digital privacy

Bilingual

Chatcontrol: Of de Amerikanen onze WhatsApp foto's willen melden bij Europol - Bert Hubert's writings
2 months ago
- Under Denmark's lead, many EU member states are pushing to force messaging apps like WhatsApp and Signal to scan all photos and links with AI for potential child sexual abuse material.
- If the AI has any doubt, the photo, location, phone number, and other data are sent to a new EU Centre, then to Europol and local police, with no clear process for what happens next.
- The AI is built by WhatsApp/Meta/Facebook, meaning they monitor users on behalf of the EU; all photos are scanned without any specific suspicion.
- Even if a photo is deemed legal, a copy is retained by the EU Centre for potential future use.
- Users who refuse consent for AI scanning will lose the ability to send images and links; Signal has threatened to leave the EU if forced to implement such scanning.
- Police and experts already overwhelmed with reports; politicians often claim to act 'for the children' but rarely provide more resources for child protection units.
- The proposal creates a massive surveillance system run by Americans, while EU governments exempt their own police, military, and intelligence services from the law.
- The Dutch government opposes the AI scanning requirement, but it remains a contentious issue, especially with upcoming elections.
- The EU also has a broader ProtectEU strategy to give police more access to communications, including new rules for wiretapping specific messages.
Pluralistic: Google's new remote attestation scheme is every bit as terrible as its old remote attestation scheme (12 Jun 2026)
2 months ago
- Google's new remote attestation system mirrors its old one, both restricting user control and blocking interoperability.
- Remote attestation forces devices to disclose configuration details, enabling servers to block ad-blockers, privacy tools, and accessibility modifications.
- Google's dominance stems from unethical practices, including bribing Apple and rigging ad markets, as confirmed by antitrust losses.
- Android's surveillance collects user data relentlessly, aiding authoritarian governments, driving demand for de-Googled alternatives.
- Google uses technical barriers like WEI and reCAPTCHA to complement illegal commercial tactics, limiting modified Android versions.
- Public outrage killed the WEI project, but Google persists with new attestation methods to enforce control.
Fourth Circuit: Border Agents Can Search Your Phone by Hand, No Suspicion Needed
2 months ago
- The Fourth Circuit ruled that manual cell phone searches at U.S. borders require no warrant or suspicion, while forensic searches require individualized suspicion.
- EFF argued that all border device searches should need a warrant based on probable cause, or at least the same Fourth Amendment standard.
- The court distinguished manual from forensic searches based on technical differences, but critics note both are equally invasive of privacy.
- Even brief manual searches can reveal intimate personal data, undermining the court's reliance on the search lasting only two minutes.
- A silver lining: the court left open the possibility that lengthier manual searches might require heightened suspicion, but for now officers can bypass higher standards.
The ACLU Is Arming Lawyers to Expose State Surveillance Secrets
2 months ago
- The ACLU of Massachusetts is releasing an online toolkit for defense attorneys to uncover secret police surveillance use.
- The toolkit includes legal motions to force disclosure of surveillance tech like facial recognition, license plate readers, and AI reports.
- It also features preservation motions to prevent automatic deletion of surveillance data by government and private vendors.
- The effort aims to address the lag between police adopting new tech and courts ruling on its legality.
- Examples show police often hide surveillance use, even from prosecutors, via secrecy agreements or vague warrants.
- The toolkit helps attorneys request the full scope of surveillance, as many currently ask for limited records.
- Preservation motions target self-destructing evidence, such as AI-drafted police reports or automatically deleted footage.
- Massachusetts courts have shown support for digital privacy, with rulings against withheld evidence and for warrant requirements.
- The release coincides with a recent Supreme Court ruling on geofence warrants, which the toolkit addresses.
- The ACLU plans to adapt the toolkit for other states and gather feedback from attorneys using the motions.
'We decided not to limit VPNs': UK government U-turns on age-gating VPNs
2 months ago
- The UK government decided not to limit VPNs, citing their legitimate privacy and security uses.
- Research shows only 7-10% of teenagers use VPNs to bypass age checks, while 45% use false dates of birth.
- Social media platforms will be required to prevent underage users from circumventing age assurance measures.
- New rules include midnight curfews and default disabling of autoplay and infinite feeds for 16- and 17-year-olds.
- Mandatory breaks for AI chatbot use by under-18s are planned to prevent emotional dependency.
They Prefer the App
2 months ago
- The author prefers building websites over mobile apps, but feels like an outsider because many people now primarily use apps and have forgotten about websites.
- Many apps, especially informational ones like those for schools, could be replaced by simple websites but instead restrict basic web features like copy-paste and link handling.
- People often don't understand websites, viewing them as lightweight previews of apps, and services push apps to better track user data, as seen with platforms like LinkedIn or Facebook.
- While the author and a small community prefer using progressive web apps, most users happily download large apps for tasks that websites can handle, making website enthusiasts a minority.
India halts WhatsApp global username feature over cyberfraud risk
2 months ago
- WhatsApp introduced global username feature, enabling chatting without sharing phone numbers.
- Indian government objected to the username feature, fearing increased scams and fraud.
- Government also sought explanations from Telegram and Signal regarding their username features.
- Experts warn that conceding to India's demands could lead to global copycat regulations.
- India is WhatsApp's largest market with over 850 million users.
- Username feature could protect users from harassment by separating online identities.
- Government concerns lack evidence, as similar cybercrime risks exist across various platforms.
- WhatsApp emphasized built-in security measures against impersonation in username system.
- India's move could lead to fragmented privacy protections across jurisdictions.
- Public notice on design features is seen as unprecedented government overreach.
Microsoft admits Windows 11 has a GDID tracker with no off switch
2 months ago
- Microsoft's Global Device Identifier (GDID) is a persistent, unique digital fingerprint assigned to Windows installations when users sign in with a Microsoft Account, used for licensing and tracking across services.
- The FBI used GDID to trace alleged hacker Peter Stokes by linking his Windows device's activity across VPNs and proxies to his online accounts, leading to his arrest at Helsinki airport in 2026.
- Privacy concerns arise because GDID is assigned without user consent, lacks visible controls like on Apple or Android, and can persist across reinstalls via Microsoft Account linkages, raising surveillance questions.
- To mitigate GDID tracking, users can switch to local accounts, disable optional diagnostics and advertising IDs, turn off cloud search, or use Linux with Tor for high-risk activities.
The 4th Amendment Moves to the Cloud: Chatrie and the Future of Digital Privacy
2 months ago
- The Supreme Court held that police obtaining cell phone location data via a geofence warrant constitutes a Fourth Amendment search, overriding the third-party doctrine.
- The decision extends Carpenter v. United States principles, emphasizing privacy in location records and rejecting arguments based on data quantity or duration.
- Key unresolved issues include the scope of protection for other digital data, the robustness of Fourth Amendment safeguards, and warrant particularity requirements.
- Justices were divided: a majority upheld privacy expectations, concurrences raised concerns about warrant reasonableness, and dissents favored a broader third-party doctrine.
- The ruling impacts law enforcement practices, data storage policies, and corporate compliance with reverse warrants, highlighting ongoing digital privacy challenges.
Google's new remote attestation scheme is every bit as terrible as its old one
2 months ago
- Google's 'reCAPTCHA Mobile Verification' threatens to block users running independent, 'de-googled' Android versions that prioritize privacy and block ads.
- Browsers act as user agents on the open web, allowing users to control their experience, but Google's walled-garden approach undermines this interoperability.
- Google has engaged in anticompetitive practices, including blocking rival technologies and losing multiple antitrust cases, to cement market dominance.
- De-googled Android alternatives like CalyxOS and Graphene offer enhanced privacy by resisting Google's pervasive data collection.
- Remote attestation technologies, such as Web Environment Integrity (WEI) and reCAPTCHA Mobile Verification, enable servers to reject devices based on their configurations, limiting user choice and accessibility.
The internet does not want readers. It wants livestock
2 months ago
- The internet treats users as livestock, focusing on converting audiences, optimizing funnels, and capturing leads rather than providing genuine content.
- Platforms and tools have become overly complex and intrusive, prioritizing growth and measurement through engagement metrics and attention harvesting, leading to 'enshittification'.
- There is a growing movement of people building websites that reject tracking, pop-ups, and data collection, advocating for simple, respectful online experiences as a radical act of good manners.
Chat Control passed first round in EU Parliament
2 months ago
- EU Parliament narrowly approves urgency motion to reconsider Chat Control 1.0 before summer break.
- Proponents aim to reinstate expired regulation allowing voluntary scans of private communications for child abuse material without suspicion.
- Critics argue the move violates parliamentary procedure and enables mass surveillance under general suspicion.
- Social Democrats cave to pressure, supporting urgency despite prior rejection of Chat Control extension.
- Tactical advantage for proponents due to lower vote threshold on final session day, making re-enactment likely.
- Concerns raised over AI scan error rates and erosion of privacy, with fears it may delay more effective regulations.
Chat Control 1.0 vs. 2.0
3 months ago
- Chat Control 1.0 is Regulation (EU) 2021/1232, a temporary law that allowed voluntary scanning of private messages for child sexual abuse material, excluding encrypted messages; it expired in April 2026 but is being revived by the Council via a fast-track process.
- Chat Control 2.0 is the proposed permanent CSA Regulation, which would mandate detection and reporting; negotiations are deadlocked over issues like mandatory scanning and encryption, with no agreement after five trilogue rounds.
- The EU Parliament has taken protective stances, rejecting extensions of Chat Control 1.0 and advocating for targeted scanning with judicial oversight, while the Council pushes for broader scanning measures.
- Key events include the expiration of Chat Control 1.0, Council attempts to resurrect it, and ongoing trilogue failures for Chat Control 2.0, with encryption and suspicionless scanning as major points of contention.
- As of July 2026, Chat Control 1.0's revival is pending an urgency vote in Parliament, requiring an absolute majority to stop it, while Chat Control 2.0 negotiations continue under the Irish presidency.
AB 1856: CA Exempts Open Source, Still Expands Age-Gating
3 months ago
- California lawmakers are considering an exemption for open-source operating systems from the age-bracketing requirements of AB 1043 due to public pressure, but concerns remain about threats to speech, privacy, and security.
- AB 1856 expands the age-bracketing regime from operating systems and app stores to include web browsers and websites, increasing constitutional harms to users despite some relief for open-source developers.
- An amendment to AB 1856 exempts open-source operating systems from age data collection, offering partial relief, but ambiguities persist regarding commercial use and application scope.
- EFF opposes AB 1856 because it broadens AB 1043's scope, potentially leading to more age verification, invasive data collection, and barriers to lawful speech without addressing core privacy and anonymity issues.
- The bill has passed the Assembly and moves to the Senate, where EFF will advocate for amendments to narrow AB 1043's impact and enhance user protections against age-gating harms.

digital privacy

Chatcontrol: Of de Amerikanen onze WhatsApp foto's willen melden bij Europol - Bert Hubert's writings

Pluralistic: Google's new remote attestation scheme is every bit as terrible as its old remote attestation scheme (12 Jun 2026)

Fourth Circuit: Border Agents Can Search Your Phone by Hand, No Suspicion Needed

The ACLU Is Arming Lawyers to Expose State Surveillance Secrets

'We decided not to limit VPNs': UK government U-turns on age-gating VPNs

They Prefer the App

India halts WhatsApp global username feature over cyberfraud risk

Microsoft admits Windows 11 has a GDID tracker with no off switch

The 4th Amendment Moves to the Cloud: Chatrie and the Future of Digital Privacy

Google's new remote attestation scheme is every bit as terrible as its old one

The internet does not want readers. It wants livestock

Chat Control passed first round in EU Parliament

Chat Control 1.0 vs. 2.0

AB 1856: CA Exempts Open Source, Still Expands Age-Gating