We can contain an AI just fine. Sandboxes are effective. Defense in depth works even better, but as you can see we already have a phrase for that. If you “need” harness training as root with internet access to match most user flows… The product team is the threat, actually.

I have encountered fake Facebook spotters groups which their admins are claiming to represent spotter communities of RAF bases hosting U.S. military aircraft. I have investigated admins of these groups extensively. My findings indicate that some of these Facebook groups are operated by Iran and UK based Pakistani nationals who are not plane spotters or even aviation enthusiasts. They are most likely in use of either the IRGC Intelligence Organization or Russian Military Intelligence to monitor U.S. military activities. These concerns extend beyond the United Kingdom. I identified similar groups in the United States and elsewhere that were being moderated by the Chinese intelligence operatives.

U.S. intelligence officials found no evidence that any foreign adversary successfully interfered in the 2024 presidential election, according to sources familiar with the findings of a classified assessment therecord.media/trump-harris…

🚨 The #OSINTSummit 2027 Call for Presentations is OPEN! Have an OSINT case study, tool, technique, research project, or lesson learned worth sharing with the community? ⏰ Submit by Oct. 19 📩 go.sans.org/dPm8qI #OSINT #OpenSourceIntelligence

Frustrating but predictable. It's hard for Russian info ops content to reach a wide audience, but they probably find that they can rely on western journalists to amplify it for them.

Legislative Trojan horses 🇪🇺 Chat Control 1.0 and 2.0 🇪🇺 Social media ban for children 🇪🇺 Addictive design ban for adults 🇪🇺 Combat fraud and serious crime 🇦🇺 Social media ban for children 🇺🇸 Social media ban for children 🇺🇸 Addictive design restrictions for children 🇳🇿 Social media ban for children 🇮🇪 Social media ban for children 🇫🇷 Social media ban for children 🇨🇦 Social media ban for children 🇬🇧 Social media ban for children 🇬🇧 Addictive design restrictions for children 🇬🇧 Child exploitation & grooming protection 🇬🇧 Force platforms to prioritise "trusted" news 🇦🇪 Social media ban for children 🇪🇸 Social media ban for children 🇬🇷 Social media ban for children 🇩🇰 Social media ban for children 🇳🇴 Social media ban for children 🇦🇹 Social media ban for children 🇵🇱 Social media ban for children 🇸🇮 Social media ban for children 🇹🇷 Social media ban for children 🇮🇩 Social media ban for children 🇲🇾 Social media ban for children 🇧🇷 Social media restrictions for children 🇵🇹 Social media restrictions for children 🇮🇳 Social media ban for children 🇸🇪 Social media ban for children 🇩🇪 Social media restrictions for children 🇮🇹 Social media restrictions for children 🇨🇳 Social media restrictions for children I’m sharing this because more journalists have started following my work, and I want to show what I’m exposing through technical analysis anyone can understand. I’m working on one of my most consequential investigations into legislation and technology built for digital surveillance. It’s called Chat Control. What follows looks like coordination between governments and a handful of tech companies. Tech companies get more data to monetise. Governments gain the ability to monitor who says what, to whom, why, where they go and how they spend money. Technical Trojan horses 🇪🇺 Compulsory identity verification 🇪🇺 Scan private communications 🇪🇺 Weaken end to end encryption 🇪🇺 Expand lawful access 🇬🇧 Compulsory identity verification 🇬🇧 Compulsory on-device scanning for every app 🇬🇧 Algorithms to prioritize trusted news sources 🇦🇺 Compulsory identity verification 🇳🇿 Compulsory identity verification 🇮🇪 Compulsory identity verification 🇫🇷 Compulsory identity verification 🇪🇸 Compulsory identity verification 🇬🇷 Compulsory identity verification 🇩🇰 Compulsory identity verification 🇳🇴 Compulsory identity verification 🇦🇹 Compulsory identity verification 🇵🇱 Compulsory identity verification 🇸🇮 Compulsory identity verification 🇹🇷 Compulsory identity verification 🇦🇪 Compulsory identity verification 🇮🇩 Compulsory identity verification 🇲🇾 Compulsory identity verification 🇧🇷 Compulsory identity verification 🇵🇹 Compulsory identity verification 🇨🇦 Compulsory identity verification 🇺🇸 Compulsory identity verification Spot the pattern. 🔞 Australia set the stage. Other countries are now following with "robust" age assurance language in their TV appearances, including the US, UK and Ireland. The US AGs have added it to the proposed legislation following the Meta lawsuit. 💡 Australia’s own standard says age checks must be "technically accurate, robust, and reliable". "Robust" means fault proof. It brings meaning like "best" endeavours. Age estimation can’t meet that standard. As Australia defines it, age verification determines age "to a high level of accuracy", while age estimation only provides an approximate age. Fault proof age checking requires identity verification. Now look at the tech companies and what they built recently. Apple, Google, Meta and Microsoft built identity verification capabilities before governments started saying existing age assurance wasn’t "robust" enough. They knew what was coming. 🪪 Apple has age assurance APIs that can return verified age ranges, including confirmation using government ID, and its Wallet API lets apps verify age or identity from government issued digital ID. 🪪 Google recently built an Age Signals API so apps can receive age ranges and verification status. Android already lets parents block apps by age across the entire device, so this isn’t technically necessary for child safety. Google has also added facial verification to Google Account and Gmail recovery through selfie video matching, presented as account security. 🪪 Meta launched selfie based Facebook verification that checks a video selfie against profile photos and plans to expand it globally. 🪪 Microsoft has rolled out age assurance across Microsoft Accounts using facial age estimation, identity documents and government systems. Refuse to verify and some content and features are blocked. 💭 A handful of tech companies control the operating systems, app stores and identity layers across almost every mobile device. Governments barely need to negotiate outside G7 rooms. If Apple, Google, Meta and Microsoft enforce the same rules, billions of people are instantly impacted. The same technical capability keeps appearing: identify verification. Identity the person first, then decide what they’re allowed to do, who they're allowed to speak to, and when they're allowed to move money. p.s. Anthropic and OpenAI have identity verification services and the US government holds a kill switch that decides who has permission to use AI. --- Let me know if I got anything wrong. I have 60 minutes to make an edit. Or just leave a comment so others can see your correction.

Today at noon EDT I'm launching a book I've been working on for 20 months: Dynamic Incident Response, an iterative IR framework designed for how security teams actually work. Free in all formats. Join me for the launch today: sans.org/engage/dynamic-inci…

Last week I set out every Russian attack on European soil proven in court or formally attributed by a government. Nine cases. Here's the surprising reason why that list may stop growing. NATO has reportedly foiled a Russian operation in the Arctic rehearsing a weapon designed to disable undersea cables without leaving any trace of who did it. Britain, Norway and the United States tracked the vessels and confronted them. Read that again. Designed to leave no fingerprints. Every case on my previous list turned on evidence. Arsonists caught on camera. Parcels traced to a post office in Vilnius. Six people convicted at the Old Bailey on hard evidence. In each case evidence is what made attribution possible. However, a weapon engineered for deniability breaks that chain deliberately. The campaign doesn't stop. It just becomes unprovable. The UK is unusually exposed. Sixty-four cables connect Britain to the world, carrying some £220 billion of financial transactions every day. But it is worse than the number suggests: just two of those cables carry three quarters of our transatlantic capacity. In January last year the Russian survey ship Yantar was found loitering over British cables. Parliament's national security committee has reported on this. It said it was not confident Britain could prevent an attack on these cables, or recover within an acceptable period. That was the warning. So whilst we have spent five years getting better at exposing what Russia is doing. Moscow has spent that time building approaches they believe we won't be able to prove at all.

Seriously not good

We've somehow managed to make it a quarter of a century with this silly hobby project. Thanks to everyone who has helped make this happen - crazy hackers the world over, the wardriving community, and everyone who loves to see the RF spectrum come alive.

This was always going to happen to age verification systems. It wasn’t even so much of a prediction as it was an inevitability. The second half of this is tying actual web usage to real-world ID, and breaches will give us that too, soon.

I've created a site called Dossier Overasselt that will update every 12 hours breaking down this case: dossier-overasselt.pplx.app/ #osint #overasselt

Investigate malicious IPs and report them back to the community. The AbuseIPDB integration for Cortex & TheHive provides confidence scores, report history, and abuse categories. Teams can also report malicious IPs to AbuseIPDB. strangebee.com/integration/a… #AbuseIPDB #TheHive

Some people in the community seem to be fully locked into the idea that there is no risk, no uplift, just hype from AI. I find this totally perplexing, it’s obvious how impactful the technology is. As capability progress continues rapidly we, more than other groups, should be advocating on behalf of people that don’t have the same foundational understanding.

The media is making the same mistake it always does about foreign info ops: framing them as though the goal is to advance a specific political agenda. In reality, the goal is specifically to amplify existing cultural fissures in American society.

One message to @VodafoneUK's #CEO was all it took. Within hours of the disclosure to Mr Taylor's team, the HMD Fuse/#Harmblock+ device appears to have been pulled from Vodafone & Three. It's disappeared from Mozillion too, for reasons unknown. This is what #responsibleDisclosure looks like when a company's commitment to #ChildSafety is genuine rather than a marketing line. Vodafone deserve enormous credit for how they handled this. Swift, decisive, no legal obstruction. One of the most straightforward disclosures I've been involved in; the new yardstick to which all others will be compared. The #HMDFuse should not return to market. Nobody involved in building it appears to have asked the most basic questions about whether it actually safe, not even the then Secretary of State for #DSIT, @peterkyle or @jessphillips - who claimed it was "proven technology" whilst testing the vulnerable device. #HMD's own website still has it advertised at a £50 discount, yet the platform has been offline since July 8th. Thanks to everyone who raised awareness with retweets/quotes.

Sound ON! 🔊 #OnThisDay in 2005 🗓️ One of the great balls 🙌

Shodan Membership sale is live until 2026-08-09 00:00 UTC (~48 hours from now): account.shodan.io/billing/me…

I have warned about this for twenty years while globalists, especially in Germany, dismissed the argument as “not understanding market economics.” And here we go. the-american-interest.com/20…