• Who/What/When/Where/Why: Anthropic and a group of authors settled a 2024 U.S. copyright suit last week for $1.5 billion over alleged unauthorized use of books to train AI models, with the settlement aimed at resolving claims and imposing damages and data-removal terms.
• Settlement amount: $1.5 billion total.
• Per-book valuation: The settlement sets the value of a single infringed book at $3,000.
• Prior court ruling: Judge William Alsup had earlier held that training on lawfully purchased books was transformative and therefore fair use.
• Data and purge obligations: Anthropic agreed to destroy the datasets at issue and purge the allegedly illicit content from its systems.
• Strategic framing: The move is presented as a strategic retreat likened to General Kutuzov’s tactics—sacrificing a battle to reshape the broader litigation landscape.
• Implications for OpenAI: The $3,000 per-book metric and Anthropic’s purge heighten potential liability for OpenAI in separate suits, which also involve allegations of illicit outputs and evidence-spoliation issues and could make OpenAI the anchor defendant in multidistrict litigation.
• Anthropic’s future exposure: The class settlement covers virtually every registered work in its ingested datasets and likely forecloses most follow-on suits against Anthropic, even as broader litigation against generative AI is expected to grow.

You may also like

Up Next

Embed code copied to clipboard

[Facebook](https://www.facebook.com/sharer/sharer.php?u=https://www.wsj.com/video/series/journal-editorial-report/wsj-opinion-hits-and-misses-of-the-week/EC802186-5B22-4C1D-8275-B5A7EEFE8206&t=WSJ Opinion: Hits and Misses of the Week "Share on Facebook")

[Twitter](https://twitter.com/intent/tweet?url=https://www.wsj.com/video/series/journal-editorial-report/wsj-opinion-hits-and-misses-of-the-week/EC802186-5B22-4C1D-8275-B5A7EEFE8206&text=WSJ Opinion: Hits and Misses of the Week "Share on Twitter")

Your browser does not support HTML5 video.

0:10

Paused

0:01 / 1:29

Journal Editorial Report: The week’s best and worst from Allysia Finley, Kyle Peterson and Kim Strassel.

The AI company Anthropic last week did something unexpected. A group of authors had sued the company in 2024, accusing it of using their books to train its AI models without permission. Just as the tide seemed to be turning in the company’s favor in the suit, Anthropic, best known for its Claude chatbot, settled for a landmark $1.5 billion. It agreed to destroy the data used to train its models and set the value of a single infringed book at $3,000. No other AI company being sued by authors has offered anything close.

Anthropic made this move immediately after it secured a favorable ruling. Judge William Alsup had held that training on lawfully purchased books was transformative, and therefore fair use. The plaintiffs’ theory had narrowed from a copyright suit to one on how Anthropic obtained the books, which plaintiffs alleged were from pirated libraries. Anthropic looked poised, if not to win outright, to wear down the plaintiffs through a long and costly battle. So why settle?

A strategy worthy of Gen. Mikhail Kutuzov—that’s why. Like the commander of Russia’s forces amid Napoleon’s failed invasion in 1812, Anthropic seems to be choosing to rewrite the battlefield in its favor rather than win a single battle, even one that’s seemingly pivotal.

After Kutuzov’s surrender of Moscow, the French emperor believed himself triumphant. The Russian army had retreated. The city had been abandoned to French forces. The campaign, it seemed, was complete. But it had only begun.

Kutuzov understood something his adversary didn’t. The purpose of war isn’t to capture cities; it’s to outlast conditions. By yielding Moscow, he bought time. By burning it, he denied the French an ounce of comfort. By drawing Napoleon deep into the continent, he consigned the Grand Armée to a fate no strategy could overcome. Kutuzov handed the war over to what would have been a troublesome foe had he stayed to fight: the Russian winter.

Like Kutuzov, Anthropic shaped its loss to trigger a larger force—entrepreneurial litigation now armed with a dangerously high price—and left its corporate rival, OpenAI, squarely in the crosshairs. Anthropic has burned and abandoned Moscow and now waits for the cold to set in.

Anthropic built its trap from arithmetic. Throughout the litigation, the price per pirated book was theoretical. No longer: It is now $3,000. That number can be applied across tens or hundreds of thousands of works in lawsuits that are still under way.

This math will be ruinous to OpenAI, which faces litigation in New York and other states. It was already in a weaker position than Anthropic had been in its suit. The facts are murkier. OpenAI’s cases involve more-complex sourcing for the training data under scrutiny and procedural questions about spoliation, such as whether OpenAI’s deletion of training and output logs constitutes the wrongful destruction of evidence. And while Anthropic settled only regarding alleged illicit inputs, OpenAI is accused of illicit outputs as well: Authors allege that GPT models regurgitate copyrighted passages verbatim. OpenAI denies any wrongdoing.

If the price of allegedly misusing a single book in training is $3,000, the cost of doing so and echoing an author’s voice line for line will surely be higher. Perhaps even more dangerous for OpenAI is Anthropic’s agreement to purge the allegedly illicit content. Anthropic can apparently sever the data over which authors sued from its system. But OpenAI likely can’t purge the data it got from the massive data sets concerned in its lawsuits, some of which have been deleted and are therefore even harder to entangle from the rest of the training data.

OpenAI’s legal problems are also likely to expand. It’ll probably be the anchor defendant in the mass-tort multidistrict litigation that Anthropic has now made inevitable. While an AI-company victory in Anthropic’s suit may have scared off many potential plaintiffs, the settlement creates an enticing financial incentive to sue. Copyright suits have gone from a niche area to a potential gold rush for lawyers.

But Anthropic itself is likely safe from further lawsuits. The class it settled with includes virtually every author whose registered works appeared in the datasets the company’s models ingested. The settlement forecloses almost all viable follow-on suits. Unless Anthropic uses new infringing material or outputs something egregious, its litigation exposure is over.

The legal campaign against generative AI will still grow. But Anthropic has retreated from the fight, removing itself from the mass-tort model. It’s OpenAI that now faces a bitter cold.

Mr. Klapper is founder and CEO of Learned Hand AI.

PHOTO: GABBY JONES/BLOOMBERG NEWS

• Who/What/When/Where/Why: In January OpenAI CEO Sam Altman and CPO Kevin Weil demonstrated ChatGPT’s upcoming “deep research” app to a Beltway audience, showing it could draft a memo preparing a fictional senator for Albert Einstein’s confirmation as energy secretary to showcase the model’s research capabilities.
• LLM capability: Large language models (ChatGPT, Google Gemini, Anthropic Claude) excel at locating, synthesizing and connecting existing knowledge but do not generate new knowledge.
• Human knowledge creation: Humans often produce novel insights when answering questions driven by incentives (salary, fame, tenure, clicks, curiosity), incentives that may diminish if LLMs dominate question-answering.
• Stack Overflow impact: A study found Stack Overflow questions fell 25% six months after ChatGPT’s introduction relative to similar sites; as of this month the site’s questions are reported to be down more than 90%.
• Wikipedia and web traffic: Research by Hannah Li and co-authors found declines in views and edits for Wikipedia pages similar to ChatGPT outputs after ChatGPT’s launch, and Google’s AI answers have sharply reduced referral traffic to publishers.
• Antitrust and search: Judge Amit Mehta ruled Google had an illegal monopoly in search but imposed light penalties, noting AI could present a genuine challenge to Google’s dominance.
• Risks of feedback loop: Columbia’s Hannah Li warned that training LLMs on other LLM outputs can degrade model quality (“model collapse”), likened to passive investing reducing price discovery in markets.
• Cognitive engagement and personal research: An MIT study found essay writers using LLMs showed less brain engagement than those using search or memory, and a separate personal search into Einstein yielded diverse historical details beyond the demo’s summary.

Illustration: Rachel Mendelson/WSJ, iStock

In January, OpenAI Chief Executive Sam Altman and Chief Product Officer Kevin Weil hosted a demonstration of ChatGPT’s soon-to-be-released “deep research” application. A Beltway audience watched as Weil asked ChatGPT to prepare a memo briefing a fictional senator for the confirmation of Albert Einstein to be energy secretary.

ChatGPT soon produced a thorough profile of Einstein, listing his technical and engineering accomplishments, leadership style, strengths (“a globally respected scientist-statesman”) and weaknesses (“never managed a large organization”) plus questions the senator could ask (“You have been an outspoken voice on nuclear issues since WWII. As Energy Secretary, how will you ensure the safety of nuclear power plants and uphold U.S. commitments to nuclear nonproliferation?”).

The benefits of such impressive, and now routine, capabilities, were obvious: enormous savings of time and effort. Of course, there were potential costs: How many jobs could researchers, writers and other knowledge workers lose to artificial intelligence?

I wondered about a different cost: How much knowledge will be lost to AI? Large language models (LLMs) such as ChatGPT, Google Gemini and Anthropic’s Claude excel at locating, synthesizing and connecting knowledge. They don’t add to the stock of knowledge.

By contrast, when humans answer questions, such as whether Einstein should be energy secretary, they often pursue novel avenues of inquiry, creating new knowledge and insight as they go. They do this for a variety of reasons: salary, wealth, fame, tenure, “likes,” clicks, curiosity.

If LLMs come to dominate the business of answering questions, those incentives shrivel. There is little reward to creating knowledge that then gets puréed in a large language blender.

Consider the fate of Stack Overflow, a website where software developers ask and answer questions, becoming both a wellspring and repository for knowledge. 

But then developers started putting their questions to ChatGPT. Six months after its introduction in November 2022, the number of questions on Stack Overflow had fallen 25% relative to similar Chinese and Russian language sites where ChatGPT wasn’t an alternative, according to a study by Johannes Wachs of Corvinus University of Budapest and two co-authors.

The drop was the same regardless of quality, based on peer feedback, refuting predictions that AI would displace only low-value research.

As of this month, the number of questions is down more than 90%. Why should anyone other than Stack Overflow’s owners care? Because, as tech writer Nick Hodges explained in InfoWorld, “Stack Overflow provides much of the knowledge that is embedded in AI coding tools, but the more developers rely on AI coding tools the less likely they will participate in Stack Overflow, the site that produces that knowledge.”

Stack Overflow may be an extreme case. A different study found no similar decline on Reddit.

But there are signs of similar effects elsewhere. Many LLMs are trained on Wikipedia, a repository of knowledge compiled and curated by humans. Columbia University business professor Hannah Li and five co-authors found that between the year before and the year after ChatGPT’s launch, views fell for Wikipedia pages most similar to what ChatGPT could produce. Edits also dropped, a potential sign of less incentive to contribute, although the data were inconclusive.

Meanwhile, as Google has enabled users to answer queries through AI without clicking on links, web publishers large and small have seen referral traffic from search plummet.

Alphabet CEO Sundar Pichai in May. Google AI is reducing search referral traffic to publishers’ websites. PHOTO: JEFF CHIU/ASSOCIATED PRESS

Internet search itself is at risk. Last year, District Court Judge Amit Mehta found Google, a unit of Alphabet, had an illegal monopoly in search. But the dramatic growth of AI prompted him to impose surprisingly light penalties last week. “For the first time in over a decade, there is a genuine prospect that a product could emerge that will present a meaningful challenge to Google’s market dominance,” Mehta wrote.

If LLM output comes to dominate the web, the web will become, well, dumber. Columbia’s Li said in an interview: “What happens when we train LLMs on other LLM outputs? The overall outcomes get worse. The models get worse. This is what they call model collapse.”

There is a parallel in what index funds and other passive strategies have done to the stock market. They don’t do research and price discovery (the process of negotiation that reveals an asset’s value). Instead, they free ride on the research and price discovery of active investors. In other words, they exploit market efficiency without contributing to it. In the process, they are squeezing out active investing, leaving a market increasingly dominated by algorithms trading against each other.  

These are, I’ll admit, dystopian scenarios. I could tell a different story of how AI will help scholars discover connections between otherwise disparate bits of knowledge across the web. Joshua Gans, a University of Toronto economist who has written extensively on AI, thinks that so long as new knowledge has value, it will find a way to be created. He says when AI insights are incremental, humans will pivot to more truly novel research.

Maybe. But instead of pivoting, what if humans lose interest in learning altogether? Reliance on AI can cause critical thinking to atrophy, just as reliance on GPS weakens spatial memory. A study by Nataliya Kosmyna at Massachusetts Institute of Technology and seven co-authors asked three groups of subjects to write essays, one using an LLM, one using internet search, and one just their brains. Scans later showed the LLM group had the least engagement across brain regions such as for memory recall and executive functioning; the brain-only group had the most.

Mental engagement, the authors argue, is enhanced by “novelty, encountering new or unexpected content.” That resonates. Dissatisfied with OpenAI’s demo, I searched the web for biographies and writings of Einstein.

I learned his father’s company made electrical equipment based on direct current, then went bust when alternating current triumphed; that he was outspoken in support for civil rights in the U.S. and against oppression of Jews in Germany, for which the Nazis put a price on his head; that during the McCarthyite fervor of the 1940s and 1950s he was called a foreign-born agitator spreading communism; that he wasn’t a communist but was a socialist. In a 1949 essay for a socialist journal, he answered a question I often ponder: how economics differs from the physical sciences, like astronomy: “economic phenomena are often affected by many factors which are very hard to evaluate separately.”

I have no idea if any of that bore on his qualifications to be energy secretary. I could have spent the time on more productive work. But then, acquiring new knowledge has never felt like work.

Write to Greg Ip at greg.ip@wsj.com

• Who/What/When/Where/Why: The European Union fined Google €2.95 billion on a recent Friday in Brussels for abusing dominance in ad‑tech to favor its ad exchange, a move that drew President Trump’s ire amid sensitive U.S.–EU trade talks.
• Size and significance: The €2.95 billion (almost $3.5 billion) penalty is the EU’s second‑largest antitrust fine after a 2018 sanction and signals strong enforcement intent.
• Allegations and remedies: The Commission found Google abused its role in buying and selling digital ads across third‑party sites/apps to drive business to its ad exchange, gave 60 days for remedy proposals, and preliminarily indicated divestiture may be required.
• U.S. political reaction: President Trump called the action discriminatory and threatened a Section 301 trade investigation to “nullify the unfair penalties,” framing the dispute within ongoing tariff and trade negotiations.
• Parallel legal actions: The EU case follows a four‑year probe running parallel to a Justice Department antitrust case; a U.S. judge found Google created a monopoly and DOJ has urged selling parts of its ad‑tech business.
• Google’s response: Google said it will appeal, called the decision wrong and unjustified, and asserted its ad‑tech services face increasing alternatives, according to Lee‑Anne Mulholland.
• Economic context: Google’s ad‑tech business accounted for roughly 10% of its $71 billion advertising revenue in Q2; observers note fines alone often represent a small fraction of big‑tech revenues.
• Timing, procedure and stakeholders: The EU delayed an initial Sept. 1 announcement after trade chief Maroš Šefčovič raised concerns; the Commission said internal procedures were completed, antitrust chief Teresa Ribera framed the decision as reaffirming enforcement, and the European Publishers Council urged stronger measures beyond a fine.

Your browser does not support HTML5 video.

Explained: Trump's EU Trade Deal and What Comes NextPlay video: Explained: Trump's EU Trade Deal and What Comes Next

Keep hovering to play

In July, WSJ reporter Kim Mackrael explained Trump’s EU trade deal and what could come next. Photo: Andrew Harnik/Getty Images

BRUSSELS—The European Union fined Google nearly $3.5 billion for abusing the dominance of its advertising-technology tools, a move that immediately stirred the ire of President Trump amid already delicate trade talks. 

The fine is the EU’s second-largest antitrust penalty ever, after another Google fine in 2018, and ramps up the threat on both sides of the Atlantic to one of the search giant’s bigger businesses.

The action prompted a swift response from Trump, who called the move discriminatory and threatened to open a Section 301 trade investigation “to nullify the unfair penalties” that he said are being charged to American companies. 

With the EU and U.S. in the middle of sensitive trade discussions, antitrust officials in Brussels had to overcome internal concern from the bloc’s trade chief before issuing the fine, people familiar with the matter said.

The European Commission, the EU’s antitrust regulator, said Friday that Google has abused its dominant role in the buying and selling of digital ads across third-party websites and apps to drive business to its own advertising auction house, known as an ad exchange. 

The bloc gave Google 60 days to propose how to resolve “inherent conflicts of interest,” but added that its preliminary view remains that Google must divest parts of that business. Fines alone haven’t tended to change big tech companies’ business practices because even large penalties represent a fraction of their overall revenue.

Still, the size of Friday’s fine suggests the EU isn’t giving up on its efforts to enforce tough measures against U.S. tech companies, despite pressure from the Trump administration, which has criticized European digital rules.

Issuing a fine in the billions carries political significance, said William Kovacic, a law professor at George Washington University. “It’s a way of saying we’re not going to back off,” he said.

The decision “reaffirms the EU’s unequivocal commitment to competition enforcement,” the bloc’s antitrust chief, Teresa Ribera, said Friday.

Though largely invisible to internet users, Google’s ad-tech tools underpin much of the buying and selling of digital ads that help fund websites and apps across the internet. That line of business, while a declining share of Google’s top line, is still a cash cow, bringing in roughly 10% of Google’s $71 billion in advertising revenue in the second quarter. 

The EU fine of €2.95 billion, equivalent to almost $3.5 billion, follows a four-year-long investigation that has proceeded on a parallel track to an antitrust case brought by the Justice Department.

Google’s ad-tech tools are used in much of the buying and selling of digital ads on websites and apps across the internet. PHOTO: DAVID PAUL MORRIS/BLOOMBERG NEWS

A U.S. federal judge in April found that Google had created a monopoly that allowed it to control parts of the online-advertising industry. In May, the Justice Department argued Google should be forced to sell off two of its ad-tech businesses to address those antitrust issues.

Both cases are likely to lead to protracted legal battles.

Google said it would appeal the EU decision and fine, which it described as wrong and unjustified. “There’s nothing anticompetitive in providing services for ad buyers and sellers, and there are more alternatives to our services than ever before,” said Lee-Anne Mulholland, Google’s global head of regulatory affairs.

The ad-tech cases against Google are separate from the case where a U.S. federal judge earlier this week imposed lighter penalties on Google than regulators had sought in a case that could have seen the company forced to divest its Chrome browser. 

The EU had initially planned to announce its fine against Google on Sept. 1 but delayed the decision at the last minute after the bloc’s trade chief raised concerns, the people familiar with the matter said. The delay appeared to be related to the EU’s discussions with the U.S. over trade, they added.

The U.S. and EU reached a political agreement on tariffs in July but have continued to discuss the details of the deal, and the EU is waiting for the U.S. to follow through on a pledge to lower auto tariffs to 15%. President Trump also threatened additional tariffs or trade restrictions last month against countries with digital taxes or other rules that could hurt U.S. tech companies.

The bloc’s trade chief, Maroš Šefčovič, on Wednesday declined to comment on what he said were confidential and internal procedures when asked about the timing of the Google announcement. But he said that he supported the Commission’s investigation and had been in regular contact with Ribera, the EU’s antitrust chief.

“This is a complex case that requires a thorough assessment,” Šefčovič said on Wednesday. “I can assure you that my priority is, and always would be, the European interest.”

A spokeswoman for the European Commission said Friday that the decision was adopted once the EU’s internal procedures were completed.

The delay to the much-anticipated Google announcement was earlier reported by legal publication MLex.

The European Publishers Council, which filed a complaint against Google’s ad-tech practices in 2022, said it wanted to see measures that will force the company to change its behavior. 

“A fine will not fix Google’s abuse of its ad tech. Without strong and decisive enforcement, Google will simply write this off as a cost of business,” the Council said.

Write to Kim Mackrael at kim.mackrael@wsj.com and Sam Schechner at Sam.Schechner@wsj.com

• Who/What/When/Where/Why: Deep Specter Research reports a multi‑year (2021–2025) industrial‑scale phishing and brand‑impersonation operation hosted primarily on Google Cloud and Cloudflare that uses hijacked/expired domains to cloakedly serve cloned corporate sites, malware and gambling content to enable large‑scale abuse.
• Scale: The infrastructure includes roughly 48,000 active virtual hosts, >80 clusters, 86 physical IPs, ~44K virtual IPs on Google Cloud and ~4K on other providers.
• Targets: Cloned content from ~200 known organizations including multiple Fortune 500 firms and Lockheed Martin, with the largest cluster replicating a single organization across ~6,000 virtual hosts.
• Cloaking Technique: Sites detect User‑Agent and other fingerprints to show sanitized content (brand clones) to crawlers and harmful content (gambling/malware) to real users; example documented: militaryfighterjet[.]com serving Lockheed Martin clone and gambling pages after domain expiry.
• Infrastructure Details: Operators use organized cluster/management hosts, aaPanel instances, HTTrack site copies, DNS/IP rotation, Cloudflare/Google hosting, and TLS/JARM fingerprints consistent with Sliver C2 indicators on ~1,000 HTTPS hosts.
• Timeline & Observations: Activity observed 2021–2025 with growth and spikes (notable increases after MOVEit in May 2023 and peaks in March 2025); sample counts: 2023 ~3,012 hosts/48,830 observations and 2025 ~2,791 hosts/56,075 observations (March peak ~33,890 observations).
• Malicious Activity & Traffic Sources: Cloaked sites served malware and gambling content, communicated with confirmed Windows and Android malware, and received traffic via Google, Meta and Android apps.
• Response & Regulatory Exposure: Deep Specter documents >265 public detections and reports that Google and Cloudflare failed to remediate many incidents, creating potential GDPR, DMCA and FTC exposure for affected brands and hosting providers.

Intro

First, we examine Google and Cloudflare as infrastructure providers with broad operational reach. Their services power a significant portion of the internet, and as such, they carry a wide scope of responsibility. When these platforms enable long-term abuse — such as cloaked phishing sites or illegal operations (e.g.APT41 Group tactics ) — their role shifts from passive intermediary to potential enabler, especially when threat intelligence sources have already flagged the relevant infrastructure identifiers (e.g., domains, IPs, certificates) as malicious and no action is taken, we aware about Cloudflare Policy and Google's Shared responsibility, but since these organizations practically routing most of the internet, we believe where inaction may be interpreted as willful blindness.

Second, we address a vendor like Lockheed Martin, a company with substantial national security relevance and public trust. As a defense contractor and prominent publicly traded entity, Lockheed Martin has both the visibility and technical capability to detect cloned or spoofed versions of its digital assets — as we ourselves have identified. From this standpoint, we believe Lockheed Martin and other similar companies should implement stronger monitoring and proactive detection mechanisms to prevent abuse like phishing, brand hijacking, or impersonation. In our view, this is not just a technical gap, but a responsibility tied to their status and trust profile.

Executive Summary

Deep Specter Research exposes a multi-year, industrial-scale phishing and brand impersonation scheme operating for over 3 years on Google Cloud (Nasdaq:GOOG) and Cloudflare (NYSE:NET) platforms. Despite repeated alerts, these tech giants failed to act, exposing public companies to millions in potential regulatory penalties. This failure constitutes industry-wide willful blindness. Key findings:

• 48,000 hosts, >80 clusters abusing high-trust expired domains
• Multiple impersonations of Fortune 500 companies incl. Lockheed Martin
• Malware and gambling content served from brand-trusted resources
• Cloaked sites receive traffic from Google, Meta, Android apps
• Cloudflare & Google failed to respond despite >265 public detections
• Potential GDPR, DMCA, and FTC exposure for involved companies

What happens when a forgotten domain resurfaces — not as a blank page, but as a perfect clone of a Fortune 500 defense contractor?

We uncovered a large-scale, cloud-hosted infrastructure that hijacks abandoned or expired domains, then pairs them with cloned websites of major global brands — including Lockheed Martin and many other US and non-US companies. These clones aren't theoretical risks. They've been live, undetected, and interacting with users and malware for years.

But the real issue isn't just technical. It's business-critical:

Many of the cloned sites still load resources from the original brand's cloud infrastructure — meaning the original brand may actively be serving content to a malicious impersonator

From a legal and regulatory standpoint, this creates significant regulatory and legal liability. Not only is the impersonation possible, but it continues with the unintentional assistance of the original asset owner. This suggests a failure to monitor and raises serious questions about due diligence, data protection, and customer safety.

At Deep Specter Research, we don't just surface security anomalies.

We translate technical findings into business vulnerabilities and regulatory exposure — assigning real-world accountability to organizations who fail to take reasonable steps to protect their digital assets.

We work closely with legal experts and privacy advocates to ensure the public is informed, regulators are aware, and enterprises are held responsible.

The Research

Several years ago, I was a fan of fighter jets. I collected their pictures and figures, constructed them from LEGO and, of course, read news about them. My favorite movie was "Top Gun", and I watched them both (old and new one) at least 5 times.

One of the sources, constantly providing pictures and news was this Facebook page (100K subscribers):

military fighter jets facebook community

They also had a website, while it seems like most people in 2022–2023 mostly viewed their Facebook page:

militaryfighterjet[.]com

military fighter jets site

All was good, until 2024–09–14 18:00:32 (last September)..

What happened is their "DNS record expired" 2 months before approximately. This means, somebody "forgot to pay the bill", causing them to lose ownership over the domain militaryfighterjet[.]com and their domain was "on sale" and bought by somebody else.

This happens sometimes. Not too often, but happens.

What followed, however, was highly unusual.

On 2024–09–16 14:49:50 this domain started to show this "168 Lottery Results" gambling page:

when accessed directly using Desktop Browsers…

But when You search for this domain in Google:

or when accessed from Mobile Devices or just by adding "/index-2.html" to the domain address:

This is clearly a clone of Lockheed Martin's site!

This means, that someone who acquired militaryfighterjet[.]com now showing there clone of Lockheed Martin website (including login pages for employees and partners), and gambling website altogether!

This is something that called "Cloaking".

It is SEO (Search Engine Optimization) black-hat technique where content presented to search engine crawlers (like GoogleBot) is different from the content presented to human users. The main goal is to manipulate search engine ranking or to hide illicit content from detection.

The software under the "cloak" checking the User-Agent Header and other fingerprints to decide if this is a Bot or real user (sometimes even from which country) and shows different content according to it. It shows sanitized content to crawlers and illicit content to real users**.**

This is problematic and punishable practice:

• Violation Of Search Engine Guidelines — Cloaking is a direct violation of Google's Webmaster Guidelines and similar policies from other search engines. Sites caught cloaking can face severe penalties, including being de-indexed (removed entirely from search results).
• Deceptive User Experience — It creates misleading and frustrating experience for users who expect to see one type of content but are presented with something entirely different, often unwanted or harmful.
• Security Risks — Copied sites used in cloaking can also pose security risks to visitors, potentially hosting malware or phishing attempts.

The Brand Reputation

There can be significant brand damage for the owner of the copied site, even if they are unaware of the cloaking taking place:

SEO Penalties and Loss of Visibility

1. Duplicate Content Issues: Search engines like Google actively penalize duplicate content. If the "known brand's" legitimate content is copied and hosted elsewhere, Google's algorithms might see it as duplicate and struggle to determine the original source. This can lead to the original site being de-ranked, losing its hard-earned visibility in search results.
2. "Spammy Association" — If the copied content is associated with a site that also hosts gambling (or other illicit) content, search engines might flag the entire domain as low-quality or spammy. This negative association can indirectly harm the reputation of the legitimate brand in the eyes of search engines, even if their site isn't directly involved in the gambling.

Erosion of Trust and Reputation

1. User Confusion — If users stumble upon the copied content on the gambling domain (even if it's eventually redirected or hidden), it can create confusion. They might wonder why a reputable brand's content is appearing on such a site, leading to a loss of trust in the original brand.
2. Association with Illicit Activities: The most significant damage is the potential association with gambling or other undesirable activities. Even if the brand is completely innocent, the mere presence of their content on a site promoting illegal or unethical activities can tarnish their image and reputation. Consumers might mistakenly believe the brand is involved or endorses such content.
3. Perception of Weak Security -If a brand's content can be easily scraped and used for malicious purposes, it might suggest to customers (and even competitors) that the original brand's website security is lax. This can erode confidence in the brand's ability to protect its own assets and, by extension, customer data if they engage with the brand online.

Financial Losses

1. We identify a clear risk that this systemic willful blindness may result in substantial exposure under GDPR and SEC disclosure requirements. By prioritizing continued revenue from these clients over the immediate termination of accounts engaged in malware and gambling campaigns, service providers could be seen as enabling persistent regulatory violations and consumer harm.
2. Lost Traffic and Revenue — If the original site is de-ranked due to duplicate content, it loses organic search traffic, which can directly translate to lost leads, sales, and advertising revenue.
3. Brand Dilution -When a brand's unique content appears on multiple, unrelated sites, it dilutes the brand's identity and makes it harder for consumers to associate that content solely with the legitimate brand.
4. Legal Costs (if they pursue action) — While the original brand is the victim, they might incur significant legal costs if they decide to pursue a Digital Millennium Copyright Act (DMCA) takedown notice or other legal action to have the copied content removed.

Difficulty in Monitoring and Enforcement:

1. Hidden Cloaking — Cloaking makes it harder for the legitimate brand to even discover that their content is being used in this way, as the deceptive site might only show the "clean" version to them or their monitoring tools.
2. Ongoing Battle — Even if they manage to get the content removed from one site, determined scrapers or black-hat SEOs might simply copy it to another, creating an ongoing "whack-a-mole" problem for the brand.

So, how big this problem? Let's see

When we discovered this (only this year) — we immediately looked at the source code:

And saw the "how" and "when":

HTTrack Website Copier/3.x [XR&CO'2014], Mon, 16 Sep 2024 19:45:00 GM

HTTrack is one of the oldest website copying tools available. This is software that allows you to copy entire website, with all its images, scripts and so on.

Once, we know "how", maybe we will find "where"?

Quick check reveals that this IP has 414 or more domains resolving to it (historically).

Let's introduce another great service: Censys.io:

So, we now know, that this is Google Cloud IP, hosting this clearly violating Lockheed Martin brand rights for almost a year, undetected. Perhaps they hadn't noticed… Let's tell them (and we did).

We continued investigating

We isolated properties which are unique to this "cloaking effort" and searched it in Censys.io:

• we found 86 physical IP addresses, all hosted on Google Cloud (Hong Kong, Taiwan)
• entire infrastructure contains 44K virtual IP addresses from Google Cloud and 4K from other hosting providers (new cloned sites now show up on CloudFlareNet).
• Virtual hosts organized in 86 clusters, each physical host is the managing host of its cluster.
• 8 physical hosts are upper tier management, managing the cluster managers.
• 78 physical hosts are "regular" clusters.
• they use cloned content of 200 known organizations
• all industries are targeted (military, healthcare, manufacturing, even "cat pics forums" and "cat food shops")

All of these is growing and dynamically changing, rolling cloned websites between them.

This is big and costly infrastructure (table created using Censys.io):

It is clear, that Google Cloud is the major platform. Others used as testing ground, administration or for specific targeting.

On some hosts, port 80 displays:

Note: This aaPanel reference will be relevant in future investigations. It is widely used by various malicious-services platforms.

Again, using ZoomEye.ai, we created a graph, that shows number of observations of one cluster. More observation — more active is the cluster.

By creating a profile for such activity and looking it in historical data we detected that:

Some findings from 2021 (34 hosts, 56 observations):

<a href="http://www.style-files.com" rel="nofollow">www.style-files.com</a> mirror hosted as m[.]fjwjygr[.]com on 2021-07-04 10:45:11
...
<a href="http://zenfolio.com" rel="nofollow">zenfolio.com</a> mirror hosted as gkpot[.]com 2021-12-21 18:37:42

Some findings from 2022 (663 hosts, 6,444 observations):

<a href="http://icicilombard.com" rel="nofollow">icicilombard.com</a> mirror hosted as 0598998[.]com 2022-01-06 04:55:46
...
<a href="http://colorbarcosmetics.com" rel="nofollow">colorbarcosmetics.com</a> mirror hosted as busancvb[.]org on 2022-12-31 01:21:40

The last quarter of 2022 was a record-shattering period for phishing. The APWG (Anti-Phishing Working Group) observed over 1.35 million total phishing attacks in Q4 2022, which was a new quarterly high. Number of observations in November is x60 times higher than in October. Number of hosts involved increased x 7.5 times.

• some findings from 2023 (3,012 hosts, 48,830 observations, 8 detected as malicious):

  <a href="http://artannapola.com" rel="nofollow">artannapola.com</a> mirror hosted as artannapola[.]com on 2023-01-01 07:35:54 ... watchfinder.co.uk mirror hosted as letfreedomsingfestival[.]org on 2023-12-31 14:05:05

May 2023 ("MOVEit Transfer Zero-Day Exploitation") shows x 244 times increase in observations, and x 22 times in number of hosts.

• 2024–1,217 hosts (14,809 observations, 8 identified as malicious). After "ALPHV/BlackCat Ransomware Disruption" in the end of 2023 it looks like the infrastructure is kept on "low flame", without spikes of activity (dropped x 2 times in hosts number and x 7.2 times drop in observations). Restoring activity in August (x 2 times more hosts, x 3 times more observations) and in December (x 2 times more hosts, x 5 times more observations).
• 2025–2,791 hosts (56,075 observations, 3 identified as malicious). March registered all years maximum: 33,890 observations, 1,997 hosts. Multiple breaches occurred in March — like "GitHub Actions Supply Chain Attack" and "Oracle Cloud Breach".

The trend in graph: hosts as main line, others overlapped, normalized (2021–2025)

Each domain they use to serve this cloned website is carefully picked from available, selecting only ones with high reputation or live Facebook communities on so on. It also MATCH the cloned website by content or industry (technically by keywords), therefore:

militaryfighterjet[.]com ⇒ <a href="http://lockheedmartin.com" rel="nofollow">lockheedmartin.com</a>

We collected a comprehensive list of organizations impacted, both whose website was copied and whose domain was overtaken to host such copy. Between them, private companies and publicly traded ones, Government-related organization, communities, and many others.

Some domains included in this "cloak" were just "abandoned" by their owners — keep showing their content, so for unsuspecting visitors — nothing changed…

So, you've found cloaked websites?

We will answer:

• the scale — 48K active virtual hosts/domains
• the time — 4 years at least
• the abuse of copied brands (many many known and big inside the victims list)
• the abuse of Trustworthy hosting solutions like Google Cloud and CloudFlareNet and their failure in detecting this
• carefully picked tandem of cloned website and domain that now serves it
• unified scripting infrastructure to support all this
• gambling content can be illegal in some countries — under this cloak can be accessed freely
• communication from/to this infrastructure from confirmed malware (Windows executables and Android Applications)
• these websites activity corelates with malware campaigns worldwide
• the main core of this platform is evolving continuously and we counted already more than 7 generations of it
• biggest "cluster' of hosts showing same cloned content of one organization contains almost virtual 6000 hosts! This means, that this organization name used in super-massive phishing campaign right now. It may be also true, that this is the Next Big Breach.
• we are assuming that this is very successful phishing-as-service platform.

We have a feeling, that this "gambling" page by itself, is just another "cloak" hiding something completely different beneath.

It looks like, gambling content is taken from here:

and any time that You press "Bet Now" it will lead You to one of the "dead end" domains like this:

What do You think? Please, share Your ideas with us!

All this make this effort — work of the INDUSTRY level player (Phishing as Service).

Few actors have the resources to execute this at such scale (both time and size).

This infrastructure operated in plain sight — seen by everyone, noticed by no one, until we came.

Google, Cloudflare, Lockheed Martin and other big companies were helpless for almost 4 years, unable to detect the abuse of their own infrastructure. .

You can ask, "May be this was so hard to detect, that no one could? Maybe no one complained?"

There is a wonderful resource, called urlquery.net, where people check potentially phishing links. On this resource alone there 39 checks for this infrastructure in 2023, 91 in 2024, and 135 this year already.

Additionally, In many cases, HTTrack does not copy external resources, so, for example, when copied website use Victim organization logo image stored in Amazon S3 bucket or even Google Analytics — it is not copied, leaving instead a link to it (similar at original website). This allows the Victims — whose website was cloned to identify clones by examining HTTP Headers of incoming requests trying to access such resources.

GET /<victim domain>/fonts/<some font specific to Victim>.woff2 HTTP/1.1
Host: [s3.amazonaws.com](<http://s3.amazonaws.com/>)
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: <cloaked domain>
DNT: 1
Connection: keep-alive
Referer: <cloaked domain>
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

If, just, organizations simply collected and analyzed HTTP headers from requests to external resources..

P.S. Interesting, but only 1000 hosts from 48K total of this infrastructure are using HTTPS. But those which do, have these TLS fingerprints:

JARM: 3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763
TLSv1.3:
 ja3s: 15af977ce25de452b96affa2addb1036
 ja4s: t130200_1302_a56c5b993250
TLSv1.2:
  ja3s: 76d88c75d798a42d6ea08ab2b9006623
  ja4s: t120300_cca8_eac207b63351
TLSv1.1:
  ja3s: f43f6aaa857b937a9728a6760c1cb77e
  ja4s: t110300_c013_eac207b63351

that look like Sliver malware C2 server match.

• Who/What/When/Where/Why: Tim Cook will unveil new iPhones next week as Apple faces legal, regulatory and competitive challenges from Epic, Spotify and European authorities that threaten its App Store control and future profitability.
• Financials: Apple remains highly profitable, with App Store sales about 8% of revenue and court records showing store operating margins exceeding 75%.
• Epic lawsuit: In April, Epic Games won a court order allowing apps to direct users outside Apple’s payment system, enabling avoidance of the 30% commission.
• Spotify campaign: Daniel Ek and Spotify lobbied regulators, filed a March 2019 complaint with the European Commission, and used Android A/B tests showing Apple-like rules reduced upgrades by an estimated ~20%.
• European action: The European Commission fined Apple nearly $2 billion in March 2024, the Digital Markets Act (2022) limited App Store control, and Apple faced a separate >$500 million fine this year for noncompliance (under appeal).
• Historical conflict: Tensions escalated after Apple launched Apple Music in 2015 at $9.99 versus Spotify’s $12.99 in-app price (reflecting Apple’s 30% cut), leading to repeated app rejections and high-level meetings.
• Legal strategy: Spotify hired Horacio Gutierrez in 2016 to pursue regulatory and antitrust avenues in the U.S. and EU, and worked with EU enforcer Margrethe Vestager to advance complaints and policy changes.
• Risks and context: U.S. court rulings and European measures threaten billions in App Store profits just as iPhone sales face pressure and AI innovations could undermine the smartphone’s central role.

When Tim Cook takes center stage next week to show off the latest iPhones, he is trumpeting the future of a company that’s been severely weakened from just a few years ago. 

Yes, Apple MMAAPLMM continues to pump out dizzying amounts of profit—squeezing every penny possible from the iPhone empire it created almost 20 years ago. But its place as the powerful gateway to the digital world is severely imperiled. Its lucrative future as a toll-taker at the center of the App Economy is unclear, especially in an era where rapid advancements in artificial intelligence threaten to displace the smartphone at the center of daily lives.

A rebellion by rival tech companies helped bring that change. They worked in loose coordination for years to chip away at Apple’s iconic image and paint the company—fairly or not—as a 21st-century monopolist on par with the Robber Barons of the 19th century. Or, more recently, the Microsoft of the ’90s.

Tim Sweeney, the founder of Epic Games, was the public face in the U.S. fighting Apple’s control over third-party apps that want to do business on the iPhone and through its App Store. He won a huge victory in April with a court order allowing apps, like his “Fortnite,” to direct users beyond the reach of Apple’s payment system to make purchases on the internet. 

That saves Epic from having to hand over 30% of its U.S. sales to Apple. And, in theory, it gives users cheaper ways to buy digital goods to consume on their iPhones. 

Equally important—and less understood—was the role Daniel Ek’sSpotify MMSPOTMM played, whipping up lawmakers and regulators around the world against Apple, including in Europe. The European Commission in March 2024 leveled a $2 billion fine, one of the largest ever, against Apple for conduct against Spotify and others, and shepherded sweeping new laws to limit its control of the App Store, a move that’s being copied in other parts of the world.

Combined, the results of the U.S. court case and the efforts in Europe are threatening a major driver of Apple’s valuation, putting billions of dollars of profit at risk of evaporating. App Store sales accounted for an estimated 8% of the company’s revenue in the past fiscal year but punched above its weight in terms of profitability. While the company doesn’t publicly report profits from the App Store, previously released court records revealed store operating margins exceeding 75%, far greater than what’s estimated for its hardware sales.  

The uncertainty comes at a time when its iPhone sales are under pressure and investors are worried that Apple is failing to keep up with AI innovations that rivals are betting will unleash a new computing paradigm that could displace the iPhone. 

Adapted from “iWAR: Fortnite, Elon Musk, Spotify, WeChat, and Laying Siege to Apple’s Empire,” by Wall Street Journal columnist Tim Higgins, to be published by Harper Business on Sept. 16.

Just as Rome didn’t fall in a day, the crumbling of Apple’s walled garden didn’t happen overnight. Spotify’s efforts began in earnest a decade ago. This account is based on interviews I conducted and records I reviewed around the world. 

From Spotify’s early days, it became clear that Ek’s vision for business was at odds with Apple, which upended the music industry with the idea of selling individual digital songs for 99 cents through the iTunes store. Instead, Ek was basically giving access to an all-you-can-eat buffet of music through a streaming service—an offering that would seem perfect with the arrival of the mobile, on-the-go computing world made popular with Apple’s iPhone.

The bad blood between Spotify and Apple only intensified when Cook launched a rival streaming service in 2015 called Apple Music. Spotify executives fumed when they saw the rival service priced at $9.99 a month—undercutting their App Store offering of $12.99. The entire difference between the two was the 30% cut that Spotify was forced to pay to Apple, under the rules that companies had to follow if they wanted to appear in Apple’s App Store.

It was clear that Spotify founder Daniel Ek’s vision for business was at odds with Apple even in his company’s early days. PHOTO: CHARLES ESHELMAN/GETTY IMAGES FOR SPOTIFY

All of this was occurring as Ek was eyeing a plan to take his startup public. That Apple “tax,” as opponents called it, posed a risk to a company already paying a huge proportion of its sales to music licenses. 

In 2016, Ek hired Horacio Gutierrez from Microsoft as general counsel to prepare Spotify for the initial public offering. Years earlier, Gutierrez had begun his Microsoft career shortly after the Justice Department brought its antitrust claims against that tech giant. He played a role in the defense, before being dispatched to Brussels to defend against a similar legal battle being waged by the European Commission. 

His experience in corporate combat would soon be tested. A few weeks after Gutierrez began at Spotify, engineers sent an updated version of the app to Apple’s App Store that included a dramatic change: New Spotify users could no longer upgrade inside the app to paid subscriptions. 

Spotify was turning off Apple’s vaunted in-app purchase system for new users in a move to avoid handing over a commission to Apple. Instead, it created an “email me” button for users to click to be sent information about an opportunity to upgrade at a discount. 

In response, Apple rejected Spotify’s app update. What followed was a standoff between the companies as Spotify kept trying different approaches only to run up against continued rejection.

Thinking he might be able to negotiate a truce, Gutierrez traveled to Apple headquarters in Cupertino, Calif., to meet directly with Bruce Sewell, then the iPhone maker’s top lawyer. 

Sewell had been a firefighter before becoming a lawyer. He oversaw a legal department that spanned about 900 people and had an annual budget of almost $1 billion—a good portion of which he used for litigation. 

Unlike some lawyers, Sewell subscribed to a theory that a general counsel was there to embrace risk—not avoid it. Or, as he described it, he didn’t mind sailing close to the wind.

Apple’s Tim Cook, left, and Eddy Cue at the unveiling of Apple Music in 2015. PHOTO: JUSTIN SULLIVAN/GETTY IMAGES

“You want to get to the point where you can use risk as a competitive advantage—that’s the point at which law actually becomes a commercial asset to the company,” Sewell would one day tell law school students. In other words, he wanted to get close to the line without crossing it. 

Given that philosophy, it’s probably not surprising that the Apple-Spotify meeting didn’t resolve their differences. Later, Gutierrez sent a blistering letter to Sewell about Spotify’s update being rejected. “This latest episode raises serious concerns under both U.S. and EU competition law,” Gutierrez wrote. “It continues a troubling pattern of behavior by Apple to exclude and diminish the competitiveness of Spotify.”

Apple responded forcefully. In its own letter, Apple accused the streaming service of wanting special treatment—an assertion it often used against developers who spoke out against its rules. 

“We find it troubling that you are asking for exemptions to the rules we apply to all developers, and are publicly resorting to rumors and half-truths about our service,” Sewell wrote. “Spotify’s app was again rejected for attempting to circumvent in-app purchase rules, and not, as you claim, because Spotify was simply seeking to communicate with its customers.” 

Months later, Apple’s stonewalling on approving Spotify’s app stopped.

A call from Apple suggesting a minor tweak unlocked things. 

It would be a brief reprieve.

Even before Gutierrez had been hired, Spotify had been seeking help dealing with Apple from Washington, D.C., including going to the Federal Trade Commission, to present their argument for why Apple’s behavior was a violation of antitrust law. 

The overall theory was similar to the one the Justice Department pursued against Microsoft years earlier: that Apple had an ecosystem that was leveraging dominance in one space to distort competition in another.

But Spotify left disappointed. They felt there was either a lack of understanding of the power of the App Economy or a lack of an appetite to go after Apple. The iPhone maker was seen as an innovator, and the Spotify team kept hearing: Why can’t Apple charge money?

Horacio Gutierrez became general counsel at Spotify as the company was preparing to go public. PHOTO: PIARAS Ó MÍDHEACH/SPORTSFILE FOR WEB SUMMIT VIA GETTY IMAGES

​​

With Gutierrez at the helm, Spotify intensified efforts to seek help from regulators in Europe. Spotify, after all, was founded in Sweden, a member of the European Union. “As a victim of a crime, it’s easier to go to the authority where you reside,” one Spotify executive said. 

In Brussels, Gutierrez found an ally in a Danish politician named Margrethe Vestager, then head of the bloc’s powerful antitrust office. She was probably the closest thing to a celebrity in Brussels, becoming known in the U.S. as the “tax lady” for a bruising public fight with Apple over her claim that the company owed more than $14 billion in unpaid taxes. 

Vestager had grown up in a small town, the daughter of two Lutheran rectors whose early lessons of right and wrong resonated for a lifetime. She framed antitrust law in almost biblical terms. And she was more than willing to be David in a fight against the U.S. tech Goliaths. 

As Apple fought Vestager over claims it had improperly dodged taxes, Cook himself traveled to Brussels in 2016 to meet face to face with her. 

The meeting didn’t go well. Cook lectured her on tax laws in a way that the Europeans saw as trying to intimidate, people familiar with the meeting said. “Widely known in Brussels as the worst tech meeting to ever occur,” a lawyer close to the commission said later. “People say it was pretty damn ugly.”

Vestager’s team was more than willing to hear what Spotify had to say about Apple’s alleged abuses. She’d been looking for a poster child in a broader fight against Apple’s power. 

Spotify was more than eager to play that role. And it was ready to offer something even more important: a smoking gun. 

Because Spotify operated in both Apple’s App Store and the parallel universe of Google’s app store, which at the time was more permissive, Spotify came up with a clever way of showing how things might be different if not for Apple’s rules. 

Using the Android platform, Spotify essentially created an A/B test to show how Apple-like rules affected upgrades compared with more permissive rules allowing customers to be steered to alternative payment methods.

The first experiment was conducted in May 2018 on users in Spotify’s five largest European markets—France, Germany, Italy, Spain and the U.K. A second experiment was run in December with different variables and on a wider group—not just the five largest European markets, but also Australia, Brazil, Mexico and the United States. 

Danish politician Margrethe Vestager had been looking for a poster child in the fight against Apple’s power.  PHOTO: VIRGINIA MAYO/ASSOCIATED PRESS

Both experiments, according to results that were later revealed in legal records, showed fewer people upgrading under the Apple-like rules. 

Armed with data, Spotify was ready to attack. The company filed an official complaint in March 2019 with the European Commission, alleging that Apple had abused its control over which apps appear in the App Store to limit competition against its own streaming music service. It took issue with Apple blocking efforts to inform customers of ways to upgrade its service outside Apple’s reach. 

Using Spotify’s data, the commission conservatively estimated that Apple’s restrictions were resulting in Spotify losing out on 20% of its in-app users upgrading. Put another way, millions of “users got lost in the subscription process and did not end up subscribing,” and millions more had “an inferior user experience.”

Apple would strongly deny wrongdoing in a lengthy statement, essentially accusing Spotify of being a freeloader. “Spotify wouldn’t be the business they are today without the App Store ecosystem, but now they’re leveraging their scale to avoid contributing to maintaining that ecosystem for the next generation of app entrepreneurs,” the company said. “We think that’s wrong.”

Ultimately, the commission would agree with Spotify, leveling the giant fine last year that’s under appeal. 

That was just one part of Gutierrez’s strategy. The second part was to push the European Union to pass new laws targeted at reining in Apple’s power over the App Economy. 

Gutierrez, who left Spotify in early 2022, and other Apple rivals would argue that the bloc needed updated antitrust laws to give Vestager’s office the ability to move faster as technology evolved, an argument helped by the fact that the EU’s investigation into Apple was taking so long. 

The culmination was the adoption in 2022 of the Digital Markets Act, aimed at large tech companies like Apple. For the iPhone maker, the law loosens its grip on the App Store, including by prohibiting it from banning developers from steering European users outside of the app to make purchases—Spotify’s original complaint.Earlier this year, Apple was hit with a more than $500 million fine for failing to comply with the new law. The company is appealing, arguing it is working to fulfill the new requirements. Its latest plans for fulfilling those requirements fall short of what Spotify had hoped, however. “Apple is still proposing new fees that perpetuate the status quo—despite being told to stop its illegal conduct,” Avery Gardiner, director of global competition policy at Spotify, said.

All of which puts more pressure on Cook next week to deliver iPhones that juice sales while Apple continues to sail close to the wind in its App Economy war.

Adapted from “iWAR: Fortnite, Elon Musk, Spotify, WeChat, and Laying Siege to Apple’s Empire,” by Tim Higgins, to be published by Harper Business on September 16, 2025. Original text Copyright © 2025 by Tim Higgins. Printed by arrangement with Harper Business, an imprint of HarperCollins Publishers (which, like The Wall Street Journal, is owned by News Corp).

Write to Tim Higgins at tim.higgins@wsj.com

• Who/What/When/Where/Why: Arthur L. Caplan, PLoS Biology essay published 4 Sep 2025, examines recent private “de‑extinction” claims and urges ethical and regulatory scrutiny because of scientific shortcomings and welfare risks.
• Central conclusion: Recent private efforts (e.g., Colossal Biosciences’ dire wolf announcement) do not produce true resurrected species but create engineered hybrids and overstate scientific achievements.
• Cloning limitations: Cloning requires living cells and eggs, is unsuitable for truly extinct species, and often yields health problems in clones.
• CRISPR limitations: Ancient DNA is fragmented, close‑relative genomes are required, extensive edits risk unpredictable gene interactions, and surrogates and rearing environments differ from extinct ancestors.
• Ecological rationale questioned: Claims that engineered animals (e.g., mammoth‑like elephants) could restore ecosystems are implausible given scale, time, unknown impacts, and weak justification for species extinct millennia ago (e.g., dire wolves, moa).
• Animal welfare concerns: Engineered or partially reconstructed animals face unknown health, social, habitat, predation, poaching, and dietary challenges that demand full welfare assessment.
• Human/hominid risk: Techniques could theoretically be applied to Neanderthals or other hominids; the piece urges preemptive debate, independent risk assessment, and protective standards before any attempts.
• Governance and transparency: Calls for international regulation, independent ethical oversight, public debate, expert welfare review, penalties for unsanctioned attempts, strict investor liability, and media demands for documented approvals beyond press releases.

• Article

• Authors

• Metrics

• Comments

• Media Coverage

• Abstract

• References

• Reader Comments

?

This is an uncorrected proof.

Abstract

Recent efforts by a private company to modify modern species with ancient DNA in the name of ‘de-extinction’ are both scientifically and morally suspect. A bright line requiring more than press releases as well as independent ethical oversight must be drawn before they are extended to distant human and hominid ancestors.

Citation: Caplan AL (2025) Should scientists be allowed to bring distant human ancestors back to life? PLoS Biol 23(9): e3003384. https://doi.org/10.1371/journal.pbio.3003384

Published: September 4, 2025

Copyright: © 2025 Arthur L. Caplan. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.

Funding: The author received no specific funding for this work.

Competing interests: The author has declared that no competing interests exist.

The recent trend for resurrecting extinct animals has made headlines globally and sparked controversy over the validity of the claims being made and the approach taken to reporting them. But, the bigger question should be, is this work ethical? And what if similar work was to be used to replicate features of historically distant human and hominid ancestors?

Much publicity accompanied the announcement by the Dallas-based biotechnology company Colossal Biosciences, that it had successfully ‘de-extincted’ dire wolves and has plans to do so for other species. However, once the actual genetic techniques involved are examined (Box 1), the claims of species de-extinction are far from credible. What has been done and is being planned is actually the creation of hybrids somewhat akin to but far from identical to extinct animal species. Still, despite the inability to actually de-extinct any species, private efforts to modify ancient DNA in the name of de-extinction are likely to continue.

Box 1. The technology of de-extinction

De-extinction describes the process by which species that have entirely disappeared can be recreated. Cloning and, more recently, genetic engineering through CRISPR, are the two major techniques for attempting species restoration.

Using cloning alone for de-extinction is at best a means of trying to preserve nearly extinct animals and organisms. Cloning can and has been used to preserve animals nearing extinction. But, since cloning requires living sources from adult cells and their eggs that are not available for animals that have gone totally extinct, its utility in the service of de-extinction is severely limited. At best, it offers a last-ditch tool to prevent imminent extinction. Also, many cloned animals exhibit health issues and suffer premature deaths, thus limiting the role cloning can play in species preservation [1].

Gene editing via CRISPR also has limitations [2,3]. The first step in using CRISPR for de-extinction is sequencing the extinct animal’s genome. Scientists also need to procure the genome of a very close living relative, if one exists. If the sequence of the genome of the extinct animal is known, and if the genome of a very close living relative is available, the differences can be mapped. Once the traits deemed characteristic of the extinct animal are identified, CRISPR is used to modify the living relative’s genome [2,3]. This creates a new genome for a hybrid animal that is far from a replica of the extinct animal. Cloning follows with implantation into a surrogate.

Using CRISPR in this way has huge drawbacks. Ancient DNA is very fragmented, having been broken down over time by bacteria, exposure to UV light and other agents, making locating all ancient genes difficult. Introducing many genetic changes into a background genome creates unknowable and possibly dangerous interactions between preexisting and newly introduced genes and the proteins and traits they create.

Furthermore, existing surrogate mothers may not create a close replica of the environment the extinct animal’s mother’s womb and diet would have created. And duplicating any resulting animal’s diet and social upbringing is next to impossible since these are unknown, making de-extinction implausible.

Once the limits of CRISPR recreation are understood, proponents of de-extinction tend, perhaps not surprisingly, to point toward environmental benefits, not actual species recreation, as their rationale. Ecosystems that depended on keystone species have lost the diversity they once supported. As environmental change occurs, Colossal Biosciences and other supporters of creating hybrid creatures say they may be useful in restoring ecological balance [4].

A prime example is the wooly mammoth. Four thousand years ago, the tundras of Russia and Canada consisted of a rich grass and ice-based ecosystem. Today they are melting. A few dozen changes to the genome of modern elephants—to give them subcutaneous fat, woolly hair, and sebaceous glands—might suffice to create a variation that is functionally similar to the mammoth. Returning this keystone-like species to the tundras could stave off some effects of warming, as ‘de-extincted mammoths’ could keep the region colder by eating dead grass, thus enabling the sun to reach spring grass, whose deep roots prevent erosion. They could also increase reflected light by felling trees, which absorb sunlight, and punch through insulating snow so that freezing air penetrates the soil [4]. However, this rationale is not convincing, leaving the ethics of the effort in doubt [5].

In a world that is rapidly overheating, the idea that modified elephants could rebalance any ecosystem is unpersuasive on its face. The number of healthy animals needed, the time to create them, and the time for herds in novel climates to have an impact are enormous roadblocks to undertaking the effort. And the unknown impact of CRISPR engineering on the well-being of hybrid, mammoth-like elephants in terms of their diet, risk of infectious diseases, social needs, climate change, and overall health from CRISPR, surrogacy and cloning (Box1) make moral defenses of announcements misdescribed as de-extinction exceedingly ethically dubious.

Following their recent announcement, Colossal Biosciences said it was “proud to return the dire wolf to its rightful place in the ecosystem,” suggesting the same ecological rationale offered for recreating mammoths. But this argument makes no sense. Dire wolves have been extinct for thousands of years, and the ecology that supported them and their role or benefit for future ecological stability are not known. Yet despite the justification of ecological restoration for modifying wolves to resemble dire wolves being weak, Colossal Bioscience has repeated it in pointing toward a planned effort to restore the 600-year extinct flightless bird, the moa.

Others have noted that animal de-extinction efforts made them morally uneasy. The resurrection might not be good for the animals. Where would they live, give the loss of their former habitat, and possible harm from predators or poachers? Would they be lonely? What would they be fed [5]? The animal welfare concerns about these creatures are legitimate and ought to be fully addressed in any publications and media announcements [1].

The effort and the drive for publicity for the inaccurately described ‘de-extinction’ work and the constant targeting of new species raise another huge issue that has not drawn attention—what if a privately held company were to use CRISPR-based techniques aimed at ‘restoring’ extinct human ancestors?

Three hundred thousand years ago, at least nine species of hominids were alive [6]. Today, only Homo sapiens remains. Theories abound around the disappearance of these other species, from H. sapiens having better infant survival rates to H. sapiens hunting other species or interbreeding with them and simply assimilating their genetics. Modifying a contemporary human genome through tracking ancestral hominid DNA might provide some answers. To do so would require locating DNA from fossils, which would be possible for Neanderthals among other ancestors [6]. Proponents might insist that using genes from Homo neanderthalensis or other extinct ancestors’, such as Denisovans, using the CRISPR-driven techniques Colossol Biosciences used to create so-called dire wolves could answer further questions.

Although such efforts are currently only theoretical, the decision about de-extincting or, more accurately, partially reconstructing, human ancestors needs to be addressed now before any effort is made. Ancient hominid de-extinction should not be left in the hands of private, closely held, for-profit companies. Whether an effort at ancient hominid partial recreation is justified should be debated and regulated by an international body with the power to hold public debates, offer independent risk assessments, and insist on standards for undertaking such experiments and protection for any potential surrogates involved. Expertise needs to be sought from appropriate independent scientific experts concerning the welfare of beings created in this manner and the potential dangers to human surrogates. Penalties for any unsanctioned attempts must be put in place. Investors in such efforts must be held strictly liable for any harm caused by such an undertaking. The media must demand not just a press release but documentation of appropriate independent ethical approval and oversight.

The de-extinction of human predecessors could be undertaken at any time by private entitities. Given how recent efforts have been overly hyped, lack a persuasive rationale, have had little independent peer review, and have taken place with unethical indifference to animal welfare, this seems highly undesirable. The mere possibility merits much more than responding after the fact with ethical questions. A strong case exists for proactive ethical debate and transparent regulatory oversight of experiments with all extinct species.

References

1. 1. Cowl VB, Comizzoli P, Appeltant R, Bolton RL, Browne RK, Holt WV, et al. Cloning for the twenty-first century and its place in endangered species conservation. Annu Rev Anim Biosci. 2024;12:91–112. pmid:37988633

   • View Article
   • PubMed/NCBI
   • Google Scholar

2. 2. Novak BJ. De-extinction. Genes (Basel). 2018;9(11):548. pmid:30428542

   • View Article
   • PubMed/NCBI
   • Google Scholar

3. 3. Schlebusch CM. Genomics: testing the limits of de-extinction. Curr Biol. 2022;32(7):R324–7. pmid:35413261

   • View Article
   • PubMed/NCBI
   • Google Scholar

4. 4. Jepson PR. De-extinction beyond species: restoring ecosystem functionality through large herbivore rewilding. Extinction. 2025.

   • View Article
   • Google Scholar

5. 5. Sekar N. Mammoth de-extinction is bad conservation. Ars Technica. 2025. Available from: https://arstechnica.com/science/2025/04/editorial-mammoth-de-extinction-is-bad-conservation/

6. 6. Haber M, Mezzavilla M, Xue Y, Tyler-Smith C. Ancient DNA and the rewriting of human history: be sparing with Occam’s razor. Genome Biol. 2016;17:1. pmid:26753840

   • View Article
   • PubMed/NCBI
   • Google Scholar