Handala’s second claim, however—that it hacked the FBI—seems, for now, to be fiction. All evidence points to Handala having breached Patel’s older, personal Gmail account. Widely believed to be a “hacktivist” front for Iran’s intelligence agency the MOIS, Handala suggested on its website that the emails contained classified information, but the messages initially reviewed by WIRED didn’t appear to be related to any government work. TechCrunch did find, however, that Patel appears to have forwarded some emails from his Justice Department email account to his Gmail account in 2014.

Handala, which cybersecurity experts have described to WIRED as an “opportunistic” hacker group whose cyberattacks and breaches are often calculated more for their propaganda value than their tactical impacts, has nonetheless made the most of Patel’s embarrassing breach. “To the whole world, we declare: the FBI is just a name, and behind this name, there is no real security,” the group wrote in its statement. “If your director can be compromised this easily, what do you expect from your lower-level employees?”

Handala Hackers Put $50 Million Bounty on Trump and Netanyahu’s Heads

For further evidence of Handala’s bombastic rhetoric, look no further than another post on its website earlier this week (we’re intentionally not linking to it) that offered a $50 million bounty to anyone who could “eliminate” US president Donald Trump and Israeli prime minister Benjamin Netanyahu. “This substantial prize will be awarded, directly and securely, to any individual or group bold enough to show true action against tyranny,” the hackers’ statement read, along with an invitation to any would-be assassins to reach out via the encrypted messaging app Session. “All our communication and payment channels utilize the latest encryption and anonymization technologies, your safety and confidentiality are fully guaranteed.”

That bounty, Handala explained, was posted in answer to a statement about Handala published on the US Department of Justice website last week that offered $10 million for information leading to the identity or location of anyone who carries out “malicious cyber activities against US critical infrastructure” on behalf of a foreign government.

“Our message is clear: If you truly have the will and the power, come and find us!” Handala wrote in its response. “We fear no challenge and are prepared to respond to every attack with even greater force.”

In yet another post on its website this week, Handala also claimed to have doxed 28 engineers at military contractor Lockheed Martin working in Israel and threatened them with personal harm if they didn’t leave the country within 48 hours. When WIRED tried calling the phone numbers included in Handala’s leaked data, however, most of them didn’t work.

4 Years in, Apple’s Pegasus-Killer Remains Undefeated, Company Says

Apple says no device with its Lockdown Mode security feature enabled has ever been successfully compromised by mercenary spyware in the nearly four years since its launch. Amnesty International’s security lab head, Donncha Ó Cearbhaill, also says his team has seen no evidence of a successful attack against a Lockdown Mode–enabled iPhone. And Citizen Lab, which has documented several successful spyware attacks against iPhones, says none involve a Lockdown Mode bypass, while in two cases its researchers found the feature actively blocked attacks against NSO Group’s Pegasus and Intellexa’s Predator. Google researchers, meanwhile, found one spyware strain that simply abandons infection attempts when it detects the feature is enabled.

Lockdown Mode works by disabling commonly exploited iPhone features, such as most message attachment types and features like links and link previews. Incoming FaceTime calls are blocked unless the user has previously called that person within the past 30 days. When the iPhone is locked, it blocks connections with computers and accessories. The device will not automatically join nonsecure Wi-Fi networks, and 2G and 3G support is disabled. Apple has also doubled bounties for researchers who detect any Lockdown Mode bypass, with payouts up to $2 million.

Security researcher Patrick Wardle tells TechCrunch that Lockdown Mode is the most aggressive consumer-facing hardening feature ever shipped, noting that it eliminates entire exploit classes instead of patching individual flaws. Apple has reportedly sent spyware notifications to users in 150 countries. While it remains possible a bypass has gone undetected, Amnesty and Citizen Lab backing up Apple’s claims is a strong sign the feature is working as intended.

Russia Is Planning to Use Its Own Encryption for 5G

A proposed Russian law currently moving through the country’s legislative process would require that telecoms implement an encryption algorithm developed in Russia for all domestic 5G mobile networks. If the bill succeeds, all 5G mobile devices sold in Russia would need to support the homegrown encryption, known as NEA-7, to be able to connect to 5G. The bill includes a provision to phase out support for foreign algorithms by 2032—including the US’s AES, China’s ZUC, and the EU’s SNOW. The law seems focused, at least in part, on making it harder for Ukrainian drones (or those of other enemies) to use Russian SIM cards to aid infrastructure targeting. It also fits into the Kremlin’s years-long effort to isolate and exert control over the Russian internet. If passed, though, the law could severely hinder 5G expansion in Russia given that there currently isn’t cell tower equipment that supports NEA-7.

33 Data Brokers Admitted They Sell Americans’ Data to China, Russia, and Iran

The California Privacy Protection Agency updated its data broker registry on Tuesday with a concerning revelation: At least 33 data brokers self-reported selling or sharing Californians’ personal information with entities in China, Russia, North Korea, or Iran—the four nations California’s data broker law treats as foreign adversaries. (The registry doesn’t distinguish between sales to those nations’ governments and sales to private companies headquartered or incorporated there.)

The registry is significant even for users throughout the US, as California is the only state that statutorily requires this disclosure. China, Russia, North Korea, or Iran all have legal frameworks that can compel domestic companies to share data with state intelligence services, and all are active cyber adversaries of the United States. The US government considers even routine commercial data sales to private entities in those jurisdictions to be a national security risk.

Named companies include Cision, CoStar, Epsilon, HubSpot, Healthcare Inc., and Moody's, among others. Some of the 33 brokers have since claimed they incorrectly declared their own sales to entities in those countries on their filings, but as the Electronic Privacy Information Center noted, the reporting errors could cut both ways: If some brokers overstated their foreign sales, others may have understated theirs.