In August 2020, Boise State University chose a doctoral student in public policy, Melanie Fillmore, to deliver what is called a “land acknowledgment” speech at a convocation for incoming freshmen. Fillmore, who is part Indigenous, would recognize the tribes that lived in the Boise Valley before they were banished to reservations to make way for white settlers.

Fillmore considered it an honor. She was devoted to Boise State, where she had earned her bachelor’s and master’s degrees, taught undergraduate courses and served on job search committees. She also admired Marlene Tromp, a feminist literary scholar who came from the University of California, Santa Cruz, in 2019 to become Boise State’s first female president. Tromp had been hired with a mandate to promote diversity, and including an Indigenous speaker in the ceremony marking the start of students’ higher education would advance that agenda.

The convocation was to be virtual, because of the pandemic. Fillmore put on beaded Native American jewelry and recorded an eight-minute video on her phone. She began by naming the “rightful owners of this land,” the Boise Valley Indigenous tribes, and then described her own “complicated” background. Her father was Hunkpapa Lakota, her mother white. “I can trace eight generations of my Lakota ancestors being removed from the land of their lifeblood to the reservation, just as I can trace seven generations of Norwegian and English ancestors taking that land,” she said.

Fillmore urged viewers to “find a way to share your story here at Boise State” and to learn the history of Indigenous people. “When we acknowledge the Boise Valley ancestors and their land, we make room for that story of removal that was genocidal in purpose,” she said. “When we tell those stories honestly and fully, we heal, and our ancestors heal with us.”

She submitted her speech to the university, but the students never heard it. Boise State higher-ups thought that it was too long and too provocative to roll out in a politically precarious climate, one former official said. They consulted another administrator about whether to drop the speech. “I communicated that pulling it was a bad idea and incredibly wrong,” said this person, who has also left the university. “I don’t believe in de-platforming Indigenous voices.”

The advice was disregarded. Two days before the convocation, the vice president for student affairs told Fillmore that her appearance was canceled, explaining that her safety might be at risk or that she might be trolled or doxxed online.

Fillmore was devastated. She had encouraged the students to tell their stories, and now hers was being erased. She wondered if administrators were worried about the timing. The Idaho Legislature — which normally meets from January to March, when it decides how much money to give to public education, including Boise State — would hold a special session three days after the convocation to consider COVID-19 measures. Conservative legislators, who ever since Tromp’s arrival had been attacking Boise State’s diversity initiatives, might hear about Fillmore’s talk and seize on it to bash the university.

“I didn’t say anything that I haven’t already been sharing with my research and work,” she wrote to a faculty mentor, political scientist Stephen Utych, in an email the next day.

“I was incredibly frustrated for Melanie, but also that the university caved on something so relatively benign, because there’s so much pressure coming externally,” Utych said in an interview. He added that concerns about the Legislature’s impact on Boise State were one reason he quit his tenured professorship this year to work in market research.

When the university’s convocation committee, which organized the event, was informed of the decision, Amy Vecchione expressed misgivings. “I remember saying, ‘Typically, what we do is allow speech to take place, regardless of the content,’” said Vecchione, assistant director of the university’s center for developing online courses, who was the faculty senate liaison to the committee. “‘We process reactions if there are any. That’s part of academic freedom.’”

After the convocation, Tromp commiserated with Fillmore over Zoom. “She told me it was a sad outcome,” Fillmore said. Tromp did not respond to questions about the incident. Alicia Estey, chief of staff and vice president for university affairs, said in an email that “safety was a concern.”

Almost two years later, Fillmore still broods about how she was treated. Although she loves teaching, she’s rethinking her aspirations for an academic career. “I really lost a lot of faith in Boise State,” she said. “It was more important for the university to cope with whatever the Legislature wanted than to advocate for students. I feel more like a liability than a part of the community.”

Across the country, elected officials in red states are seeking to impose their political views on public universities. Even as they decry liberal cancel culture, they’re leveraging the threat of budget cuts to scale back diversity initiatives, sanitize the teaching of American history and interfere with university policies and appointments.

In Georgia, the governor’s appointees have made it easier to fire tenured professors. Florida passed a law requiring public universities to survey faculty and students annually about “the extent to which competing ideas and perspectives are presented,” and allowing students to record professors’ lectures as evidence of possible bias. In North Carolina, the Republican-dominated legislature, through its control over key positions, is “inappropriately seeking to expand [its] purview into the day-to-day operations” of state campuses, the American Association of University Professors reported in April. In Texas, the lieutenant governor and conservative donors worked with the state university’s flagship Austin campus to start an institute “dedicated to the study and teaching of individual liberty, limited government, private enterprise and free markets,” according to The Texas Tribune.

Perhaps reflecting such tensions, the average tenure of public university presidents has declined from nine years to seven over the past two decades, and they are increasingly being fired or forced to resign, according to data prepared for this article by Sondra Barringer and Michael Harris, professors of higher education at Southern Methodist University. Between 2014 and 2020, 29% of departures by presidents of NCAA Division 1 public universities were involuntary, up from 19% between 2007 and 2013, and 10% between 2000 and 2006. Moreover, based on media reports and other sources, micromanaging or hyperpartisan boards were responsible for 24% of involuntary turnover at such universities in red states from 2014 to 2020, a rate more than four times higher than in blue states, Barringer and Harris found.

“One way to weaken these institutions is to weaken the leadership of these institutions,” Harris said. “Higher education is under attack in a way that it has never quite been before. These are direct assaults on the core tenets of the institutions. ... Boards are running leaders out of town. It’s scary stuff.”

The pressure has been intense in Idaho — and especially at its largest university, Boise State. Egged on by the Idaho Freedom Foundation, a nonprofit group dedicated to “exposing, defeating, and replacing the state’s socialist public policies,” conservative legislators have pushed to prevent an overwhelmingly white institution from considering diversity in its policies and programs.

In 2020, Idaho banned affirmative action at public universities. Last year, the state trimmed $1.5 million from Boise State’s budget, targeting diversity, equity and inclusion programs, along with a total of $1 million from the other two state universities. Idaho also became thefirst of seven states to adopt laws aimed at restricting colleges’ teaching or training related to critical race theory, which examines how racism is ingrained in America’s laws and power structure. The lieutenant governor convened a task force to “protect our young people from the scourge of critical race theory, socialism, communism and Marxism” in higher education. This year, the Legislature adopted a nonbinding resolution condemning critical race theory and The New York Times’s 1619 Project for “divisive content” that “seeks to disregard the history of the United States and the nation’s journey to becoming a pillar of freedom in the world.”

Boise State is a revealing prism through which to examine how public universities, meant to be bastions of academic freedom, are responding to red-state pressures. The school would seem to be in a strong position to resist them. It receives a relatively modest 18% of its budget from the state, with the balance from tuition, student fees, federal student financial aid, research grants and donors. Buoyed by its nationally known football team, which plays on a blue field that has come to rival the potato as Idaho’s most recognizable symbol, and located in one of the nation’s fastest-growing metropolitan areas, Boise State has seen its academic stature and private fundraising rise. It received $41.8 million in donations in fiscal 2021, up from $34.2 million in 2020, although one prominent donor vowed to reduce his giving, complaining that the university was trending leftward.

But for all its seeming clout and independence, Boise State has yielded again and again. It has canceled events, like Fillmore’s speech, that might alienate conservatives; avoided using the terms “diversity” and “inclusion”; and suspended a course on ethics and diversity with 1,300 students over a legislator’s unfounded allegation of misconduct by a teacher.

University administrators “seem to want to placate the conservatives,” said sociology lecturer Michael Kreiter, who was an instructor in the suspended course and teaches classes on racism. “Their goal, in my view, is just to stay out of sight, hoping that all of this backlash won’t get focused on them.”

Idaho’s anti-critical race theory law “has chilled some Boise State educators and shut down their teaching and speech about race and gender in the classroom,” said Aadika Singh, legal director at the ACLU of Idaho, which investigated potentially unconstitutional enforcement of the law. “But it is also clear that some courageous educators have doubled down and reacted to the legislature’s attacks on education by teaching more controversial topics. The university administration has not been courageous; they haven’t had their faculty’s backs.” While the investigation remains open, Singh said, the ACLU of Idaho shifted its focus to educating faculty members on their academic freedom and free-speech rights in the classroom.

Boise State spokesperson Mike Sharp said that the 18% slice of its budget doesn’t convey the full scope of the state’s support for the university. Its land is titled in the name of the state Board of Education, and its buildings are all state buildings, he said. If Boise State had to cut programs to meet payroll, he added, enrollment would decline, and its credit rating might be downgraded. Without state support, “Boise State as it exists today would disappear,” Sharp said.

In an email to ProPublica, Tromp explained her strategy. “My aim is to support our faculty, students and staff and to open lines of dialogue with those in our community who are certain universities don’t see or hear them,” she wrote. “The work we are doing has the potential to be truly transformative — not just here but more broadly.” She declined to comment further, saying it is “a delicate moment, in which it continues to be easy to harm the best efforts in almost any direction.”

Some professors worry that the unanswered attacks are hurting Boise State’s credibility. When faculty members and community organizations recently sponsored a symposium on how to adjust property taxes to help homeowners affected by Boise’s soaring housing values, they held it off campus and didn’t list the university as a sponsor, in contrast to a similar symposium that the university conducted on campus 15 years ago.

“I am saddened by what’s happened in the last couple of years,” said Boise State political scientist Stephanie Witt, who helped organize the discussion. “There’s the perception that working with us is somehow connected to this taint on all higher education. We can’t be trusted.”

As it searched for a president in 2019, Boise State was increasingly gaining national recognition — and not just for athletics. Founded as a junior college by the Episcopal church in 1932, it entered the state system in 1969 and became a university in 1974. For years thereafter it was largely a commuter school for working adults. But now enrollment was steadily growing, especially from out of state; 17% of its undergraduates come from California. Its status had recently been upgraded to “high research activity” under the Carnegie system for classifying universities, and U.S. News & World Report had named it one of the country’s 50 most innovative universities.

One shortcoming stood in the way of its aspirations: a lack of diversity. Its faculty is 83% white, 5% Latino, 5% Asian and 1% Black. Even though 43% of degree-seeking undergraduates come from outside predominantly white Idaho, fewer than 2% are Black. Latinos make up 14%. The services needed to attract faculty and students of color, as well as low-income and LGBTQ students, and make them feel at home were scanty compared with many universities.

“We are a modern day Cinderella story,” a university commission concluded in 2017. “Unfortunately ... it is not clear that everyone is being invited nor supported to participate in the ball.” It called for creating “an infrastructure with executive leadership, and with the appropriate resources.”

During the presidential search, faculty, staff and students emphasized the importance of diversity. But some candidates were wary of Idaho politics. One finalist, Andrew Marcus, former dean of arts and sciences at the University of Oregon, cited “limited state funding and a climate of growing national concern about universities” as challenges in his job application. A Boise State staffer warned Marcus that Idaho was a one-party state in which Republicans were split into three factions: Mormons, who supported state funding for higher education; and libertarians and Trump acolytes, who didn’t.

Another hopeful bowed out after researching state politics. “I felt my values may not be shared by the governance structures in Idaho,” she said. “I didn’t want to have those fights.”

Tromp was the clear choice for the job. Born in 1966, she was raised a two-hour drive from the Idaho border, in Green River, Wyoming. Her father was a mechanic in a trona mine, a mineral processed into baking soda, and her mother was a telephone operator. Her high school guidance counselor applied to colleges for her, because she couldn’t afford the application fees. When an East Coast university offered her a full scholarship, her father said, “Honey, what would happen if you got all the way across the country and this turned out not to be real?” She enrolled at Creighton University in Nebraska, where she was smitten by Victorian poetry.

After earning her doctorate at the University of Florida, she spent 14 years at Denison University, a liberal arts college in Ohio. An English professor and director of women’s studies, she earned teaching awards and churned out books and articles. She advocated for nontraditional departments such as queer studies, said Toni King, a professor of Black studies and women’s and gender studies at Denison. “She cares very deeply about individual people, she pulls talent together, she innovates beyond,” King said. “She was always, ‘We can get there quicker, sooner, bigger.’”

Tromp immersed herself in campus life, speaking at “Take Back the Night” marches to raise awareness of violence against women. She was married on the steps of Denison’s library in 2007. Music department faculty played in the reception band. When she left for Arizona State, King thought, “There goes a college president.”

At Arizona State, Tromp served as dean of a college that offered interdisciplinary programs across the sciences, social sciences and humanities. At UC Santa Cruz, which she joined in 2017 as executive vice chancellor, she launched a mentoring program for faculty from underrepresented groups. She also proposed a new strategic plan too quickly, without enough familiarity with campus culture, according to Ronnie Lipschutz, an emeritus professor of politics.

“Marlene swept in and wanted to make an impact,” said Lipschutz, who is the author of an institutional history of UC Santa Cruz that examines why numerous strategic plans there have failed. “She didn’t talk to many people about how the place operated.” Tromp did not respond to questions about the strategic plan and her experience at Santa Cruz.

The battle over her plan was dragging on when Tromp left. She told the Santa Cruz academic senate that “incidents involving her personal and family’s safety” led her to accept the Boise State presidency, according to meeting minutes summarizing her talk. She also “expressed fear that there may be a lack of understanding of how easy it is to incite rage against the leaders in our community.” Santa Cruz colleagues said that she had been alarmed when people threatened and jeered her while she was jogging along a coastal road. They may have been unhoused students for whom dormitory space wasn’t available, and who had been denied permission to live in their cars and park in a campus lot, one friend said.

For a feminist university president, Idaho seemed unlikely to provide a safer, less volatile environment. “We were all surprised” at her departure, “especially since her project had not finished,” Lipschutz said. “The fact that she was going to Idaho was also a bit of a surprise. It was like, ‘Why on earth would you go to Idaho?’”

Tromp had no such doubts. “She was very enthusiastic and very much felt that she was coming home to the region that shaped her,” King said.

The Legislature wasn’t about to give her a honeymoon. In June 2019, Boise State’s interim president had highlighted the university’s diversity initiatives in a newsletter. They included graduation fetes for Black and LGBTQ students, six graduate fellowships for underrepresented minority students, recruiting a Black sorority or fraternity and implicit bias training for employees.

The next month, eight days after Tromp started, half of the 56 Republicans in Idaho’s House of Representatives wrote to her, assailing these programs as “divisive and exclusionary” and “antithetical to the purpose of a public university in Idaho.”

Through no fault of her own, Tromp was boxed in. She responded by calling for “meaningful dialogue,” thanking legislators for their “genuine engagement” and saying she looked forward to hearing their concerns.

In the midst of this firestorm, she met with three student activists. Ushered into her office, they noticed her treadmill desk and the bookshelves featuring her own works. When they told her about racism on campus, including swastikas painted on dormitory walls, Tromp started crying, according to two students, Ryann Banks and Abby Barzee.

“Didn’t you know about this before you took the job?” Banks asked her.

“I did not know,” Tromp said.

About 10 days after the legislators’ letter, cartoon postcards were mailed anonymously to state officials and lawmakers, depicting Tromp as a clown. Other attacks ensued. Although Tromp had spent only two years at UC Santa Cruz, the Idaho Freedom Foundation’s sister organization, Idaho Freedom Action, lampooned her as a “California liberal ... Turning Boise State Into a Taxpayer-Funded Marxist Indoctrination Center.” A scholar of xenophobia in Victorian England, Tromp was experiencing fear of outsiders firsthand.

After the foundation encouraged its supporters to troll her, Tromp received “hundreds and hundreds and hundreds of some of the most venomous hateful emails I could possibly imagine,” she said at a private 2021 meeting, according to a recording the Idaho Freedom Foundation obtained and posted. “Threats to drag me out in the street and sexually assault me and kill me. Messages of hatred. ... It’s a manifestation of the toxicity of the political climate across our country.”

Much as former President Barack Obama once courted congressional Republicans, Tromp sought to conciliate the conservative legislators. In one-on-one meetings, she assured them that she took the free-speech rights of a student wearing a Make America Great Again hat as seriously as anyone else’s. “All means all” became her mantra. Previously either a Democrat or undeclared, she registered to vote in Idaho as a Republican.

But she faced several disadvantages, starting with her gender. “These extremists think that it’s easier to pick off a woman than a man, and so they go after” her, said former Boise State President Bob Kustra.

Tromp’s striking appearance — she’s tall and slender, with close-cropped hair, glasses (often red) and multiple ear piercings — may have disconcerted some Idahoans. “I sometimes wonder if Dr. Tromp isn’t an easier target because she looks like a modern woman,” said Witt, the political scientist. “People say, ‘She’s got more than one hole in her ears, she’s got short hair.’”

As Idaho’s only urban university, Boise State attracts disproportionate media attention and conservative skepticism. It also has few of the natural allies on whom universities often lean politically: alumni in key government posts. Tromp reports to the state Board of Education, which has only one Boise State graduate among its eight members.

While its campus is a mile from the state Capitol building, Boise State’s presence there is sparse. About 10% of legislators are Boise State alumni, which may be partly attributable to its lack of a law school. Two Mormon institutions, Brigham Young University in Provo, Utah, and Brigham Young University-Idaho in Rexburg, together have about twice as many alumni in the Legislature as Boise State does. The University of Idaho has almost double Boise State’s representation. Gov. Brad Little is a University of Idaho graduate.

The disparity is even greater on the Joint Finance-Appropriations Committee, which sets the higher education budget. Six members of the Republican majority on JFAC graduated from the University of Idaho, including a co-chair, and none from Boise State.

As Idaho’s only land-grant university, with the state’s only public law school, the University of Idaho possesses in-state cachet and connections that Boise State is hard-pressed to match. Its diversity initiatives are comparable to Boise State’s. It has a chief diversity officer, as well as a director of diversity and inclusion for its engineering college. Boise State has neither position. Yet the Legislature appropriated 72% more per student to the University of Idaho in fiscal 2022 than to Boise State.

The University of Idaho’s president, C. Scott Green, called out the freedom foundation this past January, denouncing “a false narrative created by conflict entrepreneurs who make their living sowing fear and doubt with legislators and voters.”

Green avoided any pushback because “he has friends in key positions,” said Rep. Brent Crane, a committee chairman and former House assistant majority leader, who graduated from Boise State in 2005.

Even though Crane is an alumnus, Boise State can’t count on his support. His father, a former state legislator and treasurer, is treasurer of the Idaho Freedom Foundation, with which Crane agrees 82% of the time, according to its rankings.

The 47-year-old Crane represents the Boise suburb of Nampa, where he was born and grew up, and where he’s vice president of his family’s security and fire alarm business. He and his brother also own a fire sprinkler company. At a nearby coffeehouse, he said that, when he was a political science major at Boise State, his teachers never revealed their opinions. “What I respected most about my professors was that I didn’t know if they were Democrats or Republicans,” he said. “Whatever the student thought, the professor took the opposite tack. In my perfect world, I’d like to see Boise State get back to where it was when I was there.”

Crane, who is white, said that he disagrees with critical race theory: “There’s no racism in my life.” In his boyhood, he said, “African Americans were revered and looked up to. They were the athletes who played on the football and basketball teams. They were the heroes.”

Under immediate pressure, Tromp began rethinking her agenda. “From day one, when she came in, and the letter from the legislators came in saying, ‘You’re under a microscope, you’d better start scrubbing your campus of these programs,’ that changed the operating environment from her perspective, and probably the perspective of everyone,” one insider said.

“There was a quiet reassessment of what can we reasonably accomplish and an ongoing conversation about how do we serve our students best without unnecessarily inflaming the rage and the accusations of these legislators?’”

Crane, the legislator and Boise State alumnus, had a role in one of the university’s early concessions. Boise State was advertising for a new position: vice provost for equity and inclusion. It would be the top diversity job at the university, implementing Tromp’s agenda. The vice provost would oversee recruiting and retaining faculty, building diversity into the curriculum and monitoring the campus climate.

The search produced two finalists. One of them, Brandy Bryson, looked into Idaho politics and withdrew her name from consideration. “There was no way the institution was going to survive the political strong-arming that was coming from the Legislature,” said Bryson, director of inclusive excellence at Appalachian State University in North Carolina. “Boise State’s desire to hire a vice provost for equity and inclusion was a clear commitment to academic excellence and the empirically proven benefits of diversity, which the Legislature didn’t seem to understand or value.”

The other finalist, John Miller Jr., then chair of social work at a liberal arts college in the South, noticed that someone from the Idaho Freedom Foundation was tracking him on social media. Nevertheless, he accepted an invitation to visit Boise State, where he met in March 2020 with Tromp and other leaders, and gave a presentation.

Some search committee members had reservations about Miller, who wasn’t a shoo-in, insiders said. Still, “the vibe I got, when I was dropped off at the airport, I fully expected an offer,” Miller said. “I was definitely under strong consideration.”

After the student newspaper reported on the opening, though, Boise State’s critics weighed in. Idaho Freedom Foundation President Wayne Hoffman wrote on the group’s website that “BSU didn’t get the message” from the “written rebuke” by the 28 legislators. Shortly after Miller returned to South Carolina, Crane denounced his alma mater for hiring a “vice president of diversity,” calling it “a direct affront” to the Legislature and “me personally.” Despite getting the job title wrong, Crane clearly meant the vice provost position.

Crane also conveyed his concerns privately to Tromp. He regarded the new position as part of “the woke agenda sweeping the country: I don’t want to see Boise State caught up in that,” he told ProPublica. The House had already killed the higher education budget twice. If Tromp had forged ahead, other Boise State priorities might not have been funded, Crane said.

“She and I disagree on the vice provost of diversity,” he told ProPublica. “That’s not a hill she wants to die on. She chose to pay deference.” A week later, Boise State notified Miller that it had halted the search. It never filled the position.

Crane continued to lambaste Boise State. During an April 2021 debate on the higher education budget, Crane read aloud what he said was an email from an unnamed Boise State music student complaining that a professor had asked a class to discuss how Black composers are superior to white composers. The student protested that skin color has nothing to do with the quality of music but was purportedly told to be quiet. (The incident could not be confirmed.)

“I’m disgusted. I’m embarrassed and I’m ashamed,” Crane told the legislature. “There has been a direct shift in the ideology that’s being taught at Boise State University. ... Our tax dollars” do not “need to be spent silencing kids’ voices on our college campuses.”

One way that Boise State sought to reduce legislative pushback was by adjusting its language. For example, Tromp asked a university planning committee to avoid the words “diversity” and “inclusion,” which legislators would be searching for, said Angel Cantu, a former student government president on the committee. Boise State’s 2022-26 strategic plan doesn’t mention “diversity” or “inclusion,” while the phrase “equity gaps” appears four times. By contrast, the University of Idaho’s plan calls for building an “inclusive, diverse community” and creating an “inclusive learning environment.”

Boise State administrators discussed the importance of terminology at several meetings, a former official recalled. The message was that “you can use different words to have the same meaning. Equity and words like that are less incendiary.”

The university tweaked job titles similarly. In August 2020, Francisco Salinas, then the university’s top diversity officer, moved from “director of student diversity and inclusion” to “assistant to the vice president for equity initiatives.”

Although his responsibilities did change, Salinas said, the new description wasn’t his choice, and he disagreed with scrubbing words like diversity. “The tactics being used” against Boise State, he said, “were bullying tactics. It’s the same thing you learn as a kid. If a bully is successful at taking your lunch money, they’re going to keep going. You have to stand up and let them know they can’t do that to you.”

Discouraged, Salinas left Boise State in April to become dean of equity, diversity and inclusion at Spokane Falls Community College in Washington. He said other diversity officials have fled. “I know what Dr. Tromp’s heart is,” he said. “I was very pleased she was hired. I thought she’d be able to make progress along this axis. But the environment did not afford that.”

The legislative barrage also affected recruitment. “I’ve been on hiring committees and I see who applies for jobs here,” said Utych, the former political science professor. “They are a lot whiter than they are at other universities. Part of that is the location, but part of that is also the Legislature attacking diversity and inclusion.”

Tromp “described being very, very disheartened that the best thing to do might be to pull back because of the resistance,” her friend King recalled. “There was concern, with all the information she had before her, how could she move forward? She had to think about the university as a whole.”

When the university did move forward with a lightning-rod event, it took precautions to avoid a backlash. Republican legislators had attacked the “Rainbow Graduation,” which honors LGBTQ students, in their letter to Tromp, and the Idaho Freedom Foundation had accused Boise State of holding “segregationist” commencements. At this spring’s Rainbow Graduation, Boise State’s dean of students pointedly reminded the 30 or so seniors that “this is not a commencement ceremony.” Since they were aware that they would actually graduate nine days later, the disclaimer appeared to be intended for critics outside the university.

Some faculty were undaunted. The sociology department has doubled the number of its courses focusing on race and racism from two to four, and it opened an Anti-Racism Collective that brings in speakers. “This is a great opportunity in some sense,” said sociology department chairman Arthur Scarritt. Added Kreiter, who doesn’t have tenure: “I feel I don’t have a lot of longevity here. I’m just going to teach this as fiery as I can.”

Several professors and administrators urged Tromp to fight back. “There were a lot of people on campus, even in senior leadership, who said, ‘You can’t get out of this by taking the high road,’” one recalled. “I would have preferred a more direct approach.”

Tromp drew the line at cultivating the Idaho Freedom Foundation. Hoffman said he has asked to meet with her on multiple occasions and has been refused. “Nothing has changed at Boise State,” he said in an email. “It’s just handled more carefully.”

There is some evidence for the contention by Crane and other critics that conservative students at Boise State tend to feel squelched in class. A state Board of Education survey completed last November found that 36% of Boise State students who self-identified as right of center felt pressured often or very frequently to accept beliefs they found offensive, as opposed to 12% of students in the center and 6% on the left. Conservative students were more apt to feel this pressure from professors; liberals, from classmates.

Still, the faculty encompasses a range of views. Anne Walker, chair of the economics department, holds a fellowship in free enterprise capitalism. One member of the lieutenant governor’s task force on communism in higher education was Scott Yenor, a Boise State political scientist and occasional Tucker Carlson guest. In December 2020, Yenor and an Idaho Freedom Foundation analyst co-authored a report urging the Legislature to “direct the university to eliminate courses that are infused with social justice ideology.” In a speech last fall, Yenor mocked feminists as “medicated, meddlesome and quarrelsome” and universities as “the citadels of our gynecocracy.”

Boise State’s donors also span the political spectrum. Timber and cattle ranching magnate Larry Williams served for 20 years on the Boise State Foundation board and has donated millions of dollars for athletics and business programs. He has also given six figures to the Idaho Freedom Foundation. In this year’s Republican primary campaign, he gave about $125,000 to more than 30 conservative candidates, including $1,000 to Crane.

Throughout 2020, Williams pressed Boise State to scuttle the programs identified by the 28 Republican legislators, to no avail. Although he found Tromp to be open and engaging, he told legislators in February 2021 that he would no longer donate to Boise State, with the exception of its football program, “until this is turned around.”

“It appears BSU no longer shares our Idaho values,” Williams wrote. “Students are taught ... that our honest, hardworking rural farmers, ranchers, miners and loggers are ‘white privileged’ with ‘implicit bias’ toward minorities and Native Americans.”

The Idaho Freedom Foundation’s Hoffman acknowledged that Boise State has fewer diversity initiatives than some big universities in other states. “We recognize that it’s a small but growing dedication of resources to this enterprise,” he said. “I don’t care how big it is. I care if any taxpayer dollars are wasted on these efforts. We want to catch it now before it becomes an even bigger problem.”

Like white students from rural Idaho who are exposed for the first time to concepts like white privilege and systemic racism, some students of color, especially from other states, endure culture shock on campus. After Kennyetta Coulter, a biology major from Long Beach, California, arrived at Boise State last year, accompanied by her mother, they hardly saw another Black person for two weeks. “If you don’t like Boise, don’t be afraid to tell me,” her mother said on leaving.

In a “Difficult Conversations” class, Coulter, who describes herself as a political moderate, found that she was the only student in her discussion group who favored background checks for gun buyers or was open to letting transgender athletes participate in sports based on their gender identity. Her three roommates, all of whom had blue eyes and blond hair, were nice to her. But sometimes she felt peer pressure to suppress her views. At Boise State football games, she squirmed in the student section while “big, buff white boys with cowboy boots” chanted, “Fuck Joe Biden.”

Coulter became so depressed that she sought counseling. “Sometimes I just feel I’m all alone,” she said, “and I’m the only one who understands what I’m going through.” She didn’t have the energy to go to class and stayed in bed and watched television.

The administration’s reluctance to challenge legislators dispirited her. “Why isn’t the university saying anything?” Coulter wondered.

In some red states, public universities have fought back. The University of Nebraska has been especially effective in warding off political pressure. It’s the only public university in Nebraska, and about half of the state’s legislators earned degrees from institutions within the University of Nebraska system. So did all eight regents. And as a retired vice admiral and former superintendent of the U.S. Naval Academy, Nebraska president Ted Carter has the kind of military credentials that make it hard to call him a communist.

University regent Jim Pillen, a veterinarian and former Nebraska football star who is running for governor, proposed a resolution last year that critical race theory “seeks to silence opposing views and disparage important American ideals” and should not be “imposed in curriculum, training and programming.”

Aided by the ACLU of Nebraska and other advocacy groups, the university’s administration, faculty and student government mobilized against the resolution. At a hearing last August before the regents, almost 40 people testified against it, while only a handful supported it. Defenders of critical race theory noted that the Declaration of Independence refers to “merciless Indian Savages.” A retired English professor pleaded with the board: “If you pass this, you repudiate my whole career.”

The four nonvoting student regents also voiced their opposition, including Batool Ibrahim, the first Black student government president of Nebraska’s flagship Lincoln campus. Ibrahim considers herself a native Nebraskan, although technically she isn’t. Her Sudanese parents were flying to the U.S. in 1999, hoping she would be born on American soil so she could become president someday, when her mother went into labor on the plane. The pilot hurriedly landed in Dubai, where Ibrahim was born. The family soon moved to Lincoln, where she grew up.

Critical race theory “is the history of people of color in this nation,” Ibrahim said. “It is my history. So when we talk about whether critical race theory should be taught or it should not be taught, you’re telling me that my history does not belong in the classroom.”

Pillen defended his resolution, saying that it did not violate academic freedom and that “Nebraskans deserve the confidence of knowing their hard-earned tax dollars cannot be used to force critical race theory on anyone.”

The board upheld teaching critical race theory by a 5-3 vote. But the battle was just starting. One regent in the majority warned that 400 of 550 constituents who contacted him supported the resolution — a promising sign for Pillen, who would go on to win the Republican gubernatorial nomination.

In November 2021, the chancellor of the University of Nebraska’s Lincoln campus, saying he had been “shaken” by the Minneapolis police killing of George Floyd, announced a plan to “recruit, retain and support the success of students, faculty and staff who are people of color.” Nebraska Gov. Pete Ricketts, who can’t seek reelection because of term limits and has endorsed Pillen, called the plan “ideological indoctrination” that would “inject critical race theory into every corner of campus.”

Then a Nebraska legislator proposed withholding funds from colleges or public schools that engaged in “race or sex scapegoating.” In a rerun of the regents’ hearing, 40 people testified against the bill in February, while three supported it. Speaking for the university, Richard Moberly, dean of the law school, warned that the bill could be interpreted to prohibit legitimate discussion of systemic racism and unconscious bias. It died in committee.

Pillen isn’t giving up. “As governor, I’ll fight CRT and other un-American, far-left ideologies in our classrooms,” he told ProPublica.

Despite Tromp’s conciliatory approach, a controversy in October 2020 further roiled the university’s critics. It pitted a popular downtown establishment, Big City Coffee, which had just opened a branch in Boise State’s library, against student activists galvanized by Floyd’s killing five months before.

Big City Coffee’s name appears to be ironic. Agricultural signs hang from the walls and rafters: “Duroc Hog,” “Strawberries for Sale,” “Cattle Crossing.” But it was another aspect of the downtown location’s decor that prompted student complaints, even though it wasn’t replicated in the library shop: a “thin blue line” flag. The students argued that such flags can signify support for white supremacists and hostility to the Black Lives Matter movement, and that a business with those sentiments should not have a campus outlet.

The coffee shop owner, who describes herself as a political moderate, explained that she was engaged to a former police officer who had been shot and disabled in the line of duty, and that she only meant to support law enforcement. Student government President Angel Cantu agreed that the shop should not be kicked off campus simply for being sympathetic to first responders.

The protesters weren’t mollified. They were already upset with Cantu because they wanted the university to cancel its security contract with Boise police. He felt Boise State shouldn’t do so without first knowing how to replace the department’s services.

The wrangle escalated as Big City Coffee shut down the campus branch, and other student government leaders impeached Cantu. The coffee shop owner sued Boise State, Tromp and three other university officials, accusing them of forcing her off campus. Charges against the university and Tromp were dismissed, while the case is proceeding against the other defendants, who have denied wrongdoing.

The branch’s demise and Cantu’s impeachment galvanized conservative students. Jacinta Rigi, a sophomore who had opposed the impeachment, posted a video accusing the student government of ignoring her and others on campus. “Freedom of speech is being abused and stolen from many students at the university and our voices are being silenced,” she said. The video drew almost 8,300 views, and Rigi ran for student government president in 2021.

Although Rigi lost — she now works at Fox News in New York while completing her Boise State degree online — the political momentum on campus had shifted. This past March, Adam Jones, a former intern in the Republican Party’s Boise office who urged Boise State to reconcile with the Legislature, was elected student government president. “Too often it is looked at that the state is being the bad guy,” Jones told ProPublica.

Jones is a Boise native. His father, a lawyer, and his mother, a banker, both graduated from Boise State. He campaigned in a 1993 white Ford pickup truck he rebuilt himself, with “Blue Lives Matter” and “God Bless America” stickers on its rear windshield, a mounted American flag and a “USA4EVA” license plate. Asked about public safety at a candidates’ debate, he said, “Every time I see a Boise police officer go by, I feel safe.”

In March 2021, about 1,300 Boise State students were taking University Foundations 200, “Foundations of Ethics and Diversity.” The course, which predated Tromp, was split into more than 50 sections. Each tackled the topic through a different lens, from the “Star Wars” saga to how lack of access to technology affects rural Americans and other groups.

Sociology professor Dora Ramírez was teaching a section on censorship. She was about to start a unit about a bill, under consideration in the Idaho Legislature, attacking critical race theory. Then, Ramírez said, she and the other UF 200 instructors got a lesson in censorship from their own university.

Boise State had received a complaint from a legislator, who has never been publicly identified. The legislator said he had seen a video of a UF 200 class in which an instructor had demeaned a female student’s intelligence and forced her to apologize in front of the class for being white. She was supposedly taunted by other students and left the class in tears.

Without seeing the video, Tromp suspended all UF 200 sections for a week and hired a law firm to investigate. “Isn’t it ironic?” to suspend a censorship class, Ramírez recalled thinking. “What a way to undermine the authority of all those instructors. You work so hard to build a rapport with all those students. Then they’re thinking, ‘What did she do wrong?’”

Some faculty members were appalled. “A lot of us were quickly pointing out, ‘We have students of color made to feel bad every day of the week,’” said sociologist Martin Orr, a former president of the faculty senate. “One white student feels bad, all hell breaks loose.”

When the course resumed, Kreiter used the suspension as fodder for his UF 200 section on inequality in higher education. “The university is robbing you of your education because of politics,” he told students. “You’re still out the same tuition bill, but you’re getting less education.”

The law firm’s report, which came out in May, concluded that no student was mistreated and no instructor acted improperly. The complaint apparently mischaracterized a class discussion about universal health care in which a student had called an instructor’s logic “stupid” — not the other way around. “There were no reports of anyone being forced to apologize for being white.” The legislator told investigators that he didn’t have the video, which has never surfaced publicly.

Tromp told the Inlander, a community newspaper in Spokane, Washington, that since she hadn’t known in which class section the alleged incident took place, she had been forced to suspend the entire course. Other university presidents whom she consulted agreed with her decision, she said. “It’s a little bit like being told there’s a gas leak in the building, but you don’t know where it is,” Tromp said. “It always feels dramatic to clear the building to find the gas leak.”

For one UF 200 instructor, who was teaching a section on misinformation, the incident was “very much” what his class was about. Legislators were “trying to craft a completely unwarranted narrative for political reasons in order to shut something down.”

Nevertheless, Tromp redoubled catering to them. She established an “Institute for Advancing American Values” to inspire “us to talk and listen to each other respectfully.” Its first speaker was conservative pundit Jason Riley.

Boise State also scaled back an annual tradition, “Day at the Capitol.” In the past, a dozen student government members would set up a booth in the Capitol rotunda and chat with legislators. Other students were invited to watch from the gallery.

Mostly, Democratic lawmakers dropped by. Republicans sent aides to say they were busy. “We got used to being avoided by them,” Cantu said. “We still went out of our way to invite them.”

This year, there was no booth. “The university’s concern was that the students would protest or do something inappropriate,” Jones said. Two student leaders met briefly with the governor as he declared it “Boise State University Day.” Three other students delivered gifts — 105 jars of honey, courtesy of Boise State’s beekeeping team — to the offices of each of the 70 representatives and 35 senators.

While reining in students, Boise State invited Crane, the alumnus who had opposed hiring a vice provost for equity and inclusion, to introduce its leadership team on that special day to the House chambers. Crane was delighted to help.

On Jan. 11, antivirus company Bitdefender said it was “happy to announce" a startling breakthrough. It had found a flaw in the ransomware that a gang known as DarkSide was using to freeze computer networks of dozens of businesses in the U.S. and Europe. Companies facing demands from DarkSide could download a free tool from Bitdefender and avoid paying millions of dollars in ransom to the hackers.

But Bitdefender wasn't the first to identify this flaw. Two other researchers, Fabian Wosar and Michael Gillespie, had noticed it the month before and had begun discreetly looking for victims to help. By publicizing its tool, Bitdefender alerted DarkSide to the lapse, which involved reusing the same digital keys to lock and unlock multiple victims. The next day, DarkSide declared that it had repaired the problem, and that “new companies have nothing to hope for."

“Special thanks to BitDefender for helping fix our issues," DarkSide said. “This will make us even better."

DarkSide soon proved it wasn't bluffing, unleashing a string of attacks. This month, it paralyzed the Colonial Pipeline Co., prompting a shutdown of the 5,500 mile pipeline that carries 45% of the fuel used on the East Coast, quickly followed by a rise in gasoline prices, panic buying of gas across the Southeast and closures of thousands of gas stations. Absent Bitdefender's announcement, it's possible that the crisis might have been contained, and that Colonial might have quietly restored its system with Wosar and Gillespie's decryption tool.

Instead, Colonial paid DarkSide $4.4 million in Bitcoin for a key to unlock its files. “I will admit that I wasn't comfortable seeing money go out the door to people like this," CEO Joseph Blount told The Wall Street Journal.

The missed opportunity was part of a broader pattern of botched or half-hearted responses to the growing menace of ransomware, which during the pandemic has disabled businesses, schools, hospitals and government agencies across the country. The incident also shows how antivirus companies eager to make a name for themselves sometimes violate one of the cardinal rules of the cat-and-mouse game of cyber-warfare: Don't let your opponents know what you've figured out. During World War II, when the British secret service learned from decrypted communications that the Gestapo was planning to abduct and murder a valuable double agent, Johnny Jebsen, his handler wasn't allowed to warn him for fear of cluing in the enemy that its cipher had been cracked. Today, ransomware hunters like Wosar and Gillespie try to prolong the attackers' ignorance, even at the cost of contacting fewer victims. Sooner or later, as payments drop off, the cybercriminals realize that something has gone wrong.

Whether to tout a decryption tool is a “calculated decision," said Rob McLeod, senior director of the threat response unit for cybersecurity firm eSentire. From the marketing perspective, “You are singing that song from the rooftops about how you have come up with a security solution that will decrypt a victim's data. And then the security researcher angle says, 'Don't disclose any information here. Keep the ransomware bugs that we've found that allow us to decode the data secret, so as not to notify the threat actors.'"

Wosar said that publicly releasing tools, as Bitdefender did, has become riskier as ransoms have soared and the gangs have grown wealthier and more technically adept. In the early days of ransomware, when hackers froze home computers for a few hundred dollars, they often couldn't determine how their code was broken unless the flaw was specifically pointed out to them.

Today, the creators of ransomware “have access to reverse engineers and penetration testers who are very very capable," he said. “That's how they gain entrance to these oftentimes highly secured networks in the first place. They download the decryptor, they disassemble it, they reverse engineer it and they figure out exactly why we were able to decrypt their files. And 24 hours later, the whole thing is fixed. Bitdefender should have known better."

It wasn't the first time that Bitdefender trumpeted a solution that Wosar or Gillespie had beaten it to. Gillespie had broken the code of a ransomware strain called GoGoogle and was helping victims without any fanfare, when Bitdefender released a decryption tool in May 2020. Other companies have also announced breakthroughs publicly, Wosar and Gillespie said.

“People are desperate for a news mention, and big security companies don't care about victims," Wosar said.

Bogdan Botezatu, director of threat research at Bucharest, Romania-based Bitdefender, said the company wasn't aware of the earlier success in unlocking files infected by DarkSide. Regardless, he said, Bitdefender decided to publish its tool “because most victims who fall for ransomware do not have the right connection with ransomware support groups and won't know where to ask for help unless they can learn about the existence of tools from media reports or with a simple search."

Bitdefender has provided free technical support to more than a dozen DarkSide victims, and “we believe many others have successfully used the tool without our intervention," Botezatu said. Over the years, Bitdefender has helped individuals and businesses avoid paying more than $100 million in ransom, he said.

Bitdefender recognized that DarkSide might correct the flaw, Botezatu said. “We are well aware that attackers are agile and adapt to our decryptors." But DarkSide might have “spotted the issue" anyway. “We don't believe in ransomware decryptors made silently available. Attackers will learn about their existence by impersonating home users or companies in need, while the vast majority of victims will have no idea that they can get their data back for free."

The attack on Colonial Pipeline, and the ensuing chaos at the gas pumps throughout the Southeast, appears to have spurred the federal government to be more vigilant. President Joe Biden issued an executive order to improve cybersecurity and create a blueprint for a federal response to cyberattacks. DarkSide said it was shutting down under U.S. pressure, although ransomware crews have often disbanded to avoid scrutiny and then re-formed under new names, or their members have launched or joined other groups.

“As sophisticated as they are, these guys will pop up again, and they'll be that much smarter," said Aaron Tantleff, a Chicago cybersecurity attorney who has consulted with 10 companies attacked by DarkSide. “They'll come back with a vengeance."

At least until now, private researchers and companies have often been more effective than the government in fighting ransomware. Last October, Microsoft disrupted the infrastructure of Trickbot, a network of more than 1 million infected computers that disseminated the notorious Ryuk strain of ransomware, by disabling its servers and communications. That month, ProtonMail, the Swiss-based email service, shut down 20,000 Ryuk-related accounts.

Wosar and Gillespie, who belong to a worldwide volunteer group called the Ransomware Hunting Team, have cracked more than 300 major ransomware strains and variants, saving an estimated 4 million victims from paying billions of dollars.

By contrast, the FBI rarely decrypts ransomware or arrests the attackers, who are typically based in countries like Russia or Iran that lack extradition agreements with the U.S. DarkSide, for instance, is believed to operate out of Russia. Far more victims seek help from the Hunting Team, through websites maintained by its members, than from the FBI.

The U.S. Secret Service also investigates ransomware, which falls under its purview of combating financial crimes. But, especially in election years, it sometimes rotates agents off cyber assignments to carry out its better-known mission of protecting presidents, vice presidents, major party candidates and their families. European law enforcement, especially the Dutch National Police, has been more successful than the U.S. in arresting attackers and seizing servers.

Similarly, the U.S. government has made only modest headway in pushing private industry, including pipeline companies, to strengthen cybersecurity defenses. Cybersecurity oversight is divided among an alphabet soup of agencies, hampering coordination. The Department of Homeland Security conducts “vulnerability assessments" for critical infrastructure, which includes pipelines.

It reviewed Colonial Pipeline in around 2013 as part of a study of places where a cyberattack might cause a catastrophe. The pipeline was deemed resilient, meaning that it could recover quickly, according to a former DHS official. The department did not respond to questions about any subsequent reviews.

Five years later, DHS created a pipeline cybersecurity initiative to identify weaknesses in pipeline computer systems and recommend strategies to address them. Participation is voluntary, and a person familiar with the initiative said that it is more useful for smaller companies with limited in-house IT expertise than for big ones like Colonial. The National Risk Management Center, which oversees the initiative, also grapples with other thorny issues such as election security.

Ransomware has skyrocketed since 2012, when the advent of Bitcoin made it hard to track or block payments. The criminals' tactics have evolved from indiscriminate “spray and pray" campaigns seeking a few hundred dollars apiece to targeting specific businesses, government agencies and nonprofit groups with multimillion-dollar demands.

Attacks on energy businesses in particular have increased during the pandemic — not just in the U.S. but in Canada, Latin America and Europe. As the companies allowed employees to work from home, they relaxed some security controls, McLeod said.

Since 2019, numerous gangs have ratcheted up pressure with a technique known as “double extortion." Upon entering a system, they steal sensitive data before launching ransomware that encodes the files and makes it impossible for hospitals, universities and cities to do their daily work. If the loss of computer access is not sufficiently intimidating, they threaten to reveal confidential information, often posting samples as leverage. For instance, when the Washington, D.C., police department didn't pay the $4 million ransom demanded by a gang called Babuk last month, Babuk published intelligence briefings, names of criminal suspects and witnesses, and personnel files, from medical information to polygraph test results, of officers and job candidates.

DarkSide, which emerged last August, epitomized this new breed. It chose targets based on a careful financial analysis or information gleaned from corporate emails. For instance, it attacked one of Tantleff's clients during a week when the hackers knew the company would be vulnerable because it was transitioning its files to the cloud and didn't have clean backups.

To infiltrate target networks, the gang used advanced methods such as “zero-day exploits" that immediately take advantage of software vulnerabilities before they can be patched. Once inside, it moved swiftly, looking not only for sensitive data but also for the victim's cyber insurance policy, so it could peg its demands to the amount of coverage. After two to three days of poking around, DarkSide encrypted the files.

“They have a faster attack window," said Christopher Ballod, associate managing director for cyber risk at Kroll, the business investigations firm, who has advised half a dozen DarkSide victims. “The longer you dwell in the system, the more likely you are to be caught."

Typically, DarkSide's demands were “on the high end of the scale," $5 million and up, Ballod said. One scary tactic: If publicly traded companies didn't pay the ransom, DarkSide threatened to share information stolen from them with short-sellers who would profit if the share price dropped upon publication.

DarkSide's site on the dark web identified dozens of victims and described the confidential data it claimed to have filched from them. One was New Orleans law firm Stone Pigman Walther Wittmann. “A big annoyance is what it was," attorney Phil Wittmann said, referring to the DarkSide attack in February. “We paid them nothing," said Michael Walshe Jr., chair of the firm's management committee, declining to comment further.

Last November, DarkSide adopted what is known as a “ransomware-as-a-service" model. Under this model, it partnered with affiliates who launched the attacks. The affiliates received 75% to 90% of the ransom, with DarkSide keeping the remainder. As this partnership suggests, the ransomware ecosystem is a distorted mirror of corporate culture, with everything from job interviews to procedures for handling disputes. After DarkSide shut down, several people who identified themselves as its affiliates complained on a dispute resolution forum that it had stiffed them. “The target paid, but I did not receive my share," one wrote.

Together, DarkSide and its affiliates reportedly grossed at least $90 million. Seven of Tantleff's clients, including two companies in the energy industry, paid ransoms ranging from $1.25 million to $6 million, reflecting negotiated discounts from initial demands of $7.5 million to $30 million. His other three clients hit by DarkSide did not pay. In one of those cases, the hackers demanded $50 million. Negotiations grew acrimonious, and the two sides couldn't agree on a price.

DarkSide's representatives were shrewd bargainers, Tantleff said. If a victim said it couldn't afford the ransom because of the pandemic, DarkSide was ready with data showing that the company's revenue was up, or that COVID-19's impact was factored into the price.

DarkSide's grasp of geopolitics was less advanced than its approach to ransomware. Around the same time that it adopted the affiliate model, it posted that it was planning to safeguard information stolen from victims by storing it in servers in Iran. DarkSide apparently didn't realize that an Iranian connection would complicate its collection of ransoms from victims in the U.S., which has economic sanctions restricting financial transactions with Iran. Although DarkSide later walked back this statement, saying that it had only considered Iran as a possible location, numerous cyber insurers had concerns about covering payments to the group. Coveware, a Connecticut firm that negotiates with attackers on behalf of victims, stopped dealing with DarkSide.

Ballod said that, with their insurers unwilling to reimburse the ransom, none of his clients paid DarkSide, despite concerns about exposure of their data. Even if they had caved in to DarkSide, and received assurances from the hackers in return that the data would be shredded, the information might still leak, he said.

During DarkSide's changeover to the affiliate model, a flaw was introduced into its ransomware. The vulnerability caught the attention of members of the Ransomware Hunting Team. Established in 2016, the invitation-only team consists of about a dozen volunteers in the U.S., Spain, Italy, Germany, Hungary and the U.K. They work in cybersecurity or related fields. In their spare time, they collaborate in finding and decrypting new ransomware strains.

Several members, including Wosar, have little formal education but an aptitude for coding. A high school dropout, Wosar grew up in a working-class family near the German port city of Rostock. In 1992, at the age of 8, he saw a computer for the first time and was entranced. By 16, he was developing his own antivirus software and making money from it. Now 37, he has worked for antivirus firm Emsisoft since its inception almost two decades ago and is its chief technology officer. He moved to the U.K. from Germany in 2018 and lives near London.

He has been battling ransomware hackers since 2012, when he cracked a strain called ACCDFISA, which stood for “Anti Cyber Crime Department of Federal Internet Security Agency." This fictional agency was notifying people that child pornography had infected their computers, and so it was blocking access to their files unless they paid $100 to remove the virus.

The ACCDFISA hacker eventually noticed that the strain had been decrypted and released a revised version. Many of Wosar's subsequent triumphs were also fleeting. He and his teammates tried to keep criminals blissfully unaware for as long as possible that their strain was vulnerable. They left cryptic messages on forums inviting victims to contact them for assistance or sent direct messages to people who posted that they had been attacked.

In the course of protecting against computer intrusions, analysts at antivirus firms sometimes detected ransomware flaws and built decryption tools, though it wasn't their main focus. Sometimes they collided with Wosar.

In 2014, Wosar discovered that a ransomware strain called CryptoDefense copied and pasted from Microsoft Windows some of the code it used to lock and unlock files, not realizing that the same code was preserved in a folder on the victim's own computer. It was missing the signal, or “flag," in their program, usually included by ransomware creators to instruct Windows not to save a copy of the key.

Wosar quickly developed a decryption tool to retrieve the key. “We faced an interesting conundrum," Sarah White, another Hunting Team member, wrote on Emsisoft's blog. “How to get our tool out to the most victims possible without alerting the malware developer of his mistake?"

Wosar discreetly sought out CryptoDefense victims through support forums, volunteer networks and announcements of where to contact for help. He avoided describing how the tool worked or the blunder it exploited. When victims came forward, he supplied the fix, scrubbing the ransomware from at least 350 computers. CryptoDefense eventually “caught on to us ... but he still did not have access to the decrypter we used and had no idea how we were unlocking his victims' files," White wrote.

But then an antivirus company, Symantec, uncovered the same problem and bragged about the discovery on a blog post that “contained enough information to help the CryptoDefense developer find and correct the flaw," White wrote. Within 24 hours the attackers began spreading a revised version. They changed its name to CryptoWall and made $325 million.

Symantec “chose quick publicity over helping CryptoDefense victims recover their files," White wrote. “Sometimes there are things that are better left unsaid."

A spokeswoman for Broadcom, which acquired Symantec's enterprise security business in 2019, declined to comment, saying that “the team members who worked on the tool are no longer with the company."

Like Wosar, the 29-year-old Gillespie comes from poverty and never went to college. When he was growing up in central Illinois, his family struggled so much financially that they sometimes had to move in with friends or relatives. After high school, he worked full time for 10 years at a computer repair chain called Nerds on Call. Last year, he became a malware and cybersecurity researcher at Coveware.

Last December, he messaged Wosar for help. Gillespie had been working with a DarkSide victim who had paid a ransom and received a tool to recover the data. But DarkSide's decryptor had a reputation for being slow, and the victim hoped that Gillespie could speed up the process.

Gillespie analyzed the software, which contained a key to release the files. He wanted to extract the key, but because it was stored in an unusually complex way, he couldn't. He turned to Wosar, who was able to isolate it.

The teammates then began testing the key on other files infected by DarkSide. Gillespie checked files uploaded by victims to the website he operates, ID Ransomware, while Wosar used VirusTotal, an online database of suspected malware.

That night, they shared a discovery.

“I have confirmation DarkSide is re-using their RSA keys," Gillespie wrote to the Hunting Team on its Slack channel. A type of cryptography, RSA generates two keys: a public key to encode data and a private key to decipher it. RSA is used legitimately to safeguard many aspects of e-commerce, such as protecting credit numbers. But it's also been co-opted by ransomware hackers.

“I noticed the same as I was able to decrypt newly encrypted files using their decrypter," Wosar replied less than an hour later, at 2:45 a.m. London time.

Their analysis showed that, before adopting the affiliate model, DarkSide had used a different public and private key for each victim. Wosar suspected that, during this transition, DarkSide introduced a mistake into its affiliate portal used to generate the ransomware for each target. Wosar and Gillespie could now use the key that Wosar had extracted to retrieve files from Windows machines seized by DarkSide. The cryptographic blunder didn't affect Linux operating systems.

“We were scratching our heads," Wosar said. “Could they really have fucked up this badly? DarkSide was one of the more professional ransomware-as-a-service schemes out there. For them to make such a huge mistake is very, very rare."

The Hunting Team celebrated quietly, without seeking publicity. White, who is a computer science student at Royal Holloway, part of the University of London, began looking for DarkSide victims. She contacted firms that handle digital forensics and incident response.

“We told them, 'Hey listen, if you have any DarkSide victims, tell them to reach out to us, we can help them. We can recover their files and they don't have to pay a huge ransom,'" Wosar said.

The DarkSide hackers mostly took the Christmas season off. Gillespie and Wosar expected that, when the attacks resumed in the new year, their discovery would help dozens of victims. But then Bitdefender published its post, under the headline “Darkside Ransomware Decryption Tool."

In a messaging channel with the ransomware response community, someone asked why Bitdefender would tip off the hackers. “Publicity," White responded. “Looks good. I can guarantee they'll fix it much faster now though."

She was right. The next day, DarkSide acknowledged the error that Wosar and Gillespie had found before Bitdefender. “Due to the problem with key generation, some companies have the same keys," the hackers wrote, adding that up to 40% of keys were affected.

DarkSide mocked Bitdefender for releasing the decryptor at “the wrong time…., as the activity of us and our partners during the New Year holidays is the lowest."

Adding to the team's frustrations, Wosar discovered that the Bitdefender tool had its own drawbacks. Using the company's decryptor, he tried to unlock samples infected by DarkSide and found that they were damaged in the process. “They actually implemented the decryption wrong," Wosar said. “That means if victims did use the Bitdefender tool, there's a good chance that they damaged the data."

Asked about Wosar's criticism, Botezatu said that data recovery is difficult, and that Bitdefender has “taken all precautions to make sure that we're not compromising user data" including exhaustive testing and “code that evaluates whether the resulting decrypted file is valid."

Even without Bitdefender, DarkSide might have soon realized its mistake anyway, Wosar and Gillespie said. For example, as they sifted through compromised networks, the hackers might have come across emails in which victims helped by the Hunting Team discussed the flaw.

“They might figure it out that way — that is always a possibility," Wosar said. “But it's especially painful if a vulnerability is being burned through something stupid like this."

The incident led the Hunting Team to coin a term for the premature exposure of a weakness in a ransomware strain. “Internally, we often joke, 'Yeah, they are probably going to pull a Bitdefender,'" Wosar said.