YunoBlog

Author: tio

  • Young Americans Aren’t Buying Old Narratives on China

    Young Americans Aren’t Buying Old Narratives on China

    Call it what you want. Post-America. The American Century of Humiliation. The decline of the Burger Reich. However you slice it, the United States’ de facto role as the global hegemon is waning. The wheel of disillusionment turns, and reasons for Americans to grow tired become redundant: dire economic conditions for working people; the cringe-ification of the government apparatus through DOGE; civilians shot in the street by ICE agents; militarized police; towns driven to madness by the hum of AI data centers; the U.S.-Israeli strikes on Iran; President Donald Trump’s links to convicted sex offender Jeffrey Epstein; the disappearance of immigrants at home; and a direct hand in the Gaza genocide abroad, to name just a few. Who, then, could blame American youth for looking at how other countries govern?

  • Pluralistic: Blowtorching the frog (05 Mar 2026) executive-dysfunction

    Today’s links

    • Blowtorching the frog: If I must have enemies, let them be impatient ones.
    • Hey look at this: Delights to delectate.
    • Object permanence: Bill Cosby v Waxy; Rodney King, 20 years on; Peter Watts v flesh-eating bacteria; American authoritarianism; Algebra II v Statistics for Citizenship; Ideas lying around; Banksy x Russian graffists; TSA v hand luggage; Hack your Sodastream; There were always enshittifiers.
    • Upcoming appearances: Where to find me.
    • Recent appearances: Where I’ve been.
    • Latest books: You keep readin’ em, I’ll keep writin’ ’em.
    • Upcoming books: Like I said, I’ll keep writin’ ’em.
    • Colophon: All the rest.


    Elon Musk wielding a flamethrower; he is roasting the snout of a giant frog

    Blowtorching the frog (permalink)

    Back in 2018, the Singletrack blog published a widely read article explaining the lethal trigonometry of a UK intersection where drivers kept hitting cyclists:

    https://singletrackworld.com/2018/01/collision-course-why-this-type-of-road-junction-will-keep-killing-cyclists/

    There are lots of intersections that are dangerous for cyclists, of course, but what made Ipsley Cross so lethal was a kind of eldritch geometry that let the cyclist and the driver see each other a long time before the collision, while also providing the illusion that they were not going to collide, until an instant before the crash.

    This intersection is an illustration of a phenomenon called “constant bearing, decreasing range,” which (the article notes) had long been understood by sailors as a reason that ships often collide. I’m not going to get into the trigonometry here (the Singletrack article does a great job of laying it out).

    I am, however, going to use this as a metaphor: there is a kind of collision that is almost always fatal because its severity isn’t apparent until it is too late to avert the crash. Anyone who’s been filled with existential horror at the looming climate emergency can certainly relate.

    The metaphor isn’t exact. “Constant bearing, decreasing range” is the result of an optical illusion that makes it seem like things are fine right up until they aren’t. Our failure to come to grips with the climate emergency is (partly‡) caused by a different cognitive flaw: the fact that we struggle to perceive the absolute magnitude of a series of slow, small changes.

    ‡The other part being the corrupting influence of corporate money in politics, obviously

    This is the phenomenon that’s invoked in the parable of “boiling a frog.” Supposedly, if you put a frog in a pot of water at a comfortable temperature and then slowly warm the water to boiling, the frog will happily swim about even as it is cooked alive. In this metaphor, the frog can only perceive relative changes, so all that it senses is that the water has gotten a little warmer, and a small change in temperature isn’t anything to worry about, right? The fact that the absolute change to the water is lethal does not register for our (hypothetical) frog.

    Now, as it happens, frogs will totally leap clear of a pot of warming water when it reaches a certain temperature, irrespective of how slowly the temperature rises. But the metaphor persists, because while it does not describe the behavior of frogs in a gradually worsening situation, it absolutely describes how humans respond to small, adverse changes in our environment.

    Take moral compromises: most of us set out to be good people, but reality demands small compromises to our ethics. So we make a small ethical compromise, and then before long, circumstances demand another compromise, and then another, and another, and another. Taken in toto, these compromises represent a severe fall from our personal standards, but so long as they are dripped out in slow and small increments, too often we rationalize our way into them: each one is only a small compromise, after all:

    https://pluralistic.net/2020/02/19/pluralist-19-feb-2020/#thinkdifferent

    Back to the climate emergency: for the first 25 years after NASA’s James Hansen testified before Congress about “global heating,” the changes to our world were mostly incremental: droughts got a little worse, as did floods. We had a few more hurricanes. Ski seasons got shorter. Heat waves got longer. Taken individually, each of these changes was small enough for our collective consciousness to absorb as within the bounds of normalcy, or, at worst, just a small worsening. Sure, there could be a collision on the horizon, but it wasn’t anything urgent enough to justify the massive effort of decarbonizing our energy and transportation:

    https://locusmag.com/feature/cory-doctorow-the-swerve/

    It’s not that we’re deliberately committing civilizational suicide, it’s just that slow-moving problems are hard to confront, especially in a world replete with fast-moving, urgent problems.

    But crises precipitate change:

    https://www.youtube.com/watch?v=FrEdbKwivCI

    Before 2022, Europe was doing no better than the rest of the world when it came to confronting the climate emergency. Its energy mix was still dominated by fossil fuels, despite the increasing tempo of wildfires and floods and the rolling political crises touched off by waves of climate refugees. These were all dire and terrifying, but they were incremental, a drip-drip-drip of bad and worsening news.

    Then Putin invaded Ukraine, and the EU turned its back on Russian gas and oil. Overnight, Europe was plunged into an urgent energy crisis, confronted with the very real possibility that millions of Europeans would shortly find themselves shivering in the dark – and not just for a few nights, but for the long-foreseeable future.

    At that moment, the slow-moving crisis of the climate became the Putin emergency. The fossil fuel industry – one of the most powerful and corrupting influences in Brussels and around the world – was sidelined. Europe raced to solarize. In three short years, the continent went from decades behind on its climate goals to a decade ahead on them:

    https://pluralistic.net/2025/10/11/cyber-rights-now/#better-late-than-never

    Putin could have continued to stage minor incursions on Ukraine, none of them crossing any hard geopolitical red lines, and Europe would likely have continued to rationalize its way into continuing its reliance on Russia’s hydrocarbon exports. But Putin lacked the patience to continue nibbling away at Ukraine. He tried to gobble it all down at once, and then everything changed.

    There is a sense, then, in which Putin’s impatient aggression was a feature, not a bug. But for Putin’s lack of executive function, Ukraine might still be in danger of being devoured by Russia, but without Europe taking any meaningful steps to come to its aid – and Europe’s solar transition would still be decades behind schedule.

    Enshittification is one of those drip-drip-drip phenomena, too. Platform bosses have a keen appreciation of how much value we deliver to one another – community, support, mutual aid, care – and they know that so long as we love each other more than we hate the people who own the platforms, we’ll likely stay glued to them. Mark Zuckerberg is a master of “twiddling” the knobs on the back-ends of his platforms, announcing big, enshittifying changes, and then backing off on them to a level that’s shittier than it used to be, but not as shitty as he’d threatened:

    https://pluralistic.net/2023/02/19/twiddler/

    Zuck is a colossal asshole, a man who founded his empire in a Harvard dorm room to nonconsensually rate the fuckability of his fellow undergrads, a man who knowingly abetted a genocide, a man who cheats at Settlers of Catan:

    https://pluralistic.net/2025/04/23/zuckerstreisand/#zdgaf

    But despite all these disqualifying personality defects, Mark Zuckerberg has one virtue that puts him ahead of his social media competitor Elon Musk: Zuck has a rudimentary executive function, and so he is capable of backing down (sometimes, temporarily) from his shittiest ideas.

    Contrast that with Musk’s management of Twitter. Musk invaded Twitter the same year Putin invaded Ukraine, and embarked upon a string of absolutely unhinged and incontinent enshittificatory gambits that lacked any subtlety or discretion. Musk didn’t boil the frog – he took one of his flamethrowers to it.

    Millions of people were motivated to hop out of Musk’s Twitter pot. But millions more – including me – found ourselves mired there. It wasn’t that we liked Musk’s Twitter, but we had more reasons to stay than we had to go. For me, the fact that I’d amassed half a million followers since some old pals messaged me to say they’d started a new service called “Twitter” meant that leaving would come at a high price to my activism and my publishing career.

    But Musk kept giving me reasons to reassess my decision to stay. Very early into the Musk regime, I asked my sysadmin Ken Snider to investigate setting up a Bluesky server that I could move to. I was already very active on Mastodon, which is designed to be impossible to enshittify the way Musk had done to Twitter, because you can always move from one Fediverse server to another if the management turns shitty:

    https://pluralistic.net/2022/12/23/semipermeable-membranes/

    But for years, Bluesky’s promise of federation remained just that – a promise. Technically, its architecture dangled the promise of multiple, independent Bluesky servers, but practically, there was no way to set this up:

    https://pluralistic.net/2023/08/06/fool-me-twice-we-dont-get-fooled-again/

    But – to Bluesky’s credit – they eventually figured it out, and published the tools and instructions to set up your own Bluesky servers. Ken checked into it, and told me that it was all do-able, but not until a planned hardware upgrade to the Linux box he keeps in a colo cage in Toronto was complete. That upgrade happened a couple months ago, and yesterday, Ken let me know that he’d finished setting up a Bluesky server, just for me. So now I’m on Bluesky, at @doctorow.pluralistic.net:

    https://bsky.app/profile/doctorow.pluralistic.net

    I am on Bluesky, the service, but I am not a user of Bluesky, the company. That means that I’m able to interact with Bluesky users without clicking through Bluesky’s abominable terms of service, through which you permanently surrender your right to sue the company (even if you later quit Bluesky and join another server!):

    https://pluralistic.net/2025/08/15/dogs-breakfast/#by-clicking-this-you-agree-on-behalf-of-your-employer-to-release-me-from-all-obligations-and-waivers-arising-from-any-and-all-NON-NEGOTIATED-agreements

    Remember: I knew and trusted the Twitter founders and I still got screwed. It’s not enough for the people who run a service to be good people – they also have to take steps to insulate themselves (and their successors) from the kind of drip-drip-drip rationalizations that turn a series of small ethical waivers into a cumulative avalanche of pure wickedness:

    https://pluralistic.net/2024/12/14/fire-exits/#graceful-failure-modes

    Bluesky’s “binding arbitration waiver” does the exact opposite: rather than insulating Bluesky’s management from their own future selves’ impulse to do wrong, a binding arbitration waiver permanently insulates Bluesky from consequences if (when) they yield the temptation to harm their users.

    But Bluesky’s technical architecture offers a way to eat my cake and have it, too. By setting up a Bluesky (the service) account on a non-Bluesky (the company) server, I can join a social space that has lots of people I like, and lots of interesting technical innovations, like composable moderation, without submitting to the company’s unacceptable terms of service:

    https://bsky.social/about/blog/4-13-2023-moderation

    If Twitter was on the same slow enshittification drip-drip-drip of the pre-Musk years, I might have set up on Bluesky and stayed on Twitter. But thanks to Musk and his frog blowtorch, I’m able to make a break. For years now, I have posted this notice to Twitter nearly every day:

    Twitter gets worse every single day. Someday it will degrade beyond the point of usability. The Fediverse is our best hope for an enshittification-resistant alternative. I’m @pluralistic@mamot.fr.

    Today, I am posting a modified version, which adds:

    If you’d like to follow me on Bluesky, I’m @doctorow.pluralistic.net. This is the last thread I will post to Twitter.

    Crises precipitate change. All things being equal, the world would be a better place without Vladimir Putin or Elon Musk or Donald Trump in it. But these incontinent, impatient, terrible men do have a use: they transform slow-moving crises that are too gradual to galvanize action into emergencies that can’t be ignored. Putin pushed the EU to break with fossil fuels. Musk pushed millions into federated social media. Trump is ushering in a post-American internet:

    https://pluralistic.net/2026/01/01/39c3/#the-new-coalition

    If you’re reading this on Twitter, this is the long-promised notice that I’m done here. See you on the Fediverse, see you on Bluesky – see you in a world of enshittification-resistant social media.

    It’s been fun, until it wasn’t.

    Hey look at this (permalink)


    A shelf of leatherbound history books with a gilt-stamped series title, 'The World's Famous Events.'

    Object permanence (permalink)

    #20yrsago Waxy threatened with a lawsuit by Bill Cosby over “House of Cosbys” vids https://waxy.org/2006/03/litigation_cosb/

    #15yrsago Proposed TX law would criminalize TSA screening procedures https://blog.tenthamendmentcenter.com/2011/03/texas-legislation-proposes-felony-charges-for-tsa-agents/

    #15yrsago Rodney King: 20 years of citizen photojournalism https://mediactive.com/2011/03/02/rodney-king-and-the-rise-of-the-citizen-photojournalist/

    #15yrsago Mobile “bandwidth hogs” are just ahead of the curve https://tech.slashdot.org/story/11/03/02/2027209/High-Bandwidth-Users-Are-Just-Early-Adopters

    #15yrsago Peter Watts blogs from near-death experience with flesh-eating bacteria https://www.rifters.com/crawl/?category_name=flesh-eating-fest-11

    #15yrsago How a HarperCollins library book looks after 26 checkouts (pretty good!) https://www.youtube.com/watch?v=Je90XRRrruM

    #15yrsago Banksy bails out Russian graffiti artists https://memex.craphound.com/2011/03/04/banksy-bails-out-russian-graffiti-artists/

    #15yrsago TSA wants hand-luggage fee to pay for extra screening due to checked luggage fees https://web.archive.org/web/20110308142316/https://hosted.ap.org/dynamic/stories/U/US_TSA_BAGGAGE_FEES?SITE=AP&SECTION=HOME&TEMPLATE=DEFAULT&CTIME=2011-03-03-16-50-03

    #15yrsago US house prices fall to 1890s levels (where they usually are) https://www.csmonitor.com/Business/Paper-Economy/2011/0303/Home-prices-falling-to-level-of-1890s

    #10yrsago Whuffie would be a terrible currency https://locusmag.com/feature/cory-doctorow-wealth-inequality-is-even-worse-in-reputation-economies/

    #10yrsago Ditch your overpriced Sodastream canisters in favor of refillable CO2 tanks https://www.wired.com/2016/03/sodamod/

    #10yrsago Why the First Amendment means that the FBI can’t force Apple to write and sign code https://www.eff.org/files/2016/03/03/16cm10sp_eff_apple_v_fbi_amicus_court_stamped.pdf

    #10yrsago Apple vs FBI: The privacy disaster is inevitable, but we can prevent the catastrophe https://www.theguardian.com/technology/2016/mar/04/privacy-apple-fbi-encryption-surveillance

    #10yrsago The 2010 election was the most important one in American history https://www.youtube.com/watch?v=fw41BDhI_K8

    #10yrsago As Apple fights the FBI tooth and nail, Amazon drops Kindle encryption https://web.archive.org/web/20160304055204/https://motherboard.vice.com/read/amazon-removes-device-encryption-fire-os-kindle-phones-and-tablets

    #10yrsago Understanding American authoritarianism https://web.archive.org/web/20160301224922/https://www.vox.com/2016/3/1/11127424/trump-authoritarianism

    #10yrsago Proposal: replace Algebra II and Calculus with “Statistics for Citizenship” https://web.archive.org/web/20190310081625/https://slate.com/human-interest/2016/03/algebra-ii-has-to-go.html

    #10yrsago Panorama: the largest photo ever made of NYC https://360gigapixels.com/nyc-skyline-photo-panorama/

    #1yrago Ideas Lying Around https://pluralistic.net/2025/03/03/friedmanite/#oil-crisis-two-point-oh

    #1yrago There Were Always Enshittifiers https://pluralistic.net/2025/03/04/object-permanence/#picks-and-shovels

    Upcoming appearances (permalink)

    A photo of me onstage, giving a speech, pounding the podium.


    A screenshot of me at my desk, doing a livecast.

    Recent appearances (permalink)


    A grid of my books with Will Stahle covers..

    Latest books (permalink)


    A cardboard book box with the Macmillan logo.

    Upcoming books (permalink)

    • “The Reverse-Centaur’s Guide to AI,” a short book about being a better AI critic, Farrar, Straus and Giroux, June 2026

    • “Enshittification, Why Everything Suddenly Got Worse and What to Do About It” (the graphic novel), Firstsecond, 2026

    • “The Post-American Internet,” a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027

    • “Unauthorized Bread”: a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, 2027

    • “The Memex Method,” Farrar, Straus, Giroux, 2027


    Colophon (permalink)

    Today’s top sources:

    Currently writing: “The Post-American Internet,” a sequel to “Enshittification,” about the better world the rest of us get to have now that Trump has torched America (1066 words today, 43341 total)

    • “The Reverse Centaur’s Guide to AI,” a short book for Farrar, Straus and Giroux about being an effective AI critic. LEGAL REVIEW AND COPYEDIT COMPLETE.

    • “The Post-American Internet,” a short book about internet policy in the age of Trumpism. PLANNING.

    • A Little Brother short story about DIY insulin PLANNING

    This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

    https://creativecommons.org/licenses/by/4.0/

    Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.

    How to get Pluralistic:

    Blog (no ads, tracking, or data-collection):

    Pluralistic.net

    Newsletter (no ads, tracking, or data-collection):

    https://pluralistic.net/plura-list

    Mastodon (no ads, tracking, or data-collection):

    https://mamot.fr/@pluralistic

    Bluesky (no ads, possible tracking and data-collection):

    https://bsky.app/profile/doctorow.pluralistic.net

    Medium (no ads, paywalled):

    https://doctorow.medium.com/
    https://twitter.com/doctorow

    Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

    https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

    “When life gives you SARS, you make sarsaparilla” -Joey “Accordion Guy” DeVilla

    READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies (“BOGUS AGREEMENTS”) that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

    ISSN: 3066-764X

  • ‘Moment of reckoning’ needed in social care, says Louise Casey

    The chair of the independent commission on social care recommends introducing a full-time dementia tsar, and new fast-track passport system for people diagnosed with motor neurone disease (MND).

  • Congress Is Considering Abolishing Your Right to Be Anonymous Online

    Sen. Marsha Blackburn, R-Tenn., speaks at a rally in support of the Kids Online Safety Act on Dec. 10, 2024, in Washington, D.C. Photo: Jemal Countess/Getty Images for Accountable Tech

    In August 2024, the Biden administration hosted hundreds of influencers at the White House for the first-ever Creator Economy Conference. Neera Tanden, a senior Biden adviser, took to the stage and bemoaned anonymity online. The influencers alongside her agreed, pushing the idea that anonymous speech on the internet is harmful, and regulation is needed to force the use of real names on social media. The audience whispered excitedly as those on stage spoke about how proposed laws like the Kids Online Safety Act, or KOSA, could unmask every troll. 

    This narrative of online safety, particularly in relation to children, has become central to the bipartisan effort to censor and deanonymize the internet for everyone. Today, a package of a dozen “child online safety” bills is moving forward in the House of Representatives with bipartisan support. The laws, framed as a way to crack down on harmful content and make the internet safer, would force social media companies to enact invasive identity verification measures in order to keep children from accessing online spaces.

    The problem is that there’s no way to reliably verify someone’s age without verifying who they are. A platform cannot magically discern that a user is 16 without collecting identifying information, whether through government documents such as a passport, payment information like a credit card, or other identity-disclosing data. Whether that data is stored by the platform itself or outsourced to a vendor, the result is always the same: A user’s offline identity is forever linked with their online behavior.

    Stripping anonymity from the internet would constitute one of the most sweeping rollbacks of civil rights in recent history. It would allow for unprecedented levels of mass surveillance and censorship, endangering the most marginalized members of society. Whistleblowers exposing corporate wrongdoing could be tracked and fired, government employees speaking out about illegal behavior or bad policies could face prosecution, and activists organizing protests could be identified and surveilled before ever setting foot on the street.


    Related

    Google Fulfilled ICE Subpoena Demanding Student Journalist’s Bank and Credit Card Numbers

    Already, the U.S. government is flooding social media platforms with subpoenas seeking to unmask hundreds of anonymously run anti-ICE social media accounts. These laws would make it all the more easier for the government to target and prosecute those who dissent. 

    Vulnerable members of society will suffer most. Trans people under attack from the government could be identified and outed without their consent. Undocumented immigrants could be cut off from the ability to communicate and connect with advocates. Young people seeking abortions in states with restrictive laws might no longer have the ability to access information safely and anonymously.

    Not only will a de-anonymized internet be valuable to the government as it seeks to tighten control, it will also make it easier for any corporation or bad actor to intimidate, blackmail, or exploit people by leveraging their own data against them.

    The quest to remove anonymous speech from the web is not new. Conservative groups like the Heritage Foundation and the National Center on Sexual Exploitation, formerly known as Morality in Media, have long pursued these laws, arguing that online anonymity fuels pornography, exploitation, and general moral decay. In recent years, Democrats have become integral to advancing these proposals, falsely claiming that surveillance laws will crack down on Big Tech or curb social media addiction.

    The laws will lead to more data being collected on kids, which predatory companies can then use to target them in more invasive ways.

    None of these surveillance laws do any of that. In fact, the laws will lead to more data being collected on kids, which predatory companies can then use to target them in more invasive ways. Already, these bills are standing in the way of protecting kids online: Last week, the FTC said it would decline to enforce COPPA, a landmark law that mandates the protection of children’s data, in order to incentivize ID verification.

    The laws would create a massive new market for third-party identification vendors, many funded by the same tech investors who backed social media giants, such as Peter Thiel, who funded ID verification platform Persona via his investment group Founders Fund. Smaller apps will be forced to shoulder the enormous cost of enacting identity verification measures, hindering their ability to operate, and making it harder to compete with Big Tech companies that are leveraging these laws to consolidate power.

    It’s no surprise then that Big Tech companies are also heavily involved in lobbying for various versions of these laws. Elon Musk has endorsed KOSA. The Digital Childhood Alliance, a group that frequently posts about the dangers of “Big Tech,” is secretly funded by Meta, and has played a role in pushing the App Store Accountability Act. Meta CEO Mark Zuckerberg recently told a court that Apple and Google should verify the identity of every smartphone user at the operating system level, which would permanently end anonymous internet access for everyone.

    This exact invasive scheme is being boosted by Democratic lawmakers like California Gov. Gavin Newsom, who recently signed an ID verification law for all operating systems, including Linux, and has mused about banning all social media for users under the age of 16.

    “Young people still have human rights.”

    These efforts have “been brewing for or for a few years now, but just in the last few months, we’ve seen a lot of momentum,” said David Greene, senior counsel at the Electronic Frontier Foundation. While it’s tempting to take a paternalistic attitude toward young people, Greene said that it’s crucial to recognize young people have rights too, and often use the internet when taking part in social justice movements.

    “Young people still have human rights,” he said, “and that includes the right to access information and to associate with other people and to speak to the world. These laws are designed to diminish those rights.”


    Related

    How Student Protesters and Immigrants Became Targets of Trump’s Surveillance Tech

    Young people have led campuswide protests against the genocide in Gaza and against ICE across the country. Laws that restrict and surveil online access would severely limit their speech and ability to organize. And as the U.S. escalates attacks in the Middle East and immigration agents exert more power at home, activists are becoming concerned by the assault on anonymous speech.

    “Whenever imperialist governments go to war, they become more authoritarian at home,” Evan Greer, director of digital rights group Fight for the Future, posted to Bluesky.

    The Kids Online Safety Act, co-sponsored by members of both parties, is one of the most dangerous proposals currently making its way through Congress. The law would empower state attorneys general to mass censor any content online deemed “harmful to minors.” The Heritage Foundation has already come out publicly and said it plans to leverage KOSA and similar “online safety” laws to remove LGBTQ+ content and abortion content from the internet. 

    Sen. Marsha Blackburn, R-Tenn., the lead co-sponsor of KOSA, said that it was essential to pass the law to protect “minor children from the transgender [sic] in this culture.” Jonathan Haidt, the author of the bestselling book “The Anxious Generation,” who has played a major role in rallying political and public support for these laws globally, has promoted the fringe theory that some young people become trans because of the social media they consume.

    As KOSA has encountered growing backlash, more lawmakers have started pushing proposed ID verification at the operating system or app store level. On Wednesday, the X account for the House Energy and Commerce Committee boosted a dubious poll from far right think tank the American Principles Project, a group that has opposed abortion and same-sex marriage, declaring, “The OVERWHELMING majority of voters agree—app stores should have to verify users’ age to prevent minors from downloading apps without parental consent.” 

    But enacting identity verification at the app store level does nothing to address the privacy issues at play. Privacy activists and those fighting the law have sounded the alarm about how the App Store Accountability Act creates a sprawling, insecure data-sharing pipeline that mandates divulging highly sensitive user age data with millions of general-audience apps. This is why users in some states are being forced to provide their government IDs to download things like a weather app or calculator app. The way the law equates the entire internet and treats every app in the app store as inherently pornographic will also inevitably chill speech.

    The way the law equates the entire internet and treats every app in the app store as inherently pornographic will inevitably chill speech.

    Rising reactionary sentiment and right-wing extremism under Trump has accelerated the push for online age verification, Greer said. “Online protest, documenting war crimes, even news articles could be suppressed [if these laws pass].” Already, similar versions of these laws are playing out abroad. Soon after the United Kingdom’s Online Safety Act took effect last summer, the law was used to restrict content, including videos documenting police violence, posts challenging the government’s narratives on Palestine, and a subreddit dedicated to documenting Israel’s war crimes.

    China, Saudi Arabia, and Russia have used their vast online surveillance systems to crack down on speech challenging the government, imprisoning activists who leverage social media to challenge power. Dozens more countries are seeking to replicate authoritarian-style internet surveillance within their own borders. Indonesia, Malaysia, France, and Australia are among those that have embraced identity verification systems that would eliminate anonymous speech online under the guise of protecting children. 


    Related

    He Tweeted Charlie Kirk “Won’t Be Remembered as a Hero.” The State Dept. Revoked His Visa.

    “The through-line couldn’t be clearer: destroying online anonymity is a way for government to be able to identify ­— and ultimately punish — dissenters,” said Ari Cohn, lead counsel for tech policy at the Foundation for Individual Rights and Expression, a civil liberties group. “In the United States, the federal government’s recent demands that online services identify critics of DHS and ICE serves as a chilling example of the types of attacks on lawful speech that such laws will only enable further.” 

    The harms of widespread government censorship, he said, are only compounded by the “massive privacy and security threats posed by collecting personally identifiable information en masse.” Systems built to remove anonymity in the name of “child safety” will be used to identify whistleblowers, protest organizers, and critics of federal agencies, Cohn said. “At this point, not seeing the planet-sized red flags is more a result of willful blindness than anything else,” he said. 

    For journalists, dissidents, and vulnerable communities, the ability to gather and share information anonymously online is critical. Just this week, The Atlantic reported that the Pentagon is seeking to use powerful AI models from companies like Anthropic and OpenAI to mass surveil U.S. citizens by harvesting broad swaths of commercially available data. Age verification laws would dramatically expand the collection of identity-linked browsing and speech data, endangering users and creating new troves of data for commercial and government exploitation.

    LGBTQ+ youth frequently rely on anonymous online spaces to explore identity and seek support, particularly in hostile states. Kansas recently invalidated hundreds of trans residents’ driver’s licenses. As harmful laws that target LGBTQ+ people spread, openly identifying as LGBTQ+ online could put people in danger. Tying online access to government-issued IDs will also deter vulnerable young people from seeking help or gaining information about crucial topics like abuse or sexual health. Reproductive justice activists have been sounding the alarm about state efforts to de-anonymize organizations providing abortion and reproductive health information online.

    Whistleblowers especially rely on anonymous accounts to call out corporate or government wrongdoing. During Trump’s first administration, dozens of employees and scientists within the government set up “rogue” Twitter accounts, revealing firsthand information about the administration’s efforts to gut federal agencies and censor scientific information. The “rebel” accounts mirroring those of NASA, the U.S. National Park Service, and other agencies revealed crucial research on topics like climate change to the public. 

    The push to eliminate online anonymity is ultimately a fight over whether the internet remains a space for dissent and free expression or further becomes a dystopian digital panopticon that operates as an arm of the surveillance state. A free society depends on the right to publish and consume information anonymously and to organize and speak privately. Age verification policies only bolster the power of Big Tech and give the government complete authority to surveil and censor online speech.

    The post Congress Is Considering Abolishing Your Right to Be Anonymous Online appeared first on The Intercept.

  • Covid inquiry chair defends £200m cost and four-year process on final day

    Baroness Heather Hallett said completing the hearings in under four years was an achievement but critics have questioned its cost.

  • Sanctioned Alleged Member of ‘Criminal’ Conglomerate Bought $17 Million in London Properties

    An alleged member of Prince Group — the Cambodia-based conglomerate the U.S. calls a “transnational criminal organization” — owns at least $17-million worth of London properties, company and land records show.

    Yang Jian was named in a sanctions notice last year in a list of 146 U.S. Department of the Treasury targets for alleged online fraud and human trafficking by the Prince Group. 

    Records show that Yang Jian purchased a dozen house units and at least 17 car parking spaces in an adjoining garage through a U.K. company he established with his Cypriot passport in December 2021.

    Conveyancing documents filed with the U.K. Land Registry show that the company, DSRR Limited, purchased these assets all at once in November 2022, for a combined price tag of £12.7 million (about $17 million).

    Yang Jian did not respond before publication to emailed requests for comment sent to his lawyers and company secretaries in Hong Kong.

    OCCRP reporters who visited the property found the 12 adjoining houses fenced off in a gated, private road in a quiet corner of Rotherhithe, a district in South London, with a view of the Canary Wharf financial district skyline directly across the River Thames. 

    Reporters were unable to directly access the property, but it was clear that at least some of these units were occupied or in use.

     

    Yang Jian, who is also a Chinese citizen but acquired Cypriot citizenship in 2019, has not been sanctioned by the U.K. He was sanctioned by the U.S. Treasury for his involvement in Grand Legend International Asset Management Co Ltd., a Palau-based company part-owned by Chen Zhi, chairman of the Prince Group.

    Documents from Grand Legend International, which allegedly participated in criminal operations, list Yang Jian as a director and shareholder of the company, along with Chen Zhi and another alleged member of Prince Group, Chen Xiaoer, whose birth name is Hu Xiaowei.

    OCCRP has reported extensively on Hu Xiaowei’s $45-million U.K. property portfolio and his global businesses, and uncovered his multiple identities and alleged involvement with Prince Group.

    OCCRP previously contacted Hu Xiaowei for comment via his assistant, who did not respond to questions about his multiple identities. The assistant told OCCRP that Hu Xiaowei was a “long-time acquaintance” of Chen Zhi, and their only business together — a resort in Palau — was “unjustly sanctioned.”

    Chinese company registries also show that, beyond their Prince Group affiliations, both Hu Xiaowei and Yang Jian shared overlapping company interests dating back to the early 2010s. Reporters also found that Yang Jian, under his Chinese citizenship, continues to hold active stakes in Hong Kong companies. 

    Another sanctioned Prince Group associate, Zhu Zhongbiao, purchased at least 29 prestige properties in Dubai, while his wife bought five luxury apartments in London, OCCRP reporting shows. Neither Zhu nor his wife have responded to OCCRP’s requests to comment.

    The discovery of Yang’s London properties comes amid growing action to dismantle the operations of Prince Group. Following sanctions by the U.S., U.K. and South Korea against alleged members of the organization, Prince Group Chairman Chen Zhi was arrested in Cambodia and extradited to China in early January. 

    The Prince Group has denied any involvement in illegal activity, saying in a statement last November: “The recent allegations are baseless and appear aimed at justifying the unlawful seizure of assets worth billions of dollars.”

    This week, Singapore announced it had made three arrests and seized Prince Group assets and Taiwan indicted 62 people linked to the organization, OCCRP reported.

    China’s Ministry of Public Security subsequently issued a February 15 deadline for those suspected of involvement in Prince Group to surrender and confess their crimes to police in exchange for light or mitigated punishments. 

  • Using Bellingcat’s New Open Source Tool to Explore Historical and Spatial Flight Data

    Using Bellingcat’s New Open Source Tool to Explore Historical and Spatial Flight Data

    Flight tracking data is an important tool in open source research, but with 100,000 daily flights, it can be difficult to contextualise what a particular aircraft’s movements indicate. 

    Bellingcat has developed a tool called Turnstone to make it easier to visualise historical trends in flight data and spot unusual patterns. It also allows users to filter by parameters such as aircraft type or a geographic region of interest. 

    Source: ZUMA Press Wire via Reuters Connect; overlays of Turnstone by Bellingcat

    This tool primarily uses Automatic Dependent Surveillance–Broadcast (ADS-B) data, the technology that enables open source investigators and enthusiasts to track flights. 

    Most aircraft are equipped with transmitters that broadcast ADS-B data to comply with global aviation regulations, though regulations vary by jurisdiction, and military aircraft might not always transmit. ADS-B data includes information about an aircraft’s identity and type, as well as its precise position, speed and altitude. 

    Popular flight-tracking websites such as Flightradar24 and ADS-B Exchange typically display historical data for a particular time or aircraft. However, Turnstone aggregates ADS-B data for multiple aircraft over time, and allows users to search for flights across two areas of interest at once. These features provide additional context for open source investigators to better understand flight behaviour.

    Watch the video for a demonstration of how the tool works, using the example of Black Hawk helicopter patrols near one of the borders between the US and Canada:

    You can view Turnstone’s source code and information about hosting it yourself on Bellingcat’s GitHub. 

    We also have a web-based instance of the tool that journalists and academics can access. Due to data hosting and processing costs, we can only grant access on a selective basis. If you would like to apply, please fill in this form. Priority will be given to researchers conducting open source investigations aligned with Bellingcat’s goals.

    Read on for more examples of how Turnstone can be used for investigations, as well as some limitations of the tool.  

    Spotting Unusually High US Tanker Activity Before Iran Strikes

    The US and Israel launched joint air strikes across Iran on Feb. 28, 2026, reportedly killing more than 1,000 people, including members of the Iranian leadership, in five days.

    This marked a dramatic escalation since the US and Israel bombed three Iranian nuclear sites in June 2025. 

    Flight data before both the June 2025 and February 2026 strikes showed a large number of American aerial tankers leaving the US and crossing the Atlantic towards Iran. Aerial tankers such as the KC-135 and KC-46A can refuel military aircraft in-flight, making them essential for most long-range combat missions.

    With Turnstone, it is possible to interrogate the baseline level of movement and see how unusual this activity is.

    To do this, three filters are set on the search: a geographic region of interest, set to the North Atlantic, a filter on the aircraft type, to search only for tankers, and a filter on the aircraft heading, to search only for eastbound traffic.

    Filtering a search by aircraft type, region of interest, and heading range that captures eastbound traffic. Source: Turnstone/Bellingcat

    [Note: For the aircraft category designations, Bellingcat used a custom-prompted large language model (LLM), Claude Sonnet 4.0, to assign a category label using aircraft type code data. There may be some inaccuracies in the classifications, as LLMs are prone to hallucinations. We discuss this further in the “Limitations of the Data” section of this piece.]

    This search finds over 40,000 aircraft locations that match these filter queries. However, a look at the summary table shows that this data includes non-American tankers as well.

    Results from a filtered search, showing tankers owned by the French Air Force and the United States Air Force. Source: Turnstone/Bellingcat

    We can filter this data to include only aircraft associated with the US by typing “United States” into the search box in the table. Note that ownership data is not 100 percent accurate – it may be out of date, especially for privately owned aircraft, and new aircraft might not have any data at all. However, especially when comparing trends over time or searching for research leads, this data can still be useful.

    The graph of matching detections over time now shows that while there is a large baseline level of transatlantic movement for American tankers, there was a notably higher number of American tankers heading eastward from the US across the North Atlantic detected in the week of June 15, 2025, as well as in the last two weeks of February 2026.

    The weekly graph view on Turnstone shows a noticeable spike in eastbound American tankers crossing the North Atlantic per day from June 15 to June 21, 2025 and from Feb. 15 to Feb. 28, 2026. Source: Turnstone/Bellingcat

    A week after the increased eastbound traffic in June 2025, early in the morning on June 22, the US struck several nuclear sites in Iran. And on Feb. 28, 2026, the US and Israel launched over 900 strikes against Iran.

    Altering the search query to look for westbound tankers instead of eastbound tankers, we can also see a larger-than-normal number of American tankers heading in the direction of the US during the week of July 13, 2025, bookending the summer airstrikes in Iran. No such return movement is yet visible following the recent strikes.

    The number of American tankers heading westward across the North Atlantic, towards the US, appeared higher than usual from July 13 to July 19, 2025. Source: Turnstone/Bellingcat

    Finding Deportation Flights to Guantanamo Bay

    Turnstone also allows you to search for aircraft detected across two different geographic regions of interest (ROIs). 

    Shortly after US President Donald Trump announced the opening of a migrant detention centre at Guantanamo Bay in Cuba at the end of January 2025, the US military reportedly flew about 100 immigrants from El Paso, Texas, to the US naval base to await deportation. By selecting the areas around both Guantanamo Bay and El Paso, we can find flights between these cities that broadcast ADS-B data.

    When you select two regions of interest, a filter for the time difference between them also appears. Source: Turnstone/Bellingcat

    When two ROIs are selected, you can also enter the maximum time difference between an aircraft’s presence in the two regions. 

    In the example below, we have entered 36,000 seconds (10 hours), meaning that the aircraft must have crossed through both regions within 10 hours of each other. We have also set the maximum altitude to 15,000 ft (4.57km) to look for planes landing and taking off. This limit is set relatively high as there are no ADS-B receivers at Guantanamo Bay, and only the initial approach is captured.

    Search panel settings for finding aircraft that have been in both Guantanamo Bay and El Paso, Texas, with inputs under the “Maximum Altitude” and “Maximum Time Difference” fields, and selection areas drawn around both areas on the map (in blue). Source: Turnstone/Bellingcat

    After five months with no tracked flights between the two locations, this search shows an uptick in flights in the few months from February 2025.

    The results from Turnstone come with a bar graph that shows the average aircraft per day by week or by month, which can be further filtered by aircraft hex code (the unique identifier for specific aircraft) or the aircraft type code. Source: Turnstone/Bellingcat

    Results for this search query from Jan. 26, 2026, include several passenger aircraft operated by companies known to run deportation flights from the US, such as Omni Air International and Global Crossing Airlines.

    Results from a search of flights of up to 10 hours between Guantanamo Bay and El Paso, Texas, conducted on Jan. 26, 2026 show flights owned by Omni Air International and Global Crossing Airlines, both carriers known to operate deportation flights. Source: Turnstone/Bellingcat

    Mapping US Customs and Border Patrol Aircraft

    Turnstone also supports uploading a list of International Civil Aviation Organization (ICAO) addresses, informally referred to as aircraft “hex codes”, which are unique identifiers assigned to aircraft by ICAO member states.

    For example, to explore data related to Department of Homeland Security (DHS) activity and look for patterns related to the US immigration enforcement and border security operations, we can copy and paste the hex codes from a list of US Customs and Border Patrol (CBP) aircraft (used across the DHS) into a text file, and upload that file. Now, we can search among these aircraft with any of the same filters demonstrated in the earlier case studies. Alternatively, we can also deselect all of the filters to track the most recent activity by those aircraft.

    Let’s try that with the CBP list, this time with a very large number of results selected: 500,000. Note that increasing the number of results increases the search time and requires more browser memory.

    With the list of hex codes provided, the search interface shows “216 hex codes loaded”. No other filters have been selected and the result limit is set to 500,000. Source: Turnstone/Bellingcat

    When many points are displayed, the map is simplified, and hover features are disabled.

    The results map shows a large number of CBP flights over the US without any filters, from a search of historical data on Jan. 26, 2026. Source: Turnstone/Bellingcat

    By the California-Mexico border, Eurocopter AS350 (type “AS50”) can be seen on frequent patrol missions over the land border. Over the Pacific Ocean, Black Hawk helicopters (“H60”) can be seen patrolling the international waters boundary off the Mexican coast, while CBP Dash-8s (“DH8B” and “DH8C”) travel farther offshore.

    Zooming in on the area near the California-Mexico border shows an obvious concentration of certain aircraft types in this search of historical data on Jan. 26. 2026. Source: Turnstone/Bellingcat

    In contrast, by the Minnesota-Canada border, CBP makes more active use of one of its MQ-9 Reaper drones, as seen from the prevalence of red dots that correspond to “Q9”, the type code of these drones, in the results map.

    The dots around the Minnesota-Canada border mainly show activity by MQ-9 Reaper drones in this search of historical data on Jan. 26, 2026. Source: Turnstone/Bellingcat

    Let’s take a closer look at these drones by filtering the results with the text “Q9”. Now the displayed aircraft only include MQ-9 Reaper drones.

    Results can be filtered by typing into the search field on the top right of the “Aircraft Summary” table. Source: Turnstone/Bellingcat

    Now we can take a closer look at the patterns of drones, specifically among the search results.

    Left: A very large number of MQ-9 Reaper flights south of San Angelo, Texas. They are coloured by altitude, with green symbols indicating lower flights and red showing those at higher altitudes. Right: The flight pattern of a known Aug. 13, 2025 MQ-9 Reaper mission into Mexico, as shown on Turnstone. Source: Turnstone/Bellingcat

    While overall CBP flight activity was relatively stable, drone flights seem to have intensified in December 2025 and January 2026, compared with previous weeks.

    The bar graph by week shows a higher average number of MQ-9 Reaper drone flights in December 2025 and January 2026 than in previous weeks. Source: Turnstone/Bellingcat

    Limitations of the Data

    In open source research, it is always important to be alert to the limitations of a particular data source, and ADS-B data is no exception. 

    For example, some aircraft do not have ADS-B transponders and use older transponders to transmit flight information, which can result in tracking tools such as Turnstone showing inaccurate position data. 

    In the previous case study of CBP aircraft, the Turnstone results appeared to show an MQ-9 Reaper drone in Canada on Jan. 20, 2026. 

    Search results for CBP MQ-9 Reaper drones on Jan. 20, 2026, which appeared to show four instances (circled) of a drone in Canadian airspace. Source: Turnstone/Bellingcat

    Is this evidence of covert DHS missions in Canadian airspace? Likely not: a cross-check of the drone’s hex code on that date with ADS-B Exchange shows that the aircraft’s position track is not smooth, but jumps back and forth between a line in the US and several points many kilometres away in Canada.

    Screenshot from flight tracking website ADS-B Exchange, appearing to show a CBP drone flying within US airspace but jumping suddenly to the circled points in Canada, several kilometres away. Source: ADS-B Exchange; annotations by Bellingcat

    This happens because when ADS-B position data is not available, flight trackers often use multilateration (MLAT), which estimates the location of the aircraft using the time differences between signals transmitted from known sites, as a substitute. The flight tracking information on ADS-B Exchange shows that the position was calculated using MLAT, which is less accurate than position data directly transmitted through ADS-B. ADSB.lol, which is the data source used by Turnstone, uses MLAT when ADS-B position data is not available.  

    ADS-B data is also limited by where ground antennas are available to receive radio signals from aircraft and by when aircraft choose to transmit the data.

    Other datasets which Bellingcat has used to enable the filters available on Turnstone each have their own limitations. 

    There is no single source of data on aircraft ownership. ADS-B data identifies an aircraft only using its ICAO address or hex codes, but does not contain other information that directly specifies the type of aircraft or its registration.

    Instead, flight-tracking websites reference aircraft registration databases, such as those maintained by the US Federal Aviation Administration, to correlate ICAO addresses with registration information. The ownership data displayed on Turnstone is from tar1090-db, a community-maintained project which has produced the most comprehensive freely available global aircraft registration database. However, since ownership data is collected from many jurisdictions, with different privacy and disclosure requirements, it may sometimes be out-of-date or misleading. 

    Ownership information displayed in Turnstone or any other flight-tracking software should still be verified independently using multiple sources.

    For example, one of the aircraft that came up in the search for flights between El Paso and Guantanamo Bay had a hex code of a6b0f5. This showed up in Turnstone’s results as being owned by Bank of Utah Trustee, which matches the operator listed for this flight on ADS-B Exchange. But some of the flight codes used by this aircraft, starting with “GXA”, are used by Global Crossing Airlines (GlobalX). The Bank of Utah is known to legally own aircraft under a trust relationship, while leasing the aircraft and operational control to third parties such as GlobalX.

    Screenshot from Turnstone showing aircraft flying between Guantanamo Bay and El Paso, from a historical flight data search on Jan. 26, 2026.

    The “Category” label and “Military” flag, which provide a convenient way to filter aircraft, are pre-generated by a custom-prompted large language model, Claude Sonnet 4.0, based on the make and model of an aircraft. 

    For example, the LLM may take a type code of A321, which refers to an Airbus A321 passenger jet, as input and assign the corresponding aircraft the category of “airliner”. 

    Bellingcat manually verified over 80 per cent of aircraft, corresponding to the most common aircraft types. But as we know, LLMs are prone to hallucinations, and categorisation may be inaccurate for more obscure aircraft. Additionally, some aircraft, such as the V-22 Osprey, fall between categories and are inherently ambiguous. 

    To prevent errors caused by the potential miscategorisation of aircraft, you may want to search by type code, which will draw from the raw tar1090-db data, rather than category. All aircraft registration, type, and owner information should be independently verified.

    Suggestions and Further Information

    As we’ve seen in this guide, Turnstone searches historical ADS-B data to allow researchers to explore flight patterns over time and in specific locations. While flight-tracking data has inherent limitations, Turnstone can provide useful leads for researchers looking to incorporate flight tracking in their investigations.

    If you have suggestions for improving the tool, you can submit a pull request on Bellingcat’s GitHub. More technical information can also be found in the tool’s README.

    For more demos and information about the history of this tool, watch a talk that Bellingcat gave about it at the What Hackers Yearn (WHY) 2025 hacker camp:

    Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

    The post Using Bellingcat’s New Open Source Tool to Explore Historical and Spatial Flight Data appeared first on bellingcat.

  • More Than 1,100 Ships Hit by Widespread GPS Disruption After Iran Strikes

    Following the U.S.-Israel attack against Iran on 28 February, more than 1,100 ships across the Middle East experienced GPS and Automatic Identification System (AIS) interference within a 24-hour period, exposing the vessels to navigation and accident risks, according to the maritime AI company Windward.

    In what resembled a maritime cybersecurity incident, the interference caused GPS and AIS signals to show false vessel locations –  showing them inland at a nuclear power plant, at airports, and on Iranian land, and “creating navigation and compliance risks.” In its analysis published  March 1, Windward identified “at least 21 new AIS jamming clusters across the UAE, Qatari, Omani, and Iranian waters.”

    Speaking to OCCRP, the firm said that this spike in jamming is not all “deliberate GPS spoofing by individual vessels but rather broad jamming that disrupts all traffic in affected areas.”

    This is not the first reported jamming wave. Windward said similar patterns have appeared in the Baltic, Black Sea, and Red Sea, and now again near Iran.

    Signal jamming at this scale is typically carried out using ground-based transmitters that overpower the legitimate GPS signals. In some cases, more sophisticated systems “can ‘throw’ vessels’ AIS-reported positions onto land,” similar to the recent interference, the company said.

    “What’s changed now is the intensity and geographic spread of the jamming in the Gulf in a very short period,” Windward added.

    Lloyd’s published a similar analysis, showing wide-scale jamming across the region on March 2, with about 600 cargo ships appearing off the UAE, more than 80 recorded off Iran, around 50 off Oman, and about 10 off Qatar.

    “I think it’s most likely that it is the neighboring countries trying to prevent Iranian strikes that today appear to have been targeting multiple neighbors,” said Royal Institute of Navigation chief executive Ramsey Faragher.

    “This is widespread, intentional interference that creates serious safety risks, including higher collision risk and false alerts about where ships are and what they’re doing,” Windward warned.

  • The Government Uses Targeted Advertising to Track Your Location. Here’s What We Need to Do.

    We’ve all had the unsettling experience of seeing an ad online that reveals just how much advertisers know about our lives. You’re right to be disturbed. Those very same online ad systems have been used by the government to warrantlessly track peoples’ locations, new reporting has confirmed.

    For years, the internet advertising industry has been sucking up our data, including our location data, to serve us “more relevant ads.” At the same time, we know that federal law enforcement agencies have been buying up our location data from shady data brokers that most people have never heard of.

    Now, a new report gives us direct evidence that Customs and Border Protection (CBP) has used location data taken from the internet advertising ecosystem to track phones. In a document uncovered by 404 Media, CBP admits what we’ve been saying for years: The technical systems powering creepy targeted ads also allow federal agencies to track your location.

    The document acknowledges that a program by the agency to use “commercially available marketing location data” for surveillance drew from the process used to select the targeted ads shown to you on nearly every website and app you visit. In this blog post, we’ll tell you what this process is, how it can and is being used for state surveillance, and what can be done about it—by individuals, by lawmakers, and by the tech companies that enable these abuses.

    Advertising Surveillance Enables Government Surveillance

    The online advertising industry has built a massive surveillance machine, and the government can co-opt it to spy on us. 

    In the absence of strong privacy laws, surveillance-based advertising has become the norm online. Companies track our online and offline activity, then share it with ad tech companies and data brokers to help target ads. Law enforcement agencies take advantage of this advertising system to buy information about us that they would normally need a warrant for, like location data. They rely on the multi-billion-dollar data broker industry to buy location data harvested from people’s smartphones.

    We’ve known for years that location data brokers are one part of federal law enforcement’s massive surveillance arsenal, including immigration enforcement agencies like CBP and Immigration and Customs Enforcement (ICE). ICE, CBP and the FBI have purchased location data from the data broker Venntell and used it to identify immigrants who were later arrested. Last year, ICE purchased a spy tool called Webloc that gathers the locations of millions of phones and makes it easy to search for phones within specific geographic areas over a period of time. Webloc also allows them to filter location data by the unique advertising IDs that Apple and Google assign to our phones.

    But a document recently obtained by 404 Media is the first time CBP has acknowledged the location data it buys is partially sourced from the system powering nearly every ad you see online: real-time bidding (RTB). As CBP puts it, “RTB-sourced location data is recorded when an advertisement is served.” 

    Even though this document is about a 2019-2021 pilot use of this data, CBP and other federal agencies have continued to purchase and use commercially obtained location data. ICE has purchased location tracking tools since then and recently requested information on “Ad Tech” tools it could use for investigations. 

    The CBP document acknowledges two sources of location data that it relies on: software development kits (SDKs) and RTB, both methods of location-tracking that EFF has written about before. Apps for weather, navigation, dating, fitness, and “family safety” often request location permissions to enable key features. But once an app has access to your location, it could share it with data brokers directly through SDKs or indirectly (and often without the app developers’ knowledge) through RTB. Data brokers can collect location data from SDKs that they pay developers to put in their apps. When relying on RTB, data brokers don’t need any direct relationship with the apps and websites they’re collecting location data from. RTB is facilitated by ad companies that are already plugged into most websites and apps. 

    How Real-Time Bidding Works

    RTB is the process by which most websites and apps auction off their ad space. Unfortunately, the milliseconds-long auctions that determine which ads you see also expose your information, including location data, to thousands of companies a day. At a high-level, here’s how RTB works:

    1. The moment you visit a website or app with ad space, it asks an ad tech company to determine which ads to display for you. 
    2. This ad tech company packages all the information they can gather about you into a “bid request” and broadcasts it to thousands of potential advertisers. 
    3. The bid request may contain information like your unique advertising ID, your GPS coordinates, IP address, device details, inferred interests, demographic information, and the app or website you’re visiting. The information in bid requests is called “bidstream data” and typically includes identifiers that can be linked to real people. 
    4. Advertisers use the personal information in each bid request, along with data profiles they’ve built about you over time, to decide whether to bid on the ad space. 
    5. The highest bidder gets to display an ad for you, but advertisers (or the adtech companies that represent them) can collect your bidstream data regardless of whether or not they bid on the ad space.   

    A key vulnerability of real-time bidding is that while only one advertiser wins the auction, all participants receive data about the person who would see their ad. As a result, anyone posing as an ad buyer can access a stream of sensitive data about billions of individuals a day. Data brokers have taken advantage of this vulnerability to harvest data at a staggering scale. For example, the FTC found that location data broker Mobilewalla collected data on over a billion people, with an estimated 60% sourced from RTB auctions. Leaked data from another location data broker, Gravy Analytics, referenced thousands of apps, including Microsoft apps, Candy Crush, Tinder, Grindr, MyFitnessPal, pregnancy trackers and religious-focused apps. When confronted, several of these apps’ developers said they had never heard of Gravy Analytics. 

    As Venntel, one of the location data brokers that has sold to ICE, puts it, “Commercially available bidstream data from the advertising ecosystem has long been one of the most comprehensive sources of real-time location and device data available.” But the privacy harms of RTB are not just a matter of misuse by individual data brokers. RTB auctions broadcast the average person’s data to thousands of companies, hundreds of times per day, with no oversight of how this information is ultimately exploited. Once your information is broadcast through RTB, it’s almost impossible to know who receives it or control how it’s used. 

    What You Can Do To Protect Yourself

    Revelations about the government’s exploitation of this location data shows how dangerous online tracking has become, but we’re not powerless. Here are two basic steps you can take to better protect your location data:

    1. Disable your mobile advertising ID (see instructions for iPhone/Android). Apple and Google assign unique advertising IDs to each of their phones. Location data brokers use these advertising IDs to stitch together the information they collect about you from different apps. 
    2. Review apps you’ve granted location permissions to. Apps that have access to your location could share it with other companies, so make sure you’re only granting location permission to apps that really need it in order to function. If you can’t disable location access completely for an app, limit it to only when you have the app open or only approximate location instead of precise location. 

    For more tips, check out EFF’s guide to protecting yourself from mobile-device based location tracking. Keep in mind that the security plan that’s best for you will vary in different situations. For example, you may want to take stronger steps to protect your location data when traveling to a sensitive location, like a protest. 

    What Tech Companies and Lawmakers Must Do

    Legislators and tech companies must act so that individuals don’t bear the burden of defending their data every time they use the internet.

    Ad tech companies must reckon with their role in warrantless government surveillance, among other privacy harms. The systems they built for targeted advertising are actively used to track people’s location. The best way to prevent online ads from fueling surveillance is to stop targeting ads based on detailed behavioral profiles. Ads can still be targeted contextually—based on the content people are viewing—without collecting or exposing their sensitive personal information. Short of moving to contextual advertising, tech companies can limit the use of their systems for government location tracking by:

    • Stopping the use of precise location data for targeted advertising. Ad tech companies facilitating ad auctions can and should remove precise location data from bid requests. Ads can be targeted based on people’s coarse location, like the city they’re in, without giving data brokers people’s exact GPS coordinates. Precise location data can reveal where we work, where we live, who we meet, where we protest, where we worship, and more. Broadcasting it to thousands of companies a day through RTB is dangerous.
    • Removing advertising IDs from devices, or at minimum, disabling them by default. Advertising IDs have become a linchpin of the data broker economy and are actively used by law enforcement to track people’s location. Advertising IDs were added to phones in 2012 to let companies track you, and removing them is not a far-fetched idea. When Apple forced apps to request access to people’s advertising IDs starting in 2021 (if you have an iPhone you’ve probably seen the “Ask App Not to Track” pop-ups), 96% of U.S. users opted out, essentially disabling advertising IDs on most iOS devices. One study found that iPhone users were less likely to be victims of financial fraud after Apple implemented this change. Google should follow Apple’s lead and disable advertising IDs by default.

    Lawmakers also need to step up to protect their constituents’ privacy. We need strong, federal privacy laws to stop companies from spying on us and selling our personal information. EFF advocates for data privacy legislation with teeth and a ban on ad targeting based on online behavioral profiles, as it creates a financial incentive for companies to track our every move.

    Legislators can and must also close the “data broker loophole” on the Fourth Amendment. Instead of obtaining a warrant signed by a judge, law enforcement agencies can just buy location data from private brokers to find out where you’ve been. Last year, Montana became the first state in the U.S. to pass a law blocking the government from buying sensitive data it would otherwise need a warrant to obtain. And in 2024, Senator Ron Wyden’s EFF-endorsed Fourth Amendment is Not for Sale Act passed the House before dying in the Senate. Others should follow suit to stop this end-run around constitutional protections.

    Online behavioral advertising isn’t just creepy–it’s dangerous. It’s wrong that our personal information is being silently harvested, bought by shadow-y data brokers, and sold to anyone who wants to invade our privacy. This latest revelation of warrantless government surveillance should serve as a frightening wakeup call of how dangerous online behavioral advertising  has become.

  • Paraguayan Senator Convicted of Aiding International Cocaine Trafficker

    A Paraguayan senator from the ruling Colorado Party was sentenced to 13 years in prison for money laundering and criminal association linked to a scheme led by fugitive Uruguayan drug trafficker Sebastián Marset, one of the DEA’s most wanted fugitives.

    Senator Erico Galeano Segovia was found guilty of collaborating with Marset’s criminal organization during a trial held Wednesday in Asunción, Paraguay’s capital. “Erico Galeano provided operational support to a transnational organization dedicated to the international trafficking of cargo between 2020 and 2021,” the president of the Specialized Organized Crime Sentencing Court said while reading the verdict.

    Prosecutors presented evidence that in 2020 Galeano sold a luxury property for $1 million in cash to Hugo Manuel González Ramos, who is under investigation as a frontman for Miguel Ángel Insfrán, alias “Tío Rico” (Uncle Rico). Miguel Insfrán and his brother José Alberto are considered leaders of the “Insfrán Clan,” which worked with Marset between 2019 and 2021 to traffic cocaine from South America to Europe.

    The judge said González Ramos lacked basic financial activity to justify the purchase. He also appears as the listed owner of a livestock company raided during “Operation A Ultranza Py” in 2022, Paraguay’s largest anti-drug investigation, which targeted Marset and led to the downfall of the Insfrán clan.

    The property was transferred to González Ramos only a year after the cash transaction and was not recorded in public registries. The court said the maneuver was designed to avoid leaving a paper trail and to conceal the identity of the true buyer, Miguel Insfrán.

    The presiding judge also said Marset used a light aircraft owned by Galeano on December 30, 2022, to travel from Ciudad del Este, on the border with Brazil, to Asunción. The aircraft, registered ZP-BHQ, had reportedly been used by Marset on several occasions.

    The court said financial support Galeano provided to Marset’s organization generated significant returns, part of which was funneled into Deportivo Capiatá, a semi-professional Paraguayan soccer club where Galeano served as president. Prosecutors said the club was used to launder proceeds from the trafficking scheme.

    Galeano initially did not list Deportivo Capiatá in his 2022 asset declaration. After Operation A Ultranza Py became public, he amended the statement. In March 2022, an “account receivable” of $158,730 appeared. By 2023, the amount had risen to $1,44 million.

    “The introduction of such funds into Deportivo Capiatá, among others, and their subsequent declaration as accounts receivable, reveals an operation intended to grant an appearance of legitimacy to resources that effectively stem from an illicit origin,” the court said. Marset also played briefly for the club in 2021 during Galeano’s tenure as a director. The stadium, with a capacity of about 15,000, still bears Galeano’s name.

    Galeano remains an active senator and holds parliamentary immunity, which protects him from imprisonment until the sentence is final and enforceable by Paraguay’s Supreme Court. Lawyers for the Colorado Party lawmaker said they will appeal the ruling.