How Feds Really Bypass WhatsApp Encryption | Facebook Messages Expose Capitol Hill Rioters | More SolarWinds Victims Named

Plus: Google Security: Here’s How Stealthy Attackers Could Steal Your Details

In a recurring feature in this newsletter, I'm going to be publishing court documents that you won't have seen anywhere else, ones that outline how the feds are carrying out surveillance in a criminal world full of encrypted apps and secret communications. I'm calling it The Wire IRL.

This week's edition looks at the investigation of an alleged opioid dealer. As found in this search warrant, he was taking bulk orders for oxycodone, one of the most addictive and powerful opioids on the market, via WhatsApp, according to investigators. The Facebook tool has end-to-end encryption and should be impermeable to snoops intercepting messages. But what Hammond didn't know was that one of his customers was an undercover DEA agent, who ordered hundreds of pills during 2019 and 2020, according to the warrant. (According to court records, the suspect hasn't been charged, though his homes was searched. He couldn't be reached for comment and remains innocent until proven guilty. The DOJ declined to comment.)

It's one of many cases I've reviewed recently that show that rather than trying to break WhatsApp encryption, cops prefer to use tried and tested undercover methods to bypass the high levels of security in the app. Even if they can't get WhatsApp messages, police can also ask WhatsApp for certain information on a user, like their IP address, which in this case pointed straight to the suspect's home. The FBI and other law enforcement agencies have been demanding the likes of WhatsApp provide them with a backdoor into messages, but does this show they have other ways of getting the information they need to catch criminals?

If you want a fascinating insight into how modern-day undercover investigations are trying to stymie the opioid crisis, from WhatsApp deals to following the cryptocurrency trail, take a look at the document in full.

If you have any tips on government surveillance or cybercrime, drop me an email on tbrewster@forbes.com.

The Big Story

The Stories You Have To Read Today

More targets of the unprecedented SolarWinds espionage hacks have been revealed. They include a $5 billion market cap security company and a Virginia business regulator. The impact ranges from minimal to a mystery.

The Defense Intelligence Agency has been buying commercial location data, using it to track people in five investigations over the past two and a half years without the need for a warrant, according to the New York Times. The U.S. military and the IRS are amongst other agencies who've purchased such data from commercial providers.

Malwarebytes, a successful cybersecurity startup, has confirmed it was targeted by the same hackers who carried out the SolarWinds attacks that have infiltrated swathes of organizations, including U.S. government agencies.

Another security company, SonicWall, said it was hacked by "sophisticated" attackers who abused vulnerabilities in its own technology. Embarrassing much?

Technologists are using facial recognition techniques on an archive of Parler videos to find matches for those recording their escapades during the January 6 Capitol Hill riots, Vice reports. No doubt police are doing the same, but it's a worrying sign that this technology is now being democratized for anyone to use.

Winner Of The Week

Multiple winners this week. The Biden administration is bulking up its cyber leadership. According to CyberScoop, Rob Silvers, a lawyer and former Department of Homeland Security official, will head up CISA, the organization responsible for securing elections and other critical infrastructure.

Reuters reported that the top candidate for the new National Cyber Director role is Jen Easterly, a former high ranking National Security Agency official.

Loser Of The Week

Telesforo Aviles, a 35-year-old ex-employee at security company ADT, pled guilty last week to accessing customers' home security video footage. The DOJ said he targeted homes of attractive women, and watched them for "sexual gratification." The Texas man watched numerous videos of people having sex inside their homes over a four-and-a-half-year period, secretly accessing roughly 200 customer accounts more than 9,600 times. Gross.