An activist has officially been charged

for using the Graphene OS duress pin

feature to destroy evidence.

Facial recognition is running rampant in

private companies and inside Germany's

free speech crackdowns.

We are covering all of this and more

coming up on this episode of This Week

in Privacy number sixty four.

So stay tuned.

Hello everyone and welcome back to This

Week in Privacy,

our weekly series where we discuss the

latest updates with what we're working on

within the Privacy Guides community and

this week's top stories in data privacy

and cybersecurity.

I'm Nate and with me this week again

is Jonah.

Jonah, how was your week?

You know, it's been pretty great.

Lots of stuff going on.

I think lots of good stories to talk

about.

I was ordering some stickers that I could

hand out at DEFCON when I'm there next

week.

Unfortunately, those haven't arrived yet.

They're arriving in a few hours.

I wanted to maybe show people what they

would look like on the stream today.

Don't have them yet,

but they are pretty cool.

And I sent a picture in our supporters

chat.

And if anyone will be at DEF CON

next week again,

come say hi and I'll give you one.

That's the only place to get them.

We don't have them on the store.

Yeah,

I showed the picture you sent in the

supporter chat to my wife and she was

like, oh, those are so cool.

So yeah, they look awesome.

Hopefully I have some extras that I can

mail out to people afterwards,

but we'll see.

We'll see.

How have you been, Nate?

Good, good.

It's been a busy week,

but I guess we'll talk more in the

site updates,

but we got a lot done this week

and

Um, yeah, I mean,

not too much exciting over on my end.

Just, uh, yeah, all good.

Well, those updates should be exciting.

Um, with that, let's talk about.

Our first story today,

this was reported by Ars Technica.

An activist was charged with a felony

after giving border agent duress code that

wiped his phone.

So they say in early twenty twenty five,

Atlanta resident Samuel Tunick was on his

way home following a trip abroad after

landing in the U.S.

Customs agents demanded access to his

Google Pixel phone.

You probably see where that's going.

It was running an alternative version of

Android called Graphene OS.

And we talked about some of this on

This Week in Privacy episode number thirty

one.

Security features.

Government attorneys and agents claim that

Tunick was subjected to a standard

secondary interrogation at an

international airport.

During that encounter,

agents were looking for anything that's

prohibited.

However,

Tunick's legal team alleges he was

targeted for his activism.

This is because Tunick was involved with a

group called Defend the Atlanta Forest,

which opposed the construction of an

enormous law enforcement training facility

in the area often known as Cop City.

What Tunick didn't know,

according to his lawyers,

was that he'd been placed on a watch

list for his actions and that Customs and

Border Protection had discussed over email

plans to detain him upon his arrival back

in the U.S.

for suspected terrorism activities.

So, during this investigation,

these Border Patrol agents basically said

they wanted to search his phone for

evidence of child sexual abuse material.

We talked a bit about that sort of

thing in another story last week.

And if he didn't unlock the device,

it would be confiscated.

So what comes into this story and how

it relates to Graphene OS is the duress

code is an optional feature of Graphene OS

that allows a user to set up a

secondary pin number that when it's

entered,

if you're worried about it falling into

the wrong

hands,

or if you're in a situation like this,

you can basically enter that code on the

lock screen instead of your regular PIN

number,

and it immediately irreversibly wipes the

eSIM, it wipes the entire device,

so none of that

data can be restored.

The article says that Tunick provided this

code to an agent who entered it on

the phone,

after which the screen went blank,

flashed several times,

and the phone appeared to restart.

All of the data on the phone was

gone,

but authorities confiscated it anyways.

Tunick was allowed to leave at that time.

But in late twenty twenty five, the U.S.

Department of Justice opted to file

criminal charges against him,

citing a little used statute,

Title eighteen U.S.

Code Section two to three to eight.

That makes it illegal to knowingly destroy

or damage property to prevent it from

being seized.

TechCrunch noted that this appears to be a

new legal strategy for the government.

EFF experts who spoke to TechCrunch note

that they've never seen the law applied in

this way before.

So the Department of Justice will need to

argue that even though Tunick was told

this was a routine border check,

he ran afoul of the law by tricking

an agent into deleting his data.

If convicted,

Tunick could face up to five years in

prison.

Um,

four or four media also interviewed Tunick

and his lawyer,

and his lawyer said that he only found

one other case using the same law,

which was a drug trafficking

investigation.

In other posts and outlets,

I think we have an article from PCMag

here,

Graphene OS discussed the case from a

technical perspective,

noting that none of their features are

illegal and that based on current

evidence,

Graphene OS phones can withstand forensic

investigation without requiring the use of

a duress pin.

So that is quite a story that I

think will have a lot of people using

Graphene OS and maybe the Stores pin

feature interested.

Nate,

I'm really curious what you think about

all of this first of all.

Why don't you share your thoughts?

Yeah, so this is a,

This is a complicated story in the sense

that when we first covered this story back

in – what did we say it was

there?

This week in Privacy at Thirty-One,

I reached out to a friend of mine

who's a lawyer and asked their expertise.

And veteran viewers know that right now,

the entire state of the Fourth Amendment

as it relates to electronic devices is

really, really up in the air.

And –

The courts are kind of really shy to

make a ruling and lay down some precedent

either way.

So right now – let's see.

I asked my friend to send me that

paper she wrote again.

So basically right now –

Searches normally require a warrant,

but at the border, there's an exception,

and within a hundred miles from land

borders and coastlines,

as well as airports,

international airports,

and it's worth noting that about

two-thirds of Americans live in this area.

So they can do a routine search, which,

again,

has not been legally defined by the

Supreme Court.

And it just says one that does not

seriously invade a traveler's privacy.

And let's see.

CBP guidance requires reasonable suspicion

only for advanced searches.

And a reasonable let's see a search is

considered advanced if an officer connects

external equipment through a wired or

wireless connection to an electronic

device,

not merely to gain access to the device,

but to review,

copy and or analyze its contents.

So this, I think,

would have counted as a routine search.

I also spoke to,

let me pull up my notes here.

I spoke to a friend of mine who

works in law enforcement to get his take.

He's very knowledgeable.

He knows about graphene.

He knows that it's not something that just

criminals use.

He said that he checked the court records

for federal cases using that section,

to and he said the only ones that

he found involved physical property and a

criminal investigation,

which he notes based on the information we

have right now,

this was not a criminal investigation.

This was a routine search.

He said,

I can't tell you the likelihood of this

charge sticking because that's beyond the

scope of my legal knowledge.

But in his opinion,

it's kind of a stretch.

Let me see here.

I'm trying to make sure I didn't miss

anything with his take.

Yeah, so it's very –

I think what this is ultimately going to

come down to – and for the record,

I'm not a lawyer either.

I don't have any legal training.

I got really busy,

and I forgot to send my lawyer friend

the actual legal paperwork,

which I think the TechCrunch article links

to.

Oh, this one does too actually.

So there is a link in there if

you want to read the actual charges.

I think it's only like two pages.

It's not that long.

But from what I'm reading and what I'm

seeing from other people –

Trying to charge him under this specific

statue is kind of weird,

and it may not stick,

but I think what might come back to

bite him is the fact that he gave

the officer the wrong pin.

And he knowingly did so,

although I would like to note that the

mayor of New York claimed that he forgot

his phone's password and never faced any

consequences,

which I don't think any of us buy

that.

But it'd be one thing – like I've

seen some people say online.

I think they've even said in our forum

thread about this that –

It'd be one thing if, like,

he wrote down the duress pin in his

phone and made it look like the actual

pin,

or if he made it something easily

guessable, like, you know, his birth year,

one, one, one, one, zero, zero, whatever.

If he had done that and the cop

just guessed and assumed,

I think he'd be in a much stronger

legal position.

If anything's going to come back to bite

him,

I think it's going to be the fact

that he knowingly gave them a duress pin.

But it... Yeah, I mean, it's definitely...

I think it's – I mean all this

is kind of beating around the bush of

saying that like I think we all know

this whole like, oh,

we think there's CSAM on your phone.

Like really?

Why do you think that?

Like where did that accusation come from?

Like this – I think any – what's

the word I'm looking for?

I think most people can see right through

it that this was clearly related to his

activism with the whole StopCopCity thing,

which, for the record,

I do want to point out there that

the last time we talked about a story

about StopCopCity and Proton turned over

information to the FBI,

that person was accused of throwing

firebombs and being violently aggressive,

which –

I advocate for peaceful protest,

so I don't know what this dude's story

is.

I don't know if he was out there

throwing Molotov cocktails or if he was

just out holding signs.

But either way,

I think there's clearly a link here.

And yeah,

I think this is probably going to be

one of those really big cases that we

have to keep our eye on and hope

for the best.

For sure.

I mean,

and Dag Overhull in the chat said exactly

the same thing.

I mean,

the government used three different

excuses in this Ars Technica article.

They said they were investigating him for

terrorism.

They talked about using CSAM as a

pretense,

which is exactly in line with what I

was talking about last week,

which is that the government uses these as

an excuse to search random people,

often without any evidence

at all,

and this is just yet more proof of

that happening.

There probably wasn't

any sort of probable cause whatsoever for

the things that the government was

claiming was on his phone,

which I think is a huge problem for

their legal case.

I'm obviously not a lawyer either,

but I totally agree with what your friend

was saying too about this specific law.

When I read this article,

I think it was posted by Zach Whitaker

on TechCrunch,

who is an excellent reporter.

My immediate reaction was that this is a

very strange law to charge him with

because I do think it clearly relates to

physical property.

The law says that you can't knowingly

destroy your damaged property to prevent

it from being seized by the government.

However,

The government did seize his phone,

and his phone is still fully functional as

a phone,

so in what way was the property destroyed

in a way that

prevented them from seizing it.

Obviously,

the government is after the data,

they're not after the phone itself,

but I don't think that this law applies

at all to this data case.

There's been a lot of court cases that

we've seen actually where,

unrelated to criminal charges whatsoever,

but it's generally understood that data is

not

property in the first place.

And this US code specifically relates to

property.

I think if data was property,

there'd be a lot more arguments about

like, oh, these data brokers,

they're illegally possessing my property,

right?

So I can sue them.

It's basically theft if they're sharing it

and selling it and whatever.

But that isn't how the law works.

Obviously,

I'm not really sure that's how the law

works.

I don't really subscribe to the fact that

personal data is property,

I think that would open up a whole

can of worms that we don't have to

get into right now.

But at least at the moment,

that isn't how it works.

And I think that because of all these

things,

I think these charges are pretty tenuous

at best.

This is obviously, to me,

a case of the government just trying to

use the court system as a punitive tool

attack against him because

It's expensive to go through all of these

legal proceedings.

He had to get a lawyer now.

There's all of these... I mean,

he has to deal with this lawsuit, right?

It's annoying.

And even if you're completely innocent of

anything you're being...

or everything you're being accused of,

it's a whole process.

And that is the goal of the government

in these cases.

It's an intimidation tactic, I think,

against protesters or activists like Tunic

here.

And...

it is really not a great story um

the government basically has unlimited

money resources power in the courts to

make your life terrible forever until you

give in so um yeah it's it's a

very scary and concerning story and

It's very problematic that this continues

to be a thing at the border,

especially with border control agents and

US citizens.

So...

Yeah,

I think that sort of sums up what

I was saying.

Let me see if we had anything else

in the notes here I didn't talk about.

I'll add real quick while you're checking

that,

that I think you made a really good

point about data as property.

This almost feels like a double-edged

sword where the government either has to

say, no, he didn't destroy property,

therefore he didn't do anything wrong.

Or B, they have to say, okay,

data is property, which I would imagine,

again, not a lawyer.

Now the Fourth Amendment applies a little

bit more rigidly,

and they have to stop doing things like

buying data from data brokers to get

around a warrant requirement.

I feel like the government kind of put

themselves in a corner here with that one

when you brought that up.

Yeah, yeah.

Yeah, the whole data as property thing,

that's been debated a lot in terms of

advantages or disadvantages it would have.

But I mean, in this case,

like the property itself was not

destroyed.

And the article literally says like,

and I think they say in their documents

that they did, they seized the device,

they use that word.

So like,

what part of the law was even violated

in the first place?

I don't know.

It's probably a case for like,

this is a law that's not on the

books.

And so they're just they're grasping at

straws, basically.

Yeah, I don't know.

I had a few thoughts,

if that's all you had.

Yeah,

I think the main thing I'll just point

out again is that, like,

as Graphene OS said,

there's probably no good reason to use

this in the first place because they can't

get into your phone.

So I would keep that in mind if

you're thinking about that feature.

Anyways, what are you thinking?

No,

that's actually very similar to what I was

going to say is like, I think, like,

I think the dress pin thing is really

cool.

And I think.

I think it makes sense.

Like,

obviously we don't know what was deleted

from this person's phone and maybe there

was some really sensitive stuff on there.

Like not in the sense of CSAM,

but I mean, maybe there was,

who knows not, but you know,

maybe there were like names of other

protesters and like upcoming plans and,

you know,

access into Google docs and like things

that it's, he's like,

I don't want the cops to have this.

And so maybe the lesser evil for him

was like,

I need to make damn sure the cops

don't get into this.

Like, even though as far as we know,

they can't get into graphene.

Like,

what if that one percent chance they can

and he decided it wasn't worth it for

him um so i'm glad this feature does

exist but i i think that we see

a lot of people in the privacy space

set up tools like this um

I'm just going to say,

I think sometimes we think we're Mr.

Robot and we like really get into these

tools.

And if you want to set them up,

that's fine.

But like, keep in mind,

there can be consequences for this.

And, you know,

when I was twenty and I didn't have

a family and like, you know,

I had a dead end job at Walmart,

like, OK, fine,

I'll set up the duress pin like I'll.

Why not?

I have nowhere to be, but you know,

if you have people that rely on you

going to work to keep a roof over

your head, or, you know,

like you pointed out,

uncle Sam has unlimited resources.

Like that was that whole issue with the,

what was it?

The tornado cash developer that recently

went to jail.

Like he said that in his interviews is

he's like, yeah,

I couldn't keep litigating this case.

We were already tens of thousands of

dollars in debt.

And just digging deeper.

And the government has infinite pockets,

thanks to our taxpayer dollars.

That's a different rant.

To just keep charging these people

endlessly and dragging this out in court.

And so it's just something to keep in

mind.

It's a threat modeling thing.

Like, again,

some people really do have data where it's

like,

I can't risk that one percent chance.

But, you know,

I think most of us are probably not

in that boat.

And you've got to keep in mind the

consequences that could rise here.

Yeah.

I'll take a look at some chats here

really quick.

Yeah, definitely.

Hello, welcome to the stream.

Hello, world.

Peaceboy John, yeah, yeah, Graphene OS.

Yeah, I mean, it's a great tool.

I think it's important to note what Deg

Overholtz said again here in the chat.

They can't get into Graphene OS as far

as we know.

That's certainly true,

but I think Graphene OS also has a

lot of features that don't involve

completely destroying the data.

Something like,

I think disabling the USB port is a

pretty great feature that they have.

And that comes enabled by default for the

record.

Yep, when it's locked.

I mean,

and you can take it even further.

Like, on my Pixel right now,

I have it completely disabled when the

phone is on, so it only charges when,

like, the phone is powered off, basically.

And that has been fine,

because I just charge things overnight

anyways.

And there's stuff like that.

They have features, like,

you can disable Wi-Fi and Bluetooth after

a certain amount of time, or, like,

when the phone locks, so that they can't,

like,

connect it to a malicious Wi-Fi network or

something like that.

So, of course...

It's not as foolproof as completely

destroying the data, I'll give you that.

But exactly like you were saying,

I think you don't have to do this

Mr.

Robot Edward Snowden LARPing thing unless

you have a really good reason to.

But I think even in this case,

even if you know you're being targeted

because of your activism or something,

it's pretty unlikely that...

They're going to use all of these

resources to get into your phone,

maybe secret ones.

If you stole a ton of national secrets

like Edward Snowden,

maybe they would take it a bit more

seriously.

But even situations like this,

it's probably overkill.

uh unredacted said one can say they

entered the pin and destroyed the data

themselves um and yeah one could

definitely say that um this I mean you

could definitely argue like they should

have known about this possibility and not

just done whatever he said but also at

the same time you know him saying it

is like um

probably like that's probably the worst

thing for his case I still think that

this case is pretty weak despite that but

it is a thing I also wonder about

like writing down the pin on like a

piece of tape on the back of the

phone I don't know um but I don't

know if that would be considered like

telling them as well but that would be

a bit like even more of a gray

area that I think would would have

benefited him so that's a possibility but

Yeah, it's – Yeah.

I just wanted to say in regards to

that one,

like I don't think that argument is going

to fly.

Like again, not a lawyer,

but that whole like, well,

he's the one that entered the pin.

Yeah,

but you gave him the wrong pin knowing

what would happen.

Like that would be like – I know

this would –

I would say this would never happen,

but I've read crazier stories.

If the cops raided your home and they

say, we think you've kidnapped somebody.

Where are they?

And you're like, oh,

they're through that door over there.

But you booby trap that door.

You're still going to be held responsible

for the cop getting injured or killed

because you knew there was a booby trap

behind that door.

And I think it's the same thing here.

Like, I don't think that argument of like,

well,

he's the one that entered it is going

to fly away.

Yeah,

the booby trap thing was crossing my mind

too.

I'm glad you brought that up.

Great minds think alike.

I remember someone saying your PIN number

is protected by the First Amendment,

just not your biometrics.

That's generally considered to be true.

That hasn't been tested in courts,

but pretty much all legal experts agree it

would be because it's something in your

mind.

That being said,

there have been cases where the government

just detained some people forever because

they didn't give up their PIN or because

they forgot their PIN,

which is pretty rare,

but it just goes to show.

Some of the bad behavior in some cases.

Yeah,

I'm glad you highlighted that one because,

yeah,

it's – I guess it hasn't been tested

in court.

But generally,

it's – your First Amendment protects – you

don't have to give up the pin because

that's a violation of your free speech.

And I would imagine a violation of your

right against self-incrimination.

And we didn't mention it in these show

notes, but he claims,

this Samuel Tunick guy,

he claims that he repeatedly asked for a

lawyer and was denied.

So if that's true and they can prove

that,

I feel like that's a really strong

argument that all this stuff is going to

get thrown out because a lawyer would have

told him don't give them any pin,

even if it's a fake pin.

You know, I think.

Yeah.

Yeah.

I mean,

that but that is a critical component.

that was probably like the right move is

to just shut up don't don't give a

pin um at all uh sb ass is

powering off the phone before handing it

over also illegal powering off important

to delete the encryption key and and yeah

getting your phone to like up before first

unlock state is definitely more secure

without wiping any of that data

um that gives you more possibilities for

for defense in the future um you still

shouldn't you know give them any pin at

all like we like we just said but

i i don't actually know how this would

work i suspect it would

not be illegal in the same way at

all.

I mean,

the government can stretch any law to make

whatever claims they want,

and maybe they would claim, you know,

you deleted the encryption key by powering

it off,

and that destroyed the evidence or

whatever.

Who knows, right?

But I certainly don't think it would be

illegal to power off your device before

you've been informed of the investigation,

at the very least.

And I think this is something to consider

when you're going through...

these border checkpoints or if you're in a

situation where you reasonably expect you

might have an interaction like this with

some overreaching law enforcement,

it's probably a good idea to just have

your device powered off in the first

place.

is also probably a good idea to back

up your devices to the cloud and just

wipe them before you go through.

Only keep minimal data on your phone for

what you need for traveling, basically.

I think that that's probably one of the

strongest moves you can do.

So yeah,

there's a lot of options that would

definitely clearly be legal.

Much more legal compared to the gray area

that...

that this case is in.

But again,

I think that this case is a pretty

light gray.

I think that their case is pretty weak.

Newlywitch said,

if the CSAM turns out to be fabricated,

the privacy community needs to rally

behind this activist.

I think it's pretty clear that the CSAM

accusations are...

because the government is claiming that

this is sort of a suspected terrorism

activity in their behind-the-scenes

emails, which is not what they told him,

but that seems to be what they actually

believed.

So I think, in my opinion,

this is just...

total proof that it's probably like in

their training or something to just accuse

people of possessing CSIM wherever they

can because it's such a I mean it's

it's difficult to prove it's something you

could easily plant on people's devices

it's something that people really don't

like so it makes all of these headline

stories but since they're discussing you

know suspected terrorism activities behind

the scenes and not and not you know

investigating him for CSIM before they

told him that I

I think it's very clearly a total farce

basically.

Yeah, I would imagine the the CSAM thing,

too,

is like that is such a horrible thing

to be charged with that most people would

probably instinctively just want to clear

their name right there before those

accusations get out of control.

Like, oh, God, no, here,

please take my phone.

See, there's nothing on there.

So I wonder if that's part of why

they do it, too.

I wanted to go back real quick to

the question about powering off your

phone.

I've started doing that, actually,

because my logic is, again,

I don't have anything that sensitive that

I would

I've had my phone blow up.

So those of you who follow me know

that.

And like trying to get back into like

things like Signal and all my accounts,

it's like it wasn't really the end of

the world,

but it was still kind of a pain

in the ass.

So I would rather not factory reset my

phone if I don't have to.

So when I go through the airport, yeah,

I've started just rebooting my phone right

before I throw it in the thing to

go through the –

the x-ray because i actually have had

computers not like forensically searched

but i remember one of my it was

actually my cubes computer um because it's

literally from like two thousand twelve it

did go through the airport one time and

they were like hey we pinged is like

there's residue on here i'm gonna swab it

with a cotton swab it never left my

site she did everything right in front of

me she never turned it on or opened

it or anything but she like swabbed it

with a cotton swab and like okay you

came back clean everything's good go about

your way and so i've kind of had

that that

walk through my head of like, well,

I don't want to delete my phone,

but I also want to keep people out

before first unlock.

So yeah, as far as I know,

that's not illegal because like Jonah was

saying,

like nobody came up to me and was

like, Hey, let me search your phone.

It's me preemptively getting ahead of

that.

Like I am about to give up control

of my phone.

Let me go ahead and reboot it.

And that way,

if I end up in this situation where

they say, Hey, we pinged your phone,

I'm going to take it to a back

room, have fun.

It's before first unlock.

And also real quick,

Dag Overhaul said have a separate innocent

profile.

I mean, yeah,

that would work except if they do the

forensic thing because at that point the

phone's unlocked.

If they just do like a quick visual

search, then yeah,

what are they going to – they're not

going to find anything there.

But I don't know.

That's my thought process.

I just want to do this.

Oh,

the last thing I'll say real quick is

to definitely go ahead and check out this

four or four interview with him because

like it does require a subscription.

And I mean, it's like what?

Five bucks a month, ten bucks a month.

Just get like a one month subscription.

But it's totally worth reading because

apparently the cops like had a hidden

camera on him.

They had like a tracker on his car

and he didn't know this at the time

for the record.

He had no idea he was this targeted.

It's just it's so wild.

That's crazy.

Just another comment from DakeOverhaul.

Another YouTuber says he resets his phone

every time he's flying.

I mean, yeah,

that's not really a bad strategy,

especially if you can back it up and

restore it easily at your destination.

Honestly, when I fly to Vegas next week,

I'll be bringing a wiped...

macbook that doesn't have any data on it

um not necessarily for this reason mostly

because i don't need to bring all of

my all of the stuff on my laptop

to defcon but um you know it's typically

not a bad idea to travel with like

the minimum uh information you can so

Yeah, I'm not dedicated enough to do that.

But if my threat model was high enough

or if I was flying somewhere where like

I knew I'm almost certainly going to get

searched,

like if I was going to China for

whatever reason,

like maybe I would do that.

But.

It's definitely more of a concern like

international borders.

I don't know how much power TSA has

in this regard,

but I don't think they can do full

law enforcement investigations.

I'd have to look.

But border control in the U.S.

definitely can.

There's definitely a lot of power that

border control in other countries would

have as well,

no matter where you're traveling.

So all of those international borders,

for sure, you should keep that in mind.

Yeah, agreed.

I don't have anything else on that story.

Do you?

I think we pretty much got it covered.

Cool.

I was just going to look really quick

if we had any comments about this story

in the forum thread since this was our

kind of title story.

But we may have covered a lot of

the questions here that were answered

today.

by or asked by people in the live

stream um and maybe bob's your uncle said

i wonder if having an almost bare fake

android profile with a completely

different pin is enough for border control

um yeah i guess it depends on how

knowledgeable they are like if they're

only gonna search one profile you could

just have that one open but um that's

probably not a path i would

try to go down necessarily,

but it could be better than nothing.

I know that they can get kind of

mad about you having a blank phone.

They're like, where's your social media?

Is this legitimate?

That sort of thing.

But it's challenging to defend against the

government and law enforcement agencies in

this case because

They can kind of do whatever they want

and it gets sorted out later by the

courts.

So it's not a super fantastic system,

unfortunately.

Yeah, it looks like in the forum thread,

there was some discussion about this,

but not really a lot of questions,

just people kind of talking about all the

stuff we said,

somebody linked to that four or four

article,

somebody else linked to a Gizmodo article.

so yeah um just there's one post in

the forum i'd just highlight a sentence

from that was from trustee rock nate i'm

hopeful this case sets a precedent in

favor of dress pins i think that that

could be um one of the best outcomes

of this so we'll we'll see if that

happens um i guess it depends on how

tenuous the government thinks that their

case will be because there's there's also

cases where you see like things like this

and then to avoid uh setting a precedent

the government will very quickly drop it

but after a lot of time after you

have to spend a lot of money that

sort of thing so yeah you never really

you never really know

So real quick,

wanted to mention SB here brought up the

idea of a password strength checker,

and somebody else also said something

about using a strong password.

I mean, your mileage may vary,

but I remember Naomi Brockwell did a video

where she argued that a six-digit PIN is

probably going to be enough for most

people.

I mean, again,

if you're in a situation where you'd

rather just wipe the phone completely,

then you probably shouldn't trust a

six-digit PIN, but...

I don't know.

I it doesn't I guess what I'm getting

at is like,

I don't think it necessarily has to be

this like super crazy,

like twenty eight character randomly

generated letter, uppercase, lowercase.

Like,

I think there's a middle ground for most

people.

But I mean,

certainly if you want to do that,

go for it.

thing with that um is that the length

of this pin does directly improve like the

strength of the encryption if somebody is

able to brute force that data without any

limits um the reason you can do like

a six digit pin is because of the

brute forcing protections

in a phone,

and those are generally considered to be

fairly good,

especially with modern ones like latest

iPhones or especially like the Google

Pixel and the Titan chip on Graphene OS.

There should be enough rate limiting or

wiping it after a certain amount of time

enforced by the operating system that the

complexity of your pin,

as long as it's not super simple,

is not going to be a huge problem.

But

we have seen in the past, definitely,

definitely a good number of cases where

like we find out celebrate or gray key

or some of these other tools that these

agencies are using,

they can bypass the the rate limiting.

So

It is something definitely to consider,

especially if you're going to be in this

situation.

The other thing you could do is have

a six-digit pin on your profile and have

a separate,

longer password on a private space in your

profile.

Because private spaces,

at least on Graphene OS,

they're fully separate profiles with their

own encryption keys.

You can set up a second password for

them and...

you could sort out most of your apps

that might have sensitive information like

your banking app or your email or whatever

into a private space like that and just

keep

basic things like social media or whatever

you consider less sensitive in your main

profile.

I think that that's one legitimate thing

you can do as well.

And Dag Overhaal basically said the same

thing.

Like,

if you can get the keys out of

it,

you can brute force those short pins super

easily.

So there is that to consider.

But in theory,

they can't get the keys out of it,

and so it should be fine.

It's not as provenly foolproof as using a

longer pin.

So there's trade-offs for sure, for sure.

Gotcha.

I think we kind of got it.

Why don't you take our next story here?

All right.

I think I'm back.

I hope I'm back.

I don't know what's going on with my

internet.

I think you're back.

I didn't know you left,

but I can hear you now.

My internet keeps freezing up.

Yeah.

Interesting.

Weird.

Before we move on to the next story,

we did have one question in our forum

thread that's not related to this story.

It said,

are there any privacy alternatives to ring

cameras?

I did not do any research on this

one, but...

I don't know.

I mean,

I'm definitely not a fan of Ring for

so, so, so many reasons.

But the one thing I will give Ring

is that they've got an end-to-end

encryption that you can enable,

and I think that's a good start.

Is it true, though?

I mean, Anchor had those cameras.

Was it Eufy or whatever that were supposed

to be end-to-end encrypted?

Obviously, they were not.

Ring has a lot of other privacy problems

because they have those programs where,

like,

you can opt in to share all of

your camera footage with law enforcement

or like other programs to search for lost

dogs or something silly like that.

So, yeah, it's...

It's not a great setup.

There's certainly self-hosted setups you

can do.

There's a lot of video recording threads

on the forum you could look at with

a lot of different recommended tools.

There's some sort of cloud-based ones that

I think are better than others,

but they're gonna be unsafe if they use

the internet as an authentication later.

I'm thinking of like,

unify unify protect for example they have

good cameras but there's some like

reliance on like cloud authentication kind

of similar to like plex for example which

isn't like amazing um but there's always a

trade-off between like features because

with a lot of like self-hosted ones you

don't get a lot of useful things like

notifications uh on your phone when when

the doorbell rings or something like that

that you would get from

bigger tech company apps.

But yeah,

I don't have any specific recommendations.

I would take a look at all of

the home camera related threats on the

forum because they are probably more

knowledgeable than I am right now.

Yeah, I'm still renting,

so I haven't had much of an incentive

to look into home security that deeply.

But I'm looking here.

I know...

I know there was one that one of

our associates recommended,

and I passed that along a long time

ago,

but I can't remember what episode that

was.

AI summary,

so take it with a grain of salt.

But according to Brave's AI summary,

I looked up private doorbell camera.

It says things like Reolink and Eufy are

highly recommended because they allow

local storage without a monthly

subscription on a micro SD card.

There's also a TP-Link Taipo, Aquara,

who I've never heard of.

And then they said there's actually some

cameras that work with Home Assistant.

They're a Chinese company.

I didn't know they made the cameras they

make.

I know they make Z-Wave sensors for Home

Assistant and stuff.

I wanted to bring up really quick.

Sorry,

I'm trying to bring up a sharing screen

situation, which I don't know how to.

How do I?

I got you.

How do I share?

Thanks.

You can share my screen.

I have to remove mine.

That's why.

uh there we go uh somebody in our

signal group for supporters which you can

join by donating at privacyguides.org

donate um mentioned secluso uh this is a

raspberry pi based camera setup uh it's

end-to-end encrypted

The the secluso people are on our forum

I believe and there's a thread about it

and you can even ask them questions there

and stuff I think that's definitely one to

look into if you're in more of a

self hosting state of mind There's also

frigate and scripted as John points out in

the YouTube chat I've used

Ooh, I don't know which one I used.

I looked at both of them,

and I used one of them to get

some of my self-hosted cameras into Apple

HomeKit,

which is end-to-end encrypted and provides

some of those notifications.

And they integrate with Home Assistant as

well.

If only I remembered which one.

But I think people use both of them,

and that could be some other self-hosted

options to look into,

especially because they work...

with pretty much any LAN-only cameras.

Unredacted says, Unify Protect is decent.

Yeah,

and there are ways to use Unify products

without their cloud stuff.

If you don't connect it to the cloud,

they have a local web interface that you

can access everything on.

It's not open source,

so you can maybe take that with a

grain of salt, but...

Yeah, because something to consider.

John said scripted as a functional.

I think I did use scripted.

I think that is right.

So yeah, it is pretty, pretty neat.

I probably wouldn't integrate it with

Google and Amazon,

even though it can do that.

But Apple should be.

Apple handles that all through the Apple

TV to encrypt it locally.

So you do need to have a home

hub like that,

but it should be a bit better than

those products.

But again, that's not open source either,

so then you have to trust Apple.

There's all that stuff.

If you want a fully local sub-hosted NVR,

I would look at this Seclusa thing.

I would look at Frigate because I think

those are all good options as well.

I just wanted to say another vote for

X Protect is, again, AI summary,

take it with a grain of salt.

But it did say,

the last thing it says,

while local storage enhances privacy,

note that some manufactured data

collection may still occur for device

connectivity.

For absolute security,

consider air gap systems like X Protect or

Unify setups,

though these are more complex and

expensive to install.

So, yeah.

That's all I got on that one.

Sweet.

I think you're up for the next story

here if you want to.

I am.

All right.

Let's talk about Pokemon.

My childhood here.

We're actually going to combine these next

couple of stories because they're...

Let me throw this up here real quick.

These next couple stories are kind of all

about the rise of how private companies

are increasingly using surveillance

technology,

specifically facial recognition

technology,

uh, surveillance technology.

So this one's pretty quick.

Uh, this comes from PC or PC gamer,

excuse me.

And basically it says that Nintendo

stores, uh, it says specifically in Japan.

I don't know if it's worldwide,

but I think it's just in Japan for

now.

They say that basically they're having a

real problem with scalpers coming in and,

uh,

buying up all the cards and then reselling

them.

And then there's no, uh,

cards left over for normal,

legitimate people.

Um,

So they are going to start rolling out

facial recognition systems to verify that

customers are only coming in once per day,

which is apparently the limit.

They say the exception to this will be

children under elementary school age,

so preschoolers up to six years old.

Let me see here.

Yeah,

so this is the once a day to

ensure that players get more access to the

stock.

If the system detects that the same person

has entered the store more than one a

day or received more than one entry

ticket,

a notification to that effect is displayed

on the screen.

Entry will be denied to that person based

on the system's judgment.

Yeah,

the article kind of points out that

there's really nothing you can do about

this.

And they did go on to...

They're a little more generous than I

would have been.

This author basically said,

I've had loads of issues with the online

Pokemon Center.

It's never ending queues and insistence

that I'm in fact a bot whenever I

try to try multiple times to get a

pre-order through because the site keeps

bugging out.

While facial recognition systems seem like

it would be harder to mess up,

there is always room for error with these

things.

And unfortunately,

they say that facial recognition scans for

entering stores in Japan are not exactly

new.

Gundam stores employ the same system to

ensure people only buy one exclusive item

a day.

It seems like it's currently the best way

to combat scalpers and get popular stock

out to more people.

So I don't know that I agree that

it's the best way, but yeah,

I do appreciate them pointing out.

It's like, yeah, it's a cool idea,

assuming it works.

And I also feel the need to point

out that like,

these systems have to scan everybody.

It says like, oh,

it's not going to work on children up

to six years old.

Okay.

Maybe it's because I'm not a parent and

I don't really spend a lot of time

around kids.

I can't tell how old a kid is.

I mean,

pretty much everyone younger than me,

if they're not a teenager,

they're like six.

So I don't know.

The older you get, at least again,

for me,

it's harder to differentiate age brackets.

Again,

I can tell it's like you're adolescent,

you're

Oh no.

You're a teenager.

You're probably a young adult.

Like, but I don't understand that.

Like, did I cut out again?

Yeah, just a bit.

But yeah, my point is like, you know,

it's,

it's age verification is always like so

bad at doing things and like,

And I'm also annoyed by the part that

it says it's based on the system's

judgment.

Like,

I think I'd be a little more comfortable

if it's like a person will intervene and

double check the system, but whatever.

The only other thing I'll add is it

says that a Pokemon does explain that this

data will not be held indefinitely and

will be promptly deleted after a certain

period of time.

But this article did not specify what that

period of time is.

And then the other story that we're going

to group in with this one is about

Madison Square Garden.

And this is a summary that comes from

Bruce Schneier,

but I really liked his summary.

I think it was really well done.

So he shared a link to a story

about how Madison Square Garden is using

facial recognition software on everyone

that enters,

and they flag activists that oppose –

Using facial recognition,

they also – I think when this story

first started breaking,

it was about a woman who worked for

a law firm that was involved with suing

Madison Square Garden.

Like she wasn't even involved,

but she worked for the company,

so they wouldn't let her in in her

free time to go see a Christmas thing

with her kids.

And it turns out that last week the

system was shut off for Taylor Swift's

wedding.

And they said – well,

I'll read the ending here,

and then I'll go back and read this

quote from Evan Greer.

Bruce said that whatever privacy measures

Swift had in place for the wedding seemed

to have worked.

No photos have leaked online.

So Evan Greer,

who is one of the people that Madison

Square Garden alerts on,

says that ironically Swift herself has

reportedly used facial recognition at her

own concerts to identify stalkers.

This privacy-for-me surveillance-for-the

attitude feels like a perfect

encapsulation of the future we're already

living in.

one where wealthy elites can afford

privacy while the rest of us are forced

to live in a corporate surveillance

panopticon.

Yeah,

I don't have too much to add to

that, I don't think.

I think, Jonah,

if I can throw it back to you,

how do you feel about this idea?

Because a private company, theoretically,

has a right to do whatever they want,

right?

But it feels like there's not a lot

of regulation over this technology.

I don't know.

How do you think we should navigate this?

Yeah, there's really not.

Looking at the chat here, unredacted said,

many U.S.

states and cities outlaw or restrict

facial recognition without consent.

First of all,

least the first story about the pokemon

company that that's only in japan as far

as i know so wouldn't apply here in

the first place um but also typically you

can get this consent by basically posting

signs and i would imagine that they'll do

that because it's not really like you know

they they don't have a reason to do

this secretively they probably will post

signs to just say hey you know we're

we're on to you scalpers and and use

that as a as a deterrent basically so

I don't think that this is super regulated

at all, basically, like you were saying,

Nate.

And yeah,

there's nothing you can really...

do about some of these cases it's just

gonna be a growing issue I think

especially in this isn't like the case as

far as I know with at least the

Pokemon store story for example but a lot

of these systems will like link up with

with law enforcement I know that the

Madison Square Garden system

does connect to law enforcement databases.

The the people who work at Madison Square

Garden,

anybody like involved in the with the

business that they don't get,

they don't get information,

unless like a law enforcement agency comes

back and like, tells them, hey,

we flagged this person on your cameras,

but all of that data is basically streamed

to some law enforcement databases,

and it's all interconnected.

The other thing

yeah i i mean the other thing is

basically that comment where like when

businesses are implementing these and

they're not applying them to everyone like

you can they're not applying them to

taylor swift because she demanded privacy

at her wedding for example which i think

is reasonable obviously but it is a

situation where like the wealthy elites uh

as

as Evan Greer said,

can afford privacy while the rest of us

are forced to live in that corporate

surveillance panopticon.

Just like you said,

I think that is a perfectly apt summary

of the situation.

I just wanted to highlight again there.

It's... Yeah,

it's just not a great situation.

It really ties into...

The whole surveillance camera thing,

we're being attacked kind of from both

angles, basically.

We got cities and law enforcement setting

up plot cameras.

We got businesses setting up all of these

really advanced surveillance systems that

they're not only, like,

recording things for a limited period of

time to, like...

see who stole something off the shelf or

something like that.

But now they're like tracking people in

real time.

And they're like,

doing behavioral analysis.

And they're like making these huge

databases of people's data,

personal information,

they're linking it all up to to these

larger systems.

And this is where it really becomes a

much larger privacy concern than it was

before.

I think now would actually be a good

time to address.

We got a question in the supporters signal

chat right before we started streaming.

And they said,

what can everyday people do if they want

to travel without being tracked by ALPRs

or other mass surveillance tools?

And can the ALPRs or other cameras already

in use track people outside of cars using

facial recognition or other biometric

identifiers?

I think we're actually about to talk about

that in a minute.

But yeah, I mean,

I know there's no easy answers to that

one.

do you think there is anything we can

do as this surveillance?

Because I actually,

earlier this year when I was in New

York,

I walked right past Madison Square Garden.

I've actually been in that neighborhood

for my previous job as well.

And I remember just walking right past it

and you look around and they're not even

subtle,

like not even just Madison Square Garden,

but NYPD, like they're not even subtle.

You look at a light post and you

see like,

it looks like one of those stock photos.

There's like six different cameras pointed

out in every which way.

And there's a sign that's like,

NYPD is surveilling this area or whatever.

And it's like,

what is happening?

Other than moving out of New York and

never going back?

Like,

what do you do you think there's any

options here?

Yeah, it's,

it's really tough to do anything about it

on like an individual level.

It's, it's really the thing that it's,

it's a thing that we have to push

back against at a larger scale, I think,

and we just can't find it acceptable.

I think

I don't know what point we will reach

before we finally decide that this stuff

isn't okay.

I don't know what it'll take to make

that happen.

But yeah, it's a huge problem.

And I think it's just going unnoticed and

like, like just by the general population.

And

Yeah, it's really hard to, you know,

you're basically fighting back against

somebody with the resources of the

government, because it is the government.

And they can really, I mean,

we talk about this all the time,

you know, if the government is after you,

right,

there's not a lot you can do about

it.

And that applies even to these situations.

there's probably like things you could do

that would be wildly inconvenient like map

out routes that don't have these cameras

for example but it's not realistic i think

to avoid the you know the entire mass

surveillance system at this time uh

unfortunately because it's just very um

just very what's the word i'm thinking of

it's it's invasive and it's

pervasive pervasive it's everywhere um

somebody on our supporters chat said wear

ir blasters yeah you know blast in with

lasers i don't know i don't know what

you can do this is not you know

advice ir blasters is probably fine i

don't know how these uh cameras work so

i can't tell you if that would actually

work but that would be kind of a

funny setup

I almost sent it to our production chat

the other day since I was working on

a video.

We'll go into detail about this later,

but I'm working on a video about flock

right now, and I've checked dflock.org.

I live about a block away from a

major intersection.

There are thirteen flock cameras just at

that intersection.

Thankfully, most of them,

I actually don't think any of them are

pointed at the road,

except there is one that's pointed.

It's like, oh,

that's an intersection that I almost can't

avoid to get on that main road to

go anywhere.

There's one camera.

I'm like, man,

that thing has probably caught me so many

times just going to the store,

going to the gas station.

It's ridiculous.

It's insane.

That's just in the block around my place.

It's nuts.

I feel like we've seen reports of a

lot of cases where

Some of these flock cameras are not even

pointed at roads at all,

despite ostensibly being license plate

readers.

But they're just being used as general

surveillance cameras in general,

and they do have a lot of capabilities

beyond just license plate detection.

I think that brings us pretty well into

our next story I want to talk about

here, which was just the form post.

was a news report that was written up

by freya on our team so it's on

our website but there were some uh good

comments on there uh from the article

freya said flock styles license plate

reader vendor leonardo announced a new

system called signal trace which somebody

is talking about in the chat here too

so we can get into that but it

can fingerprint your wireless devices when

you drive by and track you around without

needing to see your license plate

When you travel in your car,

your smartphone, your smartwatch,

wireless headphones,

and even your car's infotainment system

are usually outputting a constant stream

of RF emissions.

When all of these individual devices are

traveling together,

it's likely to be the same person.

So the new devices

for tracking can be retrofitted onto

pre-existing license plate reader cameras,

and they're meant to work alongside them,

storing your device fingerprint alongside

your license plate number in a centralized

database that police can access at any

time.

One of the most terrifying things about

this, Freya says,

is that it not only identifies your car,

but it tries to identify individual people

inside the car.

For example,

if two people are riding together,

it can detect each person's individual

fingerprint separately.

It also means that the readers work if

you're not driving.

Simply walking around,

biking close enough,

will likely mean that your unique RF

fingerprint is now stored in some

database,

and your movements can be tracked.

Kind of ridiculously,

Leonardo tries to advertise that their

system, quote,

respects individuals' privacy rights,

end quote,

because the actual data itself isn't

decrypted or read.

but as Freya points out,

this is definitely an example of the

metadata being more useful than the

content, even if, you know,

police can't see what your actual, like,

MAC address or other device identifier,

I-M-E-I-I-M-S, M-Z, uh, what have you, um,

even if they can't read, like,

the actual numbers,

this system that Leonardo has built

basically, uh,

has already tied all of those identifiers

to other things that identify you.

So the content doesn't actually matter.

It's still a huge privacy concern.

Yeah, so again,

it is really a question of what can

you do to defend yourself against this?

And it's very tricky because these systems

are already in place.

Yeah,

scarecrows in the chat says surveillance

cameras respect your privacy because they

can't see through your clothes or inside

your bags.

That's exactly the same sort of argument,

right?

If you're tracking all of this metadata,

you're tracking people exactly where they

are, what they're doing.

It's not a privacy-respecting situation

just because you can't later look up what

exact device identifier was being tracked

at that time.

It's...

It's a huge privacy problem.

It's completely ridiculous that they would

claim otherwise.

Scarecrows also said that it looked like

the Texas Department of Transportation has

antennas on all their camera poles now,

so they're probably adding that in.

They haven't seen anything officially

saying they're Leonardo's signal trace,

but they look the same.

So, very, very concerning stuff,

and I think... I don't know, like...

how prevalent uh leonardo is compared to

flock but i'd be concerned about that i

also wouldn't be surprised if flock um if

they don't have a product like this

already is working on something like this

because as as terracotta pie in the chat

said uh why the world is just becoming

so surveilling and intrusive that's that's

so true and it is a huge it's

a huge problem

I mean, that means we fixed crime, right?

Like, you know,

there's no place in the world right now

that an ant can't pass gas,

that it's not caught on some kind of

camera.

So clearly we've solved crime.

Yeah, we've solved it.

Nobody has ever done anything bad since we

added these systems.

So I guess it's totally worth it.

Yeah,

I think – I know it's kind of

a rhetorical question,

but I think things like this go –

I think –

I know this comes from CalixOS,

and Henry and I talked about it at

Surveillance Report,

but I feel like they really have the

best model in the sense that privacy is

a three-pronged approach.

There's the technical side,

the legislative side,

and the education side.

And

You know, we've talked about this before,

like the people who just think like, oh,

well,

I'll just use Linux and like all this

this, you know,

age verification stuff won't affect me.

Yeah.

Until the person you're messaging is using

Windows and all your stuff is getting

scraped up in Windows recall and all that

kind of crap.

And then, you know, or until like.

Canada bans encrypted messaging and signal

says,

we're not going to service that place

anymore.

Like, what are you going to do then?

And, uh, but you know,

at the same time, it's like, yeah,

obviously companies break the law.

We can't just solely rely on these

laughably low fines.

And I think this is a case of

like the education one where like people

don't understand.

And I think a lot of it is,

um, a lack of,

I don't want to sound mean when I

say this,

but like a lack of empathy in the

What was her name?

Shoshana Zuboff in Surveillance

Capitalism,

The Age of Surveillance Capitalism.

She tells a story at the very beginning

how her house literally exploded.

It burned down and exploded.

And she talked about when the house first

caught fire,

she was trying to gather up all her

notes and stuff because she had no frame

of reference for –

what was about to happen.

Like,

it's just one of those things where like,

when you don't have a frame of reference,

you don't even think about it.

It's, it's the whole, sorry.

I know I'm rambling a little bit here,

but I'm, I'm going somewhere with this.

It's the whole, like, you know,

when people think like, Oh, well,

why would anyone want to hack me?

Like, I'm not interesting.

Or like, I have nothing to hide.

It's like, yeah, it's,

Because you're a decent person whose brain

doesn't immediately think of all the

horrible things you could do with

somebody's data.

And I think it's the same thing here

where like normal,

not crazy people think about surveillance

cameras and they're like, oh yeah,

we can find like stolen cars and Amber

alerts and like deter a crime.

And like, yeah, this is great.

And because they're not completely insane,

they don't stop and think about the cops

we talked about a couple of weeks ago

who are like stalking,

not even their girlfriend,

a girl who turned them down.

you know the all the hacked cameras that

allow pedophiles to look at playgrounds

that i think we covered one story about

a camera that was or maybe i wrote

about it in like a data breach or

something but like a um flock cameras that

were like placed inside a gym at a

community center and rightfully people

were like why was there even a camera

in there in the first place like you

know normal people don't think about all

the bad things that can happen because

they're not bad people

And yeah,

I think that's really what it is,

is it's a lack of education where people

don't.

And furthermore,

it's like this is one of the reasons

I post the data breach thing every week

is because it's one thing to say this

could happen.

It's another thing to show articles and go

like this does happen all the time.

Here's the twenty pages of search results

of all the times this has happened.

And I think that's when it'll really start

not not to try and scare people because

that doesn't work,

but to just make people realize like this

is not hypothetical.

This is not theoretical.

This is happening.

And we have to factor that into the

math.

Thank you for coming to my TED Talk.

Tip your service.

Scarecrow's in the chat here.

about those cameras you should post a

picture of these if you can to the

to the form uh have people take a

look at them because i think we can

we can try and track them down yeah

it is i mean of course these are

going to go brandless at this point

because they don't want to get any

backlash of course um but yeah it's a

huge huge problem post it on the forum

discuss dot privacyguides.net it's a great

great place

Yeah,

tag me in that because I'm on the

board of EFF Austin,

and I think I know what you're talking

about, but it's been so long.

I no longer live in Texas,

and even at the time,

I never really stopped and stood on the

street corner and like,

let me get a good look at this.

But yeah,

tag me because I can share it around

with the other board members,

and maybe we can identify what those are

and figure something out.

Or maybe somebody already knows for all I

know.

I've never asked about them before.

Yeah.

Okay.

Oh,

the one last thing I wanted to share

on this topic is somebody left a comment

on this story,

which is why I included it as a

forum post and not an actual story,

where they said the part about this

Leonardo thing can track RFID devices such

as credit cards.

They said, I cast suspicion on this claim.

Even if we pretend they aren't –

trying to scan RFID through the metal

panels of your car,

which should normally neutralize RFID.

I have no idea how they can even

pretend to scan a passive RFID signal,

such as that of a credit card,

from several meters away.

Its range is a few centimeters.

The signal-to-noise ratio is going to

render the signal as unreadable noise at

any large range.

They make a really good point because I

do use Apple Pay sometimes.

And like, depending on the terminal,

sometimes like if I'm just a few

centimeters or inches off,

it won't read the and I know that's

like NFC, not RFID.

But yeah, these things are so low powered.

It's like,

how are you going to read that from

ten feet away?

That doesn't even make sense.

So big, if true,

if they've mastered that technology,

that's impressive.

Alrighty.

I think that'll bring us into the site

updates if we don't have anything more to

add to that.

All right.

So yeah, in a little bit,

we're going to give you guys an update

on a story about some eBay executives.

If any of you remember that story,

they threatened and harassed some people

who left some negative reviews.

And we're not just talking about like

legal letters.

But before we get to that,

we're going to give you some quick updates

about what we've been working on at

Privacy Guides this week.

So I mentioned I've did some work on

a flock video.

That's because our video about Bull Run

and the NSA's

It's not the latest attack on encryption,

but the next chapter in our series is

done.

It looks great.

Thank you to Jordan for all of that.

And it should be going out to members.

I think we're trying to release it this

weekend.

So if you are not a member,

definitely sign up,

get early access to that.

This is my first time filming a

storytelling video like that.

And I'm really excited with how it turned

out.

And I think you guys are going to

enjoy it.

And then, yeah, just a little teaser.

Our next video that we're already working

on is about flock and, uh,

D flocks national day of action.

And, um, I believe it was Jonah that,

that did some digging and realized like,

man, other than Ben Jordan,

there's not really a lot of privacy people

talking about flock.

And so we thought it would be really

cool for us to step in and, uh,

hopefully this will be a really good video

that.

Explains what Flock is,

explains what are all the problems with

it,

gives that list of twenty pages of search

results that I mentioned earlier,

and is hopefully something you guys can

share with friends and family to be like,

hey, go talk to your city councilors,

email your politicians,

and tell them you don't want this.

So,

that's what we've got going on on the

video side.

Sweet.

On the website community side of things...

Some stuff I'm working on,

there's an upcoming kind of redesign of

the site to make it a bit easier

to maintain.

We were using this software called

MakeDocsMKDocs,

which is basically being discontinued.

There's a whole...

don't know a lot going on with it

uh so we're working on kind of a

new yeah that's kind of the driving force

behind this so we're switching to uh

should be switching to hugo uh for that

which should make contributing a little

easier hopefully and uh we're gonna

redesign our blog make it a bit easier

to navigate um besides that i've been

looking into security keys lately uh

that's been

mostly what I'm doing this week.

There's a lot of stuff going on that

makes them really annoying to come up with

good recommendations and criteria.

A lot of cases where security keys aren't

certified or they are certified,

but they don't report themselves as

certified in some cases,

so then websites can't tell if they are

or not and stuff like that.

There's varying...

Varying security practices with all of

these,

and it's hard to find one super great

solution.

Because of course,

YubiKeys have been traditionally the top

recommendation,

but there are drawbacks to them for sure.

You can't back them up,

which people find very inconvenient.

If you switch them out or update,

you have to...

switch them out on every single website

you visit, which is really annoying to do.

So yeah,

a lot of a lot of stuff like

that.

So continuing to look into those pretty

much there's a thread on our form at

discuss the privacy guides.net.

Again,

talking about there's like multiple

threads, basically,

there's some tool specific ones,

there's comparison ones where people are

sharing kind of opinions about all of that

stuff.

So if you have any thoughts about

security keys for some reason,

you can chime in there.

Otherwise,

Free has been working on articles.

We talked about

that one earlier,

but there's been other ones throughout the

week.

They get posted to privacyguides.org slash

news,

and it's a great way to stay up

to date with some other stories that we

don't talk about on this weekly show.

Some of the stories include over a hundred

vulnerabilities being found in the IRS's

contractor handling Americans' tax

information.

New dynamic patching in Chrome is going to

allow updates without restarting the

browser.

And then, of course,

those stories that we talked about today.

All of the stuff that we just talked

about in this section,

it's made possible by our supporters.

You can sign up for a membership or

donate at privacyguides.org.

Or you can pick up some swag merch

at shop.privacyguides.org.

Hopefully,

I can expand some of that stuff with

new sticker designs in the future,

but we'll see.

Privacy Guides, all of us here, of course,

we are a nonprofit.

We research and share privacy-related

information.

We host communities like our forum,

for example.

We have chats on Matrix where people can

get advice and stay up to date about

digital privacy and preserving your

digital rights.

So yeah,

with all of that out of the way,

let's...

We're going to talk about an update to

the FCC router ban that we discussed a

few episodes ago.

I don't remember exactly when that was.

First,

I'll check the chat really quick for some

stuff.

Derek, twenty three fifty eight.

Looking forward to the vlog video.

Yeah, I hope it'll be good.

And it's been working on that for a

bit.

So hopefully we can get that out pretty

soon.

Tony Mojo said the same thing.

Yeah, I think it should be.

It should be fun.

It's definitely a little bit more entry

level.

It doesn't dive in super deep.

But again,

there's so little content out there as it

is that I think we kind of wanted

to start very surface level and give

people kind of an on-ramp to understand

the problem.

At least that's what I was going for.

Yeah.

I also just wanted to say real quick.

Yeah.

The, the security keys do have drawbacks.

Like right now I'm trying to get back

into using the Tor browser a lot more

and it's like, oh, cool.

I can't even log into Tudor because I

added the security key and remove TOTP.

So yeah, that, that is a bummer.

I hope Tor can figure that out at

some point.

I don't remember if mall that browser has

enabled it.

I know they were looking into it at

one point,

but I was going to say they haven't

yet, but I, yeah,

I know they're trying to,

so hopefully soon fingers crossed.

This story was reported by Ars Technica.

The Trump administration exempts SpaceX's

Starlink from the FCC ban on foreign-made

routers.

A public notice issued by the FCC said

Starlink routers received approval from

the Department of Defense.

SpaceX's exemption is good until February

first, twenty twenty eight.

Netgear's exemption,

which we're going to talk about next,

is only good until October of twenty

twenty seven.

Netgear was the first major vendor to get

an exception to this rule on April

fourteenth.

Amazon then received an exemption for its

Aero routers and the routers to be used

for its Leo satellite service.

I would remind people we talked about this

in the episode where we first discussed

this FCC router ban,

but like there are pretty much

no routers made in America.

And it's not like super easy to just

spin up router factories overnight.

So of course,

there would have to be all sorts of

exemptions to these laws.

I do think

We'll get back to this in a second,

but I do think it's kind of arbitrary

how these are being applied.

The article says SpaceX has a factory in

Texas and some of its routers have the

words made in the USA printed on them,

leading some to believe that it might be

the only major router maker to escape the

FCC's wide-ranging ban.

Yeah, exactly.

But other Starlink routers are made in

Vietnam.

So, some discussion topics here.

The FCC hasn't publicly shared what

criteria these companies meet to get

exemptions.

And this is the main problem that I

have with all of this stuff.

It seems to be kind of arbitrary whoever's

in the Trump administration's favor at any

given point in time.

It seems like they are often...

kind of coerced or threatened into making

whatever changes the government wants in

order to preserve their business.

I am really annoyed right now,

not because of...

routers but because of some stuff that's

happening with the company that makes my

car i have a pull star too and

they've been banned from selling new

models in the us because they're a chinese

company it's a strange situation because

like their sister company volvo is owned

by the same parent company and they

received an exemption um it seems like

other car manufacturers are receiving

exemptions

as well,

but that kind of relates to a similar

thing as these routers where it's

computers from foreign countries that the

Trump administration doesn't want in the

USA.

It's very strange because all of the

computers in Polestar's cars as well as

Volvo's run

android automotive so like it's it's all

designed by a by a american company

basically uh so why they are concerned

about those computers it's not very clear

to me but it's just it kind of

seems to be whoever is putting in the

effort to basically convince the trump

administration

that they should keep their business

around is getting exemptions.

And in that case,

Polestar just didn't really bother with

it.

But it's annoying that all that stuff is

happening in the first place.

Anyways, I think that was my main thought.

Nate,

what were you thinking about this article?

Did you have any thoughts or questions

about it?

Um, not really too much.

Uh, I mean, you,

you kind of nailed everything, you know,

it's like, even from the beginning,

the government hasn't really said like,

what exactly is their criteria here?

What is the threat they're trying to

defend against just some vague national

security, which, you know,

the government's always done like, Oh,

national security.

But now they're like really kicking that

into overdrive.

And, um,

I think the article also noted that it's

interesting that these are all temporary

exemptions.

But once they're up, it's like, okay,

what happens?

They can reapply,

but I guess they're also supposed to show

progress that they're moving manufacturing

to the U.S., which, like you said,

just does not happen overnight.

So, okay, this is an extreme example,

but –

I checked on it the other day out

of sheer boredom.

Samsung semiconductor factory that they're

building in Texas.

That sucker's been under construction.

I think they broke ground in like twenty

twenty one or something like that.

And every year they've been saying we're

going to start putting out chips in the

spring.

We're going to start putting out chips in

the fall.

They're still not putting out chips.

I don't know what they're doing.

That's happening, I think,

with a lot of these companies in America.

There's one in Arizona I know of.

I don't remember if it's TSMC or Intel,

but somebody's building a plant out there.

I think it's TSMC.

Yeah, and that's been a similar situation.

Routers might be an easier one to make

in the U.S.

I know that they really want chip

companies to move manufacturing to the

U.S.,

but that is such a specialized tool that

even TSMC...

is gonna have a very hard time moving

that manufacturing capacity to the US if

they want to because it's not just a

matter of like getting the plans in the

machines and like making it here some of

these products require like real experts

in the field and like pretty much all

of them in that case are in Taiwan

so where are they in America who can

even do this stuff you you actually need

the people involved in it actually just is

true that

there aren't enough people in America who

know about that stuff to implement these

things.

So I think that that's going to cause

delays.

I think it's just the thing where like,

clearly favors Elon Musk, basically.

That's kind of the favoritism we've seen

with Tesla and his other companies.

We've seen it with like OpenAI and Sam

Altman.

There's just some companies that the

government really likes.

I think we talked about that when

anthropics fable models where were banned

by the us government for some period of

time and that was an american company you

know there weren't even like chinese

concerns which is usually the excuse that

they use um so yeah i i don't

think anyone's really safe from these

sorts of restrictions unfortunately yeah

honestly i was surprised it took starlink

this long to get the the exception i

wonder if they just didn't bother to

to apply for it or something.

But yeah, it's, it's like you said,

there's so many like with these, I mean,

I don't know about routers,

but with semiconductor factories,

it's like in some cases there's like very

specific niche equipment that's made by

like, I'm not even making this up.

There's some stuff that's only made by

like a single company in Germany that has

like ten people.

So they're back ordered by like six to

eighteen months on this equipment.

And then that's not including the facility

itself,

which granted the Samsung semiconductors,

the conductor factory is like one of the

biggest in the world.

So that's probably a bit of an exception,

but yeah, it's,

it's not like you just rent an office

space,

throw in a few cubicles and start printing

out stuff.

Like even with these routers, it's like,

this doesn't just happen overnight.

It's.

Yeah, and it's going to be,

it's kind of a situation,

I think a lot of these businesses who

are affected are going to have to face

the question of like,

is it even worth sticking around in the

US?

And I think probably more businesses may

opt out of that than the Trump

administration probably expects.

Going back to the whole Polestar thing,

I know that like,

it's only five percent of their US sales

or something like that were in the US.

They're big in like Europe, for example.

And in I assume the reason that they

didn't really pursue an exemption in that

case was because it'd be way cheaper to

just drop that five percent of sales than,

you know,

try and meet all of these demands that

the government has.

And I don't know if that'll be the

case with like Netgear, for example,

but spinning up this this manufacturing

capability is not.

cheap so giving up on us sales for

a lot of these companies might actually be

the more cost-effective way to go even

even for american companies like like

netgear is an american company for example

they just manufacture overseas like pretty

much every other company in the us does

so it'll be a weird time in tech

i think it'll be bad for americans overall

because

Americans have gotten really used to tech

being very cheap.

If you ask anybody from any other country,

even like nearby countries like Canada,

but especially Europe,

especially like far away from everything

countries like Australia.

tech is way more expensive to buy pretty

much everything in those countries

compared to the US.

And I think that changes like this are

just going to really push up the price

to...

like not exorbitant but basically it's

going to be meeting the the prices of

other of all these other countries and

we're just kind of going to be in

the same boat um we're just not going

to have the advantages that we've enjoyed

for for quite a while and that'll be

probably a shock to a lot of people

i don't have much more to add to

that i agree

Tough times are coming.

Yeah.

Well,

why don't you take us away with our

next question?

Speaking of Europe.

Yeah.

Speaking of Europe and tough times are

coming.

So this next story comes from Telegraph.

It says inside the dystopian world of

Germany's free speech crackdown.

I'm going to read off the notes that

I made here because this is a very

long article.

Definitely worth a read.

Lots of good stuff in there.

But I'm going to read off my notes

just to keep it short.

to the relevant parts.

So Berlin police told Dr.

Ziedelman he had been accused of violating

a post-Second World War law that bans the

display of Nazi symbols, slogans,

and imagery and could now face three years

in prison if found guilty.

The sixty-nine-year-old found out the

offending social media post was a meme

about Adolf Hitler,

but it was one in which he criticized

the Nazi dictator and compared his

invasion of Czechoslovakia to Vladimir

Putin's invasion of Ukraine.

So basically, like,

I'm saying Hitler is bad.

Why is this

Yeah.

Dr.

Z is one of thousands of Germans who

have been threatened with fines or prison

sentences for social media posts that fall

afoul of the country's political speech

laws,

which are unusually stringent for an EU

member state.

One German had his home raided for calling

a minister a –

Schwachkopf,

which I guess is German for dummy.

And I'm sure all the Germans are laughing

at my pronunciation right now.

Another was fined two thousand euros or

about seventeen hundred pounds for calling

Friedrich Merz a lying fritz under a law

that critics claim makes it effectively

illegal to make fun of politicians.

The number of investigations under Section

eighty six a the Nazi symbol band that

Dr.

Z was investigated for has more than

doubled over the past decade,

according to official police statistics.

Investigate investigations into the

political insult law also reached a record

level in twenty twenty five.

The surge in cases is so vast that

the U.N.

has launched an investigation into free

speech violations in Germany,

a step typically reserved for

dictatorships and banana republics.

German free speech activists on the left

and right,

as well as the Trump administration,

have also raised the alarm,

and there are growing calls from some of

the country's stricter laws to be

scrapped.

The fur bears some similarities to the

speech debate in Britain,

where citizens have a knock on the door

from police over opinions posted online.

Uh,

this part blew my mind in the case

of Dr. Z,

the rise of online portals in Germany,

which allows citizens to report each other

for illegal comments seems to be what

alerted police to a social media post.

So they literally have like Stasi style

snitch on your neighbor because something

he said hurt my feelings.

Which is pretty insane.

Another controversial law in Germany's

free speech debate is section one eighty

eight of the criminal code,

which imposes a de facto ban on publicly

insulting or defaming elected officials.

In one recent case,

a pensioner was investigated under Section

one eighty eight for posting Pinocchio is

coming on Facebook.

After he learned that Frederick Mertz,

the chancellor, was visiting his hometown.

In November,

twenty twenty four police in Bavaria

raided the home of another pensioner

because he called Robert Habeck,

the then vice chancellor of Germany,

again, a dummy.

The raid was reportedly launched after Mr.

Habeck personally filed a criminal

complaint against the pensioner.

In twenty twenty one,

police raided a man's apartment in Hamburg

after he told a senator,

you're such a D. I'm assuming it's dick.

I don't know.

And this year,

a resident was fined two thousand euros

for calling Mr. Mertz a lying fritz.

Officials show a record four thousand

seven hundred and ninety two section one

eighty eight cases were filed in Germany

in twenty twenty five,

with the numbers rising by nearly eighty

five percent between twenty twenty three

and twenty twenty five.

So, um.

Yeah, I mean, this is...

This kind of goes back to the thing

that I said with the graphene thing,

where it's like...

Some people are totally comfortable...

painting a target on their back because

it's the principle of the matter, right?

Like you should be allowed to call your

politicians names.

I'm sorry,

but no matter what politician it is,

as long as you're not like threatening

them,

you should be allowed to say that they're

stupid.

You should be allowed to say that they're

corrupt.

You should be allowed to say that they're

not doing a good job.

Like you should be allowed to criticize

them.

And I think if you're,

It's one of those things where like we're

seeing this all over the West,

unfortunately,

where this kind of stuff is being

monitored.

We know that the feds here in the

U.S.

at least are monitoring social media.

That's what services like Palantir do is

they just scrape social media,

even the really fringe niche ones that

only have like one hundred thousand people

using them.

So just remember that what you post,

even if it's like friends only or

something,

anything you put in a digital format,

you should kind of assume it's public.

And just be aware if you're one of

those people who's like,

I'm going to go ahead and stand up

for my right for free speech.

Like, that's totally cool.

I applaud that.

I do that, too.

I'm very critical of all levels of

government on Mastodon.

But at the same time,

just you need to be aware of the

risk you're taking.

So and Germany needs to figure out what

they're doing if they're getting

investigated by the UN.

I think that's pretty wild.

I don't know if I have much more

to add to that.

Did anything jump out at you that I

missed?

No.

No, I don't think so.

I think you pretty much covered it.

Yeah,

it's just like we talked about earlier in

terms of government overreach, basically.

Are you willing to take the risk of

being targeted by these governments,

even if you're not doing anything wrong?

It's a pain.

It's a hassle that they can really put

you through,

and I think that that's a big problem

we have to face right now.

Good times.

I have not heard of this Gulag Archipelago

that Scarecrow recommends.

So I don't know.

I can add that to my reading list.

I haven't heard of that one before.

Sounds like something that somebody in

Russia may have written.

I'm not seeing any other questions right

now.

So I think we can probably jump into

our story about eBay that I know you

were interested in.

Yeah, that's a crazy one.

Yeah, just checking the chat here,

but we'll look at this TechCrunch article.

eBay reaches a fifty six million dollar

settlement with e-commerce newsletter

writers it terrorized in twenty nineteen.

I remember reading about this in twenty

nineteen.

Well,

I guess I didn't remember I read it

in twenty nineteen, though.

I thought it was an older story.

It's a lot more recent than I thought.

The article says the settlement this week

resolves a twenty twenty one civil case

that was brought by the couple against

eBay.

The couple is a married couple,

Ina and David Steiner,

who were the co-authors of eCommerce

Bytes.

They inspired the ire of high-level eBay

executives, said TechCrunch,

after occasionally criticizing the company

in their newsletter.

uh executives from ebay used sock puppet

social media accounts to harass the couple

while also sending them anonymous

threatening letters and bizarre items in

the mail including live spiders and

cockroaches pornographic magazines a

bloody pig mask a funeral wreath and a

book about surviving the death of a spouse

so this is not just the typical legal

harassment you might see from a company's

lawyers this is an actual

criminal harassment and stalking from

top-level executives at eBay.

According to previously released court

documents,

a plan that was attempted but never

successfully carried out involved affixing

a GPS tracking device to the couple's car.

Yet another internally broached plan at

eBay involved sending a, quote,

Samoan gang to the Steiner's home.

In a statement published Tuesday,

eBay disavowed its former employees'

behavior as, quote,

not representative of eBay's culture.

So that is a crazy story.

I know that eBay made that statement.

statement obviously but uh people up to

the ceo of the of ebay uh devin

uh weinig and uh multiple board members

were involved in this uh the ceo settled

for two million dollars as part of the

settlement uh was directly from him uh

half a million dollars will be paid out

from uh another ebay executive wendy

Jones and seven former eBay employees were

criminally charged and pled guilty in

relation to this plot,

including the company's former security

chief, James Bout,

who was sentenced to nearly five years in

prison for this.

So it's wild.

eBay is crazy apparently.

And I believe a lot of the people

like, um,

A lot of the people involved are still

on the, at least the board, I believe.

I know that the CEO is the former

CEO.

I don't know who's involved now,

but not all of them were, like,

very punished, basically.

So... I guess, um...

Getting fifty six million dollars is not

the worst outcome for these people.

They're probably happy about that because

they settled.

But it is absolutely crazy that they had

to go through that in the first place.

You know,

a targeted harassment campaign like that

is not exactly typical of a company like

eBay.

So, yeah.

Was there anything you wanted to discuss

about this article or any other thoughts

that you had, Nate?

No,

I think partially I wanted to cover it

because one, like, yeah, it's so wild.

It's like, these are executives, right?

And it's funny because I've noticed I've

worked around every level of employee you

can imagine from like the entry level

cashier at the grocery store to like I

have stood ten feet away from someone

who's in the top twenty on the Forbes

billionaire list.

Like I have worked around everybody you

can imagine.

And I've noticed a curve of like.

I don't want to drop an F-bomb of

like how many craps they give where like

the lowest level people don't care.

Like they're never stressed.

They don't care.

Well, I mean, they're stressed,

but like they don't care because they

don't get paid enough to care.

And then on the other end of the

spectrum is like all the higher executives

that don't care because they pay someone

else to care.

And then right in the middle are all,

like,

the middle managers that are just

constantly stressed and high-strung about

everything.

And so it's just weird to me that

there's, like,

all these C-suites and executives that

it's just, like,

why are you wasting your time because

somebody, like,

left you a negative review in their

personal substack?

Like, seriously.

Truly, like,

when we were talking about this article

earlier today,

if you had asked me about this story,

because I knew of this story.

I remember reading the original, like,

story about it.

But I would have told you,

I remember this happening in like,

two thousand eight or two thousand ten or

like some sometime like early eBay,

basically,

where it's maybe it's a small company and

they're like personally invested.

But this started in early twenty nineteen,

this whole thing like eBay is a massive

company at this point.

And you're concerned about some couple's

newsletter on on a blog online.

It doesn't even make any sense at all.

It is the wildest story I have ever

seen.

And, yeah,

I guess I don't even know what else

to say about that.

It's crazy.

Yeah, it really is.

Also, just, you know, privacy.

Be careful what information you put out

there, who has access to it,

all that kind of stuff.

Yeah,

you never know who's going to stalk you,

apparently.

Seriously, that's so wild.

You would think they'd have better things

to do.

I sure would if I was being paid

that much.

Just to backtrack,

Scarecrow was talking about that book.

He said, yeah,

it's about someone's arrest in nineteen

forty five for private letters to a friend

about Stalin.

Imagine your letters from seven years ago

came back to smack you in this way.

Eight years of hard labor.

Yeah,

I kind of want to point that out

that not not to fear monger,

but this is something I hear smart people

point out all the time is like.

Again,

why privacy matters is a lot of the

time.

in an authoritarian or repressive regime,

when the new guys take over,

they will retroactively punish people for

things that happened before.

So in a functioning democracy,

usually a law will be passed and they'll

say, okay, from this point going forward,

this thing is illegal.

But like when the Taliban took over,

I distinctly remember this story because I

remember thinking how sad it was.

When the Taliban took over in Afghanistan,

when the US pulled out,

Afghans were rushing to like delete their

online presence because for years,

a lot of them had been like kind

of slowly westernizing.

And now they knew that some of the

stuff they did that was like totally

innocent, like, you know,

maybe women wearing blue jeans could get

them killed now.

And they were trying so hard to scrub

their social media presence and stuff like

that because now what they did in the

past is yeah.

And like, I don't,

I don't think we should all be living

in fear, but it's just, again,

be mindful of it's yeah.

Privacy matters.

It's very unfortunate.

But yeah, that's all I had, I think.

I think those were all our stories.

So I think we can check around,

see if we have any more final questions

before we wrap up here.

I think we only had one forum post.

Send them in the chat if you have

any.

I did see a forum post I wanted

to look at, actually.

Sure.

One of the top stories from the last

week.

Somebody posted on the forum,

does your privacy setup actually make you

stand out more?

They said for the past month and a

half,

they've been trying out some VPN services

on their phone,

trying to see which one works better.

So they talked about different VPN

providers that they used.

But they said that they received a message

from their IT department basically saying

they connected,

they detected a connection to their work

email account from an IP address

associated with Malved VPN and they wanted

to confirm that it was them and why

they were using a VPN service for that

connection,

which of course did not make them feel

very private.

It is.

So like,

it is a concern with some of these

tools.

Absolutely.

Uh, we,

we talk about this a lot more in

like the browser fingerprinting context

where it's like using something like

Mulvet browser, for example,

or even brave, uh,

might make you more fingerprintable to

people who are specifically looking out

for it.

A lot of these privacy tools that we

recommend are really geared towards, um,

thwarting mass surveillance tools.

They're effective at blocking like,

ninety-nine percent of the general things

that you'll see on sites,

whether that's like Facebook tracking or

ad networks or that sort of broad

surveillance,

whether that's by companies or otherwise.

When it comes to like,

individualized privacy advice,

it is more of a

There's a lot of threat modeling you have

to take into account.

You have to decide who you're trying to

defend against from a privacy perspective

and how you want to stand out.

Because if people are looking at you

specifically,

they can detect that you're using these

privacy tools and that can be a red

flag in some cases, like this one,

for example.

There are certainly ways to work around

this.

One way, like on phones,

at least Android phones, for example,

I see people use private spaces or work

profiles in their main profile because you

can set a VPN connection for only that

profile and the apps inside that.

And then you can have like a private

space with a VPN for most of your

general apps and then keep like...

work stuff for local stuff like your bank

in a in a profile that doesn't use

a VPN.

But yeah,

it really depends on your individual

situation in that case,

which is why

If you have any questions about that sort

of thing,

it'd be great to ask on the forum.

There were a lot of good responses in

that thread.

I won't go through all of them,

but that was kind of my two cents

on that, and I wanted to highlight,

I think,

a related question here in the chat from,

and maybe Bob's your uncle.

If you obfuscate a connection to a VPN

like you can with Tor Bridges,

does the ISP still know you're connecting

to a VPN?

That is the sort of thing where it's

also...

suspicious, or it can be.

There are different obfuscation methods

that are less fingerprintable.

So like web tunnels with Tor, for example,

are supposed to be less identifiable,

which is why they can get around

censorship in some countries.

I don't know what specific tools you would

use with a VPN,

although some of that Tor bridge software

is kind of generic and could be used

in theory for that sort of thing.

But even in that case,

I think it's a little suspicious if you're

just sending like a large amount of

traffic every day to one specific IP

address and there aren't a ton of ways

around that so I guess I don't know

off the top of my head if there's

any like VPN clients that will rotate

different connections between different

IPs or VPNs or whatever I'd have to

look into that but um I think I

think either way typically

Your ISP definitely can detect whether

you're using a VPN.

They can also detect whether you're using

Tor.

The Tor network,

maybe that's a common misconception people

have,

but it doesn't hide the fact that you're

using these things or like you're

devices or whatever from the ISP

specifically.

The only thing that it will hide is

a lot of metadata about that traffic,

like the domain names you're connecting to

and IP addresses, etc.

How much you're sending to like one

particular source.

But that's why we say VPNs are,

they're not like a foolproof solution.

They're

Just shifting trust from your ISP to that

VPN provider in most cases,

but they're not like the perfect privacy

tools and they can be detected.

So it is something that you have to

keep in mind.

Yep,

I don't really have anything to add to

that.

I did see that question.

I thought it was really interesting

because, yeah, I thought about,

like you said,

we usually see it talked about in the

browser space where if everybody's using

Movad browser and you've got all the

shields and uBlock turned on,

then you stand out.

But it's definitely a lot different when

you're talking about very specific use

cases like at work or they talked here

about trying to access their bank and

stuff like that.

So it's a good thread, though.

Lots of good info there.

Check our signal donors chat again real

quick here.

Yeah, I've been kind of bouncing around,

checking the forum thread,

not seeing anything new.

Scarecrows in the chat said,

Zuma?

I'm not familiar with who that is,

but they made a video about the government

vandal events.

Maybe that's worth checking out.

I'll have to add it to my list

of videos.

I assume there probably are ways of

obfuscating some of that information,

but typically with VPN companies also,

the IP address that you're connecting to

is visible and known to be a VPN,

so they can just know that way.

A lot of the deep packet inspection stuff

that I've seen is like,

claims that your ISP could use that to

detect what specific sites that you're

connecting to even when you're using a VPN

and people say the same thing about the

Tor network that they can use that to

see to kind of gain more information about

what you're doing on Tor in addition to

just the fact that you're connecting to

it.

I haven't seen any evidence that that can

be reliably applied in the real world.

I know that

It's all just theoretical,

and I think that some VPN providers like

MOLVAD with their data, D-A-I-T-A program,

they claim to defend against that sort of

thing,

but also I've never seen any proof that

that sort of thing can be reliably used

outside of lab academic settings,

basically, with small groups.

At an ISP scale,

I don't think that deep packet inspection

is going to be a huge issue.

But there are,

if you are concerned about that,

there are, of course,

obfuscation techniques.

As Unrejected said,

there's also advanced protocols like

X-Ray.

Reality, that's sort of a similar thing.

Spoof the TLS signatures of other sites.

I'm not totally for sure with how that

works.

I think...

Similar to web tunnels if I remember

correctly that Tor has but I could be

I could be wrong I know a lot

of these tools Especially ones that

unredacted org works with you should

definitely check out their site by the way

because you're doing a lot of cool stuff

with like the Tor network and stuff but

a Lot of those for like anti-censorship

purposes can get around that sort of thing

I Would

I will have to look more into how

this works because I'm not sure.

I feel like, like I said before,

I think sending a lot of traffic to

one specific server is probably suspicious

in itself.

But yeah,

some of these tools can add more plausible

deniability.

But maybe there's other things that it

does that I don't know or remember off

the top of my head.

So I'll have to look into that later.

I wanted to mention scarecrow said here

that, um,

several politicians have suggested that

this sort of stuff may earn you extra

scrutiny.

I remember we covered that story a little

bit,

and I think what they were actually saying

was that it's not so much that using

a VPN will make you extra interesting.

It's more that, um,

so the way that section seven Oh two

works is any electronic signal that

crosses international borders becomes a

fair game for the NSA and

With a VPN, since they can't, in theory,

since they can't tell where it's coming

from originally,

there's a lot of questions about like,

does that count as crossing international

borders?

Can you collect VPN traffic?

Because is it somebody from the UK

connecting here to try and evade age

verification on Discord?

Is it, you know,

somebody from a repressive country?

Is it somebody in the US who's just

connected to a nearby server and it didn't

cross international lines or something

like that?

So, or, you know,

if you use like Proton Secure Core,

those route through servers that are

actually owned by Proton.

So there's like,

There's a handful in Iceland.

There's a handful in Switzerland.

I think there's another country that they

have a few.

But so like those would,

for a US user like myself,

those would bounce out of the country and

then back in.

So I think that's more what it was

referring to.

Not so much like, hey,

let's watch everybody that uses a VPN,

but more like, hey,

how do we know if these people are

supposed to be protected by law?

Which I would argue the NSA doesn't care

about anyways, but I digress.

Sorry,

I was trying to get something to go

away.

I was just going to say,

Zach from Unredacted also said,

they take into account how much traffic is

sent to different IPs.

I guess there's some VPN clients designed

for sensory countries that can load

balance connections.

Yeah,

that would be what I'm interested in

looking into more because I think that

could be a cool solution,

but I don't know what they are.

Again,

I'll have to look into this after the

show.

I don't think I have much else.

I'm not seeing anything in the signal

chat.

Kind of wraps things up.

I think I just want to share really

quick.

Right before this stream,

I was reading a story,

and I caught some of Henry from TechLore's

livestream like an hour before this one,

where he talked about some stuff about

Texas...

getting a court order for Verisign to

basically revoke another Coventry's .com

domain.

I had a lot of thoughts,

both about that story and also about

Henry's take on the whole thing,

so I think I'm going to talk about

that in a livestream on my channel right

after this one.

So if anyone's interested in continuing to

listen to me talk about stuff,

you could go over there if you want

to, but just throwing that out there.

Otherwise, yeah, Nate,

you want to wrap things up,

do you think?

Yeah, sure.

I'll let you get to that.

So all the updates from this week in

privacy will be shared on the blog every

week.

So sign up for the newsletter or subscribe

with your favorite RSS reader if you want

to stay tuned.

For people who prefer audio,

we also offer a podcast available on all

podcast platforms and RSS,

and this video will be synced to PeerTube.

Privacy Guides is an impartial nonprofit

organization that is focused on building a

strong privacy advocacy community and

delivering the best digital privacy and

consumer technology rights advice on the

internet.

If you want to support our mission,

you can make a donation on our website,

privacyguides.org.

To make a donation,

you can click the red heart icon located

in the top right corner of the page.

You could also go straight to

privacyguides.org slash donate.

You can contribute using standard fiat

currency via debit or credit card or opt

to donate anonymously using Monero or your

favorite cryptocurrency.

Becoming a paid member unlocks exclusive

perks like early access to video content

and priority during the live stream Q&A.

You'll also get a cool badge on your

profile in the Privacy Guides forum and

the warm fuzzy feeling of supporting

independent media.

So thank you everyone who watched and

stuck around and we will see you next

week.