This week we talk about Threads, Meta, and the Fediverse. We also discuss Instagram, follower migrations, and the social media landscape. Show notes/transcript: letsknowthings.com 

This is a public episode. If you’d like to discuss this with other subscribers or get access to bonus episodes, visit letsknowthings.substack.com/subscribe

Social Graph

A calm, non-shouty, non-polemical, weekly news analysis podcast for folks of all stripes and leanings who want to know more about what's happening in the world around them. Hosted by analytic journalist Colin Wright since 2016. 

letsknowthings.substack.com

News

News Commentary

TikTok Ban

This week we talk about STELLARWIND, 9/11, and the NSA. We also discuss warrantless surveillance, intelligence agencies, and FISA. Recommended Book: Period: The Real Story of Menstruation by Kate Clancy Transcript Immediately after the terrorist attacks in the US on September 11, 2001, then President George W. Bush gave his approval for the National Security Agency, the NSA, to run a portfolio of significant and ever-evolving cross-agency efforts aimed at preventing future attacks of that kind, scale, and scope. The thinking behind this collection of authorizations to various US intelligence agencies, which would operate in tandem with the NSA, was that we somehow didn't see this well-orchestrated, complex plan coming, and though revelations in later years suggested we kind of did, we just didn't act on the intelligence we had, in those early, post-attack days, everyone at the top was scrambling to reassure the country that things would be okay, while also worrying that more attacks from someone, somewhere, might be impending. So the President signed a bunch of go-aheads that typically wouldn't have been signed, and the government gave a lot of power to the NSA to amalgamate the resulting intelligence data in ways that also wouldn't have previously been okay'd, but that, in those unusual circumstances, were considered to be not just acceptable, but desirable and necessary. This jumble of intelligence service activities, approved by the president and delegated to the NSA, became known as the President's Surveillance Program, and they were kept secret, in part because of how unprecedented they were, and in part because those in charge didn't want to risk their opposition—those they knew about, like Al Qaeda, but also those that might be waiting in the wings to attack the US while it was perceptually weakened and vulnerable—they didn't want to risk those entities knowing what they were doing, what they knew about, how they were collecting data, and so on. The info that was gleaned via these programs was compiled and stored in an SCI, which stands for Sensitive Compartment Information, and which refers to a type of document control system, a bit like Top Secret or Classified, in that it allows those running it to set what level of access people must have to view, process, use, or even discuss its contents, and this particular SCI was codenamed STELLARWIND. Among other activities, the programs feeding data into the Stellarwind SCI mined huge databases of email and phone communications, alongside web-browsing and financial activities; all sorts of tracking information that's collected by various components of intelligence, law enforcement, and other government and government-adjacent services were tapped and harvested. All of this data was then funneled into this one program, and though the degree to which this much information is useful up for debate, because having a slew of data doesn't mean that data is organized in useful ways, in 2004 the US Justice Department discovered that the NSA was not just collecting this sort of data when it was connected to foreign entities or entities that have been connected to terrorism, it was also collecting it from sources and people, including just average everyday Americans and small businesses that were doing no terrorism at all, and which had no links to terrorism, and it was doing so on American soil. After this discovery, then-President Bush said, well, the NSA is allowed to do that, that's fine, but they can only look at collected metadata related to terrorism—so they can collect whatever they want, sweep up gobs of information, file-away whatever drifts into their expansive and undifferentiating nets, but they're not allowed to look at and use anything not related to terrorism; and with that clarification to keep the Justice Department from doing anything that might hinder the program, the president reauthorized it that same year, 2004. There was disagreement within the government about the legality of all this, some entities saying that warrantless wiretapping of American citizens was illegal, even if the collected data was supposedly unusable unless some kind of terrorism connection could be ginned up to justify it. But those in charge ultimately decided that it would be irresponsible not to use these wiretapping powers the NSA wielded to protect American lives, and even said that Congress had no power to stop them from doing so, because it fell within their wheelhouse, that of defense against potential future foreign attack. All of the President's Surveillance Programs officially expired on February 1 of 2007, but new legislation that same year, and more in 2008, extended some of these activities, all with the justification of protecting the US from future terrorist attacks, and in 2009, a report published by the Inspectors General of the country's intelligence agencies found, in essence, that the now-retired President's Surveillance Program went way beyond what was allowed, in terms of collecting this sort of data without a warrant, and indicated that there was little oversight keeping folks from looking at data they weren't supposed to be looking at, while also indicating that the program probably wasn't very effective—so there was all this data, collected on dubious legal grounds, approved during a period of fear and perceived vulnerability, that was also becoming this a major headache for folks concerned about what amounted to a big, secret surveillance program that was targeting the very people it was supposedly meant to protect from terrorism, all in the pursuit of purported security benefits that were more theoretical than real. A former NSA codebreaker went on the record with WIRED magazine in 2012, outlining how the NSA was surveilling Americans in this way, which got the codename Stellarwind into the press as a consequence, and the following year, in 2013, the Washington Post and The Guardian published a draft of that 2009 Inspector General report that said the program was going far beyond the bounds of what was legal and right and effective—that draft leaked by NSA employee and subcontractor Edward Snowden. Further revelations based on that leak came out in 2014, at which point there was abundant public evidence that much of what was happening within the Stellarwind program was kept secret even after supposed earlier divulgences, and a lot of it was seemingly very illegal, though this program still functions in various capacities and at various scales, even now, in 2024. What I'd like to talk about today is a portion of the Stellarwind program that was recently extended, though not without controversy and pushback. — The Foreign Intelligence Surveillance Act, or FISA, was passed in 1978 in response to the fairly brazen and regular violations of Americans' privacy under the Nixon administration; namely that his government regularly spied on, and used intelligence and law enforcement services to mess with, political and activist groups that Nixon didn't like. FISA was meant to establish guardrails for when and how that sort of surveillance could be conducted, who could access the relevant data, and how it could be used—though notably, all of this applied to collecting intelligence in US territory; the rules are a lot looser when it comes to surveillance of non-americans in other countries. Among other things, FISA established the Foreign Intelligence Surveillance Court, which is a court that decides who can use these tools and access this data—they oversee the divvying-out of surveillance warrants—and FISA was the basis for all those President's Surveillance Programs following 9/11; so it was meant to prevent abuses of surveillance and intelligence tools by the US government against its citizens, and this general framework was used as a scaffolding for those enhanced surveillance powers the government gave itself after the 9/11 attacks; it was also a primary resource for those who found all those post-9/11 additional powers to be illegal oversteps. One evolution of FISA following September 11 was the introduction of what's called Section 702, which is provision that allows the US government to undertake targeted surveillance efforts against non US citizens outside the US, leveraging the full weight of the US government to do so, including but not limited to coercing telecommunications companies, like internet or phone companies, to hand over whatever data and recordings and such they might have available. Section 702 is meant to be very targeted and specific, never allowing the surveillance of any US citizen, anywhere, any person from any country who's in the US, or any foreign person located anywhere on the planet who is communicating with a US citizen—which is a technique that was previously leveraged by some components of Stellarwinds, the idea being that if you wanted to surveil an American but had no evidence they have links to terrorism, you would just capture their phone calls and other communications with non-Americans, and you'd be good to go. There's a fairly rigid set of protocols involved in using Section 702 for surveillance, including Department of Justice oversight on every targeting request, and opportunities to deny the collection of, or subsequent access to data that is collected by a sequence of analysts who are disconnected from those requesting said data. That's what the rules and processes for this provision say, anyway. In practice, Section 702 has allegedly been used to track members of Congress, journalists, victims of various sorts of crime, political donors, and protestors—targeting them for surveillance, but also used to search existing data that's already been collected, baselessly, via so-called "backdoor searches" with no connection to terrorism or anything else that would allow for the formal use of these tools, seemingly in violation of those supposed hardcore guardrails, at the behest of the FBI, CIA, and NSA. And this seemingly happens on a fairly regular basis—more than 200,000 warrantless, backdoor searches are performed each year. All of which adds interesting context to a recent congressional vote to reauthorize Section 702 for another two years, right as it was about to expire. This extension vote was laden with drama, in part because two major US internet companies said they would no longer comply if Section 702 wasn't renewed, as the government had had its request to keep collecting data for another year approved, but it no longer had legal backing to demand such data from companies, with the ability to coerce them to hand over digital communications data, like email and text records, if they denied more polite requests. So these companies said, well, you can collect whatever data you can get your hands on, but you can't get your hands on our data, anymore. There was also political drama, though, in the shape of former US President, and current Presidential candidate Trump's loudly stated antagonism toward renewing this provision, something that aligned him with privacy oriented groups that he typically doesn't like or align with. A vote that would have ended all warrantless searches on these sorts of communications failed to pass earlier in April, due to a tied 212 to 212 vote in the House, and another that would have accomplished a similar outcome and which was voted upon a few days later was defeated by just a handful of votes. The conflict here is seemingly that while there are significant and persistent privacy issues with this and related programs, it's also considered to be a potentially useful tool in the US intelligence community's utility belt. And though most politicians would like to be seen as defending the privacy of American citizen from prying government eyes, few want to be seen as hobbling its defense infrastructure, even if the defense value of this and connected programs have been questioned and challenged, time and time again. What eventually helped a Section 702 extension bill attain approval from Congress was a compromise that approved the extension of some components of it, that allowed it to take new communications technologies into account, arguably making it more useful for surveillance purposes while simultaneously increasing the privacy risks it poses, but pairing those add-ons with a shortened extension period, down from five years to two. Which means it's likely there will be another showdown over whether it should be extended in just a few years, at which point it can be killed or further edited, depending on how this new, slightly iterated version, is functioning at that point. All of which is interesting and newly relevant in part because we're stepping into what some have called a new Cold War, with all sorts of real-deal military conflicts on the ground threatening to expand and encompass more of the planet, alongside rifts in the relationships between behemoths like the US and China, which could erupt into larger versions of the same, if these governments aren't careful. At such moments, we tend to see more support for measures that give heightened power to governments and other defense-oriented entities, even at the expense of individual rights. So rather than clipping the wings of this and similar programs in a few years when renewal is once more on the docket, it may be that Congress further empowers it—depending on how today's conflicts play out, and how the relationships between the US and its primary rivals evolve in the meantime. Show Notes https://www.washingtonpost.com/national-security/2024/04/19/fisa-702-surveillance-internet/ https://www.washingtonpost.com/national-security/2024/04/20/congress-extends-controversial-warrantless-surveillance-law-two-years/ https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act https://www.dni.gov/files/CLPT/documents/2023_ASTR_for_CY2022.pdf#page=24 https://www.intelligence.gov/assets/documents/702%20Documents/declassified/2023/FISC_2023_FISA_702_Certifications_Opinion_April11_2023.pdf#page=89 https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf https://www.aclu.org/issues/national-security/warrantless-surveillance-under-section-702-fisa https://www.brennancenter.org/our-work/research-reports/whats-next-reforming-section-702-foreign-intelligence-surveillance-act https://www.brennancenter.org/our-work/research-reports/fisa-section-702-civil-rights-abuses https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act https://www.nytimes.com/2024/04/20/us/politics/senate-passes-surveillance-law-extension.html https://en.wikipedia.org/wiki/President%27s_Surveillance_Program https://en.wikipedia.org/wiki/Sensitive_compartmented_information https://en.wikipedia.org/wiki/Stellar_Wind 

This is a public episode. If you’d like to discuss this with other subscribers or get access to bonus episodes, visit letsknowthings.substack.com/subscribe

Section 702

This week we talk about diplomatic immunity, Trump’s court cases, and the Supreme Court. We also discuss Nixon, Clinton, and the US Constitution. Recommended Book: My upcoming book, How To Turn 39 (https://books2read.com/htt39), which is available for pre-order today :) Transcript There's a concept in international law—diplomatic immunity—that says, in essence, certain government officials should be immune from the laws of foreign countries, including those within which they're operating. This is a very old concept, based on similar rights that were granted to envoys and messengers back in the oldest documented periods of human civilizations. The idea is that if different cultures, whether organized into tribes or kingdoms or nation states, are going to be able to deal with each other, they need to maintain open and reliable means of communication. Thus, the folks tasked with carrying messages between leaders of these different groups would need to be fairly confident that they wouldn't be hassled or attacked or prosecuted by the people they were bringing those messages to, and whose messages they were bringing back to their own leaders. Such representatives have at times been imprisoned or killed by their hosts, but this is relatively rare, because any governing body that treated ambassadors from other cultures in this way would have trouble dealing with anyone outside their current legal sway, and that would in turn mean less trade, less reliable peace, and less opportunity to generally cross-pollinate with cultures they might benefit from cross-pollinating with. As a general rule, at least in the modern iteration of diplomatic immunity, folks operating under the auspices of this policy can still be punished for their misdeeds, it's just that they'll generally be declared persona non grata, expelled from the country where they did something wrong, rather than punished under that country's laws. In some rare instances a country hosting a misbehaving or criminal ambassador or other diplomat might ask that person's home country to waive their immunity, basically saying, look, this person killed someone or got drunk and drove recklessly through our capitol city's downtown, we'd like to try them in our courts, and it may be that the government running that misbehaving person's home country says, okay, yeah, that's messed up, you go ahead; but usually—even if that person has done something truly reprehensible—they'll instead say, no, sorry, we'll pull them back and they won't be allowed to return to your country or serve as an ambassador anywhere else, because they've shown themselves to be unreliable, and we might even try them in a court here, in their home country, but we can't allow our people, no matter what they do, to fall under the legal jurisdiction of some other nation, because that would set a bad precedent, and it may make people wary of working for us in this capacity in the future—surely you understand. There are tiers of diplomatic immunity, depending on the seniority of the diplomat or other representative in question, and the Congress of Vienna of the early 1800s charted out the basis for how these things work, in much detail, formalizing a lot of what was already in the ether back then, and creating an outline that was then further formalized in 1961's Vienna Convention on Diplomatic Relations, which has been almost universally ratified and respected, though of course there's been a lot of grey area in terms of what harassment of a representative, which is a no-no according to this convention, entails, and to what degree it can be proven, and thus punished, if violated. We saw a lot of grey area utility during the height of the Cold War in particular, in part because many diplomats were moonlighting as spies, which is still true today, though it was even more overt and worrisome to their host countries, back then, so harassment, kidnappings, even assassinations of diplomats were more common then, than today, though they were still almost universally done covertly so that no one seemed to be violating these nearly universally accepted terms. What I'd like to talk about today is another type of legal immunity—in this case, Presidential Immunity in the US—and why this type of immunity is at the center of former US President Trump's ongoing legal cases. — In the United States, many politicians and high-level appointees enjoy some of the immunity-related privileges in their own country that diplomats of various stripes have traditionally enjoyed elsewhere. Most of these figures are only protected by this immunity under very specific circumstances, though, not universally. Judges, while doing court-related, judge-work, for instance, have absolute civil immunity—so a judge who falls afoul of the law in the course of their duty as a judge, doing judge-things, will tend to get away with whatever it is they did wrong, though this won't generally apply to non-judge things they do during that same period So a judge would have trouble arguing that they should get off with a warning for murdering someone because they happened to kill that person while they were on their lunch break, but they would likely be okay if they accidentally ruled in a way that exceeded their jurisdiction, even if their having done so caused all sorts of secondary problems. Similarly, and also within the US court system, a prosecutor can't be sued for withholding evidence, even if their having done so leads to a wrongful conviction, which would be a bad thing that happened as a result of their actions, but because they acted while performing their protected duty, they'll almost certainly be okay from a legal standpoint, even if not always a moral one. These are not rules novel to the US system of governance; most of them were borrowed from earlier forms of the same, and a lot of the US's version of these immunity rules are derived from those that exist within the British parliamentary system, where parliamentarians can't be prosecuted for things they say while in Parliament, and the same is true for politicians while engaged in their work on the floor of the US House of Senate. Interestingly though, while the US Constitution provides that kind of legislative immunity to Congresspeople, it doesn't grant the same, or anything similar, to the President; and this was apparently a hotly debated topic back in the Constitution-writing days, as those who set up the rules of the land were aware that it might be beneficial to allow folks at the top some legal leeway, so they don't make executive decisions based on whether or not they might be sued or otherwise punished for those decisions, but at the same time they really didn't want another king, or similarly authoritarian ruler to step into office and then get away with murder—perhaps literally. So the constitution doesn't give the President of the United States the same immunity as other members of government, but a slew of cases in the 19th and 20th centuries found, in general, that if the president or members of the president's cabinet take actions that are "more or less" within the scope of their duties, they should be granted absolute immunity, protecting them from lawsuits and legal punishments. A court case against President Nixon in the 1970s made that previously somewhat vague and general legal trend more formal, at first triggering a bunch of lawsuits against him and his people, but then a 1982 Supreme Court decisions said, in essence, that former or current presidents are immune from lawsuits related to anything that falls within the "outer perimeter" of their duties, due to the president's "unique status under the Constitution." This legal precedent was tested in the mid-1990s when then-President Bill Clinton was sued for sexual harassment during his governor of Arkansas days, and a lower court, then the Supreme Court, both affirmed that presidential immunity doesn't protect the president from things they did before taking that highest government office. As a result of all that, today we have a legal context in which the President is kind of granted some immunity for some things they do while in office, but the delineation between protected and not-protected is fuzzy, and there's a whole lot of theory on this matter, but less in the way of actual court precedent that establishes confident footing for anyone stepping into this corner of the legal world. All of which is newly relevant in 2024 because former President Trump is currently being prosecuted for all sorts of things in several different jurisdictions. And part of his legal strategy is based on a sort of Hail Mary play that's made its way to the Supreme Court, and which is premised on the concept of Presidential Immunity. But before we get to that case, let's talk real quick about the other cases that are currently in progress, all of which that bigger Supreme Court case may influence, depending on how it turns out. Beginning this week, as of the day this episode goes live, the week of April 15, 2024, Trump is scheduled to be in court four days a week for the next six to eight weeks, facing 34 criminal charges related to falsifying business records in order to get payoff money to Stormy Daniels, allegedly to cover up an affair they had, which he didn't want becoming public while he was running for his first term in office. Tentatively beginning in late-May of 2024, Trump will face 40 criminal charges in Florida for allegedly mishandling sensitive documents, and his alleged conspiracy to keep those documents even after the government demanded them back. A federal case in which Trump faces four criminal charges related to his alleged effort to overturn the 2020 presidential election results was originally meant to begin the first half of this year, but it's looking increasingly likely it won't occur until after the November presidential election, as the judge overseeing the case has postponed it until after the Supreme Court makes their decision about presidential immunity, though there's a chance it could start as early as August, despite that delay. And Trump faces 10 criminal charges for the same general collection of alleged efforts to overturn the 2020 election in Georgia, alongside 18 alleged co-conspirators; that trial has a proposed start date of August 5, but that would be tricky, as it would mean the trial could run through Election Day, which would be awkward and would likely complicate things further. Trump has also dealt with a flurry of recent civil, so non-criminal, no jail time possible, just fines, lawsuits, including one related to sexual assault and his defamation of the person he sexually assaulted, which led to a big payout recently, and another in New York related to his misrepresentation of the value of his real estate holdings in the state, which led to an even bigger fine, but which is currently being appealed. There's another federal civil case that's ongoing, Thompson v. Trump, which is related to the attack on the US Capitol by Trump's fans on January 6, 2021, and that's especially relevant here because, already, the judge in that case, ruled that Trump's presidential immunity does not shield him from this lawsuit, and an appeals judge ruled the same. There's now a Supreme Court case, which I mentioned earlier, that consolidates three separate civil lawsuits into one, Trump v. United States, and this case asks, in essence, whether Trump should be protected from these lawsuits by presidential immunity; that same immunity that was upheld in many cases in recent memory, though in different contexts. The reason this Supreme Court case is so fundamental here is that it could impact many or all of those other cases, plus others that might arise related to Trump's actions in the future, as it would give him a sort of legal whammy on just about anything he could argue was done within the perview of his role as President. Thus, he could argue he wasn't trying to overturn the 2020 election that he lost, he was looking into what he considered to be legitimate election irregularities as part of his duty as President. And if some other things happened as a result of that effort, like his supporters breaking into the Capitol building, he should be protected from that under the auspices of this immunity. Those two DC court judges that earlier ruled Trump wasn't protected by presidential immunity said that it's in the public interest to hold presidents accountable for their actions, because not doing so would leave anyone who holds that office "unbounded authority to commit crimes." They determined that it was worth the possibility that a president might make some executive decisions from a perspective of worrying about later lawsuits if it would prevent the creation of a political office from which someone could legally get away with any crime they chose to commit, including but not limited to, theoretically at least, assassinating their political rivals. The big question now is how the Supreme Court will decide on this matter; some people are predicting that the heavily slanted toward conservative justices court will be more likely to find in Trump's favor, though they've defied those expectations several times in recent years, in some cases seeming to take advantage of their current 5 or 6, depending on how you measure, versus 3, conservative to liberal composition in order to get a bunch of Republican priorities accomplished, like overturning Roe v. Wade, which protected the right to an abortion at the federal level, but in other cases they've made what seem to be more objective rulings, defying assumptions made based on those ideological leanings—so there's no way to know one way or the other on this, right now. We'll likely find out, though, sometime in May or June, as the court will begin considering these claims on April 25 of this year, and it's expected they'll have their ruling sometime in those subsequent two months. Until then, though, some of these other cases are a bit up in the air, as the granting of enhanced immunity could make Trump's current and potential future cases a slam-dunk for his defense team, while a ruling in favor of the contemporary, fuzzy standard, or one that weakens that standard, at least for his specific context, would deny him that potentiality. That said, Trump's defense team seems to have also been making use of the abundant delay tactics that are available within the US justice system, and there's a chance that if he delays long enough and then wins another term as president in November, that would allow him, when he steps back into office early next year, to either pardon himself or order someone in his government to get rid of the charges against him. Which is part of why the prosecutors working opposite him have been politely but firmly asking the judges in charge of these cases to pick up the pace, because there's a looming possibility that even if the courts decide against Trump in some key cases, he could still get off Scott free, because of that other apparent loophole in the system that would allow a sitting President to get away with just about anything, though in this case because of a different, in practice immunity-granting mechanism. Show Notes https://www.washingtonpost.com/news/opinions/wp/2014/01/30/7th-circuit-pokes-a-hole-in-prosecutorial-immunity/ https://en.wikipedia.org/wiki/Trial_of_Donald_Trump https://en.wikipedia.org/wiki/Indictments_against_Donald_Trump https://www.nytimes.com/interactive/2023/us/trump-investigations-charges-indictments.html https://www.nytimes.com/article/trump-investigations-civil-criminal.html https://www.pbs.org/newshour/politics/trumps-2024-trials-where-they-stand-and-what-to-expect https://www.washingtonpost.com/politics/interactive/2023/trump-investigations-indictments/ https://www.bbc.com/news/world-us-canada-68577638 https://www.bbc.com/news/world-us-canada-61084161 https://www.theatlantic.com/ideas/archive/2024/03/donald-trump-legal-cases-charges/675531/ https://archive.ph/JFsIB https://en.wikipedia.org/wiki/Indictments_against_Donald_Trump https://apnews.com/article/trump-jury-selection-hush-money-trial-manhattan-56d540406cd174ab143fe12469e9adef https://apnews.com/article/donald-trump-michael-cohen-stormy-daniels-e40532d3bce7768e296fdaf9591ef05b https://www.wsj.com/us-news/law/trump-criminal-hush-money-trial-begins-2a1bdd15 https://www.reuters.com/world/us/fallout-trumps-bid-overturn-election-loss-heads-supreme-court-2024-04-14/ https://www.reuters.com/legal/special-counsel-urges-us-supreme-court-reject-trump-immunity-bid-2024-04-09/ https://en.wikipedia.org/wiki/Trump_v._United_States_(2024) https://en.wikipedia.org/wiki/Presidential_immunity_in_the_United_States https://en.wikipedia.org/wiki/Absolute_immunity https://en.wikipedia.org/wiki/Parliamentary_immunity https://en.wikipedia.org/wiki/Diplomatic_immunity https://www.britannica.com/topic/diplomatic-immunity https://en.wikipedia.org/wiki/Vienna_Convention_on_Diplomatic_Relations 

This is a public episode. If you’d like to discuss this with other subscribers or get access to bonus episodes, visit letsknowthings.substack.com/subscribe

Presidential Immunity

This week we talk about Linux, backdoors, and the Open Source community. We also discuss CPU usage, state-backed hackers, and SSH. Recommended Book: The Underworld by Susan Casey Transcript In the world of computers, a "backdoor" is a means of accessing a device or piece of software via an alternative entry point that allows one to bypass typical security measures and often, though not always, to do so in a subtle, undetected and maybe even undetectable manner. While backdoors can be built into hardware and software systems by the companies that make those devices and apps and bits of internet architecture, and while some governments and agencies, including the Chinese government, and allegedly folks at the NSA, have at times installed backdoors in relevant hardware and software for surveillance purposes, backdoors are generally the domain of tech-oriented criminals of various stripes, most of whom make use of vulnerabilities that are baked into their targets in order to gain access, and then while inside the administration components of a system, they write some code or find some kind of management lever meant to give the company or other entity behind the target access for non-criminal, repair and security purposes, and that then allows them to continue to gain access in the future; like using a rock to prop open a door. Concerns over a backdoor being installed in vital systems is fundamental to why the US and European governments have been so hesitant to allow Chinese-made 5G hardware into their wireless communication systems: there's a chance that, with the aid, or perhaps just at the prodding of the Chinese government, such hardware, or the software it utilizes, could contain a Trojan or other packet of code, hidden from view and hardcoded into the devices in some covert manner; these devices could also harbor even smaller devices, indistinguishable from hardware that's meat to be there, that would allow them to do the same via more tangible means. Though there were almost certainly other economic and technology-dominance reasons for the clampdown on products made by Chinese tech company Huawei beginning in earnest in 2012, and escalating rapidly during the US Trump administration, that process was at least ostensibly tied to worries that a Chinese company, prone to spying and stealing foreign tech, already, might incorporate itself into fundamental global communication infrastructure. It was underpricing everybody else, offering whizbang new high-end 5G technology at a discount, and supposedly, if the accusations are true, at least, doing so as part of a bigger plan to tap into all sorts of vital aspects of these systems, giving them unparalleled access to all communications, basically, but also giving them the ability, supposedly, to shut down those systems with the press of a button in the event that China wants or needs to do so at some point, if they ever decide to invade Taiwan, for instance, and want to distract the Western world until that invasion is complete, or just make rallying a defense a lot more difficult. Other, confirmed and successfully deployed backdoors have been found in all sorts of products, ranging from counterfeit Cisco network products, like routers and modems, some of which were installed in military and government facilities back in 2008 before they were recognized for what they were, to Microsoft software, Wordpress plugins, and a brand of terminals that manage the data sent along fiber-optic cables, mostly for high-speed internet purposes. Again, in some cases, the entities making these products sometimes do install what are literally or essentially backdoors in their hardware and software because it allows them to, for instance, help their customers retrieve lost passwords, fix issues, install security updates, and so on. But backdoors of any shape or size are considered to be major security vulnerabilities, as stealing a password or getting access to a vital terminal could then grant someone with bad intentions access to absolutely everything, giving them god-like control over all aspects of a customer's information and operations, or maybe all of the company's customer's information and operations, and that creates a single point of failure that most companies want to avoid, because at a certain point there's no real way to prevent a truly determined and well-funded foe if they know the payout for investing in accessing that terminal or getting that password would be that substantial. What I'd like to talk about today is a long-term effort to do exactly that, the target, in this case, being small, but the potential payoff of backdooring it being pretty much as big as you can imagine. — XZ Utils is the name of an Open Source data compression utility, which means that it squishes data in such a way that no information is lost, but so that big files and other packets of information become smaller, and that makes it faster and easier and cheaper to send that data from place to place. XZ is popular in part because it's effective, in many cases outperforming other free alternatives, like gzip and bzip2, but it also supports an older compression model called LZMA, and it exists in the public domain, which means it's incredibly inexpensive to use, free, for most purposes. It's especially popular in Linux and other Unix-like systems, and in practice that means it's used across these systems so that when data is moved from place to place, it's compressed and decompressed, putting less pressure on the systems themselves, almost like reducing the weight of everything you have to carry throughout the day, without any reduction in quality or the nature of those books and bags and laptops and other things you're hauling around all the time; even small reductions in that weight could make a big difference in the strain on your body, over time, and this utility accomplishes the same for the systems that incorporate it. So this software utility is super useful, is free to anyone who wants to use it, and it's better than a lot of other options, and it's thus been baked into a bunch of fundamental computer infrastructure, like most Unix-like systems. And that's important for a lot of reasons, but the most immediately concerning issue is that the vast majority of servers that run the tech world—basically all the major tech companies, and all the companies they work with—manage their services with Linux. XZ isn't just important for folks who have laptops running on Linux, then, it's also vital to the functionality of huge chunks of the internet; stats from the past few years show that about 96.3% of the top million web sites run on Linux servers, and a substantial amount of non-web-serving servers do, as well. All of which sets the stage for the hubbub that arose on March 29, 2024, when a Microsoft employee named Andres Freund announced that, after looking into a decrease in performance in a version of Linux called Debian—a distinction between how fast it should have been going and how fast it was going of about 500 milliseconds, and that minor slowdown bugged him enough to look into what newer, experimental versions of XZ Utils were doing to the Debian operating system he was working with—after looking into that issue, he announced that he had discovered a backdoor in XZ that was causing errors in a memory debugging tool built into the software, and using more CPU power than Debian otherwise would have used. So he announced this discovery, reported it to an open source security mailing list, to make it known amongst the right people, and that alerted the folks who were experimentally incorporating this new build of XZ into their software. As it turns out, this backdoor, had it been implemented in all this software and spread across the servers that manage the web, would have granted whomever had access to it the ability to alter the behavior of the local instance of the Secure Shell Protocol, or SSH, which is what protects servers while they operate on open networks like the internet. The degree to which this would have damaged the web, as it exists today, cannot be overstated. This problem was given a Common Vulnerability Scoring System ranking, which rates the alarmingness of software issues based on how much damage they could potentially cause, which helps computer security professionals figure out which problems to address first, a score of 10, which is the highest possible score. In theory, this would have granted the person or other entity with backdoor access the ability to get into essentially any server touching the internet with full administrator privileges, making all that information transparent to them, providing them all information about users, passwords, banking information, everything everyone has ever posted to social media, private communications, research and technology secrets—it's really just boggling thinking about how much damage could have been caused by the right person or people, as such a backdoor would basically do away with most of the security measures they might encounter while attempting to infiltrate and even take over pretty much anyone. Because it was discovered by Freund, though, and because he got word out to the right people as quickly as he did, the cybersecurity world was able to pivot pretty quickly, advising everyone who had implemented these test versions to roll back to earlier versions of the relevant software, and the folks behind XZ quickly released updated versions of the utility that removed the backdoor problem. This also triggered a response in the wider software world as many developers have started to reduce the damage future, similar backdoors would be able to cause by reducing the connections and dependencies it took advantage of to function. So this was a big enough deal that even something as arcane as compression utilities and SSH became front-page news around the world, but arguably one of the most interesting aspects of this story is what we know about the person or people who seem to have installed this backdoor. Someone, or group of someones, going by the name Jia Tan, alongside an array of sock puppet accounts—fake accounts with different names that they also managed—started to contribute to the maintenance and development of this project, which is common in the open source world; that's part of what makes open source software and systems so powerful and desirable, despite often not having much in the way of funding or official support from big-name companies; they're often passion projects maintained by maybe just one or a few or a handful of dedicated developers. In 2021, this entity that became known as Jia Tan started contributing to open source projects, and then contributed a patch to XZ via its mailing list. Around that same time, several people who hadn't been seen in this project's community, previously, started to complain that it wasn't being updated fast enough, and arguing that another maintainer should be brought on board, to help it move along faster. This Jia Tan character then started making a lot more contributions to the project, all of them seemingly innocuous and helpful, though in retrospect at least one of them changed a function that would have detected the more malicious changes they ultimately submitted, later. In February of 2024, Tan submitted changes for the new version of XZ Utils that incorporated a backdoor, and groups of people in this larger open source community, possibly sock puppet accounts, started telling the developers who run Debian, Ubuntu, and Red Hat, all popular versions of Linux, they should incorporate this new version with those backdoor-incorporating changes into their operating systems. There are strong suspicions, but little evidence, at this point at least, that Jia Tan and those other sock puppet accounts were run by a well-funded and skilled, probably government-backed hacking group, like one of the entities that often work as proxies for Russia's SVR—their intelligence agency that tends to support local hacking groups to do this sort of dirty work; though again, we can't say that with any certainty, as a lot of government-backed hacking groups could pull off something like this, with enough patience, years worth of patience, and it's still possible that this was a single hacker seeing a soft-target and the potential for a huge payoff if it all worked out. That said, because of the approach this threat actor, whomever they actually are, took to target this utility, and because of how close they got to doing what they intended to do, which would have been devastating, probably even world-changing in some ways, the relationship that big tech and governance has with the open source world is being reassessed, because often the folks running these projects are just individual people doing all this important work in their free time. But because of how the tech world has evolved, huge swathes of the internet and other vital infrastructure are reliant on these single-person, passion-projects that are potential targets for cooption or, as seems to have been the case here, using what's called social engineering to manipulate the folks behind these projects, which can then gives more access to all the stuff they manage, and thus, the things that rely on the stuff they manage, to entities that want to cause harm. Again, and this cannot be emphasized enough, we just barely dodged a bullet here, and the only thing that prevented a huge amount of potential destruction was the effort of another single person who was, almost on a whim, hacking away on a little problem they wanted to look into, and who thus stumbled upon this issue right before it reached a scale that would have been truly problematic. And all of these issues were arguably the result of someone who found themself in the position of maintaining, more or less solo, a utility that became vital to global cybersecurity, and which thus made them the target of a sophisticated social engineering campaign. Show Notes https://en.wikipedia.org/wiki/Backdoor_(computing) https://en.wikipedia.org/wiki/Hardware_backdoor https://en.wikipedia.org/wiki/Social_engineering_(security) https://www.zdnet.com/article/linux-has-over-3-of-the-desktop-market-its-more-complicated-than-that/ https://arstechnica.com/security/2024/04/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world/ https://research.swtch.com/xz-timeline https://research.swtch.com/xz-script https://news.ycombinator.com/item?id=39895344 https://www.runtime.news/sabotage-in-the-software-supply-chain/ https://news.ycombinator.com/item?id=39903685 https://www.theverge.com/2024/4/2/24119342/xz-utils-linux-backdoor-attempt https://www.wired.com/story/jia-tan-xz-backdoor/ https://www.404media.co/xz-backdoor-bullying-in-open-source-software-is-a-massive-security-vulnerability/ https://www.nytimes.com/2024/04/03/technology/prevent-cyberattack-linux.html https://www.economist.com/science-and-technology/2024/04/02/a-stealth-attack-came-close-to-compromising-the-worlds-computers 

This is a public episode. If you’d like to discuss this with other subscribers or get access to bonus episodes, visit letsknowthings.substack.com/subscribe

XZ Utils Hack

This week we talk about cacao, plantations, and bean-to-bar chocolate. We also discuss black pod disease, swollen shoot virus, and seed pod currency. Recommended Book: The City & The City by China Miéville Transcript The cocoa bean, also called "cacao," is a seed derived from the cocoa tree, which is native to the Amazon Rainforest in South America. More than 5,000 years ago, near present day Ecuador, the Mayo-Chinchipe culture domesticated and cultivated this tree, which then found its way north into Mesoamerica—so parts of Central America, and modern day Mexico—and that's where we actually thought it came from until a handful of years ago, when new research pushed the initial domestication date back by about 1,500 years, tracking its path down into Ecuador by identifying cocoa residue on pottery from that time period down in that region. But way back then, it's thought that the pulp of this seed was used primarily to create an alcoholic beverage that was fermented to about the same alcohol percentage as a consumer-grade, modern day beer—just over 5%—and because of that utility in making this popular beverage, it was used as a currency in some parts of South and Central America. It's worth noting, too, that this tree and its seed would have originally been called kakawa, which was then turned into an Aztec derivative word much later, cacauatl, which then became cacao, when the Spanish colonized the region, and cacao then became cocoa when introduced to English-speaking parts of the world—and that variation of the word took over in the age of post-WWII globalization, due in large part to the popularization of chocolate products from English-speaking countries like the US and the UK, cacao only recently being reintroduced on that scale to differentiate more expensive cocoa products from those that have become mainstream. Also worth noting is that in addition to being used to produce a popular alcoholic beverage way back in the day, the cocoa bean was also turned into a kind of frothy spiced drink by Aztec royalty and other higher-ups in this part of the world, and that drink was enjoyed by high-born members of society for several thousand years, the beverage used in all sorts of rituals. And to make it, cocoa was whipped together with vanilla and other spices and sweeteners to produce something akin to a sort of hot chocolate the modern person would recognize, though leaning a lot more into those spices than most modern chocolates, rather than sugars and fats. This wasn't a widely available thing in most areas, and it probably wasn't the main end-product for most cocoa beans for most of history, as that alcoholic drink and its many derivatives were a lot more broadly available and widely disseminated. That said, different groups, across this region and across time, including the Maya and the Olmecs, had their own variations of this hot cocoa-like drink, and there's even an Aztec story that Quetzalcoatl was outcast by the other gods in their pantheon for sharing chocolate with humans, and some regional experts have speculated that the ritual of extracting the hearts from human sacrifices in the Aztec empire might be connected to the process of extracting the cocoa pulp from the cocoa bean seed pod when producing this beverage; though that's pretty speculative. The Aztecs came later than a lot of the other cultures in this region that partook in chocolate-related rituals and made cocoa-related goods, so that's likely part of why their rituals surrounding this drink were more elaborate than those of their neighbors, contemporary and forebear, but it's likely that the nature of the bean itself, which only grows in a finite region, about 20 degrees north and south of the equator, also had something to do with it. Because of that limited range, the Aztecs couldn't grow cocoa in their territory, and that meant it was always a luxury import for them, which meant—like many luxuries, even today—only the richest members of society could afford it, and that helped them differentiate themselves from the chocolate-less plebeians. This changed somewhat following the arrival of the Europeans in the Americas, when the Spaniards, who were maybe originally introduced to the drink by Montezuma or one of his underlings, brought the drink back home with them, eventually creating a new market for producers, though Europeans were not initially a fan of it, and mostly seemed to indulge because it seemed exotic, but early on they realized that because this bean already served as a unit of currency in many of the areas they were exploring and exploiting, it allowed them to deal with locals in a familiar way: this many cocoa beans for one thing, this many for another—it made negotiations and payment a lot cleaner and clearer, and cocoa beans could be easily transported for trade while also being useful, in a pinch, as a stable source of food while in transit, which compared favorably to other food goods they were bringing back home from their explorations and invasions, like bananas. What I'd like to talk about today is the modern chocolate market, and a dramatic price increase in cocoa beans that's raising eyebrows and concerns around the world. — The modern chocolate market has expanded in the years since Montezuma and the Spanish conquistadors to cover the whole of the globe, with products based on the cocoa bean on shelves in every country—even shut-ins like North Korea. In 2022, the global chocolate industry was worth something like $116 billion, which is more than double the $50 billion or so it was worth in 2009, and analysts expect this market's compound annual growth rate, which tallies the increase in the industry's return on investment each year, to remain steady at around 3.4%, which is solid, and predicated on the increase in the dark chocolate market, especially amongst health-conscious consumers, and the burgeoning plant-based and vegan chocolate markets, which further reinforce the perception of some chocolate as being a luxurious and healthful indulgence. Such luxury upbranding is key to those CAGR assumptions, as positioning some of these products as more expensive, but better versions of what's long been available allows chocolate companies to sell relatively less product for relatively higher prices, and that means expanding their customer base while also increasing their profit-margins. All of which would be vital for this sort of industry even during normal times, but it's even more important when things are going sideways with an industry's access to raw materials, which seems to be what's happening in the world of chocolate. In the 20th century, especially the late-20th century, the brands that were selling the most chocolate to the most people, globally, started gobbling up their competition. This period of acquisition and consolidation left us with about a dozen big chocolate manufacturers, globally, including names you've almost certainly heard of, like Cadbury, which is the biggest such company in the world, but also Hershey, Mars, Neuhaus, Ferrero, and Milka. Some of these companies, like Nestlé, are what's called bean-to-bar chocolate manufacturers, but most of the titans in this space melt chocolate from other manufacturers into their end-products, only using the bean-to-bar model for a few high-end offerings. But there are a slew of bean-to-bar companies still in operation, today, they just tend to be a lot smaller, because this model requires that they process their own cocoa beans in-house, rather than outsourcing, which tends to be required to achieve the scale that companies like Hershey and Mars have reached; it's a lot more time-intensive and expensive to do it this way. That said, the expansion of the chocolate market into a multi-billion, then more than $100 billion global industry necessitated expanding the footprint of its base-level production beyond its traditional South and Central American origins. Several other locations within that 20 degrees north and south of the equator spectrum have thus seen cocoa trees introduced, but the biggest producer of cocoa, today, is Côte d'Ivoire, the Ivory Coast, in Western Africa, where about 45% of the world's cocoa was cultivated, as of 2022, which amounted to around 2.2 million tonnes that year, alone. Neighboring Ghana comes in second, producing about half as much as Ivory Coast, with about 1.1 million tonnes produced that same year, and Indonesia is a distant third, producing about 667,000 tonnes in 2022. Combined with Ivory Coast's output, Ghana's cocoa bean industry, plus the smaller outputs of nearby Nigeria and Cameroon, account for about 70% of all the cocoa produced anywhere in the world. Ecuador, where the cocoa tree was seemingly first domesticated, is now all the way down in fourth place, producing about 337,000 tonnes of the bean for export in 2022. Because of the nature of how cocoa beans are harvested, and where, chocolate companies have huge sway over local politics and economics, and the folks doing the harvesting have historically not been treated terribly well, and in some cases their ranks have been filled with children. In some such areas, people are trafficked or enslaved and put to work harvesting cocoa beans, and even those who are there of their own behest are paid very little by international standards, not even a living wage (based on the cost of things like shelter and food in their regions), their incomes artificially capped by an agreement with the cocoa bean-buying industry, and though Fair Trade certification has become more common for many chocolate companies, demonstrating their commitment to paying better wages, and in turn allowing the folks producing the raw materials for their chocolates to actually be able to afford to buy chocolate products, which is not the case for those working in non-Fair Trade conditions, that's still not the norm, and in some areas the conditions faced by workers are pretty bleak, many of them children under the age of 15, many of them forced to work for various reasons, and all of them making just enough money to survive, but nothing beyond that, and in some cases, barely that. Most of these beans, the ones that end up in chocolate produced by those bigwig entities that dominate the global chocolate trade, are mixed together with beans from other locations on commodity markets, these companies buying them by the metric ton, similar to other food commodities that are traded in this way, like soybeans, milk, and palm oil. Distinct from most other commodities right now, though, is the increase in price cocoa beans are seeing on these markets. In 2022, the average price for a metric tonne of cocoa beans was somewhere between $2,200 and $2,500. That's of a kind with the typical pricing for the past decade or so, and though there was a massive spike in 1977, which was only about $5,700 per tonne in unconverted money, but that's about $28,000 per tonne if we account for inflation—so that was a pretty bad year for chocolate lovers and companies—but other than that and a few other aberrations through the decades, cocoa beans have been a pretty stable commodity, at least compared to other commodities that are thus traded. In February of 2024, though, cocoa bean prices shot up from those $2,500-ish per tonne prices all the way to around $6,000 per tonne, and then in March cocoa futures hit a record (unconverted for inflation) price of about $10,000 per tonne, which is a staggering leap of something like 4 to 5 times the usual cost. This price jump is being attributed to a confluence of variables, most of them contributing to a series of poor harvests in Ghana and the Ivory Coast, which again, together, account for most of the world's cocoa bean output. The El Niño phenomenon that's been messing with the global water cycle and increasing average global temperatures since July of 2023 is partly the blame here, as are the creeping effects of climate change, which have, in practice, moved the ideal growing areas for all sorts of plants, because of a tweak to the average global temperature knobs that have nudged things higher in most parts of the world, while also making weather patterns more irregular, compared to what we've become used to. Those climate nudges have also allowed diseases to spread faster and to new regions, including those that impact plants. Extreme and unusual rainfall in Western Africa sparked outbreaks of black pod disease, which usually hits after wet season, and all that rain was followed by a period of extreme dryness and drought, which stoked the spread of swollen shoot virus, which reduces output by up to 25% in the first year of infection, up to 50% in the second, and which ultimately kills its hosts, the cocoa trees, and once it spreads to a plantation, the whole plantation, all the trees, usually have to be uprooted and burned, new trees planted in their stead, before things can get up and running again—all of which takes a lot of time and resources. Cocoa manufacturers have been underinvesting in their plantations and smaller cocoa producers for years; so it's not just their workers that they're under-investing in, it's the infrastructure surrounding those workers, which is often decrepit and unsafe, and which has left them prone to these newly aggressive diseases and unusual climate happenings. And a lot of the cocoa produced in these top-producing countries are run by small-holders, not by large-scale plantations. And because these small-holders are often almost as impoverished as the people working on the plantations, they don't have the money to invest in treating disease or uprooting and replacing all their trees, and that's led to a surge in illegal mining operations in cocoa growing areas, because illegal miners come in and say they'll pay the owners of the land where they want to dig a reliable, if still small income, and those landowners don't really have a choice—cocoa doesn't provide them enough money to do more than sustain themselves, so they take what they can get, and every time this happens, that's less prime cocoa-growing land that's being used to grow cocoa. Because of all this, the mid-season crop coming out of Ivory Coast, the biggest producer in the world, is expected to be about a third lower than usual this year, and Ghana's production is expected to hit a 22-year low; hence, those dramatically hiked prices, which have been further inflamed by market maneuvers meant to protect investors from irregularities, but which have the practical effect of raising prices in the short-term, creating more volatility, not less. This price-surge and negative overall outlook for the industry is causing a fair bit of concern for the global chocolate market, which has some stockpiled supply of beans, but which is struggling to account for this increase in overall cost, and is thus attempting to prepare their customers for price hikes and fresh instances of shrinkflation: which basically means selling the same product for the same price, but with less of the product in the package; so maybe a candy bar selling for the same price as before, but the bar is 2/3 its former size. This has been a big discussion topic recently in part because of the recent Easter holiday, which is a big day for chocolate sales in many parts of the Western world in particular, so this situation is topical news, but also because it's representative of what's happening in other commodity and non-commodity markets, as well, as a result of many of the same factors. The global supply of coffee beans has been shrinking since 2021, labor and other systemic issues contributing to that, but the climate also changing where coffee grows best, and thus making life hard on the folks who currently grow most of it, in what were previously the optimal regions for doing so, but which aren't any longer, and may no longer be capable of growing these beans at all in a few decades, the way things are going. Olive oil is likewise seeing record-high prices in 2024, the price of extra virgin olive oil up 70% from a year previous, and 260% from two years ago, due to widespread drought across the Mediterranean, where most olives are grown, and because of a bacteria that's infecting olive trees more enthusiastically than ever before because of all that heat and drought. The banana industry is also raising alarms, too, as the change in global temperatures and the water cycle are combining with a collection of increasingly aggressive diseases and infections that are impacting banana growing regions in Australia, Asia, Africa, and South America, necessitating a clean-sweep approach similar to those used to get a cocoa bean plantation ready to grow, again, post-infection, requiring a lot of additional investment and leading to a lot of waste and diminished expectations. Most of these industries have enough of a backlog and stockpile to keep prices on shelves constant for a while after this sort of hit, but for all of these industries, prices are expected to go up, possibly permanently, because of this seeming new reality, and because of the nature of the entities operating in these spaces, and the systems they've deployed to keep their goods flowing to the entities that turn them into products that end up in stores around the world. So while chocolate is the first to really hit the public consciousness in terms of the companies that own this space trying to prepare their customer base for what's about to happen by making it known that their core prices have grown shockingly high, it's likely we'll continue to see this sort of base-level inflationary impact on all sorts of goods in the coming years, unless something fundamental changes about the variables impacting supply, or the business model they use to sustain their industries. Show Notes https://finance.yahoo.com/news/chocolate-market-size-worth-usd-191300029.html https://www.theguardian.com/environment/2024/mar/29/easter-eggs-chocolate-cacao-harvests-cocoa-prices-aoe https://www.cnbc.com/2024/03/26/cocoa-prices-are-soaring-to-record-levels-what-it-means-for-consumers.html https://archive.ph/YnZH7 https://apnews.com/article/easter-chocolate-africa-farmers-cocoa-ghana-4a4d58a4e6076c8d46258c1b4dc414c4 https://archive.ph/SbWVF https://archive.ph/wPhkk https://www.visualcapitalist.com/worlds-top-cocoa-producing-countries/ https://www.statista.com/statistics/263855/cocoa-bean-production-worldwide-by-region/ https://www.confectioneryproduction.com/news/47651/cocoa-sector-reaches-crisis-point-as-crop-prices-hit-10000-a-tonne/ https://ycharts.com/indicators/cocoa_bean_price https://www.aljazeera.com/gallery/2024/3/30/chocolate-prices-to-keep-rising-as-west-africas-cocoa-crisis-deepens https://investorplace.com/2024/03/olive-oil-coffee-and-cocoa-prices-oh-my-3-grocery-store-items-to-watch/ https://www.bbc.com/news/science-environment-68534309 https://www.ucl.ac.uk/news/2024/mar/analysis-cocoa-beans-short-supply-what-means-farmers-businesses-chocolate-lovers https://www.france24.com/en/live-news/20231220-illegal-mining-smuggling-threaten-ghana-s-cocoa-industry https://www.sciencedirect.com/science/article/pii/S0022316622143798?via%3Dihub https://www.sciencedaily.com/releases/2018/10/181029130945.htm https://en.wikipedia.org/wiki/Chocolate https://en.wikipedia.org/wiki/Cocoa_bean 

This is a public episode. If you’d like to discuss this with other subscribers or get access to bonus episodes, visit letsknowthings.substack.com/subscribe

Social Graph

Download our free app to listen on your phone