2021: Meta deleted over a billion faceprints after a class action lawsuit alleged it collected biometric data without consent. They called it "an important step" in privacy. 2024: Meta settled Texas's facial recognition lawsuit for $1.4 billion. The largest biometric privacy settlement in US history. 2026: Meta launches a facial recognition system for every Facebook user. They deleted a billion faceprints. paid $1.4 billion in fines. then built it again. Meta buried the announcement inside a post about Facebook Marketplace's 10th anniversary. five paragraphs about buying and selling furniture. then: "oh and starting Monday, video selfie verification for everyone." The product is described as "free" and "optional" to get the badge. But the feature that makes it work, facial recognition that matches your selfie against every photo you've ever posted on Facebook, is not optional. It runs when you submit. Meta says the video selfie is deleted after verification. They also said, "We do not use your photos to build or improve facial recognition systems." This is the company that paid $1.4 billion to do exactly that without telling anyone.

Anthropic just accused Alibaba of illicitly extracting Claude's capabilities. The internet's response was immediate. "You trained on the open internet and then call it 'distillation attacks' when others learn from you." That's a real quote. from a real AI founder. posted publicly. Here's what's documented: Authors sued Anthropic for downloading over 7 million books from pirate sites to train Claude. Library Genesis. Pirate Library Mirror. shadow libraries. not licensed copies. pirated ones. The judge ruled that using legally acquired books for AI training was fair use. But downloading pirated copies was not. Anthropic settled for $1.5 billion in September 2025. the largest copyright settlement in US history. paying authors $3,000 per book for roughly 500,000 works. Then, Reddit sued Anthropic in June 2025 for scraping over 100,000 posts and comments without permission to fine-tune Claude. Reddit's lawsuit described Anthropic as having "a public face that attempts to ingratiate itself into the consumer's consciousness with claims of righteousness" and "a private face that ignores any rules that interfere with its attempts to further line its pockets." Now Anthropic is asking Congress to protect its IP from Chinese labs doing the same thing it did to authors and Reddit. Nobody is clean here. Distillation attacks are real. The Alibaba campaign was real. 28.8 million exchanges is industrial-scale theft. But the company leading the charge on IP protection just paid $1.5 billion for its own. How the tables turn.

In 1945 Soviet school children gave the US Ambassador to Moscow a gift. a large hand-carved wooden replica of the Great Seal of the United States. a gesture of friendship between wartime allies. The Ambassador hung it in his study at the embassy. It stayed there for seven years. Inside it was a listening device. No battery, power source or any active electronics. nothing that any counterintelligence sweep of the era could detect. because there was nothing to detect. It was called The Thing. Here's how it worked. The KGB would park outside the embassy or sit in a nearby building with a directional radio transmitter. They would aim a microwave beam at the Great Seal. The beam would activate a tiny resonant cavity inside the carving. The cavity would pick up voices in the room and modulate the reflected signal back to the receiver. A skilled operator would decode that reflection into clear audio. The principle that was invented, a passive cavity resonator that activates when hit by an external radio signal and reflects data back, is the basis of modern RFID technology. The chip in your work badge. the tag on your clothes. The contactless payment on your phone. All descended from a listening device built by a prisoner in a Soviet labor camp.

Your fingerprints can be lifted from photos. Here's what to actually do about it. 1. Be mindful of hand photos. high-resolution photos of your fingertips at close range are the risk. a normal selfie or group photo is not. The concern is clear: close shots of your fingers, peace signs, hands holding items, and typing shots. 2. Don't rely on fingerprint authentication alone for high-stakes accounts. Use a strong PIN or password as your primary unlock method. fingerprint as convenience, not as your only lock. 3. Use a passkey or hardware security key for your most sensitive accounts. These cannot be spoofed from a photo. 4. For banking apps: enable a secondary PIN in addition to biometric. Most banking apps support this. Use it. 5. Know your threat model. For most people, a spoofed fingerprint attack requires physical access to your device afterward. The photo gets the print. The attacker still needs to be holding your phone. If you're not a high-value target, your risk is low. If you are a high-value target: Disable fingerprint authentication entirely on your most sensitive devices. Use a long alphanumeric PIN. Assume any high-resolution photo of your hands is a liability. Your fingerprint is the one password you can never change. treat it accordingly.

Google just released a $100 speaker with three far-field microphones. always on. always listening. waiting for the wake word. Reviews focused on the audio quality. nobody is talking about what it actually is. a permanently active microphone array made by the world's largest advertising company. sitting in your kitchen. connected to your Google account. linked to your search history, your Gmail, your YouTube watch history, your location data, and now your home. Google knows what you search. what you watch. where you go. who you email. now it also knows what you say out loud when you think nobody is listening. the speaker also requires a subscription to unlock the features that justify buying it. $10 a month for Gemini Live. $20 a month for extended camera history if you have Google home cameras. so the business model is: you pay $100 for the hardware. you pay $10-$20 a month for the features. Google gets permanent audio access to your home. Gemini learns your routines, your preferences, your household dynamics. and the privacy policy: Google says voice recordings are processed to improve its services. you can review and delete them in My Activity. the setting is opt-out not opt-in. the speaker that randomly told a reviewer jokes they didn't ask for is now in your kitchen. listening. all the time. for $100 plus tax.

China just topped the global supercomputer ranking for the first time since 2017. LineShine. Shenzhen. 2.198 exaflops. 2 quintillion calculations per second. 20% faster than the US's El Capitan. built entirely on domestic Chinese CPUs. no Nvidia. no US chips. no export controls can touch it. the US banned advanced chip exports to China to slow them down. China built the world's fastest supercomputer without them. Jsyk... El Capitan, the machine China just beat, is housed at Lawrence Livermore National Laboratory. It's used to develop and maintain the US nuclear weapons stockpile. And xAI's Colossus in Memphis is already estimated to be more powerful than El Capitan. Amazon, Microsoft, and Google all have supercomputers that would top this list if they submitted them. "If the hyperscalers submitted their systems, this 'world's fastest' would not crack the top five." So China didn't beat America's fastest computer. It beat America's fastest publicly listed computer. The real ones aren't on the list. But here's what LineShine actually proves: US export controls were supposed to make this impossible. China was supposed to be years behind without access to advanced chips. They just debuted the world's fastest supercomputer. First time on the list. straight to number one. The sanctions were a speed bump. not a wall.

Scam Wednesday QR codes aren't automatically safe. Attackers can place malicious QR codes over legitimate ones. Before entering credentials or payment details: • Check the website address • Verify the source • Be cautious of QR codes in public places A QR code is just a shortcut to a link.

Discord is testing new age verification methods including Google Wallet, credit cards, and facial scans through a new vendor called Incode. In October 2025: Discord's age verification vendor was breached. 70,000 users had their government ID photos, names, emails, and credit card information exposed. not Discord directly. a third-party vendor they trusted with your most sensitive documents. February 2026: Discord announces global age verification anyway. ID upload or facial scan. for everyone. the rollout language included the phrase "identity documents submitted to our vendor partners are deleted quickly in most cases, immediately after age confirmation." in most cases. The backlash was significant enough that Discord paused the global rollout and went back to the drawing board. Now they're testing Google Wallet, credit cards, and Incode for facial scans. some details worth knowing: — over 90% of users will never be prompted. Discord runs a background AI model that predicts your age from account age, payment history, server types, and activity patterns. silently. without telling you. — the credit card check works as a possession proxy. if you have a card, Discord assumes you're an adult. they say they only receive a yes/no result. — Incode processes facial scans on-device. your biometric data supposedly never leaves your phone. this was a requirement Discord set after dropping their previous vendor Persona for not meeting it. — Discord has now used three different age verification vendors: Persona, k-ID, and now Incode in testing. each switch came after a problem with the previous one. The EFF warned that this normalizes sweeping demands for identity across mainstream platforms. Discord promised full vendor transparency after the breach. There is still no technical diagram showing exactly what data flows through the Google Wallet or credit card verification pipeline. the platform that leaked 70,000 ID photos is now asking for your credit card, your Google Wallet, and your face. one of those options at a time.

The founders of The Pirate Bay built the world's most famous torrent site in 2003. Three Swedish guys. Peter Sunde. Fredrik Neij. Gottfrid Svartholm. Their stated goal: help people freely exchange information. The entertainment industry's goal: destroy them. What followed is one of the most chaotic legal stories in internet history. 2006: Swedish police raid the servers. Took everything away. the site is back online within three days. the founders publish the cease-and-desist letters they receive from Hollywood studios on the site with mocking responses. They become folk heroes. 2009: trial begins. Hollywood shows up with lawyers. then things get interesting. it emerges mid-trial that the lead police investigator in the case had secretly taken a job with one of the plaintiff studios while the investigation was ongoing. the appeal judge was a member of the Swedish Copyright Association. the defendants screamed corruption. the court said it didn't matter. guilty. one year each. $4.2 million fine. None of them went. Gottfrid fled to Cambodia. Cambodia has no extradition treaty with Sweden. The Swedish government reportedly leveraged a $59 million aid grant to Cambodia to get him deported anyway. he came back in handcuffs. While evading his copyright sentence in Cambodia, he hacked Danish government systems police records, social security numbers, the Schengen border database. six months of access. When he was finally deported to Sweden and serving his copyright sentence, the Danish charges caught up with him. extradited again. convicted again. ended up doing three years across Swedish and Danish jails Fredrik fled to Laos. Then Thailand. arrested in 2014. deported. served 10 months. Peter stayed. served 8 months. came out and built Njalla — an anonymous domain registration service — because he said: "We're going the wrong way in society regarding people's right to be anonymous." The guy who ran the world's most pirated site came out of prison and built a privacy company. The Pirate Bay is still online.

Did you know malware can hide inside a process your computer already trusts. it's called process hollowing. Here's how it works. Windows runs hundreds of processes in the background. svchost.exe. explorer.exe. legitimate system programs. security tools trust them by name. network connections from svchost.exe are normal background noise. same connections from unknown.exe trigger alerts immediately. attackers exploit that trust. step one: malware launches a legitimate process, say svchost.exe but pauses it before it runs a single line of code. suspended. sitting in memory. doing nothing yet. step two: malware carves out the legitimate code from inside that process. empties it. hollows it out. step three: injects its own malicious code into the empty space. step four: resumes the process. now malicious code is running. but Windows sees svchost.exe. the task manager sees svchost.exe. your antivirus sees svchost.exe. the file on disk is the real, clean, signed Microsoft executable. nothing on disk is malicious. the malicious code only exists in memory. and the process has inherited svchost's identity, its access token, its whitelisted status, and its right to make network connections without raising alarms. TrickBot used it. Emotet used it. multiple ransomware loaders use it. The defense is memory analysis, not file scanning. EDR tools that watch for processes whose memory contents don't match the executable on disk. But organizations are still scanning files.

The US, Russia, and China are all integrating AI into nuclear early warning systems. In 1983, a Soviet officer named Stanislav Petrov received an automated alert. US nuclear missiles inbound. five of them. the system was certain. He looked at the data and decided the system was wrong. He chose not to report it. He was right. It was a satellite malfunction. a false alarm triggered by sunlight reflecting off clouds. Because one human being decided to distrust his own system, we are all still here. Now, three nuclear powers are replacing that human judgment layer with AI. Russia's hypersonic missiles have compressed the window between launch detection and response to minutes. The time a human being has to do what Petrov did, look at the data, and decide the machine is wrong is shorter. Researchers put GPT-5.2, Claude Sonnet 4, and Gemini 3 Flash into a nuclear crisis simulation earlier this year. Each model played a national leader. each was given intelligence assessments, escalation options, and a chain of command. Not once, across every scenario tested, did any model choose de-escalation under acute pressure. not once. The models reduced violence at the margins. They never chose peace. It has never been closer.

The US, Russia, and China are all integrating AI into nuclear early warning systems. In 1983, a Soviet officer named Stanislav Petrov received an automated alert. US nuclear missiles inbound. five of them. the system was certain. He looked at the data and decided the system was wrong. He chose not to report it. He was right. It was a satellite malfunction. a false alarm triggered by sunlight reflecting off clouds. Because one human being decided to distrust his own system, we are all still here. Now, three nuclear powers are replacing that human judgment layer with AI. Russia's hypersonic missiles have compressed the window between launch detection and response to minutes. The time a human being has to do what Petrov did, look at the data, and decide the machine is wrong is shorter. Researchers put GPT-5.2, Claude Sonnet 4, and Gemini 3 Flash into a nuclear crisis simulation earlier this year. Each model played a national leader. each was given intelligence assessments, escalation options, and a chain of command. Not once, across every scenario tested, did any model choose de-escalation under acute pressure. not once. The models reduced violence at the margins. They never chose peace. It has never been closer.