Today, ADALA joins the world in celebrating World Press Freedom Day. As recent history has made clear, Information is a Public Good. the COVID-19 pandemic has further illuminated journalists, across medium and sectors, as our Information "first responders". They act as both protectors and champions of verifiable and reliable Information, therefore, achieving that Public Good. Across the Middle East, North Africa, and Asia we are endeavoring to support journalists to ensure economic viability within media ecosystems, advocate against the rise of digital autocracy and data transparency, whilst enhancing Media and Information Literacy. Thus further deterring the global rise in disinformation and digital authoritarianism. Our efforts have not been easy, the onset of the COVID-19 pandemic has carried with it the concurrent rise in digital authoritarianism. This in turn has increased repression and state censorship which in turn further nurtures disinformation and the subsequent spread thereof. Nonetheless, it is under these conditions in which we thrive, our collective becomes emboldened, and acts as the sinew for our network of networks. Not only do we stand to pay tribute in discourse we embody this rhetoric. We understand that there has never been a more important time to protect Information as of the Public Good. This is why at the present time our Founder and Executive Director is in Southeast Asia; working alongside journalists to empower as they bring to light the crisis in Myanmar. We are an organization of action - we are here to support the United Nation's efforts, "to inform citizens of violations of press freedom - a reminder that in dozens of countries around the world, publications are censored, fined, suspended, and closed down, while journalists, editors, and publishers are harassed, attacked, detained and even murdered." But also to actively foster and defend media thus maintaining Information as a Public Good.  

The Chinese government secretly used an award-winning iPhone hack to spy on Uyghurs. Beijing’s operations against Uyghur is so aggressive that it transcends border therefore effectively making it Global in scope and scale. The effort targets journalists, dissidents, and anyone who raises Beijing’s suspicions of insufficient loyalty. An attack that targeted Apple devices was used to spy on China’s Muslim minority—and US officials claim it was developed at the country’s top hacking competition. - Beijing secretly used an award-winning iPhone hack to spy on Uyghurs - The United States tracked the attack and informed Apple - Tianfu Cup is a “venue for China to get zero-days,” say experts In March 2017, a group of hackers from China arrived in Vancouver with one goal: Find hidden weak spots inside the world’s most popular technologies. Google’s Chrome browser, Microsoft’s Windows operating system, and Apple’s iPhones were all in the crosshairs. But no one was breaking the law. These were just some of the people taking part in Pwn2Own, one of the world’s most prestigious hacking competitions. It was the 10th anniversary for Pwn2Own, a contest that draws elite hackers from around the globe with the lure of big cash prizes if they manage to exploit previously undiscovered software vulnerabilities, known as “zero-days.” Once a flaw is found, the details are handed over to the companies involved, giving them time to fix it. The hacker, meanwhile, walks away with a financial reward and eternal bragging rights. For years, Chinese hackers were the most dominant forces at events like Pwn2Own, earning millions of dollars in prizes and establishing themselves among the elite. But in 2017, that all stopped. One of China’s elite hacked an iPhone…. Virtually overnight, Chinese intelligence used it as a weapon against a besieged minority ethnic group, striking before Apple could fix the problem. It was a brazen act performed in broad daylight. In an unexpected statement, the billionaire founder and CEO of the Chinese cybersecurity giant Qihoo 360—one of the most important technology firms in China—publicly criticized Chinese citizens who went overseas to take part in hacking competitions. In an interview with the Chinese news site Sina, Zhou Hongyi said that performing well in such events represented merely an “imaginary” success. Zhou warned that once Chinese hackers show off vulnerabilities at overseas competitions, they can “no longer be used.” Instead, he argued, the hackers and their knowledge should “stay in China” so that they could recognize the true importance and “strategic value” of the software vulnerabilities. Beijing agreed. Soon, the Chinese government banned cybersecurity researchers from attending overseas hacking competitions. Just months later, a new competition popped up inside China to take the place of the international contests. The Tianfu Cup, as it was called, offered prizes that added up to over a million dollars. The inaugural event was held in November 2018. The $200,000 top prize went to Qihoo 360 researcher Qixun Zhao, who showed off a remarkable chain of exploits that allowed him to easily and reliably take control of even the newest and most up-to-date iPhones. From a starting point within the Safari web browser, he found a weakness in the core of the iPhones operating system, its kernel. The result? A remote attacker could take over any iPhone that visited a web page containing Qixun’s malicious code. It’s the kind of hack that can potentially be sold for millions of dollars on the open market to give criminals or governments the ability to spy on large numbers of people. Qixun named it “Chaos.” The inaugural event was held in November 2018. The $200,000 top prize went to Qihoo 360 researcher Qixun Zhao, who showed off a remarkable chain of exploits that allowed him to easily and reliably take control of even the newest and most up-to-date iPhones. From a starting point within the Safari web browser, he found a weakness in the core of the iPhones operating system, its kernel. The result? A remote attacker could take over any iPhone that visited a web page containing Qixun’s malicious code. It’s the kind of hack that can potentially be sold for millions of dollars on the open market to give criminals or governments the ability to spy on large numbers of people. Qixun named it “Chaos.” Two months later, in January 2019, Apple issued an update that fixed the flaw. There was little fanfare—just a quick note of thanks to those who discovered it. But in August of that year, Google published an extraordinary analysis into a hacking campaign it said was “exploiting iPhones en masse.” Researchers dissected five distinct exploit chains they’d spotted “in the wild.” These included the exploit that won Qixun the top prize at Tianfu, which they said had also been discovered by an unnamed “attacker.” The Google researchers pointed out similarities between the attacks they caught being used in the real world and Chaos. What their deep dive omitted, however, were the identities of the victims and the attackers: Uyghur Muslims and the Chinese government. A campaign of oppression For the past seven years, China has committed human rights abuses against the Uyghur people and other minority groups in the Western province of Xinjiang. Well-documented aspects of the campaign include detention camps, systematic compulsory sterilization, organized torture and rape, forced labor, and an unparalleled surveillance effort. Officials in Beijing argue that China is acting to fight “terrorism and extremism,” but the United States, among other countries, has called the actions genocide. The abuses add up to an unprecedented high-tech campaign of oppression that dominates Uyghur lives, relying in part on targeted hacking campaigns. China’s hacking of Uyghurs is so aggressive that it is effectively global, extending far beyond the country’s own borders. It targets journalists, dissidents, and anyone who raises Beijing’s suspicions of insufficient loyalty. Shortly after Google’s researchers noted the attacks, media reports connected the dots: the targets of the campaign that used the Chaos exploit were the Uyghur people, and the hackers were linked to the Chinese government. Apple published a rare blog post that confirmed the attack had taken place over two months: that is, the period beginning immediately after Qixun won the Tianfu Cup and stretching until Apple issued the fix. MIT Technology Review has learned that United States government surveillance independently spotted the Chaos exploit being used against Uyghurs, and informed Apple. (Both Apple and Google declined to comment on this story.) The Americans concluded that the Chinese essentially followed the “strategic value” plan laid out by Qihoo’s Zhou Hongyi; that the Tianfu Cup had generated an important hack; and that the exploit had been quickly handed over to Chinese intelligence, which then used it to spy on Uyghurs. The US collected the full details of the exploit used to hack the Uyghurs, and it matched Tianfu’s Chaos hack, MIT Technology Review has learned. (Google’s in-depth examination later noted how structurally similar the exploits are.) The US quietly informed Apple, which had already been tracking the attack on its own and reached the same conclusion: the Tianfu hack and the Uyghur hack were one and the same. The company prioritized a difficult fix. Qihoo 360 and Tianfu Cup did not respond to multiple requests for comment. When we contacted Qixun Zhao via Twitter, he strongly denied involvement, although he also said he couldn’t remember who came into possession of the exploit code. At first, he suggested the exploit wielded against Uyghurs was probably used “after the patch release.” On the contrary, both Google and Apple have extensively documented how this exploit was used before January 2019. He also pointed out that his ‘Chaos’ exploit shared code from other hackers. In fact, within Apple and US intelligence, the conclusion has long been that these exploits are not merely similar—they are the same. Although Qixun wrote the exploit, there is nothing to suggest he was personally involved in what happened to it after the Tianfu event (Chinese law requires citizens and organizations to provide support and assistance to the country’s intelligence agencies whenever asked.) By the time the vulnerabilities were closed, Tianfu had achieved its goal. “The original decision to not to allow the hackers to go abroad to competitions seems to be motivated by a desire to keep discovered vulnerabilities inside of China,” says Adam Segal, an expert on Chinese cybersecurity policy at the Council for Foreign Relations. It also cut top Chinese hackers from other income sources “so they are forced into a closer connection with the state and established companies,” he says. The incident is stark. One of China’s elite hacked an iPhone, and won public acclaim and a large amount of money for doing so. Virtually overnight, Chinese intelligence used it as a weapon against a besieged minority ethnic group, striking before Apple could fix the problem. It was a brazen act performed in broad daylight and with the knowledge that there would be no consequences to speak of. Concerning links Today, the Tianfu Cup is heading into its third year, and it’s sponsored by some of China’s biggest tech companies: Alibaba, Baidu, and Qihoo 360 are among the organizers. But American officials and security experts are increasingly concerned about the links between those involved in the competition and the Chinese military. Qihoo, which is valued at over $9 billion, was one of dozens of Chinese companies added to a trade blacklist by the United States in 2020 after a US Department of Commerce assessment that the company might support Chinese military activity. Others involved in the event have also raised alarms in Washington. The Beijing company Topsec, which helps organize Tianfu, allegedly provides hacking training, services, and recruitment for the government and has employed nationalist hackers, according to US officials. The company is linked to cyber-espionage campaigns including the 2015 hack of the US insurance giant Anthem, a connection that was accidentally exposed when hackers used the same server to try to break into a US military contractor and to host a Chinese university hacking competition. Other organizers and sponsors include NSFocus, which grew directly out of the earliest Chinese nationalist hacker movement called the Green Army, and Venus Tech, a prolific Chinese military contractor that has been linked to offensive hacking. One other Tianfu organizer, the state-owned Chinese Electronics Technology Group, has a surveillance subsidiary called Hikvision, which provides “Uyghur analytics” and facial recognition tools to the Chinese government. It was added to a US trade blacklist in 2019. Neither the Tianfu Cup nor its organizers returned repeated requests for comment. US experts say the links between the event and Chinese intelligence are clear, however. “I think it is not only a venue for China to get zero-days but it’s also a big recruiting venue,” says Scott Henderson, an analyst on the cyber espionage team at FireEye, a major security company based in California. Tianfu’s links to Uyghur surveillance and genocide show that getting early access to bugs can be a powerful weapon. In fact, the “reckless” hacking spree that Chinese groups launched against Microsoft Exchange in early 2021 bears some striking similarities. In that case, a Taiwanese researcher uncovered the security flaws and passed them to Microsoft, which then privately shared them with security partners. But before a fix could be released, Chinese hacking groups started exploiting the flaw all around the world. Microsoft, which was forced to rush out a fix two weeks earlier than planned, is investigating the potential that the bug was leaked. These bugs are incredibly valuable, not just in financial terms, but in their capacity to create an open window for espionage and oppression. Google researcher Ian Beer said as much in the original report detailing the exploit chain. “I shan’t get into a discussion of whether these exploits cost $1 million, $2 million, or $20 million,” he wrote. “I will instead suggest that all of those price tags seem low for the capability to target and monitor the private activities of entire populations in real time.”

Misogyny, bigotry and threats ‘cut public trust in critical media’, warns report after major investigation. An epidemic of online violence against female journalists worldwide is undermining their reporting, spilling over into real-life attacks and harassment, and puts their health and professional prospects in jeopardy, the UN has warned. The avalanche of misogynistic abuse and threats is not only damaging women working in media, it is also weaponised “to undercut public trust in critical journalism and facts in general”, a report commissioned by the UN’s cultural agency Unesco has found. ‘The Chilling: Global Trends in Online Violence Against Women Journalists” draws on a survey of 901 journalists from 125 countries. Journalists from diverse backgrounds faced particularly intense attacks, as misogyny mixed with racism, homophobia, religious bigotry and other forms of discrimination, the report found. “Online violence against women journalists is designed to belittle, humiliate, and shame; induce fear, silence, and retreat; discredit them professionally, undermining accountability, journalism and trust in facts,” the report found, adding that it also aimed to freeze women out of public debate. “This amounts to an attack on democratic deliberation and media freedom… and it cannot afford to be normalised or tolerated as an inevitable aspect of online discourse.” In-depth case studies analyse more than 2.5 million posts on Facebook and Twitter directed at two prominent women journalists. The first is Maria Ressa who heads the news outlet Rappler in the Philippines, and was recently awarded the Unesco annual press freedom prize. Her reporting has made her a target of her country’s judiciary and online hate campaigns, and at one point she was receiving 90 hate messages an hour on Facebook, the report found. The second is the award-winning Carole Cadwalladr who writes for the Observer and the Guardian in the UK. The report found more than 10,000 instances of obvious abuse on Twitter alone, nearly half laced with sexist and misogynistic language. There was also a significant element of “anti-journalism” rhetoric in attacks on Cadwalladr, “reflecting the demonisation of the press… and the weaponisation of terms like ‘fake news’ to chill critical reporting”. Online threats and attacks are highly damaging to women’s careers and health. One in 10 had sought medical or psychological help after being targeted, and one in three had started self-censoring. A large portion reported a professional impact from the attacks, with 2% of those affected leaving journalism entirely. “There is nothing virtual about online violence. It has become the new frontline in journalism safety - and women journalists sit at the epicentre of risk,” the report said. “Networked misogyny and gaslighting intersect with racism, religious bigotry, homophobia and other forms of discrimination to threaten women journalists, severely and disproportionately. It also detailed how online violence is increasingly spilling offline. Case studies included the vandalising of an academy run by Sri Lankan journalist Sharmila Seyyid, and people coming to the home and workplace of April Ryan, White House correspondent for the Grio, specifically to abuse her. The report analysed multiple forms of online violence, including threats of sexual and physical violence, harassing private messages, coordinated “dog-pile” attacks from large groups, hacking and “doxxing” – publishing personal information online. As a result of the exposure of personal details, a number of journalists had to move home or even country, with cases in the US, Sri Lanka, the UK and South Africa. The report also covered less well known forms of attack, including misrepresentation through spoof accounts and manipulated or fake content, and flooding search results on sites like Google with false and hateful content to drown out professional journalistic work. Social media platforms are the main forum for online violence against women, and have “so far failed to respond quickly or effectively to the crisis”, the report found. “Central to this failure is an attempt to use “free speech” as a shield against accountability, and a continuing reluctance to assume responsibility for the content on their sites.” Their policies mean that women are left to be first responders to the growing levels of violence against them. “They are the ones required to ‘report’, ‘block’, ‘mute’, ‘delete’, and ‘restrict’ their attackers, potentially compounding the effects of the abuse, and creating unbearable pressures when the attacks come at scale.”