Blog

  • Enshittification Merch That Actually Fights Enshittification 

    Enshittification isn’t just a sweary word to describe the accelerating decay of the online platforms, apps, and services that we rely on.  

    It’s a framework for understanding the structural incentives that make tech companies enemies of their own users over time—the surveillance business model, the erosion of privacy, the monopoly power that eliminates alternatives, the regulatory capture that prevents accountability.  

    SUPPORT EFF

    GET LimITED EDITION MERCH + FIGHT ENSHITTIFICATION

    These are some of EFF’s core fights and have been for over 35 years. EFF sues. EFF advocates. EFF codes. And EFF wins. EFF is the most profound and powerful disenshittifying force on the planet Earth, and I’ve been proud to fight alongside them for nearly 25 of those years.  

    One of the lessons you learn in battles with very long timelines against very powerful actors is that these battles are deeply serious, and because of that they must also be fun. “Enshittification” took off as a shorthand in part because of the minor license to vulgarity it confers. It’s slightly crass for a reason: getting people to engage with the abstract issues of tech policy can be hard at the best of times. No one knows this better than my colleagues at EFF, who consistently surprise me with their ability to make complex, technical concepts concrete, memorable, and sometimes even joyful. 

    Words matter, but so do visuals. For the cover of the U.S. edition of my book, Enshittification, designer Devin Washburn of No Ideas studio created an iconic variation of the “pile of poo” emoji, with angry eyebrows and a grawlix-scrawled censor bar over its mouth. It instantly became the symbol of enshittification I’d been looking for. 

    I liked it so much I ordered a couple hundred enamel pins and a couple thousand vinyl stickers and handed them out to people I met on my 33-city book tour. Even when giving them away, I was inundated with requests to buy more of them.  

    I’ve since bought out Devin’s rights to the image and released it under a Creative Commons Attribution 4.0 license—free for anyone to use, remix, or build on, including commercially, with attribution. The high-resolution files are on Wikimedia CommonsFlickr, and the Internet Archive (including a PSD with an ink-density adjustment layer). It belongs to the commons now. 

    But I made sure EFF had first crack at the design for their “official merch,” and they’ve done right by it. There are two items available now in the EFF shop, and all proceeds go directly to EFF’s work defending digital rights. I’ve spent years admiring EFF’s merch and consistent, creative visual identity, so it fills me with pride to see this more-than-a-mere-poop-emoji in their shop.  

    A recognizable visual shorthand is a genuine organizing tool. When someone sees the enshittification emoji, they know what the conversation is about. When you wear the pin or slap the sticker on your laptop, you’re signaling that you understand what’s happening to the internet, and that you know we can do better.  

    You can get a $5 sticker:

    An angry poop emoji sticker affixed to the coiled spring mechanism inside a vending machine. The sticker depicts a scowling poop emoji holding a black sign reading "&$!#%".

    A hand with black nail polish and a gold ring holds an angry poop emoji sticker against a white door. The sticker shows a scowling poop emoji holding a black sign reading "&$!#%".

    Or a $10 pin:

    A close-up of an enamel pin on the lapel of a tan jacket. The pin depicts an angry poop emoji holding a black banner reading "&$!#%".

    An enamel pin clipped to the nose bridge of black-framed sunglasses resting on a wooden surface. The pin depicts a scowling poop emoji holding a black banner reading "&$!#%". 

     Because the design is CC-licensed, you don’t have to buy one. You can make your own merch, your own swag, your own illustrations. I made a lawn flag for my front garden.

    A  small white garden flag on a metal stake, planted among cacti and succulents in a sunny yard. The flag depicts an angry poop emoji holding a sign reading "&$!#%". 

    But if you do want to buy a sticker or pin, you can do so while supporting the most profound and powerful disenshittifying force on the planet Earth—the Electronic Frontier Foundation.

    SUPPORT EFF

    GET LimITED EDITION MERCH + FIGHT ENSHITTIFICATION

     

  • 🔊 Mass Surveillance for… Loud Music? | EFFector 38.11

    Across the country, surveillance companies have spun a vast web of tens of thousands of license plate cameras. The people selling this tech want you to believe that it’s for your safety, but how are authorities really using automated license plate readers (ALPR)? In this week’s EFFector newsletter, we’re looking at how these powerful surveillance networks have become universal people-trackers used for noise complaints and other low-level investigations.

    JOIN OUR NEWSLETTER

    For over 35 years, EFFector has been your guide to understanding the intersection of technology, civil liberties, and the law. This week’s issue covers a victory for facial privacy, EFF’s testimony to Congress about AI and surveillance, and troubling new examples of ALPR mission creep.

    Prefer to listen in? EFFector is now available on all major podcast platforms. This week, we’re chatting with EFF Associate Director of State Affairs Rindala Alajaji about what she uncovered about police use of ALPR. And don’t miss the EFFector news quiz. You can find the episode and subscribe on your podcast platform of choice:

    Privacy info.
    This embed will serve content from simplecast.com

    Listen on Spotify Podcasts Badge Listen on Apple Podcasts Badge  Subscribe via RSS badge

    Want to stay in the fight for privacy and free speech online? Sign up for EFF’s EFFector newsletter for updates, ways to take action, and new merch drops. You can also fuel the fight against online surveillance when you support EFF today!

  • Who Runs the Ransomware Group ‘The Gentlemen?’

    Who Runs the Ransomware Group ‘The Gentlemen?’

    A cybercrime group known as The Gentlemen has emerged as the second most active ransomware gang by victim count, rapidly attracting a talented pool of hackers through an aggressive recruitment strategy that promises affiliates 90 percent of any ransom paid by victims. This post examines clues pointing to a real life identity for the administrator of The Gentlemen ransomware group.

    A graphic created and shared by The Gentlemen ransomware group administrator Hastalamuerte on Breachforums in May 2026. Credit: ke-la.com.

    Experts at the security firm Check Point Software have been closely covering exploits of The Gentlemen, a so-called “ransomware-as-a-service” (RaaS) offering that pays affiliates handsomely to help spread the group’s malware.

    “A 90/10 affiliate revenue split — compared to the industry standard 80/20 — is accelerating the group’s growth by attracting experienced operators from competing programs,” the researchers wrote in April.

    Check Point found The Gentlemen are the second most active ransomware group by victim count so far this year, claiming at least 332 published victims since the group’s inception in mid-2025 and more than 240 in 2026 alone.

    According to Check Point, the group targets Internet-facing devices (VPNs, firewalls) as their entry point, and once inside moves quickly to encrypt entire networks within hours.

    Check Point says the administrator and primary operator of the ransomware group uses the nickname Zeta88 on the Russian-language cybercrime forums, and that this individual was previously known under the moniker Hastalamuerte. Check Point noted that a breach of the group’s backend infrastructure made it clear that Hastalamuerte/Zeta88 is the person who assembles the locker and RaaS panel, manages payments, and is essentially the administrator of the entire program who receives 10 percent of all ransoms.

    WHO IS HASTALAMUERTE?

    The cyber intelligence firm Intel 471 shows that the user Hastalamuerte is a Russian and English speaking person who registered on almost a dozen cybercrime forums between 2019 and the present day, including Exploit, Breachforums, Ramp_V2, BHF, Raidforums, and Nulled.

    Intel 471 reveals that Hastalamuerte registered on Breachforums in January 2025 from an Internet address in Izhevsk, the capital city of Russia’s Udmurt Republic. Likewise, the user Zeta88 signed up at the English-language cybercrime forum Breached in August 2022 from a different Internet address in Izhevsk.

    Intel 471 finds Hastalamuerte registered on Raidforums in 2020 using the email address hastalamuerte1488@protonmail.com (1488 is a common combination of two numeric symbols associated with white supremacy). A lookup on this address at the open source intelligence service Epieos shows it is connected to an account at Apple and to a phone number ending in 04.

    Epieos says that Protonmail address is also linked to a GitHub account under the username SantaMuerte. That account is marked private, but a history of this user’s activity shows they are watching and developing a number of malware tools and exploits.

    In April 2020, Hastalamuerte said on the crime forum Nulled that they could be contacted at the Telegram instant messenger name @hastalamuerte18, and the threat intelligence company Flashpoint finds this username is assigned the unique Telegram ID number 30907522 [full disclosure: Flashpoint is an advertiser on this blog].

    The breach tracking service Constella Intelligence reports that Hastalamuerte’s Telegram ID is connected to another username — “bu4vs” — and to the Russian phone number 79127650004. Pivoting on this phone number in Constella fetches multiple records from hacked Russian government databases showing it is assigned to one Alexander Andreevich Yapaev, a 36-year-old from Izhevsk.

    Constella reveals that phone number was used to create an account at the Russian social media platform Pikabu under the name “4apai18,” and shows Mr. Yapaev has signed up at a number of websites using the common surname Ivanov, or else “Chapaev” (the numeral 4 is often used as shorthand for a “ch” sound in Russian).

    A search in Intel 471 for cybercrime forum members with the nickname SantaMeurte unearths an account by the same name created in 2020 on the Russian hacking forum Codeby. Intel 471 shows this user originally registered on Codeby with the not-so-subtle nickname Alexandr 4apaev.

    Constella finds Mr. Yapaev regularly used the email address bu4vs@mail.ru. Meanwhile, Epieos shows this address is connected to a LinkedIn account for Alexander Yapaev, who lists himself as the head of B2B marketing at the company Uralenergo Udmurtia, one of Russia’s largest suppliers of electrotechnical and lighting products.

    Mr. Yapaev did not respond to multiple requests for comment.

    Nearly every time we publish one of these Breadcrumbs stories, readers are curious to know why it seems like so many cybercriminals from Russia apparently do little to hide their real life identities. The truth is that — Russian or not — most didn’t exactly set out to be arch criminals, but instead got drawn into the scene gradually over several years as their skills broadened and sharpened.

    Another important dynamic is that the Russian government generally either co-opts or ignores cybercriminal activity within its border so long as the hackers do not steal from or attack Russian businesses and citizens. As a result, successful cybercriminals in Russia are usually insulated from prosecution and arrest by foreign law enforcement agencies provided they occasionally pay off the right people and do not travel abroad. And cybercriminals who intend to strictly adhere to those unwritten rules may (at least initially) be less concerned about covering their tracks online.

    But the simplest explanation is that cybercriminals of all nationalities tend to make a number of basic operational security mistakes early in their careers, when they are less savvy and have far less to lose by their carelessness. A review of Hastalamuerte’s early posts on the crime forums (circa 2019-2020) shows a relatively unsophisticated and low-skilled hacker still trying to learn the ropes and earn a positive reputation on these communities.

    For example, in June 2020 Hastalamuerte’s Telegram account joined a multi-month training program (@pntst) to learn how to use popular penetration testing tools, and their candid posts to this hacker training camp show Hastalamuerte struggling to use these tools effectively. A Google-translated record of Hastalmuerte’s posts to @pntst is here.

  • Cyprus to Auction Off Fugitive Jho Low’s Luxury Seaside Villa

    Fugitive Malaysian financier Jho Low’s luxury seaside villa in Cyprus is set to be auctioned after a Nicosia district court issued a confiscation order on the property this week. 

    The Cyprus attorney general’s office said in a June 9 statement that it had jointly applied to seize the property with the country’s Unit for Combating Money Laundering. 

    The decision to confiscate the property represents the first time such an action has been taken in Cyprus without a conviction by a local court, and according to the statement issued, was taken with the consent of Low’s legal team. 

    OCCRP emailed Low’s previously known attorneys in Cyprus for comment but did not receive a response before publication.

    Low’s current whereabouts are unknown; he has been a fugitive since an Interpol Red Notice was issued for him in 2016 at the request of Singapore and Malaysia.

    It is not yet clear whether the proceeds from the auction of his Cyprus property will be distributed to the Malaysian government, which has launched a number of international legal proceedings over the theft of at least $4.5 billion from its sovereign wealth fund.

    Low is alleged to have masterminded the fraud and money laundering scheme, which allegedly siphoned funds from the state-owned 1Malaysia Development Berhad (1MDB) to offshore companies and banks across the globe between 2009 to 2015.

    The brazen nature of the alleged fraud grabbed international attention, as it financed lavish lifestyles, implicated Goldman Sachs, and landed Malaysian Prime Minister Najib Razak and his wife, Rosmah Mansor, in prison for corruption.

    Low allegedly used his ill-gotten proceeds to make splashy purchases, including a transparent grand piano for supermodel Miranda Kerr, a New York City penthouse once owned by Jay-Z, a $6 million emerald green soup can painted by Andy Warhol, and an entire hotel in Beverly Hills.

    Low bought the Cyprus property, a luxury seaside villa in the Cape Greco area of Ayia Napa, in 2015 for 5.9 million euros. The purchase was used in his securing of nationality in the country under the now-defunct Cyprus Citizenship by Investment (CIP) or “golden passport” scheme.

    Reports about the 1MDB scandal and Low’s alleged role had emerged prior to the approval of his application for citizenship. The Unit for Combating Money Laundering flagged concerns to Cyprus’ Interior Ministry during his application, according to a report drafted by a Cypriot government investigative committee.

    In May 2023, the Cypriot Cabinet of Ministers announced that they had stripped Low of his Cyprus citizenship over his role in the 1MDB scandal, a process that concluded in June 2024 with a rejection of an appeal by Low. 

  • The Baloney Protection Act

    The Baloney Protection Act

    We have had to endure a great deal of interference from government in the conduct of institutions that should be governed by science and evidence. I’m sorry to report – here is one more. Senators Mike Lee (R-UT) and Tommy Tuberville (R- AL) have recently introduced a bill that would limit the FDA’s ability to regulate the blatant pseudoscience of homeopathy. This […]

    The post The Baloney Protection Act first appeared on Science-Based Medicine.

  • UN rights chief urges ‘massive rethink’ of US immigration policies ahead of World Cup

    The UN’s top human rights official has called for a ‘massive rethink’ of US immigration and security policies ahead of the World Cup, warning that racial profiling, surveillance and aggressive enforcement are already affecting teams, officials and supporters. 
  • ‘The day never stops’ for aid workers braving missiles and drones in Ukraine

    As Russia’s full-scale invasion of Ukraine enters its fifth year, conditions in southern Ukraine have rapidly deteriorated. Maintaining humanitarian operations has become an increasingly complex balancing act between enabling aid delivery and managing risk.
  • EU Plans Massive 21st Sanctions Package to Target Russian Banks and Crypto

    The European Union is preparing to launch its 21st sanctions package against Russia, aiming to deliver a sweeping blow to Moscow’s financial infrastructure and wartime supply chains.

    “We intend to deal a heavy blow to Russia’s financial sector, imposing asset freezes on close to 90 banks and additional transaction bans on over 30 banks in Russia and other third countries,” announced EU Foreign Policy Chief Kaja Kallas on X.

    Beyond traditional banking, the upcoming measures will target 11 cryptocurrency platforms accused of helping Moscow circumvent Western financial restrictions. Alongside these targeted measures, the EU plans to tighten its blanket ban on providing crypto-asset services to designated third countries.

    The industrial and energy sectors will also face renewed pressure. The new restrictions are designed to directly squeeze Russian drone production while clamping down on domestic oil traders and refiners.

    Finally, to combat sanctions evasion, the package imposes trade controls on 50 companies operating outside of Russia. This includes entities based in China, Türkiye, Kyrgyzstan, Kazakhstan, the UAE, and India.

  • The Informal Governance of Global Capitalism

    This post concludes a symposium on international law under the second Trump administration. Read the rest of the posts here. ** ** ** It has been widely observed that a key characteristic of Trump 2.0 is the marginalization of international law. As the administration has turned away from the post-Cold War world order and undermined various international institutions, most notably the WTO…

    Source

  • Up to 15 Years in Prison Sought for Azerbaijani Journalists in Deepening Crackdown

    An Azerbaijani prosecutor has demanded prison sentences of up to 15 years for a team of independent journalists facing financial crimes charges, prompting fierce condemnation from international press freedom groups who describe the trial as a severe escalation in the country’s crackdown on the media.

    During a hearing on June 8 at the Baku Court of Grave Crimes, the state prosecutor, Rauf Malyshov, reportedly requested sentences ranging from 13 to 15 years for four staff members of Toplum TV, an independent news site known for its critical coverage of human rights abuses and state corruption.

    The defendants—co-founder Alasgar Mammadli, video editor Mushfig Jabbar, reporter Farid Ismailyov, and social media manager Elmir Abbasov—were swept up in a March 2024 police raid on their offices. Authorities initially charged the journalists with “currency smuggling,” later expanding the indictment to encompass a broader array of financial crimes.

    The journalists have strongly denied the charges, arguing that the prosecution is direct retaliation for their investigative reporting.

    The prosecution’s demands in the case extend beyond the Toplum TV team. Malyshov also requested 16-year sentences for two prominent pro-democracy activists, Ruslan Izzetli and Akif Gurbanov, and terms ranging from 14 to 15 years for three other civil society workers who are being prosecuted in the same case.

    The state prosecutor’s demands drew a prompt backlash from rights watchdogs, who have long accused the government in Baku of weaponizing the judicial system to silence dissent.

    Marie Struthers, Amnesty International’s Director for Eastern Europe and Central Asia, told OCCRP that the sentencing recommendation “demonstrates that the authorities are not easing their assault on independent journalism but intensifying it.” She added that “international pressure has so far failed to halt the repression,” urging those with “influence and leverage” over Azerbaijan to intervene.

    Press freedom advocates noted that the requested prison terms mark an escalation in the state’s tactics.

    Jeanne Cavelier, head of the Eastern Europe and Central Asia desk at Reporters Without Borders, told OCCRP that the prosecutor’s request “appears designed not only to punish critical reporting, but to retaliate against outspoken critics of the government and deter other journalists from continuing their work, even from behind bars.”

    Cavelier pointed out that the proposed sentences are significantly “harsher” than those handed down just a year ago. In June 2025, the same Baku court sentenced staff members from the investigative outlet Abzas Media and a journalist at RFE/RL’s Azerbaijani service to up to nine years in prison following a financial crimes trial that international observers widely condemned as a sham.

    “The severity of these proposed sentences underscores just how threatened Azerbaijani authorities are by reporting that exposes high-level corruption,” said Gulnoza Said, Europe and Central Asia Program Coordinator at the Committee to Protect Journalists.

    The Toplum TV staff are among at least two dozen media workers who have been detained since late 2023 in what rights groups describe as an unprecedented crackdown on the free press in Azerbaijan. Many of those detained have been charged with financial offenses. Among those targeted are journalists from OCCRP’s member center Meydan TV, who currently face up to 12 years in prison following their arrests in December 2024.

    Struthers, Cavelier, and Said all urged for the immediate release of all of the detained Azerbaijani journalists and media workers. 

    The trial of the Toplum TV journalists and their co-defendants is set to continue, with the next court date scheduled for June 22.