A Typhoon hits Massachusetts

Summary

Click Here Podcast Summary Episode: "A Typhoon hits Massachusetts" | Released: April 29, 2025

---

Introduction to Littleton and Nick Lawler

The episode opens with a picturesque portrayal of Littleton, Massachusetts—a quaint town of approximately 10,000 residents characterized by its rural charm and tight-knit community. Host Dena Temple-Raston introduces listeners to Nick Lawler, the dedicated manager of Littleton's municipal utility, which provides essential services such as light, water, and power.

Nick Lawler [00:55]: "I always love the public power model. It's great to go to a place every day that you provide an essential service to the residents you serve and then to have their appreciation for that back."

Nick emphasizes the fulfillment derived from serving the community, highlighting the direct satisfaction that comes from such a public service role.

The Suspicious Call

On a typical Friday afternoon in the fall of 2023, Nick receives an unusual phone call while maintaining his lawn. The caller, claiming to represent the FBI, urgently instructs him to contact the FBI and provide his personal email address followed by clicking a link.

Nick Lawler [01:13]: "We need your personal email address. So if you can give us your personal email address, that'd be great. We then want you to click on a link."

Despite the alarming nature of the call, Nick remains composed. His extensive background in cybersecurity and familiarity with common scams prompt him to hang up and continue his day undisturbed.

Nick Lawler [02:50]: "That you know, this is ridiculous. I'm getting a scam right now, but."

Nick's skepticism is further reinforced by his proactive approach to cybersecurity within the municipal utility, which has been recognized at national conferences for its preparedness against cyber threats.

Verification and the Arrival of Agents

Unsure about the legitimacy of the initial call, Nick takes the prudent step of directly contacting the local FBI field office. The response he receives deepens the mystery and urgency of the situation.

Nick Lawler [03:19]: "What is going on here?"

Shortly after, on the morning before Thanksgiving, two individuals presenting themselves as Homeland Security and FBI agents arrive in Littleton. Their professional demeanor and provision of a pamphlet about Volt Typhoon, a notorious Chinese state-sponsored hacking group, signal the gravity of the situation.

Nick Lawler [07:02]: "They're the top priority in the federal government... Littleton, Massachusetts, population 10,001 substation a top priority."

Understanding Volt Typhoon

Volt Typhoon is revealed as a sophisticated cyber threat targeting critical infrastructure across the United States. Unlike typical cyberattacks, Volt Typhoon operates stealthily, avoiding obvious signs such as ransomware demands or overt messages. Instead, they infiltrate IT systems to position themselves within networks, laying the groundwork for potential future disruptions.

Nick Lawler [07:08]: "They put a pamphlet in front of me. It's got nation state, actor, Volt Typhoon."

John Burns from Dragos, a cybersecurity firm, explains that Volt Typhoon’s methods involve minimal footprints, making detection challenging. His team uses a comprehensive list of malicious IP addresses to identify and mitigate the threat within Littleton's systems.

Sue Gordon [08:25]: "I went in and started looking, and I very quickly was able to see that there was some really weird traffic going from a couple of their servers to some malicious IPs were geolocating to China."

The Breach and Its Implications

The breach in Littleton occurred through a commonly exploited vulnerability: a third-party IT vendor failed to apply a necessary firmware upgrade, allowing Volt Typhoon to gain access. Fortunately, the segregation between IT and Operational Technology (OT) systems in Littleton's infrastructure prevented the hackers from accessing critical physical control systems.

Nick Lawler [09:38]: "They never did gain access to any customer information or our OT systems."

In response, the municipal utility swiftly overhauled its cybersecurity measures, including changing IP addresses, restructuring networks, implementing multi-factor authentication, and upgrading firewalls. A subsequent stress test by the Cybersecurity and Infrastructure Security Agency (CISA) confirmed the effectiveness of these defenses.

Nick Lawler [11:30]: "We changed IP addresses, we changed structure, we got multi Factor authentication across the board. Now new firewalls."

Broader Impact of Volt Typhoon

Volt Typhoon's infiltration is not an isolated incident confined to Littleton. The group has compromised approximately 200 other U.S. utilities, positioning themselves to potentially disrupt vital services nationwide during geopolitical crises or conflicts. This advanced and methodical approach to cyber warfare underscores the evolving nature of threats faced by critical infrastructure.

Dena Temple-Raston [14:24]: "Volt Typhoon was doing this quiet hack to pre position themselves on infrastructure networks across the country."

Experts like Sue Gordon from Dragos emphasize that small utilities serve as testing grounds for larger-scale attacks, allowing adversaries to refine their techniques before targeting more significant systems.

Sue Gordon [15:54]: "If I was an adversary and I was wanting to test my ability to make an attack on a bigger target, I think it's cheaper for an adversary to test their tools on a smaller target rather than put in place their own infrastructure to test their tools."

Challenges in Cybersecurity Awareness and Funding

Despite the severity of Volt Typhoon's activities, awareness within the utility sector remains limited. At a cybersecurity summit, only half of the attendees were familiar with Volt Typhoon, highlighting a significant gap in industry knowledge and preparedness.

Nick Lawler [20:01]: "And when I asked how many had heard of old Typhoon, only half the hands went up."

The episode also touches on the critical role of government funding and public-private partnerships in bolstering cybersecurity defenses. Sue Gordon expresses concern over potential cuts to cybersecurity grants, which are essential for maintaining and enhancing the security posture of utilities and other critical infrastructure.

John Burns [18:08]: "It's incredibly worrisome when that's the approach you take of a line item that you can't trace to some immediate benefit."

Nick Lawler's Reflection on Cyber Warfare

Reflecting on the incident, Nick acknowledges the pervasive nature of cyber threats and the reality of living in a state of constant vigilance.

Nick Lawler [20:26]: "The whole thing's mind blowing. ... this is cyber warfare."

He underscores the importance of transparency and communication within the industry to foster a collective defense against such sophisticated adversaries.

Nick Lawler [19:19]: "If we're not willing to talk about it as victims, then how do we expect our peers to ever hear of it?"

Conclusion

"A Typhoon hits Massachusetts" delves deep into the intricate and often invisible world of cyber warfare targeting critical infrastructure. Through Nick Lawler’s firsthand experience, the episode illustrates the vulnerabilities small-town utilities face from state-sponsored hackers like Volt Typhoon. It emphasizes the need for heightened awareness, robust cybersecurity measures, and sustained government support to protect the backbone of our digital and physical infrastructure.

---

Notable Quotes:

• Nick Lawler [00:55]: "I always love the public power model. It's great to go to a place every day that you provide an essential service to the residents you serve and then to have their appreciation for that back."

• Nick Lawler [02:50]: "That you know, this is ridiculous. I'm getting a scam right now, but."

• Nick Lawler [07:02]: "They put a pamphlet in front of me. It's got nation state, actor, Volt Typhoon."

• Sue Gordon [15:54]: "If I was an adversary and I was wanting to test my ability to make an attack on a bigger target, I think it's cheaper for an adversary to test their tools on a smaller target rather than put in place their own infrastructure to test their tools."

• Nick Lawler [20:26]: "The whole thing's mind blowing. ... this is cyber warfare."

---

This episode of Click Here masterfully weaves a narrative that not only highlights the specific challenges faced by Littleton's municipal utility but also sheds light on the broader implications of cyber threats to national infrastructure. It serves as a crucial reminder of the importance of cybersecurity vigilance in an increasingly interconnected world.

Transcript

[Dena Temple Rastin]

From Recorded Future News and prx, this is Click Here. Littleton, Massachusetts, is a town of about 10,000 people. It's the kind of place with more cows than coffee shops, where neighbors wave from porches, and where a conversation about wastewater management with the head of the local utility can happen between the Frosted Flakes and Raisin Bran at the grocery store.

[Nick Lawler]

It does happen a lot in town. I have a direct contact with the people that we serve and well loved in the community.

[Dena Temple Rastin]

That's Nick Lawler. He runs Littleton's municipal utility. He provides light, water, and power. It's not glamorous, but it matters. And that's what Nick loves about it.

[Nick Lawler]

I always love the public power model. It's great to go to a place every day that you provide an essential service to the residents you serve and then to have their appreciation for that back. I don't think there's many jobs in the country that you get that direct satisfaction from.

[Dena Temple Rastin]

One Friday afternoon in the fall of 2023, Nick was outside bowing the lawn when his phone started to buzz. The caller said Nick needed to ring the FBI. No real details, just call the FBI. So he did, and that's when Nick got the bad news. The voice on the other end said Littleton's utility had been hacked. And then almost right away, the voice said, don't worry, I'm here to help. Nick just needed to give the voice some information.

[Nick Lawler]

We need your personal email address. So if you can give us your personal email address, that'd be great. We then want you to click on a link.

[Dena Temple Rastin]

Now, Nick wasn't born yesterday. So when someone called claiming to be the FBI and told him to click on a link, he didn't panic and he didn't click. Instead, he hung up and went back to his mowing. Because if it was a scam, he wasn't going to fall for it. There's another reason Nick didn't buy all this. Littleton's utility wasn't flying blind when it came to cybersecurity. Far from it.

[Nick Lawler]

We've always taken it seriously. We've presented at national conferences as what do small utilities do? And how can you be prepared for these events? We had policies in place. We, you know, had cyber insurance like we. We do employee training. We very much thought that we were leading the way.

[Dena Temple Rastin]

So they weren't just prepared. They were an example. So when the call came, it just didn't sit right. And what was going through your mind.

[Nick Lawler]

That you know, this is ridiculous. I'm getting a scam right now, but.

[Dena Temple Rastin]

Still, you never really know.

[Nick Lawler]

But you know, you play it out.

[Dena Temple Rastin]

So he did. He decided to call the local FBI field office himself, the real one, just to be sure.

[Nick Lawler]

I called back the number that I looked up online. I asked for that gentleman and he answered the phone. Oh, okay. Nick, you're back. Yeah. It's like, what is going on here?

[Dena Temple Rastin]

What was going on was bigger than Nick ever imagined. It was the beginning of an unlikely story about a small town utility, Chinese state hackers, and the choices Nick would have to make to stop them. I'm Dena Temple Rasted and this is Click Here. A podcast about all things cyber and intelligence. We tell true stories about the people making and breaking our digital world. And today, a quiet threat hiding out in our infrastructure. Water, power, lighting, gas, all of it. And how foreign adversaries are quietly positioning themselves to potentially take it down.

[Nick Lawler]

No, I know now it's. I mean, everybody is a target.

[Dena Temple Rastin]

Stay with us.

[James King]

For decades, China's economic rise has been symbolized by the unstoppable force of low cost manufacturing. But today, a new and far more disruptive wave of competition is unfolding. One that threatens not just western manufacturing, but also the West's geopolitical dominance. I'm journalist James King, and in my new audiobook, Global Tech wars, from Pushkin Industries and the Financial Times, I'm unpacking what China's rapid technological ascent across cutting edge industries like artificial intelligence, electric vehicles and surveillance technology means for the future. Find Global Tech wars at Pushkin fm, audiobooks, Audible, Spotify, and wherever audiobooks are sold.

[John Burns]

From.

[Dena Temple Rastin]

Recorded future news. This is Click Here. I'm Dina Temple. Rest. Even after calling the FBI directly, Nick Lawler still wasn't convinced this was real. And he told the guys much.

[Nick Lawler]

Listen, I can't comprehend what you're saying right now. It seems very fishy. You know, if you're really who you say you are, you know, why don't you come to our office Monday morning? I want you to tell me to my face.

[Dena Temple Rastin]

He hung up and he figured that was the end of it. But then on the Monday morning, just before Thanksgiving, Nick Lawler was in his office sipping coffee, checking in with his team, his usual morning routine.

[Nick Lawler]

Until all of a sudden I get a call from, from our front office saying that there's two gentlemen here from one from Homeland Security, one from the FBI.

[Dena Temple Rastin]

Did they look like feds?

[Nick Lawler]

Yeah, it looked like Men in Black. You had two guys in suit and ties, collared shirts.

[James King]

We're the Men in Black. We have a situation and we need your help.

[Nick Lawler]

I'm thinking in my head, do these two guys just go to the store and buy suits? And is this the trap? Like, what is the trap you keep trying to figure out because you're just so skeptical.

[Dena Temple Rastin]

It didn't help when one of them introduced himself as Daniel King. If you're a Cold War trivia buff or just mildly paranoid, the name might ring a bell. Daniel King was an American sailor accused of spying for the Russians.

[Nick Lawler]

So now your mind's even going more like, whoa, was this the spy dealer King that was in here? But I played along with them. I still wasn't sure why they were.

[Dena Temple Rastin]

Nick brought them back into the conference room. That's when the 2G men slid a pamphlet across the conference table to him.

[Nick Lawler]

They put a pamphlet in front of me. It's got nation state, actor, Volt Typhoon.

[Dena Temple Rastin]

Volt Typhoon, a Chinese state sponsored hacking group known for quietly targeting critical infrastructure. And had you ever heard of Volt Typhoon before they gave you this literature on it?

[Nick Lawler]

No. No.

[Dena Temple Rastin]

They explained the threat. They'd been seeing quiet probes into infrastructure all across the country, and it looked like Littleton was among the targets. And then they said they could help.

[Nick Lawler]

But we don't need you to make a decision today. This isn't ransomware. This isn't something that's going to happen tomorrow. Take your time, enjoy Thanksgiving, and then call us back. Yeah, that was kind of my response. I kind of laugh. Enjoy Thanksgiving. If this is real, how can I enjoy Thanksgiving?

[Sue Gordon]

Nick definitely seemed like he was frazzled, but, I mean, who wouldn't be when they got a phone call from the FBI?

[Dena Temple Rastin]

This is John Burns. He leads threat hunting at Dragos, a cyber security firm that specializes in threats like this. And months before, John's team had started working with Littleton, helping them beef up their defenses against cyber attacks.

[Nick Lawler]

And then I met with old Typhoon, and they're. I heard the sigh of panic, so I'm like, okay, well, at least.

[James King]

At least.

[Nick Lawler]

At least that's real.

[Sue Gordon]

Our adversary hunters were already tracking it as a. As a threat group that was doing things out in the wild. But we hadn't seen it in any customer environments yet.

[Dena Temple Rastin]

Until now. John told Nick that Volt Typhoon doesn't leave many fingerprints. There's no ransomware screen, no ransom notes.

[Sue Gordon]

There's no message or calling card. There's no, like, banner that pops up that says, hey, this is Volt Typhoon in your environment.

[Dena Temple Rastin]

Instead, they slip in like a ghost and then just wait. It's not a smash and grab. With them, it's a long con. Dragos also had something most others didn't. A list of some 35,000 IP addresses that had been tied to Volt Typhoon in the past. So John and his team went hunting for those in Littleton's systems.

[Sue Gordon]

I went in and started looking, and I very quickly was able to see that there was some really weird traffic going from a couple of their servers to some malicious IPs were geolocating to China.

[Nick Lawler]

So that's when I knew it was real.

[Dena Temple Rastin]

Now that Nick had confirmed that the threat was real, the question became, how did it happen? And it turns out, for as ominous as the threat sounded, a nation state hacker in your network. The attack itself happened in the most pedestrian of ways. The vulnerability came from a third party IT vendor.

[Nick Lawler]

They got an alert saying, hey, we need a firmware upgrade because of a known vulnerability. And they never did that upgrade.

[Dena Temple Rastin]

So it was basically a patch that wasn't done, correct?

[Nick Lawler]

Yep. I would say within days of that vulnerability being known, Volt Typhoon had gained access. They probably ran some sort of algorithm that. That put us on a list of people they wanted to try to infiltrate.

[Dena Temple Rastin]

Needless to say, Littleton canceled that vendor's contract. But as John and his team and Dragos looked further, they did uncover one piece of good news about the hack.

[Nick Lawler]

Now, they never did gain access to any customer information or our OT systems.

[Dena Temple Rastin]

OT or Operational Technology systems. OT systems control the physical world, like turning water on and off or managing safety sensors. If a hacker could control that, they can shut the whole system down. But in this case, the hackers had only made it into Littleton's IT systems, the part of the network that controls more virtual things like email. And that was by Littleton's design. They had drawn the line between IT and OT systems and put a strong firewall between them. And that line held. So the hackers never had control over the physical plant. Now that they confirmed that they had an intruder, they got to work rebuilding the perimeter, patching the holes.

[Nick Lawler]

We changed IP addresses, we changed structure, we got multi Factor authentication across the board. Now new firewalls.

[Dena Temple Rastin]

The whole operation took about a month. And then, just in case, they ran a stress test. Last summer, cisa, one of the government cyber divisions, came back and did an exercise. CISA tried every which way to break past Littleton security for three long weeks. As Nick held his breath, they were.

[Nick Lawler]

Unsuccessful to get in. So we believe that we closed any doors that Vol Typhoon might have opened. But it's one of those things, you know, IT'S a strange feeling once they're in. I don't think you ever sleep to see him at night thinking that, you know, did they somehow leave something somewhere you didn't find?

[Dena Temple Rastin]

And there was this other thing still keeping him up at night. One question he couldn't answer. Why them? Why Littleton? That's when we come back.

[Andrew Ferguson]

If you're looking for a daily guide to cybersecurity news and policy, sign up for the Cyber Daily from Recorded Future News. It serves up today's most interesting and important cyber stories from our sister publication, the Record, and then aggregates all of the big cyber stories you might have missed from news outlets around the world. Just go to the Record Media and click on Cyber Daily to get all you need to know about the world of cybersecurity. Right in your inbox.

[James King]

ChatGPT, AI machines, satellite engine ignition.

[Dena Temple Rastin]

Click here.

[John Burns]

And the liftoff.

[Dena Temple Rastin]

When Nick Lawler was sitting in that conference room, the Volt Typhoon pamphlet in front of him, the men in suits across the table, they kept saying this one thing.

[Nick Lawler]

They made it very clear on several occasions that we were the top priority in the federal government, which I kind of chuckled.

[Dena Temple Rastin]

Littleton, Massachusetts, population 10,001 substation a top priority. Nick was dubious until they explained why Vault Typhoon doesn't behave like most hackers. They don't lock you out, they don't demand Bitcoin, they don't brag on social media about their hacks. They just slip in quietly and kind of hang out.

[Nick Lawler]

They come in, they blend in, and then they might grab some files that look interesting to them. Then they get off. That's what makes it hard to catch them. They're not actively on your system, but they're actively making sure that their access is still there. So every couple months, I think they're coming back in. Okay. Yep, Good. That door's still open. Or we still have access to what we need to get access to. And that's it.

[Dena Temple Rastin]

Volt Typhoon was doing this quiet hack to pre position themselves on infrastructure networks across the country. They were lying in wait for the moment when something went south. A war, but diplomatic crisis. And then they'd already be inside, ready and waiting to attack. And it turns out it wasn't just Littleton. Volt Typhoon had cracked into Systems in some 200 other US utilities in places where Volt Typhoon gained access to operational technology. It was more than just lurking inside a network. Theoretically, they could cut the power, they could stop the flow of water. They could even disable critical utilities near military installations and this isn't hypothetical. It's already happened elsewhere. During the pandemic, Russian hackers locked up Colonial pipelines billing system, crippling fuel deliveries up and down the Eastern Seaboard for days. And then there was jbs, the world's largest meat processing company. In that case, a Russian ransomware group shut it down for days. And according to the suits, China's Volt Typhoon was putting the pieces in place to be able to do something like that. And there's this other thing that makes small towns targets. They often are home to big things like military bases or nuclear facilities. They're also just a good place to sort of run a dress rehearsal for larger attacks. John Burns from dragos.

[Sue Gordon]

Again, if I was an adversary and I was wanting to test my ability to make an attack on a bigger target, I think it's cheaper for an adversary to test their tools on a smaller target rather than put in place their own infrastructure to test their tools. I would probably go test it on a small utility or a small water company to test and make sure that my compromised tools work before I went and deployed them on a big hit and a big attack.

[Dena Temple Rastin]

It used to be that if you attacked a town like Littleton, it wouldn't teach you much about how to attack Boston or Baltimore. Systems were all different, but not anymore.

[Sue Gordon]

It used to be very, very heterogeneous out in the world where it was like every control system was completely different. And you. If you compromised one, it was like, okay, no big deal. You really can't compromise another one just because you compromised this first one. It's kind of a one off. But now we're kind of getting into this homogenous era where everything's there. It's all about repeatability and scalability. So if you can use a compromise in one place, I'm potentially vulnerable to the same attack because of that. And people need to understand that.

[Dena Temple Rastin]

Which is how Littleton becomes a gateway to New York, to D.C. everyone is.

[John Burns]

Either target or transportation.

[Dena Temple Rastin]

Tell me what you mean by that.

[John Burns]

You either have something they want, or you are the path to get to the thing that they want.

[Dena Temple Rastin]

This is Sue Gordon. She used to be the number two at the Office of the Director of National Intelligence during the first Trump administration. We caught up with her to talk about Littleton at Vanderbilt's Future of War summit in Nashville back in April.

[John Burns]

What we do to protect the critical infrastructure has got to be done taking into account the fact that when you make it more orderly, you make it.

[Dena Temple Rastin]

More attackable, because being orderly makes things Predictable and by extension very hackable. Sue also worries when she sees Elon Musk's so called Department of Government Efficiency cut CyberSecurity grants, the U.S. government's strategy to protect vital infrastructure. A big part of that is public private partnerships, funding grants to help towns like Littleton beef up security against adversaries.

[John Burns]

I know if you're Doge and you see some dollars for something, it's hard to identify what that's going to yield 10 years from now. So I think it's incredibly worrisome when that's the approach you take of a line item that you can't trace to some immediate benefit that that becomes something you take away. Because it's that long time horizon work that has saved us over and over again over the course of our history. Now maybe it's not 30 years anymore, but sure, not one year.

[Dena Temple Rastin]

Because the federal government can see the pattern. They can spot how one compromised water system and one forgotten zip code can have ripple effects. So they invest in preventing that.

[John Burns]

Yeah, there are some things the government does really well. It tackles big problems that are too big for others. It has longer time horizons.

[Dena Temple Rastin]

Do you think that there are lots of Littletons out there that are totally vulnerable to these kinds of threats?

[John Burns]

Infinite.

[Dena Temple Rastin]

Wow. So that's why Nick Lawlor speaks up even when others don't or won't.

[Nick Lawler]

I mean, I know there's other utilities in New England that were hit and no one wants to talk about it. And if we're not willing to talk about it as victims, then how do we expect our peers to ever hear of it? And I think the first reaction from the public is how you let that happen. But you know, it's our job to explain it and it's our job to tell the public what we did right and tell the public what we didn't do right. So that way, hopefully it doesn't happen to you.

[Dena Temple Rastin]

Last September, Nick took the stage at a cybersecurity summit for the American American Public Power Association.

[Nick Lawler]

And when I asked how many had heard of old Typhoon, only half the hands went up. So this is a full year after we had been compromised. These are professionals that are in this part of the industry. Not about half of them have heard about Volt Typhoon.

[Dena Temple Rastin]

Did that surprise you?

[Nick Lawler]

I mean, it's hard to say it surprised me when a year before I didn't even hear of it. It doesn't surprise me, but it's unfortunate.

[Dena Temple Rastin]

And that's the part that sticks that one of the most sophisticated cyber operations China has ever Run could quietly reach into a tiny town with a single substation. But a year later, half the people responsible for keeping the lights on across America still hadn't even heard its name. So is it a little mind blowing when you think that a Chinese state hacker came after little, tiny Littleton? What does that make you feel like?

[Nick Lawler]

Well, the whole thing's mind blowing. And really, ever since this has happened, it's really heightened my awareness of the world that we live in today and the type of warfare that we're witnessing. And that's what this is. I mean, this is cyber warfare. I think James Comey had the quote, there's two types of companies in the world, one that have been infiltrated and compromised by the Chinese, and one that doesn't know it yet.

[Dena Temple Rastin]

This is qlik here.

[Andrew Ferguson]

If you're looking for a daily guide to cybersecurity news and policy, sign up for the Cyber Daily from Recorded Future News. It serves up the day's most interesting and important cyber stories from our sister publication the Record, and then aggregates all of the big cyber stories you might have missed from news outlets around the world. Just go to the Record Media and click on Cyber Daily to get all you need to know about the world of cybersecurity right in your inbox.

[Dena Temple Rastin]

Here are some of the top cyber and intelligence stories we're following, from a trial that could dismantle one of the most powerful companies in Silicon Valley to a global supply chain shift that's leaving American manufacturing behind, and a shakeup at the National Science foundation that could chill American research for years to come. It's Tuesday, April 29th. First, a major moment for big tech.

[Zach Hirsch]

The way America innovates is by promoting competition.

[Dena Temple Rastin]

That's FTC chair Andrew Ferguson commenting as we slip into the third week of a landmark antitrust trial against Meta, the company behind Facebook, Instagram and WhatsApp. At the heart of the case is whether Facebook illegally monopolized social media by buying up potential rivals before they could grow into real threats. Internal documents suggest that Meta CEO Mark Zuckerberg pursued what he called a buy or bury strategy, snapping up Instagram in 2012 and WhatsApp two years later. The FTC argues that these moves crushed innovation and hurt consumers. If the government wins the day, Instagram and WhatsApp could be forced to split off into separate companies, potentially gutting Meta's ad business and reshaping the digital economy. The case could drag on for months. Meanwhile, while Washington battles over who controls social media, American manufacturing is facing a different kind of threat Apple is looking to shift iPhone production out of China as tensions with China escalate, America's tech giants are making a different kind of move overseas. Apple is now expected to shift the majority of its iPhone production for the US market to India by the end of 2026. The shift comes after years of rising tariffs and uncertainty between Washington and Beijing. Today, nearly 80% of American iPhones are made in China, but that's changing fast. India's labor is more expensive, but it's seen as safer. And Apple isn't alone. Analysts predict other companies like Go, Google and Microsoft will follow their lead. It's a massive realignment of the global supply chain, just not the one US Policymakers were hoping for. And finally, even the world of scientific research isn't immune from Washington's shifting priorities.

[James King]

The Trump administration is waging a wholesale assault on US Science.

[Dena Temple Rastin]

Last week, the National Science Foundation, America's largest independent funder of basic research, canceled more than $230 million in grants. The cuts targeted projects linked to diversity, equity and inclusion, or dei, and efforts to counter misinformation. But the definition of DEI appears to be unusually broad. Grants supporting bird conservation and even research on government censorship in authoritarian countries like Iran and China were abruptly axed. Critics say it's injecting politics into science, a move that could set American research back for years. Adding to the upheaval, NSF's director resigned Thursday after five years at the helm, leaving a leadership void at a crucial moment.

[Zach Hirsch]

Today's episode was written and produced by Megan Dietrich, Sean Powers, Erica Gaeda, Dina Temple Rastin, and the lead producer was me, Zach Hirsch. It was edited by Karen Duffin, Fact Checked by Darren Ancrum, and contains original music by Ben Levingston with some other music from Blue Dot Sessions. Our staff writer is Lucas Riley, and our illustrator is Megan Gough. Martin Peralta and Jesse Niswonger are our sound designers and engineers. Click Here is a production of Recorded Future News and prx. Tune in Friday for Mic Drop, which features our favorite interview of the week. We'll see you then.

[Andrew Ferguson]

If you're looking for a daily guide to cybersecurity news and policy, sign up for the Cyber Daily from Recorded Future News. It serves up today's most interesting and important cyber stories from our sister publication the Record, and then aggregates all of the big cyber stories you might have missed from news outlets around the world. Just go to the Record Media and click on Cyber Daily to get all you need to know about the world of cybersecurity right in your inbox.