This is the web version of this week’s edition of The Wiretap newsletter, which every Tuesday brings exclusives and other news about surveillance, privacy and cybercrime, straight to your inbox. Click here to get on the newsletter list!
In 2020, Claire Woodall-Vogg, executive director of the Milwaukee Election Commission, had just finalized the results of the presidential election in her city. Over email she joked with an election consultant about finishing the job in the middle of the night.
“Damn, Claire, you have a flair for drama, delivering just the margin needed at 3:00 a.m.,” wrote Ryan Chew of the Elections Group. “I bet you had those votes counted at midnight, and just wanted to keep the world waiting!”
Woodall-Vogg responded, “Lol. I just wanted to say I had been awake for a full 24 hours!”
The exchange appeared innocuous, but when published by the Gateway Pundit and Wisconsin Spotlight in mid-2021, some readers saw it as a sign of interference, trying to swing the vote for President Biden in a crucial Wisconsin battleground. It led to a slew of abusive, threatening emails and calls to Woodall-Vogg, with as many as 150 messages sent over just three days indicating she had been involved in fraudulent activity. Some appeared to threaten physical harm.
According to a previously unreported search warrant, the FBI began investigating the harassment, paying attention to one email sent to Woodall-Vogg’s personal address from an anonymous user of encrypted email service ProtonMail, which carried the subject line, “Hello Marxist Bitch.” “Thankfully the The Gateway Pundit brought your betrayal of Wisconsin and America to my attention, Fox News and Breitbart don’t do shit these days,” the ProtonMail user wrote. “I hope you know there are consequences for your actions. I know a lot of information about you. I will have to think about what comes next.”
The warrant revealed that the FBI managed to acquire data from Proton Technologies, the owner of Proton Mail, to kick off the hunt for the anonymous emailer. It’s a rare example of a U.S. data request on Proton and shows how small pieces of metadata from encrypted software can prove hugely useful for cops trying to unmask users who expect strong privacy protections from such apps.
Based in Switzerland, Proton has made a name for itself as a privacy-first email provider that isn’t beholden to the same kind of legal demands as the likes of giants like Google or Microsoft. The warrant didn’t detail what specific legal process the FBI used to get the information and Proton declined to comment on specific cases. Proton did say, however, that by Swiss law, for U.S. agencies to get information on Proton accounts, they have to go through Swiss authorities.
The FBI didn’t get much back from Proton, but it did receive the recovery and associated email addresses linked to the ProtonMail user. They proved crucial, enabling the FBI to find more information about the person online and conduct a sweep across the suspect’s internet accounts, including on Amazon, Apple, Coinbase, Google, PayPal and Spotify. The FBI didn’t make clear in the warrant why it needed to get account activity across the various platforms, though it was likely to gather further evidence.
The suspect has not been charged and Forbes is not naming him as a result. The Department of Justice declined to comment on the status of the investigation. “The long-standing policy of the Department of Justice prohibits employees from confirming, denying or answering any questions regarding the possible existence of investigations,” said Ken Gales, spokesperson for the United States Attorney’s Office Eastern District of Wisconsin.
Woodall-Vogg told Forbes that the case did not end up with any “breakthrough.” She was told that the suspect was “deemed not to have the means or intent to actually carry out any violent acts against me.” She is unaware of anyone being arrested or charged as a result of the threats made against her.
“Luckily, harassment of me and my staff has not continued recently,” she added.
Proton spokesperson Betsy Jones said, “illegal activity has no place on Proton’s platforms as is clearly stated in our terms and conditions. We employ several well-staffed teams that handle instances of abuse of our terms and conditions and swiftly and proactively disable accounts that are found to be in breach.
“Any information received would be limited to metadata, since email contents, attachments, files, calendar entries, etc. are all end-to-end encrypted and no-one, not even Proton, can access them.”
She added that because Proton doesn’t answer directly to foreign law enforcement agencies, it does not track the number of requests it receives from them. It does, however, have a transparency report, which revealed it had received 6,995 orders for data in 2022, of which it contested 1,038. The number of orders has risen every year since Proton started keeping records in 2017. Back then, it only received 26 orders for the whole year.
The Big Story
Exclusive: DHS Used Clearview AI Facial Recognition In Thousands Of Child Exploitation Cold Cases
The DHS HSI agency is using facial recognition and AI to try to solve thousands of cold child exploitation cases by identifying victims and their abusers.
Stories You Have To Read Today
While DHS is hoping facial recognition will save children from abuse, critics continue to note its use in apprehending innocent people. The New York Times reported this weekend that a pregnant woman was wrongly arrested after her face was falsely matched with a suspect in a carjacking.
A group of North Korean hackers secretly breached computer networks at Russian missile developer NPO Mashinostroyeniya. Reported in Reuters, it shows how North Korea will happily hack even friendly nations in support of its foundering missile projects.
Back in 2020, the National Security Agency discovered China had breached Japan’s defense networks. Japan has since improved its security, but American officials remain concerned about gaps that could be exploited by Chinese hackers, the Washington Post reports.
Winner of the Week
TechCrunch has a fascinating profile of Window Snyder, detailing her 25-year career in cybersecurity, during which she led teams at Apple and Microsoft. Snyder “basically revolutionized security for the entire internet” while at Microsoft, according to one of her contemporaries, and was one of the driving forces behind Apple’s move to encrypt much of its users’ data.
Loser of the Week
Ilya “Dutch” Lichtenstein, the husband of the now-infamous Crypto Couple that laundered $3.6 billion in cryptocurrency from the 2016 Bitfinex hack, admitted that he was in fact behind the breach. He also pleaded guilty to laundering some of the funds. Meanwhile, his wife Heather Morgan, who had a side hustle as a rapper, also pleaded guilty to money laundering.
Read the full article here
