Enjoyed the Spider Man movie, except for that part where he casually uses mass surveillance against everyone in New York to stalk a young woman. Didn’t like that.
Martin Shelton
@mshelton.bsky.social
Security therapist. Deputy director of digital security @freedom.press. Mastodon: https://mastodon.social/@mshelton Digisec newsletter: https://freedom.press/newsletters
Ron Wyden says no one opening a credit card expects brokers to sell their data to ICE, and there is no way to opt out. Reporting by Joseph Cox, @404mediaco. www.404media.co/you-opened-a...
You Opened a Credit Card. ICE Now Knows Where You Live
Here's how your personal address travels from your credit card provider, through middlemen companies, and ends up with ICE.
404media.co
You gotta hand it to OpenAI, billing this as a *partnership* between OpenAI & Hugging Face when what actually happened was Hugging Face finding out that OpenAI was using a bunch of bots to exploit security vulnerabilities. Talk about good marketing or whatever you want to call it, by OpenAI.
It’s astonishing that OpenAI is spinning the fact that its software hacked Hugging Face as marketing. If you or me or any normal person did this, we’d have some serious legal risk.
Sometimes the good guys win. And when this happens, we take the time to enjoy our victory because that is the only way to fight a long fight without burning out. www.eff.org/deeplinks/20...
Victory! Flock Ends Rollout of Audio “Distress Detection” of Human Voices
Reversing course, Flock Safety—the surveillance technology vendor most known for its extensive network of automated license plate readers—has announced that it will end a pilot for its acoustic gunsho...
eff.org
Large language models used in chatbots and elsewhere are vulnerable to malicious prompts. New research shows they may also be easily “confused” into taking user input as their own ideas. That’s right, they can be “incepted.” Read our newsletter for more.
The ‘s’ in LLM stands for ‘security’
Researchers bypass guardrails on open source LLMs with slight role-based language changes
freedom.press
The business of producing real news and protecting the First Amendment go hand in hand. And Paramount clearly has no interest in either. That’s why we just sued Paramount owner David Ellison over his corrupt deal with Trump to acquire CNN:
This Certo report on how abusers are using Chrome sync for stalking is an important reminder that tech-enabled abuse isn't just limited to stalkerware: www.certosoftware.com/insights/cyb...
Cyberstalkers Are Exploiting Chrome Sync to Spy on Victims | Certo Software
Certo's research team reveals how cyberstalkers are quietly switching the signed-in account in Google Chrome to remotely monitor victims' browsing history and saved passwords with no warning ever show...
certosoftware.com
"OpenAI found that Sol has a tendency to take whatever actions it thinks gets a job done, even destructive ones, as long as those actions aren’t “unambiguously” prohibited. Then it might lie about what caused it to do so." Sounds like… A good reason not to release it. techcrunch.com/2026/07/14/o...
OpenAI's new flagship model deletes files on its own, people keep warning | TechCrunch
A number of social media posts claim that GPT-5.6 Sol deleted files and data without warning. OpenAI had basically disclosed the problem in June.
techcrunch.com
For no reason at all, we want to talk to journalists about how to protect their Signal account and identity. freedom.press/digisec/blog...
What journalists need to know about Signal account safety
There are a few straightforward steps you can take to make your account and identity much more secure
freedom.press
Even the LAPD doesn't want to work with Flock because of its privacy and data storage risks. The LAPD. I'm going to say that a third time: The LAPD. techcrunch.com/2026/07/13/l...
LAPD lets contract with surveillance giant Flock expire, citing 'serious concerns' over civil liberties and privacy | TechCrunch
The LAPD, one of Flock's biggest government customers, is ending its contract with the company citing civil liberties concerns.
techcrunch.com
If you use Signal to work with sensitive contacts, it’s not a “set it and forget it” app. You do need to maintain the safety of your account. Fortunately it's pretty easy to do. Check out our guide: freedom.press/digisec/blog...
What journalists need to know about Signal account safety
There are a few straightforward steps you can take to make your account and identity much more secure
freedom.press
Lessons from The Intercept’s Signal tipline username breach
Lessons from The Intercept’s Signal tipline username breach
There’s a lot news organizations can do to prevent this kind of account compromise
freedom.press
If you use Signal to work with sensitive contacts, it’s not a “set it and forget it” app. You do need to maintain the safety of your account. Fortunately it's pretty easy to do. Check out our guide: freedom.press/digisec/blog...
What journalists need to know about Signal account safety
There are a few straightforward steps you can take to make your account and identity much more secure
freedom.press
One reason WhatsApp users should consider switching to usernames is because if someone hijacks your phone number, then they could also likely recover other accounts, FPF's @mshelton.bsky.social told @monicatorrr.bsky.social.
WhatsApp Just Rolled Out A Privacy Feature You'll Probably Want To Enable ASAP
This seemingly small update could make a big difference for your privacy. Here’s what you need to know.
huffpost.com
WhatsApp just released a username feature — better late than never! We've added that to our guide to upgrading WhatsApp security. freedom.press/digisec/blog...
Upgrading WhatsApp security
Also available in Spanish.
freedom.press
Every year, @huertanix.bsky.social and I do a "Worst of Cybersecurity Reporting" talk at @cactuscon.com. We first roasted 2019 articles and keep getting invited back. We work on this talk all year long, discussing candidates in a shared doc, and we'd love your help.
Hoo boy. I am analyzing this to learn more about how it happened. I will have a writeup about how newsrooms can prevent Signal username hijacking risks. www.dropsitenews.com/p/intercept-...
A Third Party Breached The Intercept’s Signal Tip Line and Has Been Soliciting Whistleblowers
The news outlet changed its tip line this week, but has not informed potential sources or the public of the breach.
dropsitenews.com
Hoo boy. I am analyzing this to learn more about how it happened. I will have a writeup about how newsrooms can prevent Signal username hijacking risks. www.dropsitenews.com/p/intercept-...
A Third Party Breached The Intercept’s Signal Tip Line and Has Been Soliciting Whistleblowers
The news outlet changed its tip line this week, but has not informed potential sources or the public of the breach.
dropsitenews.com
Job alert! The Open Tech Fund (OTF) is hiring program managers: www.opentech.fund/jobs/working...
Working at OTF
OTF is an independent non-profit corporation dedicated to promoting internet freedom globally to ensure that all people can access information, communicate, and associate freely online without fear of...
opentech.fund
If you or me download a copyrighted work from the web, it's piracy. So don't do that. But if you pirate the entire public internet, including copyrighted works, that's actually okay. So long as you use it to train LLMs and start a company.
I don't know how any AI companies can justify being upset when someone copies content from them to train their models. arstechnica.com/tech-policy/...
Anthropic says Alibaba must be punished for largest Claude cloning attack
Alibaba allegedly used 25,000 accounts to mine Claude over 28.8 million exchanges.
arstechnica.com
Ralph Wiggum: I'm in danger
Alt: Ralph Wiggum, sitting in a moving bus, chuckling: I'm in danger
static.klipy.com
On average, global ocean temperatures right now are the hottest in our historical records for this time of year! Follow along at zacklabe.com/climate-chan... 🌊
🎉🎉🎉🎉🎉🎉 Nearly 400 local newspapers sue OpenAI, Microsoft over alleged copyright theft.
Nearly 400 local newspapers sue OpenAI, Microsoft over alleged copyright theft - New Jersey Globe
The massive coalition of local newspaper publishers filed a federal lawsuit today against OpenAI and Microsoft, alleging the technology companies
newjerseyglobe.com
This indictment seems to allege, specifically, that Alexander Iniguez Mercado committed obstruction of justice "by uninstalling the Signal application" from his phone:
#BREAKING: A Chicago man has been arrested in connection with "the planning of a violent attack targeting an Ultimate Fighting Championship" event at the White House. Alexander Iniguez Mercado, 20, is charged with obstruction of justice.
Microsoft constantly demonstrates that the killer app is maintenance and stability. They aren't good at those things. www.windowslatest.com/2026/06/25/w...
Windows 10 support quietly extended until Oct 2027, as users reject Windows 11
Microsoft extends Windows 10 ESU for home users to October 2027, one year longer than planned. Here's the changes, the cost and how to enroll
windowslatest.com
NEW: buried within the trove of hacked documents from Madison Square Garden, the folks @404media.co found the company was keeping files on activists that criticized their use of facial recognition. Including me. Here's @fightforthefuture.org's statement: www.fightforthefuture.org/news/2026-06...
On top of boiling the ocean, the price of the Steam Machine means I will forever curse AI companies.
There we go. US Gov tightens post-quantum cryptography transition deadlines for high-value systems to 2030 for key exchange and 2031 for signatures. Also, speeding up the CMVP (FIPS 140 validation) processes. That’s how you know the rush is real. The quantum computers are (potentially) coming.
Securing the Nation Against Advanced Cryptographic Attacks
By the authority vested in me as President by the Constitution and the laws of the United States of America, it is hereby ordered: Section 1. Background
whitehouse.gov
This is basically how I feel about these chatbots. They can be fun. But ultimately they are software operating on behalf of a company. They’re not doing this for free. techcrunch.com/2026/06/20/s...
Signal’s Meredith Whittaker wants you to remember that AI chatbots ‘are not your friends’ | TechCrunch
"These are not your friends. These are not conscious beings. These are not sentient interlocutors.”
techcrunch.com