Hacking Dictatorships with AI: Real-World Cases of Propaganda Warfare

Hacking Dictatorships with AI: Real-World Cases of Propaganda Warfare

Speakers: Chris Kubecka (CEO, HypaSec)

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=ylGMP-lZnV4

Overview

In an electrifying and deeply personal presentation at DefCamp, Chris Kubecka, CEO of HypaSec, unveiled the stark realities of "Hacking Dictatorships with AI: Real-World Cases of Propaganda Warfare." Kubecka, a veteran of the US Air Force, former head of information protection for Aramco, and a top expert in generative AI and cyber warfare, shared her extensive experience in leveraging advanced technology and digital sabotage to combat authoritarian regimes. Her talk was not merely theoretical but grounded in "field-tested" operations, offering a chilling glimpse into how modern dictatorships weaponize big tech and AI, and how a dedicated network of ethical hackers can fight back.

Kubecka's narrative transcends typical cybersecurity discourse, blending geopolitical analysis, human rights advocacy, and cutting-edge technical insights. Her work, driven by a profound dislike for corruption and a commitment to democracy, exposes the intricate web of surveillance, propaganda, and illicit activities—including drug trafficking—that underpin modern authoritarian rule, particularly in Venezuela. The presentation served as both a warning about the pervasive digital threats posed by oppressive governments and an inspiring call to action for the cybersecurity community to reclaim the digital battlespace for good.

The talk highlighted the critical role of individuals and coordinated groups in challenging state-sponsored digital oppression, demonstrating how open-source intelligence (OSINT), forensic analysis, and even custom AI tools can dismantle propaganda machines, expose corruption, and protect vulnerable populations. Kubecka's unique perspective, informed by a lifetime of hacking everything "land, sea, space, and air," provided an urgent reminder that technology, while often a tool of control, can also be a powerful instrument of liberation.

Background

▶ Watch: Introduction and personal background (0:00)

Chris Kubecka's journey into digital warfare against dictatorships is deeply rooted in her personal history and a lifelong exposure to intelligence operations. She revealed that her grandfather, a DIA agent and director of Voice of America's Latin American operations, inadvertently exposed her to classified work as a child, fostering a "curious" and "spy-like" inclination. This early exposure included a declassified version of an Office of Strategic Services (OSS) booklet from World War II, detailing methods of sabotage for everyday citizens in occupied territories. These ranged from using light oil in machinery instead of heavy crude to poking holes in filters, or stuffing flammable materials into fireproof rooms—tactics designed for plausible deniability and maximum disruption. This foundational understanding of physical sabotage later evolved into her conceptualization of digital sabotage.

Her professional career further solidified this path. In 2006, Kubecka conducted the forensic analysis of the law firm involved in the Panama Papers, an investigation whose findings are now cited in a significant legal case, John Doe versus Germany. The same year, she witnessed firsthand the political volatility in Bulgaria, a country that experienced seven elections in four years. At the Openfest conference in 2016, she led a workshop on using open-source intelligence (OSINT) to uncover corruption among political contenders, an event controversially interrupted by the Bulgarian government attempting to shut down the livestream. Concurrently, Russia's hacking of a Netherlands referendum on trade with Ukraine in 2016 further underscored the vulnerability of democratic processes to digital interference. These experiences culminated in Kubecka writing a book detailing election interference, particularly focusing on Russian activities in the US, UK, and Netherlands.

Kubecka's Puerto Rican heritage provided another crucial lens. Growing up in what she describes as a US colony, she experienced a US military dictatorship for 50 years, where speaking Spanish or displaying the Puerto Rican flag was forbidden. This era fostered crypto linguistics through music and dance, like the Plena, as a means of conveying censored messages. The Las Carpetas program, a massive FBI surveillance operation that targeted 80,000 individuals and extended surveillance to 80% of the island's population, instilled a deep understanding of state-sponsored surveillance and blacklisting. Realizing that modern authoritarian governments, including those leveraging big tech companies like Google, were replicating and enhancing these surveillance tactics digitally, Kubecka committed herself to countering them.

Key Findings

▶ Watch: Venezuela's rigged election and VenApp spyware (9:00)

The core of Kubecka's presentation revolved around exposing the sophisticated digital tactics employed by modern dictatorships, particularly in Venezuela, and her counter-efforts. Her key findings include:

• Weaponized Citizen Apps: In the lead-up to Venezuela's July 31st, 2024 elections, where an improbable 96% of the vote went to Maduro, a "citizen app" called Patricia (older phones) or Ven app (newer phones) was widely promoted. Kubecka's analysis of the Android APK revealed it to be a sophisticated spyware tool. It could remotely activate the user's camera and microphone, prevent the phone from sleeping, exfiltrate all contacts, and inject calendar items—specifically, mandates to attend pro-Maduro political rallies. This transformed citizens' phones into "spies in their pockets."
• Surveillance via Government Websites and Big Tech: Kubecka discovered that the Venezuelan prison administration website, managed by a sanctioned official (Miss Wrangle, sanctioned in six countries), utilized Google ID and Google Analytics to geolocate visitors down to the street level, especially those accessing it via smartphones. This meant that relatives searching for disappeared loved ones were themselves being tracked and subsequently "picked up and disappeared." Google initially denied this, but after Kubecka filed a GDPR complaint in the Netherlands, citing a similar incident in occupied Ukraine in 2022 where Google services were used to profile Ukrainians, Google eventually apologized and confirmed that the "continued use of Google Analytics and Tag Manager on government Venezuelan servers... is leading to additional loss of life."
• International Reach of Bolivarian Security Services: The talk highlighted the international operational capabilities of Venezuela's security services. Kubecka cited the case of Alexander Granco, head of Venezuelan security services, who, along with associates, dressed as Chilean immigration officials in November to abduct an exile from Chile. This individual has not been seen since, demonstrating the transnational nature of their operations.
• Propaganda and Disinformation: Maduro's government attempted to deny the July 2024 election results, falsely blaming North Macedonia for a "massive cyber attack" on the official election website, CNC. Kubecka explained this as a geopolitical maneuver, linking Venezuela's actions to Russia's concerns about North Macedonia's alignment with the EU. Her forensic analysis of Venezuelan government networks found no evidence of a North Macedonian attack.
• Cartel-Government Collusion: Kubecka presented "absolute proof of corruption and collusion" between the Maduro administration and major drug cartels. Through "mistakenly hacking" into Panamanian government systems, she uncovered CVs that directly linked the legal representative of the Ven app to the corrupt PSVD party in Panama, known for its cartel ties. This provided concrete evidence of the Venezuelan government's facilitation of drug trafficking.
• Russian Military Presence and Influence: Since mid-August of the previous year, Russian drones have been present in Caracas and other parts of Venezuela. Furthermore, checkpoints equipped with Russian technology, identical to those used in occupied Ukraine for phone checking, have been set up in Venezuela, indicating a deep level of Russian military and surveillance support.
• AI for Counter-Dictatorship Operations: Kubecka and her team developed AI-powered tools for "good." These include Zero Day GPT, a non-commercial tool for creating zero-days, used to deal with threats like Starlink-enabled drug submarines operated by the Venezuelan Navy. Another tool, Pirate GPT, was developed to track and hack maritime activities, specifically targeting these drug operations and Chinese drug precursor imports.
• Retaliation and Resilience: Kubecka faced significant retaliation for her work. Google issued "letters" to a US media organization that published her findings on Google Tag Manager, leading to the article's removal and the journalist's resignation. Kubecka and the journalist reposted it a year later, daring Google to sue. Furthermore, Cuban state media, on one of their official organizations, branded her a "CYBER FASCIST" for her role in exposing Venezuelan activities, using her artwork without permission.
• "Hacking for Democracy": Kubecka detailed successful "hacking for democracy" operations. This included gaining access to VoIP phones (Android version 2.1.3), the Office of Personnel Management (Venezuela's HR), and uncovering detailed information on cocaine production logistics, submarine operations, aviation administration ties, metadata on photographs, grow locations, and shipping routes (e.g., cocaine shipped as bananas out of Peru). Her team also aided the escape of opposition candidates and their families, using information from security services' infotainment systems and IoT cameras, and even exploiting tracking pixels in Gmail to locate kidnapped relatives and facilitate their safe passage to Colombia and Spain.

Technical Deep Dive

▶ Watch: Russian presence in Venezuela and AI for good (19:00)

The technical underpinnings of Kubecka's work are multifaceted, combining traditional cybersecurity forensics with innovative applications of AI and OSINT. Her approach demonstrates a profound understanding of how digital infrastructure can be both exploited by and turned against authoritarian regimes.

A primary technical finding involved the Ven app (and its predecessor, Patricia), distributed by the Venezuelan government. Kubecka's team performed an APK analysis of the Android version, revealing its true nature as sophisticated spyware. The app's code contained functionalities allowing it to activate the phone's camera and microphone remotely, prevent the device from entering a sleep state (maintaining constant surveillance), exfiltrate the user's entire contact list, and even inject calendar entries. These entries were not benign reminders but political mandates, such as expected attendance at pro-Maduro rallies. This level of access transformed a seemingly innocuous "citizen app" into a pervasive "spy in your pocket," leveraging common smartphone permissions for state-level surveillance.

Another critical technical exposure concerned the misuse of widely adopted web analytics platforms. Kubecka meticulously documented how the Venezuelan prison administration website, a seemingly routine government portal, incorporated Google ID and Google Analytics. While these tools are typically used for website traffic analysis, their implementation on a government site dealing with sensitive information in a repressive regime had dire consequences. The JavaScript code associated with these scripts was configured to perform geolocation tracking, capable of pinpointing a user's location down to the street level, especially when accessed from a smartphone. This allowed the regime to identify and target individuals—often family members—who were simply trying to locate disappeared relatives, leading to their own arrests and disappearances. Kubecka's subsequent GDPR complaint in the Netherlands, backed by her code submissions, compelled Google to acknowledge the "additional loss of life" resulting from this misuse, highlighting a significant ethical and technical failing by a major tech company.

Kubecka also detailed her forensic analysis of Venezuelan government networks and codebases. When Maduro falsely blamed North Macedonia for a cyberattack on the CNC election website, Kubecka and her "friends" (implying a network of skilled collaborators) conducted their own forensic analysis of the Venezuelan government's network and code. This investigation found no evidence supporting Maduro's claims, instead uncovering ties that pointed to Russian geopolitical influence.

A significant technical breakthrough involved "mistakenly hacking" into the Panamanian government's systems. This operation yielded a trove of Curriculum Vitae (CVs), which Kubecka cross-referenced to uncover direct links between the legal representative of the Ven app and the corrupt PSVD party in Panama, a known entity with deep ties to drug cartels. This demonstrated the power of deep-dive OSINT and network penetration to expose high-level corruption and transnational criminal enterprises.

In response to these threats, Kubecka's team developed bespoke AI tools. The Zero Day GPT is designed to create "many, many not for commercial criminal reasons zero days." This tool, for instance, was used to address the threat of IoT remote control via Starlink drug submarines operated by the Venezuelan Navy, as well as the import of drug precursors from China. The Pirate GPT was developed specifically to track maritime activities associated with these drug operations and, in some cases, "hack some of it." These AI applications exemplify the strategic use of advanced technology to counter specific, sophisticated threats posed by state and criminal actors.

Further technical exploits included gaining access to desk phones and VoIP phones (specifically those running Android version 2.1.3), and penetrating Venezuela's Office of Personnel Management—effectively their HR system for government careers. This access allowed Kubecka's team to extract highly sensitive data, including "cocaine production logistics information," details about their submarines, tie-ins with their aviation administration, metadata on photographs, specific "grow locations" for drugs, "automated locations," and information about "other countries and ports that they ship cocaine as bananas out of Peru."

Finally, Kubecka's team employed seemingly simple yet effective techniques, such as exploiting tracking pixels in Gmail. This was used to locate kidnapped relatives of opposition candidates who, unfamiliar with advanced digital security, left digital breadcrumbs that enabled Kubecka's team to track them and facilitate their escape across the border into Colombia and eventually to Spain. This blend of high-tech AI and low-tech digital forensics underscores the versatile approach required to combat modern dictatorships.

Demo / Proof of Concept

▶ Watch: Labeled 'Cyber Fascist'; hacking for democracy (22:00)

While Chris Kubecka's presentation did not feature a live, interactive technical demonstration, she presented compelling evidence and detailed several "field-tested" operations that served as a powerful proof of concept for her methods. Her talk was rich with descriptions of successful hacks, forensic analyses, and intelligence gathering operations, effectively demonstrating the efficacy of her approach.

For instance, Kubecka explicitly stated, "I hacked into Panama mistakenly," and then showed a slide displaying CVs obtained from Panamanian government systems. This visual evidence directly supported her claim of uncovering the link between the legal representative of the Venezuelan Ven app and the corrupt PSVD party with cartel ties. This segment, accompanied by her explanation, acted as a direct presentation of her findings.

Furthermore, Kubecka described the meticulous APK analysis of the Ven app, detailing its spy capabilities, and the code review of Google Analytics implementations on Venezuelan government websites. Although the code itself wasn't displayed line-by-line, her confident articulation of the findings, including the specific functionalities and the subsequent GDPR complaint and Google's apology, served as robust validation of her technical expertise and the actionable intelligence derived. The development and application of Zero Day GPT and Pirate GPT for specific targets like Starlink-connected drug submarines were also presented as established capabilities, rather than theoretical concepts. The successful aid in spiriting away opposition candidates and their families, utilizing techniques like tracking pixels in Gmail and exploiting IoT cameras, demonstrated the real-world impact and "hacking for democracy" ethos of her work.

Defensive Implications

▶ Watch: Q&A: Why sudden interest in Venezuela's situation? (45:00)

Chris Kubecka's talk provides critical insights for defenders operating in an increasingly complex and politically charged digital landscape. The defensive implications extend beyond traditional network security to encompass ethical considerations, supply chain vigilance, and the weaponization of commonplace technologies.

Firstly, individuals and organizations must be acutely aware of the potential for seemingly innocuous "citizen apps" to be repurposed as sophisticated spyware. Defenders should educate users about the permissions requested by such applications and the potential for surveillance, especially in regions with authoritarian governments. Rigorous APK analysis and runtime monitoring should be standard practice for any application promoted by state entities.

Secondly, the pervasive use of third-party web analytics, such as Google ID, Google Analytics, and Tag Manager, on government websites poses a significant risk to citizen privacy and safety. Defenders, particularly in democratic nations, should advocate for stricter regulations and independent audits of how government entities collect and utilize citizen data, especially when involving foreign-owned platforms. For those operating in or assisting populations in repressive states, the advice is to use tools that block JavaScript and analytics scripts when accessing sensitive government portals, as Kubecka did. This highlights the need for user-side privacy tools and browser configurations.

Thirdly, the integrity of democratic processes hinges on transparency. Kubecka's experience with the hacked Netherlands referendum and the push for open-source voting tabulation software underscores the importance of public inspectability. Defenders should advocate for open-source election software and hardware, allowing independent security researchers to scrutinize code for vulnerabilities and backdoors, thereby building public trust and resilience against interference.

Fourthly, major technology companies like Google, Apple, and Starlink bear a significant ethical and legal responsibility. Their services, even if designed for legitimate purposes, can be weaponized by authoritarian regimes and criminal organizations. Defenders should apply pressure on these companies to enforce sanctions, conduct thorough due diligence on their clients, and implement robust ethical guidelines to prevent their platforms from facilitating human rights abuses. The case of Starlink providing services in sanctioned regions for drug cartels and cyber slave operations is a stark example of this failure.

Finally, Kubecka's call to action for "digital sabotage" and "hacking for democracy" offers a framework for proactive defense. This involves:

• Coordination: Building networks with like-minded cybersecurity professionals, journalists, and activists.
• Ethical Digital Sabotage: Employing tactics (like turning off antivirus, 2FA, logging, or adding "any any firewall rules") with plausible deniability to disrupt oppressive systems without endangering individuals.
• Leveraging AI and Big Data: Using AI as a "helper" for tasks like automating the mapping of propaganda websites, creating thousands of counter-propaganda sites with real information, generating dossiers on corrupt officials, and tracking illicit financial flows. However, Kubecka stresses that "you would not only use AI because then you're going to fail," emphasizing the necessity of human oversight and critical thinking.
• Prioritizing Human Safety: All operations must prioritize the safety of individuals, especially those being targeted by the regime.
• Working with Journalists: Collaborating with journalists to apply pressure on politicians, expose corruption through credible reporting, and leverage freedom of information requests.

Ultimately, Kubecka posits that the cybersecurity community represents a "cyber army" with the skills and opportunity to utilize technology against dictator technology, reclaiming the digital battlespace for freedom and human rights.

Key Takeaways

• Authoritarian Regimes Weaponize Everyday Tech: Dictatorships actively repurpose common digital tools like citizen apps and web analytics (e.g., Google ID, Google Analytics, Tag Manager) into sophisticated surveillance and repression instruments, turning citizens' phones into "spies in their pockets" and government websites into tracking mechanisms.
• Big Tech's Ethical and Legal Responsibilities: Major technology companies often fail to adequately enforce sanctions or scrutinize how their services are used, inadvertently (or negligently) facilitating human rights abuses and criminal enterprises by authoritarian regimes and cartels.
• Digital Sabotage and OSINT are Potent Counter-Tools: Leveraging open-source intelligence, forensic analysis, and ethical digital sabotage can effectively expose corruption, disrupt propaganda, and provide critical support to vulnerable populations under oppressive rule.
• AI Augments, But Doesn't Replace, Human Expertise: AI tools like Zero Day GPT and Pirate GPT can significantly enhance capabilities for intelligence gathering, propaganda mapping, and counter-operations, but human oversight, ethical considerations, and critical thinking remain paramount to avoid failure.
• Coordination is Key for "Hacking for Democracy": A united front of cybersecurity professionals, activists, and journalists is essential to apply pressure, expose truths, and effect change, especially in combating transnational digital oppression.
• The Fight is Geopolitical and Multi-faceted: The struggle against digital authoritarianism is deeply intertwined with geopolitics, international drug trade, and human rights, requiring a comprehensive approach that addresses technical, ethical, and political dimensions.

About the Speaker(s)

Chris Kubecka is the CEO of HypaSec, a company specializing in cybersecurity. Her career is marked by an extraordinary breadth of experience across various high-stakes domains. She previously served in the US Air Force as an aviator and with Space Command, demonstrating an early engagement with advanced technology and national security. Kubecka gained significant notoriety for heading the information protection group for Aramco during and after a massive cyberattack by the Iranians, showcasing her expertise in incident response and critical infrastructure protection. She also handles nuclear and maritime incidents, further highlighting her involvement in areas of extreme sensitivity and national importance. Up until recently, she was slated to be the United States' top expert in generative AI and cyber warfare with the US Defense Science Board, a position from which she was "fired by Trump." Describing herself as a "very curious person with a lot of skills," Kubecka is known for her propensity to "hack everything, land, sea, space, and air." She is also a registered journalist in the Netherlands, using her platform to expose corruption and advocate for human rights. Her personal background as a Puerto Rican, with a deep understanding of censorship and surveillance, fuels her passion for "hacking for democracy."