ІНСАЙДЕР УКРАЇНА

As new potential threats from Chinese hackers were identified this week, the federal government issued one of its strongest warnings to date about the need for Americans — and in particular government officials and other “highly targeted” individuals — to secure their communications against eavesdropping and interception.

The warning came as news was breaking about a Commerce Department investigation into the possibility that computer network routers manufactured by the Chinese firm TP-Link may pose a threat to the millions of U.S. businesses, households and government agencies that use them.

Also on Wednesday, Congress took long-awaited steps toward funding a program that will purge other Chinese technology from U.S. telecommunications systems. The so-called rip-and-replace program targets gear manufactured by Chinese firms Huawei and ZTE.

Too far behind

While experts said the recent actions are a step in the right direction, they warned that U.S. policymakers have been extremely slow to react to a mountain of evidence that Chinese hackers have long been targeting essential communications and infrastructure systems in the U.S.

The lack of action has persisted despite law enforcement and intelligence agencies repeatedly sounding alarms.

In January, while testifying before the House Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party, FBI Director Christopher Wray said, “There has been far too little public focus on the fact that [People’s Republic of China] hackers are targeting our critical infrastructure — our water treatment plants, our electrical grid, our oil and natural gas pipelines, our transportation systems. And the risk that poses to every American requires our attention now.”

A year previously, Wray had warned lawmakers on the House Appropriations Committee that his investigators were badly outnumbered.

“To give you a sense of what we’re up against, if each one of the FBI’s cyber agents and intel analysts focused exclusively on the China threat, Chinese hackers would still outnumber FBI Cyber personnel by at least 50-to-1,” Wray said.

Decades of complexity

Part of the problem, experts said, is that it is difficult for policymakers to summon the political will to make changes that could be disruptive to the lives and livelihoods of U.S. citizens in the absence of public concern about the problem.

“It still remains very, very difficult to impress upon average, typical everyday citizens the gravity of Chinese espionage, or the extent of it,” said Bill Drexel, a fellow with the Technology and National Security Program at the Center for a New American Security.

He contrasted the relatively muted public response to the recent revelation of a Chinese hacking operation known as Salt Typhoon, which compromised mobile telephone networks throughout the country, with the uproar that accompanied the far less serious appearance of a Chinese spy balloon over the U.S. mainland in 2023.

“That just goes to show this … problem where really grave issues that are intangible — that are just in cyberspace — are really hard to wrap our minds around,” Drexel told VOA.

“For four decades, we intertwined our supply chains very deeply with China, and our digital systems became more and more complex, allowing more and more compounding ways to be hacked, to be compromised,” Drexel said.

“We’ve just started to try to change course on this stuff,” he added. “But there’s so much momentum for so long on these issues, and they continue to compound in complexity, such that it’s just really hard to catch up.”

Warning ‘highly targeted’ Americans

The Cybersecurity and Infrastructure Security Agency (CISA) issued guidance on Wednesday, reporting that it “has identified cyber espionage activity by People’s Republic of China (PRC) government-affiliated threat actors targeting commercial telecommunications infrastructure.”

It continued, “This activity enabled the theft of customer call records and the compromise of private communications for a limited number of highly targeted individuals.”

The warning appeared to be related to the Salt Typhoon hack that, according to government investigators, compromised all the major mobile phone carriers in the U.S., giving the Chinese government extraordinary access to the communications among millions of Americans.

The five-page CISA document outlines steps that the agency advises all Americans, but particularly those most likely to be targeted, to take immediately.

The first is to immediately curtail use of standard mobile communications platforms, such as voice calls and Short Message Service (SMS) texting. Instead, the agency advises Americans to restrict their communications to free messaging platforms that offer end-to-end encryption, such as Signal, which support one-on-one and group chats, as well as voice and video calls. Data sent with end-to-end encryption is extremely difficult to decrypt, even if a malicious actor is able to intercept it during transmission.

Among the other advice CISA offered was to avoid using SMS messages for multifactor authentication by switching to apps that provide authenticator codes or, where possible, adopting hardware-based security keys for highly sensitive accounts. Other recommendations included the use of complex and random passwords stored in password manager software, as well as platform-specific suggestions for iPhone and Android users.

TP-Link concerns

On Wednesday, The Wall Street Journal reported, and other outlets subsequently confirmed, that the Commerce Department, as well as the Justice and Defense departments, are investigating reports that computer routers manufactured by the Shenzhen-based TP-Link are one vector of attack for Chinese hackers.

TP-Link currently dominates the market for computer routers in the U.S., with nearly two-thirds of total market share. In October, a report from Microsoft revealed that one Chinese hacking operation it identified as CovertNetwork-1658 has compromised thousands of TP-Link routers to create a network that is used by “multiple Chinese threat actors” to gain illicit access to computer networks around the world.

The Journal’s reporting also revealed that the Commerce Department is considering a ban on the sale of TP-Link routers in the U.S. next year, an action that could significantly disrupt the U.S. market for networking hardware.

Rip and replace

Congress on Wednesday took long-delayed action to address a different potential threat from China, allocating $3 billion to a program that will remove telecommunications equipment manufactured by Huawei and ZTE from rural telecommunications networks in the U.S.

Funding for the rip-and-replace program arrives years after the U.S. identified the two companies as posing a potential threat.

Beginning in the first Trump administration and continuing during Joe Biden’s time in office, the U.S. pressured allies around the world to block the installation of Huawei and ZTE 5G cellular communications equipment from their networks, in some cases threatening to stop sharing sensitive intelligence with allies that failed to comply. 
…

washington — Experts on cybersecurity and online foreign influence campaigns are urging social media company Bluesky, whose app has exploded in popularity in recent weeks, to step up moderation to counter potential state-sponsored influence efforts.

Over the past month, Bluesky, a microblogging platform with its roots in Twitter, has seen one of its biggest increases in new user registrations since it was publicly released in February. Over 25 million are now on the platform, close to half of whom joined after the 2024 U.S. presidential election.

Rose Wang, Bluesky’s chief operating officer, said in a recent interview that Bluesky does not intend to push any political ideologies.

“We have no political viewpoint that we are trying to promote,” she said in early December.

Exploiting users’ political leanings

Many who joined Bluesky have cited user experience as one of the reasons for migrating from social media platform X. They also have said they joined the platform after Election Day because they are critics of Elon Musk and President-elect Donald Trump. Some commentators in the U.S. have questioned whether Bluesky is risking becoming an echo chamber of the left.

Some experts contend the platform’s liberal-leaning users could be exploited by foreign propagandists. Joe Bodnar, who tracks foreign influence operations for the Institute for Strategic Dialogue, told VOA Mandarin that Russian propaganda often appeals to the anti-establishment left in the U.S. on contentious topics, like Gaza, gun violence and America’s global dominance.

“The Kremlin wants to make those arguments even louder,” Bodnar said. “Sometimes that means they play to the left.”

So far, at least three accounts that belong to RT, a Russia-controlled media outlet, have joined Bluesky. Sputnik Brazil is also actively posting on the platform.

VOA Mandarin found that at least two Chinese accounts that belong to state broadcaster CGTN have joined the platform.

Bluesky does not assign verification labels. One way to authenticate an account is for the person or organization to link it to the domain of its official website.

There are at least four other accounts that claim to be Chinese state media outlets, including China Daily, the Global Times and People’s Daily. None of the three publications replied to VOA’s emails inquiring about these accounts’ authenticity.

Additionally, Beijing has played heavily to the Western left on certain global issues. China has consistently called for a ceasefire in Gaza and blamed the West for supporting Israel.

But those familiar with Chinese and Russian state media say the left-leaning user base on Bluesky actually could give Beijing and Moscow a hard time for pushing their narratives.

“Bluesky isn’t the most hospitable place for Russian narratives,” Bodnar said.

Sean Haines, a British national who used to work for Chinese state media outlets, shared similar opinions in a recent blog post about Bluesky.

“With its predominately Western liberal leaning, the platform also will be an uphill challenge for those looking to push overtly nationalistic viewpoints,” he wrote.

Most of the Chinese and Russian state media accounts have only hundreds of followers, with RT en Espanol at the top, with nearly 7,000.

Could ‘decentralization’ be detrimental?

China and Russia have been finding ways to reach the American public through covert disinformation operations on social media. During this year’s election, disinformation campaigns connected to China and Russia promoted claims that cast doubt on the integrity of the voting process.

Similar tactics could soon be coming to Bluesky.

“I don’t think Bluesky is more vulnerable to influence campaigns than X or other social networks,” Jennifer Victoria Scurrell, a researcher on AI-supported influence operations, told VOA Mandarin. But Scurrell, of ETH Zurich’s Center for Security Studies, said Bluesky’s decentralized moderation approach is flawed.

Jack Dorsey, the founder of Twitter, started Bluesky as an internal project to give users more power over moderation. Bluesky then went independent in 2021.

“Our mission is to develop and drive large-scale technologies of open and decentralized public conversation,” the company says on its website.

To do that, Bluesky “decentralized” its moderation authority, giving users tools to customize their experience on the site.

Bluesky offers a universal basic moderation setting for every user, which labels content such as extremism, misinformation, fake accounts and adult content. Users can choose whether to see the content labeled by Bluesky. Users can report to Bluesky content or accounts they believe have violated Bluesky’s guidelines.

On top of that, users get to create their own moderation settings to label or filter out certain content and accounts. Other users can subscribe to these customized settings, should they choose.

Scurrell, who helps test security weaknesses for OpenAI as a contractor, told VOA Mandarin the decentralized approach to moderation could be a double-edged sword.

“Societal values are diverse, contextual and local, which makes decentralized moderation an appealing concept,” she wrote in her replies to VOA.

She warned that outsourcing content moderation to users, though, “raises serious concerns” because the approach would give bad actors the same amount of power as normal users.

“What happens if an entire node is taken over by malicious actors spreading disinformation or manipulative content,” she wrote, or “if the system gets hijacked by an army of bots?”

VOA Mandarin emailed Bluesky a list of detailed questions about its moderation policy against potential foreign influence attempts but did not receive a response.

Experts have urged Bluesky to implement measures to counter potential foreign influence campaigns.

In a recent blog post, Sarah Cook, an independent China watcher and former China director at Freedom House, urged Bluesky to label state media accounts, a practice exercised by many social media companies, so users know of these accounts’ ties to foreign governments.

Eugenio Benincasa, an expert on Chinese cyber threats at ETH Zurich, asserts that studying how Chinese tech companies help Beijing surveil social media platforms and manipulate online discussions can help Bluesky better prepare.

“It is crucial to thoroughly study the evolving influence tactics enabled by tools like public opinion monitoring systems to identify vulnerabilities that may have been overlooked or are emerging, in order to develop effective safeguards,” Benincasa said.
…

WASHINGTON — The U.S. cybersecurity watchdog CISA is telling senior American government officials and politicians to immediately switch to end-to-end encrypted messaging following intrusions at major American telecoms blamed on Chinese hackers. 

In written guidance released on Wednesday, the Cybersecurity and Infrastructure Security Agency said “individuals who are in senior government or senior political positions” should “immediately review and apply” a series of best practices around the use of mobile devices. 

The first recommendation: “Use only end-to-end encrypted communications.” 

End-to-end encryption — a data protection technique that aims to make data unreadable by anyone except its sender and its recipient — is baked into various chat apps, including Meta Platforms’ WhatsApp, Apple’s iMessage, and the privacy-focused app Signal. Corporate offerings, which allow end-to-end encryption, also include Microsoft’s Teams and Zoom Communications’ meetings. 

CISA’s message is the latest in a series of increasingly stark warnings issued by American officials in the wake of dramatic hacks of U.S. telecom companies by a group dubbed “Salt Typhoon.” 

Last week, Democratic Senator Ben Ray Lujan said, “this attack likely represents the largest telecommunications hack in our nation’s history.” 

U.S. officials have blamed China for the hacking. Beijing routinely denies allegations of cyberespionage. 
…

WASHINGTON — The U.S. Supreme Court decided on Wednesday to hear a bid by TikTok and its China-based parent company, ByteDance, to block a law intended to force the sale of the short-video app by January 19 or face a ban on national security grounds. 

The justices did not immediately act on an emergency request by TikTok and ByteDance, as well as by some of its users who post content on the social media platform, for an injunction to halt the looming ban, opting instead to hear arguments on the matter on January 10.  

The challengers are appealing a lower court’s ruling that upheld the law. TikTok is used by about 170 million Americans. 

Congress passed the measure in April and President Joe Biden, a Democrat, signed it into law. The Justice Department had said that as a Chinese company, TikTok poses “a national-security threat of immense depth and scale” because of its access to vast amounts of data on American users, from locations to private messages, and its ability to secretly manipulate content that Americans view on the app. TikTok has said it poses no imminent threat to U.S. security.  

TikTok and ByteDance asked the Supreme Court on December 16 to pause the law, which they said violates free speech protections under the U.S. Constitution’s First Amendment.  

TikTok on Wednesday said it was pleased the court will take up the issue. “We believe the court will find the TikTok ban unconstitutional so the over 170 million Americans on our platform can continue to exercise their free speech rights,” the company said. 

The companies said that being shuttered for even one month would cause TikTok to lose about a third of its U.S. users and undermine its ability to attract advertisers and recruit content creators and employee talent. 

The U.S. Court of Appeals for the District of Columbia Circuit in Washington on December 6 rejected the First Amendment arguments by the companies.  

In their filing to the Supreme Court, TikTok and ByteDance said that “if Americans, duly informed of the alleged risks of ‘covert’ content manipulation, choose to continue viewing content on TikTok with their eyes wide open, the First Amendment entrusts them with making that choice, free from the government’s censorship.” 

Senate Republican leader Mitch McConnell on Wednesday, in a brief filed with the Supreme Court, urged the court to reject any delay, comparing TikTok to a hardened criminal. 

A U.S. ban on TikTok would make the company far less valuable to ByteDance and its investors, and hurt businesses that depend on TikTok to drive their sales. 

Republican President-elect Donald Trump, who unsuccessfully tried to ban TikTok during his first term in the White House in 2020, has reversed his stance and promised during the presidential race this year that he would try to save TikTok. Trump said on Dec. 16 that he has “a warm spot in my heart for TikTok” and that he would “take a look” at the matter. 

Trump takes office on January 20, the day after the TikTok deadline under the law. 

In its decision, the D.C. Circuit wrote, “The First Amendment exists to protect free speech in the United States. Here the government acted solely to protect that freedom from a foreign adversary nation and to limit that adversary’s ability to gather data on people in the United States.” 

TikTok has denied it has or ever would share U.S. user data, accusing U.S. lawmakers in the lawsuit of advancing speculative concerns. It has characterized the ban as a “radical departure from this country’s tradition of championing an open Internet.”  

The dispute comes at a time of growing trade tensions between the world’s two biggest economies after the Biden administration placed new restrictions on the Chinese chip industry and China responded with a ban on exports of gallium, germanium and antimony, metals which are used in making high-tech microchips, to the United States. 

The U.S. law would bar providing certain services to TikTok and other foreign adversary-controlled apps including offering it through app stores such as Apple and Alphabet’s Google, effectively preventing TikTok’s continued U.S. use unless ByteDance divests TikTok by the deadline. 

An unimpeded ban could open the door to a future crackdown on other foreign-owned apps. In 2020, Trump had also tried to ban WeChat, owned by Chinese company Tencent, but was blocked by the courts.
…

A bipartisan effort to protect children from the harms of social media is running out of time in this session of the U.S. Congress. If passed, the Kids Online Safety Act would institute safeguards for minors’ personal data online. But free speech advocates and some Republicans are concerned the bill could lead to censorship. VOA’s Congressional Correspondent Katherine Gypson has more. Kim Lewis contributed to this story.
…

Paris — The Democratic Republic of Congo has filed criminal complaints against Apple subsidiaries in France and Belgium, accusing the tech firm of using conflict minerals in its supply chain, lawyers for the Congolese government told Reuters. 

Congo is a major source of tin, tantalum and tungsten, so-called 3T minerals used in computers and mobile phones. But some artisanal mines are run by armed groups involved in massacres of civilians, mass rapes, looting and other crimes, according to U.N. experts and human rights groups. 

Apple does not directly source primary minerals and says it audits suppliers, publishes findings and funds bodies that seek to improve mineral traceability. 

Apple last year said it had “no reasonable basis for concluding” its products contain illegally exported minerals from conflict-hit zones. The tech giant has insisted it carefully verifies the origin of materials in its output. 

Its 2023 filing on conflict minerals to the U.S. Securities and Exchange Commission said none of the smelters or refiners of 3T minerals or gold in its supply chain had financed or benefited armed groups in Congo or neighboring countries. 

But international lawyers representing Congo argue that Apple uses minerals pillaged from Congo and laundered through international supply chains, which they say renders the firm complicit in crimes taking place in Congo. 

In parallel complaints filed to the Paris prosecutor’s office and to a Belgian investigating magistrate’s office on Monday, Congo accuses local subsidiaries Apple France, Apple Retail France and Apple Retail Belgium of a range of offenses. 

These include covering up war crimes and the laundering of tainted minerals, handling stolen goods, and carrying out deceptive commercial practices to assure consumers supply chains are clean. 

“It is clear that the Apple group, Apple France and Apple Retail France know very well that their minerals supply chain relies on systemic wrongdoing,” says the French complaint, after citing U.N. and rights reports on conflict in east Congo. 

Belgium had a particular moral duty to act because looting of Congo’s resources began during the 19th-century colonial rule of its King Leopold II, Congo’s Belgian lawyer Christophe Marchand said. 

“It is incumbent on Belgium to help Congo in its effort to use judicial means to end the pillaging,” he said. 

The complaints, prepared by the lawyers on behalf of Congo’s justice minister, make allegations not just against the local subsidiaries but against the Apple group as a whole. 

France and Belgium were chosen because of their perceived strong emphasis on corporate accountability. Judicial authorities in both nations will decide whether to investigate the complaints further and bring criminal charges. 

In an unrelated case in March, a U.S. federal court rejected an attempt by private plaintiffs to hold Apple, Google, Tesla, Dell and Microsoft accountable for what the plaintiffs described as their dependence on child labor in Congolese cobalt mines. 

Minerals fuel violence 

Since the 1990s, Congo’s mining heartlands in the east have been devastated by waves of fighting between armed groups, some backed by neighboring Rwanda, and the Congolese military. 

Millions of civilians have died and been displaced. 

Competition for minerals is one of the main drivers of conflict as armed groups sustain themselves and buy weapons with the proceeds of exports, often smuggled via Rwanda, according to U.N. experts and human rights organizations. 

Rwanda denies benefiting from the trade, dismissing the allegations as unfounded. 

Among the appendices to Congo’s legal complaint in France was a statement issued by the U.S. State Department in July, expressing concerns about the role of the illicit trade in minerals from Congo, including tantalum, in financing conflict. 

The statement was a response to requests from the private sector for the U.S. government to clarify potential risks associated with manufacturing products using minerals extracted, transported or exported from eastern Congo, Rwanda and Uganda. 

Congo’s complaints focus on ITSCI, a metals industry-funded monitoring and certification scheme designed to help companies perform due diligence on suppliers of 3T minerals exported from Congo, Rwanda, Burundi and Uganda. 

Congo’s lawyers argue that ITSCI has been discredited, including by the Responsible Minerals Initiative (RMI) of which Apple is a member, and that Apple nevertheless uses ITSCI as a fig leaf to falsely present its supply chain as clean. 

The RMI, whose members include more than 500 companies, announced in 2022 it was removing ITSCI from its list of approved traceability schemes. 

In July, it said it was prolonging the suspension until at least 2026, saying ITSCI had not provided field observations from high-risk sites or explained how it was responding to an escalation of violence in North Kivu province, which borders Rwanda and is a key 3T mining area. 

ITSCI criticized the RMI’s own processes and defended its work in Congo as reliable. It has also rejected allegations in a 2022 report by campaigning group Global Witness entitled “The ITSCI Laundromat,” cited in Congo’s legal complaint in France, that it was complicit in the false labeling of minerals from conflict zones as coming from mines located in peaceful areas. 

Apple mentioned ITSCI five times in its 2023 filing on conflict minerals. The filing also made multiple mentions of the RMI, in which Apple said it had continued active participation and leadership but did not mention the RMI’s ditching of ITSCI. 

In its July statement, the U.S. State Department said flaws in traceability schemes have not garnered sufficient engagement and attention to lead to changes needed. 

Robert Amsterdam, a U.S.-based lawyer for Congo, said the French and Belgian complaints were the first criminal complaints by the Congolese state against a major tech company, describing them as a “first salvo” only. 

Some information for this report came from Agence France-Presse. 
…

LONDON — European Union regulators said Tuesday they’re investigating whether TikTok breached the bloc’s digital rulebook by failing to deal with risks to Romania’s presidential election, which has been thrown into turmoil over allegations of electoral violations and Russian meddling.

The European Commission is escalating its scrutiny of the popular video-sharing platform after Romania’s top court canceled results of the first round of voting that resulted in an unknown far-right candidate becoming the front-runner.

The court made its unprecedented decision after authorities in the European Union and NATO member country declassified documents alleging Moscow organized a sprawling social media campaign to promote a long-shot candidate, Calin Georgescu.

“Following serious indications that foreign actors interfered in the Romanian presidential elections by using TikTok, we are now thoroughly investigating whether TikTok has violated the Digital Services Act by failing to tackle such risks,” European Commission President Ursula von der Leyen said in a press release. “It should be crystal clear that in the EU, all online platforms, including TikTok, must be held accountable.”

The European Commission is the 27-nation European Union’s executive arm and enforces the bloc’s Digital Services Act, a sweeping set of regulations intended to clean up social media platforms and protect users from risks such as election-related misinformation. It ordered TikTok earlier this month to retain all information related to the election.

In the preliminary round of voting on Nov. 24 Georgescu was an outsider among the 13 candidates but ended up topping the polls. He was due to face a pro-EU reformist rival in a runoff before the court canceled the results.

The declassified files alleged that there was an “aggressive promotion campaign” to boost Georgescu’s popularity, including payments worth a total of $381,000 to TikTok influencers to promote him on the platform.

TikTok said it has “protected the integrity” of its platform over 150 elections around the world and is continuing to address these “industry-wide challenges.”

“TikTok has provided the European Commission with extensive information regarding these efforts, and we have transparently and publicly detailed our robust actions,” it said in a statement.

The commission said its investigation will focus on TikTok’s content recommendation systems, especially on risks related to “coordinated inauthentic manipulation or automated exploitation.” It’s also looking at TikTok’s policies on political advertisements and “paid-for political content.”

TikTok said it doesn’t accept paid political ads and “proactively” removes content for violating policies on misinformation.

The investigation could result in TikTok making changes to fix problems or fines worth up to 6% of the company’s total global revenue.
…