Amazon’s Ring to partner with Flock, a network of AI cameras used by ICE, feds, and police with little oversight

Posted on October 18, 2025 by Robin Edgar

Amazon’s surveillance camera maker Ring announced a partnership on Thursday with Flock, a maker of AI-powered surveillance cameras that share footage with law enforcement.

Now agencies that use Flock can request that Ring doorbell users share footage to help with “evidence collection and investigative work.”

Flock cameras work by scanning the license plates and other identifying information about cars they see. Flock’s government and police customers can also make natural language searches of their video footage to find people who match specific descriptions. However, AI-powered technology used by law enforcement has been proven to exacerbate racial biases.

On the same day that Ring announced this partnership, 404 Media reported that ICE, the Secret Service, and the Navy had access to Flock’s network of cameras. By partnering with Ring, Flock could potentially access footage from millions more cameras.

Ring has long had a poor track record with keeping customers’ videos safe and secure. In 2023, the FTC ordered the company to pay $5.8 million over claims that employees and contractors had unrestricted access to customers’ videos for years.

Source: Amazon’s Ring to partner with Flock, a network of AI cameras used by ICE, feds, and police | TechCrunch

For more on Flock cameras and how unsecured and dangerous these things are (and also how to join a network of people monitoring this pervasive surveillance) click here.

Microsoft illegally tracked students via 365 Education, must now say what it did with the data

Posted on October 14, 2025 by Robin Edgar

An Austrian digital privacy group has claimed victory over Microsoft after the country’s data protection regulator ruled the software giant “illegally” tracked students via its 365 Education platform and used their data.

noyb said the ruling [PDF] by the Austrian Data Protection Authority also confirmed that Microsoft had tried to shift responsibility for access requests to local schools, and the software and cloud giant would have to explain how it used user data.

The ruling could have far-reaching effects for Microsoft and its obligations to inform Microsoft 365 users across Europe about what it is doing with their data, noyb argues.

The complaint dates back to the COVID-19 pandemic, when schools rapidly shifted to online learning, using the likes of 365 Education.

The privacy group said: “Microsoft shifted all responsibility to comply with privacy laws onto schools and national authorities – that have little to no actual control over the use of student data.”

When the complainant filed an access request to see what information was being processed, “this led to massive finger pointing: Microsoft simply referred the complainant to its local school.”

But the school and education authorities could only provide minimal information. The school, for example, could not access information that rested with Microsoft. “No one felt able to comply with GDPR rights.”

This prompted a complaint against the school, national and local education authorities, and Microsoft.

The ruling, machine translated, said: “It is determined that Microsoft, as a controller, violated the complainant’s right of access (Art. 15 GDPR) by failing to provide complete information about the data processed when using Microsoft Education 365.”

Microsoft was ordered to provide complete information about the data transmitted, and to provide clear explanations of terms such as “internal reporting,” “business modelling” and “improvement of core functionality.” It must also disclose if information was transferred to third parties.

[…]

Source: Microsoft ‘illegally’ tracked students via 365 Education • The Register

Germany against ChatControl: Denmark takes it off the table so the EU can’t vote against it NOW, but will re-try (3rd time lucky) later again, when the people aren’t looking.

Posted on October 9, 2025 by Robin Edgar

Germany does not support the Danish proposal on the so-called CSA regulation, which is called ‘chat control’ by critics.

The proposal was to be voted on on Tuesday in the EU Council of Ministers, but it has now been taken off the table.

The Danish government, which currently holds the EU Presidency, has chosen to withdraw the proposal from the vote. This is stated in a press release from the German parliament.

[…]

Among other things, 500 researchers from 34 countries worldwide, including 25 from Danish universities, have signed a letter criticizing the CSA regulation, as they believe, among other things, that the method will be ineffective and that there will at the same time be a high risk of misuse of information.

And leading experts in encryption have compared the suggestion of placing a spy microphone in everyone’s pockets.

[…]

The Danish Minister of Justice, Peter Hummelgaard (S), confirms in a written reply to DR News that the proposal will not be discussed at the Council meeting next week.

“It’s no secret that it’s a difficult case with many considerations that needs to be balanced. This is shown by the great public debate that has been in the recent past as well.

“Since the necessary support for the current compromise proposal has not yet been established, prior to the Council meeting next week, the proposal will not be discussed by the ministers at the Council meeting,” he said.

Despite the fact that the government has not succeeded in finding the necessary support, the Minister of Justice does not give up.

– However, the Danish EU Presidency will continue to work on the Member States to find a solution, and therefore negotiations on the technical details of the proposal will continue.

[…]

“Both ministries stressed (the German Ministry of Interior and Justice) that, like many other EU countries, they do not support the Danish proposal in the current form,” it said.

Source: Tyskland fejer kontroversielt ‘chatkontrol’-forslag af bordet | Politik | DR

An absolute gutter move by Denmark, freeing them up to try again a 3rd time – and call it a second attempt. Maybe they will try over December, April or July, when the proletariat is on holiday and won’t raise such a stink about being spied on 24/7 by their own governments. There is nothing democratic about the way this is being handled.

Germany slams brakes on EU’s Chat Control snoopfest

Posted on October 8, 2025 by Robin Edgar

Germany has committed to oppose the EU’s controversial “Chat Control” regulations following huge pressure from multiple activists and major organizations.

The draft regs would allow authorities to compel providers of communications services – such as WhatsApp, Signal, etc – to monitor user comms for potential child sexual abuse material. And they wouldn’t exempt encrypted services.

Jens Spahn, a member of the Bundestag for Germany’s Christian Democratic Union (CDU) – part of the ruling coalition in the country – confirmed in a statement on Tuesday that the German government would not allow the proposed regulations, which are commonly referred to as Chat Control, to become law.

“We, the CDU/CSU parliamentary group in the Bundestag, are opposed to the unwarranted monitoring of chats. That would be like opening all letters as a precautionary measure to see if there is anything illegal in them. That is not acceptable, and we will not allow it.”

As The Reg has mentioned previously, to pass the legislation, EU leaders need support from nations representing the majority of the member-state bloc’s population – which is why Germany’s is a key player.

The news follows speculation last week that Germany would reverse its stance and oppose the Child Sexual Abuse (CSA) Regulation, which EU politicians have tried to pass since it was first tabled in 2022.

Essentially, it’s the EU’s version of the UK’s long-held ambition to force encrypted messaging platforms to break end-to-end encryption (E2EE), packaged under a similar guise.

If passed, the CSA Regulation would require communications platforms to deploy AI-powered content filters to ensure CSA material was blocked, and those possessing and sharing it be brought to justice.

And, of course, would also undermine E2EE, theoretically allowing the EU to spy on any citizen’s private communications.

So far, Chat Control has naturally received similarly heated opposition as the UK’s equivalent plans, first through the Investigatory Powers Act and later through the Online Safety Act.

[…]

Source: Germany slams brakes on EU’s Chat Control snoopfest • The Register

Another Day, Another Age Verification Data Breach: Discord’s Third-Party Partner Leaked Government IDs. That didn’t take long, did it?

Posted on October 8, 2025 by Robin Edgar

Once again, we’re reminded why age verification systems are fundamentally broken when it comes to privacy and security. Discord has disclosed that one of its third-party customer service providers was breached, exposing user data, including government-issued photo IDs, from users who had appealed age determinations.

Data potentially accessed by the hack includes things like names, usernames, emails, and the last four digits of credit card numbers. The unauthorized party also accessed a “small number” of images of government IDs from “users who had appealed an age determination.” Full credit card numbers and passwords were not impacted by the breach, Discord says.

Seems pretty bad.

What makes this breach particularly instructive is that it highlights the perverse incentives created by age verification mandates. Discord wasn’t collecting government IDs because they wanted to—they were responding to age determination appeals, likely driven by legal and regulatory pressures to keep underage users away from certain content. The result? A treasure trove of sensitive identity documents sitting in the systems of a third-party customer service provider that had no business being in the identity verification game.

To “protect the children” we end up putting everyone at risk.

This is exactly the kind of incident that privacy advocates have been warning about for years as lawmakers push for increasingly stringent age verification requirements across the internet. Every time these systems are implemented, we’re told they’re secure, that the data will be protected, that sophisticated safeguards are in place. And every time, we eventually get stories like this one.

The pattern reveals a fundamental misunderstanding of how security works in practice versus theory. Age verification proponents consistently treat identity document collection as a simple technical problem with straightforward solutions, ignoring the complex ecosystem these requirements create. Companies like Discord find themselves forced to collect documents they don’t want, storing them with third-party processors they don’t fully control, creating attack surfaces that wouldn’t otherwise exist.

These third parties become attractive targets precisely because they aggregate identity documents from multiple platforms—a single breach can expose IDs collected on behalf of dozens of different services. When the inevitable breach occurs, it’s not just usernames and email addresses at risk—it’s the kind of documentation that can enable identity theft and fraud for years to come, affecting people who may have forgotten they ever uploaded an ID to appeal an automated age determination.

[…]

the fundamental problem remains: we’re creating systems that require the collection and storage of highly sensitive identity documents, often by companies that aren’t primarily in the business of securing such data. This isn’t Discord’s fault specifically—they were dealing with age verification appeals, likely driven by regulatory or legal pressures to prevent underage users from accessing certain content or features.

This breach should serve as yet another data point in the growing pile of evidence that age verification systems create more problems than they solve. The irony is that lawmakers pushing these requirements often claim to be protecting children’s privacy, while simultaneously mandating the creation of vast databases of identity documents that inevitably get breached. We’ve seen similar incidents affect everything from adult websites to social media platforms to online retailers, all because policymakers have decided that collecting copies of driver’s licenses and passports is somehow a reasonable solution to online age verification.

The real tragedy is that this won’t be the last such breach we see. As long as lawmakers continue pushing for more aggressive age verification requirements without considering the privacy and security implications, we’ll keep seeing stories like this one. The question isn’t whether these systems will be breached—it’s when, and how many people’s sensitive documents will be exposed in the process.

[…]

Source: Another Day, Another Age Verification Data Breach: Discord’s Third-Party Partner Leaked Government IDs | Techdirt

If you want to look at previous articles telling you what an insanely bad idea mandatory age verification systems are and how they are insecure, you can just search this blog.

Chat Control Is Back On The Menu In The EU. It Still Must Be Stopped

Posted on October 7, 2025 by Robin Edgar

The European Union Council is once again debating its controversial message scanning proposal, aka “Chat Control,” that would lead to the scanning of private conversations of billions of people.

Chat Control, which EFF has strongly opposed since it was first introduced in 2022, keeps being mildly tweaked and pushed by one Council presidency after another.

Chat Control is a dangerous legislative proposal that would make it mandatory for service providers, including end-to-end encrypted communication and storage services, to scan all communications and files to detect “abusive material.” This would happen through a method called client-side scanning, which scans for specific content on a device before it’s sent. In practice, Chat Control is chat surveillance and functions by having access to everything on a device with indiscriminate monitoring of everything. In a memo, the Danish Presidency claimed this does not break end-to-end encryption.

This is absurd.

We have written extensively that client-side scanning fundamentally undermines end-to-end encryption, and obliterates our right to private spaces. If the government has access to one of the “ends” of an end-to-end encrypted communication, that communication is no longer safe and secure. Pursuing this approach is dangerous for everyone, but is especially perilous for journalists, whistleblowers, activists, lawyers, and human rights workers.

If passed, Chat Control would undermine the privacy promises of end-to-end encrypted communication tools, like Signal and WhatsApp. The proposal is so dangerous that Signal has stated it would pull its app out of the EU if Chat Control is passed. Proponents even seem to realize how dangerous this is, because state communications are exempt from this scanning in the latest compromise proposal.

This doesn’t just affect people in the EU, it affects everyone around the world, including in the United States. If platforms decide to stay in the EU, they would be forced to scan the conversation of everyone in the EU. If you’re not in the EU, but you chat with someone who is, then your privacy is compromised too. Passing this proposal would pave the way for authoritarian and tyrannical governments around the world to follow suit with their own demands for access to encrypted communication apps.

Even if you take it in good faith that the government would never do anything wrong with this power, events like Salt Typhoon show there’s no such thing as a system that’s only for the “good guys.”

Despite strong opposition, Denmark is pushing forward and taking its current proposal to the Justice and Home Affairs Council meeting on October 14th.

We urge the Danish Presidency to drop its push for scanning our private communication and consider fundamental rights concerns. Any draft that compromises end-to-end encryption and permits scanning of our private communication should be blocked or voted down.

Phones and laptops must work for the users who own them, not act as “bugs in our pockets” in the service of governments, foreign or domestic. The mass scanning of everything on our devices is invasive, untenable, and must be rejected.

Republished from the EFF’s Deeplinks blog.

Source: Chat Control Is Back On The Menu In The EU. It Still Must Be Stopped | Techdirt

No account? No Windows 11 for you, says Microsoft

Posted on October 7, 2025 by Robin Edgar

Microsoft is closing a popular loophole that allowed users to install Windows 11 without a Microsoft account.

The change has appeared in recent Insider builds of Windows 11, indicating it is likely to be included in the production version soon.

Microsoft refers to these loopholes as “known mechanisms” and is talking about local commands in this instance. You can learn all about these in our piece for getting Windows 11 installed with a local account, but suffice to say start ms-cxh:localonly is no more.

“While these mechanisms were often used to bypass Microsoft account setup, they also inadvertently skip critical setup screens, potentially causing users to exit OOBE with a device that is not fully configured for use,” Microsoft said.

“Users will need to complete OOBE with internet and a Microsoft account, to ensure [the] device is set up correctly.”

As far as Redmond is concerned, this is all for the user’s own good. It is also important to note that managed devices are not directly affected, just hardware that users want to get running with Windows 11 without having to deal with a Microsoft Account during setup.

The change is part of Microsoft’s ongoing game of Whac-A-Mole with users trying to find ways of avoiding its online services. In March, it removed the bypassnro.cmd script that allowed users to get through the Windows 11 setup without needing an internet connection. That time, Microsoft said the change was to “enhance security and user experience of Windows 11.”

There remain a number of ways to avoid the Microsoft account requirement during setup, including setting up an unattended installation, but these are more complicated. It is also clear that Microsoft is determined to continue closing loopholes where it can.

It is getting increasingly difficult to use Windows 11 on an unmanaged device without a Microsoft account. Users who don’t want to sign up should perhaps consider whether it’s time to look at an alternative operating system instead.

Source: No account? No Windows 11 for you, says Microsoft • The Register

UK government says digital ID won’t be compulsory – unless you want a job. Even Palantir steps back from this one.

Posted on October 5, 2025 by Robin Edgar

The British government has finally given more details about the proposed digital ID project, directly responding to the 2.76 million naysayers that signed an online petition calling for it to be ditched.

This came a day after controversial spy-tech biz Palantir said it has no intention of helping the government implement the initiative – announced last week by prime minister Keir Starmer but not included in his political party’s manifesto at last year’s general election.

It is for this reason that Louis Mosley, UK boss at Palantir – the grandson of Sir Oswald Mosley – says his employer is not getting involved, despite being mentioned as a potential bidder.

“Digital ID is not one that was tested at the last election. It wasn’t in the manifesto. So we haven’t had a clear resounding public support at the ballot box for its implementation. So it isn’t one for us,” he told The Times

[…]

Following in the footsteps of Estonia and other nations, including China, the UK government wants to introduce a “free” digital ID card for people aged 16 and over – though it is consulting on whether this should start at 13 – to let people access public and private services “seamlessly.” It will “build on” GOV.UK One Login and the GOV.UK Wallet, we’re told.

“This system will allow people to access government services – such as benefits or tax records – without needing to remember multiple logins or provide physical documents.

[…]

The card, scheduled to be implemented by the end of the current Parliament, means employers will have to check digital ID when going through right-to-work checks, and despite previously saying the card will be mandatory, the government confirmed: “For clarity, it will not be a criminal offence to not hold a digital ID and police will not be able to demand to see a digital ID as part of a ‘stop and search.’

[…]

Big Brother Watch says the national ID system is a “serious threat to civil liberties.”

“Digital ID systems can be uniquely harmful to privacy, equality and civil liberties. They would allow the state to amass vast amounts of personal information about the public in centralised government databases. By linking government records through a unique single identifier, digital ID systems would make it very easy to build up a comprehensive picture of an individual’s life.”

[…]

Source: UK government says digital ID won’t be compulsory – honest • The Register

It also creates a single point of entry for anyone willing to hack the database. Centralised databases are incredibly broken ideas.

Also see: New digital ID will be mandatory to work in the UK. Ausweiss bitte!

And a quick search for “centralised database”

Outrage That NL Tax and Customs Authorities will give all data to US by switching to MS 365: ‘Insult to Parliament’

Posted on October 5, 2025 by Robin Edgar

‘An insult not only to the House of Representatives, but also to Dutch and European businesses’, says GroenLinks-PvdA MP Barbara Kathmann about the switch of government services to Microsoft. Earlier today, outgoing State Secretary for Taxation Eugène Heijnen (BBB) informed the House of Representatives about the switch of the Tax Authorities, the Allowances department, and Customs to Microsoft 365. This means that these services will become dependent on this American software giant for their daily work.

Outrage over Tax Authorities’ switch to Microsoft: ‘An insult to the House of Representatives’

Over the past year, there have been frequent debates about the digital independence of the Netherlands, and the call to become independent from American companies is growing louder. The fact that the State Secretary is now announcing that three government services will still switch to Microsoft is causing a lot of anger among Kathmann. ‘They are essentially just ushering us into the American cloud during this caretaker period, and that is really not necessary.’ Bert Hubert, former supervisor of the intelligence services, previously stated that Dutch tax data could end up on American servers via email contact.

Cluster of European companies

Kathmann emphasizes that it would be naive to think that we could be independent of Microsoft tomorrow, but that Dutch and European businesses are capable of a lot.

[…]

According to the State Secretary, this is not possible because there are no comparable European alternatives. Kathmann explains that the intention is precisely not to become dependent on one supplier.

[…]

Stimulate development

Last week, caretaker Prime Minister Dick Schoof called on executives of large companies to become independent from non-European suppliers. Schoof also emphasized in the House two days ago that this is a priority.

[…]

the government can play an important role in stimulating the development of European and Dutch technology. ‘The government is the largest IT buyer in the Netherlands. If it becomes the largest buyer of European Dutch products, then it will really take off.’

[…]

Source: Kagi Translate

It really is amazing how at a time when everyone is talking about digital sovereignty, the Tax people – responsible for handling extremely sensitive data – decide to give it all to an increasingly untrustworthy ally.

Signal threatens to exit Germany over Chat Control vote – 14th of October we know if Denmark has managed to turn the EU into a Stazi surveillance state.

Posted on October 4, 2025 by Robin Edgar

The Signal Foundation announced on October 3, 2025, that it would withdraw its encrypted messaging service from Germany and potentially all of Europe if the European Union’s Chat Control proposal passes in an upcoming vote. According to Signal President Meredith Whittaker, the messaging platform faces an existential choice between compromising its encryption integrity and leaving European markets entirely.

The German government holds a decisive position in the October 14, 2025 vote on the Chat Control regulation, which aims to combat child sexual abuse material but requires mass scanning of every message, photo, and video on users’ devices.

[…]

The Chat Control proposal mandates that messaging services like Signal, WhatsApp, Telegram, and Threema scan files on smartphones and end devices without suspicion to detect child sexual abuse material. This scanning would occur before encryption, according to technical documentation from the European Commission’s September 2020 draft on detecting such content in end-to-end encrypted communications.

[…]

The Chat Control vote reveals deep divisions among EU member states on digital privacy and surveillance. Fifteen countries support the proposal, eight oppose it, and several remain undecided as the October 14 deadline approaches.

[…]

Germany’s position remains critical and undecided. Despite expressing concerns about breaking end-to-end encryption at a September 12 Law Enforcement Working Party meeting, the government refrained from taking a definitive stance. This indecision makes Germany’s vote potentially decisive for the proposal’s fate.

Belgium, Italy, and Latvia remain undecided as of September 23, 2025. These countries express desire to reach agreement given the expiring interim regulation, with all three expressing support for the proposal’s goals while remaining formally uncommitted. Italy specifically voices doubts concerning inclusion of new child sexual abuse material in the scope of application. Latvia assesses the text positively but faces uncertainty about political support.

Poland and Austria share the desire for solutions but maintain skepticism about the current proposal’s approach. Greece’s position remains unclear, with the government evaluating technical implementation details. Sweden continues examining the compromise text and working on a position. Slovakia appears in both opposition and undecided categories depending on sources, reflecting the fluid nature of negotiations.

The arithmetic suggests that Germany’s decision could determine whether the required majority materializes. With 15 states supporting and 8 opposing, the undecided nations hold the balance.

[…]

Technical experts have warned that client-side scanning fundamentally undermines encryption security. A comprehensive 2021 study titled “Bugs in Our Pockets: The Risks of Client-Side Scanning,” authored by 14 security researchers including cryptography pioneers Whitfield Diffie and Ronald Rivest, concluded that such systems create serious security and privacy risks for all society.

The researchers explained that scanning every message—whether performed before or after encryption—negates the premise of end-to-end encryption. Instead of breaking Signal’s encryption protocol directly, hostile actors would only need to exploit access granted to the scanning system itself. Intelligence agencies have acknowledged this threat would prove catastrophic for national security, according to the technical consensus outlined in the research paper.

[…]

Germany’s historical experience with mass surveillance through the Stasi secret police informs current privacy advocacy. The country maintained principled opposition to Chat Control during the previous coalition government, though this position became uncertain after the current government took office

[…]

Denmark assumed the EU Council Presidency on July 1, 2025, and immediately reintroduced Chat Control as a legislative priority. Lawmakers targeted the October 14 adoption date if member states reach consensus. France, which previously opposed the measure, shifted to support the proposal by July 28, 2025, creating momentum for the 15 member states now backing the regulation.

[…]

Source: Signal threatens to exit Germany over Chat Control vote

Academic research finds economic, technical and operational harms from Italy’s Piracy Shield

Posted on October 1, 2025 by Robin Edgar

Walled Culture first wrote about Piracy Shield, Italy’s automated system for tackling alleged copyright infringement in the streaming sector, two years ago. Since then, we have written about the serious problems that soon emerged. But instead of fixing those issues, the government body that runs the scheme, Italy’s AGCOM (the Italian Authority for Communications Guarantees), has extended it. The problems may be evident, but they have not been systematically studied, until now: a peer-reviewed study from a group of (mostly Italian) researchers has just been published as a preprint (found via TorrentFreak). It’s particularly welcome as perhaps the first rigorous analysis of Piracy Shield and its flaws.

[…]

one of the major concerns about the system is the lack of transparency: AGCOM does not publish a list of IP addresses or domain names that are subject to its blocking. That not only makes it extremely difficult to correct mistakes, it also – conveniently – hides those mistakes, as well as the scope and impact of Piracy Shield. To get around this lack of transparency, the researchers had to resort to a dataset leaked on GitHub, which contained 10,918 IPv4 addresses and 42,664 domain names (more precisely, the latter were “fully qualified domain names” – FQDN) that had been blocked. As good academics, the researchers naturally verified the dataset as best they could:

While this dataset may not be exhaustive … it nonetheless provides a conservative lower-bound estimate of the platform’s blocking activity, which serves as the foundation for the subsequent analyses.

Much of the paper is devoted to the detailed methodology. One important result is that many of the blocked IP addresses belonged to leased IP address space. As the researchers explain:

This suggests that illegal streamers may attempt to exploit leased address space more intensively, even if just indirectly, by obtaining them by hosting companies that leases them, leading to more potential collateral damages for new lessees.

This particular collateral damage arises from the fact that even after the leased IP address is released by those who are using it for allegedly unauthorised streaming, it is still blocked on the Piracy Shield system. That means whoever is allocated that leased IP address subsequently is blocked by AGCOM, but are probably unaware of that fact, because of the opaque nature of the blocking process. More generally, collateral damage arose from the wrongful blocking of a wide range of completely legitimate sites:

During our classification process, we observed a wide range of website types across these collaterally affected domains, including personal branding pages, company profiles, and websites for hotels and restaurants. One notable case involves 19 Albanian websites hosted on a single IP address assigned to WIIT Cloud. These sites are still unreachable from Italy.

Italian sites were also hit, including a car mechanic, several retail shops, an accountant, a telehealth missionary program – and a nunnery. More amusingly, the researchers write:

we found a case of collateral damage involving a Google IP. Closer inspection revealed the IP was used by Telecom Italia to serve a blocking page for FQDNs filtered by Piracy Shield. Although later removed from the blocklist, this case suggests that collateral damage may have affected the blocking infrastructure itself.

The academics summarise their work as follows:

Our results on the collateral damages of IP and FQDN blocking highlight a worrisome scenario, with hundreds of legitimate websites unknowingly affected by blocking, unknown operators experiencing service disruption, and illegal streamers continuing to evade enforcement by exploiting the abundance of address space online, leaving behind unusable and polluted address ranges. Still, our findings represent a conservative lower-bound estimate.

It distinguished three ways in which Piracy Shield is harmful. Economically, because it disrupts legitimate businesses; technically, because it blocks shared infrastructure such as content delivery networks, while “polluting the IP address space” for future, unsuspecting users; and operationally, because it imposes a “growing, uncompensated burden on Italian ISPs forced to implement an expanding list of permanent blocks.” The paper concludes with some practical suggestions for improving a system that is clearly not fit for purpose, and poses a threat to national security, as discussed previously on Walled Culture. The researchers suggest that:

widespread and difficult-to-predict collateral damage suggests that IP-level blocking is an indiscriminate tool with consequences that outweigh its benefits and should not be used.

Instead, they point out that there are other legal pathways that can be pursued, since many of the allegedly infringing streams originate within the EU. If FQDN blocking is used, it should be regarded as “a last resort in tightly constrained time windows, i.e., only for the duration of the live event.” Crucially, more transparency is needed from AGCOM:

To mitigate damages, resource owners must be immediately notified when their assets are blocked, and a clear, fast unblocking mechanism must be in place.

This is an important piece of work, because it places criticisms of Piracy Shield on a firm footing, with rigorous analysis of the facts. However, AGCOM is unlike to pay attention, since it is in the process of expanding Piracy Shield to apply to vast swathes of online streaming: amendments to the relevant law mean that automatic blocks can now be applied to film premieres, and even run-of-the-mill TV shows. Based on its past behaviour, the copyright industry may well push to extend Piracy Shield to static Web material too, on the basis that the blocking infrastructure is already in place, so why not use it for every kind of material?

Source: Academic research finds economic, technical and operational harms from Italy’s Piracy Shield – Walled Culture

Ladybird Browser Gains Cloudflare Support to Challenge the Status Quo

Posted on September 30, 2025 by Robin Edgar

In a somewhat unexpected move, Cloudflare has announced its sponsorship of the Ladybird browser, an independent (still-in-development) open-source initiative aimed at developing a modern, standalone web browser engine. It’s a project launched by GitHub’s co-founder and former CEO, Chris Wanstrath, and tech visionary Andreas Kling.

It’s written in C++, and designed to be fast, standards-compliant, and free of external dependencies. Its main selling point? Unlike most alternative browsers today, Ladybird doesn’t sit on top of Chromium or WebKit.

Instead, it’s building a completely new rendering engine from scratch, which is a rare thing in today’s web landscape. For reference, the vast majority of web traffic currently runs through engines developed by either Google (Blink/Chromium), Apple (WebKit), or Mozilla (Gecko).

The sponsorship means the Ladybird team will have more resources to accelerate development. This includes paying developers to work on crucial features, such as JavaScript support, rendering improvements, and compatibility with modern web applications. Just to remind you, last year the project was already funded with $1 million from Wanstrath and his family.

Cloudflare stated that its support is part of a broader initiative to keep the web open, where competition and multiple implementations can drive enhanced security, performance, and innovation.

[…]

Source: Ladybird Browser Gains Cloudflare Support to Challenge the Status Quo

The browser wars in the 2000s were not lite for no reason – the browser is the viewing portal to the world and who controls the underlying technology is also the harvester of information. Something that most Chrome users don’t really understand.

The Internet Reacts To Electronic Arts’ $55 Billion Acquisition

Posted on September 30, 2025 by Robin Edgar

After reports sprouted up last week that Electronic Arts, the publisher behind The Sims, BioWare’s catalog, and most of your favorite sports games, was being acquired for over $50 billion in a joint venture between Saudi Arabia’s Private Investor Fund, Silver Lake, and the Jared Kushner-owned Affinity Partners, the company has officially confirmed the deal. If approved, the acquisition would be one of the most expensive in the history of the video game industry and would make Electronic Arts a privately held company. Given the questionable ownership, the internet is not taking the news well.

The Saudi Arabian government’s attempts at sportswashing away the stink of its dire human rights laws, as evidenced by its investments in various facets of the video game industry, are well-documented at this point.

[…]

Given Saudi Arabia’s treatment of queer people, a fair bit of concern has been extended specifically to The Sims and to BioWare, the developer of Mass Effect and Dragon Age, all of which have been trailblazers for queer representation in video games. EA CEO Andrew Wilson has stated in an email statement to staff that the company’s “values and [its] commitment to players and fans around the world remain unchanged,” but considering that both the Saudi Arabian government and Jared Kushner, the owner of Affinity Partners and Donald Trump’s son-in-law, now own the publisher, that’s not exactly convincing.

[…]

The Saudi government’s influence on the games it has money in has thus far resulted in some bizarre shit, such as soccer player Cristiano Ronaldo showing up in the latest Fatal Fury, though developer SNK has insisted the company’s sale to PIF would not affect its games. Beyond that, the Saudi Arabian government has been hosting events with industry figureheads like Hideo Kojima. The nation’s monetary investment in video games has been extensive, but buying one of the biggest companies in the space, whose games are played by millions every year, is almost certainly the farthest-reaching move it’s made thus far. We don’t know what impact this will have on EA, its studios, and its IP in the future, but in this moment, things look bleak.

Source: The Internet Reacts To Electronic Arts’ $55 Billion Acquisition

So yes, maybe EA will have more money to make more games, but they will be right wing nutcase / religious games, heavily censored. Considering that the gaming industry is larger than Hollywood and the shared experiences from gaming shape our culture, this is a pretty iron grip on what it is that we see, experience and how we experience it. Gaming tells us who are the goodies and the baddies and now this is under control of some very dubious people.

New digital ID will be mandatory to work in the UK. Ausweiss bitte!

Posted on September 28, 2025 by Robin Edgar

Digital ID will be mandatory in order to work in the UK, as part of plans to tackle illegal migration.

Sir Keir Starmer said the new digital ID scheme would make it tougher to work in the UK illegally and offer “countless benefits” to citizens, while his senior minister Darren Jones said it could be “the bedrock of the modern state”.

However, opposition parties argued the proposals would not stop people crossing the Channel in small boats.

The prime minister set out his plans in a broader speech to a gathering of world leaders, in which he said it had been “too easy” for people to work illegally in the UK because the centre-left had been “squeamish” about saying things that were “clearly true”.

[…]

Another Labour prime minister, Sir Tony Blair, tried to introduce compulsory ID cards but the idea was scrapped by the Conservative-Lib Dem coalition in 2010.

However, Sir Keir has recently said he believes the debate has “moved on in the last 20 years” as “we all carry a lot more digital ID now than we did”.

Labour believes its new proposal has public support, although more than a million people have signed a petition against the idea.

Conservative leader Kemi Badenoch said the plan would “do nothing to stop the boats” but would “end up being used against law-abiding citizens while crooks walk free”.

She also expressed concern about the security of the data saying it would be a risk to put the information “in one database”.

Liberal Democrat leader Sir Ed Davey said his party would “fight tooth and nail” against the scheme which would “add to our tax bills and bureaucracy, whilst doing next to nothing to tackle channel crossings”.

Some campaign groups have also objected to the plan, with Liberty arguing it raised “huge concerns” about mass surveillance, while Big Brother Watch said it would make the country “less free”.

[…]

The new digital ID will be held on people’s phones, in a similar way to contactless payment cards or the NHS app.

It is expected to include a person’s name, date of birth, nationality or residency status and a photo.

The consultation will also consider whether additional information such as an address should be included.

[…]

The government said the roll-out would eventually make it simpler to apply for services like driving licences, childcare and welfare – as well as streamlining access to tax records.

[…]

Emlyn Jenkins, 23, is against digital IDs, describing the plan as “fascistic and horrible”.

“How will people who are homeless be affected if they don’t have access to a smartphone or they don’t have access to consistent internet?” she asked.

Arianwen Fox-James, 20, says she can see some practical benefits but is uncomfortable with the idea of a “centralised hub of all the data”.

[…]

data safety. “Every time these things get launched they get hacked,” she says. “Everyone hacks everything.”

Source: New digital ID will be mandatory to work in the UK

Another point: to fight migrants “taking jobs” (hint: they are not) they are going to make it more difficult for those who don’t have jobs by making them incur costs and difficulties to get a government issued ID somehow and for temporary employers to check the validity of these IDs. So that will probably actually raise the amount of illegal work being done.

Mesh-Mapper – Drone Remote ID mapping and mesh alerts

Posted on September 28, 2025 by Robin Edgar

Project Overview

The FAA’s Remote ID requirement, which became mandatory for most drones in September 2023, means every compliant drone now broadcasts its location, pilot position, and identification data via WiFi or Bluetooth. While this regulation was designed for safety and accountability (or to violate pilot privacy 😊), it also creates an unprecedented opportunity for personal airspace awareness.

This project harnesses that data stream to create a comprehensive detection and tracking system that puts you in control of knowing what’s flying overhead. Built around the powerful dual-core Xiao ESP32 S3 microcontroller, the system captures Remote ID transmissions on both WiFi and Bluetooth simultaneously, feeding the data into a sophisticated Python Flask web application that provides real-time visualization and logging.

But here’s where it gets really interesting: the system also integrates with Meshtastic networks, allowing multiple detection nodes to share information across a mesh network. This means you can deploy several ESP32 nodes across your property or neighborhood and have them all contribute to a unified picture of drone activity in your area.

Why This Project Matters

Remote ID represents a fundamental shift in airspace transparency. For the first time, civilian drones are required to broadcast their identity and location continuously. This creates opportunities for:

Privacy Protection: Know when drones are operating near your property and who is operating them

Personal Security: Monitor activity around sensitive locations like your home or business

Community Awareness: Share drone activity information with neighbors through mesh networks

Research: Understand drone traffic patterns and airspace usage in your area

Education: Learn about wireless protocols and modern airspace management
The key difference between this system and commercial drone detection 
solutions is that it puts the power of airspace awareness directly in your 
hands, using affordable hardware and open-source software.
While you can build this project using off-the-shelf ESP32 development boards, I’ve designed custom PCBs specifically optimized for Remote ID detection integration with Meshtastic that are that are available on my Tindie store. Thank you PCBway for the awesome boards! The combination of their top tier quality, competitive pricing, fast turnaround times, and stellar customer service makes PCBWay the go-to choice for professional PCB fabrication, whether you’re prototyping innovative mesh detection systems or scaling up for full production runs.

https://www.pcbway.com/

Step 1: Hardware Preparation

If using custom MeshDetect boards from Tindie:

Boards come pre-assembled, flashed, and tested

Includes Stock 915mhz and 2.4ghz antennas

USB-C programming interface ready to use

If building with standard ESP32 S3:

Xiao ESP32 S3 development board recommended

USB-C cable for connection and power

Optional upgraded3 2.4GHz antenna for better range

Optional Heltec Lora V3 for Mesthastic Integration

Step 2: Firmware Installation

To install the firmware onto your device, follow these steps:

1. Clone the repository:
git clone https://github.com/colonelpanichacks/drone-mesh-mapper
Open the project in PlatformIO: You can use the PlatformIO IDE (in VS Code) or the PlatformIO CLI.

2.Select the correct environment:

This project uses the remotied_mesh_dualcore sketch, which enables both BLE and Wi-Fi functionality.Make sure the platformio.ini environment is set to remoteid_mesh_dualcore.

3. Connect you device via usb and flash

Upload the firmware:

In the IDE, select the remoteid_mesh_dualcore environment and click the “Upload” button.

3. Sofware Installation

Install Python dependencies:

flask>=2.0.0

flask-socketio>=5.0.0

requests>=2.25.0

urllib3>=1.26.0

pyserial>=3.5

Run the detection system:

python mapper.py

The web interface automatically opens at http://localhost:5000

Step 4: Device Configuration

1. Connect ESP32 via USB-C

2. Select the correct serial port in the web interface

3. Click “Connect” to start receiving data

4. Configure device aliases and settings as needed

How It Works

The ESP32 S3’s dual-core architecture allows simultaneous monitoring of both WiFi and Bluetooth Remote ID transmissions:

Core 0 handles WiFi monitoring in promiscuous mode, capturing Remote ID data embedded in beacon frames and processing Neighbor Awareness Networking transmissions on channel 6 by default.

Core 1 continuously scans for Bluetooth LE advertisements containing Remote ID data, supporting both BT 4.0 and 5.0 protocols with optimized low-power scanning.

Both cores feed detected Remote ID data into a unified JSON output stream via USB serial at 115200 baud. The firmware is based on Cemaxacuter’s excellent Remote ID detection work, enhanced with dual-core operation.

The Python Flask web application receives this data and provides real-time visualization on an interactive map, automatic logging to CSV and KML files, FAA database integration for aircraft registration lookups, support for up to 3 ESP32 devices simultaneously, live data streaming via WebSocket, and comprehensive export functions.

Meshtastic Integration: Distributed Detection

One of the most exciting features is Meshtastic integration. The ESP32 firmware can send compact detection messages over UART to a connected Meshtastic device. This enables:

Distributed Monitoring: Multiple detection nodes sharing data across your property or neighborhood

Extended Range: Mesh networking extends effective coverage area beyond single-device limitations

Redundancy: Multiple nodes provide backup coverage if one device fails

Low-Power Operation: Meshtastic’s LoRa radios enable remote deployment without constant power

Community Networks: Integration with existing Meshtastic mesh networks for broader awareness

Messages sent over the mesh network use a compact format optimized for LoRa bandwidth constraints:

Features in Action

Real-Time Detection and Mapping

The web interface provides a Google Maps-style view with drone markers showing current aircraft positions, pilot markers indicating operator locations, color-coded flight paths derived from device MAC addresses, signal strength indicators showing detection quality, and automatic cleanup removing stale data after 5 minutes.

Data Export and Analysis

The system continuously generates multiple data formats including timestamped CSV logs perfect for spreadsheet analysis, Google Earth compatible KML files with flight path visualization featuring individual drone paths color-coded by device and timestamped waypoints, and JSON API providing real-time data access for custom integrations with RESTful endpoints and WebSocket streams.

FAA Database Integration

One of the most powerful features is automatic FAA registration lookup that queries the FAA database using detected Remote ID information, caches results to minimize API calls and improve performance, enriches detection data with aircraft registration details, and includes configurable rate limiting to respect API guidelines.

Multi-Device Coordination

The system supports up to three ESP32 devices simultaneously with automatic device discovery and connection, individual device health monitoring, load balancing across multiple receivers, and unified data view combining all devices.

Performance and Optimization

Reception Range

Testing has shown effective detection ranges of 5 Km in urban environments, 10-15 kilometers in open areas with good antennas, overlapping coverage that eliminates dead zones when using multiple devices, and significant improvement with external antennas compared to built-in antennas.

System Resources

The Python application is optimized for continuous operation with efficient memory management for large datasets, automatic log rotation to prevent disk space issues, WebSocket connection pooling for multiple clients, and configurable data retention policies.

For remote deployments, Meshtastic integration enables off-grid operation, webhook retry logic ensures reliable alert delivery, local data storage prevents data loss during network outages, and bandwidth optimization handles limited connections.

Privacy and Security Considerations

This system puts powerful airspace monitoring capabilities in individual hands, but it’s important to use it responsibly. The detection data contains location information about both drones and their operators, so implement appropriate data retention policies and be aware of local privacy regulations.

For network security, remember that the Flask development server is not production-ready, so consider a reverse proxy for production use and implement authentication for sensitive deployments. Use HTTPS for webhook communications and monitor for unauthorized access attempts.

The system enables you to know what’s flying over your property while respecting the legitimate privacy expectations of drone operators. It’s about transparency and awareness, not surveillance.

Conclusion

This Remote ID detection system represents a significant step forward in personal airspace awareness. The combination of dual-core ESP32 processing, comprehensive web-based interface, Meshtastic mesh integration, and professional data export features creates a platform that’s both accessible to makers and powerful enough for serious privacy protection applications.

The availability of custom-designed PCBs on Tindie removes the barrier of hardware design, while the open-source firmware and software ensure complete customizability. Whether you’re building a single-node setup for personal property monitoring or deploying a mesh network for neighborhood-wide awareness, this system provides the foundation for comprehensive drone detection and tracking.

As more drones come online with Remote ID compliance, having your own detection system becomes increasingly valuable for maintaining privacy and situational awareness of your local airspace

Resources and Links

Mesh Mapper Github : https://github.com/colonelpanichacks/drone-mesh-mapper

Mesh Detect Github (all firmware for Mesh Detect boards: https://github.com/colonelpanichacks/mesh-detect

Mesh Detect SMA mount clip SMA mount clip for the Mesh Destect board by OrdoOuroboros https://www.printables.com/model/1294183-mesh-detect-board-sma-mount

Build Your Own

Ready to start monitoring your local airspace? The combination of affordable hardware, open-source software, and comprehensive documentation makes this project accessible to makers of all skill levels. Start with a single ESP32 device to learn the system, then expand to multiple nodes and Meshtastic integration as your privacy protection needs grow.

The future of airspace monitoring is distributed, affordable, and puts control back in the hands of individuals and communities. Join the movement building these next-generation detection systems!

Source: Mesh-Mapper – Drone Remote ID mapping and mesh alerts – Hackster.io

Detecting Surveillance Cameras With The ESP32 from Colonel.Panic

Posted on September 28, 2025 by Robin Edgar

These days, surveillance cameras are all around us, and they’re smarter than ever. In particular, many of them are running advanced algorithms to recognize faces and scan license plates, compiling ever-greater databases on the movements and lives of individuals. Flock You is a project that aims to, at the very least, catalogue this part of the surveillance state, by detecting these cameras out in the wild.

The system is most specifically set up to detect surveillance cameras from Flock Safety, though it’s worth noting a wide range of companies produce plate-reading cameras and associated surveillance systems these days. The device uses an ESP32 microcontroller to detect these devices, relying on the in-built wireless hardware to do the job. The project can be built on a Oui-Spy device from Colonel Panic, or just by using a standard Xiao ESP32 S3 if so desired. By looking at Wi-Fi probe requests and beacon frames, as well as Bluetooth advertisements, it’s possible for the device to pick up telltale transmissions from a range of these cameras, with various pattern-matching techniques and MAC addresses used to filter results in this regard. When the device finds a camera, it sounds a buzzer notifying the user of this fact.

Meanwhile, if you’re interested in just how prevalent plate-reading cameras really are, you might also find deflock.me interesting. It’s a map of ALPR camera locations all over the world, and you can submit your own findings if so desired. The techniques used by in the Flock You project are based on learnings from the DeFlock project. Meanwhile, if you want to join the surveillance state on your own terms, you can always build your own license plate reader instead!

Source: Detecting Surveillance Cameras With The ESP32 | Hackaday

EU becomes a little more fascist and starts collecting fingerprints at the border

Posted on September 26, 2025 by Robin Edgar

The new Entry/Exit System (EES) will start operations on 12 October 2025. European countries using the EES will introduce the system gradually at their external borders. This means that data collection will be gradually introduced at border crossing points with full implementation by 10 April 2026.

Source: What is the EES?

You need to provide your personal data each time you reach the external borders of the European countries using the EES. For more information – see What does progressive start of the EES mean?
The EES collects, records and stores:

data listed in your travel document(s) (e.g. full name, date of birth, etc.)

date and place of each entry and exit

facial image and fingerprints (called ‘biometric data’)

whether you were refused entry.

On the basis of the collected biometric data, biometric templates will be created and stored in the shared Biometric Matching Service (see footnote).

If you hold a short-stay visa to enter the Schengen area, your fingerprints will already be stored in the Visa Information System (VIS) and will not be stored again in the EES.

Depending on your particular situation, the system also collects your personal information from:

the Visa Information System (which contains additional personal information)

the European Travel Information and Authorisation System (ETIAS) , in particular the status of your ETIAS travel authorisation and, if applicable, whether you are a family member of an EU national.

[…]

If you refuse to provide your biometric data, you will be denied entry into the territory of the European countries using the EES.

Who can access your personal data?

Border, visa and immigration authorities in the European countries using the EES for the purpose of verifying your identity and understanding whether you should be allowed to enter or stay on the territory.

Law enforcement authorities of the countries using the EES and Europol for law enforcement purposes.

Under strict conditions, your data may be transferred to another country (inside or outside the EU) or international organisation (listed in Annex I of Regulation (EU) 2017/2226 – a UN organisation, the International Organisation for Migration, or the International Committee of the Red Cross) for return (Article 41(1) and (2), and Article 42) and/or law enforcement purposes (Article 41(6)).

Transport carriers will only be able to verify whether short-stay visa holders have already used the number of entries authorised by their visa and will not be able to access any further personal data.

[…]

Your data cannot be transferred to third parties – whether public or private entities – except in certain cases. See Who can access your personal data.

[…]

So lots of data collected, and loads of people who can access this data – exceptions are absolutely everywhere. And for what? To satisfy far right fantasies about migration running rampant.

LaLiga’s Anti-Piracy Tactics Disrupt Major Sites in Spain. Again. Allowing company dragnets with no recourse, warning or anything is insanely stupid.

Posted on September 21, 2025 by Robin Edgar

LaLiga, Spain’s top football league, is facing a firestorm of criticism after boasting about a staggering 142% increase in anti-piracy takedown notices in early 2025 while simultaneously causing extensive collateral damage across the internet.

As the 2025/2026 season began on August 15, LaLiga ramped up its enforcement strategy, triggering widespread outages for entirely lawful websites, services, and platforms.

These disruptions are tied to a controversial anti-piracy scheme operated in partnership with telecom giant Telefónica.

The initiative, which enjoys judicial backing in Spain, allows LaLiga to instruct major internet service providers, including Movistar, Vodafone, Orange, and DIGI, to block IP addresses suspected of hosting unauthorized streams.

The fallout is that entire chunks of the internet go dark for Spanish users, often during match broadcasts.

LaLiga doesn’t target specific infringing content. Instead, it flags entire IP ranges, many of which are shared by thousands of unrelated domains.

When one site is accused of hosting pirated material, everyone else sharing that IP address gets swept up in the block.

The result is a digital dragnet that has ensnared companies as diverse as Amazon, Cloudflare, GitHub, Twitch, and even Google Fonts.

TorrentFreak has documented repeated weekly blocks of platforms like Vercel since early 2025, while Catalonia’s own .cat domain registry has also reported service disruptions.

The issue became so disruptive that iXsystems, the team behind TrueNAS, a widely used open-source NAS operating system, was forced to shift its distribution model entirely. After its CDN IPs were repeatedly blocked in Spain, making critical security updates inaccessible to users, the developers resorted to distributing their software via BitTorrent.

[…]

LaLiga, meanwhile, continues to tout its enforcement record. A self-published report revealed that over 26 million takedown notices were sent in the first half of 2025 alone, more than doubling the total from all of 2024.

Source: LaLiga’s Anti-Piracy Tactics Disrupt Major Sites in Spain

As site blocks pile up, European Commission issues subtle slapdown to Italy’s Piracy Shield

Why Italy’s Piracy Shield destroys huge internet companies and small businesses with no recourse (unless you are rich) and can lay out the entire internet in Italy to… protect against football streaming?!

Italy is losing its mind because of copyright: it just made its awful Piracy Shield even worse

Italy’s Piracy Shield Blocks Innocent Web Sites, Makes It Hard For Them To Appeal so ISPs are ignoring the law because it’s stupid

EU prepares to give new rights to live streaming sites, to the detriment of the Internet and its users

LaLiga Piracy Blocks Randomly Take Down huge innocent segments of internet with no recourse or warning, slammed as “Unaccountable Internet Censorship”

Now the copyright industry wants to apply deep, automated blocking to the Internet’s core routers

Samsung confirms its $1,800+ fridges will start showing you ads

Posted on September 21, 2025 by Robin Edgar

Samsung started rolling out an update to its refrigerators that brought ads to the display, whether you like it or not. The whole situation is rather surreal but not entirely unsurprising. There were some doubts that the changelog wasn’t real or that it belonged to a different product. Now, Samsung has confirmed to us that ads are indeed coming to its refrigerators.

We had reached out to Samsung for a statement, and this is what a Samsung spokesperson said:

Samsung is committed to innovation and enhancing every day value for our home appliance customers. As part of our ongoing efforts to strengthen that value, we are conducting a pilot program to offer promotions and curated advertisements on certain Samsung Family Hub refrigerator models in the U.S. market.

As a part of this pilot program, Family Hub refrigerators in the U.S. will receive an over-the-network (OTN) software update with Terms of Service (T&C) and Privacy Notice (PN). Advertising will appear on certain Family Hub refrigerator Cover Screens. The Cover Screen appears when a Family Hub screen is idle. Ad design format may change depending on Family Hub personalization options for the Cover Screen, and advertising will not appear when Cover Screen displays Art Mode or picture albums.

Advertisements can be dismissed on the Cover Screens where ads are shown, meaning that specific ads will not appear again during the campaign period.

As the statement notes, this is a pilot program for certain Samsung Family Hub refrigerator models sold in the US. As part of the program, these refrigerators will display “promotions and curated advertisements” on certain Cover Screens when the Family Hub screen (i.e., the door display) is idle.

The company notes that ads can be dismissed, and dismissed ads will not appear again. The ad design format will also change depending on the Cover Screen’s personalization options. Ads will not appear when the Cover Screen displays photos or art.

From the changelog, we know that ads will be displayed on the Cover Screen for the Weather, Color, and Daily Board themes, whereas the Cover Screen for the Art and Gallery themes will not display advertisements, in line with the company’s statement.

It’s still unclear which exact refrigerators are getting the ad infestation, but Samsung’s current Family Hub-equipped lineup in the US starts at $1,800 and goes all the way up to $3,500. It doesn’t seem like users can entirely turn off ads

Source: Samsung confirms its $1,800+ fridges will start showing you ads

Yay the good old US where this is legal. I am not sure this would go in the EU but then again, I am not sure what EU law would stop this either. Apparently you don’t own what you bought and you can’t stop “new features” if you don’t want them.

US, CA and EU Airlines Sell 5 Billion Plane Ticket Records to the Government For Warrantless Searching

Posted on September 16, 2025 by Robin Edgar

A data broker owned by the country’s major airlines, including American Airlines, United, and Delta, [and Air France, Lufthansa, JetBlue] is selling access to five billion plane ticketing records to the government for warrantless searching and monitoring of peoples’ movements, including by the FBI, Secret Service, ICE, and many other agencies, according to a new contract and other records reviewed by 404 Media.

The contract provides new insight into the scale of the sale of passengers’ data by the Airlines Reporting Corporation (ARC), the airlines-owned data broker. The contract shows ARC’s data includes information related to more than 270 carriers and is sourced through more than 12,800 travel agencies. ARC has previously told the government to not reveal to the public where this passenger data came from, which includes peoples’ names, full flight itineraries, and financial details.

“Americans’ privacy rights shouldn’t depend on whether they bought their tickets directly from the airline or via a travel agency. ARC’s sale of data to U.S. government agencies is yet another example of why Congress needs to close the data broker loophole by passing my bipartisan bill, the Fourth Amendment Is Not For Sale Act,” Senator Ron Wyden told 404 Media in a statement.

ARC is owned and operated by at least eight major U.S. airlines, publicly released documents show. Its board of directors includes representatives from American Airlines, Delta, United, Southwest, Alaska Airlines, JetBlue, and European airlines Air France and Lufthansa, and Canada’s Air Canada. ARC acts as a bridge between airlines and travel agencies, in which it helps with fraud prevention and finds trends in travel data. ARC also sells passenger data to the government as part of what it calls the Travel Intelligence Program (TIP).

TIP is updated every day with the previous day’s ticket sales and can show a person’s paid intent to travel. Government agencies can then search this data by name, credit card, airline, and more.

The new contract shows that ARC has access to much more data than previously reported. Earlier coverage found TIP contained more than one billion records spanning more than 3 years of past and future travel. The new contract says ARC provides the government with “5 billion ticketing records for searching capabilities.”

Screenshots of the documents obtained by 404 Media.

404 Media obtained the contract through a Freedom of Information Act (FOIA) with the Secret Service. The contract indicates the Secret Service plans to pay ARC $885,000 for access to the data stretching into 2028.

[…]

An ARC spokesperson told 404 Media in an email that TIP “was established by ARC after the September 11, 2001, terrorist attacks and has since been used by the U.S. intelligence and law enforcement community to support national security and prevent criminal activity with bipartisan support. Over the years, TIP has likely contributed to the prevention and apprehension of criminals involved in human trafficking, drug trafficking, money laundering, sex trafficking, national security threats, terrorism and other imminent threats of harm to the United States.”

The spokesperson added “Pursuant to ARC’s privacy policy, consumers may ask ARC to refrain from selling their personal data.”

After media coverage and scrutiny from Senator Wyden’s office of the little-known data selling, ARC finally registered as a data broker in the state of California in June. Senator Wyden previously said it appeared ARC had been in violation of Californian law for not registering while selling airline customers’ data for years.

Source: Airlines Sell 5 Billion Plane Ticket Records to the Government For Warrantless Searching

Supposedly you can opt out by emailing them at privacy@arccorp.com

https://www2.arccorp.com/site-privacy-policy/#17

Posted on September 15, 2025 by Robin Edgar

Danish Minister of Justice and chief architect of the current Chat Control proposal, Peter Hummelgaard:

Danish Minister of Justice, Peter Hummelgaard.

“We must break with the totally erroneous perception that it is everyone’s civil liberty to communicate on encrypted messaging services.”

Share your thoughts via https://fightchatcontrol.eu/, or to jm@jm.dk directly.

Source: https://www.ft.dk/samling/20231/almdel/REU/spm/1426/index.htm

In the answers he cites “but we must protect the children” – as soon as that argument is trotted out have a good look at what they are taking away from you. After all, who can be against the safety of children? But blanket surveillance is bad for children and awful for society. If you know you are being watched, you can’t speak freely, you can’t voice your opinion and democracy cannot function. THAT is bad for the children.

There is something rotten in the state of Denmark. Big Brother, 1984, they were warnings, not manuals.

Source: https://mastodon.social/@chatcontrol/115204439983078498

More discussion: https://www.reddit.com/r/europe/comments/1nhdtoz/danish_minister_of_justice_we_must_break_with_the/

PS I would not buy a used camel from this creep.

Newly Granted Nintendo Patents An ‘Embarrassing Failure’ By The USPTO, Says Patent Attorney

Posted on September 14, 2025 by Robin Edgar

As you will hopefully recall, that very strange patent lawsuit between Nintendo and PocketPair over the latter’s hit game, Palworld, is ongoing. At the heart of that case is a series of overly broad patents for what are generally considered generic game mechanics that also have a bunch of prior art from before their use by Nintendo in its Pokémon games. These include concepts like throwing a capture item at an NPC to collect a character, as well as riding and mounting/dismounting NPCs in an open world setting. The result, even as the litigation is ongoing, has been PocketPair patching out several of these game mechanics from its game in order to protect itself. That it feels this is necessary as a result of these broad patents is unfortunate.

And, because of the failure of the USPTO to do its job, it seems things will only get worse. Nintendo was awarded two additional patents in just the past couple of weeks and those patents are being called an “embarrassing failure” by patent attorney Kirk Sigmon.

The last 10 days have brought a string of patent wins for Nintendo. Yesterday, the company was granted US patent 12,409,387, a patent covering riding and flying systems similar to those Nintendo has been criticized for claiming in its Palworld lawsuit (via Gamesfray). Last week, however, Nintendo received a more troubling weapon in its legal arsenal: US patent 12,403,397, a patent on summoning and battling characters that the United States Patent and Trademark Office granted with alarmingly little resistance.

According to videogame patent lawyer Kirk Sigmon, the USPTO granting Nintendo these latest patents isn’t just a moment of questionable legal theory. It’s an indictment of American patent law.

[…]

Sigmon notes that both patents are for mechanics and concepts that ought to be obvious to anyone with a reasonable amount of skill in this industry, which ought to have made them ineligible to be patented. That standard of patent law only works, however, if the USPTO acts as a true interlocutor during the filing process. In both of these cases, though, the USPTO appears to have not been in the mood to do their jobs.

Sigmon notes that it is common for patent applications like this to show some amount of questioning or pushback from the examiner. In both of these cases, that seemed almost entirely absent from the process, especially for patent ‘397.

[…]

When the claims were ultimately allowed, the only reasoning the USPTO offered was a block quote of text from the claims themselves.

The ‘397 patent granted last week is even more striking. It’s a patent on summoning and battling with “sub-characters,” using specific language suggesting it’s based on the Let’s Go! mechanics in the Pokémon Scarlet and Violet games. Despite its relevance to a conceit in countless games—calling characters to battle enemies for you—it was allowed without any pushback whatsoever from the USPTO, which Sigmon said is essentially unheard of.

“Like the above case, the reasons for allowance don’t give us even a hint of why it was allowed: the Examiner just paraphrases the claims (after block quoting them) without explaining why the claims are allowed over the prior art,” Sigmon said. “This is extremely unusual and raises a large number of red flags.”

[…]

with the Palworld example fresh in our minds, we do certainly know what the granting of patents like this will result in: more patent bullying by Nintendo.

“Pragmatically speaking, though, it’s not impossible to be sued for patent infringement even when a claim infringement argument is weak, and bad patents like this cast a massive shadow on the industry,” Sigmon said.

For a company at Nintendo’s scale, the claims of the ‘397 patent don’t need to make for a strong argument that would hold up in court. The threat of a lawsuit can stifle competition well enough on its own when it would cost millions of dollars to defend against.

And in the current environment, where challenging bad patents has become essentially pointless, you can bet we’ll see Nintendo wielding these patents against competitors in the near future.

Source: Newly Granted Nintendo Patents An ‘Embarrassing Failure’ By The USPTO, Says Patent Attorney | Techdirt

Swiss government may disable privacy tech, stoking fears of mass surveillance

Posted on September 14, 2025 by Robin Edgar

The Swiss government could soon require service providers with more than 5,000 users to collect government-issued identification, retain subscriber data for six months and, in many cases, disable encryption.

The proposal, which is not subject to parliamentary approval, has alarmed privacy and digital-freedoms advocates worldwide because of how it will destroy anonymity online, including for people located outside of Switzerland.

A large number of virtual private network (VPN) companies and other privacy-preserving firms are headquartered in the country because it has historically had liberal digital privacy laws alongside its famously discreet banking ecosystem.

Proton, which offers secure and end-to-end encrypted email along with an ultra-private VPN and cloud storage, announced on July 23 that it is moving most of its physical infrastructure out of Switzerland due to the proposed law.

The company is investing more than €100 million in the European Union, the announcement said, and plans to help develop a “sovereign EuroStack for the future of our home continent.” Switzerland is not a member of the EU.

Proton said the decision was prompted by the Swiss government’s attempt to “introduce mass surveillance.”

Proton founder and CEO Andy Yen told Radio Télévision Suisse (RTS) that the suggested regulation would be illegal in the EU and United States.

“The only country in Europe with a roughly equivalent law is Russia,” Yen said.

[…]

Internet users would no longer be able to register for a service with just an email address or anonymously and would instead have to provide their passport, drivers license or another official ID to subscribe, said Chloé Berthélémy, senior policy adviser at European Digital Rights (eDRI), an association of civil and human rights organizations from across Europe.

The regulation also includes a mass data retention obligation requiring that service providers keep users’ email addresses, phone numbers and names along with IP addresses and device port numbers for six months, Berthélémy said. Port numbers are unique identifiers that send data to a specific application or service on a computer.

All authorities would need to do to obtain the data, Berthélémy said, is make a simple request that would circumvent existing legal control mechanisms such as court orders.

“The right to anonymity is supporting a very wide range of communities and individuals who are seeking safety online,” Berthélémy said.

“In a world where we have increasing attacks from governments on specific minority groups, on human rights defenders, journalists, any kind of watchdogs and anyone who holds those in power accountable, it’s very crucial that we … preserve our privacy online in order to do those very crucial missions.”

Source: Swiss government looks to undercut privacy tech, stoking fears of mass surveillance | The Record from Recorded Future News

Spotify pissy after 10,000 users sold their own data to build AI tools

Posted on September 14, 2025 by Robin Edgar

For millions of Spotify users, the “Wrapped” feature—which crunches the numbers on their annual listening habits—is a highlight of every year’s end, ever since it debuted in 2015. NPR once broke down exactly why our brains find the feature so “irresistible,” while Cosmopolitan last year declared that sharing Wrapped screenshots of top artists and songs had by now become “the ultimate status symbol” for tens of millions of music fans.

It’s no surprise then that, after a decade, some Spotify users who are especially eager to see Wrapped evolve are no longer willing to wait to see if Spotify will ever deliver the more creative streaming insights they crave.

With the help of AI, these users expect that their data can be more quickly analyzed to potentially uncover overlooked or never-considered patterns that could offer even more insights into what their listening habits say about them.

Imagine, for example, accessing a music recap that encapsulates a user’s full listening history—not just their top songs and artists.

[…]

In pursuit of supporting developers offering novel insights like these, more than 18,000 Spotify users have joined “Unwrapped,” a collective launched in February that allows them to pool and monetize their data.

Voting as a group through the decentralized data platform Vana—which Wired profiled earlier this year—these users can elect to sell their dataset to developers who are building AI tools offering fresh ways for users to analyze streaming data in ways that Spotify likely couldn’t or wouldn’t.

In June, the group made its first sale, with 99.5 percent of members voting yes. Vana co-founder Anna Kazlauskas told Ars that the collective—at the time about 10,000 members strong—sold a “small portion” of its data (users’ artist preferences) for $55,000 to Solo AI.

While each Spotify user only earned about $5 in cryptocurrency tokens—which Kazlauskas suggested was not “ideal,” wishing the users had earned about “a hundred times” more—she said the deal was “meaningful” in showing Spotify users that their data “is actually worth something.”

“I think this is what shows how these pools of data really act like a labor union,” Kazlauskas said. “A single Spotify user, you’re not going to be able to go say like, ‘Hey, I want to sell you my individual data.’ You actually need enough of a pool to sort of make it work.”

[…]

Spotify is not happy about Unwrapped, which is perhaps a little too closely named to its popular branded feature for the streaming giant’s comfort. A spokesperson told Ars that Spotify sent a letter to the contact info listed for Unwrapped developers on their site, outlining concerns that the collective could be infringing on Spotify’s Wrapped trademark.

Further, the letter warned that Unwrapped violates Spotify’s developer policy, which bans using the Spotify platform or any Spotify content to build machine learning or AI models. And developers may also be violating terms by facilitating users’ sale of streaming data.

“Spotify honors our users’ privacy rights, including the right of portability,” Spotify’s spokesperson said. “All of our users can receive a copy of their personal data to use as they see fit. That said, UnwrappedData.org is in violation of our Developer Terms which prohibit the collection, aggregation, and sale of Spotify user data to third parties.”

But while Spotify suggests it has already taken steps to stop Unwrapped, the Unwrapped team told Ars that it never received any communication from Spotify. It plans to defend users’ right to “access, control, and benefit from their own data,” its statement said, while providing reassurances that it will “respect Spotify’s position as a global music leader.”

Unwrapped “does not distribute Spotify’s content, nor does it interfere with Spotify’s business,” developers argued. “What it provides is community-owned infrastructure that allows individuals to exercise rights they already hold under widely recognized data protection frameworks—rights to access their own listening history, preferences, and usage data.”

“When listeners choose to share or monetize their data together, they are not taking anything away from Spotify,” developers said. “They are simply exercising digital self-determination. To suggest otherwise is to claim that users do not truly own their data—that Spotify owns it for them.”

Jacob Hoffman-Andrews, a senior staff technologist for the digital rights group the Electronic Frontier Foundation, told Ars that—while EFF objects to data dividend schemes “where users are encouraged to share personal information in exchange for payment”—Spotify users should nevertheless always maintain control of their data.

“In general, listeners should have control of their own data, which includes exporting it for their own use,” Hoffman-Andrews said. “An individual’s musical history is of use not just to Spotify but also to the individual who created it. And there’s a long history of services that enable this sort of data portability, for instance Last.fm, which integrates with Spotify and many other services.”

[…]

“This is the heart of the issue: If Spotify seeks to restrict or penalize people for exercising these rights, it sends a chilling message that its listeners should have no say in how their own data is used,” the Unwrapped team’s statement said. “That is out of step not only with privacy law, but with the values of transparency, fairness, and community-driven innovation that define the next era of the Internet.”

Unwrapped sign-ups limited due to alleged Spotify issues

There could be more interest in Unwrapped. But Kazlauskas alleged to Ars that in the more than six months since Unwrapped’s launch, “Spotify has made it extraordinarily difficult” for users to port over their data. She claimed that developers have found that “every time they have an easy way for users to get their data,” Spotify shuts it down “in some way.”

Supposedly because of Spotify’s interference, Unwrapped remains in an early launch phase and can only offer limited spots for new users seeking to sell their data. Kazlauskas told Ars that about 300 users can be added each day due to the cumbersome and allegedly shifting process for porting over data.

Currently, however, Unwrapped is working on an update that could make that process more stable, Kazlauskas said, as well as changes to help users regularly update their streaming data. Those updates could perhaps attract more users to the collective.

[…]

Source: Spotify peeved after 10,000 users sold data to build AI tools – Ars Technica

Proton Mail Suspended Journalist Accounts at Request of some Cybersecurity Agency without any process

Posted on September 14, 2025 by Robin Edgar

The company behind the Proton Mail email service, Proton, describes itself as a “neutral and safe haven for your personal data, committed to defending your freedom.”

But last month, Proton disabled email accounts belonging to journalists reporting on security breaches of various South Korean government computer systems following a complaint by an unspecified cybersecurity agency. After a public outcry, and multiple weeks, the journalists’ accounts were eventually reinstated — but the reporters and editors involved still want answers on how and why Proton decided to shut down the accounts in the first place.

Martin Shelton, deputy director of digital security at the Freedom of the Press Foundation, highlighted that numerous newsrooms use Proton’s services as alternatives to something like Gmail “specifically to avoid situations like this,” pointing out that “While it’s good to see that Proton is reconsidering account suspensions, journalists are among the users who need these and similar tools most.” Newsrooms like The Intercept, the Boston Globe, and the Tampa Bay Times all rely on Proton Mail for emailed tip submissions.

Shelton noted that perhaps Proton should “prioritize responding to journalists about account suspensions privately, rather than when they go viral.”

On Reddit, Proton’s official account stated that “Proton did not knowingly block journalists’ email accounts” and that the “situation has unfortunately been blown out of proportion.” Proton did not respond to The Intercept’s request for comment.

The two journalists whose accounts were disabled were working on an article published in the August issue of the long-running hacker zine Phrack. The story described how a sophisticated hacking operation — what’s known in cybersecurity parlance as an APT, or advanced persistent threat — had wormed its way into a number of South Korean computer networks, including those of the Ministry of Foreign Affairs and the military Defense Counterintelligence Command, or DCC.

The journalists, who published their story under the names Saber and cyb0rg, describe the hack as being consistent with the work of Kimsuky, a notorious North Korean state-backed APT sanctioned by the U.S. Treasury Department in 2023.

As they pieced the story together, emails viewed by The Intercept show that the authors followed cybersecurity best practices and conducted what’s known as responsible disclosure: notifying affected parties that a vulnerability has been discovered in their systems prior to publicizing the incident.

Saber and cyb0rg created a dedicated Proton Mail account to coordinate the responsible disclosures, then proceeded to notify the impacted parties, including the Ministry of Foreign Affairs and the DCC, and also notified South Korean cybersecurity organizations like the Korea Internet and Security Agency, and KrCERT/CC, the state-sponsored Computer Emergency Response Team. According to emails viewed by The Intercept, KrCERT wrote back to the authors, thanking them for their disclosure.

A note on cybersecurity jargon: CERTs are agencies consisting of cybersecurity experts specializing in dealing with and responding to security incidents. CERTs exist in over 70 countries — with some countries having multiple CERTs each specializing in a particular field such as the financial sector — and may be government-sponsored or private organizations. They adhere to a set of formal technical standards, such as being expected to react to reported cybersecurity threats and security incidents. A high-profile example of a CERT agency in the U.S. is the Cybersecurity and Infrastructure Agency, which has recently been gutted by the Trump administration.

A week after the print issue of Phrack came out, and a few days before the digital version was released, Saber and cyb0rg found that the Proton account they had set up for the responsible disclosure notifications had been suspended. A day later, Saber discovered that his personal Proton Mail account had also been suspended. Phrack posted a timeline of the account suspensions at the top of the published article, and later highlighted the timeline in a viral social media post. Both accounts were suspended owing to an unspecified “potential policy violation,” according to screenshots of account login attempts reviewed by The Intercept.

The suspension notice instructed the authors to fill out Proton’s abuse appeals form if they believed the suspension was in error. Saber did so, and received a reply from a member of Proton Mail’s Abuse Team who went by the name Dante.

In an email viewed by The Intercept, Dante told Saber that their account “has been disabled as a result of a direct connection to an account that was taken down due to violations of our terms and conditions while being used in a malicious manner.” Dante also provided a link to Proton’s terms of service, going on to state, “We have clearly indicated that any account used for unauthorized activities, will be sanctioned accordingly.” The response concluded by stating, “We consider that allowing access to your account will cause further damage to our service, therefore we will keep the account suspended.”

On August 22, a Phrack editors reached out to Proton, writing that no hacked data was passed through the suspended email accounts, and asked if the account suspension incident could be deescalated. After receiving no response from Proton, the editor sent a follow-up email on September 6. Proton once again did not reply to the email.

On September 9, the official Phrack X account made a post asking Proton’s official account asking why Proton was “cancelling journalists and ghosting us,” adding: “need help calibrating your moral compass?” The post quickly went viral, garnering over 150,000 views.

Proton’s official account replied the following day, stating that Proton had been “alerted by a CERT that certain accounts were being misused by hackers in violation of Proton’s Terms of Service. This led to a cluster of accounts being disabled. Our team is now reviewing these cases individually to determine if any can be restored.” Proton then stated that they “stand with journalists” but “cannot see the content of accounts and therefore cannot always know when anti-abuse measures may inadvertently affect legitimate activism.”

Proton did not publicly specify which CERT had alerted them, and didn’t answer The Intercept’s request for the name of the specific CERT which had sent the alert. KrCERT also did not reply to The Intercept’s question about whether they were the CERT that had sent the alert to Proton.

Later in the day, Proton’s founder and CEO Andy Yen posted on X that the two accounts had been reinstated. Neither Yen nor Proton explained why the accounts had been reinstated, whether they had been found to not violate the terms of service after all, why had they been suspended in the first place, or why a member of the Proton Abuse Team reiterated that the accounts had violated the terms of service during Saber’s appeals process.

Phrack noted that the account suspensions created a “real impact to the author. The author was unable to answer media requests about the article.” The co-authors, Phrack pointed out, were also in the midst of the responsible disclosure process and working together with the various affected South Korean organizations to help fix their systems. “All this was denied and ruined by Proton,” Phrack stated.

Phrack editors said that the incident leaves them “concerned what this means to other whistleblowers or journalists. The community needs assurance that Proton does not disable accounts unless Proton has a court order or the crime (or ToS violation) is apparent.”

Source: Proton Mail Suspended Journalist Accounts at Request of Cybersecurity Agency

If Proton can’t view the content of accounts, how did Proton verify some random CERTs claims to make the decision to close the accounts? And how did Proton review to see if they could be restored? Is it Proton policy to decide that people are guilty before proven innocent? This attitude justifies people blowing up about this incident – because it shows how vulnerable they are to random whims of Proton instead of any kind of transparent diligent process.