You can taste the palpable salty feeling from the US Federal Government having to tell citizens they should use encrypted communications. After ages of fighting citizen’s right to private communications from the very beginning, it seems that desperate measures must be taken to prevent foreign adversaries from having access to sensitive information. This is a radical departure from the top-down message of “nothing to hide, nothing to fear.”

Since 2022, a hacking group presumably linked to the Chinese government categorized as “Salt Typhoon” have gained incredibly sensitive access to telecommunications infrastructure all over the world. This has recently escalated, to there being evidence of targeted spying on both 2024 presidential candidates.

What’s most troubling about this breach, is that it also included the “lawful access” backdoor wiretaps. So not only are everyone’s sensitive communications vulnerable in specific contexts, but also by anyone with the capabilities of leveraging Salt Typhoon’s intrusion. Currently, there is no announced timeline for this being addressed. There’s not a whole lot of reason to be optimistic. Last month, a Senate Judiciary Committee discussed just how logistically challenging it is to address this issue.

Naturally this kind of disaster is a great pretext for governments to push sweeping changes in impacted industries. At minimum, we can expect massive changes to be driven in cybersecurity, telecommunications, and hardware manufacturers. While many of these changes are long overdue, with security professionals rejoicing, others are not so benign.

This massive breach itself can be used as a rallying cry to consolidate control over digital products, companies, and even entire digital ecosystems. As the cyber security industry has advanced, the line between “cyber” and human problems becomes quite blurry. Serious concerns, like transnational repression can potentially be weaponized against subsets of the population. What’s more is that almost any aspect of what people currently take for granted as “digital freedom” can evaporate away as ’national security’ interests take priority.

I am not so naive to believe this is the long-overdue wake-up-call to governments that their citizen’s security matters. If anything, this is a rallying cry for control freaks to demand more top-down micromanagement of all things technological. Instead of working on strategies from the ground up to create a truly resilient and secure digital landscape, these concerns will be leveraged to seize even more control over the World Wide Web. We have the opportunity to push for a different direction, but time is vanishingly short.

Originally, I introduced the idea in Good Governance in Cyberspace: Digital Freedom Policy Framework for Policies for the People. The idea is inspired by the idea of Civilian-Based Defense, which is a fascinating model for society-wide resilience and freedom. Bringing civilian-based defense to cyberspace is likely to be much more effective than any top-down approach and can radically transform our digital landscape for the better.

The Structural Basis of Freedom

When power is effectively diffused throughout the society among strong loci, the rulers’ power is most likely subjected to controls and limits, thus enabling the society to resist oppression, usurpation, and aggression. This condition is associated with political “freedom” When, on the other hand, such loci have been seriously weakened or their independence of action has been destroyed, when the subjects are all equally impotent and the society’s power has become highly centralized, then the rulers’ power will most likely be uncontrolled. This condition is associated with “tyranny.”

It is no accident that past totalitarian systems have attempted either to eliminate all independent groups or to subject them to full control by the party or state. Ultimately therefore, freedom is not something that rulers “give” their subjects. Nor, in the long run, do the formal institutional structures and procedures of the government (as, for example, may be laid out in the constitution) by themselves determine the degree of freedom or the limits of the rulers’ power.

A society may in fact be more free or more oppressed than the formal constitutional or legal arrangements would indicate. Instead, the extent and intensity of the rulers’ power and the actual degree of freedom of the society will be set by the strength of the subjects and the condition of: the institutions of the whole society. The rulers’ power and the degree of the society’s freedom may in turn, be expanded or contracted by the interplay between the actions of the rulers and those of the subjects: some rulers may choose not to be as oppressive as the structural condition permits, and other rulers may receive more support than the structural condition requires, making them more powerful.

Increases in the rulers’ power are directly or indirectly determined, on the one hand, by the willingness of the subjects to accept the rulers, to obey to cooperate and to carry out their orders and wishes. On the other hand, reductions in the rulers’ power are determined by the subjects’ unwillingness to accept the rulers, coupled with their ability to disobey, to withhold cooperation, to defy orders, and to refuse demands made upon them.

The degree of liberty or tyranny in any political society is, it follows, largely a reflection of the relative determination of the subjects to be free, of their willingness and ability to organize themselves to live in freedom and, very importantly, their ability to resist any efforts to dominate or enslave them. In other words, the population can use the society itself as the means to establish and defend its freedom. Social power, not technological means of destruction, is the strongest guarantor of human freedom.

Civilian-based Defense - A Post-Military Weapons System: Page 32

This maps directly onto our digital experience. The Free Software movement has demonstrated the incredible potential of building solutions that put power in the hands of the user. By building verifiable, open and transparent systems more people can collaborate to innovate on genuine solutions to pressing problems. The Open Source model of development has been so powerful that even giant mega-corporations have adopted it (in part or in full) for their needs. True digital decentralization requires a hard look at how our devices are manufactured, built, and repaired. The entire “lifecycle” of the devices we use is filled with opportunities for genuine advancement.

Devices and software built with this in consideration can radically lower the “technical knowledge” barrier required for everyone to comfortably navigate. Many of our current challenges are precisely caused by the present condition of so much consolidated control over digital technology. I would encourage the future cyber rebels in our midst to consider building for the future we all want. Instead of corporate or state requirements driving innovation in this space, people can take on the challenge of learning to construct within new paradigms and discover novel approaches. The beauty of programmable circuits is that their potential is very often more constrained by our imagination than physics.

Everyone needs to consider who we are empowering when we allow nations to seize control over the digital landscape in the name of keeping us safe. Are we truly protecting ourselves from digital threats when we accept governments and corporations dictating our digital futures to us? If we do accept ceding more and more control in the name of safety, how can that control inevitably be abused? What should we focus on when it seems that our entire future is highly intertwined with present changes in the digital landscape?

I ask these questions aloud because there are no simple answers, only urgent lines of inquiry. More study, less complacency is the way out of digital totalitarianism. More passion, less apathy is what we need to truly push back against nefarious forces. I’m convinced that the public does have the qualities to build a much better technological future, all that’s required is some effort and creativity. In these times, this can’t be more urgent. If we desire strong freedoms within and without our societies, a much stronger emphasis on bottom-up problem-solving is required. The nature of cyberwarfare is that there aren’t really battle lines, merely troubles that come for us all, in one form or another. Governments and corporations will take care of themselves, but who’s thinking about everyday people?

This project is a labor of love.
Send support!

GrapheneOS writes to Unplugged: (Emphasis mine)

No, you created it to make money. You do not believe in anything beyond making money. You’ve marketed your products with highly inaccurate privacy and security claims including claiming it’s impenetrable.

You are scamming people, and spreading misinformation about an open source project further contributes to it.

The past history of many of the people involved in your company didn’t get erased through creating a new one.

You aren’t on the same side as us and the deeper you dig, the more of a response there’s going to be from us. You are not our allies, and you are not bringing people privacy and security. You’re grifters.

Alright, let’s rewind a bit. GrapheneOS is an open source custom operating system for Android devices (in the Pixel line) that “de-googles” the device and provides a wide variety of security and privacy features. Unplugged is a “private smartphone” company founded by the Blackwater founder Erik Prince.

The above exchange began when Pierre Chang on X asked Unplugged what makes their phone more secure than GrapheneOS, tagging them.

GrapheneOS then replied with:

Where do they make any claim about GrapheneOS?

It’s an ARMv8.2 MediaTek Dimensity 1200 SoC device running a non-hardened fork of the Android Open Source Project. The hardware/firmware doesn’t come close to meeting our security requirements, and it’s not a hardened OS.

To translate this a bit. Android Open Source Project (AOSP) is the base foundation that all android-based systems are built on top of. It initially doesn’t include Google and other bloatware, but vendors tend to add that on. As GrapheneOS states, hardware and firmware matter a great deal when it comes to security, so getting it right is important. They also claim that the Unplugged phone’s operating system LibertOS isn’t hardened. In this context hardened means making specific modifications to improve security.

What’s interesting to note is that in this exchange, Unplugged doesn’t attack GrapheneOS in their weakest point: dependence on Google manufactured hardware. It’s possible that they don’t do this because they don’t want people taking too close a look at their own hardware choices.

They get close in this exchange where GrapheneOS replies to Unplugged defending their firmware.

When using GrapheneOS (or any other custom ROM), Google driver binaries are required, but Google does not provide any commitments regarding data collection or privacy in this code.

This claim about data collection / privacy for the firmware or drivers isn’t accurate. Additionally, you use a MediaTek SoC device with proprietary MediaTek firmware and drivers, and they aren’t known for having good security. The hardware, firmware and driver security of the devices we’re supporting is much better, not worse as you’re making it seem.

As a side note, GrapheneOS is an operating system. The term ROM isn’t accurate and we don’t want it to be referred to as such. It’s a fork of the Android Open Source Project like the stock OS on any Android device.

Unplugged makes the argument that their product is important because the GrapheneOS web installer is too difficult for much of the general population. You can watch Mental Outlaw demonstrate the process and judge for yourself. Regardless of the overall difficulty, would it not be better to have a trusted friend or relative give you assistance rather than settle for a potentially inferior product? In fact if one wants the privacy and security guarantees of GrapheneOS, you can always buy a pre-flashed version from a provider like Above Phone …but that does require putting trust in that provider.

Back in July in response to a podcast, GrapheneOS wrote:

Unplugged has simply doubled down on false claims about GrapheneOS security, pretending people cannot buy devices with GrapheneOS installed and pretending it’s hard to install along with promoting their blatantly insecure products with false marketing.

…

They keep pushing the false claim that Pixels supporting using another OS makes them less secure. The reality is that it’s properly implemented in a secure way without adding any significant attack surface. The bottom of the barrel MediaTek Unplugged devices have awful security.

They still haven’t ported to the initial release of Android 14 with Android 15 right around the corner. This means they’re missing at least around a year of Moderate severity privacy/security patches and huge privacy/security improvements from the past year of Android releases.

Unplugged is using an SoC from MediaTek, a company known to have poor security practices, which fares poorly against real attackers and which has a history of repeatedly shipping actual backdoors. They’re trying to portray that as more trustworthy and more secure hardware. Nope.

Unplugged was founded by Erik Prince, noted war criminal and illegal arms dealer. They make a point in talking about the involvement of their employees in enabling these kinds of operations

That doesn’t imply competence, but explains the lack of ethics.

They’re trying to present themselves as if they were leaders in the field and switched sides, but they never were and simply want money.

Unplugged is an affinity scam in the same vein as the Freedom Phone. At least Freedom Phone doesn’t seem to try to harm open source projects.

Unplugged has built their product out of open source projects, but without complying with the licenses from projects like DivestOS and while trying to harm open source. Claiming to be in the process of replacing some of the code they were caught stealing doesn’t change much…

Now that’s the root of the teachable moment here. What is an affinity scam? In short, it’s when people create a scheme to profit off values without actually “walking the walk”. At worst, it is a deliberate attack on a particular group of people that masquerades as “one of them”. It happens to all kinds of groups and movements, and the privacy and security space is no exception.

It’s really worth asking why so many targeted operations end up having severe data breaches. Is it really too crazy to believe that in this day and age, cyberwarfare is just part of politics? Even Exxon is being investigated for allegedly hiring hackers to go after environmentalists.

We are in serious trouble if we can expect huge amounts of money to go into undermining people’s security. At minimum, it means everyone has to be a lot more careful about recommendations from media figures and personalities. This is one of the major reasons I am in no rush to sell any products. I don’t inherently believe that commercial success is impossible while providing good security, but I consider that bar extremely high.

This is largely because nothing exists in a vacuum. If one company does everything they can to be the best they can be, they can still lose. We don’t have a “perfect market” when it comes to digital security. Because a large portion of the public aren’t very knowledgeable about the issues, it creates opportunities for them to be taken advantage of. A company that spends a majority of it’s time buying PR and marketing will inherently out-compete one that actually invests in the technical merits, all else being equal. But all things aren’t equal, many institutions and private interests have a great deal to gain from undermining people’s security.

This is why Free and Open Source Software (FOSS) is a pre-requisite for genuine advancements in privacy & security. By delivering solid software or hardware as a public good, it is much easier for more parties to test and validate any claims, especially security. Despite what many believe, refusing to compromise on Software & Hardware freedom doesn’t mean making money is impossible, it just means you have to take a radically different approach. My personal suspicion these days, is that the “Unix Philosophy” of “Do one thing, and do it well” can do a lot of good. Instead of single-handedly trying to completely transform the smartphone market all at once, maybe it’s better to focus on a single component and delivering it in a robust verifiable way.

This ultimately brings me to my own objection to the Unplugged phone on a very conceptual level. They pre-load some interesting software options with the phone. With their own dedicated VPN/Messenger/Antivirus and Store apps, it really makes you wonder how much of your life you’re trusting to them. Are we supposed to believe that while using sub-standard hardware (according to GrapheneOS), they’ve managed to somehow deliver the best secure Messenger/VPN & antivirus without any problems whatsoever? Call me skeptical.

There really does seem to be a pattern of inferior options being promoted by slick marketing and alternative media. Even the Brax2 phone was no exception. People want to believe there are simple ways to avoid all the pitfalls of our modern digital environment, but that’s not possible. Everything involves trade-offs or sacrifice when one is trying to make meaningful progress. When one doesn’t understand these trade-offs they can fall prey to outright deceptive claims and become ensnared in something far more malevolent than even the defaults.

This is a big part of the reason why this project is about trying to build understanding and context to these problems. Meaningful improvements are possible and within reach, they just require seriousness and dedication. One of the most important steps of all is building up more independent security research. This requires a great deal of funding, education, and promotion for those who either have the skills, or are able to learn them. Anything we can do to bankroll independent security research will go a long way to answering the questions we have about how to move forward.

I wouldn’t recommend buying the Unplugged phone and still see GrapheneOS as the gold-standard for smartphone security. It’s important to remember that a great deal of interests have sophisticated means and a huge desire to undermine your security. Tread lightly, and always double-check your assumptions.

This project is a labor of love.
Send support!

It was an honor and pleasure to dig deep into the Bitcoin discussion on Geopolitics & Empire. Mathew Crawford brings a wealth of knowledge to the table to take it to the next level. I really enjoyed taking the topic to task with two brilliant friends.

Gabriel of Libre Solutions Network and Mathew Crawford discuss all things bitcoin and how it seems the plan was to have Trump installed and push crypto. They comment on the role of the U.S. military, influencers, BlackRock, the potential future role of bitcoin erasing U.S. debt and functioning as a banking currency, digital gold, tulip mania, viewing the technology as neutral, bitcoin’s future price, and more!

Mathew Crawford is an Educator, Entrepreneur, Statistician, Finance Specialist, and Founder of Rounding the Earth.

You may also enjoy previous conversations with Hrvoje from his TNT Radio show.

Podcast intro music is from the song “The Queens Jig” by “Musicke & Mirth” from their album “Music for Two Lyra Viols”: http://musicke-mirth.de/en/recordings.html (available on iTunes or Amazon)

This project is a labor of love.
Send support!

Welcome to Cyber Fix, your dopamine-infused tech news update.

Cyber Fix is on hiatus, you may now listen to full episodes on PeerTube

These are items that didn’t quite make it into the final episode, but noteworthy in their own right.

This project is a labor of love.
Send support!

Welcome to Cyber Fix, your dopamine-infused tech news update.

Cyber Fix is on hiatus, you may now listen to full episodes on PeerTube

Death by Remote

Experts: Lebanon Pager Explosions Likely Not Lithium Batteries Alone

Targeted Pagers Explode Across Lebanon

Turning Everyday Gadgets into Bombs is a Bad Idea

first Trump Bitcoin transaction takes minutes to complete and theyā€™re unsure if it even went through

Crypto fans beware ā€” hundreds of Android apps found using OCR to steal login details

Bumble to leverage AI to help users with profile creation and conversations

The first release candidate of FreeCAD 1.0 is out

Building the world you want to live in

Fairphone 5 review

The plan is simple

Exodus for Android: Finds trackers embedded in all your apps

Radicle 1.0

Building a browser using Servo as a web engine!

End-to-End Encryption Coming for iPhone-to-Android RCS Messages

IncogNET is now an accredited registrar for .ST

Discord launches end-to-end encrypted voice and video chats

Ex-Cop Wields Law That Only Protects Cops To Sue Data Broker For Selling His Personal Data

Phones & Precrime

Billionaire Larry Ellison says a vast AI-fueled surveillance system can ensure ‘citizens will be on their best behavior’

PwC tells employees it will use location data to police ‘back-to-office’ rule

Emails show cops knew buying drones broke state law. They did it anyway

Australian Intelligence Official Threatens To Ban Private Messaging

Chainalysis Successful Deanonymization Attack on Monero

Canadian Conservatives Propose Bill for Online Digital ID Verification and Anonymity Restrictions

Can AI make you less gullible or is it a conspiracy?

This is about Sovereignty

Bank of Canada shelves idea for digital Loonie

FTC Staff Report Finds Large Social Media and Video Streaming Companies Have Engaged in Vast Surveillance of Users…

Is Tor still safe to use?

NGI Assure Programme Successfully Concluded

X reverses course in Brazil

What is a Compute Module? Why should you care about it?

OIG audit calls for more clarity from CISA, DHS on disinformation mission

This project is a labor of love.
Send support!

Welcome to Cyber Fix, your dopamine-infused tech news update.

Cyber Fix is on hiatus, you may now listen to full episodes on PeerTube

This project is a labor of love.
Send support!

I had a great conversation with Michael Ginsburg of Actionable Truth Media discussing how people are manipulated into supporting fake decentralization or fake solutions to pressing technological troubles. If you enjoyed our conversations you can visit his website at actionabletruth.media or on his Substack.

We briefly touch on how many people are falling into the cult of personality around Elon Musk, ultimately empowering Musk to have more control over their digital lives. Rallying around false saviors has a high opportunity cost in the best case scenario, and makes one complicit in all manner of concerns the worst case.

While the Odysee team seems to be making an admirable effort taking action against censorship, there is reason to be concerned with the finer details. When one takes a close look at the “web3” ecosystem, many red flags come into view. Regardless of how one feels about the SEC decision, there are good reasons to take a close look at what new direction Odysee is taking.

Michael raised the concern around Internet shutdowns. In whole or in part, internet shutdowns are a recurring phenomenon as governments seize control during times of unrest. World-wide accessible communication is a vitally important objective for those who care about a free and open Internet. In our conversation Michael explores how an internet shutdown could be used to manufacture consent for various policies such as digital ID. Currently, it seems like the primary use of internet blackouts is to quell dissent.

This project is a labor of love.
Send support!

Cyber Fix is on hiatus, you may now listen to full episodes on PeerTube

This project is a labor of love.
Send support!

Cyber Fix is on hiatus, you may now listen to full episodes on PeerTube

SAP AI Core Vulnerabilities Expose Customer Data to Cyber Attacks

Read more:

This project is a labor of love.
Send support!

I spoke with Demi Pietchell from The Starfire Codes to learn from her experience as someone with a long career in online media. We touch on many ongoing concerns such as community dynamics, censorship, the loss of coherence online, and even how that impacts artistic and intellectual creatives.

The Digital Autonomy And The Arts Series includes an open invitation for discussing how our digital experience impacts our lives. Beyond simply exploring arts & tech, I would be happy to explore other domains as well. If you’re interested in exploring this discussion, consider getting in touch to share how your passion connects with, or is impacted by technology.

This project is a labor of love.
Send support!