YunoBlog

Author: tio

  • Research careers – what you need to lead

  • Pluralistic: Europe takes a big step towards a post-dollar world (11 Feb 2026)

    Today’s links


    An old-fashioned credit-card imprinter; its handle is a cracked and dirty American flag. Under the slip is a gold Trump Card. Looming over the imprinter is the top half of Trump's face, brooding and squint-eyed; it has been altered to increase its orangeness, to add bloodshot sclera to his eyes, and to add liver spots. At its bottom, the face merges with a bubbling, hellish cauldron of smoke and flame.

    Europe takes a big step towards a post-dollar world (permalink)

    There’s a reason every decentralized system eventually finds its way onto a platform: platforms solve real-world problems that platform users struggle to solve for themselves.

    I’ve written before about the indie/outsider author Crad Kilodney, who wrote, edited, typeset and published chapbooks of his weird and wonderful fiction, and then sold his books from Toronto street-corners with a sign around his neck reading VERY FAMOUS CANADIAN AUTHOR BUY MY BOOKS (or, if he was feeling spicy, simply: MARGARET ATWOOD):

    https://pluralistic.net/2024/02/19/crad-kilodney-was-an-outlier/#intermediation

    Crad was a hell of a writer and a bit of a force of nature, but there are plenty of writers I want to hear from who are never going to publish their own books, much less stand on a street-corner selling them with a MARGARET ATWOOD sign around their necks. Publishers, editors, distributors and booksellers all do important work, allowing writers to get on with their writing, taking all the other parts of the publishing process off their shoulders.

    That’s the value of platforms. The danger of platforms is when they grow so powerful that they usurp the relationship between the parties they are supposed to be facilitating, locking them in and then extracting value from them (someone should coin a word to describe this process!):

    https://pluralistic.net/2024/11/07/usurpers-helpmeets/#disreintermediation

    Everyone needs platforms: writers, social media users, people looking for a romantic partner. What’s more, the world needs platforms. Say you want to connect all 200+ countries on Earth with high-speed fiber lines; you can run a cable from each country to every other country (about 21,000 cables, many of them expensively draped across the ocean floor), or you can pick one country (preferably one with both Atlantic and Pacific coasts) and run all your cables there, and then interconnect them.

    That’s America, the world’s global fiber hub. The problem is, America isn’t just a platform for fiber interconnections – it’s a Great Power that uses its position at the center of the world’s fiber networks to surveil and disrupt the world’s communications networks:

    https://en.wikipedia.org/wiki/Edward_Snowden

    That’s a classic enshittification move on a geopolitical scale. It’s not the only one America’s made, either.

    Consider the US dollar. The dollar is to global commerce what America’s fiber head-ends are to the world’s data network: a site of essential, (nominally) neutral interchange that is actually a weapon that the US uses to gain advantage over its allies and to punish its enemies:

    https://pluralistic.net/2023/10/10/weaponized-interdependence/#the-other-swifties

    The world’s also got about 200 currencies. For parties in one country to trade with those in another country, the buyer needs to possess a currency the seller can readily spend. The problem is that setting up 21,000 pairwise exchange markets from every currency to every other currency is expensive and cumbersome – traders would have to amass reserves of hundreds of rarely used currencies, or they would have to construct long, brittle, expensive, high-risk chains that convert, say, Thai baht into Icelandic kroner to Brazilian reals and finally into Costa Rican colones.

    Thanks to a bunch of complicated maneuvers following World War II, the world settled on the US dollar as its currency platform. Most important international transactions use “dollar clearing” (where goods are priced in USD irrespective of their country of origin) and buyers need only find someone who will convert their currency to dollars in order to buy food, oil, and other essentials.

    There are two problems with this system. The first is that America has never treated the dollar as a neutral platform; rather, American leaders have found subtle, deniable ways to use “dollar dominance” to further America’s geopolitical agenda, at the expense of other dollar users (you know, “enshittification”). The other problem is that America has become steadily less deniable and subtle in these machinations, finding all kinds of “exceptional circumstances” to use the dollar against dollar users:

    https://pluralistic.net/2025/11/26/difficult-multipolarism/#eurostack

    America’s unabashed dollar weaponization has been getting worse for years, but under Trump, the weaponized dollar has come to constitute an existential risk to the rest of the world, sending them scrambling for alternatives. As November Kelly says, Trump inherited a poker game that was rigged in his favor, but he still flipped over the table because he resents having to pretend to play at all:

    https://pluralistic.net/2026/01/26/i-dont-want/#your-greenback-dollar

    Once Trump tried to steal Greenland, it became apparent that the downsides of the dollar far outweigh its upsides. Last month, Christine Lagarde (president of the European Central Bank) made a public announcement on a radio show that Europe “urgently” needed to build its own payment system to avoid the American payment duopoly, Visa/Mastercard:

    https://davekeating.substack.com/p/can-europe-free-itself-from-visamastercard

    Now, there’s plenty of reasons to want to avoid Visa/Mastercard, starting with cost: the companies have raised their prices by more than 40% since the pandemic started (needless to say, updating database entries has not gotten 40% more expensive since 2020). This allows two American companies to impose a tax on the entire global economy, collecting swipe fees and other commissions on $24t worth of the world’s transactions every year:

    https://finance.yahoo.com/news/europe-banks-launching-product-break-101215642.html

    But there’s another reason to get shut of Visa/Mastercard: Trump controls them. He can order them to cut off payment processing for any individual or institution that displeases him. He’s already done this to punish the International Criminal Court for issuing a genocide arrest warrant for Benjamin Netanyahu, and against a Brazilian judge for finding against the criminal dictator Jair Bolsonaro (Trump also threatened to have the judge in Bolsonaro’s case assassinated). What’s more, Visa/Mastercard have a record of billions (trillions?) of retail transactions taking place between non-Americans, which Trump’s officials can access for surveillance purposes, or just to conduct commercial espionage to benefit American firms as a loyalty bonus for the companies that buy the most $TRUMP coins.

    Two days after Lagarde’s radio announcement, 13 European countries announced the formation of “EuroPA,” an alliance that will facilitate regionwide transactions that bypass American payment processors (as well as Chinese processors like Alipay):

    https://news.europawire.eu/european-payment-leaders-sign-mou-to-create-a-sovereign-pan-european-interoperable-payments-network/eu-press-release/2026/02/02/15/34/11/168858/

    As European Business Magazine points out, EuroPA is the latest in a succession of attempts to build a European payments network:

    https://europeanbusinessmagazine.com/business/europes-24-trillion-breakup-with-visa-and-mastercard-has-begun/

    There’s Wero, a 2024 launch from the 16-country European Payments Initiative, which currently boasts 47m users and 1,100 banks in Belgium, France and Germany, who’ve spent €7.5b through the network:

    https://finance.yahoo.com/news/europe-banks-launching-product-break-101215642.html

    Wero launched as a peer-to-peer payment system that used phone numbers as identifiers, but it expanded into retail at the end of last year, with several large retailers (such as Lidl) signing on to accept Wero payments.

    Last week, Wero announced an alliance with EuroPA, making another 130m people eligible to use the service, which now covers 72% of the EU and Norway. They’re rolling out international peer-to-peer payments in 2026, and retail/ecommerce payments in 2027.

    These successes are all the more notable for the failures they follow, like Monnet (born 2008, died 2012). Even the EPI has been limping along since its founding, only finding a new vigor on the heels of Trump threatening EU member states with military force if he wasn’t given Greenland.

    As EBM writes, earlier efforts to build a regional payment processor foundered due to infighting among national payment processors within the EU, who jealously guarded their own turf and compulsively ratfucked one another. This left Visa/Mastercard as the best (and often sole) means of conducting cross-border commerce. This produced a “network effect” for Visa/Mastercard: since so many Europeans had an American credit card in their wallets, European merchants had to support them; and since so many EU merchants supported Visa/Mastercard, Europeans had to carry them in their wallets.

    Network effects are pernicious, but not insurmountable. The EU is attacking this problem from multiple angles – not just through EuroPA, but also through the creation of the Digital Euro, a Central Bank Digital Currency (CBDC). Essentially, this would give any European who signs up an account with the ECB, the federal bank of the Eurozone. Then, using an app or a website, any two Digital Euro customers could transfer funds to one another using the bank’s own ledgers, instantaneously and at zero cost.

    EBM points out that there’s a critical difficulty in getting EuroPA off the ground: because it is designed to be cheap to use, it doesn’t offer participating banks the windfall profits that Visa/Mastercard enjoy, which might hold back investment in EuroPA infrastructure.

    But banks are used to making small amounts of money from a lot of people, and with the Digital Euro offering a “public option,” the private sector EuroPA system will have a competitor that pushes it to continuously improve its systems.

    It’s true that European payment processing has been slow and halting until now, but that was when European businesses, governments and households could still pretend that the dollar – and the payment processing companies that come along with it – was a neutral platform, and not a geopolitical adversary.

    If there’s one thing the EU has demonstrated over the past three years, it’s that geopolitical threats from massive, heavily armed mad empires can break longstanding deadlocks. Remember: Putin’s invasion of Ukraine and the end of Russian gas moved the EU’s climate goals in ways that beggar belief: the region went from 15 years behind on its solar rollout to ten years ahead of schedule in just a handful of months:

    https://pluralistic.net/2026/02/05/contingency/#this-too-shall-pass

    This despite an all-out blitz from the fossil fuel lobby, one of the most powerful bodies in the history of civilization.

    Crises precipitate change, and Trump precipitates crises.

    Hey look at this (permalink)


    A shelf of leatherbound history books with a gilt-stamped series title, 'The World's Famous Events.'

    Object permanence (permalink)

    #15yrsago Realtime API for Congress https://web.archive.org/web/20110211101723/http://sunlightlabs.com/blog/2011/the-real-time-congress-api/

    #15yrsago Steampunk fetish mask with ear-horn https://bob-basset.livejournal.com/156159.html

    #10yrsago Facebook’s “Free Basics” and colonialism: an argument in six devastating points https://web.archive.org/web/20160211182436/https://www.theatlantic.com/technology/archive/2016/02/facebook-and-the-new-colonialism/462393/

    #10yrsago UK surveillance bill condemned by a Parliamentary committee, for the third time https://web.archive.org/web/20250523013320/https://www.wired.com/story/technology-ip-bill-surveillance-committee/

    #10yrsago Haunted by a lack of young voter support, Hillary advertises on the AOL login screen https://web.archive.org/web/20160211080839/http://www.weeklystandard.com/hillary-reaches-base-with-aol-login-page-ad/article/2001023

    #10yrsago Celebrate V-Day like an early feminist with these Suffragist Valentines https://web.archive.org/web/20160216100606/https://www.lwv.org/blog/votes-women-vintage-womens-suffrage-valentines

    #10yrsago Elements of telegraphic style, 1928 https://writeanessayfor.me/telegraph-office-com

    #10yrsago Disgraced ex-sheriff of LA admits he lied to FBI, will face no more than 6 months in prison https://web.archive.org/web/20160211041117/https://www.latimes.com/local/lanow/la-me-ln-ex-l-a-county-sheriff-baca-jail-scandal-20160210-story.html

    #5yrsago Apple puts North Dakota on blast https://pluralistic.net/2021/02/11/rhodium-at-2900-per-oz/#manorial-apple

    #5yrsago Catalytic converter theft https://pluralistic.net/2021/02/11/rhodium-at-2900-per-oz/#ccscrap

    #5yrsago Adam Curtis on criti-hype https://pluralistic.net/2021/02/11/rhodium-at-2900-per-oz/#hypernormal

    #5yrsago Dependency Confusion https://pluralistic.net/2021/02/11/rhodium-at-2900-per-oz/#extra-index-url

    #1yrago Musk steals a billion dollars from low-income Americans and sends it to Intuit https://pluralistic.net/2025/02/11/doubling-up-on-paperwork/#rip-freefile

    Upcoming appearances (permalink)

    A photo of me onstage, giving a speech, pounding the podium.


    A screenshot of me at my desk, doing a livecast.

    Recent appearances (permalink)


    A grid of my books with Will Stahle covers..

    Latest books (permalink)


    A cardboard book box with the Macmillan logo.

    Upcoming books (permalink)

    • “The Reverse-Centaur’s Guide to AI,” a short book about being a better AI critic, Farrar, Straus and Giroux, June 2026

    • “Enshittification, Why Everything Suddenly Got Worse and What to Do About It” (the graphic novel), Firstsecond, 2026

    • “The Post-American Internet,” a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027

    • “Unauthorized Bread”: a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, 2027

    • “The Memex Method,” Farrar, Straus, Giroux, 2027


    Colophon (permalink)

    Today’s top sources:

    Currently writing: “The Post-American Internet,” a sequel to “Enshittification,” about the better world the rest of us get to have now that Trump has torched America (1027 words today, 26735 total)

    • “The Reverse Centaur’s Guide to AI,” a short book for Farrar, Straus and Giroux about being an effective AI critic. LEGAL REVIEW AND COPYEDIT COMPLETE.

    • “The Post-American Internet,” a short book about internet policy in the age of Trumpism. PLANNING.

    • A Little Brother short story about DIY insulin PLANNING

    This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

    https://creativecommons.org/licenses/by/4.0/

    Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.

    How to get Pluralistic:

    Blog (no ads, tracking, or data-collection):

    Pluralistic.net

    Newsletter (no ads, tracking, or data-collection):

    https://pluralistic.net/plura-list

    Mastodon (no ads, tracking, or data-collection):

    https://mamot.fr/@pluralistic

    Medium (no ads, paywalled):

    https://doctorow.medium.com/

    Twitter (mass-scale, unrestricted, third-party surveillance and advertising):

    https://twitter.com/doctorow

    Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

    https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

    “When life gives you SARS, you make sarsaparilla” -Joey “Accordion Guy” DeVilla

    READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies (“BOGUS AGREEMENTS”) that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

    ISSN: 3066-764X

  • Anna’s Archive Quietly ‘Releases’ Millions of Spotify Tracks, Despite Legal Pushback

    Anna’s Archive Quietly ‘Releases’ Millions of Spotify Tracks, Despite Legal Pushback

    Anna’s Archive is generally known as a meta-search engine for shadow libraries, helping users find pirated books and other related resources.

    However, last December, the site announced that it had also backed up Spotify, which came as a shock to the music industry.

    Anna’s Archive initially released only Spotify metadata, and no actual music, but that put the music industry on high alert. Together with the likes of Universal, Warner, and Sony, Spotify filed a lawsuit days later, hoping to shut the site down.

    Through a preliminary injunction targeting domain registrars and registries, the shadow library lost several domain names. However, not all were taken down, and with the addition of a new Greenland-based backup, the site apparently pushed through with the feared Spotify data release.

    Millions of Music Files

    While there hasn’t been an official announcement or a formal listing on the torrent page, several people have spotted dozens of new Spotify download links in the torrents.json file hosted on the site. These files were added on February 8, presumably with a single seeder.

    At the time of writing, we count 47 new music torrents, plus a new metadata torrent. These releases all contain 60,000 files, except for a smaller batch, bringing the total to roughly 2.8 million files. That’s roughly 6 terabytes of music.

    In addition, there’s a massive 29 GB ‘seekable’ metadata file, which likely acts as the index for the 2.8 million tracks that use abstract Spotify track IDs as names.

    Some of the torrent data

    torrent json

    On Reddit, the mysterious releases are actively discussed in various threads. They do indeed contain music files, ranging from a few hundred kilobytes to several megabytes. The filenames reference what appear to be Spotify track IDs but contain no artist names or song titles. Instead, they likely match Spotify’s internal cache format.

    The music files themselves come with embedded media information and metadata, including song, album, artist, and publisher, among others. If applicable, the cover art is also included.

    Media information

    media information

    The torrents are labeled “pop_0,” which, based on Anna’s Archive’s earlier blog post, refers to the popularity rank. The site previously said it planned a staggered release, based on how popular releases are, but additional batches could follow.

    Defying the Injunction

    The release comes despite a preliminary injunction signed by Judge Jed Rakoff on January 16. That order explicitly prohibited Anna’s Archive from hosting, linking to, or distributing the copyrighted works, and also targeted third-party intermediaries, including domain registries, hosting companies, and Cloudflare.

    Anna’s Archive previously appeared to comply, at least in part. The site’s dedicated Spotify download section was removed and marked as “unavailable until further notice.” However, the new torrents suggest that this was a temporary measure rather than a lasting retreat.

    Until now, only metadata had been released publicly, compressed into roughly 200GB. The actual music files, which the lawsuit specifically sought to prevent from being distributed, are of much bigger concern.

    What’s Next

    Given the gravity of the situation, Spotify and the labels are not expected to sit idly by. Anna’s Archive previously said it archived roughly 86 million music files, and almost 300 terabytes in total, so there could be more to come.

    Whether the music companies will also monitor people who share these files for potential legal follow-ups is unknown, but they will do their best to keep the pressure on intermediaries.

    The music companies already have a court-ordered injunction that compels domain name registrars and registries to make the site inaccessible. However, we have observed that companies and organizations that fall outside the U.S. jurisdiction don’t automatically comply with these.

    At the time of writing, Anna’s Archive has not publicly commented on the new release yet. Spotify informed us that the company has no further comments at this time and referred us to the preliminary injunction it obtained in U.S. court last month.

    From: TF, for the latest news on copyright battles, piracy and more.

  • Epstein Bought Venezuelan Oil Bonds on Advice From Chávez-Era Insider

    Jeffrey Epstein bought Venezuelan oil bonds issued by the hardline socialist state’s national oil company, according to newly-released documents. He was advised in the purchases by Francisco D’Agostino, a businessman currently wanted in Venezuela on charges of money laundering and criminal association.

    Emails included in the files released by the U.S. Department of Justice show that D’Agostino visited the Caribbean island owned by Epstein, which is at the center of sex trafficking allegations against him.

    In correspondence between the two men, D’Agostino advises Epstein in his purchase of bonds issued by Venezuela’s state-owned oil company, Petróleos de Venezuela SA (PDVSA).

    After talking business with D’Agostino, who holds both Venezuelan and Spanish citizenship, Epstein bought at least $4.5 million in oil bonds beginning in 2012. The bonds were set to mature in 2015 — during the period when Venezuela’s oil revenues collapsed, as corruption at PDVSA increased and production plummeted.

    D’Agostino did not respond to requests for comment, which were sent by email and via his assistant by phone. OCCRP also emailed a lawyer who represented D’Agostino in Italy, but did not receive a response.

    OCCRP was unable to obtain comment from PDVSA before publication.

    ‘I had so much fun’

    D’Agostino’s relationship with Epstein appears to have begun not in a financial institution or boardroom. Instead, emails refer to their meeting during a visit by D’Agostino to Epstein’s private island in the U.S. Virgin Islands, Little Saint James — which was sometimes referred to as “Little Saint Jeff’s.”

    “I had so much fun in Little St Jeffery…and Jane, the water gazelle is really stunning…what a beautiful and smart girl,” D’Agostino wrote to Epstein in October 2012.

    “I enjoyed very much talking to you and would love to continue=to explore the different possibilities to make some money together,” D’Agostino added in the email. “I see the beginning of fun longlasting friendship.”

    In October 2012, D’Agostino proposed a series of meetings in Caracas, which suggests he enjoyed a high level of access to Venezuela’s political and economic elite.

    Among those he proposed introducing Epstein to was Baldo Sansó, a financial adviser to PDVSA and brother-in-law of Rafael Ramírez, then president of the state oil company. OCCRP sent questions to an email address in Sansó’s name, but did not receive a response.

    Epstein appears to have chosen to wait for the outcome of the October 2012 presidential election before making any plans to travel to Venezuela. When D’Agostino informed him that populist President Hugo Chávez had won his fourth term by approximately 10 percent, Epstein replied succinctly: “Great.” 

    An email from December 2012 shows D’Agostino keeping Epstein up to date about Chávez, who had been diagnosed with cancer and was rumored to be close to death.

    “It seems very acccurate that Chavez has about 6 months left or less,” D’Agostino wrote, adding that Venezuela’s constitution would require elections within 30 days of a president dying. 

    “I think there is a very high probability that someone from the Chavez movement, but less radical will win the elections,” he predicted.

    As political uncertainty pervaded in Venezuela, emails in January 2013 show Epstein offering to host D’Agostino again on his private island, telling him to “visit when you like.”

    D’Agostino responded: “By the way…how is my water gaselle???” Epstein replied that she was “here and naked.”

    Chávez died on March 5, 2013. His loyalist, Nicolás Maduro, won elections the following month. It is unclear whether Epstein ever made the planned visit to Caracas.

    Increased Exposure

    Over the two years following that exchange of emails, Epstein increased his exposure to Venezuela’s oil sector, placing direct orders for additional purchases of PDVSA bonds. 

    Meanwhile, the industry suffered a steep descent.

    Venezuela’s oil revenues fell by 40 percent over 2014 and 2015, reportedly due to low prices. As the years wore on, PDVSA would be severely undermined by corruption, decimating Venezuela’s oil industry. The U.S. imposed sanctions on the entire oil sector in 2019.

    That same year, Epstein was arrested on U.S. federal sex trafficking charges and later found hanged in his New York City jail cell, in a death ruled a suicide. American prosecutors were preparing to try him for allegedly abusing dozens of underage girls at his homes and elsewhere. He had pleaded not guilty.

    D’Agostino himself came under scrutiny in the years after making contact with Epstein, and following his death.

    One of the influential people he suggested introducing Epstein to was his alleged business associate Alejandro Betancourt López, a co-founder of Derwick Associates.

    Derwick received contracts to build power plants directly from Venezuelan state companies without going through a competitive bidding process, OCCRP has reported. The company then overcharged the government by $2.9 billion, according to the Venezuelan chapter of the anti-corruption group Transparency International. 

    Betancourt did not respond to a request for comment, but told OCCRP in 2021 that he was innocent of the corruption allegations against him.

    On November 6, 2012, D’Agostino wrote to Epstein: “Alejandro Betancourt, my business partner, and I are available to meet you Monday November 19th. Shall we have lunch? Your place?”

    Multiple lawsuits alleged that D’Agostino was a key figure in Derwick’s operations. These included a 2013 civil suit by a Washington lobbyist and former U.S. ambassador to Venezuela, Otto Reich, which accused him and several executives of bribery and racketeering linked to the energy contracts. That case was dismissed in a U.S. court for lack of jurisdiction. 

    D’Agostino has consistently denied holding a position at Derwick, and has not been charged or convicted in the alleged fraud. In 2024, Spain’s National Court reportedly opened an investigation into former executives of Derwick — including D’Agostino — over that alleged financial fraud, which involved Spanish companies.

    D’Agostino was sanctioned by the U.S. Treasury in 2021 for “ties to a network attempting to evade United States sanctions on Venezuela’s oil sector.” Treasury removed him from its sanctions list last year.

    Last month, D’Agostino was reportedly arrested on an international warrant from Venezuela, where he has been charged with money laundering and criminal association. 

    D’Agostino was detained while attempting to cross the border from Italy to France. He was released after Italian judges ruled he would be at risk of suffering inhumane or degrading treatment if imprisoned in Venezuela.

  • Sunbed ads spreading harmful misinformation to young people

    Hundreds of TikTok, Instagram and Facebook ads made misleading claims about health benefits, BBC finds.
  • Of Course The Country Was Stolen

    Of Course The Country Was Stolen

    The acclaimed singer and songwriter Billie Eilish recently caused a furor by declaring that “no one is illegal on stolen land” in her acceptance speech at the Grammy Awards, adding “Fuck ICE.” Many men furiously denounced Eilish, treating her as out of her depth. Kevin O’Leary of Shark Tank gave her the advice to “shut your mouth and just entertain.” Bill Maher essentially called her stupid, pointing out that Eilish “didn’t go to school” (she was homeschooled) and wondering whether she meant we should “go back to living in teepees.”

  • Open Letter to Tech Companies: Protect Your Users From Lawless DHS Subpoenas

    We are calling on technology companies like Meta and Google to stand up for their users by resisting the Department of Homeland Security’s (DHS) lawless administrative subpoenas for user data. 

    In the past year, DHS has consistently targeted people engaged in First Amendment activity. Among other things, the agency has issued subpoenas to technology companies to unmask or locate people who have documented ICE’s activities in their community, criticized the government, or attended protests.   

    These subpoenas are unlawful, and the government knowns it. When a handful of users challenged a few of them in court with the help of ACLU affiliates in Northern California and Pennsylvania, DHS withdrew them rather than waiting for a decision. 

    These subpoenas are unlawful, and the government knowns it.

    But it is difficult for the average user to fight back on their own. Quashing a subpoena is a fast-moving process that requires lawyers and resources. Not everyone can afford a lawyer on a moment’s notice, and non-profits and pro-bono attorneys have already been stretched to near capacity during the Trump administration.  

     That is why we, joined by the ACLU of Northern California, have asked several large tech platforms to do more to protect their users, including: 

    1.  Insist on court intervention and an order before complying with a DHS subpoena, because the agency has already proved that its legal process is often unlawful and unconstitutional;  
    2. Give users as much notice as possible when they are the target of a subpoena, so the user can seek help. While many companies have already made this promise, there are high-profile examples of it not happening—ultimately stripping users of their day in court;  
    3. Resist gag orders that would prevent companies from notifying their users that they are a target of a subpoena. 

     We sent the letter to Amazon, Apple, Discord, Google, Meta, Microsoft, Reddit, SNAP, TikTok, and X.  

     Recipients are not legally compelled to comply with administrative subpoenas absent a court order 

     An administrative subpoena is an investigative tool available to federal agencies like DHS. Many times, these are sent to technology companies to obtain user data. A subpoena cannot be used to obtain the content of communications, but they have been used to try and obtain some basic subscriber information like name, address, IP address, length of service, and session times.  

    Unlike a search warrant, an administrative subpoena is not approved by a judge. If a technology company refuses to comply, an agency’s only recourse is to drop it or go to court and try to convince a judge that the request is lawful. That is what we are asking companies to do—simply require court intervention and not obey in advance. 

    It is unclear how many administrative subpoenas DHS has issued in the past year. Subpoenas can come from many places—including civil courts, grand juries, criminal trials, and administrative agencies like DHS. Altogether, Google received 28,622 and Meta received 14,520 subpoenas in the first half of 2025, according to their transparency reports. The numbers are not broken out by type.   

    DHS is abusing its authority to issue subpoenas 

    In the past year, DHS has used these subpoenas to target protected speech. The following are just a few of the known examples. 

    On April 1, 2025, DHS sent a subpoena to Google in an attempt to locate a Cornell PhD student in the United States on a student visa. The student was likely targeted because of his brief attendance at a protest the year before. Google complied with the subpoena without giving the student an opportunity to challenge it. While Google promises to give users prior notice, it sometimes breaks that promise to avoid delay. This must stop.   

    In September 2025, DHS sent a subpoena and summons to Meta to try to unmask anonymous users behind Instagram accounts that tracked ICE activity in communities in California and Pennsylvania. The users—with the help of the ACLU and its state affiliates— challenged the subpoenas in court, and DHS withdrew the subpoenas before a court could make a ruling. In the Pennsylvania case, DHS tried to use legal authority that its own inspector general had already criticized in a lengthy report.  

    In October 2025, DHS sent Google a subpoena demanding information about a retiree who criticized the agency’s policies. The retiree had sent an email asking the agency to use common sense and decency in a high-profile asylum case. In a shocking turn, federal agents later appeared on that person’s doorstep. The ACLU is currently challenging the subpoena.  

    Read the full letter here

  • Patch Tuesday, February 2026 Edition

    Patch Tuesday, February 2026 Edition

    Microsoft today released updates to fix more than 50 security holes in its Windows operating systems and other software, including patches for a whopping six “zero-day” vulnerabilities that attackers are already exploiting in the wild.

    Zero-day #1 this month is CVE-2026-21510, a security feature bypass vulnerability in Windows Shell wherein a single click on a malicious link can quietly bypass Windows protections and run attacker-controlled content without warning or consent dialogs. CVE-2026-21510 affects all currently supported versions of Windows.

    The zero-day flaw CVE-2026-21513 is a security bypass bug targeting MSHTML, the proprietary engine of the default Web browser in Windows. CVE-2026-21514 is a related security feature bypass in Microsoft Word.

    The zero-day CVE-2026-21533 allows local attackers to elevate their user privileges to “SYSTEM” level access in Windows Remote Desktop Services. CVE-2026-21519 is a zero-day elevation of privilege flaw in the Desktop Window Manager (DWM), a key component of Windows that organizes windows on a user’s screen. Microsoft fixed a different zero-day in DWM just last month.

    The sixth zero-day is CVE-2026-21525, a potentially disruptive denial-of-service vulnerability in the Windows Remote Access Connection Manager, the service responsible for maintaining VPN connections to corporate networks.

    Chris Goettl at Ivanti reminds us Microsoft has issued several out-of-band security updates since January’s Patch Tuesday. On January 17, Microsoft pushed a fix that resolved a credential prompt failure when attempting remote desktop or remote application connections. On January 26, Microsoft patched a zero-day security feature bypass vulnerability (CVE-2026-21509) in Microsoft Office.

    Kev Breen at Immersive notes that this month’s Patch Tuesday includes several fixes for remote code execution vulnerabilities affecting GitHub Copilot and multiple integrated development environments (IDEs), including VS Code, Visual Studio, and JetBrains products. The relevant CVEs are CVE-2026-21516, CVE-2026-21523, and CVE-2026-21256.

    Breen said the AI vulnerabilities Microsoft patched this month stem from a command injection flaw that can be triggered through prompt injection, or tricking the AI agent into doing something it shouldn’t — like executing malicious code or commands.

    “Developers are high-value targets for threat actors, as they often have access to sensitive data such as API keys and secrets that function as keys to critical infrastructure, including privileged AWS or Azure API keys,” Breen said. “When organizations enable developers and automation pipelines to use LLMs and agentic AI, a malicious prompt can have significant impact. This does not mean organizations should stop using AI. It does mean developers should understand the risks, teams should clearly identify which systems and workflows have access to AI agents, and least-privilege principles should be applied to limit the blast radius if developer secrets are compromised.”

    The SANS Internet Storm Center has a clickable breakdown of each individual fix this month from Microsoft, indexed by severity and CVSS score. Enterprise Windows admins involved in testing patches before rolling them out should keep an eye on askwoody.com, which often has the skinny on wonky updates. Please don’t neglect to back up your data if it has been a while since you’ve done that, and feel free to sound off in the comments if you experience problems installing any of these fixes.

  • Kyrgyz President Removes Close Ally From Top Security Post

    In a surprising move, Kyrgyz President Sadyr Japarov dismissed his once-close ally Kamchybek Tashiev from his posts as head of the State Committee for National Security (GKNB) and deputy head of the Cabinet of Ministers, the Presidential Administration announced Tuesday.

    The administration said three of Tashiev’s deputies were also dismissed.

    Japarov’s press secretary said the President acted “in the interest of the state,” and to “prevent a split in society, including between government structures, but on the contrary, to strengthen unity,” according to Kaktus news outlet.

    Tashiev has not commented on his dismissal.

    He was appointed GKNB head in October 2020, shortly after Japarov was released from prison following the uprising. Since then, Kyrgyzstan’s security service has become one of the country’s most powerful state institutions, overseeing numerous arrests of journalists and activists.

    The dismissal was unexpected. In a recent documentary about Japarov, Tashiev said, “only death can separate him from his friendship with Sadyr Japarov,,” adding that their shared goals and paths were unbreakable despite efforts by others to divide them.

    Their alliance dates back to the 2010s and was shaped by joint opposition activities in parliament. In 2012, they were detained while trying to climb the White House fence during a rally calling for the nationalization of Kyrgyzstan’s Kumtor gold deposit.

    Japarov was later freed from prison on the night of October 5-6, 2020, by supporters including Tashiev, amid protests following parliamentary elections.

  • EU Considers Sanctions on Georgia’s Kulevi Port Over Russian Oil Links

    The European Union is considering sanctions on a Georgian port accused of handling Russian oil, as part of a new package of measures against Moscow, RFE/RL reported on Monday.

    The outlet cited a European Commission proposal outlining measures against the port of Kulevi in Georgia, alongside other facilities in Russia and Indonesia. 

    EU member states have not yet approved the proposal, which would form part ofhe bloc’s 20th package of sanctions against Russia since Moscow’s full-scale invasion of Ukraine. If adopted, the measures would bar EU companies and individuals from conducting business with these ports. 

    According to RFE/RL, the proposal alleges that Kulevi has received Russian oil imports via “vessels that employ irregular and high-risk shipping practices.” The draft package also includes sanctions targeting ships linked to Russia’s so-called “shadow fleet.” 

    Vakhtang Partsvania, a professor at the Caucasus University in Tbilisi, told OCCRP’s Georgian member center Monitori that the proposed sanctions would “touch the entire logistics through this port.” Such a move, he added, would make Kulevi “unattractive to international shipping and isolated from the global financial and insurance system.”

    Kulevi oil terminal has long been operated by the State Oil Company of Azerbaijan Republic (SOCAR). In a response to Monitori, Tamar Javakhishvili, SOCAR Energy Georgia’s Deputy General Director for Marketing and Communications said that the terminal’s operations would be restricted in the event of sanctions. 

    “The terminal [Kulevi] is owned by SOCAR, while it has independent management. In reality, this matter needs to be clarified with the state authorities,” she added. According to the company’s official website, the terminal is operated by SOCAR’s another subsidiary, Black Sea Terminal LLC. 

    Responding to RFE/RL’s reporting, Georgian Prime Minister Irakli Kobakhidze said the government was “ready to present detailed information to the European Commission” regarding the proposed sanctions: “Of course, we do not believe that anything is happening [at Kulevi] that contradicts sanctions policy,” he added.

    Shipments of Russian crude oil to the Kulevi oil terminal began at the end of 2025. Upon arrival, the oil was transferred to the new Kulevi refinery, operated by the Georgian firm Black Sea Petroleum.

    Officially, Black Sea Petroleum belongs to Georgian designer and former model Maka Asatiani and Davit Potskhveria, the nephew of her husband Konstantine Gogelia, who is himself a member of the company’s supervisory board and Asatiani’s authorized representative. 

    Last year, the investigative outlet Proekt revealed that Asatiani’s son from her first marriage is a business partner of the son of Vladimir Alekseyev, the first deputy chief of Russia’s GRU military intelligence.

    The Chairman of the Supervisory Board at Black Sea Petroleum is the former Minister of Economy and former Vice Prime Minister, Levan Davitashvili. 

    Reporters were unable to reach the company for comment.