USB charging has become completely normalized. And sometimes we don’t realize that what we’re plugging into is another computer.

USB connections are often doing two jobs at once: delivering power and opening a channel for data. And if you don’t control what you’re plugging into, that data connection might be used to steal information or load malware onto your device.

One thing that can help is a USB data blocker. It’s a cheap piece of hardware that is criminally overlooked.

In this newsletter I’ll talk about why you shouldn’t plug your phone into random USB ports, and I’ll explain how USB data blockers help and how they work.

Why You Shouldn’t Plug Into Unknown Ports

Let’s start by understanding the dangers of plugging your device into unknown USB ports.

1. Juice Jacking

First there’s juice jacking from malicious USB ports. A scammer puts malware or monitoring software into a public USB port that gives them the ability to steal data, passwords, addresses, and banking information off a phone when it plugs in.

2. Malicious Cables

Then there's the risk that the cable itself might be malicious. We've talked about things like the OMG cable on the show before: it looks identical to a normal cable, but it has a tiny computer and wifi access point hidden inside. An attacker can connect to it from anywhere in the world and run payloads on whatever it's plugged into.

So you should never plug in any charging cable that you find lying around.

3. Privacy

And finally, there’s the privacy side of plugging your phone into things. What you’re plugging into might not be malicious, but you could be unintentionally sharing data without realizing.

Cars are a great example of this. When you connect your phone to your car, oftentimes the car essentially downloads a mini clone of your phone.

Many people think that this doesn’t matter, because they assume their own car is private and neutral, and that any USB connection to it is safe because it is “their” vehicle.

But cars are packed with connected services and third-party integrations. This data isn’t staying in your car. It’s shared with countless entities. There’s an entire explosion of data collection in cars. And the worst part of it is that we have no idea who will get access to this data. Car companies, ad companies, hackers through data breaches, and of course massive data brokers that collect data from all sorts of manufacturers and they sell it.

Sometimes you might just want to charge your phone in your car without sharing your phone data with countless 3rd parties.

Risk of Unintended Data Transfer

Now how likely is it to fall victim to one of these dangers mentioned?

A malicious USB port does not usually get instant access just because you plugged in. A few things are required, and there are some protections built into your phone.

First, Android has something called “USB protection” which can block USB data while locked. And by default, iPhones and iPads enter a protective state called USB Restricted Mode: if the device has been locked for more than an hour, it won’t communicate with an accessory or computer until you unlock it, though it will still charge normally from a USB power adapter.

But you don’t always keep your phone locked when it’s charging, so these charge-only modes won’t necessarily protect you.

Next, on Android and GrapheneOS you can change your security settings so that you only ever allow charging through the USB port and not data. But this setting will have to be shifted back if you ever want to connect the device to your computer or speaker etcetera.

Then there are trust prompt protections. For example, often, to enable data transfer you have to approve some kind of popup. Some of these might auto-appear in a way that’s easy to tap accidentally, or approve while you are half awake in an airport, for example.

But sometimes consent can actually get bypassed. There are cases where your phone might automatically say yes without you even having to tap anything. For example, if you’ve previously trusted a computer, your phone might remember and not ask again. So a malicious device can potentially impersonate a trusted device and auto-connect.

Finally, if your phone is running outdated software, the chances of being successfully attacked by a malicious USB port goes up significantly.

These risks end up being non-trivial, but luckily there is an easy way to protect against all of them at the hardware level, before the phone even has a chance to negotiate a data connection.

You just need a USB data blocker.

What Is A USB Data Blocker?

It has many names, like a “charge-only” adapter, or juice-jack defender. Or more risqué names like USB condom.

It’s a small adapter that sits between your device and whatever you’re plugging it into. If you want to charge your device, you could plug the blocker into your device, then plug your charging cable into the blocker.

What is the point of this? Using a USB blocker blocks the flow of any data and allows only electrical power through.

How Does It Work?

It’s all done through the physical pins inside the USB port itself.

Let’s start with a USB-A, which is the square-shaped USB that always seems to go in the wrong way the first 2 tries.

If you cut open a USB-A cable and peel back the outer plastic jacket, you’d find that it isn’t just one solid wire inside. It’s actually four thin wires bundled together, each wrapped in its own colored insulation. Each of those four wires has a specific job, and they fall into two categories: two of them carry electricity, and two of them carry data.

One wire is called voltage positive and one wire is called ground. Electricity needs a complete loop to flow, so the V positive wire delivers the electricity, and the ground wire gives that electricity a path to return. Together, these two wires make charging possible.

The other two wires are the data wires, “D plus” and “D minus.” These don’t carry power, they carry information. When your phone sends a photo to your computer through a USB-A cable, that photo is actually being chopped up into millions of tiny electrical pulses, and those pulses travel along the D+ and D- wires from the phone to the computer.

And if you look inside a USB-A port, you’ll see four metal pins — one for each of the four wires inside the cable.

If you look inside a USB-A data blocker, you’ll see only 2 pins, because it’s physically severing the connection of the two data pins, while keeping the power pins intact. This means that electricity flows freely, but no data flows.

Now this is just for USB-A. USB-C cables are much more complex internally — they have many more wires inside the cable, and 24 pins in the connector, to support things like faster charging, video output, and reversible plug orientation. But the basic principle of separating power pathways from data pathways still applies.

Unfortunately, unlike with USB-A, you can’t visually verify what’s being cut off with a USB-C data blocker, because the internal wiring isn’t inspectable by eye and the pin count makes it non-obvious what’s connected to what. So with USB-C you largely have to trust the manufacturer’s claims.

This is a good reason to buy USB-C blockers from reputable brands with clear technical documentation, rather than no-name products (I personally use PortaPow).

It’s also worth noting that cheaper USB-C data blockers may not support fast charging protocols and may limit you to standard 5-volt charging speeds.

The Bottom Line

Remember, you’ll only want to use a data blocker when you just want to charge your device. Using one means giving up legitimate USB functions like photo transfers, Android Auto, tethering etc. A blocker will interfere with all of that data communication. But that’s the point.

But when you just want to charge, a blocker gives you a simple assurance that only power is crossing the connection.

For a fully updated, locked phone, plugging into a malicious USB port is fairly low-risk. You’d likely need to actively grant trust, or the attacker would need a real vulnerability. And compared to threats like phishing, it’s less to worry about.

But why worry at all?

Relying on being perfectly patched and attentive at all times is a bad strategy. Especially when you can instead just block the data path and move on. And especially when it costs less than a cup of coffee, and does the job so well.

Yours In Privacy,
Naomi

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

It says that if the government wants to search your life, it needs a warrant. And if it doesn’t get one, you can hold it accountable.

That’s it. That’s the bill.

You might be wondering why we need a law for something that’s already in the Constitution. After all, the Fourth Amendment already requires warrants for searches. But the reality is that decades of outdated legal doctrines have hollowed out that protection so completely that the government can now access your medical records, your financial transactions, your location history, your browsing data, your contacts, and your communications, all without a warrant. It can buy this data outright from brokers. It can demand it from the companies that hold it. It can query massive databases about you with no judge involved and no probable cause.

The Fourth Amendment already says what this bill says. But if this bill were put to a vote, it would likely fail, which tells you everything you need to know about how broken things have gotten.

How did we get here?

Right now, the legal framework courts use to decide whether the Fourth Amendment protects you is called the “reasonable expectation of privacy” test. If a court decides you had a reasonable expectation of privacy in something, the government needs a warrant to access it. If not, it can do what it wants.

Operating inside that framework is something called the third-party doctrine. It provides a specific answer to that question: if you’ve shared information with any third party, the courts say you don’t have a reasonable expectation of privacy in it. The courts have essentially equated giving your bank your financial records to sharing a secret with a friend, saying that once you’ve told someone, you can’t expect it to stay private.

But how does this framework still exist in a world where contracts exist? If I have a contract with a company where they promise to keep my information private, surely I have a reasonable expectation of privacy. The government says no, I don’t, simply because the data passed through a third party. They consider these contracts irrelevant. We literally have privacy policies spelling out what companies can and can’t do with our data, and we’re told that none of it matters when it comes to Fourth Amendment protections.

Meanwhile, our whole lives have migrated to the internet, and the entire internet runs on third parties. Your email provider stores your messages. Your phone company has your location. Your cloud account holds your files. Your apps know where you go, what you search, what you buy, who you talk to, and what patterns your life follows. Our lives moved online, but no constitutional protections followed.

On top of this, most people do not even know they are sharing information with third parties. That sharing happens invisibly, as a byproduct of the infrastructure of the digital age. Your phone pings cell towers. Your browser searches leave digital exhaust across countless servers. Your apps transmit data in the background. How can courts argue that we voluntarily shared information most people didn’t even know existed, with companies most of us didn’t even know had access to it? None of these legal frameworks make sense in a world of modern technology, yet they continue to determine whether individuals have Fourth Amendment protections.

And law enforcement knows it. As FBI Director Kash Patel acknowledged when pressed on whether the FBI buys Americans’ location data: “The FBI uses all tools... to do our mission. We do purchase commercially available information.” The government is searching your life. It’s just found ways to do it without getting a warrant.

What the bill does

The Surveillance Accountability Act fixes this in three key ways.

First, it establishes a presumption of privacy for data held by third parties. The government may not access data, metadata, or personal information held by financial services providers, telecoms, ISPs, cloud storage companies, or data brokers without a valid warrant, regardless of whether the company cooperates. It also makes clear that your contracts with companies should be respected, and the government can’t override them to get access to your data. And if a company wants to reserve the right to hand your data to the government, it can’t bury that in legalese. It has to be stated explicitly and clearly, and the user has to knowingly agree to it first. This directly neutralizes the third-party doctrine. The government can no longer treat your data as fair game simply because a company holds it.

Second, the bill defines “search” the way the word has always been understood: as any purposeful investigative act directed at a specific person, including surveillance, monitoring, and the collection of personal data through digital or automated means. This closes the loophole that agencies have been exploiting for years: the argument that buying a dataset and then querying it somehow isn’t a “search” under the Fourth Amendment. It is. It always was. This bill makes that explicit.

Third — and this may be the most important part — the bill creates a private right of action. If a government official violates your Fourth Amendment rights, you can sue. Right now, the legal avenues for holding the government accountable for warrantless searches are extremely limited. This bill changes that. It says that if the government searches your life without a warrant, there are consequences.

The bill also draws careful lines around what doesn’t require a warrant: plain-view observations, ID checks during traffic stops, genuinely public information, consensual searches, and exigent circumstances. These are the same common-sense exceptions that have always existed in Fourth Amendment law. The bill doesn’t eliminate them, it just makes sure they can’t be stretched to cover mass surveillance or data purchases.

Critically, the bill also makes clear that just because you step outside your front door doesn’t mean the government can scan your face, track your car, or log your movements without a warrant. None of the warrantless exceptions in the bill can be used to justify the collection of facial recognition data, gait analysis, voice recognition, or automated license plate tracking. These are exactly the kinds of tools being deployed right now with no judicial oversight, and this bill draws a hard line against them.

Why it matters

The core promise of the Fourth Amendment was never complicated. The founders understood that information is power, and that the government’s access to information about your life needed limits. This is because the investigative process has a natural bias. Investigators are trying to solve cases and find culprits. That is their job. But it means they are not neutral arbiters of how far they should be allowed to pry into someone’s life. Left unchecked, that bias turns into abuse. It always has, even with the best intentions.

That’s why the founders required a judge in the middle. The idea isn’t to stop investigators, but instead to make sure the government justifies itself before it searches your life, not after. While today much of law enforcement sees warrant requirements as simply bureaucratic paperwork, the warrant requirement is actually a deliberate check on the natural bias of the investigative process.

But today, that check has been bypassed. Investigators are buying giant datasets from brokers and searching them at will. They have unfettered access to troves of personal data with no magistrate involved. And the data they have access to gets bigger and bigger over time. The dirty secret is that the vast majority of the time, if the government went and applied for a warrant, they’d probably get it. But they don’t see warrants as a critical check on power, and instead see them as busywork.

The courts know the current framework is broken. But as Rob Frommer of the Fourth Amendment Project at the Institute for Justice has put it, the problem is the courts don’t know how to get out of it, so they keep creating one-off exceptions rather than really grappling with the rule itself. We can’t wait for the Supreme Court to slowly judge every new piece of technology, one by one.

The Surveillance Accountability Act is the legislature stepping in to do what the courts have been unable to do: reestablish the principle that the government needs a warrant to search your life. It was introduced to the House on April 23 by Rep. Thomas Massie and Rep. Lauren Boebert, and deserves serious attention, because the problem it’s trying to solve affects every single one of us.

Those with power do not get to open up your life for inspection just because they want to see what they can find. They have to name the person. State the reason. Limit the search. Face a judge. And justify themselves first.

That’s all this bill asks. And the fact that we have to ask for it at all should alarm everyone.

Yours In Privacy,
Naomi

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

To avoid this, your other options are cash, gift cards, or cryptocurrency. A lot of people avoid cryptocurrency because they don’t see it as useful — it doesn’t seem like there’s anywhere to spend it. The guest post below was written by Violet Rollergirl. She helps people in vulnerable communities adopt privacy tools, including private payment methods. Hopefully this article will be helpful if you want to know how you can actually use crypto in daily life, and reclaim financial privacy.

To be clear: there's nothing illegal about using cryptocurrency or opting out of traditional financial surveillance. Choosing private payment rails is a normal exercise of financial liberty — the same one every cash transaction has represented for centuries.

Yours in Privacy,
Naomi

Off-ramping: where and how to spend your cryptocurrency

By Violet Rollergirl

At the end of the day, cryptocurrency is just currency. Sooner or later, you’re going to have to spend it on something.

The cryptocurrency world calls this “off-ramping,” and it means turning your cryptocurrency assets into something else, whether digital or physical.

In the traditional financial system, spending money comes with a privacy trade-off: your bank, credit card company, and payment processor know what you’re up to. Transparent (non-private) cryptocurrency systems suffer from the same problem, but worse, because everyone in the entire world can watch what you buy. This is one of the main safety benefits to using privacy coins: no one but you and the vendor you’re buying from knows what you’re up to.

Paying directly in cryptocurrency

The easiest way to off-ramp or spend your cryptocurrency is to just pay for the thing in the same privacy coin you already have. Of course, this requires the vendor to accept payments in that privacy coin, and that’s still rare. [If someone in your community] is willing to accept payment for a service in Zcash, I’ve got my perfect off-ramp right there!

So if you’re a gig worker with skills, share that fact with friends you trust. Build a local economy, and stay surveillance-free by using something like Zcash to sustain it! The true revolutionary potential of this truly cannot be overstated.

One way to think about this is: Zodling Zcash is to money what using Signal is to speech. Vive la révolution!

Paying in Bitcoin when you only have Zcash

Although Zcash is a superior private currency, most of the crypto world still relies on other surveillable systems, like Bitcoin. Thankfully, cryptocurrencies can be easily converted from one to another so it’s easy to pay in a vendor’s cryptocurrency of choice even if you only keep a balance in Zcash. There are lots of ways to do this, but many are clunky and require you to be quite careful about exchange rates, conversion fees, and payment processing times.

By far the easiest method is Zodl’s “Crosspay” feature, so named because it can make “cross-chain payments” simple and safe. Let’s work through a common use case I have one step at a time and show Crosspay at work.

As a person who travels frequently, one very common need I have is to pay for my travel bookings. Some newer travel sites will accept payment in Bitcoin, Ethereum, or other cryptocurrencies, but I’m aware of none who accept Zcash. (Obviously, if you know of one, please contact me to tell me about it!) This is where Zodl’s Crosspay feature shines and where Travala comes in clutch.

It works like you’d expect any other flight and hotel booking platform to work, but you can pay directly in cryptocurrency. They also have a loyalty program, so you can earn extra rewards, and help me do the same if you sign up via my referral link.

Travala’s payment options include direct cryptocurrency transfer with dozens upon dozens of different supported cryptocurrencies, including the popular ones. While Travala doesn’t support Zcash directly, Zodl lets you swap your ZEC out for a number of cryptocurrencies that Travala does support at the same time as you send a payment.

To pay for a hotel booking or flight ticket with cryptocurrency:

1. Start at Travala and find the hotel or flight you want to book just like any other travel website.

2. Once on its checkout screen, choose a cryptocurrency to pay in and begin the checkout process. Travala will present a checkout screen to you that looks something like this:
   

1. When you’re ready to pay, proceed to the payment screen itself, which will give you a QR code or address to copy.

2. Copy the address presented to you.

3. Open your Zodl wallet app.

4. Click on Zodl’s “Pay” button to open the Crosspay screen.

5. Next, in the “Send to” section, enter the payee’s (Travala’s) information:

6. You’ll see a cryptocurrency selection drop-down menu for choosing the currency the payee wants to receive from us. Find Bitcoin (BTC) from the list of options; it will have a small Bitcoin logo on top of a larger, second, identical Bitcoin logo. This means we’re using our shielded ZEC, but paying in Bitcoin.

7. In the Address field, paste the Bitcoin payment address you copied from Travala earlier.

8. Now choose how much to pay by entering an amount in Bitcoin units.

9. Click “Review” at the bottom of the Zodl Crosspay screen. Zodl’s “Pay Now” drawer will open.

10. Review your payment and ensure that the amount will cover your order.

11. Click “Confirm” when you are ready to make your payment and send the transaction.

In my experience, it takes about 5 to 10 minutes for the transaction to complete, so make sure you also have at least that much time on the checkout payment timer before you confirm your transaction, or you may not be able to get your account credited before your purchase order expires. If that does happen, you’ll have to speak with a support representative about crediting your account.

There’s a lot of sparkle-emoji technology sparkle-emoji happening here, but what’s extra cool about this is that at no point do you ever need a Bitcoin wallet! Moreover, no remnant of digital cruft exists anywhere in the various blockchains that can be meaningfully linked back to you.

Practically, this enables you to safely keep your cryptocurrency assets in the Zcash shielded pool, where they stay completely private, and still be able to pay any vendor who accepts any supported cryptocurrency equally privately. If you do this, no one can know how rich (or poor) you really are. In contrast, if you keep your holdings in a transparent ledger system like Bitcoin, the whole world can tally your real net worth and track your transactions without ever asking you questions.

This is not a hypothetical example. This is in fact how I pay for the VoIP phone number I use, and other services.

Piggyback on the gift card economy

Among the most common ways to spend your hard-earned cryptocurrency today is by piggybacking on the massive gift card economy for making various kinds of retail purchases. Since gift cards and store credit systems are already a certain kind of alternative digital local currency, cryptocurrency is a natural fit. As a result, an entire crypto gift card marketplace industry has emerged to support this particular kind of off-ramp. While different crypto-to-gift-card vendors support different currencies, Zodl’s built-in decentralized exchange solves that problem, so the main considerations for those of us who want to use this method to spend our cryptocurrency funds are:

• finding a crypto to gift card exchange provider that partners with a brand we want to buy from, and

• ensuring that the exchange provider’s terms of use and their “Know Your Customer” rules doesn’t risk our privacy more than we are comfortable with.

If you’re just starting from scratch, here are my favorite vendors — two of them conveniently, are built into the same self-custody wallets I’ve already recommended.

Pay for stuff via Flexa in Zodl

The gift card vendor directly integrated with the Zcash wallet app I use is called Flexa, which is basically a multi-store gift card manager mini-app inside the Zodl wallet app itself. If you’ve installed the mainstream version of Zodl (i.e., from the Google Play Store, the Apple App Store, or the Aurora store) you’ll have the option to spend your shielded ZEC at partnered Flexa brands from within your Zodl wallet. If you downloaded your Zodl wallet from the F-Droid strictly free software app repository, Flexa will not work in your app.

As of this writing, some Flexa partners include Ulta Beauty and Kiehl’s (cosmetic and skincare product brands), Sheetz (a convenience store and gas station chain), and Chipotle.

First, set up Zodl to work with Flexa as privately as possible by enabling Zodl’s built-in Tor network privacy features. Once that’s set up do this to use Flexa from within Zodl:

1. Open your Zodl wallet app. Make sure you have some ZEC in it, enough to cover the cost of the thing you’re about to buy in the local fiat currency where you’re buying it (such as in US Dollars if you’re in the United States).

2. Tap the “More…” button in the Zodl main screen.

3. Tap the “Pay with Flexa” item in the resulting list.

4. If this is the first time you’ve used Flexa, you’ll be asked to complete a brief registration process where you are asked for your name and email address. At this point, there are a few things you should know:

   1. While Flexa will have this information, none of it will end up on the Zcash blockchain network nor with the ultimate merchant from which you are buying something.

   2. Flexa doesn't require government ID verification, and as a result caps spending at $750 per week.

   3. If you want to use an alias email address, there are many providers you can use (like Firefox Relay, SimpleLogin, and DuckDuckGo).

5. Once you have a Flexa account, you’ll be given a “Flexa QR code” that is basically just a barcode that participating brands can scan as a native payment. It’s that easy. But you’ll also see a “More instant payments” box at the bottom of your screen. These are “legacy Flexa brands,” which are the stores at which you need to tell the cashier that you want to pay using a “gift card” or “store credit.” To use these:

   1. Tap the logo icon for the brand you want to pay for. This will let you create a one-time use virtual gift card and load it up using your Zcash funds.

   2. Enter the amount you owe at the register. If the cashier tells you that your total is $20 USD, enter that amount under the brand’s logo.

   3. Press or tap the Confirm button. A new brand-specific virtual gift card QR code will appear.

   4. Tell the cashier you have your gift card ready. They will ask you to scan it. Do so, and you’ll have paid!

I have successfully used Flexa this way and, while it’s currently limited to supported business partners, it is by far the easiest way to spend my ZEC on real, physical stuff.

If you need something from a store that doesn’t have a Flexa partnership, you can still maybe find it from another cryptocurrency to gift card vendor.

Other cryptocurrency to gift card off-ramps

The cryptocurrency to gift card vendor I know most about is Bitrefill (referral link), because they’re one of the largest. Another popular one I use is Piggy.Cards (referral link). Another is DashPay.

They sell gift cards to a plethora of well-known brands by accepting cryptocurrency as payment for them. You can buy these even more privately by browsing the sites via Tor Browser. If or when you hit purchase limits, you can create a “basic account” with Bitrefill to get decently large spending limits ($10,000 USD per month).

These sites allow you to spend your crypto at hundreds of places, like Amazon, AirBnB, Uber, DoorDash, Apple, Walmart, hotels, airlines… the list goes on.

Use crypto-native service providers

Instead of gift cards, which is really just a roundabout way to help fiat economy vendors accept cryptocurrency without actually accepting cryptocurrency payments, there are also a class of business-to-consumer (B2C) middlemen that will accept payments in cryptocurrency and either interface with vendors on your behalf or provide services paid for in crypto themselves.

Booking hotel stays and air travel with cryptocurrency

We’ve already looked at one such off-ramp: Travala! But it deserves a mention in this section as a reminder, as well.

Buying VoIP and Cell service with cryptocurrency

There are some VoIP providers that will accept payment directly in crypto. Here’s a short list:

• JMP.chat - This VoIP provider is really a hosted Jabber/XMPP (instant messaging) service with a paid VoIP gateway. You give them Bitcoin, they give you a phone number. You can even sign up and use the service over Tor for more privacy. JMP.chat deserves its own exposition, but for now, just know it’s an option if you are comfortable getting through an unusual sign-up process.

• SMSpool.net - You can rent cell numbers and pay with crypto.

(Please contact me to let me know if you found any more quality VoIP and cell providers that accept crypto payments!)

Buying VPN services with cryptocurrency

Another common service many of us have need for is a reliable VPN. I have a lot of thoughts on the topic of private network technologies, which can mostly be summed up by preference for using Tor over a VPN but with that said, if you’re going to use a VPN, you should probably stick to a reputable one that you can pay for in cryptocurrency. Here are my favorite options for that:

• MullvadVPN - Uses WireGuard and OpenVPN as its VPN protocols. Mullvad also accepts payments in Bitcoin.

• NymVPN - Nym is a decentralized VPN and mixnet that requires a subscription to use, and you can pay for Nym with shielded Zcash.

• ProtonVPN - Many providers know this company for their ProtonMail service, but Proton also accepts Bitcoin for their VPN product, which supports WireGuard, OpenVPN, and a Stealth protocol (WireGuard over TLS) for bypassing VPN blockers.

Fund a traditional payment card using cryptocurrency

A less private option to consider is a refillable, cryptocurrency-backed, payment card with a major traditional card issuer.

Since these are the equivalent of physical credit cards, you will have to upload your legal identity documents during the application process. Still, its convenience may be useful for those who simply need an off-ramp to spend their more private cryptocurrency earnings.

The biggest advantage of these cards is:

• they can be used for anything a normal credit card can be used for, like rent and utilities payments, which are situations in which even prepaid Visa gift cards may not always work.

• they don’t require a bank account to pay off, making this option especially attractive for those who have suffered banking discrimination and are having trouble using or opening a traditional checking or savings account.

Apply for a Payy Card, a crypto-backed Visa payment card

Payy (referral link) is a self-custodial, privacy-centered cryptocurrency wallet and payment gateway able to interface with Visa’s payment processing network. This makes Payy two things at the same time:

• a digital payment app, much like a cryptocurrency version of CashApp, Venmo, or PayPal, which makes it easy to do the kinds of things you might currently be using those apps for in your civilian life (pay back friends for dinner, for example).

• a Visa payment card paid for with cryptocurrency, but usable anywhere traditional Visa credit cards are accepted.

What’s appealing about Payy is that you can fund your Payy Card’s balance using either fiat currencies, such as from traditional bank accounts, or cryptocurrency sources, such as other crypto wallets or exchanges, by converting whatever cryptocurrency you have into USDC on Polygon, for example. This makes it feasible for de-banked individuals to buy things the way most of the banked population does, without needing to get a bank account, which is no small feat.

It’s important to remember that payments you make using a Payy Card are associated with your legal identity. From that perspective, it’s not more private than a regular credit card. However, it is a lot more private than just using Bitcoin, Ethereum, or other transparent-ledger cryptocurrency systems directly, because your payments aren’t published publicly for the entire Internet to see.

Payy itself communicates what data is public and what data stays private when you sign up for a Payy Card.

I would not recommend using your Payy Card or the Payy network for any need you have that requires more privacy; do your best to stick with Zcash and Monero for that. However, if your friends are unwilling to adopt the stronger privacy protections offered by Zcash in Zodl, are scared of the volatility of actual privacy coins, or have otherwise succumbed to the propaganda that stablecoins are somehow superior (even though we know they’re not), Payy can be a convincing half-step to at least get them using cryptocurrency with you.

Your Payy Card can make you look more like a “normal” civilian in your personal life. And you can still keep your wealth private by having it in and moving it through the Zcash shielded pool (via Zodl) at every opportunity.

Opolis: a crypto-native independent employment platform

Opolis (referral link) is a novel digital employment cooperative you may be able to join (if you meet minimum income or eligibility requirements based on your needs, see below) that can offer a way to legitimize your income, including any earnings from cryptocurrency transactions. With Opolis, rather than work “under the table,” you set things up like a traditional business, funnel your earnings through that business, and then pay yourself back as a salaried employee.

In plain language, the whole setup works like this.

1. Register a legal business entity, such as an S-Corp that offers whatever services you provide.

2. You then hire yourself as an employee of that business, so you can pay yourself a salary out of the business’s future revenue.

3. Your business entity then partners (joins) with the Opolis business cooperative, which collectively negotiates employee benefits like health insurance plans.

4. Finally, your business in turn offers those employment benefits to you, the “human resource” (employee).

Yes, this tactic introduces complexity to your work. It means you have to go through the process of registering a business, like picking a name and choosing which State is best for you to register your business in. But the rubber meets the road when on-ramping the same as it did before, if not even better.

• Getting paid directly in crypto is no different, just show a client your QR code from a cryptocurrency wallet.

• You can use your registered business as a further shield to protect your individual privacy for accepting fiat payments like deposits when using your corporate bank account linked to fiat payment apps, notably Zelle. Just make sure you’ve registered your business in a privacy-friendly state like Delaware, Nevada, or Wyoming, and via a third-party registered agent so that you don’t have to list your legal identity as a publicly disclosed member of the corporation.

Now that you’re earning revenue on behalf of your business, you’ll need to record those funds in some accounting software. (I prefer to use GnuCash for this, but I’ve also heard good things about Rotki.) This way, you can treat it as your business’s taxable income for reporting when your business pays member dues in the cryptocurrencies Opolis supports.

A few other points to know about this off-ramp:

• You don’t need to be earning all of your income from one aspect of your work to join. What matters is how much you’re making in total so that you (as a business) can afford to run payroll while covering operating expenses, employee compensation (salary and benefits), and paying taxes or other applicable fees.

• Opolis can currently, subject to change, process payments in: DAI, ETH, BTC, USDC and USDT.

I’d love to hear about your experience if you try something like this so please don’t hesitate to reach out to me if you do!

Hopefully this guide gives you an idea of how you can use crypto to enhance your financial privacy. It may not be accepted natively everywhere yet, but that doesn’t mean that you can’t use it day-to-day anyway. In coming months we’ll talk about using wallets, and on-boarding into crypto as well.

Yours In Privacy,
Violet

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

Senator Ron Wyden was questioning James Clapper, the Director of National Intelligence, in an open hearing of the Senate Intelligence Committee. Wyden asked him a simple question: “Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?”

To understand why this question mattered, you have to understand what the NSA is supposed to be. The National Security Agency is a foreign intelligence agency. Its job is to spy on foreign governments, foreign militaries, and foreign nationals abroad. This kind of work would be flatly unconstitutional if pointed inward. Domestic investigations are supposed to belong to the FBI, which has to play by Fourth Amendment rules and requires warrants, probable cause, and judicial oversight.

The wall between the NSA and FBI exists for a reason: we have built all kinds of powerful tools for foreign surveillance, like bulk collection, warrantless interception, and dragnet monitoring. But the Constitution was written to expressly prohibit the government from turning this machinery of war and broad surveillance powers against its own citizens.

So when Wyden asked whether the NSA was collecting data on millions of Americans, he was asking whether the wall between foreign and domestic surveillance, one of the foundational lines in how the American security state is allowed to operate, had quietly been taken down.

Clapper said, “No, sir.”

Wyden pressed. Clapper added: “Not wittingly.”

Three months later, Edward Snowden’s leaks revealed that the NSA was, in fact, collecting phone metadata on essentially every call placed in the United States. Clapper had lied to Congress under oath. He later apologized for what he called his “clearly erroneous” testimony, claiming he’d given the “least untruthful” answer he could think of. He was never charged; the statute of limitations expired in 2018.

But let’s focus on the most relevant part of this story: Why did Wyden ask the question in the first place?

Wyden already knew the answer

Wyden sits on the Senate Intelligence Committee. It’s one of two committees (the other is in the House) whose members get read in to classified intelligence programs. It’s their job to make sure the intelligence community is operating above board. These committees are small, and the rest of Congress and the public stay in the dark, on a need-to-know basis.

So when Wyden asked Clapper whether the NSA was collecting data on millions of Americans, Wyden already knew the answer was yes. He’d been briefed. And when Clapper said “no,” Wyden knew, in real time, that the Director of National Intelligence was lying to Congress.

But Wyden couldn’t just stand up and tell the country what he knew. He was bound by classification rules. Asking the question in open session, with the answer pre-submitted to Clapper’s office a day in advance, was one of the only tools he had to let Congress know that he believed the intelligence community was running an illegal program.

He turned out to be right. In 2015, the Second Circuit ruled in ACLU v. Clapper that the NSA’s bulk phone records program exceeded what Congress had authorized under the Patriot Act. In 2020, the Ninth Circuit went further, holding that the program had violated federal surveillance law and was likely unconstitutional as well.

In fact, the 2015 court was pointed about why this mattered.

Congress, the judges wrote, “cannot reasonably be said to have ratified a program of which many members of Congress — and all members of the public — were not aware.”

Only a small circle of lawmakers on the intelligence committees knew. The rest of Congress, voting to reauthorize the Patriot Act, did not. Neither did the public. You cannot meaningfully consent to a program whose existence has been deliberately hidden from you.

But back to Wyden’s question: It’s a pattern worth remembering.

When Senator Wyden goes out of his way to ask a pointed question about a surveillance program, it’s usually because he already knows something he can’t say out loud.

Wyden: “Pay Attention To VPNs”

Which brings us to last week.

On March 26, 2026, Wyden (along with a handful of other Senators) sent a letter to the current Director of National Intelligence, Tulsi Gabbard. The letter asks Gabbard to publicly warn Americans that using a VPN may cause them to forfeit their Fourth Amendment rights against warrantless surveillance.

The mechanism is explained in Wyden’s press release: Under Section 702 of FISA and Executive Order 12333, when the U.S. government can’t tell what country a person is in, it’s allowed to assume that person is a foreigner. Foreigners outside the United States have no Fourth Amendment rights, and a VPN hides where you are.

So while these tools are used as a privacy protection, the intelligence community might be quietly stripping you of constitutional protections against your own government.

We don’t know exactly what Wyden has been briefed on. But the pattern from 2013 is clear: when he asks a pointed question in public, it’s usually because of something he can’t say out loud.

And then there’s the third-party doctrine

This Section 702 loophole is bad enough on its own. But there’s a second legal mechanism worth raising.

Under the third-party doctrine, U.S. law enforcement currently takes the position that it doesn’t need a warrant to obtain information you’ve voluntarily handed to a third party, such as your bank, your phone company, and your ISP. The doctrine traces back to the Katz “reasonable expectation of privacy” test: the Fourth Amendment kicks in only where you have a reasonable expectation of privacy, and the government’s argument is that once you’ve given data to someone else, that expectation disappears.

Now apply that to a VPN. A VPN routes 100% of your internet traffic through a third party. Under the government’s theory, that traffic is fair game without a warrant.

Which produces a genuinely absurd result: the legal system says you have no reasonable expectation of privacy in data you handed to a service whose entire purpose is privacy. The tool you bought specifically to assert a privacy interest is recharacterized as the act of waiving it.

In Carpenter v. United States (2018), the Supreme Court carved an exception into the third-party doctrine, holding that the government does need a warrant to obtain historical cell-site location data, on the theory that some kinds of third-party data are too revealing to fall under the old rule. VPN traffic seems like an even stronger candidate. It might be time for someone who uses a VPN to sue the government.

What Now?

So should we, or should we not, be using a VPN? The honest answer is that there’s no clean solution, because the problem isn’t really VPNs. The problem is that the entire modern internet is built on handing your data to third parties, such as your ISP, your DNS resolver, your email provider, the ad networks embedded in every website you visit, and so on. And the third-party doctrine turns every one of those interactions into a warrantless surveillance opportunity. A VPN just shifts which third party holds your traffic, it doesn’t change the underlying legal theory that says the government can help itself to it without a warrant.

That said, I still use a VPN, and I’m going to keep using one. I don’t want my IP address handed to every website I interact with, and the protection a VPN offers against that is real, even if it’s narrower than the marketing suggests. But it’s really important to be careful about which one. As I covered in a previous video, an overwhelming number of VPN providers are just data-collection shells, and some are outright malware. “Use a VPN” isn’t the advice. “Use a VPN you’ve actually vetted” is closer.

Longer term, it’s time to explore the tools that can’t aggregate your data in the first place. I’ve been digging into decentralized VPNs and mixnets lately, and if you’ve used any, I’d love to hear about your experience.

But the deeper fix is actually legal: The third-party doctrine is a relic of a world where “data you gave to someone else” meant a very narrow scope of information. It does not belong in a digital age that turns everything we do into data held by someone else.

As long as the third-party doctrine stands, we lose one of the most important protections we have against the government’s ability to surveil its own citizens: the warrant requirement. It’s a loophole the size of the entire internet. Closing that loophole is how we get the Fourth Amendment back.

Yours In Privacy,
Naomi

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

So it’s a great time to discuss the importance of warrants.

I understand the argument for eliminating warrants — when a threat seems so big, you don’t want any friction like warrants slowing you down.

But what about when there are even bigger threats that no one talks about, and warrants are one of the most critical safeguards that protects us against these threats?

Most people have never spent even five seconds thinking about warrants, and this is a big mistake, because if we allow the dodging of warrants to become normalized, as it has been under Section 702, we’re in big trouble.

In this article, we’ll explore what warrants are, why the founders cared so much about them, and why they matter more now than ever, in an age where governments are buying all your data from brokers, contracting with private companies to track your movements, and bulk collecting all your financial records.

It’s a new digital era, and the protections warrants were meant to provide have been all but eradicated. So stick with me. Because once you understand the machinery inside a warrant, you will never dismiss the importance of them again.

What Is A Warrant?

Let’s start by understanding what a warrant actually is.

They sound legal. Procedural. People think warrants are just about paperwork. But they’re not.

Warrants are one of the most important checks on power ever invented. And there’s a certain part of the warrant that almost no one ever talks about, even though it’s the part that matters most. We’ll get to that.

For now, understand that warrants have existed in legal systems around the world for a long time. They’re basically a permission slip for the government to search your stuff, seize property, or arrest someone. They vary enormously from country to country in how broad they are. In America, for example, they’re meant to be particularly limited, and these strict limits were actually explicitly written into the Constitution itself.

This is because, at the time that the Constitution was written, Britain and colonial America had been badly abusing warrants. Officials were using two types of broad search powers in the early colonial days called General Warrants and Writs of Assistance, which enabled officers to rummage through a person’s home and things with very little constraint.

As Rob Frommer, senior attorney and co-director of the 4th Amendment Project at the Institute for Justice, explained to me,

“There were these pieces of paper that officials would basically write to themselves, and they would just carry that in their pocket. That would give them power to just enter people’s homes, enter people’s property, invade them whenever they wanted. It let those petty officers be a law unto themselves where they could break in anywhere they wanted to at any time, without any real justification.”

This broad search power became a powerful tool for harassment and abuse. In England, for example, these were used to suppress dissent. People who would criticize the crown and officials in the British government were targeted. Officials would use their general warrant powers to break into homes, to try to find seditious materials. This is one of the big reasons America had a revolution.

So when the founders were writing America’s Constitution, to stop this kind of abuse from happening again, they decided that warrants had to be tightly limited in scope. So they drafted the Fourth Amendment:

“The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”

This was added to the Constitution in the Bill of Rights to protect against general warrants. The lesson was clear: the power to conduct broad searches of the populations leads to abuse.

Warrant Requirements Under The Fourth Amendment:

• A specific place

• Specific people or things

• Probable cause

• Sworn facts

• Judicial approval

That narrowness mattered, because it meant that those in power could no longer go on fishing expeditions, searching your things until they found something they could use against you.

It also created accountability, because it left a record. Abuse is much harder to challenge when there is no paper trail and no one ever had to justify themselves in the first place.

The Most Under-Appreciated Part Of The Warrant

Let’s zoom in on one of the most overlooked parts of the warrant requirement, and one of the most important:

An investigator has to make their case in front of a judge, and prove that they had probable cause before a search is allowed to happen.

The reason the framers required the involvement of a second branch of government, the judiciary, is because law enforcement has been trusted with the immense and unique power to use force against citizens, so checks on this power are necessary. You want an independent, neutral branch looking at search, seizure, and arrest decisions before they happen, to decide whether there are enough facts to actually justify it.

We’re so used to treating law enforcement as the highest authority for keeping law and order that we forget that the Constitution treated it as just one power center among others, and one that needed limits. Those who wrote the Constitution understood that law enforcement has its own mission, its own incentives, its own momentum. It is trying to solve cases and find culprits.

This doesn’t make investigators evil, but it does mean they are not neutral.

Once you realize this, the warrant requirement no longer seems like bureaucratic paperwork. It becomes clear that it’s a very deliberate safeguard against the natural bias of the investigative process.

In fact, in 1948, The Supreme Court put it bluntly when they said:

“Its protection consists in requiring that those inferences be drawn by a neutral and detached magistrate instead of being judged by the officer engaged in the often competitive enterprise of ferreting out crime.”

- Johnson v. United States, 333 U.S. 10 (1948)

As Frommer articulated:

“They’re really eager, because if they make a big bust, that’s great for their career. So they’re gung-ho. And we want somebody in the middle, saying, ‘Wait a second, show me that you actually have a good reason to do this and not just because you’re seeing promotions and awards in your eyes.”

The people who wrote the Constitution didn’t assume that the same people trying to solve the case should also be trusted to decide, on their own, how far they should get to pry into someone’s life. They assumed the opposite -- that the drive to solve a case could itself become dangerous if no outside check stood in the way.

When executive officials get to make these decisions with no independent checks, abuses mount. This is why a neutral magistrate authorizing searches in advance is essential. And when this safeguard is ignored, abuses tend to happen more and more.

This is the forgotten danger that not enough people are talking about in the current Section 702 debate.

Where did these checks on power go?

That is why the executive and judicial branches have different jobs.

The executive branch is in the business of investigating crime. The judicial branch is meant to stand back from the momentum of investigation and make sure the government does not get to decide the limits of its own power. That separation is intentional.

The judiciary is supposed to be there as the bulwark of our rights. But today, the judiciary is conspicuously absent from signing off on a huge number of searches that are going on. Investigators are buying giant data sets from brokers, and searching this data at will. They have unfettered access to troves of personal data about our lives, with no magistrate involved. And the data they have access to gets bigger and bigger over time.

Why Is A Search Dangerous?

Let’s answer the obvious question: So what?

What is so dangerous about these searches that we built constitutional limits around them in the first place?

The real issue is not the search itself. It is the power that comes from this kind of access.

Information is power, and the Fourth Amendment was designed to limit the government’s access to information about you -- to limit the amount of power it had over you, and to make sure that power did not turn into abuse.

If a government can look through your life in enough detail, it can always find something that can be made to look suspicious, something that can be distorted, or something it can use as leverage.

Once the government gets enough access to the fragments of your life, those fragments become easy to rearrange into a narrative. You can easily cobble together a story that makes someone look dangerous, suspicious, or worthy of investigation.

You were near the wrong place.
You searched for the wrong thing.
You texted the wrong joke.
You donated to the wrong cause.
Maybe you used encryption.
Turned your phone off.
Showed up in someone’s contact list.

None of that has to mean guilt. But modern life produces so much data that innocence alone can no longer protect you.

If officials decide in advance whom they want to target, and they have access to a giant trove of someone’s life, they can often easily find scraps of evidence to fit the narrative.

Again, this does not require evil motives. It can happen simply because investigators are doing what investigators do: trying to connect dots. But once someone is looking for a culprit, the temptation is to treat scattered clues as if they all point in one direction. Out-of-context fragments of your life start to look suspicious because they are being viewed through the lens of suspicion by someone trained to do just that.

And now we are increasingly outsourcing that process to AI, again with no magistrate involved. When we let masses of data generate their own “story,” innocent people get swept up in the dragnet. Data is not benign. It can always be sorted, weighted, and interpreted in ways that make ordinary life look incriminating.

Frommer explained how the investigative process has its own bias:

“We often see officers get an idea in their head, “This is what happened.” And then instead of trying to do a neutral investigation in order to determine what objectively happened, they start backfilling, and contorting facts to fit their preexisting narrative. That’s exactly why you want to have that neutral judge in the middle, for an independent check.”

So far, we’ve been talking about how this power can become dangerous even in the hands of people who think they’re doing the right thing. But what about people with worse motives? Once the machinery exists, it doesn’t stay confined to good-faith mistakes.

And the elephant in the room is that the more data someone has access to, the more power they have. Feed these systems enough data, and they gain a greater ability to sort people, rank people, and decide who gets more scrutiny.

This is how discretionary targeting begins. It can identify whistleblowers. It can chill journalists. It can map protest networks before they become effective. It can scare ordinary people away from joining, donating, speaking, meeting, or pushing back against the people in charge.

Once this infrastructure exists, using this power is a huge temptation, even for the most well-meaning people. You’re basically hoping that no one ever gets into office who might abuse this power. And if they do, they now have a ready-made system for intimidating dissidents, finding leverage over political opponents, and entrenching their own power.

Jim Harper, a constitutional law scholar at AEI who specializes in the Fourth Amendment and how it applies in the digital age, explained that the reason we have these checks is to protect our democratic institutions. If we fail to do this:

“Having a government where the wheels come off of and our protections fall away -- we’re going to really need our privacy then.”

The Government Is Buying Your Data

Unfortunately today, it’s almost like we’ve forgotten about the Fourth Amendment. Perhaps because the Constitution seems old and outdated to some people. But not only are these protections still relevant, they’re more important than ever. Because today’s government can access a staggering flood of information compared with anything the founders could have imagined.

Every part of our life is digitally archived in data logs, telemetry, search history, prompt archives, location records, and maps of your social graph. Your data has already been collected, by myriad companies archiving every aspect of your life.

Your bank has your transactions.
Your phone company has your location.
Your email provider stores your messages.
Your cloud account holds your files.
Your apps know where you go, what you search, what you buy, who you talk to, and what patterns your life follows.

We have multi-billion-dollar industries that have emerged to surveil us.

And apparently this data is completely up for grabs, with no judge getting in the way. There’s a huge amount of investigative activity that should require a warrant that doesn’t get it. Many agencies act as if a warrant is just the key that forces someone to hand over data. And if they don’t need the key and can just buy the data instead, why bother with the warrant?

This misses the deeper point. The Fourth Amendment says no unreasonable searches. We can’t just allow law enforcement to redefine the term “search” to exclude wide swaths of activity they’re engaging in, such as purchasing datasets that they then search, because they want to avoid warrant requirements.

This week a major bombshell dropped (which wasn’t even the bombshell it should have been because everyone knew this was going on) that the FBI is buying your data.

Wyden: “Can you commit this morning to not buying Americans location data?”
Patel: “The FBI uses all tools … to do our mission. We do purchase commercially available information that’s consistent with the Constitution and the laws under the electronic communications privacy act.”

As Harper notes:

“They’re rummaging your things. They just happen to be digital things that are held remotely for you.”

And so often with these searches and warrantless subpoenas, the obvious question is:

“Why couldn’t you have gone to a judge? If you have such a case against this person, why can’t you go and get a warrant?”

The dirty secret is that the vast majority of times, if the government went and applied for a warrant, they’d probably get it. But they don’t see warrants as a critical check on power, they see it as busywork.

As Harper explains:

“Warrant applications involve some work. Maybe it’s an hour. If you’re good at it, it’s half an hour. But it requires law enforcement to think carefully about and articulate their cases. Unfortunately there’s an ongoing tension, and law enforcement is constantly pushing to lower the warrant requirement. They really do want to catch criminals, but I think they want to make it so easy, that it’s subject to abuse. And obviously, with the huge swelling of information that’s online and in third-party hands, our privacy is undermined deeply by this resistance to using warrants to get information, when they properly should.”

Frommer added:

“The idea that my location information -- all the routes I’ve driven, all the places I’ve gone -- is sitting in a government database that any officer can look up whenever they want… that undermines my security.”

The whole point of the warrant requirement is to slow investigators down, force them to justify themselves, and put a judge in the middle before the search happens. Do we really want to regress to that era of abuse by pretending that there is a whole category of activities, like database queries, that somehow falls outside the definition of a search?

As Frommer explained,

“There’s nothing special about the word search. It just means any purposeful investigative act. And more importantly, it meant the exact same thing back in 1789 when they were enacting the Fourth Amendment. The government buying your data so they can look at it is a purposeful investigative act.”

If the government wants to do a search on someone, whether it’s in their own data base or someone else’s, they should need to get a warrant to access that information.

There is currently legislation being introduced called the “Surveillance Accountability Act” that is trying to codify this. It asserts that if the government wants to do a search, it needs a warrant. This would essentially eliminate the Third-Party Doctrine, which is currently used to undermine the Fourth Amendment, and get access to people’s lives without a warrant. The bill also gives people the right of action, so that if government agents skirt warrant requirements, they should be held accountable.

It might be time for the legislature to step in, because this is getting out of control. We need to reestablish protections in the digital age.

If nothing else, we need to have a serious conversation as a society about whether we are willing to accept this new normal, and whether we want every future regime that comes to power to be able to search giant databases about all of us at will.

All I hear from law enforcement is that we need to “balance” their thirst for data with our rights. But the Fourth Amendment is the balance. It was designed to ensure that there are certain things the government can’t do without judicial approval.

We already know what the balance of our rights is, we just have to go back to enforcing it.

A warrant isn’t boring paperwork. Or something that just makes life harder for law enforcement. It is one of the most important protections we have. It is the rule that says those with the most power do not get to open up your life for inspection just because they want to see what they can find. They have to name the person. State the reason. Limit the search. Face a judge. And justify themselves first.

This is how a free society functions. Once you lose that principle, you do not just lose privacy. You lose one of the most important checks on power ever created.

Yours In Privacy,
Naomi

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

As we likely all know, ‘don’t be evil’ was most widely known as Google’s old slogan. But quite a while ago, Google quietly removed it. That removal is a fitting metonym for the broader culture shift we’ve seen across tech.

Once upon a time, if a company secretly followed you across your digital life, it would have sounded like a dystopian thriller. But now it’s basically a product requirement.

In this newsletter, I want to talk about how tech culture has radically shifted, how that shift has changed the relationship between companies and users, and why so much of the public still does not see what is happening. In particular, I want to show you some egregious examples of this culture in action. Once you see how dangerous and adversarial this approach is, it becomes much clearer why we need to push back.

Spying Used to Be Creepy

The early internet, or even the internet of a decade ago, wasn’t perfect. But there were at least some broadly understood norms. First, that spying is creepy.

Bruce Schneier and Barath Raghavan wrote a great essay about shifting baseline syndrome in the privacy space. They were responding to news that Microsoft was spying on its users, and they observed that many people defended this behavior, even claiming it was ‘unfair’ to call it spying because it was simply ‘part of how cloud services work.’

The purpose of the essay was to step back and understand how this shift had happened. Because to be clear, Microsoft WAS spying on its users. What the authors found striking was that many people no longer saw this as creepy or scandalous, but as ordinary and expected. It was a vivid example of how dramatically our standards for tech companies had changed.

‘Spying is creepy’ is just one example of the culture shift.
Deception was once disreputable.
Violating user expectations was a scandal.
Consent mattered.
If a company or government was caught circumventing privacy protections, they were shamed.

That broader moral baseline was captured by the phrase ‘don’t be evil.’ It reflected a general culture in which engineers were expected to ask not just whether they could do something, but whether they should. The phrase implied restraint and moral consideration.

The New Normal

So what is the NEW normal? A culture where much of the brainpower in the tech sector, both public and private, is being directed toward things that hurt users instead of help them.

User resistance, platform safeguards, and legal boundaries are treated as engineering puzzles to route around.

Engineering culture is rewarded for solving constraints. But there’s often no regard for why those constraints might have been put there in the first place.

At some point over the past decade, constraint-solving became untethered from morals, and the act of bypassing a safeguard became treated as cleverness rather than misconduct.

The problem with that mindset is that safeguards are often there to protect the user and respect their privacy. So when the highest status goes to the people who find ways around them, the technology we rely on stops being designed to serve the user and starts being designed to extract more from them than they knowingly agreed to give.
Users are now seen as terrain to be mined.

Things like browser blocks, OS permissions, cookie rules, consent flows, and sandboxing should function as warning signs that say, ‘keep out.’ But instead of respecting that, much of the tech sector treats these barriers as prompts for ingenuity.
Then these workarounds are whitewashed in the terms of service and privacy policies. They’re buried in vague legalese intended to hide the details from users. And this language also affects the people building this technology: it abstracts away the meaning of what they are doing, making it feel cleaner and more palatable.

“Telemetry.”
“Signal.”
“Optimization.”
“Friction reduction.”
“Identity resolution.”
“Measurement.”

These terms make invasive acts sound neutral. Once you rename spying as measurement, you can quiet your conscience. We have baked the normalization of civil rights violations into the architecture of everyday technology, and then convinced ourselves that it’s nothing to be alarmed about.

Meta: A Case Study

Let’s look at a case study of this kind of culture shift. Researchers found that Meta was using WebRTC on Android to spy on people’s web browsing.

What does this mean?

Normally, WebRTC is a technology intended for live, direct communication. So let’s say you have a browser-based video call. When you click “Join meeting,” WebRTC helps your browser do things like access your camera and microphone, send your audio and video in real time, and receive the other person’s audio and video.

But Meta perverted this intention and instead used this technology to deanonymize people’s browsing.

How?

Well, Meta uses tracking pixels across a large swath of the web. They’re estimated to be embedded in over 5.8 million websites. When someone visits a website with one of these pixels, the browser receives a cookie identifier. In theory, this cookie shouldn’t automatically tell Meta who that person is when visiting that website.

But the Meta Pixel also used WebRTC to send that cookie to the phone’s localhost ports on Android. The Facebook and Instagram apps were listening on those ports, and if the user was logged in to one of those apps, the cookie value was now linked to that logged-in account.

So Meta was able to tell that this signed-in user was the same person browsing that website.

This is a prime example of engineers using incredibly clever tools to achieve their objectives, but also being egregiously unethical. What they were doing clearly bypassed ordinary privacy expectations, such as those that come with app sandboxing, where phones are specifically designed so that one app isn’t meant to be able to spy on the activities of another app.

This is really adversarial to the user, because it treats the user’s attempt to create boundaries as a challenge to defeat. And this is an all-too-common pattern in tech culture today.

The Gap

All of this happens without the user being aware, which means there is a huge gap between what users expect and how the technology they use actually behaves. The gap points to a culture that too often treats user understanding as a threat rather than a goal.

People today still think they are getting something like siloed data collection that only operates within carefully scoped permissions and guardrails. The average person believes things like incognito mode gives them privacy, app permissions are robust safeguards, clearing cookies resets your identity, if they didn’t click yes then data probably wasn’t collected, and my favorite: that if there were actual egregious privacy violations going on, regulators or journalists would have stopped them.

But the reality is that a new culture has emerged without users realizing it, where companies are using opaque, cross-context, technically ingenious methods to identify, infer, and manipulate.

Identifiers are stitched together across contexts, with all kinds of different actors contributing to the surveillance supply chain: apps, pixels, SDKs, APIs, ad networks, analytics firms, and data brokers. These things are all tied together by entities that make a tremendous amount of money from aggregating data sets, and some of the largest clients of this data are governments.

And as far as Chrome’s incognito mode is concerned, we all know how that ends.

Then there are app permissions: people tend to think these are a complete privacy control, when really they are only one layer, and companies usually find ways to learn far more than users think those permission screens allow.

Most of the surveillance going on in our day-to-day lives operates completely outside the average person’s comprehension.

The gap between perception and reality is part of the scandal. Companies would not work so hard to hide how this surveillance works if they thought users would be comfortable with it.

And the fact that they do it anyway is deeply unethical.

Why This Is So Dangerous

Now why does all of this matter?

Most people think this is about ads. Phrases like “surveillance capitalism” make people think this is just about companies trying to sell us a better pair of shoes.
That data can absolutely be used to sell us a better pair of shoes. But the same data can be used to infer our thoughts, habits, and political persuasion.

The same infrastructure of surveillance that identifies consumers can identify potential dissidents who might become part of a protest movement or opposition party, and stop that political opposition before it even forms.

The same real-time bidding systems that vie for our attention can be used to influence us not just in consumer choices, but in our political beliefs. It can shape our reality. It can get us to hate certain groups of people because we’re made to believe that they hate us.

When companies normalize invasive surveillance, they also normalize the infrastructure that governments, litigants, bad insiders, and future authoritarian actors can exploit.

Privacy versus surveillance is actually a battle between:

• Freedom of thought and manipulation.

• Freedom of association and censorship.

• Human dignity and reputational vulnerability.

• Liberty and the chilling effects that happen when populations start to realize that everything they say or do is monitored.

The erosion of privacy is about the quiet erosion of civil rights.

How We Got Here

All of this happened through many different mechanisms.

First of all, this surveillance happened gradually.

When we all first signed up to get a free Gmail account, none of us were told that this would be used to mine our most personal communications to learn about us, and that this data would eventually end up in the hands of countless third parties as it passed from one company to another through a vast ecosystem of data brokers.

At worst, we might have assumed Google was just selling keyword ads in its search engine. What crept in instead, largely without users noticing, was one of the most sophisticated surveillance systems ever built. And it wasn’t confined to just Google. It spread into the very infrastructure of the internet and became embedded in nearly every tool we use.

No one was told that when they bought an Android or iPhone and had their Wi-Fi on, they were essentially wardriving for Google and Apple, helping build a robust database of every SSID in existence that could be used to monitor people’s exact locations as they moved around.

The harms of these systems were distributed and often invisible, and that’s why no one really looked too closely or pushed back too much.

Because at the individual level, people asked “what do I have to hide?”

But at a societal level, this is a comprehensive infrastructure of surveillance that governments have basically total access to, that can be fine-tuned to target anyone, and that has become one of the most potent mechanisms for control we’ve ever seen.

On top of this, the gap between user understanding and the technical reality of these systems was so great that privacy advocates were caricatured as paranoid. “Things couldn’t possibly be as bad as they say. Surely we’d know about it.”

And inside some of the worst offenders, every new violation reset the internal baseline of what was acceptable. Over time, people kept asking “can we” but stopped asking “should we.” Surveillance stopped being a scandal and became a business model. A norm.

This baseline of acceptable surveillance has shifted entirely to a level that would have been unacceptable ten or twenty years ago. Those who evolved alongside it became frogs in boiling water, and the younger generations who simply inherited these degraded standards were told that “this is just how tech works.”

Today, surveillance has exploded because users are conditioned, language is sanitized behind vague legalese, and harms are hidden behind technical abstraction.

The “Don’t Be Evil” Test

So what now? Is it possible to reclaim this ground that’s been lost?

I think we can. But we have to be strong enough to demand higher standards.

I propose the “don’t be evil” test.

What does this test look like?

• If a system relies on deception, it fails the test.

• If a user would be shocked to learn what is happening in the tools they use, it fails the test.

• If a company is circumventing privacy safeguards, it fails the test.

• If meaningful consent requires a PhD to understand it, it fails the test.

• If data from one context is silently merged with another without users understanding what is going on, it fails the test.

• If engineers are rewarded for bypassing protections, the company or government agency fails the test.

We Can Raise the Standard Again

Tech has this incredible, almost utopian promise.

But that future doesn’t happen by autopilot. We have to build it.

Tech itself is neutral and can be used for good or bad. So much tech today has been hijacked for surveillance and control, but it doesn’t have to be.

But we have to feed a future where tech works for the user instead of against them, and helps people instead of quietly herding them into systems of control that are easy to abuse.

We must build technology and participate in ecosystems that help build robust protections for individual freedom, human agency, autonomy, and flourishing.
We need to start enforcing higher standards, and stop excusing the toxic culture that has overtaken so much of the tech world.

We must stop building a world where technical ingenuity is praised even when it is used against the people it claims to serve. Where the smartest people in the room are rewarded for finding ever more clever ways to violate us.

We can build a better world.
We can raise the standard again.
We can make spying creepy again.
We can make “don’t be evil” mean something again.”

Yours In Privacy,
Naomi

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

There’s a scene in almost every spy thriller you’ve ever seen. Some suave operative approaches a restricted entrance. Security guards step forward, hands raised. “You can’t go in there.”

The agent coolly removes his sunglasses, flips open a badge, says “FBI,” and walks right in. All without breaking their stride.

I always loved that move. The idea of carrying a single credential that instantly resets the power dynamic. I wanted something like that — but for privacy.

Turns out, it exists. And it fits in your wallet.

The Problem with Scanning Your ID

On a recent trip to my local grocery store I tried picking up some craft beer. The moment I scanned it at self-checkout, a red light fired signaling the store clerk to come over.

“Can I see your ID?”

I opened my wallet and showed him. “Oh, I need you to take it out — I have to scan it.”

I pushed back. “I’d rather you didn’t. Can you just type in my birthdate manually?”

He wouldn’t budge. “We have to scan it.”

I tried explaining my concern. Scanning a driver’s license doesn’t just confirm your age — it gives the system a complete text file containing everything on your license: full name, home address, date of birth, height, weight, eye color, organ donor status, endorsements, and so on. I’d like to believe the store’s system parses your birthdate, confirms you’re over 21, and discards the rest. But I have no way of knowing that. What if that data is stored? What if their system gets breached?

Nothing worked. The clerk didn’t budge, and I left without any beer.

The Solution: A Passport Card

Here’s where the FBI moment comes in.

If you’ve ever traveled internationally, you were required to have a passport book — that familiar large booklet of official government identification. What most people don’t know is that the U.S. State Department also issues passport cards: government ID the same size as a driver’s license, valid for travel within North America, and surprisingly useful for everyday privacy.

Put a passport card next to a driver’s license and the differences are immediately obvious. Where a driver’s license is loaded with personal data, a passport card has almost none of it. No address. No physical descriptors. Just a few pieces of identifying information like your name, photo, and date of birth.

That alone is a win. But my key concern was stores scanning and storing my information — and passport cards DO have barcodes. So was all of this for nothing?

Amazingly, no.

Driver’s licenses use a barcode format called PDF417, which retail scanners everywhere are capable of reading. Curious what a clerk actually pulls up when they scan yours? You can find out for yourself. The Secure Camera app, built into GrapheneOS and available for stock Android on the Google Play Store, reads many barcode formats including PDF417. Just point it at your own license and you’ll get a plain text readout of everything on it: name, address, date of birth, height, weight, eye color, organ donor status — all of it.

Passport cards use a completely different format called Code 39, which most retail scanners don’t even recognize. And on the off chance one does? All the scan returns is the card number. If you have a passport card, you can verify this for yourself with the same app to see the difference firsthand.

When I got my passport card, I quickly went back to that grocery store looking to test my new tool (and maybe hoping to cause some confusion). I grabbed the same six-pack and headed to the self-checkout. And almost as if scripted — the same clerk was there.

“Hi, I just need your ID.”

I handed him the passport card. He turned it over, puzzled, then said, “This is cool.” He typed my birthdate manually into the system, handed it back, and walked away. The same person who had insisted he was required to scan my ID.

How to Get One

Getting a passport card isn’t difficult, but it does take some time. Full instructions can be found on the State Department’s website.

If you don’t already have a passport book, it’s worth applying for both at the same time — it saves money and paperwork.

If you already have a passport book like I did, the process is a simple renewal by mail. You’ll fill out a DS-82 form, attach a compliant headshot, and mail it in along with your current passport book and a check. A few weeks later, both come back in the mail.

Conclusion

Every bartender and grocery clerk shouldn’t have the automatic privilege of knowing where you live just because you’re trying to buy a beer — or the ability to store a complete personal profile of you in their store’s system.

The passport card is one of the simplest, most underrated privacy tools out there. It costs $30, fits in your wallet, and requires zero technical knowledge to use.

If you found this helpful, share it with your friends and family. The more people who take these steps, the more we send a message: Privacy isn’t suspicious. It’s not for people with something to hide.

It’s a human right.

And it’s something we all deserve.

Yours In Privacy,

Kryptosis

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

I’m not sure if you’ve all been following this, but something huge is happening right now: the U.S. government just gave an AI company until end of day Friday to hand over its ethics, or else.

The short version:

Anthropic, the company behind the AI chatbot Claude, is in a full-blown standoff with the U.S. Department of Defense (now rebranded the “Department of War”). As of today, they have until end of day Friday to back down or face serious retaliation.

Here’s the backstory.

Last summer, the Pentagon awarded contracts up to $200 million to four AI labs: Anthropic, OpenAI, Google, and Elon Musk’s xAI. The plan is to develop AI capabilities for military use. Already terrifying, but let’s be honest, inevitable.

Anthropic was the first AI company approved for the Pentagon’s classified networks, and until recently it was the only frontier AI provider with that kind of classified access.

But in negotiating contracts, Anthropic has now drawn two hard lines:

1. No using Anthropic’s tools as an engine for mass surveillance, ie processing and analyzing data on Americans at scale

2. No fully autonomous weapons where AI makes final targeting decisions without a human in the loop, ie no operations where AI chooses and executes lethal targets without human oversight.

These seem pretty reasonable. No letting AI autonomously decide to kill people. No building a digital panopticon to surveil your own citizens. Constitutional stuff, arguably.

The Pentagon’s response: absolutely not.

Defense Secretary Pete Hegseth has pushed back, saying all AI vendors must allow their systems to be used for “all lawful purposes,” including warfare, intelligence, and potentially surveillance. Anthropic’s safety restrictions have been labeled “woke AI” by Hegseth and other Trump administration officials.

Meanwhile, OpenAI removed its explicit ban on military applications in January 2024. Google, which had promised after the Project Maven backlash not to build AI for weapons or mass surveillance, dropped that pledge from its AI Principles in February 2025. xAI has moved quickly to expand its Pentagon footprint, landing a major DoD contract and pushing Grok into the department’s internal AI rollout.

That leaves Anthropic, and we’re yet to see what they’ll do.

Today, Hegseth met with Anthropic CEO Dario Amodei directly and delivered an ultimatum: lift the restrictions or face consequences. Anthropic has until Friday.

If they don’t comply, there are three possible outcomes:

1. Cancel Anthropic’s existing and pending contracts, worth up to $200 million.

2. Label Anthropic a “supply chain risk”, a designation typically reserved for adversarial foreign suppliers. This could effectively bar all Pentagon contractors and vendors from using Claude, turning the entire defense industrial base into an enforcement mechanism.

3. Invoke the Defense Production Act, which is a Cold War-era law that would amount to using emergency wartime powers to conscript Anthropic’s AI into military service against the company’s will, forcing them to hand over access to their models whether they consent or not.

Like, wow.

That middle one, according to Dean Ball, a former White House AI policy advisor, “would basically be the government saying, ‘If you disagree with us politically, we’re going to try to put you out of business.’”

The way the military is spinning this is to say it’s “not democratic” to let a single company impose rules above what Congress and existing law already allow.

Sorry Anthropic, how undemocratic of you to refuse to let your product be used for mass surveillance of Americans or for killing people without human oversight.

As of today’s meeting, Anthropic has no plans to budge.

Why this matters:

First of all, let’s be clear: the government already has access to your personal chats in the LLMs. Basically all of the major platforms automatically flag content and feed it to law enforcement. So the fact that AI chatbots are insanely personal (we treat them like our doctor, lawyer, nutritionist, therapist, life coach) and the government is already getting access to these intimate conversations is not what’s being debated here. We already lost that battle.

This is about whether these AI tools are allowed to be deployed to help process the enormous amounts of data being vacuumed up by governments right now. The military is saying they want this tool deployed with no restrictions on surveillance or autonomous lethal force. That’s what “all lawful purposes” actually means in practice.

The resolution of this standoff will likely set precedents for the entire industry. If Anthropic holds the line, other AI companies might demand similar protections. If the Pentagon walks away and gives the contracts to companies that already said yes, the message to every AI lab going forward is simple: having ethics will cost you.

The key takeaway:

This is a fight over who gets to decide what the most powerful AI tools in the world are allowed to do. Right now, one company is drawing a line and paying a real price for it. That’s not to say Anthropic is perfect -- they’re absolutely not, and have also been responsible for some terrible lobbying around AI. But I do give them credit for wanting the DoD to clarify what they plan to use AI for, and establishing boundaries around that, as it has really helped paint a picture for all of us. That the government’s response is threats, ultimatums, and invoking emergency wartime powers against a private tech company tells you everything about how seriously they want those boundaries erased.

So yeah, if I have to use one of these major platforms and I get to choose between one that is enabling an ai-powered killing machine with dystopian panopticon capabilities, or one that is mildly pushing back, I’m probably going to vote with my money for the world I want to see.

In fact, even better, I can take my money to the ai tools that are also trying to protect my privacy, like Brave’s Leo, Venice.ai. Confer.to, and many others, not those involved in DoD contracts at all.

Yours In Privacy,

Naomi

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

I just returned from ETH Boulder and ETH Denver, two back-to-back conferences in Colorado where I gave five presentations on the importance of privacy. Both conferences were fantastic, and the conversation around privacy was more front-and-center than I’ve ever seen it. It was great to see so much mental bandwidth given to the topic from the builders there.

But here’s the thing: discussions from half the people were great. However, discussions from the other half were disquieting. They argued that privacy was “impractical”, “not pragmatic”, “a holdover from a bygone era of idealistic cypherpunks.” They explained that “we now live in the real world, and the only realistic path forward is to make concessions on privacy.”

What does that mean?

Add backdoors.
Expose viewing keys.
Build in compliance hooks.
Implement selective disclosure to regulators.
Create “privacy lite”: just enough to feel good, not enough to upset anyone in power.

The logic sounds reasonable on the surface: We can’t let perfect be the enemy of good. Let’s compromise now, ship something that’s palatable, and at least get people a little privacy.

A Flawed Argument

This is a fundamentally flawed argument. And the reason it’s flawed is that the people making it are evaluating the tradeoff in a vacuum, looking only at this present moment, without accounting for where we’ve come from.

These people are ceding ground to the forces that have been eroding privacy for decades. And those forces have never once returned what they’ve taken. Let me explain.

The Shifting Baseline

There’s a concept called “shifting baseline syndrome”. Each generation of people measures the current situation against what they personally remember, not against what existed before them. So what looks “normal” to a new generation is actually a deeply degraded version of what once was. The baseline keeps shifting downward, and nobody notices because each generation only sees their own slice.

This is exactly how the erosion of privacy works. You can’t evaluate whether a privacy tradeoff is worth making by looking only at the present moment. You have to look at the trajectory. You have to see the full arc of what’s been lost.

And when you do, the picture is staggering. Privacy has been all but eradicated, and it gets worse year after year.

The Bank Secrecy Act of 1970 and the regime it ushered in afterwards introduced mass financial surveillance as a social norm.

Executive Order 12333 in the eighties gave intelligence agencies sweeping authority to collect communications data abroad, which, in practice, meant millions of Americans’ calls, emails, and messages have been vacuumed up right along with it.

The Patriot Act of 2001 allowed warrantless wiretapping, National Security Letters that came with gag orders, and bulk data collection of millions of Americans who were suspected of nothing.

FISA Section 702, which keeps getting renewed again and again, allows the NSA to vacuum up communications from U.S. tech platforms and search through that data for American citizens, all without a warrant.

And the Third-Party Doctrine basically eliminates any kind of privacy in the digital age. It came from Supreme Court cases in the 1970s, and holds that any information you hand to a third party has no reasonable expectation of privacy. In the internet era, basically everything involves a third party, so this doctrine essentially argues that modern life forfeits your right to privacy by default. Which is an insane precedent.

These are just things going on in America, but the entire globe has followed suit. Each individual measure is presented as reasonable, and a small price to pay for security, compliance, and order. But each one has ratcheted the baseline lower.

And at no point along that trajectory have governments or institutions said, “that’s enough. We have all the surveillance we need.” They keep asking for more.

The Machine We Built

We now live under the largest data-collection regime in human history. We have built, and continue to feed, an infrastructure of surveillance unlike anything the world has ever seen.

Every day, a trillion-dollar industry harvests information about where you go, whom you talk to, what you read, what you buy, how long you linger on a screen, what scares you, and what persuades you. This data is packaged, analyzed, inferred, and sold, not just to advertisers, but to data brokers, and basically anyone willing to pay. In fact, some of the largest clients are governments all over the world who use this information to target their own populations.

This invasion of privacy, and overreaching data collection, isn’t just used by companies profiling us to sell us a better pair of shoes. Or social media companies learning about us for the algorithm. In many places, like authoritarian regimes, the machine is used to control dissent before it happens, by flagging potentially problematic people as more likely to join a protest movement, and then targeting those people.

Sometimes the machine is used to shape public sentiment, influence opinions, sway elections, or get entire populations to hate certain groups of people by convincing them that those groups hate them.

There are countries that publicly broadcast information about citizens whose social credit scores have dropped, and then use those scores to restrict their travel, limit their employment, block their children from certain schools, or cut them off from opportunity entirely.

And with the AI revolution, the machine stops being a record of your life and becomes an entire prediction engine. The data that we make concessions on and allow to be collected is dangerously easy to abuse.

A Fatal Flaw: It Can’t Be Secured

This surveillance infrastructure has another fatal flaw: it can’t be secured.

Every year, the number of data breaches hits a new all-time high. Billions of records are exposed, with information we never should have tolerated being collected in the first place, like location histories, medical records, financial data, private messages, biometric identifiers, and Social Security numbers.

This information gets dumped into the wild. It ends up on the dark web, bought and weaponized by organized cartels, criminal syndicates, and nation-state hacking operations. Centralized databases are constant targets, and breaches are not a question of if but when. As John Chambers, the former CEO of Cisco, once said: “There are only two types of companies: those that have been hacked, and those that don’t yet know they’ve been hacked.”

And yet people want to weaken privacy and security further still. Demanding even more KYC data to be collected, even though it’s been proven repeatedly that no one can keep it safe. Or clamoring for backdoors into encrypted communications, while knowing full well they cannot protect those backdoors from exploitation.

Salt Typhoon, for example, is a Chinese nation-state hacking group that infiltrated the core wiretapping infrastructure of major U.S. telecommunications providers. The very systems built to enable lawful government surveillance became the attack surface. The backdoor we accepted as a compromise to privacy, by allowing lawful access laws like CALEA to take hold, became the front door for foreign adversaries, who have been intercepting Americans’ calls and messages at scale.

And still, the calls for more backdoors continue. Just one more compromise, to keep us safe.

No More Compromise

I say, no more compromise. Those who tell us that we need limits on privacy to achieve mainstream adoption, that we need viewing keys for regulators, compliance hooks for institutions, even more backdoors for governments — they need to stop looking at this current moment in a vacuum, and see how far we’ve already fallen, and how low our shifting baseline of privacy has already sunk.

Look at the privacy that we used to enjoy, and now look at the kind of surveillance that has since become normalized. More and more privacy disappears every year through just “one more concession.” Powers that were granted were never relinquished. So-called “temporary measures” are now permanent fixtures. We are surrendering the last remaining vestiges of private life, and calling it pragmatism.

It’s time to draw a hard line in the sand. Enough is enough. We have to stop giving ground to a force that never stops asking for more. Privacy is essential for a free society, and we simply can’t afford to let people take it from us.

The Debate

Anyway, at the conferences I just came from, I had the chance to put this conviction to the test. I participated in a mock debate on a proposition that cuts to the core of the modern privacy movement: the proposition was that “Limits on privacy are a price worth paying for mainstream adoption of cryptographic privacy.”

In the previous email I published my opening statement from the debate — and for those interested, Matt Green and I ended up winning, by the way!

A mock debate is one thing. Now we actually have to win this battle in the real world. And I hope that enough people want to draw a line in the sand alongside us.

I’d also love your opinions in the comments: Who do you side with in this debate? These aren’t questions we can leave to policymakers and technologists to answer behind closed doors. If privacy is going to survive the digital age, we need more people like you in this conversation.

Yours In Privacy,

Naomi

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

Today I participated in a Privacy Salon in Denver where we debated a proposition that cuts to the core of the modern privacy movement:

“Limits on privacy are a price worth paying for mainstream adoption of cryptographic privacy.”

I was on the “no” side alongside Matt Green, with Evin McMullen and Wei Dai arguing “yes.”

It was a lively, thoughtful exchange that forced us to confront a deeper question: is weakening privacy simply the cost of scale?

Below is my opening statement from the debate.

Opening Statement

The proposition assumes something dangerous: that privacy is negotiable. That it is a dial we can turn down in exchange for popularity.
But privacy is not a marketing feature. It is the condition that makes freedom possible.

Here are 4 big reasons why limits on privacy are absolutely not a price worth paying for mainstream adoption.

1. Privacy Is Foundational to Freedom

First, privacy is the condition that makes free thought, dissent, experimentation, and innovation possible.
Without it, we lose the ability to protest, express ourselves, have whistleblowers and dissidents and all kinds of self-correcting mechanisms in society, without fear of persecution.

Privacy is something that shouldn’t be compromised because it’s the foundation of a free society.

2. Lowering Privacy Lowers the Baseline

Second, when we weaken privacy in the name of mainstream adoption, we lower the baseline of what we’re willing to accept.

“Temporary” trade-offs become norms. Surveillance that creeps in rarely gets rolled back.

Every time we accept a small expansion of surveillance in the name of convenience or scale, that weakened baseline becomes the new normal. Privacy has been decimated over the past decades due to continual compromises in the name of things like mass adoption.

3. Misdiagnosing the Problem

Third, when companies claim that privacy limits are necessary for adoption, what they often mean is that their revenue model depends on collecting more data, or that redesigning their platform would be inconvenient.

The barrier to adoption is not privacy. It is lazy product design and surveillance-based monetization.

Usability vs. Privacy is a false dichotomy.

We don’t say: “Seatbelts are complicated, so we removed them for mass adoption.”
or “Fraud protection slows down transactions, so we eliminated it.”

Safety and usability are engineering problems.
Privacy is also an engineering problem.

4. Security Risks

Finally, there are security risks of compromising on privacy. Systems that collect, profile, share, and embed personal data into their core architecture expand the attack surface for the users of these systems.

These data troves are high-value targets for hackers, foreign adversaries, criminal networks, and insider abuse. History is filled with massive breaches where millions of people had their information exposed because the system was designed to hoard data.
In cybersecurity, one of the most basic and powerful principles is data minimization.

Weak privacy increases breach risk, insider abuse, state leverage, geopolitical vulnerability. And in an AI-driven world, it increases the scale and automation of exploitation.

In Closing

Privacy isn’t negotiable. It’s the boundary that prevents mainstream adoption from becoming mainstream control.

Mass adoption without privacy produces centralized power, behavioral manipulation, and democratic fragility.

This debate is not about whether limiting privacy can accelerate growth. It is about whether trading long-term freedom for short-term scale is a price we should be willing to pay. And the answer is no.

Because what’s at stake is security, freedom, and human dignity, and the cost of losing that in society for future generations is too high.

Yours In Privacy,

Naomi

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

Originally published in A Few Thoughts on Cryptographic Engineering on Feb 2, 2026.

WhatsApp Encryption, a Lawsuit, and a Lot of Noise

It’s not every day that we see mainstream media get excited about encryption apps! For that reason, the past several days have been fascinating, since we’ve been given not one but several unusual stories about the encryption used in WhatsApp. Or more accurately, if you read the story, a pretty wild allegation that the widely-used app lacks encryption.

This is a nice departure from our ordinary encryption-app fare on this blog, which mainly deals with people (governments, usually) claiming that WhatsApp is too encrypted. Since there have now been several stories on the topic, and even folks like Elon Musk have gotten into the action, I figured it might be good to write a bit of an explainer about it.

Our story begins with a new class action lawsuit filed by the esteemed law firm Quinn Emanuel on behalf of several plaintiffs. The lawsuit notes that WhatsApp claims to use end-to-end encryption to protect its users, but alleges that all WhatsApp users’ private data is secretly available through a special terminal on Mark Zuckerberg’s desk. Ok, the lawsuit does not say precisely that — but it comes pretty darn close:

The complaint isn’t very satisfying, nor does it offer any solid evidence for any of these claims. Nonetheless, the claims have been heavily amplified online by various predictable figures, such as Elon Musk and Pavel Durov, both of whom (coincidentally) operate competing messaging apps. Making things a bit more exciting, Bloomberg reports that US authorities are now investigating Meta, the owner of WhatsApp, based on these same allegations. (How much weight you assign to this really depends on what you think of the current Justice Department.)

If you’re really looking to understand what’s being claimed here, the best way to do it is to read the complaint yourself: you can find it here (PDF). Alternatively, you can save yourself a lot of time and read the next five sentences, which contain pretty much the same amount of factual information:

1. The plaintiffs (users of WhatsApp) have all used WhatsApp for years.

2. Through this entire period, WhatsApp has advertised that it uses end-to-end encryption to protect message content, specifically, through the use of the Signal encryption protocol.

3. According to unspecified “whistleblowers”, since April 2016, WhatsApp (owned by Meta) has been able to read the messages of every single user on its platform, except for some celebrities.

Here’s the nut of it:

The Internet has mostly divided itself into people who already know these allegations are true, because they don’t trust Meta and of course Meta can read your messages — and a second set of people who also don’t trust Meta but mostly think this is unsupported nonsense. Since I’ve worked on end-to-end encryption for the last 15+ years, and I’ve specifically focused on the kinds of systems that drive apps like WhatsApp, iMessage and Signal, I tend to fall into the latter group. But that doesn’t mean there’s nothing to pay attention to here.

Hence: in this post I’m going to talk a little bit about the specifics of WhatsApp encryption; what an allegation like this would imply (technically); we can verify that things like this are true (or not verify, as the case may be). More generally I’ll try to add some signal to the noise.

Full disclosure: back in 2016 I consulted for Facebook (now Meta) for about two weeks, helping them with the rollout of encryption in Facebook Messenger. From time to time I also talk to WhatsApp engineers about new features they’re considering rolling out. I don’t get paid for doing this; they once asked me if I’d consider signing an NDA and I told them I’d rather not.

Background: what’s end-to-end encryption, and how does WhatsApp claim to do it?

Instant messaging apps are pretty ancient technology. Modern IM dates from the 1990s, but the basic ideas go back to the days of time sharing. Only two major things have really changed in messaging apps since the days of AOL Instant Messenger: the scale, and also the security of these systems.

In terms of scale, modern messaging apps are unbelievably huge. At the start of the period in the lawsuit, WhatsApp already had more than one billion monthly active users. Today that number sits closer to three billion. This is almost half the planet. In many countries, WhatsApp is more popular than phone calls.

The downside of vast scale is that apps like this can also collect data at similarly large scale. Every time you send a message through an app like WhatsApp, you’re sending that data first to a server run by WhatsApp’s parent company, Meta. That server then stores it and eventually delivers it to your intended recipients. Without great care, this can result in enormous amounts of real-time message collection and long-term storage. The risks here are obvious. Even if you trust your provider, that data can potentially be accessed by hackers, state-sponsored attackers, governments, and anyone who can compel or gain access to Meta’s platforms.

To combat this, WhatsApp’s founders Jan Koum and Brian Acton took a very opinionated approach to the design of their app. Beginning in 2014 (around the time they were acquired by Facebook), the app began rolling out end-to-end (E2E) encryption based on the Signal protocol. This design ensures that all messages sent through Meta/WhatsApp infrastructure are encrypted, both in transit and on Meta’s servers. By design, the keys required to decrypt messages exist only on a users’ device (the “end” in E2E), ensuring that even a malicious platform provider (or hacker of Meta’s servers) should never be able to read the content of your messages.

Due to WhatsApp’s huge scale, the adoption of end-to-end encryption on the platform was a very big deal.

Not only does WhatsApp’s encryption prevent Meta from mining your chat content for advertising or AI training, the deployment of this feature made many governments frantic with worry. The main reason was that even law enforcement can’t access encrypted messages sent through WhatsApp (at least, not through Meta itself.). To the surprise at many, Koum and Acton made a convert of Facebook’s CEO, Mark Zuckerberg, who decided to lean into new encryption features across many of the company’s products, including Facebook Messenger and (optionally) Instagram DMs.

The state of encryption on major messaging apps in early 2026. Notice that three of these platforms are operated by Meta.

This decision is controversial, and making it has not been cost-free for Meta/Facebook. The deployment of encryption in Meta’s products has created enormous political friction with the governments of the US, UK, Australia, India and the EU. Each government is concerned about the possibility that Meta will maintain large numbers of messages they cannot access, even with a warrant. For example, in 2019 a multi-government “open letter” signed by US AG William Barr urged Facebook not to expand end-to-end encryption without the addition of “lawful access” mechanisms:

So that’s the background. Today WhatsApp describes itself as serving on the order of three billion users worldwide, and end-to-end encryption is on by default for personal messaging. They haven’t once been ambiguous about what they claim to offer. That means that if the allegations in the lawsuit proved to be true, this would be one of the largest corporate coverups since Dupont.

Are we sure WhatsApp is actually encrypted? Could there be a backdoor?

The best thing about end-to-end encryption — when it works correctly — is that the encryption is performed in an app on your own phone. In principle, this means that only you and your communication partner have the keys, and all of those keys are under your control. While this sounds perfect, there’s an obvious caveat: while the app runs on your phone, it’s a piece of software. And the problem with most software is that you probably didn’t write it.

In the case of WhatsApp, the application software is written by a team inside of Meta. This wouldn’t necessarily be a bad thing if the code was open source, and outside experts could review the implementation. Unfortunately WhatsApp is closed-source, which means that you cannot easily download the source code to see if encryption performed correctly, or performed at all. Nor can you compile your own copy of the WhatsApp app and compare it to the version you download from the Play or App Store. (This is not a crazy thing to hope for: you actually can do those things with open-source apps like Signal.)

While the company claims to share its code with outside security reviewers, they don’t publish routine security reviews. None of this is really unusual — in fact, it’s extremely normal for most commercial apps! But it means that as a user, you are to some extent trusting that WhatsApp is not running a long-con on its three billion users. If you’re a distrustful, paranoid person (or if you’re a security engineer) you’d probably find this need for trust deeply unappealing.

Given the closed-source nature of WhatsApp, how do we know that WhatsApp is actually encrypting its data? The company is very clear in its claims that it does encrypt. But if we accept the possibility that they’re lying: is it at least possible that WhatsApp contains a secret “backdoor” that causes it to secretly exfiltrate a second copy of each message (or perhaps just the encryption keys) to a special server at Meta?

I cannot definitively tell you that this is not the case. I can, however, tell, you that if WhatsApp did this, they (1) would get caught, (2) the evidence would almost certainly be visible in WhatsApp’s application code, and (3) it would expose WhatsApp and Meta to exciting new forms of ruin.

The most important thing to keep in mind here is that Meta’s encryption happens on the client application, the one you run on your phone. If the claims in this lawsuit are true, then Meta would have to alter the WhatsApp application so that plaintext (unencrypted) data would be uploaded from your app’s message database to some infrastructure at Meta, or else the keys would. And this should not be some rare, occasional glitch. The allegations in the lawsuit state that this applied to nearly all users, and for every message ever sent by those users since they signed up.

Those constraints would tend to make this a very detectable problem. Even if WhatsApp’s app source code is not public, many historical versions of the compiled app are available for download. You can pull one down right now and decompile it using various tools, to see if your data or keys are being exfiltrated. I freely acknowledge that this is a big project that requires specialized expertise — you will not finish it by yourself in a weekend (as commenters on HN have politely pointed out to me.) Still, reverse-engineering WhatsApp’s client code is entirely possible and various parts of the app have indeed been reversed several times by various security researchers. The answer really is knowable, and if there is a crime, then the evidence is almost certainly* right there in the code that we’re all running on our phones.

If you’re going to (metaphorically) commit a crime, doing it in a forensically-detectable manner is very stupid.

But WhatsApp is known to leak metadata / backup data / business communications…!

Several online commenters have pointed out that there are loopholes in WhatsApp’s end-to-end encryption guarantees. These include certain types of data that are explicitly shared with WhatsApp, such as business communications (when you WhatsApp chat with a company, for example.) In fairness, both WhatsApp and the lawsuit are very clear about these exceptions.

These exceptions are real and important. WhatsApp’s encryption protects the content of your messages, it does not necessarily protect information about who you’re talking to, when messages were sent, and how your social graph is structured. WhatsApp’s own privacy materials talk about how personal message content is protected while other categories of data exist.

Another big question for any E2E encrypted messaging app is what happens after the encrypted message arrives at your phone and is decrypted. For example, if you choose to back up your phone to a cloud service, this often involves sending plaintext copies of your message to a server that is not under your control. Users really like this, since it means they can re-download their chat history if they lose a phone. But it also presents a security vulnerability, since those cloud backups are not always encrypted.

Unfortunately, WhatsApp’s backup situation is complex. Truthfully, it’s more of a Choose Your Own Adventure novel:

1. If you use native device backup on iOS or Android devices (for example, iCloud device backup or the standard Android/Google backup), your WhatsApp message database may be included in a device backup sent to Apple or Google. Whether that backup is end-to-end encrypted depends on what your provider supports and what you’ve enabled. On Apple platforms, for example, iCloud backups can be end-to-end encrypted if you enable Apple’s Advanced Data Protection feature, but won’t be otherwise. Note that in both cases, the backup data ends up with Apple or Google and not with Meta as the lawsuit alleges. But this still sucks.

2. WhatsApp has its own backup feature (actually, it has more than one way to do it.) WhatsApp supports end-to-end encrypted backups that can be protected with a password, a 64-digit key, and (more recently) passkeys. WhatsApp’s public docs are here and WhatsApp’s engineering writeup of the key-vault design is here. Conceptually, this is an interesting compromise: it reduces what cloud providers can read, but it introduces new key-management and recovery assumptions (and, depending on configuration, new places to attack). Importantly, even if you think backups are a mess — and they often are — this is still a far cry from the effortless, universal access alleged in this lawsuit.

Finally, WhatsApp has recently been adding AI features. If you opt into certain AI tools (like message summaries or writing help), some content may be send off-device for processing a system WhatsApp calls “Private Processing,” which is built around Trusted Execution Environments (TEEs). WhatsApp’s user-facing overview is here, Meta’s technical whitepaper is here, and Meta’s engineering post is here. This capability should not reveal plaintext data to Meta, either: more importantly, it’s brand new and much more recent than the allegations int he lawsuit.

As a technologist, I love to write about the weaknesses and limitations of end-to-end encryption in practice. But it’s important to be clear: none of these loopholes stuff can account for what’s being alleged in this lawsuit. This lawsuit is claiming something much more deliberate and ugly.

Trusting trust

When I’m speaking to laypeople, I like to keep things simple. I tell them that cryptography allows us to trust our machines. But this isn’t really an accurate statement of what cryptography does for us. At the end of the day, all cryptography can really do is extend trust. Encryption protocols like Signal allow us to take some anchor-point we trust — a machine, a moment in time, a network, a piece of software — and then spread that trust across time and space. Done well, cryptography allows us to treat hostile networks as safe places; to be confident that our data is secure when we lose our phones; or even to communicate privately in the presence of the most data-hungry corporation on the planet.

But for this vision of cryptography to make sense, there has to be trust in the first place.

It’s been more than forty years since Ken Thompson delivered his famous talk, “Reflections on Trusting Trust“, which pointed out how there is no avoiding some level of trust. Hence the question here is not: should we trust someone. That decision is already taken. It’s: should we trust that WhatsApp is not running the biggest fraud in technology history. The decision to trust WhatsApp on this point seems perfectly reasonable to me, in the absence of any concrete evidence to the contrary. In return for making that assumption, you get to communicate with the three billion people who use WhatsApp.

But this is not the only choice you can make! If you don’t trust WhatsApp (and there are reasonable non-conspiratorial arguments not to), then the correct answer is to move to another application; I recommend Signal.

Notes:

* Without leaving evidence in the code, WhatsApp could try to compromise the crypto purely on the server side, e.g., by running man-in-the-middle attacks against users’ key exchanges. This has even been proposed by various government agencies, as a way to attack targeted messaging app users. The main problem with this approach is the need to “target”. Performing mass-scale MITM against WhatsApp users in a manner described by this complaint would require (1) disabling the security code system within the app, and (2) hoping that nobody ever notices that WhatsApp servers are distributing the wrong keys. This seems very unlikely to me.

Yours In Privacy,

Matthew

Matthew D. Green is a leading cryptographer and Associate Professor at the Johns Hopkins University Information Security Institute, renowned for his pioneering work in privacy-enhancing technologies. He is a co-creator of the Zerocoin and Zerocash protocols, the latter enabling fully anonymous transactions in cryptocurrencies like Zcash through advanced zero-knowledge proofs (zk-SNARKs).

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

The answer is because computers are often easier to compromise than phones, and I would be downgrading the awesome privacy and security that Signal gives me by extending my attack surface to my computer. Let me explain.

Phones Are Locked Down by Design

Modern smartphones are some of the most locked down consumer devices that have ever existed.

They do a great job at sandboxing apps.

Some phone operating systems do a much better job than others (eg GrapheneOS does a great job at this), but in general, phones enforce app sandboxing much more strictly by default than most desktops.

What this essentially means is that on your phone, every app lives in its own isolated box. It has its own storage, its own permissions, and its own processes. The intention is that one app can’t just reach over and read another app’s data, or spy on its memory. If an app wants to access your microphone, your camera, your files, or your contacts, the operating system generally has to explicitly allow it. And you usually see that happen.

Even if a malicious app gets installed on your phone, the damage it can do to other apps and the OS is usually limited, unless you’ve granted the app powerful permissions, or unless the attacker breaks out of that sandbox. And that usually requires additional exploits.

How Desktops Are Different

Now compare that to a desktop computer.

They don’t have the same default, enforced sandboxing model as phones.

On a desktop, most apps run under the same user account. They share access to large parts of the file system. They can often observe or interfere with each other in ways that mobile operating systems simply don’t allow.

If malware runs as you on your computer, it often has access to a huge amount of what you do: Your files, clipboard, keyboard input, screen, your apps running.

Mobile operating systems are built around the assumption that every app is hostile, and try hard to silo them. Desktops are, by default, designed to be cooperative environments for apps.

This Isn’t a Signal Issue

This brings us back to Signal. This isn’t a Signal issue.

Signal is an extremely well designed, end-to-end encrypted messaging app. On your phone, it benefits from all of the security properties I just described: Strong sandboxing. Hardware-backed key storage. Restricted access to other apps. Limited background surveillance capabilities.

When you install Signal on your computer, you widen your attack surface from one hardened device to two completely different environments.

Your computer becomes another place where keys and message data can be targeted. And computers are much easier to target.

Why Computers Are Easier to Attack

There’s a reason why zero days on phones are much more valuable. On desktops, attackers often don’t even need advanced exploits to attack your system. They can use phishing attacks, malicious browser extensions, compromised software updates, and they can install malware disguised as legitimate apps. Once that malware runs, it can often do things like capture your screen, log your keystrokes, or read data from other applications.

Phishing still exists on phones, but a phishing message does not automatically lead to arbitrary code execution. A malicious app installed from an app store is still trapped inside its sandbox. A fake update prompt cannot actually replace system software. A malicious app pretending to be legitimate does not suddenly gain visibility into your other apps.

On desktops, however, these same attack paths often are sufficient to compromise the system meaningfully. On phones, they’re usually not, unless the attacker also has a separate sandbox escape or OS-level exploit.

So if I’m using a powerful private communication tool like Signal, I want it to be as private and secure as possible.

I don’t need to weaken my protections by installing it on a less trusted system.

Signal itself is a strong app on either system, but it’s the computer itself that isn’t as strong.

Hardware-Backed Security Matters

Phones also have another major advantage: Phones often make hardware-backed key storage the default assumption, while desktops vary more.

Most modern phones have secure enclaves, or trusted execution environments. These isolate cryptographic keys from the rest of the operating system, so that even if parts of the OS are compromised, those keys are much harder to extract.

On desktops, once you’re logged in, malware running as your user can often access more secrets and more app data, because more of it is accessible under that same user account.

Modern computers do have hardware security modules, like TPMs or the Secure Enclave on newer Macs. On desktops, these are heavily used for boot integrity and disk encryption, and some platforms also use them for credentials and key operations during runtime, but it’s less uniform.

On phones, secure enclaves are deeply integrated and continue protecting cryptographic keys against extraction even while the device is in active use.

In essence: Desktops often lean on hardware security heavily for boot and disk encryption, and phones tend to lean on it continuously for app key operations.

Security Always Collapses to the Weakest Link

So, to circle back, when you link Signal to your computer, you are effectively taking a very well protected environment, your phone, and extending trust to a much weaker one.

Security always collapses to the weakest link.

That does not mean that Signal Desktop is bad. It means desktops are inherently riskier environments.

For many people, that tradeoff is totally reasonable. Convenience matters. Typing on a keyboard is easier. Multitasking is easier.

But if your threat model includes targeted surveillance, and you rely on sensitive communications, then keeping Signal confined to your phone meaningfully reduces risk.

BIG Caveat

That being said, I don’t want people to assume they should do everything on their phone either, or that phones are ALWAYS more secure.

First, phones are intensely personal devices, and most of us do far too much on them. We carry social media apps and countless third-party apps everywhere we go, and we routinely grant them access to our location, contacts, microphones, and cameras. These devices follow us through our day and capture huge amounts of context about our lives.

Every app we install also broadens our attack surface. We are trusting countless third parties to write secure code, ship updates, and respond quickly when vulnerabilities are discovered.

And the phone itself matters too: If your device isn’t getting regular security patches, all of these protections degrade over time.

Keep your phone lean, only install what you absolutely need, and absolutely keep it updated.

One tip that can help you meaningfully reduce risk on your phone is by using a privacy-focused browser instead of downloading a native app for everything. If something works just as well in the browser, do it there, because app permissions tend to be invasive.

These are some of the ways to keep your phone locked down and as private and secure as possible.

TLDR

This isn’t about Signal being unsafe, or about desktops being off limits. It’s about understanding where different tools are strongest and weakest. Phones are designed to aggressively isolate apps and protect secrets, while desktops are built for flexibility and convenience. When you’re using a high-stakes private communication tool, it makes sense to keep it inside the most hardened environment you have, while also being disciplined about what you install on that device. If your threat model is lower, I think you can comfortable use these tools in ways that make them easier and sustainable for you. The more we understand how different devices are designed to protect us, the easier it is to place sensitive tools where they’re actually safest.

If you have any short questions that you’d like answered, feel free to add them to the comments section! Maybe we’ll be able to answer your question in a future article.

Yours In Privacy,

Naomi

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

I personally do not have a cell number. I don’t have a SIM in my phone -- I rely entirely on VoIP.

But even if you do have a cell number, there are many reasons not to hand it over. In my newsletter I mentioned how a phone number is a powerful unique identifier. We are trained to give it to almost everyone, which makes it trivial for data brokers and breach harvesters to link together our accounts, movements, and behavior across the internet.

Today’s newsletter is about an alarming thing happened in the process of writing that last one.

As part of my usual workflow, I ran the draft through an AI tool to check for typos, grammar, and phrasing. I often use AI for this, in this case ChatGPT. It is far more capable than a basic spell checker. It can tell the difference between diffuse and defuse, affect and effect, foment and ferment, and then automatically formats it for me with the right sized headings etc.

But instead of a check for typos, the AI censored me.

I had included a list of companies I personally use and recommend. The AI deleted the names and replaced them with a refusal, saying it could not list specific services.

I mentioned that some of these services accept cryptocurrency, which can be a more private way to pay. The reference to crypto was removed entirely.

I asked why I had been censored, and the AI said that privacy tools can be used for wrongdoing, and therefore it should not help write a how-to guide about achieving privacy. Even after acknowledging that my newsletter was aimed at everyday people doing nothing illegal, it maintained that helping people learn privacy techniques could be misused, so it should not exist.

There it was. The familiar smear that privacy is for criminals, so normalized that even an AI now repeats it without question.

First off, apologies for any typos that made their way into my last email, obviously I went with my original and not the censored version.

Now, I have three main takeaways from this experience that I want to talk about in this newsletter. The first is obvious, but the others are super important ones that I think many may miss.

1. Censorship and the shaping of thought

The most immediate lesson is the danger of AI censorship.

If we centralize knowledge into single system, that knowledge becomes easier to control. Right now there are a handful of major models out there that have immense power when it comes to quietly filtering, reshaping, and rewriting what we think to be true. What people are allowed to ask, learn, or express becomes mediated through these models and the values embedded in them.

This is why decentralization and competition amongst models matters. If society converges on a single or a handful of AI authorities, we also converge on the definition of acceptable truth.

What worries me even more is how deeply these systems are being integrated into everyday tools. Word processors. Email clients. Messaging apps. Website interfaces.

Are we heading towards a world where software scans your words before you send them, and quietly rewrites them to a more acceptable format first? Client-side filtering of wrongthink before a message ever leaves your device is not that farfetched.

There are two other, more nuanced takeaways I want to talk about.

2. These are not the AI’s views. They are ours.

It is tempting to blame the AI company only.

“They censored me!”

Yes, ChatGPT fine-tunes its models and adds safeguards around certain categories of information, including what it will and will not help with. There may be rules along the lines of “don’t help people bypass verification systems.”

Is that what happened here? Possibly.

But I would be far more convinced this was deliberate, privacy-specific censorship if I were not already so aware that much of society holds the same view.

Large language models are trained on us. What the AI told me was a reflection of a widely accepted cultural assumption about privacy itself.

Specifically, AI models are trained on enormous datasets. They ingest vast amounts of writing, ideas, and information, then learn the patterns within that data in order to generate language that sounds coherent and meaningful. They absorb patterns from the internet.

And increasingly for a generation, society has been repeating over and over that privacy is for criminals.

“If you have nothing to hide, you have nothing to fear.”

“If you want privacy, you must be doing something wrong.”

Privacy has been reframed as deviant and shameful behavior. Law-abiding people are expected to be ok with being transparent, even as their data is leaked, sold, breached, and abused.

An AI trained on data expressing this worldview will reproduce it.

AI is reflecting our views. It implied that normal people do not need privacy, and that helping people protect themselves is inherently suspect.

If we want a different future, we cannot just fight models. We have to fight the cultural assumptions being fed into them.

3. We must contribute to the knowledge base now

This leads to the most important point I want to make.

Right now, AI systems are being trained at an enormous scale. They are ingesting the internet as it exists today.

What gets written now will shape what future models believe is normal.

If the only articles it is ingesting about privacy frame it as criminal, extremist, or unnecessary, then that becomes the default assumption encoded into future LLMs.

We need to write this content now. In fact, we need to create as much content as we can.

Not only to shift culture and spread the case for privacy now, but so that tomorrow’s AI models are trained on OUR perspective, not on the narratives pushed by anti-privacy propagandists. AI isn’t going anywhere, and these models will go on to influence future generations. So we have to make sure they represent our worldview by contributing to the knowledge base.

Hundreds of thousands of people watch our videos and read our work. Imagine if even a fraction of them wrote a blog post, recorded a video, or shared a clear explanation of why privacy matters.

We have an incredibly powerful grassroots movement growing around privacy. But we all need to contribute if we want to win. Because this window of opportunity where privacy is still allowed won’t be open forever. So get active. Get creating. See if you can find a way today to post something in favor of privacy, and shift the training data back in our favor.

By the way, I ran my final newsletter through Confer.to this time, a new private, end-to-end encrypted LLM created by Moxie Marlinspike, the founder of Signal. Another way we can build a better future is to support those tools that are trying to protect us. A good lesson for all of us, including me.

Yours In Privacy,

Naomi

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

The problem is that I don’t have a SIM in my phone. Which means that I actually don’t have a cell number, the number associated with a SIM.

What should someone do in a situation like this?

Now I know I’m an anomaly here. Most people DO have a cell number.
But there are plenty of reasons someone might decide not to hand out their cell number every time a company asks. Here are two:

1. One big reason is that we end up giving out the same cell number to everyone. Thousands of merchants, restaurants, our doctor, school, the government, work colleagues. It becomes a unique identifier tying all our activities together. Almost every service you use shares data about you, and that data makes its way to data brokers. With the same cell number linking every account that you use, data brokers can now see everything you’re doing. So can criminals on the dark web: all of this data ends up in dark web breaches too. Anyone digging through those data dumps can tie your scattered accounts together and piece together an intimate picture of your life.

2. Cell numbers are tied to the telecom network in a way that creates an additional privacy risk. Cellular networks keep track of where your phone is so they can route calls and texts. That is part of how the system works. Cell numbers record your location in what’s known as a Home Location Registry, and this becomes a map of everywhere you’ve been. Telecom providers are notorious for selling your location data. Unlike cell numbers, VoIP numbers don’t actually get logged in the HLR, so it’s much safer to give someone a VoIP number than a cell number.

In this newsletter, I’ll walk through a few scenarios where you might be asked for your number, and how to avoid giving up your SIM-based identity.

1. In Person: my default line

If someone in person asks for my number, and I know it’s not actually necessary, I tell them:
“I don’t currently have a working number.”
Here’s what I’ve learned after doing this for years.
If you say “I don’t have a phone” or “I don’t have a number,” people often don’t believe you, or they get hostile. You get the “well you need one to enter in our system” pushback.
But “I don’t CURRENTLY have a working number” sounds like your phone broke or you are between plans. It gives them a socially acceptable reason to move on. If you are polite and even a little apologetic, they often waive the requirement.

2. Online: VoIP is the best default

If you are dealing with businesses online, they often force you to enter a number.
For important accounts, you can get up to 9 VoIP numbers using MySudo, where you can receive SMS and calls just like cell numbers (GrapheneOS users will have trouble getting calls in real time, but can receive voice mail fine). You can keep those numbers as long as you keep paying for your plan.

For important numbers, I have different numbers I use for different purposes: Work, friends, shopping, medical, etc.

If you want to generate a new number for every service you use, you can get hundreds of VoIP numbers using Cloaked.com.

I do this for all burner accounts, restaurant reservations, one-time purchases, etc.

VoIP numbers will almost always work. But there are some entities that don’t accept them. Let’s go over what to do in those situations.

3. If VoIP is rejected and the account is not important

If VoIP is rejected and you need a SIM-based number for a low importance account, some people use temporary number rental services.
Smspool.net is one option you can use: You deposit money in your account, and can rent a number cheaply just to receive a one-time code. You can also pay in cryptocurrency, including many privacy coins, which is super convenient.

Some platforms require a number when you first register your account, but afterwards you can go into your settings and change the number to anything, including VoIP. If that’s the case, you can rent a temporary number just for sign up, and then go into your new account and switch the number out.

There are other services that demand SMS verification every time you sign in, and if you lose access to this number you will lose access to your account. If this is the case, you don’t want to put a temporary number.

One tip is to rent a number for at least an hour: This gives you a little more time to see if this account is going to require this number for ongoing identification each time you use the account, and whether you’ll be blocked from your account if you lose access to your number. If you do require ongoing use of a number, you can rent a number long term, but that can get pricey. I recommend a more permanent solution, so let’s talk other options.

4. If you need a number long term: keep a dedicated SIM you control

If you need to provide a SIM-based number on an ongoing basis, you can buy a prepaid SIM. Just make sure that you maintain access to it. That means keeping it active so you do not lose the number, and being sure to top it up when needed. You can also use services like Bitrefill to top up your prepaid SIM.
Then whenever a company insists on a “real” cell number, you have one. But it is not the same number you give to everyone.

Why some providers block VoIP:

As mentioned, sometimes services reject VoIP numbers, and ask for a “real” cell number. This usually happens for one of two reasons:

1. The sender blocks VoIP numbers for KYC reasons.

This isn’t a usually a technical limitation, they do this because SIM-based numbers are generally better to KYC someone. Some banks and websites check whether your number is classified as a cell-based number or a VoIP number, and they simply block you if the number is classified as VoIP. They just don’t like VoIP.

2. The sender blocks VoIP numbers for fear of compatibility issues.

Some VoIP providers don’t support short code delivery. Short codes, like 5 digit verification codes, actually aren’t like normal SMS:

Think of your phone number like a mailbox, and texting like mail delivery. Most texts are “regular mail” that almost any mailbox can receive. But short code texts are more like a special kind of delivery service that uses different routes and rules than regular SMS. Behind the scenes, phone service is not one single thing. Providers turn on different capabilities depending on how a number is set up. Short codes are one of these capabilities you can switch on or off.

With VoIP numbers, the provider that issued the number (and the upstream carrier they route messages through) may simply not support short code routing for that number type. So even if your VoIP number can receive standard texts, it might not be provisioned with the right carrier connectivity to accept short code messages.

Because there’s a chance some VoIP numbers might not work with a company’s messaging system, they might decide to simply block all VoIP numbers.

The Cell to VoIP Trick (with caveats)

Sometimes a company checks your number at registration to confirm it is a cell number, but after that, they never check again. In those cases, one approach is to use a SIM based number initially, then later port that number to a VoIP provider (like MySudo). You will continue to get access to that number, but now it’s cheaper to maintain, and the VoIP number isn’t being logged in any HLR.

But there is a caveat: as mentioned, some VoIP numbers can’t receive short codes. So after a number becomes VoIP, you may stop receiving some verification codes. This is something you have to test. You do not want to be stuck unable to receive SMS codes when you need to log in.

In my experience, most codes reach VoIP numbers.

Maybe 5% of the time, I can’t get codes, but they give me a call option instead, which works just as well.

But occasionally, a specific short code just will not deliver to a particular VoIP setup. If that happens, you may need to try a different VoIP provider, or keep a SIM based number for that specific account.

The bigger point

Data collection today is normalized and invasive. Everyone wants your home address, your phone number, your social accounts, and every identifier that makes it easier to map your life and sell it.

You do not have to make it easy for them.

In the digital era, “just type your number” is treated like a harmless formality.

But it’s not harmless. Every extra identifier makes it easier to map your life.

So let’s stop volunteering this information, and let’s instead make it normal to push back. Where we can, let’s opt to give companies what they need to provide the service, and nothing more.

Yours In Privacy,

Naomi

**As always, this newsletter was not sponsored. These are just tools that I personally use and like. If you have tools that you recommend people try out, let them know in the comments!

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

What’s the best email provider?
What’s the best note-taking app?
What’s the best phone?

The annoying answer is: it depends.

It depends on your threat model (what you’re protecting yourself from), your convenience threshold (how much friction you’ll actually tolerate), and what tradeoffs you’re willing to live with (how much you want to trust a company, how well a tool fits into your life, whether it works smoothly with the people you communicate with, etc.).

Sometimes I share specific tools that I use, in case it gives people ideas or a place to start. But the truth is, there isn’t one perfect stack. Different people have different setups, and that’s a good thing.

So today, I want to share a list of favorite tools from one of our community members, Incognito Cat. It’s a great overview of privacy-respecting alternatives you can swap into your life without feeling like you have to go off the grid. I’ve also added a few editor notes throughout with some other options I like, depending on what you’re optimizing for.

And if you have tools you love, drop them in the comments. The goal is simple: give people a bigger menu of tech that respects you as a user, so you’re not stuck in ecosystems that treat you like a data source.

Guest post by Incognito Cat:

Privacy Toolbox

Just starting your privacy journey or curious what others are using for theirs? This list was first developed in 2024 to get the conversation started and reflects our current Privacy Toolbox.

Is this a comprehensive list of all tool available in each category?
Not even close!

This toolbox represents a solution for the particulars of our use cases, as outlined in the Guiding Principles. And if you’re unfamiliar with what is available to replace the apps that shipped with your desktop or mobile device, this is a great place to start.

We only discuss tools and solutions that we have personal experience with and use on a regular basis. Since privacy is a journey and not a destination, this list has and will continue to evolve with time. The links for each website will be listed next to the tool, where applicable. If a “Privacy Tool Spotlight” is available, going into greater detail about the tool, the link is next to it.

Guiding Principles

• Privacy Forward Alternatives: Solutions that preserve privacy by blocking trackers, data mining, and/or using end-to-end, zero-knowledge encryption.

• Daily Use: I only recommend solutions that I personally use every day.

• Support: If I’m not paying for it, I’m donating to its cause. I’m neither an employee, spokesman, or in any affiliate programs.

• Usability: It should be as easy to use as any mainstream software it’s replacing, encouraging adoption by all. Even my in-laws.

• Cross-Platform: It must run across Windows, MacOS, Linux, iOS, and Android/GrapheneOS where applicable.

• Bonus points: Free and open-source software (FOSS), available on F-Droid, and able to run without Google Play Services.

Keep in mind that...

The best privacy and security results rely on multiple tools working together.

Now to my ever-evolving toolbox:

• Browser:

  • Brave Browser (🔎 Tool Spotlight)

  • Mullvad Browser

(Editor note: Mullvad is only available on desktop. For a good comparison of browser privacy visit Privacy Tests)

• Anonymous Browser:

  • Tor Browser

• Search:

  • Brave Search

  • Startpage (🔎 Tool Spotlight)

• Desktop Browser Extensions:

  • 1Password

  • PrivacyBadger

  • uBlock Origin

(Editor note: having multiple browser extensions installed increases your attack surface, also makes you more easily fingerprintable. I recommend that the only browser extension you install be your password manager)

• Password Manager:

  • 1Password (🔎 Tool Spotlight)

(Editor note: some other good options include Dashlane, Bitwarden, or if you want to store your passwords locally only, KeepassXC — but just be sure to have backups)

• 2FA Authenticator:

• Enteio Auth (🔎 Tool Spotlight)

(Editor note: For Android and GrapheneOS, Aegis is also a good option)

• Hardware 2FA:

  • Yubico YubiKey (Be sure to have two! 🔎 Tool Spotlight)

(Editor note: the Yubico “YubiKey” is a specific model that supports multiple different protocols. The Yubico “Security Key” model is the cheapest option and sufficient for U2F)

• Messenger:

  • Signal Messenger (🔎 Tool Spotlight)

  • Molly (A Signal fork)

  • SimpleX Chat (A decentralized instant messenger that doesn’t depend on any unique identifiers. An effective tool against censorship)

(Editor note: SimpleX is a great decentralized tool, and we have an NBTV community chat on there, but keep in mind that it doesn’t have the same polish as Signal)

• Privacy Ecosystem:

  • Proton: Family Plan that includes the following:

    • VPN:

      ProtonVPN (🔎 Tool Spotlight)

    • Email:

      ProtonMail (🔎 Tool Spotlight)

    • Alias Email Addresses:

      Proton Pass with SimpleLogin

    • Calendar:

      Proton Calendar

    • Cloud Storage:

      Proton Drive

    Note: Proton does offer a useful free tier available to test each service out

(Editor note: I use the collaborative docs and sheets in the Proton ecosystem also. They don’t have quite the same functionality as Google docs and sheets, but they have improved dramatically over the past year and are sufficient for my organization’s needs)

• Alternative Email:

  • Tuta (Free tier available for testing | primary & backup email should be on secure & private services)

(Editor note: Startmail is another E2EE email that you can try)

• Notes:

  • Notesnook (Free tier available for testing | 🔎 Tool Spotlight)

(Editor note: Obsidian is also a useful note-taking app that you can sync privately across devices)

• Photo Storage:

  • Enteio Photos (Free tier available for testing |🔎 Tool Spotlight)

(Editor’s note: I automatically back up my photos to Proton drive with their automated backup feature, and find it simple and easy. My understanding that Ente is also simple, with added functionality for family album sharing.)

• Maps:

  • OpenStreetMap (for desktop)

  • Organic Maps (for mobile | 🔎 Tool Spotlight)

(Editor note: Google Maps is a difficult tool to replace. I like the tools above, but sometime there can be inaccuracies. You can always keep Google maps on a siloed profile on your GrapheneOS device for emergencies)

• Virtual Payments:

  • Privacy.com (Free tier available for testing |🔎 Tool Spotlight)

(Editor note: This is an example of a masked credit card. You need to KYC yourself to privacy.com, but using this service allows you to hide your real name, billing address, and real credit/debit card number from merchants, and it can also help shield where you shop from your bank.)

• VoIP Phone Numbers:

  • Cloaked

(Editor note: I also use MySudo for VoIP numbers)

• Personal Data Removal:

  • Optery (Free tier available for testing | 🔎 Tool Spotlight)

(Editor note: In many cases you have to provide ID to removal services in order to use them. I recommend Michael Bazzel’s free workbook, that shows you how to remove your information yourself)

• Videos:

  • Odysee (🔎 Tool Spotlight)

(Editor note: I encourage people to branch out and use alternatives to YouTube, such as Odysee, to create a network effect elsewhere. If there are videos you can only find on YouTube, you can at least use a more privacy-preserving front-end for YouTube. Invidious is one example of a open-source front-end, and Yewtu.be is one specific Invidious instance. Just keep in mind that you are trusting the instance operator with your searches.)

For my devices:

• Desktop OS:

  • Ubuntu Linux

• Smartphone OS:

  • GrapheneOS (🔎 Tool Spotlight)

• Privacy Keyboard:

  • Futo Keyboard (Free tier available for testing)

• App Store:

  • F-Droid (F-Droid is a free and open-source app store and software repository for Android, but with a focus on free and open-source software [FOSS])

  • Aurora Store (Aurora Store is a privacy-focused alternative to the official Google Play Store application)

• Office Suite:

  • LibreOffice

• Desktop Privacy Utility:

  • Privacy.sexy (A tool to maximize privacy and security settings on Windows, macOS, and Linux. And nothing else. | 🔎 Tool Spotlight)

• Encrypted Portable Storage:

  • Aegis Secure Key (🔎 Tool Spotlight)

• Faraday Phone Sleeve:

  • Mission Darkness Dry Shield Faraday Phone Sleeve. (Make your phone invisible to trackers and hackers | 🔎 Tool Spotlight)

• Privacy Screen Protector:

  • Various. As mobile screens get bigger and brighter, the easier they are for others to read at a distance. (🔎 Tool Spotlight)

• USB Data Blocker:

  • JSAUX USB Data Blocker & USB C Data Blocker. Goes between your device and any unknown cable and/or power source to prevent direct USB attacks, like the O.M.G cable. (🔎 Tool Spotlight)

• Smart Home Automation:

  • Home Assistant (🔎 Tool Spotlight)

  • Voice Controller: Home Assistant Voice Preview Edition

• AI:

  • Ollama (🔎 Tool Spotlight)

• Wikipedia Online Alternative:

  • Kiwix Offline (🔎 Tool Spotlight)

Remember, we may not have anything to hide, but we have everything to protect.

- Incognito Cat

Final editor note: we don’t do show sponsors or have article sponsors. These are simply examples of privacy tools that Incognito Cat or I personally use. If you have suggestions for tools you love, please let everyone know in the comments!

Yours In Privacy,

Naomi

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

You’re probably reading this newsletter because you care about privacy. But caring about privacy doesn’t always mean knowing where to begin. In fact, many people feel overwhelmed when they first start thinking about how to protect themselves.

This newsletter is for you. And for anyone in your life who knows privacy matters, but has been putting off that first step.

We will go over three small things you can change right now that will have a huge impact on your privacy in 2026.

Email

Let’s start with email, because it’s an essential tool in most people’s lives, and is a really easy one to make more private.

Switching email might sound like a massive and intimidating step. But stick with me. The first step to better email privacy is smaller than you think. It is just about getting started.

Statistically speaking, almost everyone reading this probably uses a non-private email provider, like Gmail.

You probably got set up a long time ago, and now you’re just using it out of habit.

What’s wrong with using a non-private provider? Well, let’s look at Gmail in particular. It is absolutely horrible for privacy.

Gmail is scanning and analyzing the contents of every private message. That includes personal conversations, work correspondence, health-related messages, financial information, and everything else that passes through your inbox.

Advertising is, after all, Google’s core business model. In fact, advertising makes up roughly 78 percent of Google’s revenue.

So email is one of the first things I recommend changing, because the impact it has on your privacy is huge.

There are many private email services you could use instead, like Tuta, Startmail, and Proton.

I personally use Proton. One of the reasons Proton is such an easy place to start is that they have a button that allows you to automatically import your entire history of emails into Proton from your existing Gmail account or other major provider.

If you’ve had your old email for decades, you don’t need to immediately abandon it. Just take the first small step: Create a new email address on Proton, at first for free if you’d like, and just get it set up for now.

Your new email account will be waiting for you whenever you’re ready to start using it. And when that time comes, you can slowly transition people over to it. Start responding to emails from your new address and let people know you have a new one.

But the important part is this: take that first step and get the account set up, ready to go.

Messaging

The next thing that is easy to tackle right away this new year is messaging.

Most people still rely heavily on SMS or social media DMs to talk to family, friends, and coworkers. And it’s largely because it’s what everyone else is using.

The problem is that SMS wasn’t designed to be private. In fact, it was specifically designed to be non-private. It runs through telecom infrastructure that’s built for monitoring and interception. Basically every country in the world has lawful intercept regulations. And most social media messaging platforms are tied to advertising business models. They log and analyze every communication to serve better ads, and potentially to sell that data to others.

It’s much better to use a messaging platform that is end-to-end encrypted, which means that the messaging platform itself can’t even read your messages, and that collects as little metadata about users as possible. One option is Signal.

It takes about 30 seconds to set up. Seriously. You download the app, confirm the number you want attached, and you’re good to go.

What surprises most people when they install Signal is how many of their contacts are already there. Estimates put Signal at around 70 to 100 million users, so it’s much more likely than people expect that they’ll already know people on the platform.

Everyone I’ve helped sign up already had a long list of people using it.

To find these people, click “compose,” and Signal will show you all your contacts who are already on the platform.

Once again, you don’t need to entirely switch to Signal overnight, or even convince all your friends to move there. But you can immediately start talking with all your contacts who are already there. If you simply choose Signal whenever it’s an option, you’re already taking a huge step to improve your privacy.

But your impact goes even further than just protecting your own privacy. Think about it: those contacts of yours who are already on Signal are probably there because they care about privacy too. So every time you opt to talk with them via Signal instead of another platform, you’re also helping them protect their own privacy.

You’re protecting both of you.

And each message you send or receive is data that you’re not feeding to telecom companies, advertising systems, and governments.

Browser

The third easy place to start this new year is your browser.

And this might be the easiest step of all.

Your browser is the main gateway between you and the internet. It sees where you go, what you search for, and how you interact with websites. It reveals your innermost preferences, interests, and opinions. So the choice of browser matters a lot more than people realize.

About 70 percent of the world uses Google Chrome, which is horrendous for privacy.

Chrome gives Google deep visibility into your online activity. Chrome also still allows third-party cookies by default, while every other mainstream option has blocked them for years. Google spent years promising the world they’d eventually block third-party cookies in Chrome. Then they kept delaying, and eventually reversed the decision completely, because third-party cookies are central to their advertising business.

Switching browsers is a really simple shift. You just download a new browser and start using it.

I personally like to use Brave, because out of the box it has really strong privacy defaults.

If you want to compare privacy on some of the most popular browser options to choose one you’d prefer, privacytests.org provides a great comparison.

It’s also super easy to import your bookmarks, if you’re worried about leaving those behind. In Chrome, you click “export bookmarks” in your bookmark manager, and in Brave you click “import bookmarks” in your bookmark manager.

You can even import your saved passwords if you want, by going to password settings and selecting the password file to import. Although I recommend you use a dedicated password manager instead of saving passwords in your browser anyway.

Brave blocks trackers by default, protects against bounce tracking, reduces fingerprinting, and warns you before you load a lot of known malicious sites, without you having to install a bunch of extensions.

It’s a really solid choice that will immediately beef your privacy this new year.

2026 Is the Year of Privacy

There are many reasons why you might have decided to improve your privacy this new year.

Maybe it was because of a data breach. Or a headline about governments buying all your data, including location data. Or perhaps it was just the slow realization that almost everything digital now comes with constant monitoring baked in, and you have no control over who will eventually get access to that data.

When people start thinking about privacy, they often assume the solution is extreme. But luckily, this isn’t true.

The three steps we’ve talked about are really easy ways to get started in the new year. And even if these are the only things you change for the whole year, the impact on your day-to-day privacy will be huge.

If you’re just starting your privacy journey, there’s no need to feel overwhelmed or think that you have to do everything at once. Just choose something from this list, email, messaging, or browser, and make a change today.

Happy New Year everyone!
This is the year we get serious about the fight for privacy.

Naomi

Reminder: we don’t do show sponsors or have article sponsors. These are simply examples of privacy tools that I personally use. If you have suggestions for tools you love, please let everyone know in the comments!

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

This week, Keonne Rodriguez went to prison.
I’m still processing the reality of what that means.
Because he didn’t go to prison for stealing money. Or hacking a bank. Or running a cartel.

He went to prison because he built a privacy tool.

Maybe you feel like you’re just a normal person who doesn’t need privacy right now, because, “what have you got to hide?” And if you ever need privacy in the future, like if a bad government or powerful group starts targeting people like you, then you can just start protecting your privacy then. When you actually need it.

...Right?

Actually, no.
In the future, privacy might not be possible anymore.

Because right now, people all over the world who are building the very privacy tools you might one day depend on are being arrested and thrown in jail. Governments are smearing the very right to privacy, arguing that innocent people don’t need it. That privacy is only for criminals.

There is a war on privacy currently going on. And if you don’t want your children to grow up in a world where privacy has disappeared, you need to start paying attention. Now. Before it’s too late.

I interviewed Keonne right before he went to jail, to hear his story. And now I want as many people as possible to hear his story too.

The Privacy Developer

“My name is Keonne Rodriguez, and I developed and co-founded Samourai Wallet.”

Keonne’s story goes all the way back to when he got his first computer, “when I was probably 10 or 11 years old. I was hooked on creating websites for things I was passionate about. So I’ve always loved computers, and loved the web.”

He dropped out of high school at 16 and pursued a career with computers. He was good at it. Keonne’s bread and butter was user-facing websites. That’s how he paid his bills. At one point I asked him what kinds of websites he was building as a kid.
He laughed.

“It’s a little embarrassing… I had recently gone on a trip to the Italian Alps. In the Italian Alps, they’re really into gnomes, little fantasy gnomes. I thought they were really cool. And I decided to build a website. The first website I built was a website about all the different subspecies of gnomes.”

And then he started building real projects. He built the website for the Miami Beach chapter of the United States Lifesaving Association. He built the web presence for a Thai artist who was huge in Thailand and trying to break it in the US. Computers weren’t just a skill for him. A big reason that he loved computers was the social aspect:

“I didn’t have a lot of friends in person at school… but I had a lot of people online in chat rooms who were my friends.”

Computers became his biggest passion.
Until one day, he got a new passion.

Bitcoin: Censorship-Resistant Money

“I had been hearing about Bitcoin off and on from probably around 2010. But I didn’t quite get it yet.”

At the time, a currency on the internet sounded absurd.

“It’s such a foreign concept that you can have a type of currency or money on the internet. This intangible currency, like, I can’t hold it. How’s that gonna work? There’s just a bunch of uncertainty there.”

But at the time, there was also a LOT of uncertainty about the TRADITIONAL financial system.

By this time, Keonne says he knew “there was something wrong with our financial system. I wasn’t an Occupy Wall Street person, but I knew they were onto something too.”

He watched the Great Recession hit. He watched bailouts. He watched regular people get crushed while the biggest players got rescued. And he thought:

“There has to be an alternative to what is known as the fiat system, right? Fiat means by decree, so the government decrees this currency into existence. Surely there has to be something better.”

That’s how he got into gold and silver, and it’s in those circles that he first heard Bitcoin being discussed.

“But I still didn’t quite get it. I didn’t understand.”

But between 2010 and 2013 came 2 major moments that made him understand the value proposition of Bitcoin.

It was around the time that the Greek economy exploded, and the run-on effects for neighboring Cyprus were severe.

“Authorities started dipping into people’s bank accounts and, and confiscating their savings. That was pretty shocking. At first I thought ‘you can’t do that with gold’. And then I realized they did exactly that with gold.”

In 1933, during the Depression, the US government made private ownership of monetary gold effectively illegal and forced conversion into dollars, seizing these gold assets to make it easier for them to devalue the dollar and print money.

Keonne wanted to see a money that couldn’t be seized. That way if a reckless government went bankrupt, they couldn’t destroy the lives of everyday citizens by stealing their money.

“I started to think, okay, maybe there is something to this Bitcoin thing.”

The other major catalyst event for Keonne was WikiLeaks.

Around the world, governments pressured payment providers to block payments to WikiLeaks.

“The government didn’t overtly say, oh, you can’t donate to WikiLeaks. Right? Because that would be unconstitutional. But they didn’t, they didn’t need to. The corporations did it for them. And that to me was unbelievable. Those are two massive corporations telling you what you can spend your, your money on.”

Whether you like WikiLeaks or not, allowing governments to decide which political causes, or media publications, or charities you are and aren’t allowed to donate to is dangerous. And it almost destroyed WikiLeaks.

So WikiLeaks started to accept donations in Bitcoin.

“That sealed the deal for me. I needed a way to be able to donate to the causes I wanted to donate to electronically without anyone in between saying I couldn’t. And when I figured that part of the equation out, I realized ‘Oh, that’s what it’s for. It’s for making those types of payments.’”

They call it uncensorable money, because it’s decentralized. The protocol lives on thousands of computers all over the world. You could ban it, but in order to enforce the ban you’d need to stop every single one of these thousands of computers from running it. Otherwise, the network will just keep going.

“No one can stop me from sending a transaction. That’s powerful. That’s tantamount to free speech. How you transact is speech. At that point, I got it. And I was hooked. I realized that I wanted to go all in on Bitcoin.”

He got a job working full time in Bitcoin and being paid in Bitcoin, at Blockchain.info, the largest Bitcoin wallet in the world at that time. He was employee number eight. That’s where he met William Lonergan Hill.

Bill and Keonne both agreed that this technology could really enhance human freedom, and they wanted to do everything they could to build that out.

But if you wanted Bitcoin to actually protect people, it was missing a key component:
Privacy.

Bitcoin Isn’t Anonymous

“Bitcoin is a pseudonym system. It’s not an anonymous system.”

While censorship-resistant tech is powerful, if you can’t use it privately, the state can still just target you and shut you down. If we want decentralized systems to stay censorship resistant in the real world, we need the ability to use them privately. Keonne realized almost immediately that in order for decentralized technology to be effective, it needs privacy.

“Everything that happens on Bitcoin is public. If I make a transaction, it’s publicly recorded to what’s called the blockchain.”

The amount is public. The “from” and “to” are public.
It does not show your name, but it does show your Bitcoin address.
And once your identity gets linked to that address, the entire history becomes traceable. Your entire net worth becomes visible. What you spend your money on can be tracked.

In traditional finance, this lack of privacy would be unthinkable.

“If I went to Starbucks and bought a latte and handed the barista my card, and when I paid, she was able to see all my past transactions and will be able to see all future transactions and know my net worth… we would say that’s insane.”

It’s not just insane. It’s dangerous.

In 2025, what’s known as “wrench attacks” surged by 90%. This is where criminal gangs and organized cartels visit the homes of crypto users to steal their crypto. How do they know who uses Bitcoin? Because websites, including exchanges, get hacked all the time, and these breaches expose the personal details of everyone using the platform.

“All of the attacker needs is to look on the public blockchain, see the Bitcoin addresses that were exposed, and figure out which name is a worthwhile target. There’s very little that anyone can do to stop it. So privacy is essential. Remember we had been accepting Bitcoin for our salary for three years now, right? We had a legitimate need for financial privacy at this point.

The internet had the potential to be this bastion of freedom… and it turned out to be a pretty big panopticon. And it’s the same thing with Bitcoin. If we’re not vigilant and careful, this technology that could be a bastion of freedom can turn into a surveillance hellscape.”

By 2015, Bill and Keonne saw that this was a major problem, and that’s why they decided to build Samourai Wallet, to give people the essential privacy that Bitcoin was lacking.

Samourai: The Privacy Wallet

The goal of Samourai was to “introduce so much uncertainty and doubt into a Bitcoin transaction that an observer who’s looking at it publicly really can’t make heads or tails of it.”

But it didn’t work like old-school “mixers” where you hand your money to a service and hope it comes back. Instead, Samourai was a noncustodial wallet, meaning the user always retained custody of their own funds.

“I can’t steal your Bitcoin.”

It used collaborative transactions, where multiple people participate in a joint transaction so the output is hard to untangle, and the history of the coins becomes all jumbled up.

“It starts at an address they control, and it ends at an address they control. It really wasn’t super technical. You didn’t have to be in the weeds on Bitcoin to use it. You just pressed a few buttons. It automatically routed through Tor. It automatically did best practices.

First and foremost we built Samourai Wallet for us, for Bill and myself. We needed it. And no one else was building it. And it just so happens that what we needed, a lot of other people needed as well.”

This tool was used by people all over the world, including people who needed privacy to survive. He told me about an active user in Iran, who became one of Samourai’s biggest ambassadors:

“A legitimate user in a theocratic authoritarian regime who made use of the privacy software that we created. I know that it helped people in repressive regimes. I know that it helped people who would be considered dissidents by their governments. And I’m proud of that.

It was a pretty effective tool. And quite frankly, I’m really proud that we were able to release that technology and open source it, and that it still exists today.”

This was the highest point of Keonne’s life. He was building super important software. Contributing to a cause that’s deeply important to him. People are using this tool, and it’s saving lives.

“I couldn’t think of anything else I would rather be doing.”

Then on April 24th, 2024 at 5:00 AM, everything changed.

The Arrest

Keonne woke up because his dog was barking.

“There were 40, 50, maybe more... armed FBI agents surrounding my house.”

His voice cracks, and it becomes hard for him to continue.

“They got on the megaphone, said, ‘Keonne Rodriguez, come out with your hands up, you’re under arrest.’”

Armored vehicles. Drones. Firearms.

“In the face of such an overwhelming force, you have to comply.”

He walked out, hands up.
His wife walked out, hands up.
He was arrested. Put in the back of a squad car.

“And from that point, information was scarce. They don’t talk to you.”

He sat there for hours while they searched his home. All he could think was: “Are they arresting my wife? She didn’t do anything. Is my dog OK? My cat is going to get out because they left the door open. I hope she can get back in.”

He didn’t know why they were there.

“It could only be related to Samourai Wallet because I didn’t do anything else. I didn’t run a drug empire. I didn’t really ever go out much. All I did was work on Samourai Wallet.”

He doesn’t know how much time passed, but eventually he was taken to the FBI field office. Fingerprints. DNA. Then jail at the courthouse to wait for a judge.
And finally, a public defender showed him the indictment.
That’s when he heard the charges for the first time.

The Charges

“Conspiracy to commit money laundering.”
“Conspiracy to operate an unlicensed money service business.”

Keonne was stunned.

“How could I launder someone’s money? I never had access to anyone’s money.”

His defender explained to him that it’s a conspiracy charge, and they really didn’t need much to charge him with this on a conspiracy charge.

“If I would’ve been charged with money laundering proper, they would’ve needed to provide the person I laundered money for. And prove that I had an agreement to launder money, show the amount that was laundered, and show what the criminal did with it. But that person doesn’t exist.”

He never conspired with anyone to launder money. So instead of proving he laundered money for someone, the government argued that he created software money launderers could use, and that the only reason he created it was to launder money.

“That’s how they truly saw it, that there was no legitimate reason for this software.”

I asked in disbelief: “No legitimate reason for privacy?”

“Yes,” he responded. “It’s absolutely shocking how hostile to basic privacy the United States Attorney’s Office is. Prosecutors see privacy as a stumbling block to their mission.”

And when it came time to “prove” his intent?

“All of the government’s evidence against me… comes down to tweets. Lots of jokes, lots of stuff that they took outta context.”

Any time a government did something that Keonne viewed as authoritarian, he’d tweet about it and welcome users to Samourai. For example, when the Federal Reserve banned its users from trading Bitcoin: “Welcome new Federal Reserve employee Samourai Wallet users.” When Kuwait did something similar: “Welcome new Kuwaiti Samourai Wallet users.” And when Russia was sanctioned: “Welcome new Russians, Samourai Wallet, Russian oligarch users...”

“And boy did the US Attorney’s Office go crazy about that one. They saw that and said ‘he’s advertising to Russian oligarchs. That’s his intent. That’s criminal intent. We got him.’”

Keonne says it was obviously a joke:
If he were really advertising to oligarchs, would he be doing it publicly on Twitter in English?
But that didn’t matter. They used it anyway.

Keonne thought that he was safe tweeting jokes. He thought he would be protected by settled law. Because courts have repeatedly held that you need more than generalized knowledge that criminals might use a tool. Criminals might use ANY tool. To be guilty under a conspiracy charge, you have to be part of the crime.

There’s case law going back to 1940, US v Falcone.

“A sugar distributor was charged with a conspiracy charge because he sold his sugar to a bootlegger who was making illegal alcohol during Prohibition. The judges threw it out and said, there needs to be more than just knowledge of a criminal act. He has to be part of the, the crime.”

There was another case in the 90s where a grow light manufacturer was arrested and charged with a conspiracy charge because he sold to a marijuana dealer.

“They even took out an advertisement in High Times Magazine, which is a marijuana enthusiast magazine. And God forbid they made a joke! They said ‘I don’t even want to know what you’re gonna use this light for!’ That conviction got overturned on appeal because of the same concept. You have to have more than just a vague knowledge of the crime. You need to be part of the crime.

There was a congressman out of Ohio, Warren Davidson, who had a great analogy about this case. He said, ‘it’s like prosecuting Microsoft because drug dealers make use of Excel’.”

So case law and a Supreme Court precedent was on their side. Just knowing that what they built COULD be used by some people for crimes isn’t a crime itself.

“So I was pretty confident. I mean, a Supreme Court precedent, the highest court in the land, that’s pretty strong.”

But it was the second charge where things got even crazier.

FinCEN Said It Wasn’t Illegal

“There’s something called the Brady Rule in US Criminal Procedure. And that rule says that the government has to turn over any evidence that is exculpatory, meaning if they have evidence that says maybe you didn’t commit this crime, they have to give that to you.”

In Keonne’s case, they hid exculpatory evidence from him for over a year, and only turned it over when Keonne’s team asked specifically if this evidence existed.

“A year before the prosecution, they reached out to FinCEN, the Financial Crime Enforcement Network, the regulator in charge of money transmission and preventing money laundering. And they ask the regulator, is Samourai Wallet a financial institution? And FINCEN says, ‘Under our rules, they would not be considered a financial institution or a money transmitter because they don’t take custody of anyone’s funds.’”

FinCEN had rules in 2013 and 2019 where they reiterated this.

“The Southern District of New York hid that information from us, and indicted us anyway on unlicensed money transmission.”

They said that a North Korean hacking group, called Lazarus, used Samourai to launder funds.

“And to further that they claim that we had a duty to perform KYC and AML to prevent that from happening.”

KYC and AML stand for know your customer and anti money laundering, and they’re laws that were formalized under the Patriot Act, saying that financial institutions and money transmitters have to get identity documents from customers, and prove their identity.

“We had no obligation to do that because we’re non-custodial piece of software. We’re not a bank, we’re not a financial institution. We don’t have those same obligations that a financial institution has. And that’s why I took the really, the whole industry by surprise, that a non-custodial piece of software was being targeted this way and, and prosecuted this way.”

So the Southern District of New York that prosecuted Keonne argued Samourai had obligations to do things that money transmitters do, even though the regulator in charge of regulating money transmitters said Samourai wasn’t a money transmitter, and didn’t have those obligations.

And the Southern District argued that Samourai, as part of a conspiracy charge, were liable for what people who used their tool did, even though case law and Supreme Court precedents say otherwise.

Keonne explained that once the government decides it wants you, the system becomes its own weapon.

“Getting an indictment is so easy. The deck is so stacked against a criminal defendant. The whole process has been so absolutely eye-opening to me. I knew that we had a messed up justice system. Everyone kind of knows that, but you don’t really know it until you’re face-to-face with the Department of Justice. Then you read the indictment and you’re like, ‘Hey, this is a bald face lie. They produce this chat log, but they cut off the first part and the last part where there’s all the context, and they’re spinning it another way when they know what it actually says. Why would they lie?’

It’s not like the truth will come out in front of the jury, and the jury will make the right decision based on all of the evidence. That’s not how it goes.”

The Judge

Keonne and his team prepared a motion to dismiss. Based on the FinCEN guidance and the court precedents, they had a really strong case, and the judge was someone that they thought might give a reasonable opinion on this.

“Then, suddenly out of nowhere, we get a new judge for no reason. And the new judge was a pretty bad pick for us.”

So along comes the day when they’re meant to appear in court and present their arguments. His lawyer was meant to get up and make his arguments. And the government was meant to then get up and say why they disagreed. But that’s not what happened.

“When that day came, she didn’t let us argue. She just said, no. She just denied the motion. And didn’t give any reasoning, didn’t write an opinion, didn’t verbally state an opinion. Just denied it on its face. And at that point, I think I realized, ‘oh, this is not going to be fair.’”

And he explained why that matters.

“It’s really up to the judge what the jury gets to hear. So the jury’s gonna hear all of the things I said on Twitter about welcoming Russian oligarchs. But they’re not gonna be able to hear any of the 10 years worth of podcasts and interviews that I’ve done where I talk about why I built Samourai Wallet. They’re only gonna get to hear certain things. This is like walking into a fight with both hands tied behind our back. And if we lose, we’re getting 25 years, we’re going away for the majority of my life. And Bill is 67 years old. It is not gonna be good for him in there.

So they offered us a deal.”

The Deal

They would drop money laundering (the 20-year charge) if he pled to unlicensed money transmission. Which, Keonne says, they knew FinCEN did not think applied.
But “no one cares. That’s what the deal’s gonna be.”

Keonne and Bill faced two paths.

1. Plea deal, for 5 years in prison.

2. Go to trial and fight.

5 years is a crazy amount of time to spend in jail, especially when you’re confident you didn’t do anything wrong.

But the trial was a huge risk. Even with the FinCEN guidance in their favor, they would face 25 years in prison if they lost. But on top of that, the Southern District of New York escalated the pressure, layering on additional threats and consequences if they chose to fight.

“They threatened us a number of ways to take the deal.”

They would add a $237 million money judgment against them along with the 25 years in prison. So when he got out in 25 years, he’d spend the rest of his life paying off that debt.

“And until you pay that, you’re basically on house arrest. You can’t travel, you can’t leave the country. You have to check in all the time. That earns interest until it’s paid off. So they’re basically saying, ‘you’re gonna be in prison for life if you don’t take this deal.’”

By then, the process had already destroyed them financially. They already paid 6.4 million. They were now 2.5 million in debt, and unable to pay their lawyers. It would have cost another 4 million just to get to trial. They simply didn’t have the money.

“You’re going against something that just has unlimited resources, unlimited man hours, and can throw everything they have at you. You don’t have that capability.”

So they took the deal.

“This judge was ready to put me away for a lot longer than five years. If she was able to, she would have, without question.”

And then there was an additional $250,000 that the judge added as a fine at his sentencing.

“She didn’t need to throw an additional $250,000 fine on top of the 6.4 million we had already forfeited. She knew full well that I didn’t have that money. But she did.”

It’s been just one turn of the screw after another.

The Final Knife Twist

So when did Keonne go away? This was another messed up situation.

“So after the sentencing, my lawyer stood up and said ‘We would like Keonne to be able to self-surrender, and the government agrees.’ Then the government got up and said, yes, your Honor, we agree.”

What self-surrender usually means is that you’ll go home with your family, and wait for a Bureau of Prisons designation letter. This can take four to eight weeks. But once the letter arrives, you don’t go to prison right away. The date on the letter might be months in the future. So in those intervening months, Keonne was meant to have been sent home to his family.

Instead, the judge set a hard deadline to self-surrender:
December 19th.
No final Christmas with his family.
So on December 19th, Keonne was locked up in the Metropolitan Detention Center in Brooklyn, where he’ll likely wait months to be assigned to a prison.

The MDC has notoriously bad conditions.

“There are certain judges in the Southern District of New York who refuse to send people to that jail because of how bad it is. My judge is not one of them. She was quite happy to send me there.”

Keonne added: “It seemed very personal to her. I’ve never really seen a sentencing like that where she was so hostile… she really had it in for me.”

Keonne was able to spend Thanksgiving with his family before being locked up.

“At least we had one final holiday together.”

The War On Privacy Developers

There’s a concept in criminal justice, where the process itself is the punishment. Long before a verdict, the system can drain your money, your time, your health, and your reputation.

Scholars like Malcolm M. Feeley have written about it, and Kafka also explored how procedure, uncertainty, and institutional power can become the punishment itself.

That matters for privacy. Because privacy is not a crime. But if governments want to crush privacy anyway, they don’t have to ban it or even win at trial. They can target the builders of privacy tools and let the machinery do the damage.

This is the case with Ola Bini, a well-known privacy rights activist living in Ecuador.
The government didn’t need to prove a real crime to ruin his life. They arrested him and kept him trapped inside an endless legal process. For years he has been unable to leave the country, forced to check in with prosecutors, cut off from normal banking, and living under constant surveillance. His crime? They couldn’t find any crime, so they focused on his use of privacy tools such as encrypting his devices and using Tor as evidence that he must have been attempting to hack things. The way they saw it, if you protect people from surveillance, you must be dangerous.

There’s an entire war being waged against all kinds of privacy developers right now, with a wave of arrests. Roman Storm, Roman Seminov, Roman Sterlingoff, Keonne and Bill, Ola, so many more. Not enough people even know this is going on.

This is how the war on privacy works in practice. You don’t outlaw privacy outright. You target the people who build it, and the message becomes clear: build tools that help ordinary people protect their privacy, and you may spend years fighting for your life in court, regardless of how the case ends. It creates a chilling effect, and the intent is that eventually people become too scared to build privacy tools.

“If you do anything that they perceive as undermining their power, they will come after you with an iron fist and put a stop to it.”

So in that future scenario, when you feel you’ll eventually need privacy, and you’ll just start using privacy tools then? Those tools might no longer exist, because no one is building them anymore.

We’re seeing a wave of criminalizing people in the privacy space. Not for crimes that people have actually committed. Instead, because of a fundamental disagreement over whether or not privacy is a legitimate right for ordinary people.

“The next person who has the audacity to create a tool that is useful and gives individuals the privacy they actually have a right to, they’ll go after hard.

It’s possible we may lose the ability to have privacy forever. Governments are centralizing control over our digital lives, surveilling every single thing, having more access to deep personal insights about every innocent person on the planet than ever before. This is terrifying, because without privacy, we can’t have human dignity.

How We Win The War

Keonne said it comes down to “small acts of resistance.”
Small enclaves of people who understand what’s at stake. Who continue to use privacy tools, even when it’s dangerous to do so. Who continue to build privacy tools, especially when it’s dangerous to do so. Because that’s when people need them the most.

And right now, those people do exist.

“All of our code was open source and freely available for anyone to take and do what they wanted to with.”

Within a month of their arrest, Keonne says a group took their code and redeployed Whirlpool again.

“It’s called Ashigaru.”

And the only difference is that it only runs over Tor, and the people running it are not advertising it. They are not on social media. They are not on Telegram.

“You just have to kind of learn about it and get it. That’s wonderful. And I salute and applaud those people.”

But we need to protect these builders of privacy tools, and support them. Because we need them.

Let’s not feel overwhelmed and think that small acts can’t make a difference. Small acts can change the course of history. As long as there are small acts of defiance we can take to maintain the normalcy of privacy, such as using any privacy tools that we can, we have a chance of writing a future where our children still have the option of privacy and freedom.

These small acts can actually make a huge difference. And may mean the difference between us hurtling towards a surveillance dystopia, and us actually writing a future where we still have the option of privacy and freedom.

“It’s like guerrilla warfare against a severely overpowered opponent. If you have enough of those small acts, you can win against an opponent who is completely and utterly stronger than you.”

I told Keonne that I was so sorry this happened. And that I think we should all be outraged. When you can twist the law in such a way that you can make anyone a criminal by taking things out of context, it makes us realize that none of us are safe.

I also told Keonne as we parted that I hope his story unsettles people enough that they really start to think differently about the importance of privacy and what’s currently at stake, and that they better understand the war against privacy that’s currently going on.

Help Keonne and Bill

If you’d like to sign a petition to have Keonne and Bill pardoned, or to donate to help them, visit billandkeonne.org.

As 2025 comes to a close, consider doing something that stands up for privacy.
Your help may make the difference between whether we keep privacy alive for future generations.

Yours In Privacy,
Naomi

Big thank you to Gabriel Custodiet for introducing me to Keonne and encouraging me to set up the interview.

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

Somewhere between the rise of online banking, social media, streaming apps, and the explosion of AI, we quietly sleep-walked into a world that looks uncomfortably close to 1984.

Not because of a single authoritarian regime, but because we built, piece by piece, a surveillance ecosystem so comprehensive that no dystopian novelist could have designed it better.

And the wild part?

We did it unintentionally. We even agreed to it, one signup form at a time.

We’re now living in what I’d call the KYC Era: the Know Your Customer era. Or, more honestly, the Surveillance Era.

The KYC Era: How We Got Here Without Noticing

Today, every business, platform, and digital service demands a staggering amount of personal information.

It starts when you sign up, and it accelerates with cookies, pixels, device fingerprints, and a shadow economy of cross-site tracking.

Most of us have accounts on hundreds of services.

Together, they know:

• Your name, date of birth, home address

• Your SSN

• Everything you buy

• Where you physically go

• What you search, read, like, and think

• And by linking your Reddit, X, Instagram, and browsing patterns… even who you are

This isn’t paranoia. This is the business model of the modern internet.

And then come the hacks - massive ones, constant ones.

Your credit card numbers, passwords, home address, and identity data have likely been leaked many times over. Not hypothetically - mathematically almost certain.

We’ve built a world where your sensitive information is both everywhere and nowhere secure.

So the real questions are:

Why do these companies need all this information in the first place?

Why does Apple need my date of birth, phone number, home address, and credit card info just so I can watch a movie?

Why does a random new AI model need me to create an account and subscribe to a monthly plan just to run a single prompt?

Why do we trust them to store it securely?

They’ve proven over and over that they can’t.

Why can’t we just interact with a service—pay, access, use—without a signup wall?

Imagine how much faster innovation would move if “Try now” didn’t always mean “hand over your identity.”

Even solutions like X402 address payments, but they intensify traceability. The surveillance problem remains intact - sometimes amplified.

AI Is About to Make This Much Worse

All this scattered, duplicated personal data used to be difficult to assemble.

Not anymore.

AI collapses the cost of correlation.

Anyone - from a marketer to a state actor to a criminal who gets access to your data from the dark web - can query:

• “Where does person x shop most often?”

• “What sites does he/she log into daily?”

• “Where does he spend time on weekdays?”

• “Where does person x live?”

This is no longer a sci-fi threat model.

And ironically, Web3 as it exists today can make this problem even worse - public ledgers create a behavioral and financial breadcrumb trail that AI can plug into with ease.

We have accidentally built an extreme surveillance system.

A KYC-first, privacy-last digital society.

And unless we deliberately change course, the next decade will look exponentially more invasive than the last.

Introducing the DKYC Era: Don’t Know Your Customer

If the KYC Era was about collecting everything,

the DKYC Era is about collecting only what is absolutely necessary—nothing more.

In a DKYC digital world:

• You can pay for a service without handing over your identity.

• You can access an app without signing up for a massive data suck.

• You can prove your age (“I am over 21”) without revealing your date of birth.

• You can prove you live in the right region without exposing your full address.

Zero-knowledge proofs are already capable of this. They let you prove facts without surrendering personal information.

If I buy a service, it should not require:

• My address (unless shipping something)

• My SSN

• My bank balance

• My full purchase history

• My behavioral data

The DKYC philosophy is simple:

Reveal only what is necessary for the transaction. Nothing more.

This isn’t anti-regulation.

It’s pro-safety, pro-innovation, and pro-human dignity.

What Happens If We Don’t Fix This?

If we stay in the KYC Era, the consequences are obvious and accelerating:

• Bad actors, corporations, and governments will possess absurd amounts of AI-queryable personal data.

• Hacks will grow, because the honeypots of stored data will grow.

• Targeted scams, identity theft, and physical-world safety risks will continue to worsen dramatically using AI.

• Banks and financial systems will lock people out more aggressively as AI risk models tighten.

• Innovation will stagnate, because the friction of signing up for new apps chokes experimentation.

We are already in a society where using any new service puts more and more information out there and feels cumbersome.

That’s how you kill creativity, exploration, and economic velocity.

But…

If We Shift to DKYC, We Unlock the Next Era of the Internet

Imagine:

• Fast, private payments/micropayments

• Freedom to use hundreds or thousands of single use services (no monthly lock in)

• No sign-up walls

• No massive data trails

• No duplicated identity records vulnerable to hacks

• No universal tracking footprint for AI to harvest

A world where humans can interact digitally without sacrificing their personal safety or identity every few minutes.

That’s the transition we need:

from the KYC / Surveillance / 1984 Era → to the DKYC Era.

An internet where we get all the benefits of digital convenience without handing over our entire lives every time we click “Sign up.”

Yours in privacy,
Justin Giudici

You can follow Justin here.

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

But they forget about all the employees inside the company, actively sending data out to third parties through their browser, emails, text messages, and AI chatbots.

Before we go any further, a quick note: today is Giving Tuesday. If this newsletter helps you protect your privacy, please consider supporting the free educational work we do with a donation to our non-profit. Ludlow Institute is community-funded, and your support directly pays for investigations, tutorials, and resources like this one. Many employers will match your contribution, which doubles your impact. Thank you so much for helping us keep independent, privacy-focused education available to everyone, and for spreading the word.

Donate

The landscape has shifted. We need to think just as much about what the company is voluntarily sharing with others as what might be involuntarily leaked in a hack. And we have to remember that every piece of data we hand to a third party is now sitting in someone else’s system, subject to their security bugs, their subpoenas, and their insider threats.

The new defensive mindset is simple:
Protect yourself by being more selective about what you share in the first place.

At your company, you can no longer operate on a “good faith” assumption that you can pour sensitive company data into every third-party tool and they will protect it. Instead, you need to protect yourself with more selective and judicious disclosures: share less, choose privacy-focused companies wherever possible, encrypt what remains. That is how you shrink the blast radius when defenses fail or access is compelled. And they basically all fail, eventually.

The mindset shift the modern company needs to adopt is one where it becomes second nature for employees to notice unneeded data sitting in centralized clouds; chat logs that never expire and can be taken out of context; microphone permissions no one reviewed that trigger embarrassment and retaliation; browser extensions with god-mode privileges leaking protected IP; or staff piping sensitive queries into an AI service that is later subpoenaed, turning those prompts into part of the public record.

The data your employees are sending out to countless entities is a huge liability, and it puts the security of your entire organization at risk. It’s up to you to get them to “think different.”

In this newsletter I am going to walk through a handful of company privacy best practices that focus on a neglected side of risk: data leaking out from the inside. Keep in mind that the examples of specific tools I have provided are just some of the things that I use at my company. If you have tools that you like and would recommend to others, please let everyone know in the comments.

1. Browsing

Let’s start with the lowest-hanging fruit.
The browser and search engine that your employees use can leak a huge amount of sensitive company data, quietly stored on third-party servers. Luckily, these are the easiest to switch out.

Lock down the browser

• Use a privacy-respecting browser that locks down your settings by default.

• Set a default search engine that minimizes logging and profiling.

• Audit extensions regularly. Browser extensions are a huge attack vector and should never be installed unless approved by your company’s security team. Installing an unvetted browser extension is the equivalent of clicking on random links or downloading random software onto your machine. In my opinion, the only extension most users should have is a password manager from a trusted provider (details in a later section).

Some private, usable options:

Browser
I personally like the Brave browser. By default it blocks third-party ads, trackers, fingerprinting, and other data collection through its Shields feature.
If you would like to compare Brave’s privacy protections to other browsers, I recommend PrivacyTests.org.

Search engine
The search engine built into Brave is Brave Search, which is designed not to collect personal information about you, your device, or your searches, and not to use your queries to build behavioral profiles.

Other search engines you could consider include:

• Startpage, which acts as a privacy-preserving front end to Google’s search results.

• DuckDuckGo, which has better privacy protections than Google and a strict no-profile policy.

I recommend setting a hardened, privacy-respecting browser and search engine such as Brave as your company default in your policies, then enforcing that choice through your device management.

2. AI

This is the big new leak that almost no one is prepared for. Employees are pasting contracts, product roadmaps, unreleased code, HR issues, financials, and customer data into AI chatbots because it helps them work faster. For the individual, this feels productive. For the company, it can be catastrophic.

Your company can absolutely still use AI. The key is to mitigate leaks by choosing more privacy-focused options and setting clear rules.

Treat the major AI platforms like a sensitive database. Assume every query can be stored indefinitely in a permanent log that can later be accessed through legal process, insider abuse, or a breach.

Advice:

a. Set a no-go policy
Write a short, clear policy that spells out what must never go into any external AI. Make this explicit and simple.

Example “never” list for public cloud AIs:

• Real names

• PII such as email addresses, home addresses, phone numbers

• Company financials and donor information

• Customer data, support tickets, internal HR issues

• Credentials, API keys, or passwords (these should never go into any tool)

b. Provide employees with access to more private options

Employees want to use AI. If you do not give them safe options, they will use unsafe ones. Provide access to more private alternatives and be clear about what information can go where. A simple tiered list helps.

Least private:
Cloud-hosted, account-based platforms
Examples: ChatGPT, Claude, Perplexity, Gemini, etc.

• Do not:

  • Put real names, home addresses, email addresses, phone numbers

  • Add company financials, donor information, or customer data

  • Paste SSNs, passwords, API keys, or other secrets

• Do:

  • Use these tools only for things you would be comfortable posting publicly on social media

  • Assume the content could be accessed without your knowledge and might one day be part of a legal process or a breach

  • Ask yourself: “Would this embarrass me or the company, or put clients, donors, or staff at risk if it were released out of context?” If yes, do not paste it here

Middle ground:
Privacy-focused cloud AI
Examples: Brave’s Leo, Venice.ai, NanoGPT.

These are cloud-hosted, but with stronger privacy protections and better logging policies than mainstream players. Some vendors claim no logging or short retention windows, and avoid using your prompts to train models.

• Use these tools for sensitive internal work after removing direct identifiers:

  • Strip real names and convert to roles (e.g. “Client A,” “Vendor B,” “Engineer 1”)

  • Remove addresses, phone numbers, and unique IDs

• Keep the mindset that it is still a cloud service. They still see your traffic. Their policies can change. Review them regularly.

Most private:
Self-hosted AI

If your company is large enough, you might consider setting up infrastructure and self-hosting large models that employees can use internally. Inside your own environment, behind your own access controls, staff can be much freer to paste sensitive PII or financials, because the data never leaves your infrastructure.

This option will not make sense for smaller organizations, because maintaining these systems is costly and complex. For larger organizations, they can be a very strong choice.

• Models run on your own hardware or in your own tightly controlled cloud environment

• Prompts and outputs stay inside your infrastructure

• You can integrate the model with internal data sources without exposing that data to an external provider

It is also possible for individual employees to run AI locally on their machines, but the models capable of running on a standard laptop are not as strong as the best cloud tools, and it can be complicated for employees to maintain. If you want to learn how to get started with local models anyway, see our tutorial here:

c. Ban Agentic AI Browsers

Include in your policy that staff must not use “agentic AI browsers” that automatically roam the web and click on things for them, such as Comet or Atlas. These tools are currently a major security concern because of unseeable prompt injections and uncontrolled web actions. You do not want an AI agent browsing the internet and acting on your behalf without tight controls. Perhaps they get more secure in the future, but they’re not there yet.

Takeaway
AI is set to be the biggest security and privacy hole in your organization unless you train your employees how to use it responsibly.

You do not have to sit out the AI wave. You can absolutely use powerful tools that increase your company’s productivity. You just need to:

• Teach employees clear, simple rules about what never goes into external AI

• Give them more private alternatives

3. Communications

Internal chat is where most of the real work happens. It is also where people are the most relaxed and least careful.

What to do:

• Choose end-to-end encrypted messengers for internal chats and sensitive coordination.

• Treat disappearing messages as the default for casual conversation. Most internal back and forth does not need to live forever.

• If your industry requires retention, keep it narrow. Use specific archival channels for conversations that must be kept, instead of hoarding every random thread.

• Make it obvious which spaces are ephemeral and which are permanent so staff do not assume everything is “just chat.”

Some private, usable options

• For DMs and casual group chats: Signal is a great end-to-end encrypted messenger.

• For collaborative document discussions: Proton Docs is more private than Google Docs, and you can still collaborate in real time.

You may think saving everything by default is prudence, but it’s actually more of a liability than you realize.

4. Email

It’s the cockroach of the internet. Email never dies. It’s an inherently insecure tool. And it lives on backup servers you forgot existed.

Best practices

• Use end-to-end encryption where possible for sensitive content, or at least password-protected attachments that are shared out of band.

• For external parties, prefer portals or secure file transfer when the data is truly sensitive.

• Set clear rules on what must not go into email at all, and offer better alternatives so people are not forced to choose between “get work done” and “follow policy.”

• Train staff that as you tighten email hygiene, they become the front line against phishing and malware. Short, frequent, specific training works better than once-a-year compliance theater.

• Keep personal and work mail completely separate to prevent cross contamination between consumer services and corporate accounts.

Some private, usable options

My personal preference is Proton, because they provide an entire ecosystem, with calendar, docs, VPN, and other tools as well as email. Inside Proton, messages between Proton users are end-to-end encrypted by default, and for anyone outside you can use either password-protected emails or PGP.

Other strong options are Tuta and StartMail. Tuta encrypts everything in your mailbox and lets you send end-to-end encrypted messages both inside their network and to external recipients using a shared password. StartMail builds on PGP and also offers password-protected messages when the other side has no encryption tools.

Treat email as a hostile environment that you occasionally have to use, not the default home for all company knowledge.

5. Passwords

Most password practices are terrible. People reuse passwords, or create passwords that are easily brute-forced. Everyone should generate random, unique passwords for every site, and store them in a password manager that is protected with 2FA.

• Require a real password manager and enforce unique, long credentials for every system. Some options of password managers: 1Password, Dashlane, Bitwarden, Proton Pass, or if you want to go local only, KeePassXC

• Ban password reuse outright.

• Ban the inclusion of real words in passwords. They make passwords too easy to brute-force (yes, even if they add 123! to the end).

• Turn on hardware-backed 2FA (security keys) on every website that supports it.

Use authenticator-app 2FA everywhere else.
Avoid SMS 2FA wherever possible; these are insecure.

Takeaway: Password practices inside organizations need to be dramatically upgraded.

6. Hot Mics, Cameras, And Voice Assistants

Anything with a microphone or camera should be treated as a potential recording device, not a harmless gadget. That includes laptops, phones, smart speakers, and “helpful” AI assistants. The goal is not just to stop spying. It is to prevent chilling effects and accidental leaks.

House rules

• No always-listening assistants in rooms where sensitive conversations happen. That includes board meetings, HR, strategy, legal, and product planning.

• For home offices, give staff a simple rule: if company-confidential topics are being discussed, devices that can wake on “Hey X” do not belong in the room.

• Do not connect voice assistants to corporate messaging, calendars, or file storage. Convenience is not worth turning them into a side channel into your systems.

Practical controls

• Post a clear device policy in conference rooms. Spell out when recording is allowed, and by whom.

• For truly sensitive meetings, require phones and laptops to be left outside, or shut down completely.

• On corporate devices, revoke microphone and camera permissions by default, and grant them only to tools that genuinely need them.

• Encourage physical camera covers on laptops and external webcams, and make them the default on issued devices.

Takeaway: People follow norms more than they follow policy PDFs. Make the norm clear. Voice assistants don’t belong in strategy sessions, and every mic and camera should be treated like it can record at any time. Some companies are absolutely at risk of having employee devices turned into hot mics via mercenary spyware tools.

Summary

We can no longer think about security as a wall that keeps outsiders from getting in. In the modern workplace, a huge amount of the risk comes from what insiders are unintentionally sending out. Browsers, email, chat tools, cloud AIs, extensions, microphones, and countless background services leak sensitive information every day, long before an attacker ever touches your network.

The only real defense is culture. A culture where privacy is the norm. Where people default to safer tools, share less by design, and understand that every third party you trust with data becomes part of your threat surface. Employees should feel comfortable navigating what should never be pasted into an AI chatbot, what should never be sent through email, and what should never be stored in a tool that logs everything forever.

The routine habits of every employee can substantially reduce your attack surface, and it also helps you build trust with your customers and clients. Train people well, shorten retention, standardize your tools, ban unnecessary devices in sensitive rooms, and make privacy part of daily operations instead of a compliance checkbox.

By teaching privacy hygiene to employees and enforcing clear internal privacy policies, you can dramatically increase your organization’s security. Build that culture, and your company gets stronger.

Yours in privacy,
Naomi

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.

No matter where you are in the world, I wanted to take a moment to tell you how grateful I am that you’re here.

Thank you.

Our work at Ludlow Institute and NBTV is community supported. We only exist because people like you believe that privacy matters and that a better digital future is worth fighting for. You help us fight for that future every day.

This week’s newsletter is just to let you know much I appreciate you, and to remind you that you caring genuinely shapes what we are able to do.

First, Thank You to everyone who supports us.

Everything we build, every tutorial we release, every investigation we publish is possible because you show up for us. You share our work. You support our nonprofit. You give your time, your attention, and your trust.
You make this mission possible. Truly.

Thank You to the Builders

I’m grateful for the engineers, researchers, hackers, and creators who spend long nights building the tools that keep us safe. Encrypted platforms, secure messengers, hardened operating systems, privacy-preserving protocols. Most people never think about the work that goes into maintaining and building these projects, yet the future of freedom relies on them. Thank you for building these tools for us.
You are creating the infrastructure of digital freedom.

Thank You to the People Who Use These Tools

Privacy tools only matter when people actually use them. Thank you to everyone who has switched messengers, de-Googled their phone, experimented with aliases, spun up a local AI model, tested new tools, filed bug reports, and helped strengthen these ecosystems through real use.

Unless we participate in the privacy landscape, these tools disappear.

You are the adoption curve that keeps them alive. You create the network effect that leads others to adopt them too.

Thank you for being the trailblazers.

Thank You to the People Who Spread the Word

In a world where everyone is fighting to steal your attention, you choose to put your attention toward something that matters: Privacy.

You talk about it with your friends. You share videos. You teach, and you help. Cultural change happens because ordinary people decide the status quo is not acceptable and then do something about it.

Your willingness to stay focused in a distracting world is rare. We need more people willing to use their power the way you are. Thank you for having such a profound impact on the future we are able to write.

Thank You to Everyone Who Cares

I’m grateful for every person who refuses to accept a world where everything we do is surveilled.

Privacy only survives if people insist on it. And right now, thousands of you are insisting. You are the reason this movement is growing. You are the reason we can push for a better future. You are the reason we will win.

If You’re Just Getting Started

If you’re new here and just beginning your journey into privacy, welcome. This community cares about your well-being, cares about your future freedom, and wants to help you succeed. Ask your questions. There will always be people ready to chime in and point you in the right direction.
Here is our Privacy 101 video to get you started:

Thank you to all of you, for helping us build a world where privacy is normal again.

Yours in privacy,
Naomi

Consider supporting our nonprofit so that we can fund more research into the surveillance baked into our everyday tech. We want to educate as many people as possible about what’s going on, and help write a better future. Visit LudlowInstitute.org/donate to set up a monthly, tax-deductible donation.

Donate

NBTV. Because Privacy Matters.