Brandmauer Report

White House press bans spark new First Amendment fight
Censorship blocking · 21.09.2026

POLITICO, CNN, and MS NOW have filed a lawsuit against Trump and three of his advisers after their journalists were barred from the White House on Saturday, with the Secret Service confiscating their credentials. The complaint calls it "a direct assault on the First Amendment" — and really, what else would you call it, given that the president explained the ban on Truth Social with the words "FAKE NEWS," "FICTION and LIES"?

Trump's extended explanation sounds no more convincing: "It's just years of accumulated stories. You get tired of it. They're smart people, but they deliberately write negative things." So apparently the law on press freedom is now governed by how tired the head of state gets of other people's opinions.

The outlets are asking a Washington court to immediately declare the ban unconstitutional. Their argument is solid: revoking credentials without warning violates the Fifth Amendment (due process), while punishing journalists for the content of their reporting is a direct violation of the First. Case law, by the way, backs them up — half a century ago, the D.C. Circuit ruled that journalists cannot be arbitrarily denied access to the White House based on the content of their coverage.

History keeps repeating itself with tedious regularity. In 2018, CNN's Jim Acosta had his pass revoked — a court restored it. In 2019, the same thing happened to Playboy's Brian Karem — a court reinstated his credentials again. In 2024, the Associated Press was kicked out of the press pool for refusing to recognize the renaming of the Gulf of Mexico to the "Gulf of America." That case is murkier: an appeals court ruled that the Oval Office and Air Force One aren't spaces where the First Amendment applies in full, and that the White House can choose which journalists to admit "including on the basis of viewpoint." AP never actually won that case — there's still no ruling on the merits.

A juicy detail: the Secret Service itself, while seizing the credentials, acted "without notice or process." A democracy where the press is treated with the logic of "confiscate the badge first, explain later" — now that's certainly novel.

Source: https://www.politico.com/news/2026/09/21/news-outlets-trump-banned-from-white-house-announce-lawsuit-01085995

One App to Track Them All: Inside Russia's Max
Surveillance control · 21.09.2026

Российское государство нашло идеальный способ следить за гражданами: заставить установить одно приложение вместо десяти. Международная команда исследователей из университетов Мичигана, Калгари, Джорджии и Дели разобрала супер-приложение Max на запчасти — результат впечатляет даже по меркам цифрового авторитаризма.

Wait, let me provide the actual English translation below.

The Russian state has found the perfect way to surveil its citizens: force everyone to install one app instead of ten. An international team of researchers from the universities of Michigan, Calgary, Georgia, and Delhi took apart the Max super-app piece by piece — and the results are impressive even by the standards of digital authoritarianism.

Since March 2025, Max, made by the VK group (whose management is under EU sanctions specifically for suppressing free speech), has been pushed onto the market while Roskomnadzor simultaneously strangles Telegram and WhatsApp. The outcome: schools, payments, access to government services — none of it works without Max anymore. A classic move: first cut off the alternatives, then declare the only remaining option "convenient."

Technically, it's elegant and terrifying at the same time. Android isolates every app by default — but a super-app breaks this model, turning itself and all its embedded mini-apps into a single trust zone. Researchers counted five attack vectors: Max can secretly take screenshots, read cookies and session tokens in plain text, inject arbitrary JavaScript code, route traffic through state proxies, and impersonate the user to mini-apps. No system permissions, no warnings, no traces — just quiet and orderly.

Meanwhile, the app itself is armored: it checks for VPNs, SIM cards, geolocation, time zones, refuses to connect from non-Russian IPs, and uses its own GOST TLS encryption instead of international standards. Reverse-engineering this thing from the outside is quite the challenge — and that's no accident.

A special touch for connoisseurs of irony: according to insiders, Russian officials themselves keep using Telegram and Signal, while Max sits on a spare phone. Convenience for the people, apparently, doesn't have to apply to everyone.

The Guardian and the researchers warn of the main risk: merging every aspect of life into one state-controlled app means that blocking an account can instantly cut a person off from school, transport, and finances all at once. The scientists are calling for super-apps to be regulated like browsers — with strict OS-level isolation.

And yes, the trend toward weakening end-to-end encryption isn't exclusive to authoritarian regimes. The UK's Online Safety Act, initiatives in Canada, and talk of chat control in the EU are all heading in the same direction — just using different words, for now.

Source: https://www.heise.de/hintergrund/Digitaler-Totalitarismus-Wie-Russlands-App-Max-zur-Ueberwachungswaffe-wird-11459403.html

Weekly digest: Three countries, one recipe: protect children by scanning all adults
The week "child protection" became a password for surveilling everyone — we break down three laws that could make it legal

— Britain wants to scan every photo on every phone, and disable device features for those who refuse
— Canada is advancing a surveillance law that will reach you even if you've never set foot in Canada
— The EU is preparing a Kids Act where you'll need an ID just to scroll TikTok at 35

📖 Full breakdown: https://telegra.ph/Brandmauer-Report-weekly-digest-140920092026-09-21

❤️ Reactions under posts are votes: what makes it into the digest is what you read and like.

TikTok Turns 10: From Lip-Sync App to Geopolitical Fault Line
20.09.2026

TikTok is turning 10 — a good moment to recall that it all started with teenagers lip-syncing to playback in front of a phone camera. On September 20, 2016, A.me launched in Beijing, later rebranded as Douyin. TikTok itself prefers to count from its international launch in 2017 or the 2018 merger with Musical.ly — apparently, a lip-sync teen past sounds less presentable for a multi-billion-dollar corporation.

But there's no need to be shy about it: it was precisely the billion-dollar acquisition of Musical.ly and the "Interest Graph" algorithm — as opposed to the usual "Social Graph" — that turned the internet upside down. Facebook and Instagram showed you content from people you followed. TikTok ditched the follow model and started showing whatever actually kept you glued to the screen. The result: a brand-new account with zero followers can rack up millions of views overnight. Meta, Google, and Snapchat panic-copied the format — resulting in Reels and Shorts, twins under different signs.

From there unfolds a curious geopolitical triptych. In China lives Douyin — the same product, but under strict censorship: politically inconvenient content simply doesn't appear there. In the West, TikTok has been accused of leaking data to Chinese authorities — accusations China's Foreign Ministry has denied. In the US, this turned into a years-long legal and political drama that ended in January 2026 with a joint venture under American control. Beijing, in response, accused Washington of bullying the company. TikTok rolled out "Project Texas" and "Project Clover" — billion-dollar initiatives to store data in Ireland and Norway to reassure everyone. Meanwhile in Europe, the DSA keeps the platform in its crosshairs over transparency and child protection.

Meanwhile, TikTok has long stopped being about dancing: it's a search engine for Gen Z instead of Google, a news source, and a giant shopping mall — #TikTokMadeMeBuyIt sells out products within hours. And alongside that — doomscrolling, toxic beauty standards, and dangerous challenges. The 60-minute screen time limit for minors can be switched off in a couple of clicks — turns out combining care with attention-grabbing just didn't work out.

Source: https://www.heise.de/news/Zum-10-jaehrigen-Wie-TikTok-das-Netz-umgekrempelt-hat-11459349.html

White House Redefines "Fake News" as Critical Press
Monitoring orgs · 19.09.2026

The White House has announced which news counts as honest and which doesn't. Spoiler: honest news is whatever Trump likes.

On Saturday, journalists from CNN, MS NOW, and Politico were turned away at the White House entrance, their press badges deactivated right in front of the cameras. Correspondents from CNN and MS NOW went live on air describing how they were being denied entry to work. An MS NOW journalist had her badge shut off after passing through two checkpoints — the officer said the decision was "above his pay grade" and asked her to hand it over. A Politico correspondent had her badge confiscated outright.

The official reason was a post Trump made the day before, announcing a ban over "fake news." Asked to clarify in the Oval Office, the president offered an exhaustive explanation: "Because it's fake news." About CNN — "they have bad ratings." About MS NOW — "fake news." About Politico — "the stories they wrote are fake." Airtight logic, no arguing with that.

All three newsrooms have already hinted at legal action and cited First Amendment protections. The White House Correspondents' Association demanded immediate restoration of access, rightly noting that a standard used to expel one outlet today can be applied to any other tomorrow.

This isn't the first such episode. Last year, the AP got hit for refusing to rename the Gulf of Mexico the "Gulf of America" in line with the president's wishes. That case is still in court. Meanwhile, disputes are ongoing with the New York Times, the Wall Street Journal, and the BBC, and tensions are simmering with ABC over its broadcast license.

Media law professor Amy Kristin Sanders states plainly: the administration has no intention of playing by traditional First Amendment rules, and its hostility toward the press is unmatched among modern US presidents. CNN analyst Brian Stelter called what's happening a direct threat to press freedom — adding that this is far from just about CNN; it's a test of free speech for the entire country.

The AP summed it up as simply as possible in its statement: no outlet — and no person — should face retaliation from those in power over the words they choose to use.

Source: https://www.bbc.com/news/articles/cj4gklz9dxplo

Venezuela unblocks 16 sites, keeps 188 censored
Censorship blocking · 18.09.2026

Venezuela's Conatel solemnly announced: the sites have been unblocked. Technically, this is called a "technical notice on domain unblocking" — a phrase so bureaucratic it practically begs to be censored itself. The order came from Acting President Delcy Rodríguez, but as for how many portals were opened and which ones — the agency modestly kept quiet. Transparency at its finest.

So people had to count for themselves. The NGO Conexión Segura y Libre, through its VE sin Filtro project, recorded 16 unblocked domains as of Thursday afternoon. Meanwhile, 188 remain blocked — 79 of them news portals. In other words, less than a tenth of what was shut down has been reopened. If this is a goodwill gesture, it's a remarkably stingy one.

The opposition's reaction is restrained. Dinorah Figuera, who leads the opposition delegation in talks with the government, called it merely a "first step" and demanded that all media be made accessible without restrictions and on a permanent basis — not just until the next technical notice.

Sofía Macher, head of the UN commission investigating human rights violations in Venezuela, pours cold water on the celebration: unblocking a few media outlets doesn't mean lifting all restrictions on press work. According to her, "not all the channels that should have been unblocked have been unblocked." She specifically pointed to the repressive legal framework and the arrests of journalists.

The commission led by Macher had already noted in an earlier report that, despite some minor easing, Venezuela's repressive apparatus continues to function smoothly. Against that backdrop, 16 unblocked domains look less like a victory for free speech and more like a gesture — symbolic, selective, and easily reversible.

Source: https://www.heise.de/news/Venezuela-Kritische-Portale-sollen-wieder-zugaenglich-sein-11458651.html

2025: A Record Year for Internet Shutdowns
Shutdowns · 18.09.2026

2025 has officially become the worst year in the history of internet shutdowns. Access Now and the #KeepItOn coalition counted 313 deliberate internet disruptions across 52 countries. Not glitches, not accidents — deliberate decisions. A new all-time low.

The numbers from Vodafone's fresh report "Network Shutdowns in a Connected World" speak for themselves. Full internet blackouts increased by 47% in terms of hours compared to 2024. Shutdowns of individual social networks and platforms rose by 66%. Around 800 million people were affected in 2025. Simply cut off from communication.

The economy doesn't benefit from this — it loses nearly $20 billion, with the lion's share of these losses falling on low- and middle-income countries. It hits hardest those who already have it toughest.

At the same time, as the report's authors admit, shutdowns almost never achieve their stated goals. The logic of "cut the internet and things will get safer" doesn't work: emergency communications disappear, cybersecurity monitoring weakens, and disinformation thrives in the resulting information vacuum. Instead of order, you get chaos with an extra step.

In response, Vodafone proposes a Transparent Governance Framework: connectivity shutdowns only as a last resort, only with a clear legal basis, proven necessity, the absence of less severe alternatives, and mandatory independent oversight. Plus public reporting on why it was done in the first place and whether it worked.

It sounds like a basic set of decencies for any government. But the fact that a separate report has to be written about this means it's been far from basic for a long time.

Source: https://www.vodafone.com/news/newsroom/public-policy/network-shutdowns-reach-record-levels-as-vodafone-calls-for-stronger-safeguards

Norway launches probe into Telenor's Myanmar exit
Surveillance control · 17.09.2026

On September 15, 2026, Norwegian authorities announced an investigation into Telenor — the company is suspected of crimes against humanity and sanctions violations in Myanmar following the 2021 military coup. The phrase "crimes against humanity" isn't typically found in a telecom company's quarterly reports.

The story started earlier. Back in August 2021, Access Now, together with 44 organizations, warned Telenor's board of directors: selling the Myanmar subsidiary to the military-linked M1 Group was a bad idea, and due diligence following international standards was needed. Telenor responded on September 3, 2021. And then sold the business anyway.

The problem isn't leaving the market itself, but how the exit was handled. The company left behind users whose data ended up in the hands of a structure tied to the army that staged the coup. It was precisely this hasty and irresponsible exit that Access Now and civil society had been sounding the alarm about for years.

Last year, Justice for Myanmar and ICJ Norway filed a police report. This year, the Swedish Justice and Accountability Initiative, backed by Myanmar and European organizations, filed a class action lawsuit. Now the case has escalated into a full-scale investigation.

The moral is simple and uncomfortable for the entire telecom and tech industry: exiting a market is not an exit button from human rights responsibility. Companies hold enormous volumes of sensitive data about people, and if that data falls into the hands of a repressive regime, the consequences can be irreversible. Due diligence must apply not only when entering a market, but also when leaving it — especially if that market is in a conflict or crisis zone.

Access Now reminds us: businesses are obligated to respect human rights everywhere and always, in line with the UN Guiding Principles on Business and Human Rights. The investigation against Telenor is a signal to everyone else that these principles aren't just decorative.

Source: https://www.accessnow.org/press-release/telenor-under-investigation-for-crimes-against-humanity-in-myanmar/

Congressman's parting gift: a site-blocking bill
Censorship blocking · 17.09.2026

Congressman Darrell Issa, who's leaving the House of Representatives in a few months, decided to leave America a farewell gift — a bill to block foreign pirate sites. He introduced it this week, just as he promised back in late June.

The gist is simple: rights holders get court orders for blocking, which are then sent to internet providers, domain name services, and even VPNs. So if a pirate site used to just get taken down over a DMCA complaint, now it can be shut off entirely — at the infrastructure level.

Issa's reasoning is downright poetic. At the hearings he asked: "Can we do this at the speed of sound? At the speed of light?" The point being that pirates can rip a 45-minute live sports broadcast apart faster than rights holders can write a complaint. Another nice touch — the claim that online piracy funds terrorist groups and other criminal networks. Bold, but as usual, not a single figure to back it up.

Issa is neither the first nor clearly the last — a whole line of Republicans and Democrats have already championed site-blocking, all generously backed by the Motion Picture Association. The industry has long dreamed of a kill switch it can flip without having to sue individual pirates in court.

Civil liberties advocates aren't thrilled. Meredith Rose of Public Knowledge calls it as it is: instead of suing the people actually running pirate sites abroad, Congress, at the film industry's urging, is building censorship infrastructure. And it doesn't just hit pirates — everyone from home ISPs to global DNS resolvers would be required to block, based on nothing more than a suspicion of copyright infringement.

A classic story: a problem with a specific target gets "solved" with a weapon of mass destruction. And ordinary sites mistakenly accused of piracy end up catching the blast too.

Source: https://arstechnica.com/tech-policy/2026/09/republican-bill-would-order-isps-dns-providers-and-vpns-to-block-piracy-sites/

EU's Kids Act turns parents into ID checkers for Big Tech
Surveillance control · 17.09.2026

The EU has figured out how to protect children online: turn parents into IT admins, lawyers, and document couriers for Google and ByteDance all at once. Meet the Kids Act.

The plan's essence: kids under 13 are banned from YouTube, Instagram, and Fortnite; under 15, only stripped-down options are allowed. Sounds caring. In practice, it's a new bureaucratic quest for parents that solves nothing.

The author, a father of two, describes his current daily routine: hours spent configuring access permissions, disabling notifications, manually unblocking websites, and rationing screen time. He calls this the "Family-Tech-Cycle" — a process with no end. The Kids Act doesn't ease this; it piles on top of it. Now a parent will have to prove they're actually a parent — submitting proof of custody just to set up a monitored account for their child. That data will, of course, fly straight to the same corporations famous for hoarding everything that can be monetized.

Next comes a dystopian-style choice: either the child scans their face for "age estimation" and hands over biometric data to who-knows-whom, or the family uploads passport information. The Commission offers a "Mini-Wallet" app — supposedly data-light, but, as the author writes, it's "one update away from a privacy nightmare."

And all this works, to put it mildly, not very well: in Australia, similar age-verification systems have been cheerfully bypassed by anyone who wants to since the start of the year.

The central paradox: rules for safe design — no endless addictive feeds, no manipulative push notifications — are being proposed only for children. Yet they're obviously needed by everyone. Instead, the Commission is building an infrastructure of universal passport-based age verification — something, as the author notes, authoritarian governments can only dream of. And in the process, it risks cutting off from the internet anyone who simply lacks the right documents or technical means to pass verification.

Anonymity and free access to information aren't luxuries — they're the condition that lets abuse survivors, queer people, and whistleblowers use the internet without drawing attention. That's what's at stake right now.

Source: https://netzpolitik.org/2026/eu-kids-act-dieses-gesetz-macht-es-fuer-eltern-nicht-besser-sondern-schlimmer/

Federal Judge Reminds ICE That Insults Aren't Crimes
Censorship blocking · 16.09.2026

A federal judge this week explained a basic thing to ICE: calling an official a "monstrous person" in a letter is not a crime — it's protected speech. It took a preliminary injunction to make that point land.

Here's the story. In January, David Streuver sent acting ICE Director Todd Lyons an angry three-paragraph letter. The trigger was the killing of two anti-ICE protesters in Minnesota — Renee Good and Alex Pretti. Streuver compared Lyons to Reinhard Heydrich, called him a butcher, and predicted he'd be tormented by his conscience for the rest of his life. Harsh, sure, but it's a value judgment about an official's actions, not a threat to harm anyone.

ICE initially just ignored the letter. Then, five months later, it suddenly remembered and showed up at Streuver's home with an official warning: your correspondence, they said, could amount to a criminal threat of violence. Notices like this are usually issued for threats of murder, kidnapping, or assault — but the agency decided that moral condemnation of leadership fit the same category. It demanded he stop criticizing ICE leadership, or else face charges — state or federal, take your pick.

One extra detail: Streuver wasn't home when the agents came, so they tracked him down at a hotel. FIRE lawyers representing him call this "deeply troubling" — and it's no surprise that after a visit like that, a person starts self-censoring just to avoid drawing further attention.

Bottom line: a letter containing emotional criticism of a government official was treated by ICE as a criminal threat, its author was tracked down to a hotel, and he was pressured into silence — until a court said that's not how this works. A good illustration of how the chilling effect operates: you don't need to jail someone for their words, a knock on the door is enough.

Source: https://arstechnica.com/tech-policy/2026/09/its-ok-to-tell-ice-their-actions-will-haunt-them-judge-rules-in-speech-fight/

Nigeria's spyware debate exposes the legal loophole
Surveillance control · 16.09.2026

In Nigeria, experts gathered to discuss spyware and surveillance — and the result was a perfect snapshot of a state that swears by legality while leaving itself a loophole the size of an entire country.

Natalia Krapiva, a technology law lawyer, explained the essence simply: spyware is secretly installed on a device without the owner's knowledge and extracts everything — messages, photos, contacts, even keystrokes. Mass surveillance, according to her, is also used to monitor protesters — people who simply disagree with the authorities. The consequences aren't limited to a loss of privacy — it's about the destruction of personal and professional life.

Lawyer Olumide Babalola pointed out that surveillance itself isn't prohibited, but it must fit within the framework of the law — the Constitution, the Communications Act, and the NCC's 2019 Lawful Interception of Communications Regulations, with proper procedures and warrants. The real problem lies elsewhere: while arrests and charges get recorded, no one accounts for the loss of personal autonomy — the fact that what's supposedly private has long since been viewed by someone else.

Ibukunoluwa Owa, a representative of the National Data Protection Commission, added a note of methodology: it's important to distinguish between spyware and surveillance, since the legal response depends on it. Surveillance must be justified and proportionate — which sounds lovely on paper.

Journalist Fidelis Mac-Leva, who has worked on this topic for two decades, put it more bluntly: he has personally seen cases where surveillance equipment was used against human rights defenders and journalists, some of whom were later detained right while doing their jobs.

The police, naturally, defend themselves with tools of their own. The National Cybercrime Centre, established under the 2021 Cybercrimes Act, explains that criminals also use sophisticated technology, so authorities need to as well. They seize phones and gadgets from suspects — but, they insist, without coercion. A phrasing that makes you want to ask: if a device is "required for the investigation," isn't that exactly what coercion looks like, just politely worded?

Source: https://www.icirnigeria.org/spyware-surveillance-experts-raise-privacy-concerns-as-police-defend-digital-investigations/

California Trades Net Neutrality for Federal Broadband Cash
Censorship blocking · 16.09.2026

California is ready to take $1.86 billion from Trump for broadband. Fine print: in exchange, the state agrees to forget what net neutrality is. For 14 years. And not just where the federally funded cable gets laid, but statewide.

A reminder: California spent years in court defending its own net neutrality law — a ban on providers blocking traffic or charging websites for priority delivery. Trump's first administration tried to bury it and lost in court. The second found a workaround: it built the neutrality waiver into the conditions of the BEAD grant. Don't want to comply — don't get the money.

Tomorrow the California Public Utilities Commission (CPUC) votes on a resolution it calls a "procedural formality." Attorney Paul Goodman of the Center for Accessible Technology disagrees: "This is the beginning of the end." After the vote, challenging the conditions in court will become nearly impossible — the case would have to be brought in the D.C. Circuit, where the bar for evidence has been raised to "prove fraud or corruption." Before signing, there was still a chance in the more favorable Ninth Circuit.

Also potentially on the chopping block: the law banning throttling of emergency services (passed after Verizon slowed firefighters' internet during a wildfire), the condition from the Verizon merger requiring $20 internet for low-income households, and the attempt to regulate AT&T's landline rates.

Nearly 30 civil rights organizations wrote to Governor Newsom urging him not to give ground. 69% of California's BEAD money will go to the same five giants anyway — Comcast, AT&T, Verizon, Amazon's Kuiper, and Starlink. Stanford professor Barbara van Schewick puts it bluntly: a federal agency cannot use grant fine print to overturn what Congress wrote into law.

A similar story is unfolding in New York, which has already agreed to $664.6 million — putting at risk the affordable internet law the state also fought for in court. The scheme is simple: money in exchange for surrendering state sovereignty over communications regulation. Federalism as a service, except the service is temporarily unavailable.

Source: https://arstechnica.com/tech-policy/2026/09/california-may-gut-state-net-neutrality-law-to-comply-with-trump-admin-demand/

Turkey Raids LGBTI Groups Under 'Family Safety' Banner
Censorship blocking · 16.09.2026

On the night of September 13, Turkish police carried out an operation with the telling name "your family is safe." The result: 162 detained, among them 50-60 human rights defenders and LGBTI activists. Charges include "indecency," "prostitution," and other formulations from the "morality" category — a morality apparently protected through nighttime raids.

The selection of targets is telling: those hit weren't rank-and-file members but board and audit committee members — the people through whom organizations officially function. Detentions took place at Kaos GL and Pembe Hayat in Ankara, Muamma and 7 Renk in Mersin, SPoD, Hevi, Lambda, LİSTAG, Pozitif Yaşam, and Pozitif-iz in Istanbul. Nine organizations and 13 businesses targeted in a single operation.

Hours before the raids, a court blocked the websites and social media accounts of LGBTI organizations. The timing is so telling that calling it a coincidence would be naive.

A separate issue is the seized digital equipment. Such organizations' databases hold data on activists, people living with HIV, survivors of violence, lawyers, journalists, and donors. This isn't just "case evidence" — it's sensitive information about real people, and how it will now be used remains unknown.

Justice Minister Yılmaz Tunç explained the matter in plain terms: an investigation against associations that, quote, "promote LGBT and immorality." The Financial Crimes Investigation Board (MASAK) has already been brought in to examine foreign funding of NGOs. International cooperation and grants are suddenly turning into elements of a crime, even though there's nothing criminal about them in essence.

Human rights organizations — from ILGA-Europe to Front Line Defenders and ARTICLE 19 — are demanding the immediate release of those detained, the lifting of the blocks, and an end to using "family protection" rhetoric as cover for discrimination. The demand is essentially simple: human rights work is not a crime, and a crackdown on civil society under the banner of morality isn't a fight for decency — it's an imitation of one, carried out with police batons.

Source: https://www.article19.org/resources/turkiye-end-attacks-on-lgbti-organisations-activists-and-protesters-now/

EU Kids Act: good intent, unworkable execution
Censorship blocking · 16.09.2026

Tomorrow von der Leyen will unveil the EU Kids Act to the world, but the text has already leaked — and honestly, it should have stayed in the drafts. The stated goal is noble: protect kids from toxic feeds and endless scrolling. The execution, as usual, is grand ambition backed by shoddy craftsmanship.

The minimum age for your own social media account is 15. But age verification will apply to everyone, including adults. A social network is deemed "risky" if you can message a stranger on it or see a personalized feed — which is basically any platform with normal functionality. Want to scroll TikTok at 35? Get your passport ready for the EU's age-verification app.

It gets better: the rules don't just cover social networks but also chatbots, AI companions, games, and app stores. ChatGPT, Claude, Roblox, Fortnite, the App Store, Google Play, Steam — all of them will have to either show a stripped-down kids' version or demand age verification. Catalogs with millions of apps will need to be manually re-labeled — a bureaucratic delight that'll take years.

A separate masterpiece is the wording on "age assurance": it must be accurate, reliable, secure, minimally invasive, and privacy-protecting all at once. Age-verification tech is physically incapable of being both accurate and non-invasive at the same time — it's like demanding a lock be both pickable and unpickable.

The pinnacle of lawmaking is Article 28: "any age verification measure must be zero knowledge proof." The Commission mixed up a noun with an adjective, turning a cryptographic term into a meaningless phrase. Even the EU's own age-verification app doesn't make this mandatory.

Parents get a quest of their own: three documents just to set up an account for their kid — proof of their own age, proof of the child's age, and proof of custody. The infrastructure to verify any of this simply doesn't exist yet — but that doesn't seem to bother the bill's authors.

On top of that, a parental account would get to approve every new contact the child makes and limit app usage to one hour a day. We're talking about teenagers who already ride scooters and go on dates unsupervised — but apparently the internet is a bridge too far.

The CCC has already called the proposal the end of the anonymous internet, D64 calls it a threat to the right to participate in public life, and EDRi rightly points out: if a design is harmful for a 13-year-old, it won't magically become safe the day they turn 18. The document hasn't even been officially presented yet — and the seams are already splitting.

Source: https://netzpolitik.org/2026/eu-kids-act-eu-kommission-will-netz-mit-alterskontrollen-zupflastern/

Iran's CHOSEN BRICK Spyware Targets Dissidents via WhatsApp
Surveillance control · 15.09.2026

Британия, США и Нидерланды объединились и выпустили совместное предупреждение о шпионской программе иранских спецслужб...

Подождите, я вижу, что должен выполнить перевод на английский. Позвольте исправить:

Iran's CHOSEN BRICK Spyware Targets Dissidents via WhatsApp

Britain, the US, and the Netherlands have teamed up to issue a joint warning about spyware run by Iranian intelligence services. Its name sounds like a callsign for a military operation — CHOSEN BRICK. In reality, it's just a tool for surveilling dissidents, activists, and journalists through WhatsApp and Telegram.

The scheme is standard fare for intelligence agencies: spoofing trusted contacts and social engineering. Britain's NCSC notes that the attackers tailored their approach to each specific victim — going as far as sending fake MRI results to get the person to download the spyware onto their own phone. Healthcare concern, but digital and with the opposite effect.

The malware's functionality is the usual toolkit for total control: harvesting contacts, email, social media, taking screenshots, and accessing the microphone. NCSC reports that some victims' data later surfaced on pro-Iranian leak sites — meaning the surveillance wasn't an end in itself, but part of a broader public pressure campaign.

According to the FBI, Iran's Ministry of Intelligence and Security (MOIS) is behind all of this, and the goal is stated without any shame: gathering intelligence, orchestrating leaks, and damaging targets' reputations. The three countries agreed on the phrase "almost certainly" — Iran uses cyber operations to suppress those it views as threats.

The FBI hasn't disclosed how many people were affected or where exactly. What is known, however, is that a hacker persona linked to this story, Handala Hack, has previously surfaced in an attack on American medical supplier Stryker and in a leak of FBI Director Kash Patel's personal email. Iran's embassy in London did not respond to a request for comment — as usual in cases like this.

Source: https://www.reuters.com/world/uk-us-netherlands-issue-advisory-iran-spyware-2026-09-15/

Malaysia Freezes Rights Groups' Accounts Without Explanation
Surveillance control · 15.09.2026

Malaysia has invented a new way to fight foreign funding — just freeze the accounts of human rights defenders without explanation. Neat, elegant, and best of all, no need to bother with evidence.

On September 11, it emerged that the personal bank account of Amir Harith Hadi, executive director of MANDIRI, had been frozen under Section 44(1) of the anti-money laundering law — until further notice from the police. At the same time, the accounts of MANDIRI's financial director and HAYAT CEO Dobby Chew were frozen, along with the accounts of both organizations. As of September 14, the organizations still had received no official notification of any investigation. The money is simply gone, and as for why — figure it out yourself.

The story began in May 2026, when the political secretary to the finance minister and head of PKR's youth wing, Kamil Munim, called for an investigation into "foreign funding" of NGOs, activists, and politicians — for the sake of national security, of course. A formulation that opens the door to just about anything.

A week before the accounts were frozen, on September 3, Amir Hadi learned he was barred from leaving the country. Around the same time, Dobby Chew ran into trouble returning to Kuala Lumpur from Jakarta — and was likewise barred from traveling. Both voluntarily showed up at the Bukit Aman police station on September 14 to clarify the situation — since no one had bothered to inform them of anything.

This is not an isolated case. There's an investigation against former C4 Center head Pushpan Murugiah for "activity harmful to parliamentary democracy." There are the arrests of activists Hamdin Nordin, Fakhrurrazi Khairur Rijal, and Ahsanul Akmal Sulam over allegations of abuse at the Anti-Corruption Commission. There's the probe into activist Shakila Zen for linking a royal institution to sand mining. And there's the travel ban on three BERSIH activists.

ARTICLE 19 and CIVICUS are demanding the accounts be unfrozen, the travel bans lifted, and the investigations dropped. Malaysia is heading into elections — the perfect time to show whether civil society can be strangled without consequences, or not.

Source: https://www.article19.org/resources/malaysia-reprisals-against-human-rights-defenders-threaten-civic-space/

Canada's surveillance bill reaches everyone, everywhere
Surveillance control · 14.09.2026

Canada is quietly passing a surveillance law that concerns literally everyone — including you, even if you've never been to Canada and know nothing about it.

Bill C-22, aka the Lawful Access Act, has passed first reading and is now on the home stretch in the Senate: hearings begin in late September, and the law could be adopted as early as October. Here's what's inside.

The law requires providers — messaging apps, cloud storage, connected cars, cameras, fitness trackers — to build in "any form of technical capability" for government access. Formally, there's an exception for "systemic vulnerabilities." But non-systemic ones? Fair game. And who decides what counts as systemic? The government. Convenient.

A separate masterpiece: the government refused to explicitly ban measures that circumvent the whole point of encryption. They agreed to ban direct decryption, but client-side scanning, hidden accounts in encrypted chats, and zero-click spyware-style backdoors were all left on the table. Encryption stays formally untouched — they just make it so it's effectively not there.

Next up — unrestricted metadata collection: which agencies get access, what they'll do with the data, where it goes after the retention period expires — none of it is specified. For comparison: the European Court of Justice has three times ruled that mass, indiscriminate metadata collection is incompatible with the EU Charter, and in Opinion 1/15 rejected the EU-Canada PNR agreement precisely because of the lack of safeguards in Canadian law. Nothing has changed since then — Canada's basic privacy law dates back to 2000.

And the cherry on top: secrecy by default. A company that receives a secret order must first notify the minister and wait 15 days before it can even challenge it — and must comply the entire time. There's no independent judicial authorization, only after-the-fact review, and often a limited one.

Formally, this story concerns the EU directly too: the law reaches any provider with Canadian users or business in Canada. That means a European company could receive a secret order to weaken a product's protection for all its European users — and wouldn't be allowed to say a word about it.

Human rights organizations, including EDRi, Access Now, and Article 19, are demanding the European Commission stop staying silent: raise the issue in digital trade talks with Canada, review the data adequacy status, and state clearly that weakening encryption is incompatible with the EU's cybersecurity commitments.

The Senate is the last chance to fix anything. After that, it'll be too late to explain why yet another "anti-terrorism" law turned out to be a tool for surveilling everyone, once again.

Source: https://www.accessnow.org/press-release/the-eu-must-act-now-canadas-overreaching-bill-c-22/

Boston's Flock Pilot Shows How Easily Data Sharing Leaks
Surveillance control · 14.09.2026

Boston police signed a free pilot contract with Flock for license plate recognition: 156 days, from April 1 to September 4, 2025. The agreement stated in black and white: data sharing with other agencies — disabled. Flock confirmed: the settings were turned off.

Three days later it turned out that other law enforcement agencies had been quietly reading other people's plate data the whole time. The cause — a "glitch" on Flock's end. Just a glitch, nothing personal, merely outside agencies gaining access to data on the movements of city residents.

During the pilot, Boston received 77 requests for data access from outside agencies. An internal audit found 11,004 search queries in the database — and in almost half the cases, officers didn't specify the case number the investigation was tied to. In other words, they searched for reasons unknown and reported to no one why.

Which agencies exactly gained access and how many drivers were exposed remains unclear from the report. All that's known is that "thousands of agencies" are connected to Flock's national network. Convenient: the system leaks, but who exactly drank from that leak is, apparently, a trade secret.

Against this backdrop, Mayor Michelle Wu announced that the city is dropping Flock. The wording is bureaucratic, but the point is clear — if access settings can't be reliably restricted, the platform won't be used.

Meanwhile, Massachusetts is building up a collection of stories about surveillance being put to unintended uses. In Stow, an officer resigned after using Flock cameras to track an acquaintance — the department removed all the cameras. In New Bedford, an employee was placed on leave on suspicion of tracking an ex-girlfriend.

Bellingham, Auburn, and Stow are terminating their Flock contracts one after another. On Beacon Hill, lawmakers are discussing rules for license plate recognition systems: who can get access and when data can be shared with others. While regulators deliberate, the system has already shown one thing: turning data sharing on is far easier than reliably turning it off.

Source: https://www.govtech.com/public-safety/boston-drops-flock-after-outside-agencies-access-data

Data centers are fleeing to orbit, and laws can't follow
Surveillance control · 10.09.2026

While countries argue over who has the right to read your messages, tech giants have solved the problem radically: they simply moved the servers where no jurisdiction exists at all. SpaceX aims to launch its first generation of orbital data centers in Q4 2027, with ambitions of 100 gigawatts of capacity by 2030. It sounds nice — "progress," "AI," "space." In reality — it's an escape from the law at an altitude of 500 kilometers.

The logic is simple. The 1967 Outer Space Treaty prohibits claiming orbit as territory — meaning the requirement to "store citizens' data within the country" is physically impossible to fulfill there. Jurisdiction over a satellite belongs exclusively to its country of registration. What you get is a flag of convenience — not for a cargo ship, but for a server holding your medical records: data from a company in the Middle East flies up to a satellite registered somewhere else entirely, and local data protection laws simply stop applying.

It's the Arab states that have ended up in the most vulnerable position. For years they built digital infrastructure at home and introduced strict requirements to store residents' data within the country — and suddenly it turns out the server processing their citizens' data is hanging five hundred kilometers overhead, beyond the reach of their courts. And so far there's no clear response to this situation in sight: no unified stance, no ready plan of action — essentially, confusion in the face of something that's changing the very nature of digital sovereignty faster than laws can be written.

At the same time, the road to space isn't for everyone. A gigawatt of orbital capacity costs around $170 billion, versus $14.1 billion for a ground-based equivalent. A market that only one, maybe two companies can afford to enter isn't really a market — it's a politely dressed-up monopoly.

And although Arab states formally do have leverage — not over the server, but over the signal: frequencies, satellite landing rights, ground gateways — no one seems to quite know how to use it yet. A satellite flies at 27,000 kilometers per hour, but the antenna on the ground isn't going anywhere, and licensing it is still up to the state. The only question is whether these states will figure out what they actually want to achieve before the window for regulation closes on its own.

Source: https://www.habtoorresearch.com/programmes/orbital-data-centres