was arrested on suspicion of plotting political assassinations on US soil, including against Trump. More

  • in

    Google says Iranian group tried to hack Trump and Harris campaigns

    Google said on Wednesday that an Iranian group linked to the country’s Revolutionary Guard has tried to infiltrate the personal email accounts of roughly a dozen people linked to Joe Biden, Donald Trump and Kamala Harris since May.The tech company’s threat intelligence arm said the group was still actively targeting people associated with Biden, Trump and Harris, who replaced the US president as the Democratic candidate last month when he dropped out. It said those targeted included current and former government officials, as well as presidential campaign affiliates.The new report from Google’s Threat Analysis Group affirms and expands on a Microsoft report released on Friday that revealed a suspected Iranian cyber intrusion in this year’s US presidential election. It sheds light on how foreign adversaries are ramping up their efforts to disrupt the election, which is less than three months away.Google’s report said its threat researchers detected and disrupted a “small but steady cadence” of the Iranian attackers using email credential phishing, a type of cyberattack in which the attacker poses as a trusted sender to try to get an email recipient to share their login details. John Hultquist, chief analyst for the company’s threat intelligence arm, said the company sends suspected targets of these attacks a Gmail popup that warns them that a government-backed attacker might be trying to steal their password.The report said Google observed the group gaining access to one high-profile political consultant’s personal Gmail account. Google reported the incident to the FBI in July. Microsoft’s Friday report shared similar information, noting that the email account of a former senior adviser to a presidential campaign had been compromised and weaponized to send a phishing email to a high-ranking campaign official.The group is familiar to Google’s threat intelligence arm and other researchers, and this is not the first time it has tried to interfere in US elections, Hultquist said. The report noted that the same Iranian group targeted both the Biden and Trump campaigns with phishing attacks during the 2020 cycle, as early as June of that year.The group also has been prolific in other cyber espionage activity, particularly in the Middle East, the report said. In recent months, as the Israel-Hamas war has aggravated tensions in the region, that activity has included email phishing campaigns targeted at Israeli diplomats, academics, non-governmental organizations and military affiliates.Trump’s campaign said on Saturday that it had been hacked and that sensitive internal documents had been stolen and distributed. It declared that Iranian actors were to blame.The same day, Politico revealed it had received leaked internal Trump campaign documents by email, though it was not clear whether the leaked documents were related to the suspected Iranian cyber activity. The Washington Post and the New York Times also received the documents.While the Trump campaign has not provided specific evidence linking Iran to the hack, both Trump and his longtime friend and former adviser Roger Stone have said they were contacted by Microsoft related to suspected cyber intrusions. Stone’s email was compromised by hackers targeting Trump’s campaign, a person familiar with the matter said.Google and Microsoft would not identify the people targeted in the Iranian intrusion attempts or confirm that Stone was among them. Google did confirm that the Iranian group in its report, which it calls APT42, was the same as the one in Microsoft’s research. Microsoft refers to the group as Mint Sandstorm.Harris’s campaign has declined to say whether it has identified any state-based intrusion attempts, but has said it vigilantly monitors cyber threats and is not aware of any security breaches of its systems.The FBI on Monday confirmed that it was investigating the intrusion into the Trump campaign. Two people familiar with the matter said the FBI was also investigating attempts to gain access to the Biden-Harris campaign.The reports of Iranian hacking come as US intelligence officials have warned of persistent and mounting efforts from both Russia and Iran to influence the US election through online activity. Beyond these hacking incidents, groups linked to the countries have used fake news websites and social media accounts to churn out content that appears intended to sway voters’ opinions.While neither Microsoft nor Google specified Iran’s intentions in the US presidential race, officials have previously hinted that Iran particularly opposes Trump. They have also expressed alarm about Tehran’s efforts to seek retaliation for a 2020 strike on an Iranian general that was ordered by Trump.Iran’s mission to the United Nations, when asked about the claim of the Trump campaign, denied being involved.“We do not accord any credence to such reports,” the mission told the Associated Press. “The Iranian government neither possesses nor harbors any intent or motive to interfere in the United States presidential election.”The mission did not immediately respond to a request for comment on Wednesday about Google’s report. More

  • in

    FBI told Harris campaign it was target of ‘foreign actor influence operation’ – report

    Kamala Harris’s presidential campaign said it was notified by the FBI last month that it was “targeted by a foreign actor influence operation”, a NBC News reporter said on Tuesday.“We have robust cybersecurity measures in place, and are not aware of any security breaches of our systems resulting from those efforts,” the campaign said, according to the reporter.The FBI said on Monday that it was investigating after Harris’s Republican rival Donald Trump’s presidential campaign said it was hacked.More details soon … More

  • in

    New York Times says it received hacked Trump campaign documents

    The New York Times has confirmed it received the same or similar trove of Donald Trump presidential campaign documents as other media outlets did, after Microsoft confirmed that a “high-ranking official” at a presidential campaign was a hacking target.For the third US election in a row, hacked campaign information by a foreign power is now likely to feature as potential disruption. The Trump campaign has said its email systems were breached by hackers working for Iran.Politico reported getting emails from someone who identified themselves only as “Robert” and sent internal campaign communications and a 271-page-long research dossier on Trump’s running mate, the Ohio senator JD Vance, that was part of his vetting process. The news organisation said the Vance profile was “based on publicly available information”.On Monday, two Democratic lawmakers with experience on intelligence and security committees called for information about the latest breach to be released publicly.The California Democratic congressman Eric Swalwell posted on social media that he was seeking a briefing on the breach, and that while he considered Trump “the most despicable person ever to seek office” – someone who had also called for hacking in the past – “that doesn’t mean America ever tolerates foreign interference.”Adam Schiff, the Democrat of California, urged Department of Homeland Security officials to declassify information on the foreign nature of the hack.Schiff said the US intelligence community “moved much too slow to properly identity the hacking and dumping scheme carried out by Russia” in 2016 and “should act quickly here”.He also said that in that year: “The Trump campaign welcomed Russian interference, took advantage of it and then sought to deny it, much to the detriment of the country.”The Trump campaign’s announcement that its systems had been breached came after news organizations asked questions about Vance when he was a candidate for vice-president that appeared to come from internal vetting documents.The Washington Post said it had received a 271-page document marked “privileged & confidential” from an anonymous AOL customer known as Robert. Politico later said it had been receiving documents from someone who called themselves Robert since 22 July.Trump has said that only publicly available information was taken from its systems. “They were only able to get publicly available information but, nevertheless, they shouldn’t be doing anything of this nature,” he posted on Saturday evening. “Iran and others will stop at nothing.”A Trump campaign spokesman, Steven Cheung, said: “Any media or news outlet reprinting documents or internal communications are doing the bidding of America’s enemies and doing exactly what they want.”While Microsoft has not confirmed that the Trump campaign was the target, it has said that an Iranian group run by the Iranian Revolutionary Guards was behind a June attack on a presidential campaign.But the hack of the Trump campaign will serve as a warning that the last three months of the 2024 election could be as bumpy as the previous two elections. In 2016 the Hillary Clinton campaign was hacked, allegedly by Russian agents, and hundreds of emails were published by WikiLeaks. Twelve Russian military intelligence officers were later indicted for their alleged roles in interfering in the US election.In 2020, the contents of a laptop later confirmed as belonging to Hunter Biden were released and became subject of a controversy, not only for its salacious leaked content but for a letter signed by former intelligence officials claiming that the leak had all the hallmarks of a Russian disinformation campaign.On Saturday, a spokesman for the national security council said Joe Biden’s administration “strongly condemns any foreign government or entity who attempts to interfere in our electoral process or seeks to undermine confidence in our democratic institutions”. The FBI has yet to comment. More