A young man sits in a car, pointing a cellphone camera out of the window, seemingly trying to remain undetected. As he breathes heavily in anticipation, he peers at a T-Mobile store across the road from where he is parked.
Suddenly, there is some commotion inside. An accomplice grabs something off a table where a T-Mobile employee is sitting. The accomplice, dressed in a mask and black baseball cap, then bursts out of the store and clumsily sprints towards the car.
The man in the vehicle starts laughing, then giggling uncontrollably like a child. The pair got what they came for: a T-Mobile employee’s tablet, the sort workers use everyday when dealing with customer support issues or setting up a new phone.
This is a demonstration of Fusus, an AI-powered system that is rapidly springing up across small town America and major cities alike. Fusus’ product not only funnels live feeds from usually siloed cameras into one central location, but also adds the ability to scan for people wearing certain clothes, carrying a particular bag, or look for a certain vehicle.
404 Media has obtained a cache of internal emails, presentations, memos, photos, and more which provide insight into how Fusus teams up with police departments to sell its surveillance technology. All around the country, city councils are debating whether they want to have a system that qualitatively changes what surveillance cameras mean for a town’s residents and public agencies. While many have adopted Fusus, others have pushed back, and refused to have the hardware and software installed in their neighborhoods.
"Google has its hands on quite literally every aspect of this entire saga as a vertically integrated adtech giant. Most adblockers are browser extensions that are most widely used on Chrome, which is a Google product and the most popular browser in the world. They are being used to block ads sold by Google, the largest ad company in the world. And they are specifically being used to block ads on YouTube, a Google-owned website that is also one of the largest websites on Earth."
Immigration and Customs Enforcement (ICE) has used a system called Giant Oak Search Technology (GOST) to help the agency scrutinize social media posts, determine if they are “derogatory” to the U.S., and then use that information as part of immigration enforcement, according to a new cache of documents reviewed by 404 Media.
The documents peel back the curtain on a powerful system, both in a technological and a policy sense—how information is processed and used to decide who is allowed to remain in the country and who is not.
“The government should not be using algorithms to scrutinize our social media posts and decide which of us is ‘risky.’ And agencies certainly shouldn't be buying this kind of black box technology in secret without any accountability. DHS needs to explain to the public how its systems determine whether someone is a ‘risk’ or not, and what happens to the people whose online posts are flagged by its algorithms,” Patrick Toomey, Deputy Director of the ACLU's National Security Project, told 404 Media in an email. The documents come from a Freedom of Information Act (FOIA) lawsuit brought by both the ACLU and the ACLU of Northern California. Toomey from the ACLU then shared the documents with 404 Media.
For years, a gang operating in New York allegedly offered a cash-for-Bitcoin service that generated at least $30 million, with men standing on street corners with plastic shopping bags full of money, drive-by pickups, and hundreds of thousands of dollars laid out on tables, according to court records.
The records provide rare insight into an often unseen part of the criminal underworld: how hackers and drug traffickers convert their Bitcoin into cash outside of the online Bitcoin exchanges that ordinary people use. Rather than turning to sites like Coinbase, which often collaborate with and provide records to law enforcement if required, some criminals use underground, IRL Bitcoin exchanges like this gang which are allegedly criminal entities in their own right.
Hackers are targeting accounts on Kodex, a platform that connects law enforcement agencies and tech companies and which is designed to verify emergency requests for customer data, according to multiple online conversations between hackers viewed by 404 Media.
Screenshots from one of the compromised accounts shows a panel where a law enforcement officer, or a hacker, can potentially “create a new request.” The screenshots show a wide range of companies such as tech giants Meta and Microsoft’s LinkedIn; cryptocurrency exchanges Binance and Coinbase; social media platforms Pinterest, Discord, and Snapchat; financial service Fidelity, and gaming platform Roblox. The compromised account appears to belong to a national police force, but the screenshots do not include the agency’s full name.
Williams’ crimes are not isolated to one young hacker who had more money than he knew what to do with. Nor is his story only about the rise of one group like ACG, which continues to strike fear into the broader community it is a splinter of, known as the “Comm.” Williams is part of a rapid and massive convergence between two traditionally separate sectors of crime. People like Willams have combined the frictionless, sophisticated world of cybercrime with the blunt brutality of physical violence, sprouting an entirely new area of the underground where essentially anything is possible. Hackers are no longer just people behind a keyboard. They have guns now, and innocent people are getting hurt.
DreamGF, a service that allows users to generate AI girlfriends that chat with them and send them AI generated nudes, is randomly making some girlfriends look like Jennifer Lopez and other celebrities without their consent. DreamGF users are also complaining that their AI girlfriends will abruptly demand they climax and will sometimes send them nudes of deformed bodies.
The news is yet another example of an AI tool that’s behaving in a way developers are unable to control, despite it violating their own policies, customers’ desires, and in some instances, the law. It also proves a nightmare scenario previously only imagined by AI researchers, where an AI image generator will spit out non-consensual pornography of real people even if it’s not asked to, just because their images were included in the datasets the AI was trained on. This is something that can happen to anyone whose image is online
In a bombshell report, an oversight body for the Department of Homeland Security (DHS) found that Immigration and Customs Enforcement (ICE), Customs and Border Enforcement (CBP), and the Secret Service all broke the law while using location data harvested from ordinary apps installed on smartphones. In one instance, a CBP official also inappropriately used the technology to track the location of coworkers with no investigative purpose.
For years U.S. government agencies have been buying access to location data through commercial vendors, a practice which critics say skirts the Fourth Amendment requirement of a warrant. During that time, the agencies have typically refused to publicly explain the legal basis on which they based their purchase and use of the data. Now, the report shows that three of the main customers of commercial location data broke the law while doing so, and didn’t have any supervisory review to ensure proper use of the technology. The report also recommends that ICE stop all use of such data until it obtains the necessary approvals, a request that ICE has refused.
4chan users are coordinating a posting campaign where they use Bing’s AI text-to-image generator to create racist images that they can then post across the internet. The news shows how users are able to manipulate free to access, easy to use AI tools to quickly flood the internet with racist garbage, even when those tools are allegedly strictly moderated.
“We’re making propaganda for fun. Join us, it’s comfy,” the 4chan thread instructs. “MAKE, EDIT, SHARE.”
A visual guide hosted on Imgur that’s linked in that post instructs users to use AI image generators, edit them to add captions that make them seem like political campaigns, and post them to social media sites, specifically Telegram, Twitter, and Instagram. 404 Media has also seen these images shared on a TikTok account that has since been removed.
But that doesn’t mean nudity and sexual content doesn’t exist on YouTube. Last month, I dove into a community of people who scour the platform for videos containing nudity, the more explicit the better. I was surprised to learn just how much of this content exists, and how easy it is to find once you know what to search for. I even managed to join an exclusive Discord channel where people share the rarest, least known explicit YouTube videos, and methods on how to find them, which you can only be admitted to by offering nude videos you’ve discovered on your own.
I recently got my hands on an ordinary-looking iPhone-to-HDMI adapter that mimics Apple’s branding and, when plugged in, runs a program that implores you to “Scan QR code for use.” That QR code takes you to an ad-riddled website that asks you to download an app that asks for your location data, access to your photos and videos, runs a bizarre web browser, installs tracking cookies, takes “sensor data,” and uses that data to target you with ads. The adapter’s app also kindly informed me that it’s sending all of my data to China.
The cord was discovered by friend of 404 Media John Bumstead, an electronics refurbisher and artist who buys devices in bulk from electronics recyclers. Bumstead tweeted about the cord and was kind enough to send me one so I could try it myself. Joseph has written about malicious lightning cables and USB cables made by hackers that can be used for keystroke logging and spying. While those malicious lightning cables are products marketed for spying, the HDMI adapter Bumstead has been found in the wild and is just another crappy knockoff cable sold on Amazon’s increasingly difficult to navigate website. This HDMI adapter is designed to look exactly like Apple’s same adapter. Here they are side-by-side:
I recently got my hands on an ordinary-looking iPhone-to-HDMI adapter that mimics Apple’s branding and, when plugged in, runs a program that implores you to “Scan QR code for use.” That QR code takes you to an ad-riddled website that asks you to download an app that asks for your location data, access to your photos and videos, runs a bizarre web browser, installs tracking cookies, takes “sensor data,” and uses that data to target you with ads. The adapter’s app also kindly informed me that it’s sending all of my data to China.
The cord was discovered by friend of 404 Media John Bumstead, an electronics refurbisher and artist who buys devices in bulk from electronics recyclers. Bumstead tweeted about the cord and was kind enough to send me one so I could try it myself. Joseph has written about malicious lightning cables and USB cables made by hackers that can be used for keystroke logging and spying. While those malicious lightning cables are products marketed for spying, the HDMI adapter Bumstead has been found in the wild and is just another crappy knockoff cable sold on Amazon’s increasingly difficult to navigate website. This HDMI adapter is designed to look exactly like Apple’s same adapter. Here they are side-by-side:
A federal counterintelligence agency tracking hackers has bought data harvested from the backbone of the internet by a private company because it was easier and took less time than getting similar data from the NSA, according to internal U.S. government documents. According to the documents, going through an agency like the NSA could take “days,” whereas a private contractor could provide the same data instantly.
The news is yet another example of a government agency turning to the private sector for novel datasets that the public is likely unaware are being collected and then sold.
A viral TikTok account is doxing ordinary and otherwise anonymous people on the internet using off-the-shelf facial recognition technology, creating content and growing a following by taking advantage of a fundamental new truth: privacy is now essentially dead in public spaces.
The TikTok account, conversations with victims, and TikTok’s own lack of action on the account show that access to facial recognition technology, combined with a cultural belief that anything public is fair game to exploit for clout, now means that all it takes is one random person on the internet to target you and lead a crowd in your direction.
The first thing you’ll see if you search Google for “tank man” right now will not be the iconic picture of the unidentified Chinese man who stood in protest in front of a column of tanks leaving Tiananmen Square, but an entirely fake, AI-generated selfie of that historical event.
While the AI-generated selfie doesn’t appear to be deliberate misinformation, it highlights an inherent problem with the current state of generative AI and the internet: It is exceedingly easy to use AI tools to generated endless images, text, and audio with little more than a click of a button, and as this content floods every online platform, we, and the platforms we use to surface information, still don’t have a good way to identify and differentiate it from human-made content, manually or automatically.