Cyberattacks, regional conflict, weapons of mass destruction, terrorism, business spyware, AI, misinformation, disinformation, deepfakes and TikTok. These are only among the top perceived threats that america faces, based on the U.S. government’s intelligence agency’s latest global risk assessment.

The unclassified report published Monday — sanitized for public release — gave a frank annual window into the U.S. intelligence community’s collective hive mind concerning the threats it sees facing the U.S. homeland based on its massive banks of gathered intelligence. Now in an election yr, the highest U.S. spies increasingly cite emerging technology and cybersecurity as playing a think about assessing its national security posture.

In an unclassified session with the Senate Intelligence Committee on Monday, the highest leaders across the U.S. government’s intelligence agencies — including the FBI, NSA, CIA and others — testified to lawmakers largely to reply their questions on the present state of worldwide affairs.

Here’s what we learned from the hearing.

At the least 74 countries use business spyware

In the previous few years, the U.S. government turned its attention to the federal government spyware industry, currently manufactured from corporations like NSO Group and Intellexa, and previously Hacking Team and FinFisher. In its annual report, the intelligence community wrote that, “from 2011 to 2023, at the very least 74 countries contracted with private corporations to acquire business spyware, which governments are increasingly using to focus on dissidents and journalists.”

The report doesn’t make clear where the intelligence community got that number, and the Office of the Director of National Intelligence didn’t reply to a request for comment asking to make clear.

But last yr, the Carnegie Endowment for International Peace, a Washington, D.C. think-tank, released a report on the worldwide spyware industry that included the identical number of nations in addition to the identical dates as the brand new intelligence community report. The Carnegie report, written by Steven Feldstein and Brian Kot, referenced data that the 2 collected, which they said got here from sources similar to digital rights groups and security researchers which have studied the spyware industry like Citizen Lab, the Electronic Frontier Foundation and Privacy International, in addition to news reports.

It’s vital to notice that the Carnegie dataset, as the authors explained last yr, includes what we consult with as government or business spyware, meaning tools to remotely hack and surveil targets remotely, similar to those who NSO and Intellexa make. Nevertheless it also includes digital forensic software used to extract data from phones and computers which are physically within the possession of the authorities. Two of essentially the most well-known makers of one of these tools are Cellebrite and Grayshift, each of that are widely utilized in america in addition to in other countries.

U.S. says it’s struggling to counter ransomware

The U.S. says ransomware is an ongoing risk to U.S. public services and important infrastructure because cybercriminals related to ransomware are “improving their attacks, extorting funds, disrupting critical services, and exposing sensitive data.”

Ransomware has turn out to be a world problem, with hacking gangs extorting corporations in some cases thousands and thousands of dollars in ransom payments to get their stolen files back. Some cybersecurity experts have called on governments to outright ban ransom payments as needed to stop hackers profiteering from cybercrime.

However the U.S. has shunned that view and takes a distinct approach, opting to systematically disrupt, dismantle and sanction among the worst offenders, who’re based in Russia and outdoors of the reach of U.S. justice.

“Absent cooperative law enforcement from Russia or other countries that provide cyber criminals a refuge or permissive environment, mitigation efforts will remain limited,” the threat assessment reads. In other words, until Russia — and a number of other hostile states — quit their criminals, expect ransomware to proceed to be the modern-day snow day.

U.S. warns of growing use of AI in influence operations

Using generative AI in digital influence operations isn’t recent, however the wide availability of AI tools is lowering the bar for malicious actors engaging in online influence operations, like election interference and generating deepfakes.

The rise of detailed and convincing deepfake imagery and video is playing its role in information warfare by deliberately sowing confusion and discord, citing Russia’s use of deepfake imagery against Ukraine on the battlefield.

“Russia’s influence actors have adapted their efforts to higher hide their hand, and will use recent technologies, similar to generative AI, to enhance their capabilities and reach into Western audiences,” warned the report.

This was something echoed by NSA cybersecurity director Rob Joyce earlier in January about how foreign hackers are using chatbot tools to generate more convincing phishing emails, but that AI can also be useful for digital defense.

The report also noted that China is increasingly experimenting with generative AI, noting that TikTok accounts run by a Chinese military propaganda arm “reportedly targeted candidates from each political parties in the course of the U.S. midterm election cycle in 2022.”

There aren’t any laws limiting U.S. spies from buying Americans’ data

U.S. spy agencies have caught on to a well-liked practice: Why get a warrant for data after they can just buy it online? Given how much data we share from our phone apps (which many don’t give a second thought), U.S. spy agencies are simply buying up vast troves of Americans’ commercially available location data and web traffic from the information brokers.

How is that legal? After a temporary exchange with the top of the Defense Intelligence Agency — one among the agencies confirmed to have bought access to a database containing Americans’ location data — Sen. Ron Wyden noted that the practice was allowed because there isn’t any constitutional or statutory limit on buying commercially available data.

In other words, U.S. spy agencies can keep buying data on Americans that is quickly available for purchase until Congress puts a stop to the practice — even when the basis of the issue is that data brokers shouldn’t have our data to start with.