FBI Director Kash Patel Abruptly Closes Internal Watchdog Office Overseeing Surveillance Compliance

If there’s one thing the Federal Bureau of Investigation does well, it’s mass surveillance. Several years ago, then attorney general William Barr established an internal office to curb the FBI’s abuse of one controversial surveillance law. But recently, the FBI’s long-time hater (and, ironically, current director) Kash Patel shut down the watchdog group with no explanation.

On Tuesday, the New York Times reported that Patel suddenly closed the Office of Internal Auditing that Barr created in 2020. The office’s leader, Cindy Hall, abruptly retired. People familiar with the matter told the outlet that the closure of the aforementioned watchdog group alongside the Office of Integrity and Compliance are part of internal reorganization. Sources also reportedly said that Hall was trying to expand the office’s work, but her attempts to onboard new employees were stopped by the Trump administration’s hiring freezes.

The Office of Internal Auditing was a response to controversy surrounding the FBI’s use of Section 702 of the Foreign Intelligence Surveillance Act. The 2008 law primarily addresses surveillance of non-Americans abroad. However, Jeramie Scott, senior counselor at the Electronic Privacy Information Center, told Gizmodo via email that the FBI “has repeatedly abused its ability to search Americans’ communications ‘incidentally’ collected under Section 702” to conduct warrantless spying.

Patel has not released any official comment regarding his decision to close the office. But Elizabeth Goitein, senior director at the Brennan Center for Justice, told Gizmodo via email, “It is hard to square this move with Mr. Patel’s own stated concerns about the FBI’s use of Section 702.”

Last year, Congress reauthorized Section 702 despite mounting concerns over its misuses. Although Congress introduced some reforms, the updated legislation actually expanded the government’s surveillance capabilities. At the time, Patel slammed the law’s passage, stating that former FBI director Christopher Wray, who Patel once tried to sue, “was caught last year illegally using 702 collection methods against Americans 274,000 times.” (Per the New York Times, Patel is likely referencing a declassified 2023 opinion by the FISA court that used the Office of Internal Auditing’s findings to determine the FBI made 278,000 bad queries over several years.)

According to Goitein, the office has “played a key role in exposing FBI abuses of Section 702, including warrantless searches for the communication of members of Congress, judges, and protesters.” And ironically, Patel inadvertently drove its creation after attacking the FBI’s FISA applications to wiretap a former Trump campaign advisor in 2018 while investigating potential Russian election interference. Trump and his supporters used Patel’s attacks to push their own narrative dismissing any concerns. Last year, former representative Devin Nunes, who is now CEO of Truth Social, said Patel was “instrumental” to uncovering the “hoax and finding evidence of government malfeasance.”

Although Patel mostly peddled conspiracies, the Justice Department conducted a probe into the FBI’s investigation that raised concerns over “basic and fundamental errors” it committed. In response, Barr created the Office of Internal Auditing, stating, “What happened to the Trump presidential campaign and his subsequent Administration after the President was duly elected by the American people must never happen again.”

But since taking office, Patel has changed his tune about FISA. During his confirmation hearing, Patel referred to Section 702 as a “critical tool” and said, “I’m proud of the reforms that have been implemented and I’m proud to work with Congress moving forward to implement more.” However, reforms don’t mean much by themselves. As Goitein noted, “Without a separate office dedicated to surveillance compliance, [the FBI’s] abuses could go unreported and unchecked.”

[…]

Source: FBI Director Kash Patel Abruptly Closes Internal Watchdog Office Overseeing Surveillance Compliance

M&S warns of £300M dent in profits from cyberattack

Marks & Spencer says the disruption related to its ongoing cyberattack is likely to knock around £300 million ($402 million) off its operating profits for the next financial year (2025/26).

The beleaguered high street retailer made the admission in its fiscal 2025 profit and loss accounts for the year ended March 29, published on Wednesday, following reports that it could be gearing up to make a maximum claim on its cyber insurance policy to the tune of £100 million ($134 million).

The £300 million figure will be reduced through cost mitigations, insurance, and trading actions, M&S said, and it’s expected that the total costs related to the attack itself and technical recovery will be communicated at a later date as an adjustment item.

[…]

Various divisions suffered an overall decline in operating profits. M&S said that early on into the attack, which has been ongoing for about a month now, that some franchise stores, such as those inside train stations, were experiencing shortages of certain foods, such as “meal deal” sandwiches.

This reduced availability has affected food sales, and M&S also incurred additional waste and logistics costs owing to the shift toward manual processes.

After briefly managing to keep online and app sales running post-breach, these were eventually taken offline along with other systems, and the company said online sales and trading profit was “heavily impacted” as a result.

Online sales in its fashion, home, and beauty divisions remain unavailable and are not expected to return until July, M&S revealed today.

[…]

After posting its results this morning, M&S’s share price was down 3 percent at the time of writing, and about 12 percent down since the start of the attack, representing a more than £1 billion ($1.3 billion) loss to its market valuation.

However, there are green shoots for the retailer, whose pre-tax and pre-adjusted profits were up 22.2 percent on the previous year at £875.5 million ($1.17 billion), which is the company’s best performance in more than 15 years.

Overall, sales also grew 6.1 percent to £13.9 billion ($18.6 billion), and M&S reaffirmed its commitment to reduce its costs by £500 million ($670 million) in time for the 2027/28 financial year.

[…]

M&S disclosed the attack on April 22, and responsibility was soon ascribed to the English-speaking group known as Scattered Spider, who reportedly used DragonForce ransomware to infect the retailer’s systems.

Nothing is officially confirmed on this front, although DragonForce took credit for the attack when speaking to the BBC.

DragonForce said it was also involved in the attacks on Co-op and Harrods, but none of the companies have yet appeared on its leak site, which is unexpected for intrusions that took place nearly a month ago.

M&S confirmed last week that those responsible stole customer data including names, dates of birth, telephone numbers, home addresses, household information, email addresses, and online order histories.

It told the London Stock Exchange that the data did not include full payment card numbers or account credentials

Source: M&S warns of £300M dent in profits from cyberattack • The Register

VMware price hikes 800-1,500%, claim Euro customers

Broadcom has upped VMware licensing costs by between eight to 15 times since it took over the organization, and a lack of alternatives in the tech industry means trade and end customers have no choice but to play ball.

This is the according to the European Cloud Competition Observatory (ECCO), an independent body formed by customer organizations, and CISPE – a trade association of 37 cloud providers in the region – to monitor the behavior of software vendors accused of abusing their monopoly position.

The latest report issued today by ECCO on Broadcom-owned VMware says most CISPE members were forced to renew licensing agreements.

“However, these agreements were often signed under significant pressure, influenced by a lack alternatives, abrupt contract terminations, and financial incentives such as rebates for longer-term commitments,” it claims.

Despite putting pen to paper, “these customers continue to face substantial financial burdens and operational disadvantages due to the imposed terms” of the Broadcom’s revamped licensing framework for VMware.

The chips ‘n’ software giant killed the perpetual licenses and monthly “pay-as-you-go” pricing models on VMware products, and rationalized the portfolio into a few large bundles that are only available on subscription with a three-year minimum commitment.

ECCO likens this to an electricity provider deciding to charge you based on the assumption you run your heating full-blast 24×7 rather than on actual usage, and insisting you pay up front a year or more in advance.

Broadcom, ECCO says, “unilaterally and without sufficient notice” terminated existing licensing agreements, some of which had been in place for over 10 years, in order to compel customers holding them to accept the new terms.

As The Register reported last year, it also ditched VMware’s channel program for Cloud Services Providers (CSPs) and only invited the largest such operators to join its own Broadcom partner program.

This latest report highlights that recent actions by Broadcom have, in ECCO’s words, “worsened the situation for European cloud infrastructure providers, their customers, both private and public sector, which depend on VMware virtualization software.”

[…]

 

Source: VMware price hikes? 800-1,500%, claim Euro customers • The Register

The Enhanced Games—the Olympics on Literal Steroids—Will Take Place in Vegas Next Year

© Jaap Arriens/NurPhoto via Getty Images

The Enhanced Games, a bizarre, steroid-fueled Olympics knock-off that is being funded by wealthy MAGA types, is officially happening. The unconventional sports festival—which, as its name proudly suggests, will allow contestants to use performance-enhancing drugs—will take place in 2026 in Las Vegas over Memorial Day weekend, organizers announced on Wednesday.

The inaugural festival (which, depending on whether this one results in some sort of legal action, may also be the last) will involve competitions in swimming, weight lifting, and track and field, organizers have announced. So far, a small number of former Olympic swimmers have said they intend to participate. Other than that, it’s unclear exactly who will be competing in the tournament. The organization’s website currently includes a submission portal where interested athletes can apply to compete.

Enhanced Games describes itself as “the ultimate demonstration of what the human body is capable of,” though a more accurate description would probably be the “ultimate demonstration of what the human body is capable of when you shoot it full of drugs.” Enhanced claims that its openly drug-fueled approach will actually be safer than traditional sports festivals because, while doping often takes place in traditional competitions, it occurs secretly, perhaps increasing its risk. Enhanced’s approach will allow the doping to occur transparently, under the watchful eye of health professionals, making it safer, organizers reason.

“We aim to deliver the safest sporting event in history by setting a new industry gold standard for athlete health assessments,” the festival’s website claims. “In order to assess health risks, and give athletes an informed picture of their health, we are introducing a mandated state-of-the-art pre-competition full-system medical profiling, which will help monitor cardiac risks, among other key health markers.” Detailed information about what that profiling and monitoring will look like hasn’t been released by the organization yet.

When it comes to contestant compensation, Enhanced also differs from traditional competitions. While the Olympics generally only compensate the winners of certain events (in the U.S., medalists typically only get somewhere between $15k and $25k), Enhanced’s website claims that all “athletes competing in the Enhanced Games will be paid, with those who set new enhanced world records eligible for million-dollar prizes.” The site adds that “the first athletes to set new world records for the 100m Sprint and the 50m Freestyle will receive one million dollars (USD $1,000,000).” Given that this is a competition organized by mega-capitalists, this tracks.

Enhanced is largely being funded by 1789 Capital, a venture capital firm that was founded by Donald Trump Jr., as well as MAGA banking magnate Omeed Malick and tech accelerationist Chris Buskirk. However, original funding for Enhanced Games was provided by a number of wealthy donors, including tech magnate Peter Thiel and his acolyte former Andreessen Horowitz general partner and “Network State” prophet Balaji Srinivasan. Christian Angermayer, another venture capitalist, is also a pivotal funder.

“The Enhanced Games are challenging traditional sports paradigms by embracing science, innovation, and fairness, to create the Third Olympiad – a new era of athletic excellence,” a recent press release from the 1789 Capital claims. “This landmark funding injection underscores the momentum and global belief in the Enhanced Games’ vision.”

Aron D’Souza, the president and founder of Enhanced, also recently criticized the Olympics, claiming they were “a representation of the past” and were “rooted in ancient Greece.” He added: “They have this amateurish, natural ethos that is run by a bunch of European aristocrats. The Enhanced Games are very different. They’re run by capitalists, who believe in the future, believe in science and technology.”

Source: The Enhanced Games—the Olympics on Literal Steroids—Will Take Place in Vegas Next Year

Russia to enforce location tracking app on all foreigners in Moscow

The Russian government has introduced a new law that makes installing a tracking app mandatory for all foreign nationals in the Moscow region.

The new proposal was announced by the chairman of the State Duma, Vyacheslav Volodin, who presented it as a measure to tackle migrant crimes.

“The adopted mechanism will allow, using modern technologies, to strengthen control in the field of migration and will also contribute to reducing the number of violations and crimes in this area,” stated Volodin.

Using a mobile application that all foreigners will have to install on their smartphones, the Russian state will receive the following information:

  • Residence location
  • Fingerprint
  • Face photograph
  • Real-time geo-location monitoring

“If migrants change their actual place of residence, they will be required to inform the Ministry of Internal Affairs (MVD) within three working days,” the high-ranking politician explained.

The measures will not apply to diplomats of foreign countries or citizens of Belarus.

Foreigners attempting to avoid their obligation in relation to the new law will be added to a registry of monitored individuals and deported from Russia.

Russian internet freedom observatory Roskomsvoboda’s reactions to this proposal reflect skepticism and concern.

Lawyer Anna Minushkina noted that the proposal violates Articles 23 and 24 of the Russian Constitution, guaranteeing the right to privacy.

President of the Uzbek Community in Moscow, Viktor Teplyankov, characterized the initiative as “ill-conceived and difficult to implement,” expressing doubts about its feasibility.

Finally, PSP Foundation’s Andrey Yakimov warned that such aggressive measures are bound to deter potential labor migrants, creating a different problem in the country.

The proposal hasn’t reached its final form yet, and specifics like what happens in the case of device theft/loss or similar technical or practical obstacles are to be addressed in the upcoming period during meetings between the Ministry and regional authorities.

The mass-surveillance experiment will run until September 2029, and if deemed successful, the mechanism will extend to cover more parts of the country.

Source: Russia to enforce location tracking app on all foreigners in Moscow

Oops: DanaBot Malware Devs Infected Their Own PCs

Initially spotted in May 2018 by researchers at the email security firm Proofpoint, DanaBot is a malware-as-a-service platform that specializes in credential theft and banking fraud.

Today, the U.S. Department of Justice unsealed a criminal complaint and indictment from 2022, which said the FBI identified at least 40 affiliates who were paying between $3,000 and $4,000 a month for access to the information stealer platform.

The government says the malware infected more than 300,000 systems globally, causing estimated losses of more than $50 million. The ringleaders of the DanaBot conspiracy are named as Aleksandr Stepanov, 39, a.k.a. “JimmBee,” and Artem Aleksandrovich Kalinkin, 34, a.k.a. “Onix”, both of Novosibirsk, Russia. Kalinkin is an IT engineer for the Russian state-owned energy giant Gazprom. His Facebook profile name is “Maffiozi.”

[…]

The indictment says the FBI in 2022 seized servers used by the DanaBot authors to control their malware, as well as the servers that stored stolen victim data. The government said the server data also show numerous instances in which the DanaBot defendants infected their own PCs, resulting in their credential data being uploaded to stolen data repositories that were seized by the feds.

“In some cases, such self-infections appeared to be deliberately done in order to test, analyze, or improve the malware,” the criminal complaint reads. “In other cases, the infections seemed to be inadvertent – one of the hazards of committing cybercrime is that criminals will sometimes infect themselves with their own malware by mistake.”

[…]

Source: Oops: DanaBot Malware Devs Infected Their Own PCs – Krebs on Security

Infrared contact lenses allow people to see in the dark, even with their eyes closed

Neuroscientists and materials scientists have created contact lenses that enable infrared vision in both humans and mice by converting infrared light into visible light. Unlike infrared night vision goggles, the contact lenses, described in the journal Cell, do not require a power source—and they enable the wearer to perceive multiple infrared wavelengths. Because they’re transparent, users can see both infrared and visible light simultaneously, though infrared vision was enhanced when participants had their eyes closed.

“Our research opens up the potential for noninvasive wearable devices to give people super-vision,” says senior author Tian Xue, a neuroscientist at the University of Science and Technology of China. “There are many potential applications right away for this material. For example, flickering infrared light could be used to transmit information in security, rescue, encryption or anti-counterfeiting settings.”

The contact lens technology uses nanoparticles that absorb infrared light and convert it into wavelengths that are visible to mammalian eyes (e.g., in the 400–700 nm range). The nanoparticles specifically enable the detection of “near-infrared light,” which is infrared light in the 800–1600 nm range, just beyond what humans can already see.

The team previously showed that these nanoparticles enable infrared vision in mice when injected into the retina, but they wanted to design a less invasive option.

To create the contact lenses, the team combined the nanoparticles with flexible, nontoxic polymers that are used in standard soft contact lenses. After showing that the contact lenses were nontoxic, they tested their function in both humans and mice.

Preparation procedures for infrared contacts. Credit: Sheng Wang

[…]

In humans, the infrared contact lenses enabled participants to accurately detect flashing morse code-like signals and to perceive the direction of incoming infrared light.

“It’s totally clear-cut: without the contact lenses, the subject cannot see anything, but when they put them on, they can clearly see the flickering of the infrared light,” said Xue.

“We also found that when the subject closes their eyes, they’re even better able to receive this flickering information, because near-infrared light penetrates the eyelid more effectively than , so there is less interference from visible light.”

An additional tweak to the contact lenses allows users to differentiate between different spectra of infrared light by engineering the nanoparticles to color-code different infrared wavelengths. For example, of 980 nm were converted to blue light, wavelengths of 808 nm were converted to , and wavelengths of 1,532 nm were converted to red light.

In addition to enabling wearers to perceive more detail within the , these color-coding nanoparticles could be modified to help color-blind people see wavelengths that they would otherwise be unable to detect.

“By converting red visible light into something like green visible light, this technology could make the invisible visible for color-blind people,” says Xue.

Because the contact lenses have limited ability to capture fine details (due to their close proximity to the retina, which causes the converted light particles to scatter), the team also developed a wearable glass system using the same nanoparticle technology, which enabled participants to perceive higher-resolution infrared information.

Currently, the are only able to detect infrared radiation projected from an LED light source, but the researchers are working to increase the nanoparticles’ sensitivity so that they can detect lower levels of .

“In the future, by working together with and optical experts, we hope to make a contact lens with more precise spatial resolution and higher sensitivity,” says Xue.

More information: Near-Infrared Spatiotemporal Color Vision in Humans Enabled by Upconversion Contact Lenses, Cell (2025). DOI: 10.1016/j.cell.2025.04.019. www.cell.com/cell/fulltext/S0092-8674(25)00454-4

Source: Infrared contact lenses allow people to see in the dark, even with their eyes closed

Microsoft’s Partners With Holocaust Denying, White Genocide Peddling Grok AI

[…] On Monday, Microsoft announced that it will begin offering access to Grok AI, specifically Grok 3 and Grok 3 Mini, through its Azure AI Foundry. For the uninitiated, Grok AI is a product of xAI, which is owned by the same guy whose social media site, X, is reportedly taking money from terrorist groups—Elon Musk. The partnership, to be clear, is nowhere near the level of closeness we’ve seen between Microsoft and OpenAI, which is almost entirely powering the company’s push toward generative AI, but it’s still a step in a more, um, diverse direction.

And that partnership, however small, comes with some pretty awful timing. Just a few days prior to Microsoft’s announcement that it was starting to incorporate Grok into its Azure AI Foundry, Grok was at the center of some controversy after spiraling into Holocaust denial and peddling claims of “white genocide.” The worst part about all of that (outside of the, you know, Holocaust denial part) is that Musk’s AI might not have just randomly hallucinated all of that problematic misinformation.

As noted by the New York Times, Grok only started espousing claims of “white genocide” after an instance of the AI largely debunking a post from Musk himself suggesting white farmers are being targeted as part of a genocide in South Africa. A day after said debunk, Grok was seemingly obsessed with the idea of white genocide, bringing it up in relation to queries that had absolutely nothing to do with the idea at all. During the same time, Grok also started to cast doubt on the number of Jews killed during the Holocaust, stating it was “skeptical” about the figure. xAI has since blamed the Holocaust denialism on a “programming error,” but it’s hard not to greet that claim with some skepticism of my own.

[…]

Source: Microsoft’s Partnership With Elon Musk’s Grok AI Isn’t a Feature—It’s a Liability

Google found not compliant with AVG when registering new accounts – sends the data to 70 services without user knowledge

According to a ruling by the Berlin Regional Court, Google must disclose to its users which of its more than 70 services process their data when they register for an account. The civil chamber thus upheld a lawsuit filed by the German Association of Consumer Organizations (vzbv). The consumer advocates had complained that neither the “express personalization” nor the alternative “manual personalization” complied with the legal requirements of the European General Data Protection Regulation (GDPR).
The ruling against Google Ireland Ltd. was handed down on March 25, 2025, but was only published on Friday (case number 15 O 472/22). The decision is not yet legally binding because the internet company has appealed the ruling. Google stated that it disagrees with the Regional Court’s decision.
What does Google process data for?
The consumer advocates argued that consumers must know what Google processes their data for when registering. Users must be able to freely decide how their data is processed. The judges at the Berlin Regional Court confirmed this legal opinion. The ruling states: “In this case, transparency is lacking simply because the defendant does not provide information about the individual Google services, Google apps, Google websites, or Google partners for which the data is to be used.” For this reason, the scope of consent is completely unknown to the user.
Google: Account creation has changed
Google stated that the ruling concerned an old account creation process that had since been changed. “What hasn’t changed is our commitment to enabling our users to use Google on their terms, with clear choices and control options based on extensive research, testing, and guidelines from European data protection authorities,” it stated. In the proceedings, Google argued that listing all services would result in excessively long text and harm transparency. This argument was rejected by the court. In the court’s view, information about the scope of consent is among the minimum details required by law. The regional court was particularly concerned that with “Express Personalization,” users only had the option of consenting to all data usage or canceling the process. A differentiated refusal was not possible. Even with “Manual Personalization,” consumers could not refuse the use of the German location.

Source: Landgericht Berlin: Google-Accounterstellung verletzte DSGVO | heise online

Upgrade now: OpenPGP.js bug enables encrypted message spoofing

Security researchers are sounding the alarm over a fresh flaw in the JavaScript implementation of OpenPGP (OpenPGP.js) that allows both signed and encrypted messages to be spoofed.

Discovered by Codean Labs’ Edoardo Geraci and Thomas Rinsma, the vulnerability essentially undermines the core purpose of using public key cryptography to secure communications.

Tracked as CVE-2025-47934 (8.7 – high), the vulnerability stems from the openpgp.verify and openpgp.decrypt functions. The advisory posted to the library’s GitHub repo states that a maliciously modified message can be passed to one of these functions and return a result indicating a valid signature without actually being signed.

The researchers said a full write-up of the vulnerability, complete with a proof of concept (PoC) exploit, is “coming soon.” It’s common practice to delay disclosing PoCs to allow users time to patch affected products.

The affected versions are 5.0.1 to 5.11.2 and 6.0.0-alpha.0 to 6.1.0. Users are advised to upgrade to either 5.11.3 or 6.1.1 as soon as possible to fix the problem. Versions 4.x aren’t affected.

There is no PoC just yet, but the advisory offers up some details about how the attack, which affects both signed (inline) messages and signed-and-encrypted messages, could play out.

[…]

The most notable user of OpenPGP is encrypted email provider Proton Mail. The team behind it maintains the library, and the technology is used to offer end-to-end encryption for its users.

As of 2023, Proton Mail had more than 100 million accounts registered. It’s not known how many of these accounts are active, but the figure offers some sense of how many people rely on OpenPGP every day.

Various other email services support the OpenPGP standard either natively or with a little extra software tacked on.

Microsoft Outlook supports it, for example, provided users install an add-in such as gpg4o or Gpg4win, although Outlook has its own encryption capabilities via S/MIME or Microsoft Purview Message Encryption.

Many others, most of them open source and a little niche, however, support the standard straight out of the box.

Source: OpenPGP.js bug enables encrypted message spoofing • The Register