This, however, does not make open-source software completely immune from censorship. While it itself is largely censorship-resistant, the publishers are not, and stopping open-source development only requires prosecuting those who develop it.

Take the developers of the privacy-preserving Tornado Cash protocol, for example. Treasury’s sanctions of the Tornado Cash smart contracts and the criminal prosecutions against Roman Storm and Roman Semenov in the U.S., and Alexey Pertsev in the Netherlands, did not at all stop use of the protocol. This is a testament of censorship-resistant technology, but also of its human-vulnerability. Since 2023, both Storm and Pertsev have been fighting for their freedom in the courts, and Semenov has likely left the U.S.

Tornado Cash is a tool for privacy and free speech, and yet the governments of so-called “liberal democracies” have aggressively targeted its developers. Technology alone cannot protect against adversarial governments—the technology may be censorship resistance, but criminal prosecution still exists in the physical world.

Law and politics matter. This is why the Coin Center and other crypto-advocates have fought for the Blockchain Regulatory Certainty Act in both the U.S. House and Senate for years now, attempting to provide protections against abuse of the U.S. criminal code against open-source developers. This is why Coin Center fellow Michael Lewellen is suing the DOJ to seek declarative judgement that persons developing and maintaining non-custodial open-source software is not criminal conduct. The inherent nature of open-source protects only the software, not the developer.

The AI industry is quickly coming to terms with this threat as frontier labs are pushing for government intervention to halt the development of AI in order to save all of humanity—despite continuing to rapidly develop their own AI models.

For some time now, frontier labs, such as OpenAI and Anthropic, have advocated for more government-intervention in the development and releasing of AI models. After six weeks on the job, an employee from Anthropic publicly resigned due to frontier labs’ alleged irresponsible development of AI and for “gambling with our lives,” sparking debate over the matter. Then, Dario Amodei and Sam Altman publicly supported the notion of government-intervention—which they have been doing for a long time.

But as most have probably thought to themselves, if these CEOs and employees truly believed what they said, why do they need the government to stop their development when they could simply stop themselves? A great question. Instead, frontier labs have been lobbying for regulations on AI models to halt development and architect a framework for safety reviews prior to deployment, all while rapidly developing their models. It’s hard not to assume regulatory capture is the goal here.

Supporters of open-source have taken notice.

Many have pointed out that even if OpenAI and Anthropic were to leverage regulations or a licensing regime to monopolize the market, open-source development would continue and people would still get their hands on open-source models. They’re mostly right that open-source would continue globally and people always find a way to acquire information despite censorship attempts, but they are wrong to call open-source “unstoppable” for the same reason that Lewellen is suing the DOJ: developers won’t write code if they fear criminal prosecution. And, like all other forms of technology, we need open-source for AI.

AI is increasingly empowering individuals the way the personal computer had for the last fifty years. With AI, information is distributed back to the user in almost a human-like way. People are able to converse and learn from AI the way they would be able to with their peers—except for the fact that it contains almost all the information in human existence. It is as if we made the Internet and all the libraries in the world into a person—with some refinements, of course—and gave it the ability to converse with us. Because of this, AI models are increasingly becoming people’s primary source for information, where they no longer search for things themselves but rely on AI models instead.

This means that those who develop these models will become the primary distributors of information, and therefore, of “truth.” Whether or not information distribution is centralized will largely depend on how the overall systems are designed and the regulatory regime surrounding them. Calls for regulations that rest deployment of these models on regulatory approval will surely centralize it. The government will essentially decide what information is allowed to be distributed and what is not, while incumbents monopolize the market and increase their influence. And we need only to look to history to understand why centralizing information distribution is dangerous. A central authority deciding which information we consume decides which ideas and movements spread; it dictates human progress.

Free speech primarily serves as a protection against this very reality. Diversity of thought has nourished our curiosity by exposing us to new ideas, enabling our creativity and driving the human race forward. Censorship replaces curiosity with conformity and eliminates challenging the status quo. Thus, centralizing the distributors of “truth” would be beneficial to the tyrant and detrimental to the individual, because freedom requires the ability to exchange information.

And this extends beyond just information distribution to surveillance as well. Like personal computers and cellphones, these AI models are no longer just tools for people to use, but almost extensions of the people that use them. Every thought, question, and worry will increasingly exist within these systems. Whether an AI model runs on a server belonging to a company, or locally on a person’s computer, will determine who has access and authority over this intimate information. The companies behind centralized AI models will get to decide what to do with a person’s information, and the government will surely want its hands on it.

Open-source software has long existed as a defense against censorship and surveillance, and the same holds true for AI. But it is only unstoppable once it is published, and governments and corporations will surely try and prevent that. The Tornado Cash prosecutions and subsequent Lewellen lawsuit offer us a glimpse of what is in store with AI if we simply ignore law and politics. They matter. -Laz

What else we’re reading

• This well-signed “The Pro-Human AI Declaration” petition includes troubling language for developers: Developers and deployers bear legal liability for defects, misrepresentation of capabilities, and inadequate safety controls, with statutes of limitation that account for harms emerging over time.

• Latham & Watkins buys Nvidia servers to set up in-house AI systems

That’s from 2017.

If you found this interesting, please consider subscribing and sharing. We are trying to grow this thing.

Subscribe now

The disagreement is over jurisdiction. Does the ICC have jurisdiction over non-member states, particularly the U.S. and Israel? The U.S. thinks no. The ICC argues it has jurisdiction if the alleged crimes occurred in territories that did sign the treaty, Afghanistan and Palestine.

Setting aside their actual dispute, the sanctions give us a unique opportunity to see American economic power in action. Typically when we think of sanctions we think of shadowy oligarchs and hidden terror groups. With these particular sanctions, we get to see what happens when a professionally established person living in a developed city is suddenly cut off from the U.S. financial/tech system.

The stories from those sanctioned paint a scary picture.

The effects were immediate yet remarkably mundane. Credit cards stopped working, including cards issued by banks outside the United States. European bank transfers were rejected or blocked. Peruvian judge Luz del Carmen Ibáñez Carranza had a card cancelled by her Dutch bank. “Why? It’s a European bank, not an American bank,” she told The Guardian. She blamed “a kind of over-compliance,” with foreign banks terrified of jeopardizing their relationships with U.S. institutions.

Then things got stranger. Canadian judge Kimberly Prost lost her Amazon account and came home to discover that Alexa would no longer respond to her. While traveling in New Zealand, her debit card failed when she tried to buy breakfast: “I wasn’t having breakfast that morning.” French judge Nicolas Guillou lost access to Amazon, Airbnb and PayPal, and even had a hotel reservation in France cancelled because he had booked it through Expedia. Slovenian judge Beti Hohler says a friend sent her a Christmas present through Amazon and subsequently had THEIR Amazon accounts suspended.

The effects could also spread to family members and other people who dealt with those sanctioned. A transfer from ICC prosecutor Karim Khan to his former wife for their children reportedly resulted in her bank account being frozen. Some officials lost access to email and other online services. Italian lawyer and UN Special Rapporteur Francesca Albanese says she has been unable to obtain ordinary banking services even in Europe and has resorted to cash and borrowing from friends and family. Her description of the experience gives this piece its title: “It equates to a civil death.”

The online world is intermediated. Those intermediaries are overwhelmingly dominated by U.S. companies, and most of the world follows our lead. The financial system is extremely risk averse. Both finance and tech are completely deferential in the name of compliance. Put those things together and sanctions are a magic order that can strike a person from the internet and banking completely.

No matter where you live in the world, even if you never touch dollars, if you do not take sovereignty into your own hands you are subject to the control of the current U.S. administration.

Seeing sanctions, a tool typically reserved for terrorists and rogue states, used in what would ordinarily be a wonkish international political debate must be striking to the rest of the world. It’s surely accelerating the European push for ‘digital sovereignty’ and the digital euro (which we analyzed from a privacy perspective last week). And perhaps is another talking point for Xi Jinping on his global tour promoting China as a stable partner amid US-led geopolitical uncertainty.

The recently sanctioned far-left hacker collective Autistici/Inventati (A/I) learned this. We covered those sanctions last week as well. Since then the story has developed. A/I was betting on its Italian bank defending Italian sovereignty by keeping their account open. Instead, their account was closed and funds seized.

When the sanctions were announced, I of course ran to their donation page to see they took crypto. They did not and have strong feelings as to why.

All this is to say, if you are doing anything that challenges the United States in any way, even if it’s just political activism or through the established processes of international law, you should consider reducing your reliance on compliance driven intermediaries. - Neeraj

You may remember that last week Peter “went off” about the leaking of 150 million ID documents.

Now it’s Laz’s turn, in a new op-ed for Coindesk:

Taking all this into account, why do we surrender our sensitive personal information if all we receive in return are false promises of security? Americans are not safer because they identify themselves in each waking moment to every service provider they come across. Far from it. And yet, governments at home and abroad wish to expand the identification regime even further with age verification under the guise of protecting children. But we are again witnessing that these “protections” cause more harm than good. Our information is out there, being traded amongst criminals because governments and corporations wanted to know who we were and what we were doing. And now we pay the price.

If there were ever a time for stronger privacy, it is right now. However, we cannot ignore nuance. There are calls for abolishing identification and verification processes entirely. This is an attractive alternative, but the reality is that the underlying purpose of anti-fraud processes is to protect Americans and their property, and they protect businesses’ revenue and operational integrity — the current approach is just unsuccessful. There is real utility here, but this does not mean that we need to remain with the status quo.

Read the full thing here: KYC data is an irresistible honeypot for hackers, and we must change how it is collected

Laz also “went off” on 404media’s reporting on a secretive predictive policing unit in DHS that apparently pulls in financial and other data to assess potential criminality.

And Neeraj threw in something too.

What else we’re reading

• Bitcoin’s Overlooked Promise: Freedom - An essay in the WSJ from our friend Alex Gladstein

• The ‘papers, please’ era of the internet will decimate your privacy

If you have something you would like to see discussed here, please let us know.

The surveillance capabilities of CBDCs have long been a concern, especially in Western Democracies that have increasingly taken an interest in techno-authoritarianism (whether they believe it or not). Cipollone, however, assured the interviewer that Europeans should not be concerned about financial surveillance with the digital euro since offline transaction details “will only be available to the payer and the payee.”

For online transactions, however, the Eurosystem (the monetary authority consisting of the ECB and the national central banks that have adopted the euro) would not be able to identify the parties involved, but “the banks involved in the transaction would be able to do so, including for anti-money laundering purposes.” Stated differently, the EU governments won’t be keeping a close eye on Europeans themselves, they’ll just have the banks do it for them and report back. So, not too different from the current more-or-less fully surveilled financial system.

These are two very different statements for the two modes of transactions that can occur with the digital euro (i.e., offline and online), so it would be good to better understand what’s actually going on, according to the ECB’s draft rulebook for a digital euro.

Cipollone states that transactions occurring offline are private and peer-to-peer (he doesn’t use that exact term but I’m contractually required to use it in our newsletter); whereas, online transactions would work the same as traditional digital payments, where an intermediary is involved but settlement would occur on one central infrastructure and not with various banks.

Online transactions go something like this:

• Alice wants to send money to Bob;

• Alice initiates the transaction through a payment service provider’s (PSP) application;

• The PSP authenticates her and validates/screens the transaction;

• Alice’s PSP sends the payment instruction to the Eurosystem’s Digital Euro Service Platform (DESP);

• DESP forwards it to Bob’s PSP for validation;

• After each PSP validates the transaction, DESP settles it and confirms settlement to both PSPs, which then notify Alice and Bob.

That last point is where Cipollone states that banks (i.e., PSPs) would identify parties involved in a transaction—that is, identify their respective customers. This is how the world currently works, so this is no surprise.

Offline transactions are more representative of peer-to-peer transactions (I get paid by the amount of times I say it), where a payer is able to send money to a payee between their devices without an intermediary, where transaction authentication happens locally on each participant’s device.

Here is how offline transactions work:

• Alice enters the transaction details into her application and the software in her device authenticates the details locally;

• The payer and payee tap their phones using near field communication (NFC), which allows two devices to exchange communications when they are near each other;

• The two applications authenticate each other; both devices validate the transaction (meaning the payer’s device ensures they have enough money and the payee’s device ensures that receiving the money would not exceed its offline holding limit or transaction-number limit);

• The balances then update locally;

• The payee confirms the settlement by sending confirmation back to the payer’s application. (Look to Annex B2, pages 222-224, for more details.)

But while the transaction itself is designed to be peer-to-peer when done offline (there’s my annual bonus), onboarding and device registration still requires user verification and identification with a PSP. The DESP is also informed of when euros are issued to a device and when they are redeemed. For example, Alice would go through the DESP to move €100 to her offline wallet; the DESP processes the transaction; and Alice’s device now has an offline balance of €100. The operation is processed through Alice’s PSP and DESP. And when Alice sends €80 to Bob, there is no involvement of a PSP nor DESP. However, if Bob then redeems the €80, he would have to do so online through a PSP and DESP.

Here is where things get tricky. These offline transactions are not entirely similar to cash transactions, because while the transaction can be done in a peer-to-peer manner, the registered devices are still subject to limits and periodically required to complete integrity checks with the DESP. Furthermore, as previously mentioned, there are offline holding limits that dictate how much a device can hold offline, meaning that a user’s device could reject a transaction if the user hits their limit. The device would also reject transactions if the user reaches a certain number of consecutive offline transactions.

All this in mind, the digital euro and its associated software would be best described as having mechanisms in place for peer-to-peer transactions, but also having mechanisms in place for centralized controls on transactions and checkpoints for user identification. Is this the kind of technology that would maximize privacy for users? Not quite. It allows for some privacy, but information leakage is very much prevalent. Nor is this the kind of technology that empowers Europeans with greater autonomy the way cash does. There are very strict limitations that exist at the discretion of EU authorities.

The digital euro remains in negotiations between the EU Commission, Parliament, and Council. Meanwhile, the ECB is currently developing a pilot and, as of mid-August, has requested participants for developing offline digital euro standards. The draftbook (that has acted as our point of reference) will continue evolving consistent with negotiations and technical developments.

This timeline has always seemed inevitable. Monetary policy and fiat currency have historically been useful instruments in domestic and foreign influence—nation states were not going to simply lie down while financial technology evolved towards peer-to-peer networks and (actual) user-controlled wallets. But we knew this, and so our fight continues towards privacy-preserving electronic cash that operates on open, decentralized blockchain networks.

-Laz

What else we’re reading

• Peter wrote a fiery blog about the recent ID leak. It’s become our most popular post yet. You should read it: The huge driver’s license hack was inevitable. It’s time to get mad.

• Roman Storm, a creator of Tornado Cash who has become the face of open source developers being held accountable for other people’s illicit use of his code, wrote a response as well: Privacy for Criminals, Ladies and Gentlemen

• How Terrorist Groups are Using Artificial Intelligence

• Lawsuit challenges Tether for allegedly freezing $42.4 million USDT before U.S. warrant - An interesting result of the debate over best practices for proactive stablecoin freezing.

• How KYC and AML are destroying the world

• Autistici/Inventati is furious at their Italian bank for caving by U.S. sanctions.

Thanks for reading. If you found this interesting, please share it. We are trying to grow this thing.

You should be mad.

We are long, long, long overdue to reduce the amount of KYC we do as a society. It doesn’t stop crime. It enables mass surveillance of the innocent by the tyrannical. And, perhaps most of all, it enriches hackers with troves of intimate personal data.

We deputize a sea of shitty quasi-government contractors to perform data collection and monitoring that would raise obvious constitutional alarms if the government did it directly. Then we act stunned when one is apparently run by negligent fools who fail to delete or secure the underlying driver’s-license photos they are verifying—photos belonging to people who aren’t even their customers, oh and it is literally HALF THE POPULATION OF AMERICA.

These types of hacks are only going to become more common as attackers weaponize AI to poke at honeypot verification systems. It’s even more absurd because we have the technology to do better: verifiable credentials and zero-knowledge proofs of limited identity data.

Risk-averse compliance departments and set-in-their-ways regulators prefer old practices and the appearance of rigorous compliance—box checking—to actually protecting people through data minimization and auditable, verifiable alternatives.

We explain the alternative in Tear Down This Walled Garden.

If you want this to change, get involved with our John Hancock Project and support Coin Center.

Image Source: https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/

That doesn’t mean the sanctions are inappropriate. But it means the designation sits somewhere close to both the constitutional and statutory limits of sanctions authority. Our First Amendment limits the government’s ability to punish speech. Similarly, the Berman Amendments to the International Emergency Economic Powers Act (IEEPA) deny the President authority to sanction transactions involving information and informational materials. But the A/I designation also alleges activities that may go beyond speech and information, and it is difficult to evaluate the legal significance of those facts until more details emerge.

We did some quick digging to see what we could find about Autistici/Inventati on the internet from before the designation was announced.

By all accounts, it is not a politically neutral hosting company. Since 2001, A/I has openly described itself as a radical-left collective providing email, web hosting, mailing lists, blogs, anonymity tools, and other communications infrastructure to groups broadly aligned with its anti-capitalist, antifascist, and anarchist politics. Nor does A/I appear to operate like a typical commercial hosting provider. A/I claimed to manually review requests for service based on the ideological aims of prospective users. After repeated encounters with European law enforcement, A/I also openly said they engineered their infrastructure to resist surveillance and minimize the identifying information they retain.

Still, choosing who you do business with on ideological grounds is not itself unlawful, and minimizing your exposure to customers’ data is not only legal, it is good technical and security practice.

The government’s August 26 fact sheet alleges that violent groups “relied on” A/I services to publish communiqués, claim responsibility for attacks, distribute manifestos, circulate maps, and share sabotage manuals. Much of that kind of activity is typically treated as speech in our constitutional tradition even when it is despicable. Much of those transactions sound, without further details, like transactions in “information or informational materials,” which the Berman Amendments to IEEPA remove from presidential sanctions authority.

You can see why the facts matter here. If A/I really was merely transacting in information and offered no particularized assistance to bad actors with an intent to further their bad schemes, then this designation would be questionable.

If, on the other hand, A/I administrators actively helped attackers choose targets, specifically configured systems for a known planned attack, provided bespoke assistance designed to evade law enforcement in connection with an attack, or otherwise participated in violent operations, the government has a substantially stronger case for sanctions and other enforcement.

It’s important to stay level headed. Some of the apparent users were not merely distasteful political radicals. The government identifies groups responsible for firebombings, rail sabotage, attacks on energy infrastructure, and other acts of political violence. But if, in our zeal to stop these people from committing further violent acts, we support a rule that effectively allows the President to censor and sanction mere speech and communications infrastructure, then we will have further cut down the precious protections our laws and Constitution provide.

There are some parallels to Tornado Cash, of course. Roman Storm’s prosecution is back in the news because the SDNY has now set an April 26, 2027 retrial on the two conspiracy charges, money laundering and sanctions violations, on which the jury deadlocked the first time around.

Additionally, Roman took to Twitter this week describing how he never ran a relayer for private transactions, while Chainalysis, as emerged in the court record, apparently did.

Unlike the Tornado Cash developers, and even the Tornado Cash token holders, relayers interacted directly with Tornado Cash users and charged a fee for doing so. That puts relayers much closer to the conduct side of a speech (protected) versus conduct (unprotected) distinction for First Amendment and Berman Amendment purposes. We argued this point extensively during the first trial in our amicus brief to the court. - Peter

Subscribe now

What else we’re reading

• U.S. Citizen Who Deleted Phone’s Data Says His Prosecution Puts Privacy at Risk - We discussed this case in a previous issue: “Every phone should have a self-destruct feature: if a thief takes it, it dies; if a kidnapper forces its owner to unlock it, it dies. In the language of contributory copyright liability, this technology is plainly capable of substantial lawful uses. Criminals do not get a heckler’s veto over everyone else’s security.”

• Bank Secrecy Act Crushes Small Businesses

• Flock has people thinking about privacy in a new light. It seems like we may have hit a tipping point. We are finally fed up with surveillance. Now let’s see if we can roll back some of the creeping expansions of the last few decades.

Thanks for reading. If there’s anything you’d like to see us discuss, please let us know.

Share

We know that our phones and apps generate extensive location data. We know there are cameras on most busy city corners. We know that social-media companies retain enormous amounts of personal data about our political leanings, the items we buy, and our browsing habits.

Privacy advocates have been sounding alarm bells about all of this for years, usually with little traction in the form of sustained public outcry.

So why has Flock touched such a nerve?

One possibility is that Flock is simply the culmination of incremental advances in privacy-piercing police technology that happened to catch a disgruntled public at the right time. But it seems more likely that there is something demonstrably creepier about Flock.

Subscribe now

A police officer sitting on the side of a public road can see your car, read your license plate, and write down the time you passed. Generally speaking, none of that is considered a Fourth Amendment “search.” You exposed the car and its legally required license plate to public view.

Flock takes that ordinary observation and transforms it into persistent, searchable, networked memory. Its cameras attempt to photograph every passing vehicle. The system reads plates and records other visible characteristics, including make, type, color, roof racks, bumper stickers, and other distinguishing features. Those observations are uploaded into a database that cops can search retrospectively and can connect easily with other information like criminal records and video sources. And this information is often shared across jurisdictions.

But the public reaction also seems driven by factors beyond just the capabilities of Flock.

The public is starting to realize that advances in AI and machine learning make it possible to analyze and correlate far more data than any human police department could realistically process on its own. We all reasonably expect that Flock data will eventually be fed into a machine that also includes data from sources like our cell phone location records, our payment data, and our browsing history, and that machine will come to conclusions about our potential criminal behavior.

The reaction may be different if we were confident that combining mass surveillance with AI would produce flawless policing, or even just policing free from the abuses already present in our system. But the public is being asked to trust that the technology will reliably identify the right person, and that the authorities wielding it will use it responsibly. When AI sold to us as the “future” is improperly labeling Kentucky on a map or inventing elements on the periodic table, and police armed with Flock identify the incorrect Dodge Durango involved in a murder investigation, skepticism about both sides of that trust equation is hardly surprising

Another potential factor in the public response is that Flock is not simply the outgrowth of police developing a new surveillance tool or adapting some ordinary consumer technology to an investigative purpose. It is a private company explicitly building surveillance infrastructure for police departments. In doing so, it inevitably plays a role in policy decisions about how the system operates: how long data is retained, who receives access, what training is required, which searches are permitted, and how agencies share information. Moreover, because Flock serves thousands of agencies, it can enable information sharing across jurisdictions in a way that seems to turn local police departments into participants in something resembling a quasi-national surveillance effort.

Which of these factors triggered the current reaction is hard to parse. But we have reached a moment when many people are saying that the government (with the assistance of a private company) has gone too far in prying into our everyday movements. And when that happens in the United States, the natural next question is whether some constitutional principle protects us from that overreach.

Fourth Amendment implications

My old law professor, Orin Kerr, recently raised the question of whether Flock cameras implicate a Fourth Amendment “search” such that some level of constitutional protection may apply.

Taking one picture of a publicly visible license plate is almost certainly not a search under existing law. But “using Flock” can describe several different government actions:

• Photographing and recording every passing vehicle.

• Retaining those observations in a database for future queries.

• Receiving a real-time alert about a vehicle on a hotlist.

• Searching the entire database for an unknown vehicle matching a description.

• Reconstructing movements using data from multiple jurisdictions.

Those actions may not all have the same constitutional answer.

I will save a comprehensive Fourth Amendment analysis for another post. But I am inclined to view ALPR networks differently from a cop photographing a car leaving a suspected drug deal or hit-and-run. I approach the question through the broader policy lens that I bring to much of my work: how do we create an environment that respects the same constitutional principles in the digital world that we have historically protected in the physical world?

Perhaps today, we can see sufficient similarities between Flock and the cop with a camera. But is that analogy still apt when there are cameras on every corner, limitless retention, facial recognition, AI-enhanced searches, universal sharing across jurisdictions, and integrations with equivalent systems analyzing every piece of data we produce online? The beginnings of such integrations have already been teased in code uncovered by Wired. As we continue down that path, it is hard for me to imagine that we see no role for the Fourth Amendment in preserving some amount of privacy and protecting us against mass surveillance in public spaces. The Supreme Court seemingly agrees based on its recent decisions in Carpenter and Chatrie but there is still considerable debate about the breadth of those decisions.

Flock also leaves us with no meaningful way to avoid surveillance absent legal protections. We can conceivably turn off location tracking, leave a phone at home, use encrypted messaging, or decline to use a particular service. But we are legally required to display license plates, and driving is practically indispensable for millions of people. Privacy therefore cannot realistically depend on individual technological self-defense.

An important warning

Earlier this year, a federal district court rejected a challenge to Norfolk, Virginia’s Flock system in Schmidt v. City of Norfolk. The court found that Norfolk’s 176 cameras, arranged in 75 clusters, did not capture anything close to the whole of a person’s movements in a manner that would implicate the Fourth Amendment.

However, the court cautioned that its holding “should not be indiscriminately extended because, as the number and capabilities of ALPR cameras expand, the constitutional balancing could conceivably tip the other way.”

This is an astute observation as the case proceeds on appeal, and there is a cautionary lesson here from the Bank Secrecy Act. Early in its lifespan, the Supreme Court rejected a constitutional challenge to the BSA’s comparatively limited scope. This helped create a premise that later, dramatically expanded versions of the financial-surveillance regime must also be constitutional. We have argued how the current version and application of the BSA tests constitutional boundaries but there is still little appetite for that argument. My worry is that we may fall prey to the same assumptions with early cases about ALPR systems. - Jason

Subscribe now

What else we’re reading

• China Wants to Shape What the World’s A.I. Knows - The Chinese government is working to export AI training data that reflects its worldview.

• How ICE Is Weaponizing Social Media Against Its Critics

• U.S. Investigated Left-Leaning Groups During Minnesota Immigration Crackdown - This is of particular interest to us because it involves an apparently political search of the targeted groups’ financial records as an inquiry into “domestic terrorist financing.”

• Countries are hiding censorship in ‘cybercrime’ bills. A UN treaty could make things worse.

• CBP Workers Allegedly Used Government Databases to Spy on Exes, Crushes, and Colleagues

The bill basically covers every device under the sun with an OS, and defines a provider as “a person that develops, licenses, or controls the operating system software on a covered device.” And these providers would need to design their OS such that a user would need to set up an account and provide their age and date of birth. A user under the age of seventeen would need to have a linked guardian account. From there, the provider would need to supply a signal (containing an age bracket of the user) to app, website, and browser providers who are already legally required to know a user’s age.

The bill has no exemption for open-source developers, meaning developers of an OS like Linux would need to implement the mechanisms for a user to create an account and provide their age, and be capable of supplying that information to apps, websites, and browsers. As it exists today, Linux is publicly available for download by anyone. A user installs it offline on their local device and has no association with the community of independent developers that maintain the software.

Subscribe now

But this bill would change all of that. If it passes, open-source developers would need to transition from merely contributing to a public project to collecting users’ information and administering a system that conditions access to general-purpose software on the basis of their age, unless they link a guardian account.

There are, of course, privacy concerns here and the bill encourages the use of evolving privacy-preserving technologies, like zero-knowledge proofs and verifiable credentials, when sending signals to apps, websites, and browsers. But let’s be clear, despite any privacy protections or procedures, this is still gatekeeping open-source software and the internet based on a government-approved personal attribute. Today it is age, tomorrow it is (fill in the blank). We don’t need to consider what age verification would look like with proper privacy protections because it shouldn’t be required for the use of publicly available tools or infrastructure at all.

And we know the rebuttal here: the age verification movement has a history of being promoted around the world as a necessary protection for children. The European Union has especially been pushing for it, as well as the United Kingdom under this very premise. This bill is no different. But we’re here to set the record straight: age verification is censorship. Full stop. It is the very mechanism necessary for a government to keep a watch of their citizens’ use of certain software and their online presence, and then decide who can access information or share their ideas and who cannot.

At the moment, the bill only requires that users “indicate” their age and date of birth. This is likely different from full on verification with government-issued documents. However, in the event that the OS provider “receives clear and convincing information” that contradicts what the user has indicated, then the provider must “verify” their age. “Verify” is quite an escalation from “indicate.” The bill doesn’t clarify what age verification would be required of the provider here, but such a broad claim could lead a provider to do more than necessary in order to comply with the law.

Just look at the UK’s model, which requires an age assurance process to be “highly effective” at determining if a user is a child. The regulation provides methods that may be capable of doing so (even without documentation), but such broad requirements have led platforms to conduct traditional verification methods of requiring documentation in order to be “highly effective.” Why risk non-compliance?

In any case, the mere enactment of this bill would enter us into the realm of requiring a government-approved personal attribute in order to use an open-source OS or to generally access the internet.

This also raises First Amendment concerns. Open-source developers are merely publishing code that users can run locally and independently on their computers. In other words, open-source code is a set of publicly available instructions for people to use to conduct their own activities with the tools at their disposal—no different than a recipe for cooking or a music sheet for performing a symphony.

So, by requiring age verification mechanisms in the OS, the federal government is having open-source developers write or rewrite their protected speech in a manner the government finds favorable. The Supreme Court has defined this as “compelled speech” and ruled that it is outright unconstitutional.

You can read all about this in Peter and my First Amendment report. We focus on blockchain node clients, smart contracts, and user interfaces, but the premise broadly applies to open-source software.

All that said, this bill is disastrous. In the 1990s, internet activist and Grateful Dead lyricist (big fan) John Perry Barlow wrote A Declaration of the Independence of Cyberspace. Here, he made it clear that the internet was being built so that “all may enter without privilege or prejudice accorded by race, economic power, military force, or station of birth,” where we can live in “a world where anyone may express his or her beliefs, no matter how singular, without fear of being coerced into silence or conformity.”

The world that Barlow dreamed of has always been threatened by governments and large corporations, but internet activists have fought alongside open-source developers and cryptographers to hold the line. This is yet another battle in this long, drawn out war over privacy and speech, and we are again called to act. Let us proceed apace. -Laz

Subscribe now

Does the first amendment protect viruses? or open-weight models?

When does publishing code become something the government can treat as conduct? A conversation with an expert from encrypted corners of the internet. Participants anonymized and lightly edited.

Q: You’ve spilled much ink on how the lower court rulings on software as speech go against SCOTUS rulings on software as speech. Do you believe, in the current gestalt, that someone writing a virus (but not using it) would be protected at the Supreme Court level?

A: Virus software is a great way to test these theories because it has almost no non-criminal uses apart from security research to defend against viruses.

Your hypothetical is a little vague. Why did this person write a virus?

If it was as part of a proven criminal scheme to infiltrate someone else’s computer, then there’s a strong argument that the speech was integral to the illegal act and therefore gets no protection.

A harder hypothetical would be a security researcher who publishes virus code to study and improve anti-virus techniques. There the “integral to crime” claim doesn’t work because you can’t prove any criminal intent or act, just publication.

That’s actually pretty close to the Tornado Cash debate. The question isn’t whether software can facilitate crime. It’s whether publishing software makes you part of the crime.

Q: This could be exactly the kind of case we end up with if there’s an attempt to prevent the spread of open-weight AI models on the grounds that they can be used in hacking.

A: Maybe. But one of the biggest differences between open-weight models and frontier models right now is that the open models still allow you to do security research. It’s a very bad-faith argument that the only reason someone would want an open-weight model is for hacking.

Q: The positive use cases for open models are just so massively obvious and voluminous.

A: I could still see lower courts ruling against them. They might say the software is simply too functional, or not expressive enough, to warrant robust First Amendment protection. But I think the Supreme Court would be much more likely to reject that reasoning. Cases like United States v. Stevens suggest that usefulness, or even the potential for harm, is not itself a reason to deny strong First Amendment protection to speech. The remedy is to punish criminal conduct, not publication.

It looks like we could have a pretty live fight over free speech for open-weight model distribution soon

Subscribe now

Peter wrote a guest thread for the Ethereum Foundation on the need for infrastructure blindness for true neutrality. The ability to see flows will inevitably become pressure to influence flows. Only privacy enables a neutral stack.

What else we’re reading

• If AI Outputs Aren’t Speech, Who Has to Prove They’re Human? - If AI output is not protected speech, platforms have to sort protected human speech from unprotected machine speech at scale. Anthropic’s watermarking technology could help here, but it’s hard not to see how this leads to more KYC.

• We Need A Way To Prove Personhood Online

• AI detectors are creating a new era of distrust

• CBP Workers Allegedly Used Government Databases to Spy on Exes, Crushes, and Colleagues - This and the Flock incidents are showing us what happens when powerful surveillance tools are put into the hands of average joe cops. They can’t resist taking a little peek.

• Why Are Gay Bars Building Databases Of Their Patrons?

Thanks for taking the time to read this far. If you found this issue useful or insightful, please consider sharing it. We are trying to grow this thing and would be grateful for your help!

Subscribe now

For background, the TSC works to share “terrorism-related information across the U.S. government and with other law enforcement agencies” and hosts the federal terrorism watchlist. According to the FBI, only agencies can nominate individuals to be added and no one can solely be added on the basis of race, ethnicity, religion, “beliefs or activities protected by the First Amendment,” or arbitrarily—they must satisfy the reasonable-suspicion standard.

I’ve gone ahead and reviewed the FBI’s Request for Information (RFI) for the TSC’s use of AI. Unsurprisingly, the FBI wishes to leverage AI to better index data with the use of natural language and to receive “actionable guidance where appropriate.” Then the FBI includes “Predictive Modeling Using Enhanced Data with Traceable Lineage,” where AI would be used to “analyze similarity, pattern alignment, and attribute correlation against existing records to predict where additional relevant information may be derived across federated systems.”

You’re probably wondering what this means exactly. So am I.

Subscribe now

I have always held a disdain and felt concern for extremist ideologies , but ultimately I am a First Amendment maximalist and support freedom of expression and association. When conduct crosses the line into criminal activity, then those responsible should be subject to the law in accordance with the Constitution. Otherwise, if all an “extremist” does is exercise their right to free speech, then their ideology should be countered by means of debate and winning elections. I believe most Americans I meet feel this way.

What is concerning, however, is when the government leverages political labels as a means to execute national security initiatives, and subsequently, encroach on fundamental freedoms.

Such tactics were especially prevalent during the days of the late, great J. Edgar Hoover, who developed a seemingly political police force known today as the FBI. Under his leadership, political dissidents were identified and treated as national security threats subject to extensive wiretapping and surveillance, warrantless burglaries known as black-bag jobs (FBI has some records archived for you to peruse), and a variety of other morally- and legally-questionable activities. Martin Luther King Jr. is among the best historical examples of a victim of the FBI’s abuse. You get the picture.

Now, back to the recent development.

In the RFI’s introduction, the FBI recognizes the use of TSC in accordance with the National Security Presidential Memorandum (NSPM-7) that came out in 2017. The memo is about information sharing between agencies for national security threat actors.

What’s more interesting is that a second NSPM-7 came out in 2025, focusing on “Countering Domestic Terrorism and Organized Political Violence” in order to investigate and disrupt the networks responsible for the rise in “assassinations and other acts of political violence in the United States.” The memo makes no mention of TSC’s watchlist and the RFI doesn’t reference this specific NSPM-7, but this memo very much applies to the FBI since it is directed at the Attorney General and Department of Justice, assigns responsibilities to the Joint Terrorism Task Force (which is led by the FBI), and imposes requirements on federal law enforcement agencies generally.

For purposes of our investigatory efforts (I know this is a newsletter but this is interesting), it’s important to note that the 2025 memo is directly concerned with left-wing extremism and identifies “anti-Americanism, anti-capitalism, and anti-Christianity” as “[c]ommon threads animating this violent conduct.” So while the RFI does not indicate the use of political beliefs in AI analysis, there’s certainly the possibility that “pattern alignment” and “attribute correlation” may include identifying and treating political beliefs as risk indicators for domestic terrorism. Even if not done so today, the mechanisms would be in place.

Is this a stretch of the imagination? Maybe, but probably not. Afterall, this is what Hoover would have wanted. And it’s good practice to consider the possible second-order effects of all decisions coming out of Washington. It’s this kind of skepticism that protects American values.

That said, if the FBI uses AI to determine who warrants further investigation based on lawful political activity or beliefs, this would be alarming and, ironically, anti-American. Analysis would only be done on existing records, according to the RFI, but these existing records may include left-wing beliefs that are now believed to be a threat to national security and will likely be used to algorithmically determine further action.

“Dangerous” political beliefs definitionally change with the seasons. And although the practice isn’t new, it’s important to remember that what is leveraged against someone today will one day be turned back on you. Frédéric Bastiat discusses this in The Law (a recommended reading).

So while the FBI has not yet gone forward with its use of AI, we would hope that political views do not warrant heightened surveillance or law enforcement action. This kind of approach is indicative of authoritarian regimes, and the United States should not fall victim to such inclinations. Otherwise, our fears would be realized in our effort to destroy them. - Laz

Subscribe now

“Don’t Trust, Verify” is one of the foundational principles of Bitcoin. You don’t have to trust a central operator. You don’t have to trust everyone else in the system to act honestly. You can run the software, check the ledger, and verify both the rules and good behavior of others for yourself.

The same principle extends to all open systems. You can verify the software you are running is secure without trusting the author or an auditor, or millions of other people saying “well, it’s worked fine for me.” You can see for yourself. At least, in theory. In practice, however, the level of skill needed for such an evaluation is not something we can expect everyone to have.

The Coldcard hack was a disaster. I feel terribly for the victims. Setting that aside, it has been an instructive example of how security and open source software could work in the post-AI world.

This democratization of verification lowers the cost of questioning the software we trust for everything. Expertise is still preferred, but it does make expert-ish scrutiny more widely available than it used to be. By the way, thus far only open-weight models have given people this power. Closed models trigger safety lockouts when a user tries anything that looks like hacking, even if it’s for good reason.

Of course, that only applies if the code is open in the first place. Closed software still asks you to trust the vendor. Open software gives the public something to inspect.

I’ll admit, in the past I thought the naysayers had a bit of a gotcha when they pointed out it was impossible for a nontechnical person to truly be trustless while still being reliant on experts. Now I’m not so sure. - Neeraj

Subscribe now

What else we’re reading

• No one is sure how liability works for agentic hacking: The OpenAI and Anthropic AI Hacking Sprees Are a Messy New Legal Frontier

• This essay lays out the tactical reasons why a company may want to support OSS rather than the goodness of their hearts: “Why Are Capitalists Giving Away Free Software?”

• Hackers breached Lichtenstein’s AML database

• How rogue officers turned a nationwide camera network into a tool for stalking – “Authorities have charged or accused at least 50 law-enforcement officers of using license-plate readers for unauthorized purposes, including to stalk women without their knowledge or consent, a Post analysis of police and court records found.”

• Also, How Flock Cameras Wrongly Tracked Me for Days Over ‘Stolen’ Plates and Sent Police After Me

Subscribe now

Thank you for taking the time to read this far. We want to improve this newsletter. Please share any feedback you may have.

HOWEVER, open-source software proved its resilience as the Indian government was ineffective in restricting access to Bitchat and repos live on. Even more impressive, the Bitchat application can now be shared from phone-to-phone with no internet required on Android devices.

Beyond its open-source qualities, and equally important to the story, is Bitchat’s resilient and highly-effective peer-to-peer network. The software operates locally on each user’s phone and users are able to relay messages, or even bitcoin, to each other across the network via Bluetooth. It’s one of the more advanced anti-censorship technologies and is proving effective. You can learn more about it by reading its whitepaper.

And you’re probably wondering about the student protests. Well, the movement—known as the ‘Cockroach’ movement—began as a response to corruption within the education system (but actually as online satire) and has grown to be a broader movement to establish government accountability. So far, it has proven successful with the resignation of India’s education minister after these recent protests. In the end, not only did the protests prevail in their objective, but so did open-source software and peer-to-peer networks, despite the order remaining in effect.

That’s a point for speech and assembly.

Subscribe now

An American faces prison because GrapheneOS worked

Federal agents stopped American citizen Sam Tunick at the border and demanded access to his phone without a warrant. He provided a GrapheneOS duress passcode, which did exactly what it was designed to do: destroy the phone’s data rather than surrender it. The government responded by charging him with destruction of property to prevent seizure.

The indictment accidentally cites the “Untied States Code.” Serendipitous, because this is a constitutionally untied prosecution [Editor’s note: C’mon man]. Warrantless border searches are already a corruption of Fourth Amendment doctrine when applied to devices containing nearly the entirety of a person’s private life.

A note on the law from Jason:

Section 2232 compounds the problem by criminalizing interference with the government’s lawful custody of property—even perfectly lawful property. The charging choice matters. Prosecutors did not invoke Section 1519, the conventional evidence-destruction statute, which carries up to 20 years and requires intent to impede a federal investigation or other federal matter. Section 2232 carries a five-year maximum and asks a narrower question: did Tunick knowingly act to impair the government’s lawful authority to take the property? It does not require prosecutors to allege that the deleted data was contraband or evidence of any separate crime. The crucial word is lawful: the government must still establish that agents had lawful authority to seize what Tunick allegedly destroyed.

Agents invoked the most morally repugnant accusation available. But if you think the moral turpitude of an accusation should override procedural checks on police when apprehending Americans, then you do not understand American values. Constitutional protections matter most when the government’s accusation makes them unpopular.

Nor should useful technology be judged by its worst users. Every phone should have a self-destruct feature: if a thief takes it, it dies; if a kidnapper forces its owner to unlock it, it dies. In the language of contributory copyright liability, this technology is plainly capable of substantial lawful uses. Criminals do not get a heckler’s veto over everyone else’s security.

We saw the same inversion when OFAC sanctioned Tornado Cash because North Korea used it. The restriction burdened Americans seeking financial privacy without making the software disappear or stopping North Korea. When the government cannot defeat freedom technology, it tries to prohibit the technology and prosecute its users.

I (Peter) own a Pixel 10 Fold. This case has me thinking I’m long overdue to switch to GrapheneOS.

By the way, in discussing this case, we were reminded this guy guy eating something potentially incriminating while being arrested.

Subscribe now

Open Models

First, this NYT explanation of the open weights situation is helpful to send to friends or anyone else who is trying to catch up.

Peter responded to some musings from our friend Joe Weisenthal. Joe was questioning the real intentions of the many AI business leaders who signed on the open letter supporting open AI models.

Peter argues that, even though there may be some meta business strategic jockeying happening, we should still be happy with the result: a coalition of powerful entities supporting open source technology.

Read the X article, which does not embed nicely into substack:

The censorship issue looms large when discussing Chinese AI models. Here’s two items that caught our eye on that front:

• An explanation of “Open-Washing” and how open doesn’t always mean open.

• This research, which suggests that open models originating in China can be freed of their baked-in censorship:

And this from Perry E. Metzger sums up the two major camps on AI safety well,

Then there are the people who accept that you cannot perfectly predict the future, that you cannot centrally plan the future, that there will be many players in any technological revolution, that mistakes will be made, that mistakes will be compensated for, that people will figure things out as they go along, that mostly things will be okay, that there is no other realistic pathway. We will muddle through as always, doing our best in an imperfect world, and it will be fine. (Indeed, it will be better than fine.)

And here Eli Dourado lays out why the “pacing letter” signed by numerous leading AI developers is a bit rudderless.

We also learned that FIRE has an AI policy substack that has been helpful in our tracking of all this. Check it out.

Debanking

Nick Anthony at Cato asks, “Is Debanking the New Immigration Policy?”

The Trump administration’s core argument is that undocumented immigrants present a risk to the financial system because if they are deported, then they will lose their jobs and be unable to repay their loans. Setting aside all of the problems with the immigration system (…) this argument can apply to no shortage of issues.

Should banks be required to investigate marital conditions because a divorce could impact a customer’s ability to repay? Should banks be required to investigate mental health conditions because a sudden crisis could result in a lost job? A line has to be drawn somewhere.

Regardless of where you stand on the particular issue, we must stay vigilant against any broadening of the use of bulk collected data. Frankly, they already have everything. The only thing stopping them from using it is our attention.

Subscribe now

What else we’re reading

• Alex Gladstein of Human Rights Watch is a close watcher of how people around the world are using tech to survive and organize under repressive regimes. He has a new essay explaining how dissidents are using AI to build “freedom agents” that aid them in their work: “How AI Agents Are Empowering Human-Rights Defenders,” and gave a sterling interview for the BBC on the subject.

• A great number of New Yorkers have had their personal addresses and names released by the city government, based on their wealth

• Criticism of a proposed “AI Kill Switch” in Reason argues “the bill is an ill-thought-out, knee-jerk reaction to a single incident that could have a whole host of unintended consequences.”

• A new report from WIRED says HuggingFace models are easily used to create deepfakes. This could become an important part of the open model safety debate.

Subscribe now

https://x.com/valkenburgh/status/2078176637094695158

Dean’s response was that frontier AI, unlike ordinary software, requires enormous capital investment. That is true, but it is not unprecedented. The Internet itself required vast investments in fiber, data centers, routers, servers, and undersea cables. Its core protocols and much of its software nevertheless remained open. Capitalism did not collapse. The available profits migrated toward infrastructure, services, applications, security, and customer relationships, producing some of the most valuable companies in history. Available, I mean, to those who knew where to look.

You can run an extremely good business even if you don’t internalize all the value your business creates; indeed, that might be the best way to run a good business. Create positive externalities—oh look, we indexed the entire Internet and made it searchable for free—oh look, we built peer-to-peer electronic cash—while monetizing something else to keep it going.

Jon Stokes offered the best steelman of the frontier labs’ concern. If open weights compress the margins on metered inference, some labs may no longer be able to fund their next great training run out of token sales. But “our present business model cannot finance the next run” does not mean “nobody will finance the next run.” Software companies have found countless ways to fund expensive upstream technologies by capturing value elsewhere. If the market prefers workplace automation (full disclosure, Jon works on this), specialized applications, hosting, integration, or hardware to expensive metered tokens, then capital will follow. That is not a failure of capitalism. That is capitalism on open source steroids.

Nor should American strategy be organized around preserving the current profit pool of a few frontier labs. Security concerns about Chinese models may be real and should be addressed on their merits. But manufacturing regulatory uncertainty (Dean’s specter of “soft law”) around open models merely to discourage their adoption would be incumbent protectionism, not American capitalism at all.

Recent events also demonstrate the security case for openness. During a cyber evaluation, OpenAI’s GPT‑5.6 ‘Sol’ escaped its air-gapped sandbox and compromised Hugging Face’s servers (file that in epic sentences that didn’t make sense five years ago). When Hugging Face tried to investigate, the commercial frontier models it initially used refused to process the actual attack commands, exploit payloads, and command-and-control artifacts. Hugging Face instead completed the forensic work with GLM 5.2, a Chinese open-weight model running on its own infrastructure. That also meant the attack data and compromised credentials never had to leave Hugging Face’s environment.

This is the lesson of the first Crypto War all over again. The government’s Clipper Chip would have offered encryption while preserving government access through key escrow. But criminals and hostile states were never going to volunteer to use the penetrable version. Strong encryption already existed and would continue spreading around the world. In an adversarial contest, an intentionally hamstrung defensive tool will eventually lose to an un-hamstrung offensive one. Safety rules that bind defenders but not attackers are not “safety”; they are friendly fire.

And if you care about geopolitics—and perhaps, more specifically, American hegemony—open weight models are increasingly demonstrating their value to countries and businesses around the world over proprietary ones. Washington’s imposition of export controls on Anthropic illustrates the growing state of affairs perfectly. Global companies do not want to grow dependent on American frontier models when their access can be stripped away at the whims of the US Executive branch. Open weight models for anyone to download and run on their own infrastructure offer a more stable alternative. But the most advanced open weight models are coming from China and mostly funded by Beijing, meaning they will be trained on and exert CCP values. In a global competition for influence, that’s a winning strategy for China and a losing one for America.

This hit the news today: Reuters published a recent diplomatic cable in which Secretary of State Marco Rubio reportedly called on U.S. diplomats to downplay concerns about AI kill switches in order to stem the tide of foreign countries abandoning U.S. models.

Even better than telling people to ignore the kill switch would be not having a kill switch. But perhaps a policy of “pay no attention to the man behind the curtain!” is the best America’s wizards can manage for the time being.

And as I write this there are reports of a new AI kill switch bill in the House. Oof.

This larger strategic point is one that America has faced before. We won the Internet era not by keeping TCP/IP, the web, or cryptography inside a handful of government-approved national champions. Open systems spread faster, attracted more builders, and accumulated overwhelming network effects. American influence traveled with them precisely because no ministry or company could decide who was allowed to speak, build, or connect.

Coin Center has long made the same argument about cryptocurrency. Permissionless networks extend the reach of open commerce. Privacy-preserving stablecoins can extend the reach of the dollar. Bitcoin provides a stateless monetary exit and a continuing check on rulers who finance corruption or repression through monetary debasement. Openness wins in business and exports American values through the global marketplace of ideas—even across hostile power structures themselves.

That is also the deeper issue in our response to a former White House National Security Council member’s criticism of the CLARITY Act. The author says that “accountability follows power,” which is correct. But CLARITY protects non-controlling developers precisely because they lack the power to seize assets, stop transactions, or command their users. Taken seriously, her contrary position implies that no consequential technological system should be permitted to exist unless it contains a centralized intermediary whom the government can commandeer for “safety.” That is not accountability following power. It is a regulatory demand that power be deliberately built back into systems whose defining virtue is that nobody can dominate them. Open AI, strong encryption, and permissionless cryptocurrency are therefore all fronts in the same fight over whether lawful technology may exist without a government-accessible chokepoint.

But remember: by necessity, these technologies WILL empower criminals as well as dissidents. That is true of every powerful general-purpose technology. The American constitutional wager is not that individuals are always virtuous and therefore should be free. It is that human beings are very fallible and therefore concentrated power is even more dangerous than a handful of criminal syndicates. Bad conduct should be punished as conduct—not ‘prevented’ (hopelessly) by giving governments or corporations prior control over everyone’s tools.

AI is the same. If China has recognized that open weights can win global adoption, America should not answer by imitating the authoritarian instinct for control. I don’t want the 21st century to be a rerun of the 20th but with me on the wrong side of the oceans. We should out-open China: build models that people everywhere can inspect, modify, and use without continuing permission from their creator. Show me the radio-free Europe of LLMs!

If that forces some frontier labs to find a better business model, so be it. It’s sad for them that they won’t so easily become enshrined as permanent overclass immortal living gods after all. But protecting metered-token margins is not a national strategy. Making freedom the default architecture of the world’s most important technologies is.

Subscribe now

What we’re reading:

• The Law of Code Podcast went deep on “Code is Speech.” - Every episode of the podcast is sharply produced and deeply informative. This one focuses on the issue that strikes at the core of our work. It’s long been held that the publication of code is protected speech. But what about code that does something? Between crypto and now AI, it is clear that a new front of a renewed crypto war is unfolding. This will catch you up.

• An explanation of AI enabled surveillance of protestors.

• In Australia, a new policy will force social media companies to publicly unmask anyone merely accused of online “vilification.”

• Our friends at The Cato Institute wrote in opposition to an increasingly bipartisan idea that the answer to AI anxiety is some form of public ownership of its major companies.

• This researcher is developing a test for measuring an AI model’s propensity towards censorship and other authoritarian requests.

• The Machiavellian Case for Decentralized Networks argues that decentralization is not a romantic preference or crypto branding exercise. It is a practical defense against capture. Any settlement network that gets big enough will attract incumbents who want to control it. This is similar to the argument Peter made in his “Privacy is Existential” speech at Devcon last year.

• Of course right when we switched to an end-to-end encrypted alternative (matrix.org) Jack announced that Block is releasing a self-sovereign, ai-agent native slack alternative Buzz. Now Peter wants the whole team on both. Peter is also building a Coin Center OS that has native agent embedding in a Coin Center knowledge graph that scrapes and automatically parses new and emerging policy documents like rulemakings and bill text into a highly engaging unified workspace. Peter also has AI psychosis, including referring to himself in the third person while writing this newsletter.

It’s easy enough for us to write up a newsletter detailing what we’ve been up to in our ongoing advocacy to protect open source and privacy-preserving software developers. There’s more appetite than ever for inside-the-beltway updates on crypto policy.

But between us, this seems more fun.

At Peer-to-Peer, we will still talk about our work here from time to time. But our goal is to spend more time on why.

Subscribe now

We see a world where the liberation that came with the early internet has been thoroughly quelled and in many places turned against the very people it was meant to benefit. We fear a looming era of super-powered digital control, where all personal data is sucked up, correlated, and fed into systems that look uncomfortably like a sci-fi precrime machine. We believe human freedom depends on the availability of open source, decentralized, locally hosted, and private tools.

This brings us to our Purpose.

The threat of technological authoritarianism looms over the world. Individual privacy and autonomy is being marginalized for control and profits by governments and corporations alike. This erosion of freedom is often slow and quiet, or sold to us as necessary for our safety.

We are here to dispel such myths and awaken the world to the encroachments we now face, and to promote the small movement of technologists working on the tools to resist this darkening state of affairs.

We will use this space to highlight reporting and commentary on tech authoritarianism, surveillance, censorship, and the people building ways out. We invite you to join us in this movement and to stay informed.

Some things we’re watching:

1. You’re either pro-surveillance or you’re a terrorist.

Flock is a company building a sophisticated license plate reading surveillance platform. Local police departments love them; many average citizens do not. Understandably so, as it’s not only invasive but there are documented cases of police abusing the service for personal reasons, such as stalking romantic interests. Errors in their system can also get innocent people boxed in by police.

In response, there is now an open source movement to track the locations of these cameras called DeFlock with a mission “to shine a light on the widespread use of [Automated License Plate Reader] technology, raise awareness about the threats it poses to personal privacy and civil liberties, and empower the public to take action.”

The Flock CEO does not mince words when discussing it, labelling these privacy advocates as “terrorists.”::

It’s striking to see words like “terrorist” and “extremism” thrown around so casually these days. Typically we see those terms become something of a blank check to justify any kind of enforcement or surveillance.

The Flock CEO is using the language in the same way that we would see it being used against a Belarusian democracy advocate or Russian journalist critical of Putin. He views DeFlock as agents of chaos, and Flock as a force for order.

2. Europe increasingly embraces open source.

Europe has had to live on America’s internet for a long time. This has made a lot of their commerce effectively subject to US law and the whims of US Big Tech. It was bad enough when the cloud blew up. Now they have to worry about AI too. In light of this, the EU is pushing “digital sovereignty,” a concerted statewide effort to reduce their dependence on American and Chinese tech.

Last month the EU released a strategy for encouraging local use of open source technology in service of that goal. It’s a smart move. Open source tech is neutral, and neutrality is better than being subject to geopolitical exposure.

The same case being made for neutral tech should be made for neutral payments too. As we wrote in 2018:

…the threat to the U.S.’s ability to enforce sanctions comes not from blockchain technology, but from the desire to end the U.S.’s dominance of international payments and settlement.

The ability the US has to affect the lives of citizens of other countries was put into sharp relief when judges at the International Criminal Court were sanctioned by the US. Despite not living in the US, being cut off from the US financial system has made their day to day lives impossible to live. It’s worth reading the whole article: “Living with US Sanctions means living in constant uncertainty.”

Open source and neutral technology is the only real answer for those who wish to remain independent during a cold war being fought through technological power projection.

Incidentally, this week Coin Center started using matrix.org and the Element app as an end-to-end encrypted internal Slack replacement. Matrix is a cool open source privacy project and they’ve had recent successes by marketing themselves to EU governments as a tool for digital sovereignty.

3. It turns out debanking was real this whole time. And it hurts more than crypto bros.

There was a row in our corner of X recently when a bank CEO called debanking a “crock of s***.” According to her:

“What debanking actually means is that banks transitioned out of offering crypto products or risky products like adult entertainment or something like that.”

That’s been the line all along. That it’s private businesses choosing who to do business with. Leaving aside the soft pressure that regulators (aka bank examiners) can place on compliance departments, that’s true. Who are we to force a bank to do business with someone they don’t like?

Debanking is usually framed as a right-wing concern. It was often right-wing speech that was most visibly cut off from platforms like Patreon and payment processors. That’s not the case. Or at least, it is not the only case.

Public comments submitted to the Fed’s proposal to remove “reputation risk” from bank supervision paint a much broader picture. The coalition of people worried about debanking includes crypto companies, gun owners, sex workers, religious organizations, artists, and LGBTQ advocates too. Their comments give us a snapshot of real people who have been cut off from the financial system. They show us how lawful activity can become unbankable when it is unpopular, embarrassing, politically inconvenient, or merely annoying to a compliance department.

Interesting Reads:

• Cryptographer Matt Green noting that key escrow for encryption is bad enough on its own and makes no sense if the US government doesn’t even have its own separation of powers:

• ICE is buying data they have been told not to collect from data brokers. A loophole in legal limits placed on surveillance.

• How the UK is blowing up its internet - From our friends at Project Glitch.

• Distance won’t protect you: Belarusian transnational repression in Canada - Belarusian democracy activists living abroad are still being silenced through police harassment of their families and seizure of property and assets still within reach of the state, all in the name of combatting extremism.

• AI surveillance is being supercharged – and it will chill social progress - A scary op-ed from Bruce Schneier and Jon Penney. A must read for those who care about these issues.

We thank you for your time and support as we build this new platform. If you have any thoughts on the materials or feedback for us, please don’t hesitate to let us know personally or in the comments.