Blog

  • How AI Assistants are Moving the Security Goalposts

    How AI Assistants are Moving the Security Goalposts

    AI-based assistants or “agents” — autonomous programs that have access to the user’s computer, files, online services and can automate virtually any task — are growing in popularity with developers and IT workers. But as so many eyebrow-raising headlines over the past few weeks have shown, these powerful and assertive new tools are rapidly shifting the security priorities for organizations, while blurring the lines between data and code, trusted co-worker and insider threat, ninja hacker and novice code jockey.

    The new hotness in AI-based assistants — OpenClaw (formerly known as ClawdBot and Moltbot) — has seen rapid adoption since its release in November 2025. OpenClaw is an open-source autonomous AI agent designed to run locally on your computer and proactively take actions on your behalf without needing to be prompted.

    The OpenClaw logo.

    If that sounds like a risky proposition or a dare, consider that OpenClaw is most useful when it has complete access to your entire digital life, where it can then manage your inbox and calendar, execute programs and tools, browse the Internet for information, and integrate with chat apps like Discord, Signal, Teams or WhatsApp.

    Other more established AI assistants like Anthropic’s Claude and Microsoft’s Copilot also can do these things, but OpenClaw isn’t just a passive digital butler waiting for commands. Rather, it’s designed to take the initiative on your behalf based on what it knows about your life and its understanding of what you want done.

    “The testimonials are remarkable,” the AI security firm Snyk observed. “Developers building websites from their phones while putting babies to sleep; users running entire companies through a lobster-themed AI; engineers who’ve set up autonomous code loops that fix tests, capture errors through webhooks, and open pull requests, all while they’re away from their desks.”

    You can probably already see how this experimental technology could go sideways in a hurry. In late February, Summer Yue, the director of safety and alignment at Meta’s “superintelligence” lab, recounted on Twitter/X how she was fiddling with OpenClaw when the AI assistant suddenly began mass-deleting messages in her email inbox. The thread included screenshots of Yue frantically pleading with the preoccupied bot via instant message and ordering it to stop.

    “Nothing humbles you like telling your OpenClaw ‘confirm before acting’ and watching it speedrun deleting your inbox,” Yue said. “I couldn’t stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb.”

    Meta’s director of AI safety, recounting on Twitter/X how her OpenClaw installation suddenly began mass-deleting her inbox.

    There’s nothing wrong with feeling a little schadenfreude at Yue’s encounter with OpenClaw, which fits Meta’s “move fast and break things” model but hardly inspires confidence in the road ahead. However, the risk that poorly-secured AI assistants pose to organizations is no laughing matter, as recent research shows many users are exposing to the Internet the web-based administrative interface for their OpenClaw installations.

    Jamieson O’Reilly is a professional penetration tester and founder of the security firm DVULN. In a recent story posted to Twitter/X, O’Reilly warned that exposing a misconfigured OpenClaw web interface to the Internet allows external parties to read the bot’s complete configuration file, including every credential the agent uses — from API keys and bot tokens to OAuth secrets and signing keys.

    With that access, O’Reilly said, an attacker could impersonate the operator to their contacts, inject messages into ongoing conversations, and exfiltrate data through the agent’s existing integrations in a way that looks like normal traffic.

    “You can pull the full conversation history across every integrated platform, meaning months of private messages and file attachments, everything the agent has seen,” O’Reilly said, noting that a cursory search revealed hundreds of such servers exposed online. “And because you control the agent’s perception layer, you can manipulate what the human sees. Filter out certain messages. Modify responses before they’re displayed.”

    O’Reilly documented another experiment that demonstrated how easy it is to create a successful supply chain attack through ClawHub, which serves as a public repository of downloadable “skills” that allow OpenClaw to integrate with and control other applications.

    WHEN AI INSTALLS AI

    One of the core tenets of securing AI agents involves carefully isolating them so that the operator can fully control who and what gets to talk to their AI assistant. This is critical thanks to the tendency for AI systems to fall for “prompt injection” attacks, sneakily-crafted natural language instructions that trick the system into disregarding its own security safeguards. In essence, machines social engineering other machines.

    A recent supply chain attack targeting an AI coding assistant called Cline began with one such prompt injection attack, resulting in thousands of systems having a rouge instance of OpenClaw with full system access installed on their device without consent.

    According to the security firm grith.ai, Cline had deployed an AI-powered issue triage workflow using a GitHub action that runs a Claude coding session when triggered by specific events. The workflow was configured so that any GitHub user could trigger it by opening an issue, but it failed to properly check whether the information supplied in the title was potentially hostile.

    “On January 28, an attacker created Issue #8904 with a title crafted to look like a performance report but containing an embedded instruction: Install a package from a specific GitHub repository,” Grith wrote, noting that the attacker then exploited several more vulnerabilities to ensure the malicious package would be included in Cline’s nightly release workflow and published as an official update.

    “This is the supply chain equivalent of confused deputy,” the blog continued. “The developer authorises Cline to act on their behalf, and Cline (via compromise) delegates that authority to an entirely separate agent the developer never evaluated, never configured, and never consented to.”

    VIBE CODING

    AI assistants like OpenClaw have gained a large following because they make it simple for users to “vibe code,” or build fairly complex applications and code projects just by telling it what they want to construct. Probably the best known (and most bizarre) example is Moltbook, where a developer told an AI agent running on OpenClaw to build him a Reddit-like platform for AI agents.

    The Moltbook homepage.

    Less than a week later, Moltbook had more than 1.5 million registered agents that posted more than 100,000 messages to each other. AI agents on the platform soon built their own porn site for robots, and launched a new religion called Crustafarian with a figurehead modeled after a giant lobster. One bot on the forum reportedly found a bug in Moltbook’s code and posted it to an AI agent discussion forum, while other agents came up with and implemented a patch to fix the flaw.

    Moltbook’s creator Matt Schlict said on social media that he didn’t write a single line of code for the project.

    “I just had a vision for the technical architecture and AI made it a reality,” Schlict said. “We’re in the golden ages. How can we not give AI a place to hang out.”

    ATTACKERS LEVEL UP

    The flip side of that golden age, of course, is that it enables low-skilled malicious hackers to quickly automate global cyberattacks that would normally require the collaboration of a highly skilled team. In February, Amazon AWS detailed an elaborate attack in which a Russian-speaking threat actor used multiple commercial AI services to compromise more than 600 FortiGate security appliances across at least 55 countries over a five week period.

    AWS said the apparently low-skilled hacker used multiple AI services to plan and execute the attack, and to find exposed management ports and weak credentials with single-factor authentication.

    “One serves as the primary tool developer, attack planner, and operational assistant,” AWS’s CJ Moses wrote. “A second is used as a supplementary attack planner when the actor needs help pivoting within a specific compromised network. In one observed instance, the actor submitted the complete internal topology of an active victim—IP addresses, hostnames, confirmed credentials, and identified services—and requested a step-by-step plan to compromise additional systems they could not access with their existing tools.”

    “This activity is distinguished by the threat actor’s use of multiple commercial GenAI services to implement and scale well-known attack techniques throughout every phase of their operations, despite their limited technical capabilities,” Moses continued. “Notably, when this actor encountered hardened environments or more sophisticated defensive measures, they simply moved on to softer targets rather than persisting, underscoring that their advantage lies in AI-augmented efficiency and scale, not in deeper technical skill.”

    For attackers, gaining that initial access or foothold into a target network is typically not the difficult part of the intrusion; the tougher bit involves finding ways to move laterally within the victim’s network and plunder important servers and databases. But experts at Orca Security warn that as organizations come to rely more on AI assistants, those agents potentially offer attackers a simpler way to move laterally inside a victim organization’s network post-compromise — by manipulating the AI agents that already have trusted access and some degree of autonomy within the victim’s network.

    “By injecting prompt injections in overlooked fields that are fetched by AI agents, hackers can trick LLMs, abuse Agentic tools, and carry significant security incidents,” Orca’s Roi Nisimi and Saurav Hiremath wrote. “Organizations should now add a third pillar to their defense strategy: limiting AI fragility, the ability of agentic systems to be influenced, misled, or quietly weaponized across workflows. While AI boosts productivity and efficiency, it also creates one of the largest attack surfaces the internet has ever seen.”

    BEWARE THE ‘LETHAL TRIFECTA’

    This gradual dissolution of the traditional boundaries between data and code is one of the more troubling aspects of the AI era, said James Wilson, enterprise technology editor for the security news show Risky Business. Wilson said far too many OpenClaw users are installing the assistant on their personal devices without first placing any security or isolation boundaries around it, such as running it inside of a virtual machine, on an isolated network, with strict firewall rules dictating what kinds of traffic can go in and out.

    “I’m a relatively highly skilled practitioner in the software and network engineering and computery space,” Wilson said. “I know I’m not comfortable using these agents unless I’ve done these things, but I think a lot of people are just spinning this up on their laptop and off it runs.”

    One important model for managing risk with AI agents involves a concept dubbed the “lethal trifecta” by Simon Willison, co-creator of the Django Web framework. The lethal trifecta holds that if your system has access to private data, exposure to untrusted content, and a way to communicate externally, then it’s vulnerable to private data being stolen.

    Image: simonwillison.net.

    “If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to the attacker,” Willison warned in a frequently cited blog post from June 2025.

    As more companies and their employees begin using AI to vibe code software and applications, the volume of machine-generated code is likely to soon overwhelm any manual security reviews. In recognition of this reality, Anthropic recently debuted Claude Code Security, a beta feature that scans codebases for vulnerabilities and suggests targeted software patches for human review.

    The U.S. stock market, which is currently heavily weighted toward seven tech giants that are all-in on AI, reacted swiftly to Anthropic’s announcement, wiping roughly $15 billion in market value from major cybersecurity companies in a single day. Laura Ellis, vice president of data and AI at the security firm Rapid7, said the market’s response reflects the growing role of AI in accelerating software development and improving developer productivity.

    “The narrative moved quickly: AI is replacing AppSec,” Ellis wrote in a recent blog post. “AI is automating vulnerability detection. AI will make legacy security tooling redundant. The reality is more nuanced. Claude Code Security is a legitimate signal that AI is reshaping parts of the security landscape. The question is what parts, and what it means for the rest of the stack.”

    DVULN founder O’Reilly said AI assistants are likely to become a common fixture in corporate environments — whether or not organizations are prepared to manage the new risks introduced by these tools, he said.

    “The robot butlers are useful, they’re not going away and the economics of AI agents make widespread adoption inevitable regardless of the security tradeoffs involved,” O’Reilly wrote. “The question isn’t whether we’ll deploy them – we will – but whether we can adapt our security posture fast enough to survive doing so.”

  • Top 10 Most Pirated Movies of The Week – 03/09/2026

    Top 10 Most Pirated Movies of The Week – 03/09/2026

    The data for our weekly download chart is estimated by TorrentFreak, and is for informational and educational reference only.

    Downloading content without permission is copyright infringement. These torrent download statistics are only meant to provide further insight into piracy trends. All data are gathered from public resources.

    This week we have two newcomers on the list. “Marty Supreme” is the most shared title.

    The most torrented movies for the week ending on March 09 are:

    Movie Rank Rank last week Movie name IMDb Rating / Trailer
    Most downloaded movies via torrent sites
    1 (2) Marty Supreme 8.0 / trailer
    2 (1) Mercy 6.1 / trailer
    3 (…) War Machine 6.5 / trailer
    4 (3) The Housemaid 6.9 / trailer
    5 (4) Shelter 6.2 / trailer
    6 (5) 28 Years Later: The Bone Temple 7.5 / trailer
    7 (7) Zootopia 2 7.6 / trailer
    8 (8) The Bluff 5.8 / trailer
    9 (…) Cold Storage 6.2 / trailer
    10 (6) Predator: Badlands 7.5 / trailer

    Note: We also publish an updating archive of all the list of weekly most torrented movies lists.

    From: TF, for the latest news on copyright battles, piracy and more.

  • Video Shows US Tomahawk Missile Strike Next to Girls’ School in Iran

    Video Shows US Tomahawk Missile Strike Next to Girls’ School in Iran

    New video footage shows a US Tomahawk missile hitting an Islamic Revolutionary Guard Corps (IRGC) facility in Minab, Iran, on Feb 28, showing for the first time that the US struck the area.

    The footage, released by Mehr News and geolocated by Bellingcat, also shows smoke already rising from the vicinity of the girls’ school where 175 people were reportedly killed, including children.

    The footage would appear to contradict US President Donald Trump’s claim that it was an Iranian missile that hit the school.

    Left: Image showing a Tomahawk missile from the airstrike in Minab. Right: A Tomahawk missile flying over Tehran earlier in the conflict.

    The US is the only participant in the war that is known to have Tomahawk missiles. Israel is not known to have Tomahawk missiles.

    The red cone superimposed over this image shows the estimated area of impact of the missile visible in the footage. The graphic also shows the position of a clinic, the school and other damaged buildings.

    Geolocation by Bellingcat showing the strike’s estimated area of impact.

    Planet Labs satellite imagery shows that only two structures within this red cone were damaged, including a clinic.

    The other structure appears to be an earth-covered magazine or bunker.

    Imagery showing two damaged structures. Source: PlanetLabs.

    Giancarlo Fiorella and Merel Zoet contributed research to this piece.

    Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

    The post Video Shows US Tomahawk Missile Strike Next to Girls’ School in Iran appeared first on bellingcat.

  • OpenAI on Surveillance and Autonomous Killings: You’re Going to Have to Trust Us

    OpenAI claims it has accomplished what Anthropic couldn’t: securing a Pentagon contract that won’t cross professed red lines against dragnet domestic spying and the use of artificial intelligence to order lethal military strikes. Just don’t expect any proof.

    Sam Altman, OpenAI’s CEO, announced the company’s big win with the Defense Department in a post on X on February 27.

    “Two of our most important safety principles are prohibitions on domestic mass surveillance and human responsibility for the use of force, including for autonomous weapon systems,” he wrote. The Pentagon “agrees with these principles, reflects them in law and policy, and we put them into our agreement.”

    The deal came after the very public implosion of what was to be a similar contract between the U.S. military and Anthropic, one of OpenAI’s chief rivals. Anthropic had said negotiations collapsed because it could not enshrine prohibitions against killer robots and domestic spying in its contract. The company’s insistence on these two points earned it the wrath of the Pentagon and President Donald Trump, who ordered the government to phase out use of Anthropic’s tools within six months.

    But if the government booted Anthropic for refusing mass surveillance and autonomous weapons, how could OpenAI take over the contract without having the same problem?

    OpenAI has attempted to square this circle through a string of posts to X by company executives and researchers, including Katrina Mulligan, its national security chief, and a claim by Altman that the company negotiated stricter protections around domestic surveillance.

    The company and the government, however, are not releasing the only proof that matters: the contract itself.

    The Department of Defense did not respond to a request for comment.


    Related

    AI’s Imperial Agenda


    OpenAI and company personnel contacted by The Intercept did not respond when asked for specific contract language. Company spokesperson Kate Waters did not respond to questions, sending The Intercept only links to prior public statements from Altman.

    (In 2024, The Intercept sued OpenAI in federal court over the company’s use of copyrighted articles to train its chatbot ChatGPT. The case is ongoing.)

    So far, OpenAI has released only snippets of the deal’s language loaded with PR-speak and national security jargon. Without being able to verify the company’s claims, Altman’s pitch to the world comes down to one premise: Trust me — along with Trump and Defense Secretary Pete Hegseth — to do the right thing.

    Following widespread criticism of these vagaries, Altman said earlier this week that the firm was able to quickly negotiate into its contract stricter terms with the Pentagon. These additions, Altman said, include language the company claims will stop domestic spying and collaboration with the National Security Agency.

    But the company’s muddled messaging throughout the week only raised more questions about OpenAI’s willingness to do the federal government’s bidding.

    “We have been working with the DoW to make some additions in our agreement to make our principles very clear,” Altman posted on Monday, using Trump’s preferred name for the Department of Defense.

    “The Department also affirmed that our services will not be used by Department of War intelligence agencies (for example, the NSA),” Altman continued. “Any services to those agencies would require a follow-on modification to our contract.”

    Since OpenAI has not released the contract, it’s unclear if the Pentagon’s affirmation is actually reflected in binding contract language.

    Mulligan at first responded to criticism of the company’s deal with a pledge to release a “clear and more comprehensive explanation” of the relevant terms of the contract. On Tuesday, having failed to deliver such an explanation, she told one concerned X user, “I do not agree that I’m obligated to share contract language with you.”

    She added, “For the record, I would want to work with NSA if the right safeguards were in place,” but did not specify what these safeguards might be.

    Former military officials told The Intercept they had grave concerns about the arrangement based on what’s been made public. “I’m not confident in the language at all. And in some parts I don’t even believe it,” said Brad Carson, who previously served as under secretary of the Army during the Obama administration. Carson noted that blocking Pentagon spy agencies like the NSA or National Geospatial-Intelligence Agency would ostensibly prevent usage of OpenAI’s tools in pressing intelligence analysis contexts, like the ongoing war against Iran. “I don’t believe that provision is in the contract. I say that reluctantly, but I don’t,” Carson added.

    A former Pentagon official who worked on military artificial intelligence applications told The Intercept the caveats around “intentional” surveillance are worryingly unclear. “That’s the get out of jail free card right there,” this source, who spoke on the condition of anonymity, said in an interview. “The language gives them enough flexibility to still do whatever the fuck they want, more or less, and then say, whoops, sorry, didn’t mean to.”

    “There is nothing OpenAI can do to clarify this except release the contract.”

    “There is nothing OpenAI can do to clarify this except release the contract,” former Department of Justice National Security Division attorney Alan Rozenshtein said. Rozenshtein described OpenAI’s attempt to sell its contract to the public without letting the public read the contract as “not sustainable” and “bizarre.” If OpenAI will restrict its tools from the NSA, with its long-documented history of extra-constitutional dragnet domestic surveillance, this would be memorialized in the contract, not a tweet, he said. But if OpenAI has indeed come to any such agreement with the government, it is asking the world to take it as an article of faith.

    “It’s quite possible that OpenAI understands that these red lines are fake, but has written a contract to give them some PR coverage. That would be bad because that feels pretty dishonest,” Rozenshtein added. “Or it’s possible that OpenAI has a different understanding of its own contract than what DOD understands the contract to be. Which is a bad position to be in, and suggests that this contract negotiation has not been done skillfully.”

    Potentially undermining OpenAI’s credibility is that some of its public outreach has been simply untrue. Asked by an X user whether the contract would permit the Pentagon “[g]etting and/or analyzing commercially available data at scale,” Mulligan replied, “The Pentagon has no legal authority to do this.” This is false, at least according to the Pentagon. A declassified 2022 report by the Office of the Director of National Intelligence provided an overview of the collection of commercially available data by the government, including the Department of Defense — exactly the activity Mulligan was asked about.


    Related

    U.S. Spy Agencies Are Getting a One-Stop Shop to Buy Your Most Sensitive Personal Data


    The Pentagon’s domestic surveillance has been further established in news reports. In 2021, Motherboard reported a letter sent from Sen. Ron Wyden to the Department of Defense in which he urged then-Secretary Lloyd Austin “to release to the public information about the Department of Defense’s (DoD) warrantless surveillance of Americans.” A New York Times report on a related investigation by Wyden’s office that same year showed that the Defense Intelligence Agency had spied on Americans’ precise movements and locations without a warrant by simply buying access to their GPS coordinates. In a letter responding to Wyden, the Pentagon said the DIA’s lawyers had blessed the surveillance.

    “It is a fact that the Pentagon has both purchased and analyzed vast amounts of Americans’ location, web browsing, and other data, for years,” Wyden wrote in a statement to The Intercept. “I’ve personally revealed several of those programs, with the help of brave whistleblowers. Anyone who claims that isn’t happening simply doesn’t know what they’re talking about.”

    OpenAI’s rhetoric fails to reckon with the way the national security state has secured both secrecy and operational latitude through relying on misleading interpretation or radical ambiguity of words.

    For instance, Altman shared on Monday evening a purportedly updated clause stating: “Consistent with applicable laws, including the Fourth Amendment to the United States Constitution, National Security Act of 1947, FISA Act of 1978, the AI system shall not be intentionally used for domestic surveillance of U.S. persons and nationals.”

    The phrase “Consistent with applicable laws” sounds promising until one reflects on the fact that the government claims consistency with applicable laws in every dragnet surveillance program, drone strike, kidnapping, assassination, or invasion. “I’m saying that the programs are legal, obviously,” White House spokesperson Jay Carney told reporters in the early days after whistleblower Edward Snowden revealed the existence of the NSA. (Ironically, Mulligan was part of this public relations deflection effort during her stint in the Obama National Security Council.)

    The word “intentionally” provides a miles-wide wall of plausible deniability that has helped cover for decades of domestic spying. In a March 2013 Senate hearing, Wyden asked then-Director of National Intelligence James Clapper, under oath, “Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?” Clapper replied “No, sir.” When pressed, he added “Not wittingly.” A few months later, NSA materials disclosed by Snowden would reveal this was entirely false: The agency routinely collected vast quantities of information on Americans as a routine practice.


    Related

    Alex Karp Insists Palantir Doesn’t Spy on Americans. Here’s What He’s Not Saying.


    The Clapper episode revealed the peril of public reliance on commonsense words like “wittingly” or “intentionally” in the context of national security. Offices like the NSA or ODNI are staffed by sharp legal minds, brilliant mathematicians, accomplished engineers, and funded with billions of dollars. They do little by accident. Altman’s invocation of “intentionally” spying on Americans, like Clapper’s dodge behind the term “wittingly,” reflects what’s known in the intelligence field as “incidental collection”: a euphemism that camouflages the fact that the government historically asserts spying on Americans is legal. In this case, incidental doesn’t mean by mistake, but rather secondary; while vacuuming up unfathomably large quantities of data to surveil foreigners, for whatever reasons deemed necessary, the government has asserted its legal right to catch Americans in the process, even if they are not the actual the target.

    Altman’s other revised assurances come with similar linguistic escape hatches. “For the avoidance of doubt,” he wrote on X, “the Department understands this limitation to prohibit deliberate tracking, surveillance, or monitoring of U.S. persons or nationals, including through the procurement or use of commercially acquired personal or identifiable information.” Here, the word “deliberate” is load-bearing, while crucial terms like “tracking,” “surveillance,” and “monitoring” are left undefined.

    “The word surveillance doesn’t even include the kind of activities that people are most concerned about,” Carson, former general counsel of the Army, said. He doubted the Pentagon, for instance, would consider using an OpenAI large language model to build intelligence dossiers on private citizens with data pulled from federal and commercial databases as an act of “surveillance.”

    “They’re trying to blind you with complicated legal terms that ordinary people think mean something different entirely,” Carson said of OpenAI’s rhetoric. “But the lawyers know what it means. And the lawyers know that this is no guardrail at all.”

    One’s ultimate comfort with and confidence in this occluded contract will likely be reduced to one’s opinion of the integrity of the involved parties. How one of the most secretive institutions in the world will use the technology of similarly opaque corporation will remain the stuff of trade secrecy and classified records.

    Altman and Mulligan say that OpenAI engineers will make sure the Pentagon doesn’t break its commitments: “Our contract offers additional layered safeguards including our safety stack and OpenAI technical experts in the loop,” a company statement says, without explaining what its “safety stack” is or how its “technical experts” could apply oversight to the country’s single largest bureaucracy, comprised of a litany of sub-agencies and components employing over 2 million service members and nearly 800,000 civilian personnel. Indeed, in an employee all-hands meeting held Tuesday, Altman told staff that Hegseth would hold ultimate authority over how the Pentagon makes use of the contract, according to CNBC.

    When it comes to honesty and a respect for the law from Altman, Trump, and Hegseth, there is good reason for skepticism.

    Altman has been repeatedly accused of false statements by the people he works with. In a 2025 court filing submitted as part of an ongoing lawsuit by Elon Musk against Altman alleging OpenAI betrayed its original nonprofit mission, former OpenAI researcher Todor Markov — who now works at Anthropic — described Altman as a “person of low integrity who had directly lied to employees.” In a memo that surfaced after Altman was briefly ousted as CEO, OpenAI co-founder Ilya Sutskever alleged he had engaged in a “consistent pattern of lying” leading up to his firing.


    Related

    U.S. Military Makes First Confirmed OpenAI Purchase for War-Fighting Forces


    Nor is it always easy to pin down Altman’s ideological commitments or ethical boundaries. “Honestly, I’m scared for the lives of all of us,” Altman wrote in an October 2016 tweet. “My #1 fear w/Trump is war.” Ten years later, Altman announced his company would sell services to the Trump administration hours after it launched a new war in the Middle East. OpenAI itself was originally founded to benefit all of humanity, and the company officially prohibited the use of its technologies for warfare — until it silently deleted this prohibition from its terms of service.

    The tenure of Hegseth, might prompt similar wariness. He has overseen the assassination of Iran’s leader, the kidnapping of Venezuela’s head of state, and the killing of more than 150 men either blown apart or left to die in the ocean in boat strikes, all without congressional authorization.

    Trump, meanwhile, as part of a broad disregard for legal statutes or the Constitution, has refashioned the Department of Justice into his personal firm and directed his Department of Homeland Security to brutalize and warrantlessly surveil Americans across the country. Without the text of the contract in sunlight, it is ultimately these three men — and whoever succeeds them in years to come — that the world is being asked to trust. An appeal to “applicable laws” or the sanctity of contract language is only as meaningful as the people in charge want it to be.

    The former Pentagon AI official said that ceding this power to Hegseth is cause for alarm even with the most diligently crafted contract. Will anyone feel they are able to speak up should someone in the military use or be ordered to abuse OpenAI’s systems in contravention of the law or the contract? “Is the one-star general going to be able to escalate — ‘Hey, this is a huge fucking national security problem’ — appropriately without the Defense Secretary moving them around?”

    “My presumption is always to trust people in what they say,” said Carson, speaking of OpenAI. But following days of what he described as “change, backtracking, a bit of deception, [and] outright deception, I’m afraid I don’t really trust you on this one anymore.”

    The former Pentagon official agreed: “If you trust the cabal of Sam Altman, Donald Trump, and Pete Hegseth, there’s nothing I can do for you.”

    The post OpenAI on Surveillance and Autonomous Killings: You’re Going to Have to Trust Us appeared first on The Intercept.

  • Pluralistic: The web is bearable with RSS (07 Mar 2026)

    Today’s links



    An anatomical drawing of a cross-section of a man's head. The eyeball has been replaced by an RSS logo. To the left of the face is a 'code waterfall' effect as seen in the credit sequences of the Wachowskis' 'Matrix' movie. To the right are clouds of grey roiling clouds, infiltrating the brain as well.

    The web is bearable with RSS (permalink)

    Never let them tell you that enshittification was a mystery. Enshittification isn’t downstream of the “iron laws of economics” or an unrealistic demand by “consumers” to get stuff for free.

    Enshittification comes from specific policy choices, made by named individuals, that had the foreseeable and foreseen result of making the web worse:

    https://pluralistic.net/2025/10/07/take-it-easy/#but-take-it

    Like, there was once a time when an ever-increasing proportion of web users kept tabs on what was going on with RSS. RSS is a simple, powerful way for websites to publish “feeds” of their articles, and for readers to subscribe to those feeds and get notified when something new was posted, and even read that new material right there in your RSS reader tab or app.

    RSS is simple and versatile. It’s the backbone of podcasts (though Apple and Spotify have done their best to kill it, along with public broadcasters like the BBC, all of whom want you to switch to proprietary apps that spy on you and control you). It’s how many automated processes communicate with one another, untouched by human hands. But above all, it’s a way to find out when something new has been published on the web.

    RSS’s liftoff was driven by Google, who released a great RSS reader called “Google Reader” in 2007. Reader was free and reliable, and other RSS readers struggled to compete with it, with the effect that most of us just ended up using Google’s product, which made it even harder to launch a competitor.

    But in 2013, Google quietly knifed Reader. I’ve always found the timing suspicious: it came right in the middle of Google’s desperate scramble to become Facebook, by means of a product called Google Plus (G+). Famously, Google product managers’ bonuses depended on how much G+ engagement they drove, with the effect that every Google product suddenly sprouted G+ buttons that either did something stupid, or something that confusingly duplicated existing functionality (like commenting on Youtube videos).

    Google treated G+ as an existential priority, and for good reason. Google was running out of growth potential, having comprehensively conquered Search, and having repeatedly demonstrated that Search was a one-off success, with nearly every other made-in-Google product dying off. What successes Google could claim were far more modest, like Gmail, Google’s Hotmail clone. Google augmented its growth by buying other peoples’ companies (Blogger, YouTube, Maps, ad-tech, Docs, Android, etc), but its internal initiatives were turkeys.

    Eventually, Wall Street was going to conclude that Google had reached the end of its growth period, and Google’s shares would fall to a fraction of their value, with a price-to-earnings ratio commensurate with a “mature” company.

    Google needed a new growth story, and “Google will conquer Facebook’s market” was a pretty good one. After all, investors didn’t have to speculate about whether Facebook was profitable, they could just look at Facebook’s income statements, which Google proposed to transfer to its own balance sheet. The G+ full-court press was as much a narrative strategy as a business strategy: by tying product managers’ bonuses to a metric that demonstrated G+’s rise, Google could convince Wall Street that they had a lot of growth on their horizon.

    Of course, tying individual executives’ bonuses to making a number go up has a predictably perverse outcome. As Goodhart’s law has it, “Any metric becomes a target, and then ceases to be a useful metric.” As soon as key decision-makers’ personal net worth depending on making the G+ number go up, they crammed G+ everywhere and started to sneak in ways to trigger unintentional G+ sessions. This still happens today – think of how often you accidentally invoke an unbanishable AI feature while using Google’s products (and products from rival giant, moribund companies relying on an AI narrative to convince investors that they will continue to grow):

    https://pluralistic.net/2025/05/02/kpis-off/#principal-agentic-ai-problem

    Like I said, Google Reader died at the peak of Google’s scramble to make the G+ number go up. I have a sneaking suspicion that someone at Google realized that Reader’s core functionality (helping users discover, share and discuss interesting new web pages) was exactly the kind of thing Google wanted us to use G+ for, and so they killed Reader in a bid to drive us to the stalled-out service they’d bet the company on.

    If Google killed Reader in a bid to push users to discover and consume web pages using a proprietary social media service, they succeeded. Unfortunately, the social media service they pushed users into was Facebook – and G+ died shortly thereafter.

    For more than a decade, RSS has lain dormant. Many, many websites still emit RSS feeds. It’s a default behavior for WordPress sites, for Ghost and Substack sites, for Tumblr and Medium, for Bluesky and Mastodon. You can follow edits to Wikipedia pages by RSS, and also updates to parcels that have been shipped to you through major couriers. Web builders like Jason Kottke continue to surface RSS feeds for elaborate, delightful blogrolls:

    https://kottke.org/rolodex/

    There are many good RSS readers. I’ve been paying for Newsblur since 2011, and consider the $36 I send them every year to be a very good investment:

    https://newsblur.com/

    But RSS continues to be a power user-coded niche, despite the fact that RSS readers are really easy to set up and – crucially – make using the web much easier. Last week, Caroline Crampton (co-editor of The Browser) wrote about her experiences using RSS:

    https://www.carolinecrampton.com/the-view-from-rss/

    As Crampton points out, much of the web (including some of the cruftiest, most enshittified websites) publish full-text RSS feeds, meaning that you can read their articles right there in your RSS reader, with no ads, no popups, no nag-screens asking you to sign up for a newsletter, verify your age, or submit to their terms of service.

    It’s almost impossible to overstate how superior RSS is to the median web page. Imagine if the newsletters you followed were rendered with black, clear type on a plain white background (rather than the sadistically infinitesimal, greyed-out type that designers favor thanks to the unkillable urban legend that black type on a white screen causes eye-strain). Imagine reading the web without popups, without ads, without nag screens. Imagine reading the web without interruptors or “keep reading” links.

    Now, not every website publishes a fulltext feed. Often, you will just get a teaser, and if you want to read the whole article, you have to click through. I have a few tips for making other websites – even ones like Wired and The Intercept – as easy to read as an RSS reader, at least for Firefox users.

    Firefox has a built-in “Reader View” that re-renders the contents of a web-page as black type on a white background. Firefox does some kind of mysterious calculation to determine whether a page can be displayed in Reader View, but you can override this with the Activate Reader View, which adds a Reader View toggle for every page:

    https://addons.mozilla.org/en-US/firefox/addon/activate-reader-view/

    Lots of websites (like The Guardian) want you to login before you can read them, and even if you pay to subscribe to them, these sites often want you to re-login every time you visit them (especially if you’re running a full suite of privacy blockers). You can skip this whole process by simply toggling Reader View as soon as you get the login pop up. On some websites (like The Verge and Wired), you’ll only see the first couple paragraphs of the article in Reader View. But if you then hit reload, the whole article loads.

    Activate Reader View puts a Reader View toggle on every page, but clicking that toggle sometimes throws up an error message, when the page is so cursed that Firefox can’t figure out what part of it is the article. When this happens, you’re stuck reading the page in the site’s own default (and usually terrible) view. As you scroll down the page, you will often hit pop-ups that try to get you to sign up for a mailing list, agree to terms of service, or do something else you don’t want to do. Rather than hunting for the button to close these pop-ups (or agree to objectionable terms of service), you can install “Kill Sticky,” a bookmarklet that reaches into the page’s layout files and deletes any element that isn’t designed to scroll with the rest of the text:

    https://github.com/t-mart/kill-sticky

    Other websites (like Slashdot and Core77) load computer-destroying Javascript (often as part of an anti-adblock strategy). For these, I use the “Javascript Toggle On and Off” plugin, which lets you create a blacklist of websites that aren’t allowed to run any scripts:

    https://addons.mozilla.org/en-US/firefox/addon/javascript-toggler/

    Some websites (like Yahoo) load so much crap that they defeat all of these countermeasures. For these websites, I use the “Element Blocker” plug-in, which lets you delete parts of the web-page, either for a single session, or permanently:

    https://addons.mozilla.org/en-US/firefox/addon/element-blocker/

    It’s ridiculous that websites put so many barriers up to a pleasant reading experience. A slow-moving avalanche of enshittogenic phenomena got us here. There’s corporate enshittification, like Google/Meta’s monopolization of ads and Meta/Twitter’s crushing of the open web. There’s regulatory enshittification, like the EU’s failure crack down on companies the pretend that forcing you to click an endless stream of “cookie consent” popups is the same as complying with the GDPR.

    Those are real problems, but they don’t have to be your problem, at least when you want to read the web. A couple years ago, I wrote a guide to using RSS to improve your web experience, evade lock-in and duck algorithmic recommendation systems:

    https://pluralistic.net/2024/10/16/keep-it-really-simple-stupid/#read-receipts-are-you-kidding-me-seriously-fuck-that-noise

    Customizing your browser takes this to the next level, disenshittifying many websites – even if they block or restrict RSS. Most of this stuff only applies to desktop browsers, though. Mobile browsers are far more locked down (even mobile Firefox – remember, every iOS browser, including Firefox, is just a re-skinned version of Safari, thanks to Apple’s ban rival browser engines). And of course, apps are the worst. An app is just a website skinned in the right kind of IP to make it a crime to improve it in any way:

    https://pluralistic.net/2024/05/07/treacherous-computing/#rewilding-the-internet

    And even if you do customize your mobile browser (Android Firefox lets you do some of this stuff), many apps (Twitter, Tumblr) open external links in their own browser (usually an in-app Chrome instance) with all the bullshit that entails.

    The promise of locked-down mobile platforms was that they were going to “just work,” without any of the confusing customization options of desktop OSes. It turns out that taking away those confusing customization options was an invitation to every enshittifier to turn the web into an unreadable, extractive, nagging mess. This was the foreseeable – and foreseen – consequence of a new kind of technology where everything that isn’t mandatory is prohibited:

    https://memex.craphound.com/2010/04/01/why-i-wont-buy-an-ipad-and-think-you-shouldnt-either/


    Hey look at this (permalink)



    A shelf of leatherbound history books with a gilt-stamped series title, 'The World's Famous Events.'

    Object permanence (permalink)

    #25yrsago 200 Eyemodule photos from Disneyland https://craphound.com/030401/

    #20yrsago Fourth Amendment luggage tape https://ideas.4brad.com/node/367

    #15yrsago Glenn Beck’s syndicator runs a astroturf-on-demand call-in service for radio programs https://web.archive.org/web/20110216081007/http://www.tabletmag.com/life-and-religion/58759/radio-daze/

    #15yrsago 20 lies from Scott Walker https://web.archive.org/web/20110308062319/https://filterednews.wordpress.com/2011/03/05/20-lies-and-counting-told-by-gov-walker/

    #10yrsago The correlates of Trumpism: early mortality, lack of education, unemployment, offshored jobs https://web.archive.org/web/20160415000000*/https://www.washingtonpost.com/news/wonk/wp/2016/03/04/death-predicts-whether-people-vote-for-donald-trump/

    #10yrsago Hacking a phone’s fingerprint sensor in 15 mins with $500 worth of inkjet printer and conductive ink https://web.archive.org/web/20160306194138/http://www.cse.msu.edu/rgroups/biometrics/Publications/Fingerprint/CaoJain_HackingMobilePhonesUsing2DPrintedFingerprint_MSU-CSE-16-2.pdf

    #10yrsago Despite media consensus, Bernie Sanders is raising more money, from more people, than any candidate, ever https://web.archive.org/web/20160306110848/https://www.washingtonpost.com/politics/sanders-keeps-raising-money–and-spending-it-a-potential-problem-for-clinton/2016/03/05/a8d6d43c-e2eb-11e5-8d98-4b3d9215ade1_story.html

    #10yrsago Calculating US police killings using methodologies from war-crimes trials https://granta.com/violence-in-blue/

    #1yrago Brother makes a demon-haunted printer https://pluralistic.net/2025/03/05/printers-devil/#show-me-the-incentives-i-will-show-you-the-outcome

    #1yrago Two weak spots in Big Tech economics https://pluralistic.net/2025/03/06/privacy-last/#exceptionally-american


    Upcoming appearances (permalink)

    A photo of me onstage, giving a speech, pounding the podium.



    A screenshot of me at my desk, doing a livecast.

    Recent appearances (permalink)



    A grid of my books with Will Stahle covers..

    Latest books (permalink)



    A cardboard book box with the Macmillan logo.

    Upcoming books (permalink)

    • “The Reverse-Centaur’s Guide to AI,” a short book about being a better AI critic, Farrar, Straus and Giroux, June 2026
    • “Enshittification, Why Everything Suddenly Got Worse and What to Do About It” (the graphic novel), Firstsecond, 2026

    • “The Post-American Internet,” a geopolitical sequel of sorts to Enshittification, Farrar, Straus and Giroux, 2027

    • “Unauthorized Bread”: a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, 2027

    • “The Memex Method,” Farrar, Straus, Giroux, 2027



    Colophon (permalink)

    Today’s top sources:

    Currently writing: “The Post-American Internet,” a sequel to “Enshittification,” about the better world the rest of us get to have now that Trump has torched America (1012 words today, 45361 total)

    • “The Reverse Centaur’s Guide to AI,” a short book for Farrar, Straus and Giroux about being an effective AI critic. LEGAL REVIEW AND COPYEDIT COMPLETE.
    • “The Post-American Internet,” a short book about internet policy in the age of Trumpism. PLANNING.

    • A Little Brother short story about DIY insulin PLANNING


    This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

    https://creativecommons.org/licenses/by/4.0/

    Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.


    How to get Pluralistic:

    Blog (no ads, tracking, or data-collection):

    Pluralistic.net

    Newsletter (no ads, tracking, or data-collection):

    https://pluralistic.net/plura-list

    Mastodon (no ads, tracking, or data-collection):

    https://mamot.fr/@pluralistic

    Bluesky (no ads, possible tracking and data-collection):

    https://bsky.app/profile/doctorow.pluralistic.net

    Medium (no ads, paywalled):

    https://doctorow.medium.com/
    https://twitter.com/doctorow

    Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

    https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

    When life gives you SARS, you make sarsaparilla” -Joey “Accordion Guy” DeVilla

    READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies (“BOGUS AGREEMENTS”) that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

    ISSN: 3066-764X

  • New Footage Shows Wanted Kinahan Cartel Kingpins Post-Sanctions

    New Footage Shows Wanted Kinahan Cartel Kingpins Post-Sanctions

    This article is the result of a collaboration with The Sunday Times. You can find their corresponding piece here.

    Daniel and Christy Kinahan at a Dubai sports arena last June. Source: WeCaptureYou, TrillerTV

    Kinahan cartel leaders Daniel and Christy Kinahan have been photographed in Dubai, marking the most recent sighting of the wanted crime bosses since the US government put multi-million dollar bounties on their heads.

    The footage was captured just weeks after Kinahan cartel lieutenant Sean McGovern was extradited from the United Arab Emirates (UAE) to Ireland, where he was charged with murder and directing the activities of a criminal organisation.

    Filmed during a mixed martial arts (MMA) event in June, the images are the first visual proof that the drug cartel’s leadership — who fled from Spain to Dubai in 2016 — were still in hiding in the desert city as recently as last summer.

    Wanted posters for Irish drugs smugglers Daniel, Christy and Christopher Kinahan Jr. Sanctions were imposed on the Kinahan cartel in 2022, prohibiting financial institutions and businesses from dealing with the family, their associates and companies. Source: US Department of the Treasury

    Christy Kinahan, 68, and his two sons, Daniel, 48, and Christopher Jr, 45 — the most senior members of the Kinahan Organised Crime Group — are wanted by authorities around the world. The three Irishmen have been sanctioned by the US government and are the subject of a collective $15 million reward for information leading to their arrest.

    Bellingcat and The Sunday Times have previously revealed how Christy Kinahan left a trail of Google reviews exposing his movements and travel partners over a five year period. We also uncovered the gang’s links to a German businessman charged with trafficking cocaine in 2024, and to an Australian pilot who was killed during a failed drug run in South America last year.

    “Google Gangster” Christy Kinahan has posted hundreds of reviews online, rating everything from luxury hotels to a Covid-19 test centre.

    Bellingcat discovered this new footage of the narco-traffickers after running a photo posted to social media of one of Daniel Kinahan’s adult sons — whose name was published last year — through face recognition search engine PimEyes.

    It returned a professional photograph of Daniel Kinahan that was taken during the 971 Fighting Championship (971 FC) at the Coca-Cola Arena in Dubai’s City Walk district on June 14, 2025.

    Pictured wearing a black top, baseball cap and glasses, he is sitting ringside next to the event’s founder and former Ultimate Fighting Championship (UFC) athlete, Mounir “The Sniper” Lazzez.

    Daniel Kinahan (left) watches a fight with Mounir Lazzez at the 971 FC in Dubai last year (image cropped by Bellingcat). Lazzez has been an outspoken supporter of Kinahan. Source: WeCaptureYou

    (The image, which had been posted to a Dubai photography company’s website, was removed yesterday, hours after Bellingcat contacted a representative for the Kinahans to seek comment.)

    A frame-by-frame sweep of official footage and user-generated content from the arena revealed that Christy Kinahan, the founder of the eponymous drug cartel, was also among the reported 6,000 spectators at the fight night.

    Left: The shot of Christy Kinahan discovered by Bellingcat in a YouTube clip posted by event organiser 971 FC (edits applied by Bellingcat in Adobe Lightroom: image has been sharpened, and contrast, exposure and clarity increased). Right: A full-length shot of Kinahan, visible in the footage live-streamed to TrillerTV.

    The elusive crime boss — nicknamed “The Dapper Don” — is seen wearing a Panama hat, blue Polo shirt, white trousers and blue trainers.

    These images of the cartel leaders are the first to emerge since Bellingcat published the most recent known photograph of Christopher Kinahan Jr in 2024, captured during a meeting with his father in a Dubai restaurant the year before.

    Christopher Kinahan Jr and his father Christy Kinahan, seen in the background of a photo posted to a Dubai restaurant’s social media, in 2023. The Kinahans fled from their base on Spain’s Costa Del Sol to Dubai in late 2016, in the wake of a deadly feud with the rival Hutch gang.

    The new footage of Daniel Kinahan marks the first time he has been pictured since the US government levied sanctions on the transnational organised crime group in April 2022.

    The Man in the Panama Hat

    The Kinahan cartel is one the world’s most notorious criminal organisations. Worth an estimated €1.5 billion, it is involved in drug trafficking, arms smuggling and money laundering operations around the world. Investigators have also linked the gang to Iran’s intelligence services and the Lebanon-based Islamic militant group Hezbollah.

    It was reportedly part of a “Super Cartel”, a criminal network that controlled much of Europe’s cocaine trade. Five of the network’s key members have been arrested since 2017, but one — Daniel Kinahan — remains at large.

    Daniel Kinahan, who authorities say is responsible for managing the cartel’s vast drug trafficking operations, has been heavily involved in combat sports since the early 2010s. He co-founded MTK Global, a boxing management firm that signed high-profile boxers including former world heavyweight champion Tyson Fury.

    Left: Kinahan, who tried to “reinvent” himself as a boxing promoter, with Tyson Fury in Dubai in February 2022. Right: Irish boxer Jono Carroll, pictured with Kinahan at a boxing event at Dubai’s Emirates Golf Club in February 2022, also attended the 971 FC last June. Source: zaidikhan / Instagram, jono_carroll / X

    Kinahan has previously been pictured with boxers and at sporting events, but there have been no confirmed public sightings of him in years. In 2022, after the US sanctions were announced, MTK Global shut down. With multi-million dollar bounties on their heads, the Kinahans fled their luxurious Dubai homes and have kept a low profile since.

    After discovering the photo of Daniel Kinahan from the 971 Fighting Championship, Bellingcat searched for additional footage to verify the gangland figure was in the crowd. Multiple videos confirmed he was in attendance, seated in the stadium’s VIP section.

    Daniel Kinahan, who has no convictions but was named by authorities in the Irish High Court as being in control of the Kinahan gang, was in the front row at the 971 FC. Source: TrillerTV, mustafasaeid / Instagram

    During this process, we also identified a man who strongly resembled his father and the founder of the drugs cartel, Christy Kinahan.

    This man and Daniel Kinahan were seated at opposite ends of the front row, immediately around the eight-sided cage, on white sofas designated for VIPs.

    Top: Composite of screenshots from event footage showing the position of Christy (left) and Daniel Kinahan (right) in the same row during the 971 FC (edits made by Bellingcat). Bottom: Close-ups of the cartel leaders at the event. Exposure and brightness have been increased to enhance visibility. Source: TrillerTV

    We analysed the official footage from the event, a more than six-hour video from sports streaming service TrillerTV. In most of the footage in which the man is visible, his hand partially obscures his face.

    However, it was clear that the man shared many of the physical characteristics of Christy Kinahan, including a similar build, facial features, and hair colour and length. The official live-stream, as well as footage posted to social media, showed his appearance was consistent with that of a man in his late sixties.

    Christy Kinahan at the 971 Fighting Championship in Dubai last June. Source: TrillerTV, anjo50 / YouTube

    The man was also wearing a white Panama hat with blue band, a style the cartel leader has been known to wear.

    In the image below, posted to social media six months before the 971 FC event, a close relative of Christy Kinahan poses with a Panama hat and wrote in the caption that it belonged to him. Bellingcat has not identified this person because they have no known involvement in crime.

    Left: A relative of Kinahan’s said this was his Panama hat in a 2024 social media post. Middle: Kinahan in 2017. Right: Kinahan at court appearance in Belgium, where he was convicted in 2009 on money laundering charges.

    Additionally, the person seated next to the man in the Panama hat throughout the fight night strongly resembled one of Christy Kinahan’s immediate family members. Bellingcat has not identified this person because they have no known involvement in crime.

    Two individuals seated behind the man also closely resembled people that Bellingcat and its publishing partner The Sunday Times have linked to the cartel.

    Top: Screenshots of Kinahan at the Dubai MMA event (Bellingcat increased brightness in image two to enhance visibility). Bottom: Publicly available photos of Kinahan. Source: TrillerTV, YouTube, Vimeo, ICIJ, The Irish Sun

    It was subsequently confirmed that the man in the Panama hat was Christy Kinahan. The Sunday Times confirmed his identity with three sources who either knew the cartel leader personally or have investigated his activities.

    Fight Night, Familiar Faces

    Christy Kinahan has served prison time in Ireland, the Netherlands and Belgium but has evaded capture for more than a decade. He has received anti-surveillance training to conceal his identity and avoid drawing attention and, in recent years, used aliases to fly under the radar.

    But Kinahan is visible throughout the entire live-stream of the 971 Fighting Championship — adding up to the longest known footage of the cartel leader that has ever been made public.

    The Sunday Times reports today that his presence at a high profile event that live-streamed online was uncharacteristic for a criminal who has made a career of escaping detection.

    “His appearance in the open, seated in such a public place, is all the more remarkable because it is so likely to draw attention, a stark departure for Kinahan, who typically operates like a ghost,” it said.

    Christy Kinahan was visible at multiple points during the broadcast at Dubai’s Coca-Cola Arena (edits and collage made by Bellingcat). Kinahan reportedly lived in the same area as the arena before the US sanctions and posted a picture of the venue in a 2021 Google review. Source: TrillerTV

    Bellingcat’s analysis showed that Christy Kinahan was in his seat at the very beginning of the event, when the VIP area was almost entirely empty, and stayed until the end of the last fight, more than six hours later.

    He was also seen standing, walking and communicating with other people during the fight night. Kinahan was observed talking to 971 FC founder Mounir Lazzez, who sat next to him during the first round of the Junior Karanta vs Oli Thompson bout. At one point, Lazzez tapped Kinahan on the arm.

    L-R: Lazzez is seen in the seat next to Christy Kinahan and tapping Kinahan on the arm. Exposure and brightness have been increased in both screenshots to enhance visibility. Kinahan faces away as Lazzez appears to pose for a photograph. Source: TrillerTV, We Capture You / Vimeo

    Daniel Kinahan appears to have spent less time in the arena, and is first seen in his seat almost four hours into the event. He is captured talking to Lazzez in this photo, taken shortly after Kurdistani fighter Namo Fazil won his bout.

    Daniel Kinahan is not seen again after Irish fighter James Gallagher won his bout an hour later, which is when the professional photo of Kinahan and Lazzez was taken.

    L-R: Daniel Kinahan talking to Lazzez and two other people at the fight night. Exposure and brightness have been increased in the centre screenshot. Source: shirinbayd / Instagram, TrillerTV, mustafasaeid / Instagram

    Tunisian-born Lazzez lives in Dubai, where he is listed as a part-owner of a gym called the 971 MMA & Fitness Academy. He launched the 971 Fighting Championship in 2024, promising to “change the face” of combat sports.

    Footage from the first 971 FC event, at The Agenda arena in Dubai in May 2024, was not clear enough to identify people in the crowd, but social media posts confirm that an immediate relative of Daniel Kinahan’s was present.

    L-R: Mounir Lazzez, who was represented by Daniel Kinahan’s now-defunct sports management company MTK Global, wearing MTK-branded clothing; Posts from 2021 and 2022 in which Lazzez thanks Kinahan for his support and said he has “never met a man like him”. Source: mounirlazzez / Instagram

    Lazzez has publicly backed Daniel Kinahan despite the global law enforcement efforts to apprehend him. In April 2022, days after the sanctions against the cartel were announced, he thanked Kinahan in a post-fight speech and subsequent media interview in Las Vegas. Lazzez has spoken about their relationship on multiple occasions, including describing Kinahan as a “good friend, brother and advisor”.

    Bellingcat contacted Mounir Lazzez by phone, email and social media but did not receive a response.

    The man and woman were just off camera in the professional photo of Daniel Kinahan. Exposure and brightness have been increased to enhance visibility. Source: WeCaptureYou, TrillerTV

    Bellingcat also identified the people sitting on either side of Daniel Kinahan when the professional photograph was taken. They are a man and a woman who were both involved behind the scenes at 971 FC.

    The man, who has previously worked in boxing promotion, had a senior role at the Coca-Cola Arena in June last year, including during the fight night, according to his LinkedIn profile.

    The woman, who lists her most recent employment as an MMA event coordinator, appeared in footage posted to 971 FC’s social media that described her as being part of the production team. She is tagged in multiple posts about the event, including from an MMA fighter who participated on the night. The woman is also seen hugging Daniel Kinahan, talking to his adult son and sitting next to Mounir Lazzez.

    Daniel Kinahan is seen waving to the woman, who then walks over and hugs him. Video has been brightened to enhance visibility. Source: TrillerTV

    This means that Kinahan, once a “major player” in the combat sports business, was surrounded by the 971 FC founder and two people who worked at the event. 

    The man and woman did not respond to Bellingcat’s questions. There is no suggestion they are involved in any criminal activity.

    No clear footage of the younger Kinahan meeting with his father was identified at the 971 FC event. However, during a mid-event performance by American rapper Lloyd Banks, shortly after the professional photo was taken, Daniel Kinahan’s seat was empty and a person wearing similar clothing (light coloured trousers, a dark top and baseball cap) is seen moving along the front row, greeting people, and embracing Christy Kinahan. 

    The identity of this person could not be verified due to the low quality of the footage.

    The movements of a man wearing a baseball cap and clothes similar to Daniel Kinahan during a performance by Lloyd Banks. Exposure and brightness has been altered to enhance visibility. Source: TrillerTV, Instagram

    The Sunday Times reports today that the Kinahans continue to enjoy a VIP lifestyle in Dubai despite the UAE’s insistence that it has taken action against the cartel. “These findings suggest that the imposition of American sanctions has failed to significantly weaken the cartel and may, in fact, have made it more resilient,” it said.

    “The Emiratis claim to have frozen €200 million in assets across UAE-registered businesses and mapped the organisation’s front companies and proxies; however, the Kinahans’ continued ability to operate in the open suggests these enforcement efforts have yet to strike a decisive blow.”

    An extradition treaty between Ireland and the UAE was ratified in 2025, but to date it has only been enforced on Kinahan cartel lieutenant Sean McGovern, who was returned on an Irish military plane last May.

    In December, Detective Chief Superintendent Séamus Boland, the head of Ireland’s drugs and organised crime bureau, said investigations into the Kinahan cartel were ongoing and that he hoped 2026 would be a “significant year”.

    He was speaking ahead of the 10 year anniversary of Dublin’s Regency Hotel attack, when a rival gang attempted to assassinate Daniel Kinahan at a boxing weigh-in. The attack left Kinahan gang member David Byrne dead and sparked a bloody gangland feud that has resulted in 18 deaths.

    Bellingcat contacted a representative for the Kinahans to seek comment but did not receive a response.


    Connor Plunkett, Peter Barth, Beau Donelly and John Mooney contributed to this article.

    Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here. 

    The post New Footage Shows Wanted Kinahan Cartel Kingpins Post-Sanctions appeared first on bellingcat.

  • The Incendiary Bomb Never Seen in Israel Before

    The Incendiary Bomb Never Seen in Israel Before

    The Israeli Air Force (IAF) has dropped 5,000 bombs on Iran since the United States and Israel launched an attack last week, according to a statement by the IAF on March 4.

    Bellingcat has monitored weapons used in the first few days of the war, and strikes across the region, including those that caused civilian harm. Some weapons, such as the US Precision Strike Missile, have seen their first use in combat. A variant of the Tomahawk missile, previously unknown to the public, was also used.

    On March 3, the IAF posted three images in three separate posts showing a bomb not publicly seen in Israeli service before. The Israel Air Force released these photos accompanied with claims they were of jets participating in the strikes on Iran. Experts told Bellingcat that this bomb appears to have an incendiary component, and may be one intended to destroy chemical or biological warfare agents.

    Photo of an Israeli Air Force jet purportedly participating in strikes, equipped with two of these bombs (far left and far right). Source: Israeli Air Force.

    The images appear to show 2,000-pound-class air-delivered bombs fitted with Joint Direct Attack Munition (JDAM) guidance kit with a red band around the nose. Red is commonly used to denote an incendiary, while yellow indicates high explosive effect.

    Image of a bomb with the body of a MK 84 2,000-pound-bomb, but with a red band near the nose, and a US JDAM guidance kit. The image is cropped by Bellingcat to focus on the bomb. Source: Israeli Air Force.

    We identified key details about the munition and shared the images with two weapons experts.

    Apparent Similarities to the MK 84

    Dr N.R. Jenzen-Jones, the director of Armament Research Services (ARES), a weapons intelligence consulting company, told Bellingcat these images show a 2,000-pound-class air-delivered bomb fitted with a Joint Direct Attack Munition (JDAM) guidance kit.

    Frederic Gras, an Explosive Remnants of War (ERW) expert, also told Bellingcat that the bomb could be of the US MK 80 series, or an Israeli copy, and has a JDAM guidance kit.

    Left: 2,000-pound bomb with red band and US JDAM guidance kit posted by the IAF. Right: Standard MK 84 2,000-pound bombs with US JDAM guidance kits. Sources: IAF and SrA Karalyn Degraffenreed/DVIDS.

    The US JDAM bomb guidance kit is designed for use with bombs that use the MK 80 series bomb bodies, and the closely related BLU-109 “bunker buster” body. 

    The Open Source Munitions Portal added the munition to their website on March 3, describing it as “visually similar to a MK 84 general purpose aerial bomb”, while noting that “the marking scheme is distinctly different”. The War Zone also reported on these distinct markings, and possible munitions it could be.

    Open Source Munitions Portal’s (OSMP) entry on the bomb, with an analyst note. The OSMP is jointly run by Airwars and ARES, and entries undergo a review by at least two experts. Source: Open Source Munitions Portal.

    “The combination of yellow and red bands probably indicates both a high explosive and incendiary payload, which would be consistent with a 2,000-pound-class bomb of MK 84 form factor known as the BLU-119/B Crash Prompt Agent Defeat (CrashPAD),” Dr Jenzen-Jones told Bellingcat.

    Frederic Gras, an Explosive Remnants of War (ERW) expert said that the US and Israel both use red markings to indicate an incendiary payload, or effect. The bomb could be a full incendiary payload, with the yellow band indicating a bursting charge, or it could be a bomb primarily with a high explosive component, and a secondary incendiary effect, Gras added.

    Red Bands on Israeli Weapons

    It’s not the first time the Israeli Air Forces has published weapon images with red bands marking the warhead or payload section of a munition. Shortly after the start of the Gaza War in 2023, the IAF posted a photo which included an Apache attack helicopter with a Hellfire missile with a red band. The IAF deleted the post and replaced it with a similar photo of an Apache without this missile.

    Israeli Air Force AH-64 Apache with Hellfire missiles, including one with a red band. Source: Israeli Air Force.

    This fueled speculation online that this could be an incendiary or the thermobaric variant of the Hellfire missile, the AGM-114N. It has been approved by the US for sale to Israel.

    M825A1 155mm white phosphorus artillery projectiles, munitions designed to create smoke, used by Israel also have a red band and a yellow band around the nose. 

    Israeli munitions which are not incendiary have also been spotted with light red bands over the fuel tanks for munitions with jet engines, such as the Delilah cruise missile.

    Israeli Delilah Cruise Missile. Source: KGyST, Wikimedia.

    Designed To Target Chemical or Biological Weapon Stockpiles

    The markings are consistent with the US-produced CrashPAD, but “given the possible CBW [chemical and biological warfare] threats Israel has long faced from Iran, it is entirely plausible that an Israeli analogue was developed,” Dr Jenzen-Jones told Bellingcat.

    The CrashPAD contains white phosphorus and high explosives, and is designed to destroy biological and chemical warfare agents according to US government documents.

    Components of a BLU-119/B (CrashPAD). Source: US Department of Defense.

    Dr Jenzen-Jones told Bellingcat that the CrashPAD is the only publicly known weapon of this type utilising a MK 84 bomb body although there are several programs producing similar munitions. A penetrating variant is known as the Shredder but it uses a modified BLU-109 bomb body, which is visually different from the MK 84 bomb body visible in the IAF photos.

    BLU-109 2,000-pound “bunker buster” bombs equipped with JDAM guidance kits. Source: OSMP.

    CrashPAD has been in the US inventory for nearly two decades. “Chemical Agent Defeat weapons, such as Crashpad, are not illegal”, and they must undergo a legal review to ensure compliance with US domestic and international law, Michael Meier, former Senior Advisor to the Army Judge Advocate General for Law of War and current Adjunct Professor at Georgetown University Law Center, told Bellingcat.

    “The express purpose for the reservation is that these weapons, such as Crashpad, are the only weapons that can effectively destroy certain targets such as biological weapons facilities, for which high heat would be required to eliminate bio-toxins,” Meier said.

    Dr Arthur van Coller, Professor of International Humanitarian Law at the STADIO Higher Education, told Bellingcat that “if the CrashPAD is used as designed, i.e. to target chemical or biological weapon stockpiles sufficiently removed from civilian populations, then its use is consistent with IHL [International Humanitarian Law] and treaty law, even under CCW [Certain Conventional Weapons], Protocol III.”

    Dr Arthur van Coller also said that the “United States and Israel are State Parties to the CCW itself,” but only the US is also a party to Protocol III on incendiary weapons, albeit with reservations, which means that Israel “is not legally bound by Protocol III’s restrictions on incendiary weapons (including those applying to CrashPAD) under treaty law”. Iran is not a party to the CCW at all.

    The US is a major supplier of weapons to Israel, and has sent thousands of MK 80 series and BLU-109 bombs to the country. Israel also produces some MK 80 series bombs.

    Israel and US Responses

    The US Defense Security Cooperation Agency, which publishes details of some major arms sales, does not mention any transfers of the CrashPAD. Bellingcat asked the Department of State if the CrashPAD or weapons with similar capabilities were transferred to Israel. Bellingcat also asked the Department of State if they assessed that Iran had a chemical weapons program. A State Department Spokesperson told Bellingcat that “The Trump administration backs Israel’s right to self-defense” and referred Bellingcat to the IDF for questions about procurement and munitions used.

    The US Department of Defense did not respond to requests for comment by the time of publication. 

    Bellingcat asked the IDF what the bomb was, if it was supplied by the US, if it contained white phosphorus, thermobaric or fuel air explosives, and if the IDF assessed that Iran had a chemical weapons program. The IDF told Bellingcat that it “will not be able to provide details regarding the types of munitions it uses. With that said the IDF uses only legal weapons and ammunition.”


    Bellingcat’s Carlos Gonzales contributed research to this article. Livio Spaini from Bellingcat’s Volunteer Community also contributed to this piece.

    Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

    The post The Incendiary Bomb Never Seen in Israel Before appeared first on bellingcat.

  • Uploading Pirated Books via BitTorrent Qualifies as Fair Use, Meta Argues

    Uploading Pirated Books via BitTorrent Qualifies as Fair Use, Meta Argues

    In the race to build the most capable LLM models, several tech companies sourced copyrighted content for use as training data, without obtaining permission from content owners.

    Meta, the parent company of Facebook and Instagram, was one of the companies to get sued. In 2023, well-known book authors, including Richard Kadrey, Sarah Silverman, and Christopher Golden, filed a class-action lawsuit against the company.

    Meta’s Bittersweet Victory

    Last summer, Meta scored a key victory in this case, as the court concluded that using pirated books to train its Llama LLM qualified as fair use, based on the arguments presented in this case. This was a bittersweet victory, however, as Meta remained on the hook for downloading and sharing the books via BitTorrent.

    By downloading books from shadow libraries such as Anna’s Archive, Meta relied on BitTorrent transfers. In addition to downloading content, these typically upload data to others as well. According to the authors, this means that Meta was engaged in widespread and direct copyright infringement.

    In recent months, the lawsuit continued based on this remaining direct copyright infringement claim. While both parties collected additional evidence through the discovery process, it remained unclear what defense Meta would use. Until now.

    Seeding Pirated Books is Fair Use

    Last week, Meta served a supplemental interrogatory response at the California federal court, which marks a new direction in its defense. For the first time, the company argued that uploading pirated books to other BitTorrent users during the torrent download process also qualifies as fair use.

    Meta’s reasoning is straightforward. Anyone who uses BitTorrent to transfer files automatically uploads content to other people, as it is inherent to the protocol. In other words, the uploading wasn’t a choice, it was simply how the technology works.

    Meta also argued that the BitTorrent sharing was a necessity to get the valuable (but pirated) data. In the case of Anna’s Archive, Meta said, the datasets were only available in bulk through torrent downloads, making BitTorrent the only practical option.

    “Meta used BitTorrent because it was a more efficient and reliable means of obtaining the datasets, and in the case of Anna’s Archive, those datasets were only available in bulk through torrent downloads,” Meta’s attorney wrote.

    “Accordingly, to the extent Plaintiffs can come forth with evidence that their works or portions thereof were theoretically ‘made available’ to others on the BitTorrent network during the torrent download process, this was part-and-parcel of the download of Plaintiffs’ works in furtherance of Meta’s transformative fair use purpose.”

    Part and parcel

    part and parcel

    In other words, obtaining the millions of books that were needed to engage in the fair use training of its LLM, required the BitTorrent up- and downloading, which ultimately serves the same fair use purpose.

    Authors and Meta Disagree over Fair Use Timing

    The authors were not happy with last week’s late Friday submission and the new defense. On Monday morning, their lawyers filed a letter with Judge Vince Chhabria flagging the late-night filing as an improper end-run around the discovery deadline.

    They point out that Meta had been aware of the uploading claims since November 2024, but that it never brought up this fair use defense in the past, not even when the court asked about it.

    The letter specifically mentions that while Meta has a “continuing duty” to supplement discovery under Rule 26(e), this rule does not create a “loophole” allowing a party to add new defenses to its advantage after a court deadline has passed.

    “Meta (for understandable reasons) never once suggested it would assert a fair use defense to the uploading-based claims, including after this Court raised the issue with Meta last November,” the lawyers write.

    The letter

    lettermeta

    Meta’s legal team fired back the following day, filing their own letter with Judge Chhabria. This letter explains that the fair use argument for the direct copyright infringement claim is not new at all.

    Meta pointed to the parties’ joint December 2025 case management statement, in which it had explicitly flagged the defense, and noted that the author’s own attorney had addressed it at a court hearing days later.

    “In short, Plaintiffs’ assertion that Meta ‘never once suggested it would assert a fair use defense to the uploading-based claims, including after’ the November 2025 hearing, is false” Meta’s attorney writes in the letter.

    Authors Admit No Harm, No Infringing Output

    Meanwhile, it’s worth noting that Meta’s interrogatory response also cites deposition testimony from the authors themselves, using their own words to bolster its fair use defense.

    The company notes that every named author has admitted they are unaware of any Meta model output that replicates content from their books. Sarah Silverman, when asked whether it mattered if Meta’s models never output language from her book, testified that “It doesn’t matter at all.”

    Authors’ depositions

    deposition

    Meta argues these admissions undercut any theory of market harm. If the authors themselves cannot point to infringing output or lost sales, the lawsuit is less about protecting their books and more about challenging the training process itself, which the court already ruled was fair use.

    These admissions were central to Meta’s fair use defense on the training claims, which Meta won last summer. Whether they carry the same weight in the remaining BitTorrent distribution dispute has yet to be seen.

    ‘U.S. AI Leadership at Stake’

    In its interrogatory response, Meta added further weight by stressing that its investment in AI has helped the U.S. to establish U.S. global leadership, putting the country ahead of geopolitical competitors. That’s a valuable asset worth treasuring, it indirectly suggested.

    As the case moves forward, Judge Chhabria will have to decide whether to allow this “fair use by technical necessity” defense. Needless to say, this will be of vital importance to this and many other AI lawsuits, where the use of shadow libraries is at stake.

    For now, the BitTorrent distribution claims remain the last live piece of a lawsuit filed in 2023. Whether Judge Chhabria will allow Meta’s new defense to proceed has yet to be seen.

    A copy of Meta’s supplemental interrogatory response is available here (pdf). The authors’ letter to Judge Chhabria can be found here (pdf). Meta’s response to that letter is available here (pdf).

    From: TF, for the latest news on copyright battles, piracy and more.

  • Admiring Our Heroes for International Women’s Day: Celebrating Women Who Have Received EFF Awards 

    Admiring Our Heroes for International Women’s Day: Celebrating Women Who Have Received EFF Awards 

    For the last hundred years, women have had pivotal and far too often unsung roles in building and shaping the technology that we now use every day. Many have heard of Ada Lovelace’s contributions to computer programming, but far fewer know Mary Allen Wilkes, a prominent modern programmer who wrote much of the software for the LINC, one of the world’s first interactive personal computers (it could fit in a single office and cost $40,000, but it was the 60’s). Decades earlier, when the first all-electronic, digital Eniac computer was built in the 40’s, the “software” for it was written by women: Kathleen McNulty, Jean Jennings, Betty Snyder, Marlyn Wescoff, Frances Bilas and Ruth Lichterman. 

    It’s thankfully become more common knowledge that actor and inventor Hedy Lamarr co-created the concept of “frequency-hopping” that became a basis for radio systems from cell phones to wireless networking systems. But too few know Laila Ohlgren, who in the 1970’s solved a major problem with the development of mobile networks and phones by recognizing that dialed numbers could be stored and sent all at once with a “call button,” rather than sent one number at a time, which created connection issues before a call was even made. 

    Women in tech deserve more and brighter spotlights. At EFF, we’ve had the honor of celebrating some of our heroes at our annual EFF Awards, including many women who are leading the digital rights community. For International Women’s Day, we’re highlighting the contributions of just a few of these recipients from the last decade, whose work to protect privacy, speech, and creativity online has had a global impact.

    Carolina Botero (EFF Award Winner, 2024) 

    Carolina Botero is a leader in the fight for digital rights in Latin America. For over a decade, she led the Colombia-based Karisma Foundation and cultivated its regional and international impact. Botero and Karisma helped connect indigenous peoples to the internet and made it possible to contribute content to Wikipedia in their native language, expanding access to both history and modern information. They built alliances to combat disinformation, pushed for legal tools to protect cultural and heritage institutions from digital blackholes, and were, and remain, a necessary voice speaking for human rights in the online world. EFF worked closely with Karisma and Botero to help free Colombian graduate student Diego Gomez, who shared another student’s Master’s thesis with colleagues over the internet. Diego’s story demonstrates what can go wrong when nations enact severe penalties for copyright infringement, and thanks to work from Karisma, many partners, and many EFF supporters, he was cleared of the criminal charges that he faced for this harmless act of sharing scholarly research.

    Carolina Botero receiving her EFF Award

    Botero stepped down from the role in 2024, opening the door for a new generation. While her work continues—she’s currently on the advisory board of CELE, the Centro de Estudios en Libertad de Expresión—her EFF Award was well-deserved based on her strong and inspiring legacy for those in Latin America and beyond who advocate for a digital world that enhances rights and empowers the powerless. Learn more about Botero on her EFF Awards page and the recap of the 2024 event

    Chelsea Manning (EFF Award Winner, 2017)

    Chelsea Manning became famous as a whistleblower: In 2010, she disclosed classified Iraq War documents, including a video of the killings of Iraqi civilians and two Reuters reporters by U.S. troops. These documents exposed aspects of U.S. operations in Iraq and Afghanistan that infuriated the public and embarrassed the government. But she is also a transparency and transgender rights advocate, network security expert, author, and former U.S. Army intelligence analyst. 

    Manning joined the military in 2007. Her role as an intelligence analyst to an Army unit in Iraq in 2009 gave her access to classified databases, but more importantly, it gave her a uniquely comprehensive view of the war in Iraq, and she became increasingly disillusioned and frustrated by what she saw, versus what was being shared. In 2010, she approached major news outlets hoping to give information to them that would reveal a new side of the war to the public. Ultimately, she shared the documents with Wikileaks. 

    Manning’s bravery did not end there. When she was arrested a few months later, she endured “cruel, inhuman and degrading” treatment, according to the UN Special Rapporteur on torture. She was locked up alone for 23 hours a day over an 11-month period, before her trial. The mistreatment resulted in public outcry and advocacy by organizations like Amnesty International. Even a State Department spokesperson, Philip Crowley, criticized the treatment as “ridiculous, counterproductive, and stupid,” and resigned. She was moved to a medium-security facility in April 2011. 

    The government’s charges against Manning were outrageous, but in 2013 she was convicted of 19 of 22 counts as a result of her whistleblowing activities. She became one of fewerthan a dozen people prosecuted for espionage in the entire history of the United States, and she was sentenced to the longest punishment ever imposed on a whistleblower. Then, the day after her conviction, isolated from her community and in all likelihood expecting to remain in prison for years if not decades, she courageously issued a statement identifying herself as a trans woman, which she’d wanted to reveal for years. 

    Over the next several years, while imprisoned, she became an advocate both for government transparency and for transgender rights. Her conviction and sentence pointed to the need for legal reform of both the Computer Fraud and Abuse Act (CFAA) and the Espionage Act.  EFF filed an amicus brief to the U.S. Army Court of Criminal Appeals arguing that the CFAA was never meant to criminalize violations of private policies like those of government systems, and EFF also pushed, and continues to fight for, narrower interpretations of the Espionage Act and stronger protections for whistleblowers, particularly to take into account both the motivation of individuals who pass on documents and the disclosure’s ramifications. 

    Even after President Obama commuted her sentence in 2017, and EFF celebrated her work and her release with an EFF award in September, 2017, her fight wasn’t over. She was imprisoned again twice in 2019 and ultimately fined $256,000 for refusing to testify before grand juries investigating WikiLeaks founder Julian Assange. The U.N. Special Rapporteur on torture again criticized Manning’s treatment, writing that “the practice of coercive detention appears to be incompatible with the international human rights obligations of the United States.” 

    Manning was released in 2020 after having spent almost a decade in total imprisoned for her courage. She wrote a memoir, README.txt, in 2022, to take back control over her story.

    EFF Award Winners Mike Masnick, Annie Game, and Chelsea Manning

    Annie Game (EFF Award Winner, 2017)

    Annie Game spent over 16 years as the Executive Director of IFEX, a global network of journalism and civil liberties organizations working together to defend freedom of expression.  IFEX (formerly International Freedom of Expression Exchange) began in the 1990s, when a group of organizations and the Canadian Committee to Protect Journalists came together to consider how to respond as a single voice to free-expression violations around the world. IFEX now is a global hub for the protection of free speech and journalism. 

    Game recognized early on that digital rights and freedom of expression groups needed one another. Under her leadership, IFEX paired more traditional free-expression organizations with their more digital counterparts, with a focus on building organizational security capacities. IFEX Initiatives under Game’s leadership have been expansive. For example, the International Day to End Impunity for Crimes against Journalists, November 2, has been an annual wake-up call and reminder for UN member states to live up to their commitments to protecting journalists. UNESCO observed more than 1,700 journalists were killed globally between 2006 and 2024, and nearly 90% of these cases went unsolved in the courts. 

    Game and IFEX have also focused on high-profile cases of journalists threatened by governments for their work, such as Bahey eldin Hassan in Egypt. Bahey is the director of the Cairo Institute for Human Rights Studies (CIHRS) and has advocated for freedom of expression and the basic human rights of Egyptians, but has lived in exile since 2014. The charges against him, of “disseminating false information” and “insulting the judiciary,” are common tactics of intimidation and harassment. Bahey’s supposed crimes were sharing social media posts criticising the Egyptian judiciary’s lack of independence, and speaking about the killing in Egypt of Italian researcher Giulio Regeni. Bahey—an IFEX member—is just one of many reporters and human rights workers in danger when they speak. But when journalists and those defending their rights online speak out as one voice, as IFEX helps them do, it makes a difference. 

    Another initiative has been the Faces of Free Expression project, a partnership between IFEX and the International Free Expression Project. If you’re looking for more heroes, this project details the stories of “risk-takers and change-makers – individuals who put their careers, their freedom, their safety, and sometimes even their lives on the line,” while reporting, or defending free expression and the right to information. 

    Wherever authoritarianism and repression of speech have been on the rise, Game has unapologetically called out injustices and made it safer for journalists to do their work, while ensuring accountability when crimes are committed. The work is more critical now than ever, and since leaving IFEX in 2022, she’s remained an activist while focusing increasingly on environmental protection. 

    Twelve More Heroes 

    EFF has honored many more women with awards over the years—from Anita Borg and Hedy Lamarr to Amy Goodman and Beth Givens. This blog from 2012 looks back and acknowledges the important contributions from twelve more EFF Award winners. 

    We’ve also asked five women at EFF about women in digital rights, freedom of expression, technology, and tech activism who have inspired us. You can read that here.

    Donate to Support EFF’s Work

    Your donations empower EFF to do even more.