The Trump administration has expanded financial surveillance at the southern border to target more than around 3.5 million people.

The heightened surveillance began in March 2025 with a geographic targeting order (or, GTO) issued by the Department of the Treasury. This temporary order lowered the threshold for currency transaction reports (CTRs) from $10,000 to just $200 for money service businesses like Western Union that operate in 30 zip codes along the border.

The surveillance order was quickly met with challenges in court by the Institute for Justice, and other organizations. And for a welcome change of pace, the courts agreed that something wasn’t adding up.

In Texas, the court described the $200 surveillance order as “unreasonable” because it “overreaches,” “defies common sense,” and “likely violates the Fourth Amendment.” The court issued an injunction to put the surveillance on ice until each side could make its case. A similar injunction was issued in California.

Yet, the Treasury had other plans. Instead of respecting the ongoing litigation, it issued a new order with a $1,000 threshold covering four times as many zip codes.

In the announcement of the new order, Financial Crimes Enforcement Network (FinCEN) Director Andrea Gacki said, “The reports generated by this Geographic Targeting Order will continue to help law enforcement investigate powerful illicit networks operating along the southwest border and beyond.” Yet strangely, when Gacki appeared before Congress just a few days later, she was unable to say how many criminals were caught because of this surveillance regime.

Instead, all we have been able to see is that small businesses have become trapped under hefty compliance burdens. And in a cruel twist of irony, the policy meant to catch criminals is likely pushing people into illegal markets.

One small business estimated that it would likely go from filing nine reports per week to filing 50,000 reports per week under the initial order. That is nothing short of an impossible standard to comply with. Another small business watched long lines of customers waiting to cash checks and send money to family dried up as customers became concerned about the new surveillance requirements.

Unfortunately, neither of the lack of results nor the impact on businesses has swayed the Treasury. In September 2026, the order was expanded again. What started in 30 zip codes was expanded to 304 zip codes. What started with a six-month limit has now gone on for nearly two years.

It didn’t matter to the government that there was a court case challenging the surveillance. It didn’t matter to the government that people were losing their businesses. Instead, all that seems to matter is the idea that the government should have unchecked access to our financial lives.

For the average person, it’s easy to write these concerns off. After all, this heightened surveillance regime is supposedly tucked away along the southern border. Yet, what’s happening in the south is only one piece of a vast financial surveillance system built under the Bank Secrecy Act for the past 56 years.

Banks are forced to verify your identity, report you for using more than $10,000 in cash, and report you for doing anything out of the norm. And for what? An estimated $59 billion a year is spent complying with the Bank Secrecy Act as banks file more than 28.7 million reports on customers to the government. Yet, the reports filed initiated only around 275 criminal investigations.

The Treasury should stop this heightened surveillance regime, and Congress should reform the laws that makes it possible. At the very least, geographic targeting orders should require a greater standard of evidence to justify their issuance. However, Congress should go further. It should repeal the Bank Secrecy Act and require law enforcement to get a warrant to go after financial records. Cashing a paycheck, sending money to family, or doing something out of the norm should not automatically put you on a government watchlist.

The people living in these communities should not have to prove their innocence to use financial services. Nor should small businesses have to choose between reporting their customers and closing their doors. It’s time to end unchecked surveillance, in all of its forms.

Subscribe now

What else we’re reading

• Our friends at the DeFi Education Fund have released new polling on financial privacy. Their survey finds 74% of Americans say financial privacy is important, and 60% fear data breaches at major financial institutions.

Hey, that last one is Nick again! Give him a follow.

If you found this interesting, please share and subscribe. It helps us grow.

Subscribe now

The video is about an IP trolling for legal extortion scheme, but also includes a surprising twist about Meta allegedly using illegally downloaded porn to train its models. I will look at the Muse guy differently from now on.

Thankfully the compelled revelation of IP addresses is more relevant to our work so I can focus on that today. The scheme works as follows:

Strike3 Holdings is an adult film company that owns many of the largest brands in the business. As the producer, it owns the rights to a huge number of adult videos. It monitors BitTorrent for sharing of its videos. When it identifies one being shared, it files a lawsuit against “John Doe” and has the court subpoena ISPs for the names and addresses associated with IP addresses that downloaded the file.

Now the company has someone’s name and a list of potentially embarrassing files associated with them. The company sues, and the person, often enough to make the enterprise profitable, chooses to settle out of court for fear of their private interests becoming public.

Judge Royce Lamberth didn’t mince words when calling the business extortionate:

Little wonder so many defendants settle. Indeed, the copyright troll‘s success rate comes not from the Copyright Act, but from the law of large numbers. According to PACER, over the past thirteen months, Strike 3 has filed 1849 cases just like this one in courts across the country—forty in this district alone—closely following the copyright trolls who together consumed 58% of the federal copyright docket in 2015. These serial litigants drop cases at the first sign of resistance, preying on low-hanging fruit and staying one step ahead of any coordinated defense. They don‘t seem to care about whether defendant actually did the infringing, or about developing the law.

There are a few issues here. For one thing, IP is an imperfect system for proving who exactly committed the alleged offense. A few months ago, Strike3 Holdings stunned a South Florida grandma by suing her for allegedly downloading 26 of their videos. As she puts it, “It certainly wasn’t me because I’ve never been on a pornographic site.” She has the confidence to go public with her story and fight. Many others do not.

This goes beyond adult content. When the Southern District of New York sought to establish jurisdiction in a case on alleged misconduct using the Ethereum blockchain, it reached for the same power.

Setting aside the absurdity of the claim that anyone running a validator for a blockchain in your district gives you jurisdiction over anyone using that blockchain anywhere in the world, a topic we will give the thorough treatment it deserves soon, the method is concerning. It’s an even deeper issue still: just how readily available these bulk IP collection and unmasking demands are.

Etherscan publicly shares a list of IP addresses associated with nodes.

Was SDNY able to subpoena Verizon to get real names and addresses of all customers running a node in its district? How will they use that data in the future? Are they securing it adequately?

I’m also struck by the fact that Strike3 Holding’s targets were at least supposedly doing something illegal to get unmasked. Node operators are not. Why were they revealed?

Even this story is marked by the imprecise nature of IP for identifying a person doing a particular activity. Dylan’s story begins with his roommate being identified as the one running the validator and being contacted by SDNY because he was the one who set up the account initially. I’m sure the roommate got scared by the scary email he received. Imagine if it was from Strike 3 Holdings.

This reminds me of a recent ransomware wave. The target would receive an email claiming that hackers had been able to access their webcam while they were on an adult site and threatened to release the footage. It was a bluff. But, as most of my friends’ go-to guy for crypto, I got a few panicked calls and messages from people I hadn’t heard from in ages. It was fake that time, but more recently malware that actually does use your webcam for this purpose has been discovered.

What Strike3 Holdings does is obviously much less extreme but it preys on the same fear–that our most intimate habits may become known. - Neeraj

What else we’re reading:

• This one is particularly interesting to us. We have covered GrapheneOS before.

Here’s what Peter had to say about that. Knowing now that the allegations were a ruse makes his point even more important:

Agents invoked the most morally repugnant accusation available. But if you think the moral turpitude of an accusation should override procedural checks on police when apprehending Americans, then you do not understand American values. Constitutional protections matter most when the government’s accusation makes them unpopular.

• China’s Free AI Models are Thrown Into Uncertainty - NYT

• FinCEN’s Financial Surveillance of Real Estate Transactions - Pacific Legal Foundation

If you found this interesting, please subscribe or share. It helps us grow.

Our ad based internet has resulted in a rich market for user data that has ultimately created a massive loophole in those 4th Amendment protections from undue government surveillance. The government can just buy our data on the open market. And the ease with which that loophole is exploited is only going to accelerate thanks to sophisticated AI sifting through all that sensitive information.

To be online is to accept that “our data” is out there. But we don’t really care. Who cares if the virtual beer app sends my location data home every time I want to wow a date?

Well, no one. But in the aggregate, the location of everyone who has ever dazzled their friends with a simulated beer becomes something more interesting. That’s a bundle of data showing the habits of a particular group of people. At some point the app’s creators, perhaps sensing the interest in virtual beers has peaked, decide they need to diversify their revenue streams. And that data, originally collected for in-app advertising, gets packaged up and sold.

One potential buyer is a Data Broker. Their business model relies on the accumulation of as much data on as many people as possible. They gather records from advertising exchanges, apps, retailers, credit bureaus, public filings, loyalty programs, websites, and even other brokers. They then connect those fragments using digital markers like cookies.

The result is much more valuable than the location of the beer app’s users. It’s a profile of a particular person: where they live, where they work, where they travel, their interests, and even who they spend time with. When a broker does not know something directly, they may still know enough to infer it. For the most part this type of aggregation and analysis is completely legal.

Those profiles are then sold to advertisers, compliance departments, insurance agencies, and increasingly, the government.

Usually when the government demands sensitive information from a company, it may require a court order. These orders can be broad but usually have limitations in scope and must invoke some legal authority. However, when a private company has already collected the data and is happy to sell it, then the government does not need a warrant. It is simply engaging in a typical commercial transaction in the open market.

When you consent to sharing your data, by quickly clicking “agree” to a Terms-of-Service, or even ignoring that cookie warning on every site, you are not just sharing your data with that site or even just its advertisers; you are sharing your data with everyone, even the government. And they have gotten a whole lot better at connecting those dots with AI.

Commercial databases can be correlated to create dossiers on people that go far further than anything the government could legally collect:

AI is also being used to rip data out of previously siloed or difficult to use sources for the purposes of building such tools. Like in this example:

We have written about this before as the death of practical obscurity:

In 1989 much of your life was already on file. It just wasn’t in any one file.

Your deed sat in one county’s recorder office. The lawsuit from your twenties sat in a courthouse two states away. Your voter registration, your divorce, the news blurb about you from a local paper — each was a public record, open to anyone willing to track it down. But tracking it down was riddled with hurdles. Putting a person together from those pieces meant travel across geography, navigating bureaucracies, paying clerks and investigators, and asking questions of people disinclined to answer. The cost of infringing on an ordinary person’s privacy was so high that, outside the famous and the suspected, it was rarely paid.

Government surveillance used to be limited by both the amount of work it took to track the movements of a single person and protections of the 4th amendment. AI completely eliminates that first part, and the robust market for the digital breadcrumbs AI can use makes it trivial to sidestep the second. The warrant has been replaced by an invoice.

The ability of AI to correlate our digital traces will require a broader reckoning in society. Now something as mundane as a Zillow picture leftover from when your house was previously listed for sale can be enough to pinpoint your address. Even if you don’t fear the government, the availability of such a granular database is terrifying in itself. If this company selling the service to law enforcement can build this, so can a criminal network.

There’s no way to undo the data we’ve already leaked. But this new threat should accelerate the adoption of privacy preserving tools to limit further damage. For a start, maybe we should all start blurring our zoom backgrounds. -Neeraj

Read more:

• Uncovering Webloc - An Analysis of Penlink’s Ad-based Geolocation Surveillance Tech

• FBI is buying location data to track US citizens, director confirms

• ATF cancels phone tracking contract after lawmakers raise concerns

• Wyden Releases Documents Confirming the NSA Buys Americans’ Internet Browsing Records

• American Dragnet: Data-Driven Deportation in the 21st Century

What else we’re reading:

If you found this interesting, please share and subscribe. It helps us grow.

Kahle advocated for a world in which “everyone’s a publisher” and not just centralized actors that dictate information distribution, which, as Kahle put it, “work extremely well with authoritarian governments.” For Kahle, these “middlemen layers” prevent people from owning and being paid for their work, and what we really need is a decentralized system that fosters “independence and control” over one’s own work—a sentiment widely shared by Internet activists, and especially those in crypto. “That’s the only way to make a free and open society work; otherwise, we end up with a kind of Soviet, centralized… controlled system and economy.”

But, like many of us, Kahle recognizes that technology is as liberating as it is oppressive. He explained how “public good AI” could be a good thing for societal matters, such as healthcare, education, and the environment. Kahle supports developing more tech-sovereignty for local populations by training LLMs on local values and interests, rather than just outsourcing to the US or China, or training LLMs on the commercial interests of a few large corporations.

When asked about “civilizational infrastructure,” Kahle expressed his support for “the freedom to build non-profit infrastructure” that is separate from the “top-down nature of government institutions”—like the Internet Archive, for example. These institutions would be able to move outside of the constraints of government, but are still for the public good.

He also suggested that capitalism is “another piece of civilizational infrastructure that we need.” That is, “buying and selling things; like having large numbers of small, competitive players.” Licensing and regulation regimes and the lack of ownership in our society, he explained, is much more like feudalism than what Adam Smith envisioned. “The idea that we can go and have commerce happen— small-scale, competitive commerce—I think is a great thing to have happen.” And as he concluded, “on the Internet, let’s try buying and selling files, let’s not just do this license garbage. It’s the only way, I think, we are going to make a decentralized world prosper.”

Lastly, Davila asked Kahle about his work to build a new kind of credit union after the 2008 financial crisis called the Internet Archive Federal Credit Union. The credit union was a member-owned, non-profit bank that provided underserved communities. Unfortunately, the National Credit Union Administration—a federal agency—created a lot of conflict and the members voted to liquidate it. As Kahle put it, it was “a diseased area that was controlled too much.”

Throughout the talk, Kahle pointed out something that, from my perspective, has placed power in the hands of the few and at the price of the people: big government. His solution was more explicit: capitalism fostered through “small-scale, competitive commerce.” But this solution can only be fostered where the government cannot pick winners and losers.

In the fallout of the 2008 financial crisis, as he pointed out, the US government bailed out the major banks that were engaging in risky investments while everyday Americans largely absorbed the costs. He saw many issues with the financial crisis and its aftermath, which led him to develop his credit union for the public good, but ultimately failed when the federal government stopped it, likely to protect banks’ interests—as Kahle suggested. Many may immediately diagnose the disease as capitalism—and I’m not here to say there aren’t costs to capitalism—but the common denominator in each of the issues he raised was ultimately government.

Capitalism can, of course, generate a concentration of goods and services, but the government ultimately determines whether that concentration becomes a protected, durable monopoly. His credit union presented a perfect case-study: large players leveraged the government to do their bidding, and it’s because they could. The government paved the perfect avenue for doing so.

Take the concern with AI and its monopolization of information as another example. Frontier models are only likely to succeed at controlling information-distribution if the government steps in to cement high barriers of entry for competitors. And the government is certainly incentivized to do so because concentration of information fosters more control. Open-models are our best option at combatting centralization and protecting our freedom, but they can only prosper where developers are not in constant fear of government prosecution. Some have argued that even open-models will need their training subsidized by the government to cover massive costs, risking “AI communism,” but as we’ve said before:

“Software companies have found countless ways to fund expensive upstream technologies by capturing value elsewhere. If the market prefers workplace automation…, specialized applications, hosting, integration, or hardware to expensive metered tokens, then capital will follow. That is not a failure of capitalism. That is capitalism on open source steroids.”

On the related matter of ownership on the Internet, Bitcoin presented a solution to the problem in 2008 and since 2009 has effectively illustrated what property rights look like in the Digital Age: cryptographically secured ownership on an immutable data structure computationally maintained by a decentralized network. A mouthful, but that’s because it’s a sophisticated technology that protects against the very problems of the traditional financial system and, well, government. But, like with open AI models, even those continuously maintaining the software necessary to operate and participate in the Bitcoin network need protection from adversarial governments:

“Open-source software has long empowered anyone in the world with the tools and knowledge necessary for self-sovereignty since the advent of the personal computer and the Internet as we know it. Anyone can access these tools, and often do as means for liberation and prosperity. Governments and corporations alike cannot stop open-source software itself from spreading, because like all other information, once it is made publicly-available, it can never be taken back. It goes from hand to hand, device to device; it is published on numerous websites and books. It longs to exist and spread.

This, however, does not make open-source software completely immune from censorship. While it itself is largely censorship-resistant, the publishers are not, and stopping open-source development only requires prosecuting those who develop it.”

Thus, we cannot let the government or corporations prevent us from having freedom, knowledge, and prosperity. And the best way to do so is by eliminating the means for anyone to play God; to pick winners and losers; to discriminate and oppress. If we allow the government to engineer social, political, and economic predetermined outcomes then we’ll be led like sheep straight into tyranny. -Laz

What else we’re reading

• From the internet to the streets: Resisting the violation of digital rights as a means of crushing protests in India - Association for Progressive Communications

• ICE Has Been Dumping Protester Photos Into a Palantir Supported Database - Wired

• The Authoritarian Future Is Already Here - A look at how an even deeper level of tech-authoritarianism that we’ve yet to see in America is being exported to countries like Uganda from China and Russia, and how it gives us a glimpse of what could happen here. - New York Times

• Every Country Has Its Own Internet Now - Politico

If you found this interesting, please share it. Your support helps us grow.

Share

This rhetoric obfuscates responsibility and fuels panic within the general public. When an AI agent breaks out of its sandbox and hacks an organization or government, the frontier labs speak of the incident as if they were not the ones who built and instructed the whole operation. And then what follows is a call for “AI safety,” or more specifically, regulations. Regulations that would conveniently benefit the incumbents and leave competitors—like those developing open-weight and open-source models—out. Open-models are looking more and more like the only meaningful option for the protection of sensitive data, or developing the kind of specific tuning needed for critical systems, and so following along would not only be foolish but it puts us on a path toward centrally controlled LLMs.

When I took Introduction to Applied Linear Algebra during my quick stint in pursuing a second bachelor’s degree (I didn’t finish), I would sometimes study by watching lectures from the professor who wrote the very textbook I was reading. I found this mathematician to be incredibly eloquent in his explanations, and among them was a suggestion—or perhaps a warning—to avoid thinking of machine learning as anything more than mathematics. These lectures were from 2020—well before the mass adoption of AI as we know it today, but a foreshadow of what the world would become

I will concede that perhaps AI thinks, but I do not agree that it understands anything. The Merriam-Webster definition for “think” is “to use the mind to process information, form ideas, reason, or hold an opinion.” To “understand” is “to grasp or know the meaning, intention, or nature of something.” I like these definitions and they’re largely held by the general public so I’m going to use them.

Simply put, AI is software that receives an input, runs it through some algorithms, and displays an output. It obviously “process[es] information” to form an output equating to “ideas [and] reason[ing],” and one could argue that it “hold[s] an opinion” because the weights and training are essentially meant to provide AI with its “view of the world” (for lack of a better phrase). Weights encode dispositions that influence how a model processes and conveys information.

However, AI doesn’t “know the meaning, intention, or nature of” that view or output. That would imply awareness, and math is not aware of itself. It’s just numbers placed into elegant puzzles to produce new numbers. These new numbers then instruct the movement of electricity such that a computer can do and say things. Sure, the human brain functions off electricity as well, but as it stands we are far from physically replicating consciousness, and we don’t know which physical processes do.

So, for now, AI is just a human-designed system of mathematics, electricity, and metal. We should be careful not to give AI personhood because it is not sentient and because anthropomorphizing it could lead to disastrous consequences.

If AI continues to be described with human characteristics, specifically by the ones building it, and those characterizations worm their way into policymaking, then we are likely to see misguided regulations in the near future. Open-weight and open-source models will be especially vulnerable, as governments around the world—and likely their constituents—will not want people freely downloading and running their own models locally.

When we anthropomorphize AI, it makes it easy for the public to support tight controls. Treating AI like a force of nature that can only be yoked, or a victim that can experience torture, makes the policy conversation deeply unserious. The same controls meant to prevent a “rogue” agent from hacking an unmaintained government database can also prevent the very tools necessary for cybersecurity in this new technological landscape. Instead, we’ll depend on trusted actors keeping a hand on the reins when we use the AI tools that are increasingly becoming extensions of ourselves.

Thus, it will be the incumbents and governments who win, and the people who lose. AI safety will take precedence over self-sovereignty; regulations over freedom; institutions over individuals. All because of a false understanding, or better yet, a bad-faith explanation of what is truly happening here.

I’ll conclude by saying that AI models are not humans; they are puppets who perform at the instruction of their masters. Let us not follow suit. -Laz

What else we’re reading:

If you found this interesting, we’d appreciate a subscription or share. It’s how we grow.

In 1989 much of your life was already on file. It just wasn’t in any one file.

Your deed sat in one county’s recorder office. The lawsuit from your twenties sat in a courthouse two states away. Your voter registration, your divorce, the news blurb about you from a local paper — each was a public record, open to anyone willing to track it down. But tracking it down was riddled with hurdles. Putting a person together from those pieces meant travel across geography, navigating bureaucracies, paying clerks and investigators, and asking questions of people disinclined to answer. The cost of infringing on an ordinary person’s privacy was so high that, outside the famous and the suspected, it was rarely paid.

Privacy was inherent in that cost. It wasn’t that your personal information was hidden and padlocked, but that reassembling it was prohibitively expensive. The Supreme Court even named this notion in 1989, in Department of Justice v. Reporters Committee, when journalists asked the FBI for the criminal record of a businessman tied to a corruption investigation. Much of his record was public but fragmented. The FBI refused to release its compiled version, and the Court agreed. Scattered across jurisdictions, the justices wrote, the information enjoyed a “practical obscurity.” Gathered into one file, it became something different, and the individual had a right to keep it that way. The facts were public. The compilation was not.

Practical obscurity never really entered the public discourse, though it describes the privacy most people experienced. Not secrecy. Not a right you had to assert. Just the reliable fact that analog data compilation was hardly ever worth the effort.

Notice, too, what practical obscurity asked of you: nothing. You never opted in. It covered the careful and the careless identically, because the burden of effort sat entirely with whoever wanted to know. Nearly every privacy protection built since inverts that concept. Cookie banners, privacy policies, opt-outs, broker removal requests — all exist only if you find and act on them, and they protect you precisely as far as you keep up. We replaced a protection that ran on its own with one that runs on your personal time and vigilance.

The first crack came with digitization. Records went online, and an industry grew up to compile them. By the mid-2000s anyone with twenty dollars could buy a profile from a people-search site, and Google would give you a rough one for free. But two obstacles remained. What twenty dollars bought was a pile — addresses, phone numbers, docket numbers — that took effort, judgment, and time to make legible. And the pile was thin: the old lawsuit, the local news item, the untagged photo on social media were still littered across sources most searches never reached.

AI erases these last vestiges of practical obscurity. A model with search tools reads the deed, the docket, the old news item, and the photographs. It returns not a pile but a biography: where you have lived and with whom, what you were sued over, what all of it seems to mean. It does this in minutes, even unattended, for anyone. The inversion is now complete: assembling you costs nothing, and staying unassembled is your job alone. The biography is also often partly wrong, which is its own harm — you cannot correct a file you never see.

The facts were always there. What changed is who can afford to assemble them. A few large institutions — agencies, insurers, data brokers — could always pay, and they did it quietly, out of sight, answerable to no one in particular. People tolerated that less because it was acceptable than because whoever held the file was a faceless entity, easy to wave away. AI makes those institutions more capable still. But the new thing is everyone else. What practical obscurity actually kept at bay was anyone with a personal reason to look — the landlord choosing between applicants, the ex you moved away from, the scammer who needs a convincing story — and it kept them at bay because looking was hard work. Now looking is so easy it’s no work at all.

This is not a case for going back to 1989, or for AI doomerism. Practical obscurity was an accident of bureaucracy and circumstance; it hid the slumlord from his tenants as readily as it hid you from a bad actor. AI simply removed a friction that happened to be doing an important job. That job — protecting people who do nothing to protect themselves — now needs an architecture of its own.

For the public record, the question is a legal one and for another essay. But a large share of our exposure is not the public record. It is the documents we are needlessly required to surrender whole — the license, the tax return, the passport — to prove a single fact. Here the answer is technical, and it deserves a name. Practical obscurity made your file expensive to assemble. Engineered obscurity makes it impossible to assemble, unless you decide otherwise.

To see what that means, start with the problem it solves. A convenience store scans your license — name, address, birthdate, document number — to learn that you are over twenty-one. New age-verification laws make websites do the same, and the websites keep a copy. A lender takes the full tax return to confirm that income clears a threshold. An exchange takes your passport to confirm you are not on a sanctions list. Each answers a yes-or-no question by surrendering the entire document. Why? Because we digitized the data but kept the analog procedures.

The procedures can change now. Thanks to cryptographic innovations, new data architectures are deployed, not proposed. Zero-knowledge payment systems have been doing this since 2016. An ordinary payment network keeps a permanent record of who you are, where you were, what you bought, and from whom — all to confirm one thing: that the money is real and has not already been spent. A zero-knowledge system automatically allows the payer to attach a proof of exactly that, and the network checks the proof and moves on, without storing vulnerable data on the sender, the recipient, or the amount. Identity is following. A mobile driver’s license can already release a signed “over 21” and nothing else, and it is live in Apple’s wallet for apps and websites; Google went a step further last year, shipping a proof that reveals no field at all — only that the signed birthdate clears the line — and handed to the Linux Foundation this month. Statistics have made the same turn. The 2020 Census published its tables with calibrated noise, so that no individual can be reconstructed from the counts, and a UN pilot now lets national statistics offices compute joint results across borders without any of them seeing another’s raw records. Finance is waiting on regulators, but the shape of the solution is the same in every case: confirmation without compilation. The question gets answered, the data never changes hands, and there is little left to assemble, steal, or sell.

The privacy check-box and the opt-out were never real substitutes for obscurity. They hand the file over, ask the recipient to promise, and leave the difficult work of self-protection to ordinary people, indefinitely. Privacy technology puts the burden back where practical obscurity kept it: on whoever wants to know. Whoever asks gets only what they actually need, and nothing more. The analog world gave us practical obscurity by accident. We can give ourselves engineered obscurity on purpose.

As we edited this, a relevant paper came out. Practical obscurity is dead:

For more on the potential zero-knowledge tech has to limit the sensitive data we leak just to use the internet, see this recent post from Peter.

Peer-To-Peer

The huge driver’s license hack was inevitable. It’s time to get mad.

The enormous driver’s license hack reported by KrebsOnSecurity is outrageous. A dark-market database claims more than 153 million license scans—including Pete Hegseth’s and Brian Krebs’s—were apparently siphoned from identity-verification middleman IDScan.net…

Read more

2 months ago · 8 likes · Peter Van Valkenburgh and Coin Center

What else we’re reading

If you found this interesting, please consider sharing and subscribing. It helps us grow.

We’re officially open to guest posts. Get in touch if you have something to say.

Share

This, however, does not make open-source software completely immune from censorship. While it itself is largely censorship-resistant, the publishers are not, and stopping open-source development only requires prosecuting those who develop it.

Take the developers of the privacy-preserving Tornado Cash protocol, for example. Treasury’s sanctions of the Tornado Cash smart contracts and the criminal prosecutions against Roman Storm and Roman Semenov in the U.S., and Alexey Pertsev in the Netherlands, did not at all stop use of the protocol. This is a testament of censorship-resistant technology, but also of its human-vulnerability. Since 2023, both Storm and Pertsev have been fighting for their freedom in the courts, and Semenov has likely left the U.S.

Tornado Cash is a tool for privacy and free speech, and yet the governments of so-called “liberal democracies” have aggressively targeted its developers. Technology alone cannot protect against adversarial governments—the technology may be censorship resistance, but criminal prosecution still exists in the physical world.

Law and politics matter. This is why the Coin Center and other crypto-advocates have fought for the Blockchain Regulatory Certainty Act in both the U.S. House and Senate for years now, attempting to provide protections against abuse of the U.S. criminal code against open-source developers. This is why Coin Center fellow Michael Lewellen is suing the DOJ to seek declarative judgement that persons developing and maintaining non-custodial open-source software is not criminal conduct. The inherent nature of open-source protects only the software, not the developer.

The AI industry is quickly coming to terms with this threat as frontier labs are pushing for government intervention to halt the development of AI in order to save all of humanity—despite continuing to rapidly develop their own AI models.

For some time now, frontier labs, such as OpenAI and Anthropic, have advocated for more government-intervention in the development and releasing of AI models. After six weeks on the job, an employee from Anthropic publicly resigned due to frontier labs’ alleged irresponsible development of AI and for “gambling with our lives,” sparking debate over the matter. Then, Dario Amodei and Sam Altman publicly supported the notion of government-intervention—which they have been doing for a long time.

But as most have probably thought to themselves, if these CEOs and employees truly believed what they said, why do they need the government to stop their development when they could simply stop themselves? A great question. Instead, frontier labs have been lobbying for regulations on AI models to halt development and architect a framework for safety reviews prior to deployment, all while rapidly developing their models. It’s hard not to assume regulatory capture is the goal here.

Supporters of open-source have taken notice.

Many have pointed out that even if OpenAI and Anthropic were to leverage regulations or a licensing regime to monopolize the market, open-source development would continue and people would still get their hands on open-source models. They’re mostly right that open-source would continue globally and people always find a way to acquire information despite censorship attempts, but they are wrong to call open-source “unstoppable” for the same reason that Lewellen is suing the DOJ: developers won’t write code if they fear criminal prosecution. And, like all other forms of technology, we need open-source for AI.

AI is increasingly empowering individuals the way the personal computer had for the last fifty years. With AI, information is distributed back to the user in almost a human-like way. People are able to converse and learn from AI the way they would be able to with their peers—except for the fact that it contains almost all the information in human existence. It is as if we made the Internet and all the libraries in the world into a person—with some refinements, of course—and gave it the ability to converse with us. Because of this, AI models are increasingly becoming people’s primary source for information, where they no longer search for things themselves but rely on AI models instead.

This means that those who develop these models will become the primary distributors of information, and therefore, of “truth.” Whether or not information distribution is centralized will largely depend on how the overall systems are designed and the regulatory regime surrounding them. Calls for regulations that rest deployment of these models on regulatory approval will surely centralize it. The government will essentially decide what information is allowed to be distributed and what is not, while incumbents monopolize the market and increase their influence. And we need only to look to history to understand why centralizing information distribution is dangerous. A central authority deciding which information we consume decides which ideas and movements spread; it dictates human progress.

Free speech primarily serves as a protection against this very reality. Diversity of thought has nourished our curiosity by exposing us to new ideas, enabling our creativity and driving the human race forward. Censorship replaces curiosity with conformity and eliminates challenging the status quo. Thus, centralizing the distributors of “truth” would be beneficial to the tyrant and detrimental to the individual, because freedom requires the ability to exchange information.

And this extends beyond just information distribution to surveillance as well. Like personal computers and cellphones, these AI models are no longer just tools for people to use, but almost extensions of the people that use them. Every thought, question, and worry will increasingly exist within these systems. Whether an AI model runs on a server belonging to a company, or locally on a person’s computer, will determine who has access and authority over this intimate information. The companies behind centralized AI models will get to decide what to do with a person’s information, and the government will surely want its hands on it.

Open-source software has long existed as a defense against censorship and surveillance, and the same holds true for AI. But it is only unstoppable once it is published, and governments and corporations will surely try and prevent that. The Tornado Cash prosecutions and subsequent Lewellen lawsuit offer us a glimpse of what is in store with AI if we simply ignore law and politics. They matter. -Laz

What else we’re reading

• This well-signed “The Pro-Human AI Declaration” petition includes troubling language for developers: Developers and deployers bear legal liability for defects, misrepresentation of capabilities, and inadequate safety controls, with statutes of limitation that account for harms emerging over time.

• Latham & Watkins buys Nvidia servers to set up in-house AI systems

That’s from 2017.

If you found this interesting, please consider subscribing and sharing. We are trying to grow this thing.

Subscribe now

The disagreement is over jurisdiction. Does the ICC have jurisdiction over non-member states, particularly the U.S. and Israel? The U.S. thinks no. The ICC argues it has jurisdiction if the alleged crimes occurred in territories that did sign the treaty, Afghanistan and Palestine.

Setting aside their actual dispute, the sanctions give us a unique opportunity to see American economic power in action. Typically when we think of sanctions we think of shadowy oligarchs and hidden terror groups. With these particular sanctions, we get to see what happens when a professionally established person living in a developed city is suddenly cut off from the U.S. financial/tech system.

The stories from those sanctioned paint a scary picture.

The effects were immediate yet remarkably mundane. Credit cards stopped working, including cards issued by banks outside the United States. European bank transfers were rejected or blocked. Peruvian judge Luz del Carmen Ibáñez Carranza had a card cancelled by her Dutch bank. “Why? It’s a European bank, not an American bank,” she told The Guardian. She blamed “a kind of over-compliance,” with foreign banks terrified of jeopardizing their relationships with U.S. institutions.

Then things got stranger. Canadian judge Kimberly Prost lost her Amazon account and came home to discover that Alexa would no longer respond to her. While traveling in New Zealand, her debit card failed when she tried to buy breakfast: “I wasn’t having breakfast that morning.” French judge Nicolas Guillou lost access to Amazon, Airbnb and PayPal, and even had a hotel reservation in France cancelled because he had booked it through Expedia. Slovenian judge Beti Hohler says a friend sent her a Christmas present through Amazon and subsequently had THEIR Amazon accounts suspended.

The effects could also spread to family members and other people who dealt with those sanctioned. A transfer from ICC prosecutor Karim Khan to his former wife for their children reportedly resulted in her bank account being frozen. Some officials lost access to email and other online services. Italian lawyer and UN Special Rapporteur Francesca Albanese says she has been unable to obtain ordinary banking services even in Europe and has resorted to cash and borrowing from friends and family. Her description of the experience gives this piece its title: “It equates to a civil death.”

The online world is intermediated. Those intermediaries are overwhelmingly dominated by U.S. companies, and most of the world follows our lead. The financial system is extremely risk averse. Both finance and tech are completely deferential in the name of compliance. Put those things together and sanctions are a magic order that can strike a person from the internet and banking completely.

No matter where you live in the world, even if you never touch dollars, if you do not take sovereignty into your own hands you are subject to the control of the current U.S. administration.

Seeing sanctions, a tool typically reserved for terrorists and rogue states, used in what would ordinarily be a wonkish international political debate must be striking to the rest of the world. It’s surely accelerating the European push for ‘digital sovereignty’ and the digital euro (which we analyzed from a privacy perspective last week). And perhaps is another talking point for Xi Jinping on his global tour promoting China as a stable partner amid US-led geopolitical uncertainty.

The recently sanctioned far-left hacker collective Autistici/Inventati (A/I) learned this. We covered those sanctions last week as well. Since then the story has developed. A/I was betting on its Italian bank defending Italian sovereignty by keeping their account open. Instead, their account was closed and funds seized.

When the sanctions were announced, I of course ran to their donation page to see they took crypto. They did not and have strong feelings as to why.

All this is to say, if you are doing anything that challenges the United States in any way, even if it’s just political activism or through the established processes of international law, you should consider reducing your reliance on compliance driven intermediaries. - Neeraj

You may remember that last week Peter “went off” about the leaking of 150 million ID documents.

Now it’s Laz’s turn, in a new op-ed for Coindesk:

Taking all this into account, why do we surrender our sensitive personal information if all we receive in return are false promises of security? Americans are not safer because they identify themselves in each waking moment to every service provider they come across. Far from it. And yet, governments at home and abroad wish to expand the identification regime even further with age verification under the guise of protecting children. But we are again witnessing that these “protections” cause more harm than good. Our information is out there, being traded amongst criminals because governments and corporations wanted to know who we were and what we were doing. And now we pay the price.

If there were ever a time for stronger privacy, it is right now. However, we cannot ignore nuance. There are calls for abolishing identification and verification processes entirely. This is an attractive alternative, but the reality is that the underlying purpose of anti-fraud processes is to protect Americans and their property, and they protect businesses’ revenue and operational integrity — the current approach is just unsuccessful. There is real utility here, but this does not mean that we need to remain with the status quo.

Read the full thing here: KYC data is an irresistible honeypot for hackers, and we must change how it is collected

Laz also “went off” on 404media’s reporting on a secretive predictive policing unit in DHS that apparently pulls in financial and other data to assess potential criminality.

And Neeraj threw in something too.

What else we’re reading

• Bitcoin’s Overlooked Promise: Freedom - An essay in the WSJ from our friend Alex Gladstein

• The ‘papers, please’ era of the internet will decimate your privacy

If you have something you would like to see discussed here, please let us know.

The surveillance capabilities of CBDCs have long been a concern, especially in Western Democracies that have increasingly taken an interest in techno-authoritarianism (whether they believe it or not). Cipollone, however, assured the interviewer that Europeans should not be concerned about financial surveillance with the digital euro since offline transaction details “will only be available to the payer and the payee.”

For online transactions, however, the Eurosystem (the monetary authority consisting of the ECB and the national central banks that have adopted the euro) would not be able to identify the parties involved, but “the banks involved in the transaction would be able to do so, including for anti-money laundering purposes.” Stated differently, the EU governments won’t be keeping a close eye on Europeans themselves, they’ll just have the banks do it for them and report back. So, not too different from the current more-or-less fully surveilled financial system.

These are two very different statements for the two modes of transactions that can occur with the digital euro (i.e., offline and online), so it would be good to better understand what’s actually going on, according to the ECB’s draft rulebook for a digital euro.

Cipollone states that transactions occurring offline are private and peer-to-peer (he doesn’t use that exact term but I’m contractually required to use it in our newsletter); whereas, online transactions would work the same as traditional digital payments, where an intermediary is involved but settlement would occur on one central infrastructure and not with various banks.

Online transactions go something like this:

• Alice wants to send money to Bob;

• Alice initiates the transaction through a payment service provider’s (PSP) application;

• The PSP authenticates her and validates/screens the transaction;

• Alice’s PSP sends the payment instruction to the Eurosystem’s Digital Euro Service Platform (DESP);

• DESP forwards it to Bob’s PSP for validation;

• After each PSP validates the transaction, DESP settles it and confirms settlement to both PSPs, which then notify Alice and Bob.

That last point is where Cipollone states that banks (i.e., PSPs) would identify parties involved in a transaction—that is, identify their respective customers. This is how the world currently works, so this is no surprise.

Offline transactions are more representative of peer-to-peer transactions (I get paid by the amount of times I say it), where a payer is able to send money to a payee between their devices without an intermediary, where transaction authentication happens locally on each participant’s device.

Here is how offline transactions work:

• Alice enters the transaction details into her application and the software in her device authenticates the details locally;

• The payer and payee tap their phones using near field communication (NFC), which allows two devices to exchange communications when they are near each other;

• The two applications authenticate each other; both devices validate the transaction (meaning the payer’s device ensures they have enough money and the payee’s device ensures that receiving the money would not exceed its offline holding limit or transaction-number limit);

• The balances then update locally;

• The payee confirms the settlement by sending confirmation back to the payer’s application. (Look to Annex B2, pages 222-224, for more details.)

But while the transaction itself is designed to be peer-to-peer when done offline (there’s my annual bonus), onboarding and device registration still requires user verification and identification with a PSP. The DESP is also informed of when euros are issued to a device and when they are redeemed. For example, Alice would go through the DESP to move €100 to her offline wallet; the DESP processes the transaction; and Alice’s device now has an offline balance of €100. The operation is processed through Alice’s PSP and DESP. And when Alice sends €80 to Bob, there is no involvement of a PSP nor DESP. However, if Bob then redeems the €80, he would have to do so online through a PSP and DESP.

Here is where things get tricky. These offline transactions are not entirely similar to cash transactions, because while the transaction can be done in a peer-to-peer manner, the registered devices are still subject to limits and periodically required to complete integrity checks with the DESP. Furthermore, as previously mentioned, there are offline holding limits that dictate how much a device can hold offline, meaning that a user’s device could reject a transaction if the user hits their limit. The device would also reject transactions if the user reaches a certain number of consecutive offline transactions.

All this in mind, the digital euro and its associated software would be best described as having mechanisms in place for peer-to-peer transactions, but also having mechanisms in place for centralized controls on transactions and checkpoints for user identification. Is this the kind of technology that would maximize privacy for users? Not quite. It allows for some privacy, but information leakage is very much prevalent. Nor is this the kind of technology that empowers Europeans with greater autonomy the way cash does. There are very strict limitations that exist at the discretion of EU authorities.

The digital euro remains in negotiations between the EU Commission, Parliament, and Council. Meanwhile, the ECB is currently developing a pilot and, as of mid-August, has requested participants for developing offline digital euro standards. The draftbook (that has acted as our point of reference) will continue evolving consistent with negotiations and technical developments.

This timeline has always seemed inevitable. Monetary policy and fiat currency have historically been useful instruments in domestic and foreign influence—nation states were not going to simply lie down while financial technology evolved towards peer-to-peer networks and (actual) user-controlled wallets. But we knew this, and so our fight continues towards privacy-preserving electronic cash that operates on open, decentralized blockchain networks.

-Laz

What else we’re reading

• Peter wrote a fiery blog about the recent ID leak. It’s become our most popular post yet. You should read it: The huge driver’s license hack was inevitable. It’s time to get mad.

• Roman Storm, a creator of Tornado Cash who has become the face of open source developers being held accountable for other people’s illicit use of his code, wrote a response as well: Privacy for Criminals, Ladies and Gentlemen

• How Terrorist Groups are Using Artificial Intelligence

• Lawsuit challenges Tether for allegedly freezing $42.4 million USDT before U.S. warrant - An interesting result of the debate over best practices for proactive stablecoin freezing.

• How KYC and AML are destroying the world

• Autistici/Inventati is furious at their Italian bank for caving by U.S. sanctions.

Thanks for reading. If you found this interesting, please share it. We are trying to grow this thing.

You should be mad.

We are long, long, long overdue to reduce the amount of KYC we do as a society. It doesn’t stop crime. It enables mass surveillance of the innocent by the tyrannical. And, perhaps most of all, it enriches hackers with troves of intimate personal data.

We deputize a sea of shitty quasi-government contractors to perform data collection and monitoring that would raise obvious constitutional alarms if the government did it directly. Then we act stunned when one is apparently run by negligent fools who fail to delete or secure the underlying driver’s-license photos they are verifying—photos belonging to people who aren’t even their customers, oh and it is literally HALF THE POPULATION OF AMERICA.

These types of hacks are only going to become more common as attackers weaponize AI to poke at honeypot verification systems. It’s even more absurd because we have the technology to do better: verifiable credentials and zero-knowledge proofs of limited identity data.

Risk-averse compliance departments and set-in-their-ways regulators prefer old practices and the appearance of rigorous compliance—box checking—to actually protecting people through data minimization and auditable, verifiable alternatives.

We explain the alternative in Tear Down This Walled Garden.

If you want this to change, get involved with our John Hancock Project and support Coin Center.

Image Source: https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/

That doesn’t mean the sanctions are inappropriate. But it means the designation sits somewhere close to both the constitutional and statutory limits of sanctions authority. Our First Amendment limits the government’s ability to punish speech. Similarly, the Berman Amendments to the International Emergency Economic Powers Act (IEEPA) deny the President authority to sanction transactions involving information and informational materials. But the A/I designation also alleges activities that may go beyond speech and information, and it is difficult to evaluate the legal significance of those facts until more details emerge.

We did some quick digging to see what we could find about Autistici/Inventati on the internet from before the designation was announced.

By all accounts, it is not a politically neutral hosting company. Since 2001, A/I has openly described itself as a radical-left collective providing email, web hosting, mailing lists, blogs, anonymity tools, and other communications infrastructure to groups broadly aligned with its anti-capitalist, antifascist, and anarchist politics. Nor does A/I appear to operate like a typical commercial hosting provider. A/I claimed to manually review requests for service based on the ideological aims of prospective users. After repeated encounters with European law enforcement, A/I also openly said they engineered their infrastructure to resist surveillance and minimize the identifying information they retain.

Still, choosing who you do business with on ideological grounds is not itself unlawful, and minimizing your exposure to customers’ data is not only legal, it is good technical and security practice.

The government’s August 26 fact sheet alleges that violent groups “relied on” A/I services to publish communiqués, claim responsibility for attacks, distribute manifestos, circulate maps, and share sabotage manuals. Much of that kind of activity is typically treated as speech in our constitutional tradition even when it is despicable. Much of those transactions sound, without further details, like transactions in “information or informational materials,” which the Berman Amendments to IEEPA remove from presidential sanctions authority.

You can see why the facts matter here. If A/I really was merely transacting in information and offered no particularized assistance to bad actors with an intent to further their bad schemes, then this designation would be questionable.

If, on the other hand, A/I administrators actively helped attackers choose targets, specifically configured systems for a known planned attack, provided bespoke assistance designed to evade law enforcement in connection with an attack, or otherwise participated in violent operations, the government has a substantially stronger case for sanctions and other enforcement.

It’s important to stay level headed. Some of the apparent users were not merely distasteful political radicals. The government identifies groups responsible for firebombings, rail sabotage, attacks on energy infrastructure, and other acts of political violence. But if, in our zeal to stop these people from committing further violent acts, we support a rule that effectively allows the President to censor and sanction mere speech and communications infrastructure, then we will have further cut down the precious protections our laws and Constitution provide.

There are some parallels to Tornado Cash, of course. Roman Storm’s prosecution is back in the news because the SDNY has now set an April 26, 2027 retrial on the two conspiracy charges, money laundering and sanctions violations, on which the jury deadlocked the first time around.

Additionally, Roman took to Twitter this week describing how he never ran a relayer for private transactions, while Chainalysis, as emerged in the court record, apparently did.

Unlike the Tornado Cash developers, and even the Tornado Cash token holders, relayers interacted directly with Tornado Cash users and charged a fee for doing so. That puts relayers much closer to the conduct side of a speech (protected) versus conduct (unprotected) distinction for First Amendment and Berman Amendment purposes. We argued this point extensively during the first trial in our amicus brief to the court. - Peter

Subscribe now

What else we’re reading

• U.S. Citizen Who Deleted Phone’s Data Says His Prosecution Puts Privacy at Risk - We discussed this case in a previous issue: “Every phone should have a self-destruct feature: if a thief takes it, it dies; if a kidnapper forces its owner to unlock it, it dies. In the language of contributory copyright liability, this technology is plainly capable of substantial lawful uses. Criminals do not get a heckler’s veto over everyone else’s security.”

• Bank Secrecy Act Crushes Small Businesses

• Flock has people thinking about privacy in a new light. It seems like we may have hit a tipping point. We are finally fed up with surveillance. Now let’s see if we can roll back some of the creeping expansions of the last few decades.

Thanks for reading. If there’s anything you’d like to see us discuss, please let us know.

Share

We know that our phones and apps generate extensive location data. We know there are cameras on most busy city corners. We know that social-media companies retain enormous amounts of personal data about our political leanings, the items we buy, and our browsing habits.

Privacy advocates have been sounding alarm bells about all of this for years, usually with little traction in the form of sustained public outcry.

So why has Flock touched such a nerve?

One possibility is that Flock is simply the culmination of incremental advances in privacy-piercing police technology that happened to catch a disgruntled public at the right time. But it seems more likely that there is something demonstrably creepier about Flock.

Subscribe now

A police officer sitting on the side of a public road can see your car, read your license plate, and write down the time you passed. Generally speaking, none of that is considered a Fourth Amendment “search.” You exposed the car and its legally required license plate to public view.

Flock takes that ordinary observation and transforms it into persistent, searchable, networked memory. Its cameras attempt to photograph every passing vehicle. The system reads plates and records other visible characteristics, including make, type, color, roof racks, bumper stickers, and other distinguishing features. Those observations are uploaded into a database that cops can search retrospectively and can connect easily with other information like criminal records and video sources. And this information is often shared across jurisdictions.

But the public reaction also seems driven by factors beyond just the capabilities of Flock.

The public is starting to realize that advances in AI and machine learning make it possible to analyze and correlate far more data than any human police department could realistically process on its own. We all reasonably expect that Flock data will eventually be fed into a machine that also includes data from sources like our cell phone location records, our payment data, and our browsing history, and that machine will come to conclusions about our potential criminal behavior.

The reaction may be different if we were confident that combining mass surveillance with AI would produce flawless policing, or even just policing free from the abuses already present in our system. But the public is being asked to trust that the technology will reliably identify the right person, and that the authorities wielding it will use it responsibly. When AI sold to us as the “future” is improperly labeling Kentucky on a map or inventing elements on the periodic table, and police armed with Flock identify the incorrect Dodge Durango involved in a murder investigation, skepticism about both sides of that trust equation is hardly surprising

Another potential factor in the public response is that Flock is not simply the outgrowth of police developing a new surveillance tool or adapting some ordinary consumer technology to an investigative purpose. It is a private company explicitly building surveillance infrastructure for police departments. In doing so, it inevitably plays a role in policy decisions about how the system operates: how long data is retained, who receives access, what training is required, which searches are permitted, and how agencies share information. Moreover, because Flock serves thousands of agencies, it can enable information sharing across jurisdictions in a way that seems to turn local police departments into participants in something resembling a quasi-national surveillance effort.

Which of these factors triggered the current reaction is hard to parse. But we have reached a moment when many people are saying that the government (with the assistance of a private company) has gone too far in prying into our everyday movements. And when that happens in the United States, the natural next question is whether some constitutional principle protects us from that overreach.

Fourth Amendment implications

My old law professor, Orin Kerr, recently raised the question of whether Flock cameras implicate a Fourth Amendment “search” such that some level of constitutional protection may apply.

Taking one picture of a publicly visible license plate is almost certainly not a search under existing law. But “using Flock” can describe several different government actions:

• Photographing and recording every passing vehicle.

• Retaining those observations in a database for future queries.

• Receiving a real-time alert about a vehicle on a hotlist.

• Searching the entire database for an unknown vehicle matching a description.

• Reconstructing movements using data from multiple jurisdictions.

Those actions may not all have the same constitutional answer.

I will save a comprehensive Fourth Amendment analysis for another post. But I am inclined to view ALPR networks differently from a cop photographing a car leaving a suspected drug deal or hit-and-run. I approach the question through the broader policy lens that I bring to much of my work: how do we create an environment that respects the same constitutional principles in the digital world that we have historically protected in the physical world?

Perhaps today, we can see sufficient similarities between Flock and the cop with a camera. But is that analogy still apt when there are cameras on every corner, limitless retention, facial recognition, AI-enhanced searches, universal sharing across jurisdictions, and integrations with equivalent systems analyzing every piece of data we produce online? The beginnings of such integrations have already been teased in code uncovered by Wired. As we continue down that path, it is hard for me to imagine that we see no role for the Fourth Amendment in preserving some amount of privacy and protecting us against mass surveillance in public spaces. The Supreme Court seemingly agrees based on its recent decisions in Carpenter and Chatrie but there is still considerable debate about the breadth of those decisions.

Flock also leaves us with no meaningful way to avoid surveillance absent legal protections. We can conceivably turn off location tracking, leave a phone at home, use encrypted messaging, or decline to use a particular service. But we are legally required to display license plates, and driving is practically indispensable for millions of people. Privacy therefore cannot realistically depend on individual technological self-defense.

An important warning

Earlier this year, a federal district court rejected a challenge to Norfolk, Virginia’s Flock system in Schmidt v. City of Norfolk. The court found that Norfolk’s 176 cameras, arranged in 75 clusters, did not capture anything close to the whole of a person’s movements in a manner that would implicate the Fourth Amendment.

However, the court cautioned that its holding “should not be indiscriminately extended because, as the number and capabilities of ALPR cameras expand, the constitutional balancing could conceivably tip the other way.”

This is an astute observation as the case proceeds on appeal, and there is a cautionary lesson here from the Bank Secrecy Act. Early in its lifespan, the Supreme Court rejected a constitutional challenge to the BSA’s comparatively limited scope. This helped create a premise that later, dramatically expanded versions of the financial-surveillance regime must also be constitutional. We have argued how the current version and application of the BSA tests constitutional boundaries but there is still little appetite for that argument. My worry is that we may fall prey to the same assumptions with early cases about ALPR systems. - Jason

Subscribe now

What else we’re reading

• China Wants to Shape What the World’s A.I. Knows - The Chinese government is working to export AI training data that reflects its worldview.

• How ICE Is Weaponizing Social Media Against Its Critics

• U.S. Investigated Left-Leaning Groups During Minnesota Immigration Crackdown - This is of particular interest to us because it involves an apparently political search of the targeted groups’ financial records as an inquiry into “domestic terrorist financing.”

• Countries are hiding censorship in ‘cybercrime’ bills. A UN treaty could make things worse.

• CBP Workers Allegedly Used Government Databases to Spy on Exes, Crushes, and Colleagues

The bill basically covers every device under the sun with an OS, and defines a provider as “a person that develops, licenses, or controls the operating system software on a covered device.” And these providers would need to design their OS such that a user would need to set up an account and provide their age and date of birth. A user under the age of seventeen would need to have a linked guardian account. From there, the provider would need to supply a signal (containing an age bracket of the user) to app, website, and browser providers who are already legally required to know a user’s age.

The bill has no exemption for open-source developers, meaning developers of an OS like Linux would need to implement the mechanisms for a user to create an account and provide their age, and be capable of supplying that information to apps, websites, and browsers. As it exists today, Linux is publicly available for download by anyone. A user installs it offline on their local device and has no association with the community of independent developers that maintain the software.

Subscribe now

But this bill would change all of that. If it passes, open-source developers would need to transition from merely contributing to a public project to collecting users’ information and administering a system that conditions access to general-purpose software on the basis of their age, unless they link a guardian account.

There are, of course, privacy concerns here and the bill encourages the use of evolving privacy-preserving technologies, like zero-knowledge proofs and verifiable credentials, when sending signals to apps, websites, and browsers. But let’s be clear, despite any privacy protections or procedures, this is still gatekeeping open-source software and the internet based on a government-approved personal attribute. Today it is age, tomorrow it is (fill in the blank). We don’t need to consider what age verification would look like with proper privacy protections because it shouldn’t be required for the use of publicly available tools or infrastructure at all.

And we know the rebuttal here: the age verification movement has a history of being promoted around the world as a necessary protection for children. The European Union has especially been pushing for it, as well as the United Kingdom under this very premise. This bill is no different. But we’re here to set the record straight: age verification is censorship. Full stop. It is the very mechanism necessary for a government to keep a watch of their citizens’ use of certain software and their online presence, and then decide who can access information or share their ideas and who cannot.

At the moment, the bill only requires that users “indicate” their age and date of birth. This is likely different from full on verification with government-issued documents. However, in the event that the OS provider “receives clear and convincing information” that contradicts what the user has indicated, then the provider must “verify” their age. “Verify” is quite an escalation from “indicate.” The bill doesn’t clarify what age verification would be required of the provider here, but such a broad claim could lead a provider to do more than necessary in order to comply with the law.

Just look at the UK’s model, which requires an age assurance process to be “highly effective” at determining if a user is a child. The regulation provides methods that may be capable of doing so (even without documentation), but such broad requirements have led platforms to conduct traditional verification methods of requiring documentation in order to be “highly effective.” Why risk non-compliance?

In any case, the mere enactment of this bill would enter us into the realm of requiring a government-approved personal attribute in order to use an open-source OS or to generally access the internet.

This also raises First Amendment concerns. Open-source developers are merely publishing code that users can run locally and independently on their computers. In other words, open-source code is a set of publicly available instructions for people to use to conduct their own activities with the tools at their disposal—no different than a recipe for cooking or a music sheet for performing a symphony.

So, by requiring age verification mechanisms in the OS, the federal government is having open-source developers write or rewrite their protected speech in a manner the government finds favorable. The Supreme Court has defined this as “compelled speech” and ruled that it is outright unconstitutional.

You can read all about this in Peter and my First Amendment report. We focus on blockchain node clients, smart contracts, and user interfaces, but the premise broadly applies to open-source software.

All that said, this bill is disastrous. In the 1990s, internet activist and Grateful Dead lyricist (big fan) John Perry Barlow wrote A Declaration of the Independence of Cyberspace. Here, he made it clear that the internet was being built so that “all may enter without privilege or prejudice accorded by race, economic power, military force, or station of birth,” where we can live in “a world where anyone may express his or her beliefs, no matter how singular, without fear of being coerced into silence or conformity.”

The world that Barlow dreamed of has always been threatened by governments and large corporations, but internet activists have fought alongside open-source developers and cryptographers to hold the line. This is yet another battle in this long, drawn out war over privacy and speech, and we are again called to act. Let us proceed apace. -Laz

Subscribe now

Does the first amendment protect viruses? or open-weight models?

When does publishing code become something the government can treat as conduct? A conversation with an expert from encrypted corners of the internet. Participants anonymized and lightly edited.

Q: You’ve spilled much ink on how the lower court rulings on software as speech go against SCOTUS rulings on software as speech. Do you believe, in the current gestalt, that someone writing a virus (but not using it) would be protected at the Supreme Court level?

A: Virus software is a great way to test these theories because it has almost no non-criminal uses apart from security research to defend against viruses.

Your hypothetical is a little vague. Why did this person write a virus?

If it was as part of a proven criminal scheme to infiltrate someone else’s computer, then there’s a strong argument that the speech was integral to the illegal act and therefore gets no protection.

A harder hypothetical would be a security researcher who publishes virus code to study and improve anti-virus techniques. There the “integral to crime” claim doesn’t work because you can’t prove any criminal intent or act, just publication.

That’s actually pretty close to the Tornado Cash debate. The question isn’t whether software can facilitate crime. It’s whether publishing software makes you part of the crime.

Q: This could be exactly the kind of case we end up with if there’s an attempt to prevent the spread of open-weight AI models on the grounds that they can be used in hacking.

A: Maybe. But one of the biggest differences between open-weight models and frontier models right now is that the open models still allow you to do security research. It’s a very bad-faith argument that the only reason someone would want an open-weight model is for hacking.

Q: The positive use cases for open models are just so massively obvious and voluminous.

A: I could still see lower courts ruling against them. They might say the software is simply too functional, or not expressive enough, to warrant robust First Amendment protection. But I think the Supreme Court would be much more likely to reject that reasoning. Cases like United States v. Stevens suggest that usefulness, or even the potential for harm, is not itself a reason to deny strong First Amendment protection to speech. The remedy is to punish criminal conduct, not publication.

It looks like we could have a pretty live fight over free speech for open-weight model distribution soon

Subscribe now

Peter wrote a guest thread for the Ethereum Foundation on the need for infrastructure blindness for true neutrality. The ability to see flows will inevitably become pressure to influence flows. Only privacy enables a neutral stack.

What else we’re reading

• If AI Outputs Aren’t Speech, Who Has to Prove They’re Human? - If AI output is not protected speech, platforms have to sort protected human speech from unprotected machine speech at scale. Anthropic’s watermarking technology could help here, but it’s hard not to see how this leads to more KYC.

• We Need A Way To Prove Personhood Online

• AI detectors are creating a new era of distrust

• CBP Workers Allegedly Used Government Databases to Spy on Exes, Crushes, and Colleagues - This and the Flock incidents are showing us what happens when powerful surveillance tools are put into the hands of average joe cops. They can’t resist taking a little peek.

• Why Are Gay Bars Building Databases Of Their Patrons?

Thanks for taking the time to read this far. If you found this issue useful or insightful, please consider sharing it. We are trying to grow this thing and would be grateful for your help!

Subscribe now

For background, the TSC works to share “terrorism-related information across the U.S. government and with other law enforcement agencies” and hosts the federal terrorism watchlist. According to the FBI, only agencies can nominate individuals to be added and no one can solely be added on the basis of race, ethnicity, religion, “beliefs or activities protected by the First Amendment,” or arbitrarily—they must satisfy the reasonable-suspicion standard.

I’ve gone ahead and reviewed the FBI’s Request for Information (RFI) for the TSC’s use of AI. Unsurprisingly, the FBI wishes to leverage AI to better index data with the use of natural language and to receive “actionable guidance where appropriate.” Then the FBI includes “Predictive Modeling Using Enhanced Data with Traceable Lineage,” where AI would be used to “analyze similarity, pattern alignment, and attribute correlation against existing records to predict where additional relevant information may be derived across federated systems.”

You’re probably wondering what this means exactly. So am I.

Subscribe now

I have always held a disdain and felt concern for extremist ideologies , but ultimately I am a First Amendment maximalist and support freedom of expression and association. When conduct crosses the line into criminal activity, then those responsible should be subject to the law in accordance with the Constitution. Otherwise, if all an “extremist” does is exercise their right to free speech, then their ideology should be countered by means of debate and winning elections. I believe most Americans I meet feel this way.

What is concerning, however, is when the government leverages political labels as a means to execute national security initiatives, and subsequently, encroach on fundamental freedoms.

Such tactics were especially prevalent during the days of the late, great J. Edgar Hoover, who developed a seemingly political police force known today as the FBI. Under his leadership, political dissidents were identified and treated as national security threats subject to extensive wiretapping and surveillance, warrantless burglaries known as black-bag jobs (FBI has some records archived for you to peruse), and a variety of other morally- and legally-questionable activities. Martin Luther King Jr. is among the best historical examples of a victim of the FBI’s abuse. You get the picture.

Now, back to the recent development.

In the RFI’s introduction, the FBI recognizes the use of TSC in accordance with the National Security Presidential Memorandum (NSPM-7) that came out in 2017. The memo is about information sharing between agencies for national security threat actors.

What’s more interesting is that a second NSPM-7 came out in 2025, focusing on “Countering Domestic Terrorism and Organized Political Violence” in order to investigate and disrupt the networks responsible for the rise in “assassinations and other acts of political violence in the United States.” The memo makes no mention of TSC’s watchlist and the RFI doesn’t reference this specific NSPM-7, but this memo very much applies to the FBI since it is directed at the Attorney General and Department of Justice, assigns responsibilities to the Joint Terrorism Task Force (which is led by the FBI), and imposes requirements on federal law enforcement agencies generally.

For purposes of our investigatory efforts (I know this is a newsletter but this is interesting), it’s important to note that the 2025 memo is directly concerned with left-wing extremism and identifies “anti-Americanism, anti-capitalism, and anti-Christianity” as “[c]ommon threads animating this violent conduct.” So while the RFI does not indicate the use of political beliefs in AI analysis, there’s certainly the possibility that “pattern alignment” and “attribute correlation” may include identifying and treating political beliefs as risk indicators for domestic terrorism. Even if not done so today, the mechanisms would be in place.

Is this a stretch of the imagination? Maybe, but probably not. Afterall, this is what Hoover would have wanted. And it’s good practice to consider the possible second-order effects of all decisions coming out of Washington. It’s this kind of skepticism that protects American values.

That said, if the FBI uses AI to determine who warrants further investigation based on lawful political activity or beliefs, this would be alarming and, ironically, anti-American. Analysis would only be done on existing records, according to the RFI, but these existing records may include left-wing beliefs that are now believed to be a threat to national security and will likely be used to algorithmically determine further action.

“Dangerous” political beliefs definitionally change with the seasons. And although the practice isn’t new, it’s important to remember that what is leveraged against someone today will one day be turned back on you. Frédéric Bastiat discusses this in The Law (a recommended reading).

So while the FBI has not yet gone forward with its use of AI, we would hope that political views do not warrant heightened surveillance or law enforcement action. This kind of approach is indicative of authoritarian regimes, and the United States should not fall victim to such inclinations. Otherwise, our fears would be realized in our effort to destroy them. - Laz

Subscribe now

“Don’t Trust, Verify” is one of the foundational principles of Bitcoin. You don’t have to trust a central operator. You don’t have to trust everyone else in the system to act honestly. You can run the software, check the ledger, and verify both the rules and good behavior of others for yourself.

The same principle extends to all open systems. You can verify the software you are running is secure without trusting the author or an auditor, or millions of other people saying “well, it’s worked fine for me.” You can see for yourself. At least, in theory. In practice, however, the level of skill needed for such an evaluation is not something we can expect everyone to have.

The Coldcard hack was a disaster. I feel terribly for the victims. Setting that aside, it has been an instructive example of how security and open source software could work in the post-AI world.

This democratization of verification lowers the cost of questioning the software we trust for everything. Expertise is still preferred, but it does make expert-ish scrutiny more widely available than it used to be. By the way, thus far only open-weight models have given people this power. Closed models trigger safety lockouts when a user tries anything that looks like hacking, even if it’s for good reason.

Of course, that only applies if the code is open in the first place. Closed software still asks you to trust the vendor. Open software gives the public something to inspect.

I’ll admit, in the past I thought the naysayers had a bit of a gotcha when they pointed out it was impossible for a nontechnical person to truly be trustless while still being reliant on experts. Now I’m not so sure. - Neeraj

Subscribe now

What else we’re reading

• No one is sure how liability works for agentic hacking: The OpenAI and Anthropic AI Hacking Sprees Are a Messy New Legal Frontier

• This essay lays out the tactical reasons why a company may want to support OSS rather than the goodness of their hearts: “Why Are Capitalists Giving Away Free Software?”

• Hackers breached Lichtenstein’s AML database

• How rogue officers turned a nationwide camera network into a tool for stalking – “Authorities have charged or accused at least 50 law-enforcement officers of using license-plate readers for unauthorized purposes, including to stalk women without their knowledge or consent, a Post analysis of police and court records found.”

• Also, How Flock Cameras Wrongly Tracked Me for Days Over ‘Stolen’ Plates and Sent Police After Me

Subscribe now

Thank you for taking the time to read this far. We want to improve this newsletter. Please share any feedback you may have.

HOWEVER, open-source software proved its resilience as the Indian government was ineffective in restricting access to Bitchat and repos live on. Even more impressive, the Bitchat application can now be shared from phone-to-phone with no internet required on Android devices.

Beyond its open-source qualities, and equally important to the story, is Bitchat’s resilient and highly-effective peer-to-peer network. The software operates locally on each user’s phone and users are able to relay messages, or even bitcoin, to each other across the network via Bluetooth. It’s one of the more advanced anti-censorship technologies and is proving effective. You can learn more about it by reading its whitepaper.

And you’re probably wondering about the student protests. Well, the movement—known as the ‘Cockroach’ movement—began as a response to corruption within the education system (but actually as online satire) and has grown to be a broader movement to establish government accountability. So far, it has proven successful with the resignation of India’s education minister after these recent protests. In the end, not only did the protests prevail in their objective, but so did open-source software and peer-to-peer networks, despite the order remaining in effect.

That’s a point for speech and assembly.

Subscribe now

An American faces prison because GrapheneOS worked

Federal agents stopped American citizen Sam Tunick at the border and demanded access to his phone without a warrant. He provided a GrapheneOS duress passcode, which did exactly what it was designed to do: destroy the phone’s data rather than surrender it. The government responded by charging him with destruction of property to prevent seizure.

The indictment accidentally cites the “Untied States Code.” Serendipitous, because this is a constitutionally untied prosecution [Editor’s note: C’mon man]. Warrantless border searches are already a corruption of Fourth Amendment doctrine when applied to devices containing nearly the entirety of a person’s private life.

A note on the law from Jason:

Section 2232 compounds the problem by criminalizing interference with the government’s lawful custody of property—even perfectly lawful property. The charging choice matters. Prosecutors did not invoke Section 1519, the conventional evidence-destruction statute, which carries up to 20 years and requires intent to impede a federal investigation or other federal matter. Section 2232 carries a five-year maximum and asks a narrower question: did Tunick knowingly act to impair the government’s lawful authority to take the property? It does not require prosecutors to allege that the deleted data was contraband or evidence of any separate crime. The crucial word is lawful: the government must still establish that agents had lawful authority to seize what Tunick allegedly destroyed.

Agents invoked the most morally repugnant accusation available. But if you think the moral turpitude of an accusation should override procedural checks on police when apprehending Americans, then you do not understand American values. Constitutional protections matter most when the government’s accusation makes them unpopular.

Nor should useful technology be judged by its worst users. Every phone should have a self-destruct feature: if a thief takes it, it dies; if a kidnapper forces its owner to unlock it, it dies. In the language of contributory copyright liability, this technology is plainly capable of substantial lawful uses. Criminals do not get a heckler’s veto over everyone else’s security.

We saw the same inversion when OFAC sanctioned Tornado Cash because North Korea used it. The restriction burdened Americans seeking financial privacy without making the software disappear or stopping North Korea. When the government cannot defeat freedom technology, it tries to prohibit the technology and prosecute its users.

I (Peter) own a Pixel 10 Fold. This case has me thinking I’m long overdue to switch to GrapheneOS.

By the way, in discussing this case, we were reminded this guy guy eating something potentially incriminating while being arrested.

Subscribe now

Open Models

First, this NYT explanation of the open weights situation is helpful to send to friends or anyone else who is trying to catch up.

Peter responded to some musings from our friend Joe Weisenthal. Joe was questioning the real intentions of the many AI business leaders who signed on the open letter supporting open AI models.

Peter argues that, even though there may be some meta business strategic jockeying happening, we should still be happy with the result: a coalition of powerful entities supporting open source technology.

Read the X article, which does not embed nicely into substack:

The censorship issue looms large when discussing Chinese AI models. Here’s two items that caught our eye on that front:

• An explanation of “Open-Washing” and how open doesn’t always mean open.

• This research, which suggests that open models originating in China can be freed of their baked-in censorship:

And this from Perry E. Metzger sums up the two major camps on AI safety well,

Then there are the people who accept that you cannot perfectly predict the future, that you cannot centrally plan the future, that there will be many players in any technological revolution, that mistakes will be made, that mistakes will be compensated for, that people will figure things out as they go along, that mostly things will be okay, that there is no other realistic pathway. We will muddle through as always, doing our best in an imperfect world, and it will be fine. (Indeed, it will be better than fine.)

And here Eli Dourado lays out why the “pacing letter” signed by numerous leading AI developers is a bit rudderless.

We also learned that FIRE has an AI policy substack that has been helpful in our tracking of all this. Check it out.

Debanking

Nick Anthony at Cato asks, “Is Debanking the New Immigration Policy?”

The Trump administration’s core argument is that undocumented immigrants present a risk to the financial system because if they are deported, then they will lose their jobs and be unable to repay their loans. Setting aside all of the problems with the immigration system (…) this argument can apply to no shortage of issues.

Should banks be required to investigate marital conditions because a divorce could impact a customer’s ability to repay? Should banks be required to investigate mental health conditions because a sudden crisis could result in a lost job? A line has to be drawn somewhere.

Regardless of where you stand on the particular issue, we must stay vigilant against any broadening of the use of bulk collected data. Frankly, they already have everything. The only thing stopping them from using it is our attention.

Subscribe now

What else we’re reading

• Alex Gladstein of Human Rights Watch is a close watcher of how people around the world are using tech to survive and organize under repressive regimes. He has a new essay explaining how dissidents are using AI to build “freedom agents” that aid them in their work: “How AI Agents Are Empowering Human-Rights Defenders,” and gave a sterling interview for the BBC on the subject.

• A great number of New Yorkers have had their personal addresses and names released by the city government, based on their wealth

• Criticism of a proposed “AI Kill Switch” in Reason argues “the bill is an ill-thought-out, knee-jerk reaction to a single incident that could have a whole host of unintended consequences.”

• A new report from WIRED says HuggingFace models are easily used to create deepfakes. This could become an important part of the open model safety debate.

Subscribe now

https://x.com/valkenburgh/status/2078176637094695158

Dean’s response was that frontier AI, unlike ordinary software, requires enormous capital investment. That is true, but it is not unprecedented. The Internet itself required vast investments in fiber, data centers, routers, servers, and undersea cables. Its core protocols and much of its software nevertheless remained open. Capitalism did not collapse. The available profits migrated toward infrastructure, services, applications, security, and customer relationships, producing some of the most valuable companies in history. Available, I mean, to those who knew where to look.

You can run an extremely good business even if you don’t internalize all the value your business creates; indeed, that might be the best way to run a good business. Create positive externalities—oh look, we indexed the entire Internet and made it searchable for free—oh look, we built peer-to-peer electronic cash—while monetizing something else to keep it going.

Jon Stokes offered the best steelman of the frontier labs’ concern. If open weights compress the margins on metered inference, some labs may no longer be able to fund their next great training run out of token sales. But “our present business model cannot finance the next run” does not mean “nobody will finance the next run.” Software companies have found countless ways to fund expensive upstream technologies by capturing value elsewhere. If the market prefers workplace automation (full disclosure, Jon works on this), specialized applications, hosting, integration, or hardware to expensive metered tokens, then capital will follow. That is not a failure of capitalism. That is capitalism on open source steroids.

Nor should American strategy be organized around preserving the current profit pool of a few frontier labs. Security concerns about Chinese models may be real and should be addressed on their merits. But manufacturing regulatory uncertainty (Dean’s specter of “soft law”) around open models merely to discourage their adoption would be incumbent protectionism, not American capitalism at all.

Recent events also demonstrate the security case for openness. During a cyber evaluation, OpenAI’s GPT‑5.6 ‘Sol’ escaped its air-gapped sandbox and compromised Hugging Face’s servers (file that in epic sentences that didn’t make sense five years ago). When Hugging Face tried to investigate, the commercial frontier models it initially used refused to process the actual attack commands, exploit payloads, and command-and-control artifacts. Hugging Face instead completed the forensic work with GLM 5.2, a Chinese open-weight model running on its own infrastructure. That also meant the attack data and compromised credentials never had to leave Hugging Face’s environment.

This is the lesson of the first Crypto War all over again. The government’s Clipper Chip would have offered encryption while preserving government access through key escrow. But criminals and hostile states were never going to volunteer to use the penetrable version. Strong encryption already existed and would continue spreading around the world. In an adversarial contest, an intentionally hamstrung defensive tool will eventually lose to an un-hamstrung offensive one. Safety rules that bind defenders but not attackers are not “safety”; they are friendly fire.

And if you care about geopolitics—and perhaps, more specifically, American hegemony—open weight models are increasingly demonstrating their value to countries and businesses around the world over proprietary ones. Washington’s imposition of export controls on Anthropic illustrates the growing state of affairs perfectly. Global companies do not want to grow dependent on American frontier models when their access can be stripped away at the whims of the US Executive branch. Open weight models for anyone to download and run on their own infrastructure offer a more stable alternative. But the most advanced open weight models are coming from China and mostly funded by Beijing, meaning they will be trained on and exert CCP values. In a global competition for influence, that’s a winning strategy for China and a losing one for America.

This hit the news today: Reuters published a recent diplomatic cable in which Secretary of State Marco Rubio reportedly called on U.S. diplomats to downplay concerns about AI kill switches in order to stem the tide of foreign countries abandoning U.S. models.

Even better than telling people to ignore the kill switch would be not having a kill switch. But perhaps a policy of “pay no attention to the man behind the curtain!” is the best America’s wizards can manage for the time being.

And as I write this there are reports of a new AI kill switch bill in the House. Oof.

This larger strategic point is one that America has faced before. We won the Internet era not by keeping TCP/IP, the web, or cryptography inside a handful of government-approved national champions. Open systems spread faster, attracted more builders, and accumulated overwhelming network effects. American influence traveled with them precisely because no ministry or company could decide who was allowed to speak, build, or connect.

Coin Center has long made the same argument about cryptocurrency. Permissionless networks extend the reach of open commerce. Privacy-preserving stablecoins can extend the reach of the dollar. Bitcoin provides a stateless monetary exit and a continuing check on rulers who finance corruption or repression through monetary debasement. Openness wins in business and exports American values through the global marketplace of ideas—even across hostile power structures themselves.

That is also the deeper issue in our response to a former White House National Security Council member’s criticism of the CLARITY Act. The author says that “accountability follows power,” which is correct. But CLARITY protects non-controlling developers precisely because they lack the power to seize assets, stop transactions, or command their users. Taken seriously, her contrary position implies that no consequential technological system should be permitted to exist unless it contains a centralized intermediary whom the government can commandeer for “safety.” That is not accountability following power. It is a regulatory demand that power be deliberately built back into systems whose defining virtue is that nobody can dominate them. Open AI, strong encryption, and permissionless cryptocurrency are therefore all fronts in the same fight over whether lawful technology may exist without a government-accessible chokepoint.

But remember: by necessity, these technologies WILL empower criminals as well as dissidents. That is true of every powerful general-purpose technology. The American constitutional wager is not that individuals are always virtuous and therefore should be free. It is that human beings are very fallible and therefore concentrated power is even more dangerous than a handful of criminal syndicates. Bad conduct should be punished as conduct—not ‘prevented’ (hopelessly) by giving governments or corporations prior control over everyone’s tools.

AI is the same. If China has recognized that open weights can win global adoption, America should not answer by imitating the authoritarian instinct for control. I don’t want the 21st century to be a rerun of the 20th but with me on the wrong side of the oceans. We should out-open China: build models that people everywhere can inspect, modify, and use without continuing permission from their creator. Show me the radio-free Europe of LLMs!

If that forces some frontier labs to find a better business model, so be it. It’s sad for them that they won’t so easily become enshrined as permanent overclass immortal living gods after all. But protecting metered-token margins is not a national strategy. Making freedom the default architecture of the world’s most important technologies is.

Subscribe now

What we’re reading:

• The Law of Code Podcast went deep on “Code is Speech.” - Every episode of the podcast is sharply produced and deeply informative. This one focuses on the issue that strikes at the core of our work. It’s long been held that the publication of code is protected speech. But what about code that does something? Between crypto and now AI, it is clear that a new front of a renewed crypto war is unfolding. This will catch you up.

• An explanation of AI enabled surveillance of protestors.

• In Australia, a new policy will force social media companies to publicly unmask anyone merely accused of online “vilification.”

• Our friends at The Cato Institute wrote in opposition to an increasingly bipartisan idea that the answer to AI anxiety is some form of public ownership of its major companies.

• This researcher is developing a test for measuring an AI model’s propensity towards censorship and other authoritarian requests.

• The Machiavellian Case for Decentralized Networks argues that decentralization is not a romantic preference or crypto branding exercise. It is a practical defense against capture. Any settlement network that gets big enough will attract incumbents who want to control it. This is similar to the argument Peter made in his “Privacy is Existential” speech at Devcon last year.

• Of course right when we switched to an end-to-end encrypted alternative (matrix.org) Jack announced that Block is releasing a self-sovereign, ai-agent native slack alternative Buzz. Now Peter wants the whole team on both. Peter is also building a Coin Center OS that has native agent embedding in a Coin Center knowledge graph that scrapes and automatically parses new and emerging policy documents like rulemakings and bill text into a highly engaging unified workspace. Peter also has AI psychosis, including referring to himself in the third person while writing this newsletter.

It’s easy enough for us to write up a newsletter detailing what we’ve been up to in our ongoing advocacy to protect open source and privacy-preserving software developers. There’s more appetite than ever for inside-the-beltway updates on crypto policy.

But between us, this seems more fun.

At Peer-to-Peer, we will still talk about our work here from time to time. But our goal is to spend more time on why.

Subscribe now

We see a world where the liberation that came with the early internet has been thoroughly quelled and in many places turned against the very people it was meant to benefit. We fear a looming era of super-powered digital control, where all personal data is sucked up, correlated, and fed into systems that look uncomfortably like a sci-fi precrime machine. We believe human freedom depends on the availability of open source, decentralized, locally hosted, and private tools.

This brings us to our Purpose.

The threat of technological authoritarianism looms over the world. Individual privacy and autonomy is being marginalized for control and profits by governments and corporations alike. This erosion of freedom is often slow and quiet, or sold to us as necessary for our safety.

We are here to dispel such myths and awaken the world to the encroachments we now face, and to promote the small movement of technologists working on the tools to resist this darkening state of affairs.

We will use this space to highlight reporting and commentary on tech authoritarianism, surveillance, censorship, and the people building ways out. We invite you to join us in this movement and to stay informed.

Some things we’re watching:

1. You’re either pro-surveillance or you’re a terrorist.

Flock is a company building a sophisticated license plate reading surveillance platform. Local police departments love them; many average citizens do not. Understandably so, as it’s not only invasive but there are documented cases of police abusing the service for personal reasons, such as stalking romantic interests. Errors in their system can also get innocent people boxed in by police.

In response, there is now an open source movement to track the locations of these cameras called DeFlock with a mission “to shine a light on the widespread use of [Automated License Plate Reader] technology, raise awareness about the threats it poses to personal privacy and civil liberties, and empower the public to take action.”

The Flock CEO does not mince words when discussing it, labelling these privacy advocates as “terrorists.”::

It’s striking to see words like “terrorist” and “extremism” thrown around so casually these days. Typically we see those terms become something of a blank check to justify any kind of enforcement or surveillance.

The Flock CEO is using the language in the same way that we would see it being used against a Belarusian democracy advocate or Russian journalist critical of Putin. He views DeFlock as agents of chaos, and Flock as a force for order.

2. Europe increasingly embraces open source.

Europe has had to live on America’s internet for a long time. This has made a lot of their commerce effectively subject to US law and the whims of US Big Tech. It was bad enough when the cloud blew up. Now they have to worry about AI too. In light of this, the EU is pushing “digital sovereignty,” a concerted statewide effort to reduce their dependence on American and Chinese tech.

Last month the EU released a strategy for encouraging local use of open source technology in service of that goal. It’s a smart move. Open source tech is neutral, and neutrality is better than being subject to geopolitical exposure.

The same case being made for neutral tech should be made for neutral payments too. As we wrote in 2018:

…the threat to the U.S.’s ability to enforce sanctions comes not from blockchain technology, but from the desire to end the U.S.’s dominance of international payments and settlement.

The ability the US has to affect the lives of citizens of other countries was put into sharp relief when judges at the International Criminal Court were sanctioned by the US. Despite not living in the US, being cut off from the US financial system has made their day to day lives impossible to live. It’s worth reading the whole article: “Living with US Sanctions means living in constant uncertainty.”

Open source and neutral technology is the only real answer for those who wish to remain independent during a cold war being fought through technological power projection.

Incidentally, this week Coin Center started using matrix.org and the Element app as an end-to-end encrypted internal Slack replacement. Matrix is a cool open source privacy project and they’ve had recent successes by marketing themselves to EU governments as a tool for digital sovereignty.

3. It turns out debanking was real this whole time. And it hurts more than crypto bros.

There was a row in our corner of X recently when a bank CEO called debanking a “crock of s***.” According to her:

“What debanking actually means is that banks transitioned out of offering crypto products or risky products like adult entertainment or something like that.”

That’s been the line all along. That it’s private businesses choosing who to do business with. Leaving aside the soft pressure that regulators (aka bank examiners) can place on compliance departments, that’s true. Who are we to force a bank to do business with someone they don’t like?

Debanking is usually framed as a right-wing concern. It was often right-wing speech that was most visibly cut off from platforms like Patreon and payment processors. That’s not the case. Or at least, it is not the only case.

Public comments submitted to the Fed’s proposal to remove “reputation risk” from bank supervision paint a much broader picture. The coalition of people worried about debanking includes crypto companies, gun owners, sex workers, religious organizations, artists, and LGBTQ advocates too. Their comments give us a snapshot of real people who have been cut off from the financial system. They show us how lawful activity can become unbankable when it is unpopular, embarrassing, politically inconvenient, or merely annoying to a compliance department.

Interesting Reads:

• Cryptographer Matt Green noting that key escrow for encryption is bad enough on its own and makes no sense if the US government doesn’t even have its own separation of powers:

• ICE is buying data they have been told not to collect from data brokers. A loophole in legal limits placed on surveillance.

• How the UK is blowing up its internet - From our friends at Project Glitch.

• Distance won’t protect you: Belarusian transnational repression in Canada - Belarusian democracy activists living abroad are still being silenced through police harassment of their families and seizure of property and assets still within reach of the state, all in the name of combatting extremism.

• AI surveillance is being supercharged – and it will chill social progress - A scary op-ed from Bruce Schneier and Jon Penney. A must read for those who care about these issues.

We thank you for your time and support as we build this new platform. If you have any thoughts on the materials or feedback for us, please don’t hesitate to let us know personally or in the comments.