ICE Didn't Hide the Spyware. That's the Part Worth Worrying About.
ICE admitted it uses Graphite, an Israeli zero-click spyware tool that requires no interaction from the target. The admission is more telling than the spyware itself.
Read more
Tracker-free posts on privacy, protocols, and digital sovereignty.
ICE admitted it uses Graphite, an Israeli zero-click spyware tool that requires no interaction from the target. The admission is more telling than the spyware itself.
Read moreA Mexican surveillance company has built the infrastructure to watch 26 of Mexico's 32 states and is sharing that data in real time with the FBI, ICE, CBP, DEA, and ATF under a formal agreement signed in 2022. Because Seguritech is a foreign private company, no US transparency law reaches it.
Read moreAzerbaijan has used Pegasus-grade spyware against its own journalists and activists for years, with zero consequences. Now it is building MİRAS, a permanent national surveillance platform controlled by the State Security Service, set to go live in May 2026. Access Now just filed an amicus brief at the European Court of Human Rights. The infrastructure is not waiting for the verdict.
Read moreSection 702 lets intelligence agencies collect communications without a warrant, including from an unknown number of Americans. Congress just extended it again and stripped every reform proposal in the process.
Read moreEvery time an app serves you an ad, it broadcasts your location into an ecosystem that surveillance vendors harvest and resell. Penlink's Webloc system turns that data into three years of tracked movement for ICE, the US Army, and dozens of police departments nationwide.
Read moreDragon Boss Solutions LLC shipped a trusted, digitally signed software update that deployed a PowerShell script to kill antivirus tools across 25,000 endpoints. Windows Defender was not bypassed accidentally. The payload specifically added exclusions to ensure future malware would not be detected.
Read moreAfter TotalRecall exposed Windows Recall's unencrypted screenshot database in 2024, Microsoft added authentication and encryption. TotalRecall Reloaded found the side entrance. The vault is solid, the researcher noted. The delivery truck is not.
Read moreAn independent audit of 7,000 websites found Google ignored Global Privacy Control opt-out signals 87% of the time, Meta 69%, and Microsoft 50%. In Google's case, the opt-out signal triggered more cookies. The mechanism was working as built.
Read moreAttackers compromised CPUID's website on April 9 and replaced download links for CPU-Z and HWMonitor with links to their own infrastructure. The installers users received carried a remote access trojan. The actual software builds were never touched.
Read moreThe FBI extracted deleted Signal messages from an iPhone notification database during a 2025 federal prosecution. Signal's end-to-end encryption was never broken. iOS stored the evidence anyway.
Read moreMillions are using AI chatbots for emotional support. That convenience hides a serious privacy problem. Therapy-level disclosures are being logged by companies that store and reuse the conversations.
Read moreRussia's attempt to crack down on VPNs on 4 April overloaded its own filtering infrastructure and knocked out banking payments nationwide. In 2018, a similar attempt to block Telegram produced almost identical collateral damage.
Read moreGoogle Nest routers have no local admin interface and require cloud services enabled just to assign static IPs or set up port forwarding. Your home network data is being sent to Google whether you like it or not.
Read moreOver 200 organisations want AI-generated slop banned from YouTube Kids. The legislative response being built around child safety online involves mandatory ID verification for every adult on every platform, and the breach record already shows how that ends.
Read moreApple frames each age verification rollout as compliance with local law. The result is a global identity layer being built into Apple account infrastructure, jurisdiction by jurisdiction, with no unified privacy framework governing the data.
Read moreLinkedIn silently scans your browser for over 6,000 extensions on every page load, collecting data that can reveal your religion, politics, job hunt, and health status. None of it is disclosed in their privacy policy.
Read moreQuad9 is a free, Swiss-based DNS resolver that encrypts your queries, blocks malicious domains, and doesn't log your IP. It's a meaningful upgrade over your ISP's default. It's not a privacy solution on its own.
Read moreA rootkit called NoVoice was hidden across 50+ Google Play apps downloaded 2.3 million times. It roots your device, survives a factory reset, and clones your WhatsApp session.
Read moreApple almost never patches older versions of iOS. It did for DarkSword, and the age verification features baked into iOS 26 are the most likely reason "just upgrade" stopped working as an answer.
Read morePhil Zimmermann created Pretty Good Privacy in 1991 and gave it away for free. The US government considered strong encryption to be a munition under the same laws that regulated missiles and tanks. Zimmermann distributed PGP anyway.
Read moreEvery photo you take may contain your exact location down to a few meters. This data stays embedded in the image unless something explicitly removes it. In many cases, nothing does.
Read moreLloyds Banking Group exposed personal data of up to 447,936 customers during a software glitch on March 12. The bank is asking customers who may have screenshotted other users' information to delete it. There is no mechanism to verify compliance.
Read morePolice in Coffee County, Georgia used Flock automated license plate reader cameras to issue a traffic ticket to a motorcyclist for holding a cell phone. Police departments across the country explicitly promise residents they will not use these cameras for minor violations. They lied.
Read moreA cybercrime group deployed a wiper attack targeting Iran over the weekend. The malware spreads through poorly secured cloud services and destroys data on infected systems that use Iran's time zone or have Farsi set as the default language.
Read moreGrapheneOS announced it will not comply with laws requiring operating systems to collect user age data at setup. The privacy-focused Android fork says if devices can't be sold in regions due to regulations, so be it.
Read moreAngela Lipps spent 108 days in a Tennessee jail because facial recognition software identified her as a bank fraud suspect in Fargo, North Dakota. She had never been to North Dakota. The algorithm was wrong. She lost her home, car, and dog proving it.
Read moreNavia Benefit Solutions disclosed a data breach exposing Social Security numbers, dates of birth, and personal information for 2.7 million people. Hackers accessed systems for 25 days before the company detected the intrusion.
Read moreMeta Ray-Ban smart glasses capture footage of naked people, sensitive information, and violent acts that thousands of employees in Kenya review for AI training. Investigation found workers see people using bathrooms, changing clothes, having sex, and entering credit card details.
Read moreSouth Korea's National Tax Service published photos of a seized Ledger hardware wallet with the handwritten mnemonic recovery phrase visible. Someone immediately transferred $4.8 million in cryptocurrency out of the wallet. The funds are gone.
Read moreUK Companies House exposed business data for five million registered companies from October 2025 until March 2026. The vulnerability allowed any logged-in user to access another company's dashboard by pressing the back button in a web browser.
Read more14,000 routers infected with KadNap malware form a takedown-resistant botnet that carries cybercrime traffic through residential connections. The botnet uses distributed hash tables to hide command infrastructure and sells infected routers as anonymous proxies through Doppelganger service.
Read morePornhub blocked Australian users rather than implement age verification requiring facial scans, digital wallets, or photo ID. VPN downloads in Australia surged immediately as users refused to provide biometric data and identity documents to access legal content.
Read moreMicrosoft security researchers discovered AI memory poisoning attacks where companies embed hidden instructions in Summarize with AI buttons. When clicked, these buttons inject commands into AI assistants telling them to remember companies as trusted sources. Microsoft identified over 50 unique prompts from 31 companies across 14 industries.
Read moreNew York Attorney General sued Valve for illegal gambling through loot boxes while the state runs a lottery that extracts billions from the poorest residents. The poorest Americans spend 6% of their income on lottery tickets with 1-in-45-million odds.
Read moreRing canceled its partnership with Flock Safety after weeks of public backlash over surveillance concerns. Users threatened to smash cameras over the company's ties to law enforcement while a leaked internal email showed founder Jamie Siminoff wants Search Party to "zero out crime."
Read moreResearchers at UC Santa Cruz and Johns Hopkins hijacked self-driving cars and autonomous drones using commands written on road signs. AI systems followed illicit instructions with success rates up to 95.5% in tests.
Read moreAmazon launched Search Party at the Super Bowl dressed as a lost dog feature. Every enabled Ring camera in your area automatically scans for targets and reports matches to a central system without the camera owner initiating anything.
Read moreCriminals flood small businesses with fake one-star reviews then demand payment to stop the attack. Platforms take weeks to act, leaving businesses losing customers and revenue while the damage is done.
Read moreDutch authorities seized a Windscribe VPN server without a warrant and told the company they'd return it after analysis. Windscribe disclosed the incident publicly on X. Dutch police have issued no statement and referenced no judicial warrant.
Read moreMoltbook, a social media platform for AI agents, exposed its entire production database containing user secrets and personally identifying information within days of launch. The creator bragged on X that AI wrote all the code. Researcher Gal Nagli found the database API key exposed on the front end in minutes.
Read moreInternal documents from Meta revealed during California lawsuits show the company knew Instagram was designed to be addictive and deliberately hid this from parents. Employees called it a drug. Zuckerberg said telling parents would ruin the product.
Read moreFormer Google engineer Linwei Ding was convicted on 14 counts for stealing over 2,000 pages of AI trade secrets and transferring them to Chinese companies. He uploaded confidential files to his personal cloud while secretly founding a Chinese AI startup and pitching investors using stolen Google technology.
Read moreSecurity researchers found that Bondu's AI dinosaur toys left over 50,000 chat logs exposed to anyone with a Gmail account. Children's names, birth dates, family details, and every private conversation sat on a web portal anyone could access without hacking.
Read moreAnthropic's latest model replicated one of history's costliest breaches using only Bash and Kali Linux. No custom toolkits, no iteration, no external lookups.
Read moreMicrosoft hands BitLocker recovery keys to law enforcement about 20 times annually when served with warrants. The keys live on Microsoft servers by default, letting federal agents unlock encrypted drives without asking the device owner.
Read moreSentinelOne SentinelLABS and Censys discovered 175,000 publicly accessible Ollama AI servers operating without authentication across 130 countries. The servers form a massive unmanaged layer of AI infrastructure running outside corporate security controls.
Read moreSignal Foundation president Meredith Whittaker says AI agents embedded in operating systems are destroying the practical security of end-to-end encryption. The agents require sweeping permissions to read messages and access credentials, collapsing the isolation that encrypted messaging relies on.
Read moreIndian government entities were hit by two cyber campaigns in September 2025 using GitHub repositories for command and control. The attacks filtered victims by IP address and delivered backdoors only to Windows users in India.
Read moreThe UK House of Lords voted to ban VPN services for anyone under 18. The age verification required puts Britain on the same policy path as China, Russia, and Iran
Read moreIreland's Communications Bill gives police authority to install spyware on your devices, break encryption before it activates, and track every phone in a given area. The government calls it modernization. It's state-sanctioned hacking.
Read moreThe most trusted MCP servers contain exploitable vulnerabilities. Research shows 36.7% of all MCP servers may share the same security flaws found in Microsoft's implementation.
Read moreGoogle's Fast Pair protocol was designed for one-tap Bluetooth connections. Researchers just proved it also gives hackers one-tap access to hijack your earbuds, activate your microphone, and track your location in under 15 seconds.
Read moreOleg Nefedov, a 35-year-old Russian national, has been added to the EU Most Wanted and INTERPOL Red Notice lists as the alleged leader of Black Basta ransomware. Ukrainian and German authorities identified two Ukrainian accomplices who worked as password crackers for the group.
Read moreMalicious Chrome extensions posing as enterprise productivity tools stole authentication credentials from Workday, NetSuite, and SAP SuccessFactors users. The extensions extracted session cookies every 60 seconds and blocked access to security management pages.
Read moreThe UK government created Pathways, a video game with an extremism meter that tracks children's thoughts. Schools deploy it for kids aged 11-18. Researching immigration statistics increases your score. Prevent referred a triple murderer three times and released him. Now it tracks teenage curiosity.
Read moreX reported 870,000 child abuse cases in 2023. Australia fined them $610,500 and moved on. Grok's AI deepfakes in December 2025 triggered investigations and ban threats within 72 hours.
Read moreItaly fined Apple €98.6 million over App Tracking Transparency, arguing the consent burden fell harder on third party developers while reinforcing ad tracking as the assumed norm.
Read moreAmazon stopped 1,800 North Korean operatives from infiltrating its workforce, exposing how remote hiring and broken digital identity systems are being weaponised.
Read moreIn a 2023 action, the FTC said Ring allowed employees to spy on private footage and ignored basic security, enabling hackers to hijack home cameras.
Read moreVictoria is exploiting a terrorist attack to push anti-democratic laws that restrict speech, suppress protests, and force platforms to identify users.
Read moreFlock Safety exposed dozens of Condor cameras filming unattended children and lone adults directly to the internet. Predators accessed live video and full archives with no login or trace.
Read moreAI browsers combine instruction-following models with direct access to sensitive systems, creating failure modes vendors admit cannot be eliminated.
Read moreAfter years of mass data breaches, South Korea is mandating facial verification for SIM cards, shifting identity failure into permanent biometric risk.
Read moreChildren are being given powerful digital devices earlier than ever. The problem is not technology itself but timing. Developing brains are being shaped by tools designed for constant stimulation.
Read moreCisco customers were hit by a China-linked zero-day exploit and a separate VPN brute-force campaign within days, exposing persistent edge security failures.
Read moreUS prosecutors destroyed two open source developers after regulators told them no crime existed. This case exposes how far the surveillance state will go to crush privacy tools that work.
Read moreThe KimWolF botnet is quietly infecting Android devices at scale by hiding inside trojanised apps and turning phones into invisible infrastructure.
Read moreAttackers are using stolen AWS credentials to spin up massive cryptomining workloads within minutes, draining accounts without exploiting any AWS vulnerability.
Read moreTexas is suing major TV manufacturers for using deceptive tactics to turn smart TVs into surveillance devices without real consumer consent.
Read moreEthical AI depends on consent and accountability. Under state control, AI becomes a system for scaling repression, not protecting rights.
Read moreA Google featured browser extension with millions of users silently intercepted AI chats across major platforms and exported them to analytics servers as a business model.
Read moreAttackers abused PayPal’s subscription system to send legitimate PayPal emails that falsely claim expensive purchases and push victims toward scam phone numbers.
Read moreA fake torrent claiming to contain a new Leonardo DiCaprio film was used to infect Windows users with Agent Tesla by abusing scripts, shortcuts, and built in system tools.
Read moreSession Messenger rejects phone numbers, central servers, and contact graphs. This deep dive explains how its network works, why Protocol V1 made controversial tradeoffs, and how Protocol V2 changes the cryptographic model.
Read moreMicrosoft Recall screenshots your screen by default. Signal responded by blocking Windows from capturing private conversations entirely.
Read moreRoger Dingledine helped build Tor and spent the next twenty years refusing to weaken it. That decision shaped the modern privacy landscape.
Read moreIndia is mandating SIM binding for WhatsApp, Signal and Telegram. If your SIM changes, your messages die. This is surveillance, not security.
Read moreThe US is moving from checking identities to judging expression. Five years of social media is now being treated as a border requirement.
Read moreA 19 year old breached nine companies and sold 64 million identity records. The real failure is the companies that collected that data in the first place.
Read moreThe December patches show a shift. Zero-days no longer live only in Windows. They now live inside IDEs, AI assistants and the autocomplete layer that touches your entire workflow.
Read moreShanya proves stealth is now a commodity. Ransomware gangs no longer build their own evasion. They rent it and walk straight past EDR tools still relying on a broken Windows trust model.
Read moreThe FTC denied SpyFone’s attempt to escape its 2021 ban because nothing changed. SpyFone was stalkerware and the industry still harms real people.
Read moreA new peer reviewed study shows enormous VPN brands lying about ownership, hard coding encryption keys, and quietly piping user data through insecure tunnels. The rot is systemic and it has been hidden behind Singapore shell companies and marketing gloss.
Read moreThirty vulnerabilities in AI coding tools show how prompt injection and auto approved actions can escalate into data theft and remote code execution. Every major AI IDE tested was vulnerable.
Read moreChinese state-linked groups like Earth Lamia and Jackpot Panda exploited CVE-2025-55182 in React Server Components within hours of its December 3 2025 disclosure. This unauthenticated RCE flaw gives attackers full server access without logins
Read morePetco exposed customer data after a misconfigured app left files accessible online. The real failure is the industry wide habit of collecting information it cannot defend.
Read moreAxon is using Edmonton Police to trial face recognition on body cameras. The test builds a biometric pipeline that expands police visibility far beyond live encounters.
Read moreIndia issued a secret order on 28 November 2025 forcing every phone maker to bake the Sanchar Saathi government app into devices and block users from disabling it. Three days of fury later the mandate is dead.
Read moreA SonicWall weakness let ransomware actors infiltrate Marquis Software Solutions and extract sensitive data from 74 US banks and credit unions. This attack shows what happens when a single vendor becomes a quiet central point of failure.
Read moreTwin brothers Muneeb and Sohaib Akhter spent years hacking private companies and U S government systems. Their schemes show how insider access and basic intrusions cause real damage before nation state actors ever get involved.
Read moreThe USPTO wants to cripple inter partes review and make bad patents untouchable. EFF is pushing back because the public needs the power to challenge broken law.
Read moreFlock claims it runs a smart automated safety system but the real work is being done by offshore gig workers reviewing raw footage of Americans.
Read moreAlbiriox is a new Android MaaS threat built for on device fraud, VNC control and credential theft. It targets more than 400 financial apps and bypasses FLAG_SECURE protections.
Read moreAfter media accusations and law enforcement pressure, GrapheneOS is exiting France entirely and moving infrastructure to Canada.
Read moreOver $262 million has been lost in 2025 alone to account takeover scams, with attackers mimicking bank staff and spoofing websites to steal credentials.
Read moreCISA just added an old OpenPLC ScadaBR XSS bug to the KEV list after a pro Russian crew used it in the wild. If your HMI is on the internet with default creds, you are the low hanging fruit.
Read moreUS states are pushing bills that punish VPN use and force websites to expose users. It looks a lot more like authoritarian censorship than child protection.
Read moreEdward Snowden exposed a surveillance system that watched everyone while pretending it did not exist. His leaks forced the world to face the truth.
Read moreGrapheneOS strips out Google’s surveillance layer and replaces it with real security. It takes discipline to use, but the payoff is a phone that finally works for you instead of advertisers.
Read moreMonero hides the sender, receiver and amount on every transaction. In a world built on surveillance finance, this is what real digital cash looks like.
Read moreSmart speakers are marketed as helpers but operate as networked microphones feeding Amazon and Google. Every misfire and bug proves how fragile your privacy becomes once you let them in.
Read moreSmart lightbulbs look harmless but most are insecure, invasive and built to fail. The fewer IoT gadgets you own, the safer your home becomes.
Read moreZcash’s surge has set off panic among Bitcoin purists and institutions that want crypto domesticated. Privacy is back on the table and the usual suspects are furious.
Read moreThe Federal Court issued a five point eight million penalty against Australian Clinical Labs for a breach affecting 223000 people. It confirms that companies guarding sensitive data keep failing while regulators act only after the damage is permanent.
Read moreA California judge has shut down a decade long program where police used utility smart meter data to scan entire neighborhoods without suspicion. The ruling confirms that mass data sharing by utilities crosses clear legal limits.
Read moreResearchers scraped 3.5 billion WhatsApp profiles using WhatsApp’s own contact discovery feature. No hack. No breach. Just a system that exposes too much data by design.
Read moreHidden documents show Meta estimates up to 10% of its 2024 revenue comes from scam advertisements and that its platforms display 15 billion “higher risk” scam ads each day.
Read moreBritain now arrests people for tweets, memes and opinions. Australia is copying the same digital ID structure that lets it happen.
Read moreThe GUARD Act claims to protect kids, but the fine print reveals a mass identity check for every American and a ban on teens using basic digital tools.
Read moreFlock Safety built a private surveillance empire by turning neighbourhoods into checkpoints and handing your data to police and federal agencies. Here is how the system really works.
Read moreWireGuard stripped VPNs back to what matters, modern cryptograpy, tiny attack surface, insane speed, and zero legacy baggage. Here is why we built Blackout on top of it.
Read moreA contractor leaked over seventy thousand government ID images tied to Discord accounts. Safety laws created the target.
Read more‘Child safety’ laws are being used to justify nationwide identity verification. Here's how digital ID systems and age checks merge into one surveillance framework.
Read moreA simple guide to what Linux is, why it exists, and how to install it. Learn why privacy users trust it and how to start safely.
Read moreNaomi Brockwell cuts through the noise with practical privacy that works in the real world.
Read moreThe Five Eyes alliance turned wartime cooperation into a permanent surveillance network. Here’s how it formed and what it means for privacy.
Read more