Forum: Too Lazy BBS

CRYPTO-GRAM, June 15, 2026

From Bruce Schneier@schneier@schneier.com to cryptogram@toolazy.synchro.net on Mon Jun 15 10:31:48 2026

This is a multi-part message in MIME format

--_----------=_MCPart_2124438569
Content-Type: text/plain; charset="utf-8"; format="fixed" Content-Transfer-Encoding: quoted-printable

** CRYPTO-GRAM
JUNE 15=2C 2026
------------------------------------------------------------

by Bruce Schneier
Fellow and Lecturer=2C Harvard Kennedy School
schneier@schneier.com
https://www.schneier.com

A free monthly newsletter providing summaries=2C analyses=2C insights=2C a=
nd commentaries on security: computer and otherwise.

For back issues=2C or to subscribe=2C visit Crypto-Gram's web page [https= ://www.schneier.com/crypto-gram/].

Read this issue on the web [https://www.schneier.com/crypto-gram/archives= /2026/0615.html]

These same essays and news items appear in the Schneier on Security [http= s://www.schneier.com/] blog=2C along with a lively and intelligent comment=
section. An RSS feed is available.

** *** ***** ******* *********** *************

** IN THIS ISSUE:
------------------------------------------------------------

1. Bypassing On-Camera Age-Verification Checks
2. Zero-Day Exploit Against Windows BitLocker
3. Laurie Anderson Is Quoting Me
4. On AI Security
5. macOS Kernel Memory Corruption Exploit
6. CISA Security Leak
7. Identifying People Using Wi-Fi Routers
8. FBI=E2=80=99s 2025 Internet Crime Report
9. Chilling Effects
10. Vulnerability Disclosure in the Age of AI
11. Microsoft Threatening Security Researcher
12. The Intersection of Encryption and AI
13. AI Used to Decrypt Medieval Ciphers
14. Hacking Meta=E2=80=99s AI Chatbot
15. AI Worm
16. Anthropic=E2=80=99s Project Glasswing Update
17. Critical Zcash Vulnerability Found and Fixed
18. GPS As a Key Distribution Platform
19. NSO Group Hacking WhatsApp Despite Court Order
20. Enhanced License Plate Tracking
21. Bernie Sanders=E2=80=99 AI Sovereign Wealth Fund Plan
22. Upcoming Speaking Engagements

** *** ***** ******* *********** *************

** BYPASSING ON-CAMERA AGE-VERIFICATION CHECKS ------------------------------------------------------------

[2026.05.15] [https://www.schneier.com/blog/archives/2026/05/bypassing-o= n-camera-age-verification-checks.html] Some AI-based video age-verificatio=
n checks can be fooled with a fake mustache [https://techcrunch.com/2026/= 05/06/some-kids-are-bypassing-age-verification-checks-with-a-fake-mustache=
/].

** *** ***** ******* *********** *************

** ZERO-DAY EXPLOIT AGAINST WINDOWS BITLOCKER ------------------------------------------------------------

[2026.05.18] [https://www.schneier.com/blog/archives/2026/05/zero-day-ex= ploit-against-windows-bitlocker.html] It=E2=80=99s nasty [https://arstech= nica.com/security/2026/05/zero-day-exploit-completely-defeats-default-wind= ows-11-bitlocker-protections/]=2C but it requires physical access to the c= omputer:

The exploit=2C named YellowKey=2C was published [https://github.com/Nig=

htmare-Eclipse/YellowKey] earlier this week by a researcher who goes by th=
e alias Nightmare-Eclipse. It reliably bypasses default Windows 11 deploym= ents of BitLocker=2C the full-volume encryption protection Microsoft provi=
des to make disk contents off-limits to anyone without the decryption key=
=2C which is stored in a secured piece of hardware known as a trusted plat= form module (TPM). BitLocker is a mandatory protection for many organizati= ons=2C including those that contract with governments.

Slashdot thread [https://tech.slashdot.org/story/26/05/14/0554201/mystery= -microsoft-bug-leaker-keeps-the-zero-days-coming]. And here=E2=80=99s [ht= tps://github.com/Nightmare-Eclipse] Nightmare-Eclipse=E2=80=99s GitHub acc= ount.

** *** ***** ******* *********** *************

** LAURIE ANDERSON IS QUOTING ME ------------------------------------------------------------

[2026.05.19] [https://www.schneier.com/blog/archives/2026/05/laurie-ande= rson-is-quoting-me.html] Not by name=2C but Laurie Anderson quotes me [ht= tps://www.youtube.com/watch?v=3DfBKdCzmcj_0] in one of the tracks of her n=
ew album:

My favorite quote is from a cryptologist who said =E2=80=9CIf you think=

technology will solve your problems=2C you don=E2=80=99t understand techn= ology and you don=E2=80=99t understand your problems.=E2=80=9D

Also in interviews [https://www.cbc.ca/arts/q/laurie-anderson-on-the-fant= astic-and-catastrophic-uses-of-ai-in-art-1.7206120]:

=E2=80=9COf course=2C it=E2=80=99s ridiculous=2C outrageous=2C blah=2C b=

lah=2C blah=2C=E2=80=9D Anderson says about the ad. =E2=80=98But=2C I mean=
=2C my favorite quote on this is from a cryptologist who said=2C =E2=80=98=
If you think technology will solve your problems=2C you don=E2=80=99t unde= rstand technology =C3=82 and you don=E2=80=99t understand your problems.= =E2=80=99 And I think I=E2=80=99m completely on board with that.=E2=80=9D

People are telling me that she has been reciting this quote in performance=
s for years. (I lost track of her since college and her 1981 hit =E2=80=9C=
O Superman [https://www.youtube.com/watch?v=3DVkfpi2H8tOE].=E2=80=9D)

The origins of the quote is from Roger Needham [https://www.instagram.com= /reel/DON4jlfjJIT/]:

If you think cryptography can solve your problem=2C you don=E2=80=99t un=

derstand your problem and you don=E2=80=99t understand cryptography.

I modified the quote in the preface to my 2000 book _Secrets and Lies_ [h= ttps://www.schneier.com/books/secrets-and-lies/]:

A few years ago I heard a quotation=2C and I am going to modify it here:=

If you think technology can solve your security problems=2C then you don= =E2=80=99t understand the problems and you don=E2=80=99t understand the te= chnology.

I can=E2=80=99t tell you why me in 2000 didn=E2=80=99t credit Needham by n= ame. I should have.

I have used the quote pretty consistently since then. Somewhere along the=
line I dropped =E2=80=9Csecurity=E2=80=9D from the phrase=2C and now say=
it more like Anderson quotes me:

If you think technology will solve your problem=2C you don=E2=80=99t und=

erstand your problem and you don=E2=80=99t understand technology.

I sometimes use singular and sometimes use plural. Sometimes I say =E2=80= =9Cthe problem=E2=80=9D and =E2=80=9Cthe technology.=E2=80=9D But I think=
the quote flows better ending with just the word =E2=80=9Ctechnology.=E2= =80=9D

EDITED TO ADD (5/12): It gets weirder. A friend sent me some 1997 emails t=
hat talk about this. Roger Needham wrote: =E2=80=9CButler Lampson and I ea=
ch attribute to the other the remark.=E2=80=9D I wrote: =E2=80=9CRoger Nee= dham claims that Robert Morris said it. Robert Morris claims that Roger Ne= edham said it. No one knows who the originator is.=E2=80=9D I said it fro=
m stage at Defcon that year -- definitely not the originator.

** *** ***** ******* *********** *************

** ON AI SECURITY
------------------------------------------------------------

[2026.05.20] [https://www.schneier.com/blog/archives/2026/05/on-ai-secur= ity.html] Good report [https://berryvilleiml.com/docs/no-security-meter-a= i.pdf]:

Executive Summary: Let=E2=80=99s say you wanted to make sure that your A=

I is secure. Can you just maximize the security and privacy benchmark and=
call it a day? Nope=2C because benchmarks don=E2=80=99t actually work for=
measuring AI capabilities (even when they are NOT emergent systemic prope= rties like security). So let=E2=80=99s take a step back: how do you measur=
e security in the first place? Good question. Over the last 30 years=2C se= curity engineering for software evolved from black box penetration testing=
=2C through whitebox code analysis and architectural risk analysis to de f= acto process-driven standards like the Building Security In Maturity Model=
(BSIMM). Software had a very deep impact on business operations=2C and it=
appears that AI is going to have an even deeper impact. Will a software s= ecurity-like measurement move work for AI? Probably. In the meantime we ca=
n make real progress in AI security by cleaning up our WHAT piles and mana= ging risk by identifying and applying good assurance processes. (Spoiler a= lert: no matter what we do=2C we still don=E2=80=99t get a security meter=
for AI=2C so we need to be extra vigilant about security.)

** *** ***** ******* *********** *************

** MACOS KERNEL MEMORY CORRUPTION EXPLOIT ------------------------------------------------------------

[2026.05.21] [https://www.schneier.com/blog/archives/2026/05/macos-kerne= l-memory-corruption-exploit.html] A group used Anthropic=E2=80=99s Mythos=
AI model to help find [https://blog.calif.io/p/first-public-kernel-memor= y-corruption] a kernel memory corruption vulnerability and exploit on Appl= e=E2=80=99s M5.

News article [https://9to5mac.com/2026/05/14/calif-team-details-how-anthr= opic-mythos-helped-build-a-working-macos-exploit-in-five-days/].

** *** ***** ******* *********** *************

** CISA SECURITY LEAK ------------------------------------------------------------

[2026.05.22] [https://www.schneier.com/blog/archives/2026/05/cisa-securi= ty-leak.html] Crazy story [https://krebsonsecurity.com/2026/05/cisa-admin= -leaked-aws-govcloud-keys-on-github/]:

Until this past weekend=2C a contractor for the Cybersecurity & Infrastr=

ucture Security Agency (CISA) maintained a public GitHub repository that e= xposed credentials to several highly privileged AWS GovCloud accounts and=
a large number of internal CISA systems. Security experts said the public=
archive included files detailing how CISA builds=2C tests and deploys sof= tware internally=2C and that it represents one of the most egregious gover= nment data leaks in recent history.

News article [https://gizmodo.com/the-worst-leak-that-ive-witnessed-u-s-c= ybersecurity-agency-leaves-its-digital-keys-out-in-public-on-github-200076= 0330].

** *** ***** ******* *********** *************

** IDENTIFYING PEOPLE USING WI-FI ROUTERS ------------------------------------------------------------

[2026.05.26] [https://www.schneier.com/blog/archives/2026/05/identifying= -people-using-wi-fi-routers.html] Not identifying people based on their us=
e of Wi-Fi routers=2C but identifying people using Wi-Fi signals [https:/= /gizmodo.com/researchers-issue-warning-about-tech-that-could-turn-every-ro= uter-into-a-potential-means-for-surveillance-2000763181].

This is accomplished through what is known as WiFi sensing [https://wba=

lliance.com/wi-fi-sensing-101-an-introduction/]=2C or the use of WiFi sign=
als to infer information about a physical environment. When radio signals=
like WiFi travel through a space=2C they interact with the objects and pe= ople around them. Those signals can be reflected=2C scattered=2C or absorb=
ed. By analyzing how the signal is expected to behave compared with how it=
is actually received=2C researchers can infer details about the surroundi=
ng environment.

=E2=80=9CBy observing the propagation of radio waves=2C we can create an=

image of the surroundings and of persons who are present=2C=E2=80=9D said=
Thorsten Strufe=2C a KIT professor and study co-author=2C in a press rele=
ase [https://www.kit.edu/kit/english/pi_2025_069_the-spy-who-came-in-from= -the-wifi-beware-of-radio-network-surveillance.php]. =E2=80=9CThis works s= imilar to a normal camera=2C the difference being that in our case=2C radi=
o waves instead of light waves are used for the recognition.=E2=80=9D

** *** ***** ******* *********** *************

** FBI=E2=80=99S 2025 INTERNET CRIME REPORT ------------------------------------------------------------

[2026.05.27] [https://www.schneier.com/blog/archives/2026/05/fbis-2025-i= nternet-crime-report.html] The 2025 Internet Crime Report [https://www.ic= 3.gov/AnnualReport/Reports/2025_IC3Report.pdf] was published a few weeks a= go=2C but I only just saw it.

Lots of interesting statistics.

Press release [https://www.fbi.gov/news/press-releases/cryptocurrency-and= -ai-scams-bilk-americans-of-billions]. News [https://www.wsj.com/tech/cyb= ersecurity/internet-crime-fbi-report-fd7c16e8] articles [https://www.gove= rning.com/key-findings/report-how-cyber-crime-affected-the-u-s-in-2025].

** *** ***** ******* *********** *************

** CHILLING EFFECTS ------------------------------------------------------------

[2026.05.29] [https://www.schneier.com/blog/archives/2026/05/chilling-ef= fects.html] Younger Americans have soured on the second Donald Trump presi= dency [https://thehill.com/homenews/campaign/5759759-young-voters-trump-a= pproval-rating-economy/]=2C but they are not protesting it.

Despite an unpopular Iran war [https://www.pbs.org/newshour/show/new-poll= -shows-growing-number-of-americans-disapprove-of-trumps-handling-of-iran-w=
ar] and an even more unpopular Trump administration [https://www.cnn.com/= 2026/05/05/politics/trump-approval-rating-analysis-vis]=2C college campus=
protests nationwide have gone silent [https://www.bostonglobe.com/2026/0= 4/03/metro/campus-protests-student-activists-no-kings/]. And at many schoo= ls=2C student activism [https://www.theatlantic.com/ideas/2026/03/campus-= protests-trump-iran/686518/] is virtually nonexistent [https://www.thebul= wark.com/p/the-campus-protest-culture-that-targeted-biden-goes-silent-for-= trump-iran-anti-war].

This silence comes in the wake of a relentless Trump administration war on=
campus speech [https://www.insidehighered.com/news/deep-dives/2026/02/24= /war-student-speech] that has involved lawsuits [https://www.usnews.com/n= ews/national-news/articles/trumps-higher-education-crackdown-visa-revocati= ons-dei-bans-lawsuits-and-funding-cuts]=2C arrests [https://www.theguardi= an.com/us-news/2026/apr/17/tufts-rumeysa-ozturk-trump-administration]=2C d= eportations [https://abcnews.com/Politics/foreign-college-students-target= ed-deportation/story?id=3D120210587] and expulsions [https://www.aljazeer= a.com/news/2026/2/13/court-orders-trump-administration-to-facilitate-depor= ted-students-return].

Reports cite a range of complicated factors [https://www.nytimes.com/2026= /04/14/opinion/trump-protest-ai-phones-social-media.html] for the restrain= t=2C from apathy to technology-induced incapacity. But as public policy [= https://www.belfercenter.org/person/bruce-schneier] and law and social sci= ence experts [https://cyber.harvard.edu/people/jpenney]=2C we believe stu= dents aren=E2=80=99t protesting for a very simple reason: They are afraid.=
They are self-censoring and disengaging from campaign activism to avoid p= unitive measures.

In law and social science=2C we call this impact a chilling effect [https= ://firstamendment.mtsu.edu/article/chilling-effect/] -- the behavioral ten= dency for people in face of a threat to self-censor and restrain their act= ivities for self-protection.

It=E2=80=99s increasingly clear to us that these impacts are not incidenta=
l or ancillary to Trump administration policy. Rather=2C the chilling effe=
cts are the point. This is the closest thing to a consistent governing str= ategy in Trump=E2=80=99s second term.

* THE BROADER CHILL OF TRUMP THREATS

Chilling effects can be subtle=2C but today they are everywhere. And it=E2= =80=99s not just students who are chilled by Trump administration threats.

Professors are censoring themselves in lectures and rewriting syllabuses [= https://www.nytimes.com/2026/03/16/us/professors-change-teaching-trump.ht=
ml]. Researchers are stripping grant applications of words that might attr=
act federal scrutiny [https://www.wsj.com/health/scientists-are-removing-= dei-language-to-keep-federal-grants-d092833b]=2C or abandoning the topics=
entirely. Media outlets are modifying [https://www.theguardian.com/comme= ntisfree/2026/mar/17/trump-iran-fcc-brendan-carr] their news coverage [ht= tps://www.theguardian.com/media/2025/nov/27/bbc-donald-trump-corruption-li= ne-removed-from-rutger-bregman-reith-lecture] to avoid Trump lawsuits or s= anctions.

Law enforcement [https://www.theguardian.com/us-news/2026/jan/18/justice-= department-ice-renee-good-george-floyd-minneapolis] and regulatory agencie=
s [https://www.reuters.com/business/finance/us-secs-ex-enforcement-chief-= clashed-with-bosses-before-leaving-sources-say-2026-03-23/] are refusing t=
o investigate Trump-aligned actors inside or outside government=2C and maj=
or national law firms [https://www.washingtonpost.com/national-security/2= 025/10/26/smaller-law-firms-struggle-trump-administration-initiatives/] ar=
e declining cases challenging Trump administration policies.

Publishers are =E2=80=9Cstepping back [https://www.lgbtqnation.com/2026/0= 1/publishers-are-stepping-back-from-lgbtq-books-amid-bans-the-current-gop-= president/]=E2=80=9D from LGBTQ+ books and other progressive subjects. Man=
y in targeted immigrant communities are afraid to leave home to go to work=
[https://www.ksbw.com/article/ice-raids-central-coast-immigrant-home-wor= k/65107406] or school [https://abcnews.com/Politics/heres-immigration-enf= orcement-affecting-school-enrollment-districts/story?id=3D128057477].

In most cases=2C these people and institutions are not being specifically=
targeted or threatened by Trump. But they are afraid=2C and their fear is=
doing the administration=E2=80=99s work for it. They stay silent=2C avoid=
attention and confrontation=2C and look the other way. In other cases=2C=
they change their speech and behavior to accommodate or conform to the ad= ministration=E2=80=99s worldview.

Of course=2C there are counterexamples=2C such as the winter protests in M= inneapolis in response to brutality [https://www.pbs.org/newshour/nation/= watch-live-noem-holds-news-conference-after-deadly-shooting-by-ice-in-minn= eapolis] by agents with U.S. Immigration and Customs Enforcement=2C and th=
e recent =E2=80=9CNo Kings [https://www.youtube.com/shorts/36Ac2RZIbF4]= =E2=80=9D rallies. But even here=2C the broader but less visible trend --=
chilling effects -- is evident.

For instance=2C in recent reporting on the latest No Kings rallies=2C many=
[https://prospect.org/2026/04/08/mass-protest-where-are-the-kids/] media=
outlets [https://murraystatenews.org/206247/opinion/opinion-why-are-ther= e-no-students-at-no-kings/] observed that students were noticeably missing=
[https://www.nytimes.com/2026/04/14/opinion/trump-protest-ai-phones-soci= al-media.html]=2C despite the Trump administration=E2=80=99s unpopularity=
among younger Americans.

* A PERSISTENT STRATEGY

We believe none of this is by accident.

In a new book=2C =E2=80=9CChilling Effects: Repression=2C Conformity=2C an=
d Power in the Digital Age [https://doi.org/10.1017/9781108641784]=2C=E2= =80=9D one of us -- Jon Penney -- explains how law=2C technology=2C and st=
ate and corporate power are weaponized to chill and repress=2C and the dan= gers this poses for the United States and other democratic societies. The=
other -- Bruce Schneier -- has extensively studied [https://dl.acm.org/d= oi/abs/10.5555/2685412] the security infrastructure enabling this.

What we see isn=E2=80=99t gratuitous government cruelty [https://www.thea= tlantic.com/ideas/archive/2018/10/the-cruelty-is-the-point/572104/]=2C cha=
os [https://news.wttw.com/2026/01/20/365-days-chaos-illinois-democrats-re= flect-1st-year-trump-s-2nd-term] or vengeance [https://www.theguardian.co= m/us-news/2026/jan/21/trump-retribution-campaign]. Instead=2C we see a per= sistent strategy to maximize fear and chilling effects in ways that are co= rrosive to freedom and democracy.

Research suggests that surveillance [https://papers.ssrn.com/sol3/papers.= cfm?abstract_id=3D2769645]=2C personal threats [https://doi.org/10.1080/1= 369118X.2023.2289978]=2C uncertainty [https://doi.org/10.1111/risa.16112]=
and abuse of power [https://protectdemocracy.org/work/punishing-corporat= e-expression/] are key factors in doing so [https://www.cambridge.org/cor= e/books/abs/chilling-effects/conformity-theory-of-chilling-effects/15CB195= 7C3C94076BAF2325678AF1376]. The federal government has a clear and systema=
tic pattern of employing these very mechanisms across a number of domains=
far beyond campuses.

They are evident in militarized raids by Immigration and Customs Enforceme=
nt [https://www.nytimes.com/2026/01/28/us/ice-agent-weapons-minneapolis.h=
tml] and in journalists being arrested [https://apnews.com/article/don-le= mon-arrest-minnesota-church-service-d3091fe3d1e37100a7c46573667eb85c] and=
indicted [https://amnesty.ca/urgent-actions/usa-journalists-face-charges= -for-covering-minnesota-protest/] for reporting on protests. They are made=
clear in the long list of political enemies [https://abcnews.com/US/list= -individuals-including-lisa-cook-targeted-trump-administration/story?id=3D= 124968309] the Trump administration has investigated or threatened=2C incl= uding the Federal Reserve chairman [https://www.nytimes.com/2026/04/24/bu= siness/doj-investigation-federal-reserve-powell.html]. And they can also b=
e seen in the weaponization of technology=2C including ramping up surveill= ance to target critics [https://www.nytimes.com/2026/02/13/technology/dhs= -anti-ice-social-media.html] and protestors [https://www.npr.org/2026/03/= 04/nx-s1-5717031/ice-dhs-immigrants-surveillance-confrontation-deportation= -mobile-fortify].

* CORROSIVE TO FREEDOM AND DEMOCRACY

History offers some guidance on impacts.

During the McCarthy era [https://millercenter.org/the-presidency/educatio= nal-resources/age-of-eisenhower/mcarthyism-red-scare]=2C overreaching laws=
[https://levin-center.org/joe-mccarthys-oversight-abuses/]=2C surveillan=
ce [https://www.bbc.com/news/world-us-canada-48218827]=2C and public and=
private sector reprisals [https://firstamendment.mtsu.edu/article/mccart= hyism/] ostensibly targeted alleged communists. But the real aim was often=
to suppress [https://www.archives.gov/publications/prologue/2006/fall/ag= loso.html] progressive journalists=2C trade unions and political oppositio=
n.

In the 1960s=2C these same tactics were reused by Southern states [https:= //digitalcommons.library.uab.edu/cgi/viewcontent.cgi?article=3D1317&contex= t=3Dvulcan] to chill the Civil Rights Movement. Historians have [https://= press.uchicago.edu/ucp/books/book/chicago/N/bo28241907.html] written about=
[https://writing.upenn.edu/%7Eafilreis/50s/schrecker-legacy.html] how th=
e widespread fear and conformity of these periods reshaped American societ=
y in enduring ways=2C including the destruction [https://press.uchicago.e= du/ucp/books/book/chicago/N/bo28241907.html] of progressive political move= ments and both delaying and muting [https://www.bunkhistory.org/resources= /how-mccarthyism-and-the-red-scare-hurt-the-black-freedom-struggle] the Ci=
vil Rights Movement itself.

When such state threats are systematized=2C they can foment a broader clim=
ate of fear=2C self-censorship and conformity. In that climate=2C dissenti=
ng speech=2C political opposition=2C democratic mobilization and other che=
cks on power become increasingly difficult=2C even dangerous. It is no sur= prise=2C for instance=2C that Trump critics regularly admit to self-censor= ship=2C fearing for their safety [https://www.nytimes.com/2025/03/06/us/p= olitics/trump-democracy.html].

Chilling effects are thus not only repressive -- causing self-censorship -=
- but productive. They produce conforming and compliant speech and behavio= r=2C which can have longer-term social impacts. They not only undermine pr= otected rights and suppress accountability but can promote social change -=
- even without a popular mandate to do so.

This latter point is often missed. It explains Trump=E2=80=99s assaults on=
universities and cultural institutions such as the Kennedy Center for the=
Arts [https://www.theguardian.com/us-news/2026/feb/08/trump-kennedy-cent= er-washington-dc] and the Smithsonian [https://www.pbs.org/newshour/polit= ics/trump-amplifies-attacks-on-out-of-control-smithsonian-museums-for-incl= uding-negative-parts-of-american-history]. Often dismissed as peculiar Tru=
mp obsessions [https://www.theguardian.com/commentisfree/2025/mar/20/dona= ld-trump-kennedy-center-takeover-arts]=2C they are fully consistent with P= roject 2025 [https://static.heritage.org/project2025/2025_MandateForLeade= rship_FULL.pdf] -- the sweeping policy blueprint for Trump=E2=80=99s secon=
d term authored by a coalition of conservative groups [https://www.herita= ge.org/press/project-2025-reaches-100-coalition-partners-continues-grow-pr= eparation-next-president] and its call [https://static.heritage.org/proje= ct2025/2025_MandateForLeadership_FULL.pdf] to target the =E2=80=9Cinstitut= ions of American civil society=E2=80=9D and =E2=80=9Cwield federal power= =E2=80=9D to =E2=80=9Creverse=E2=80=9D decades of progressive cultural adv= ancements.

In the near term=2C this means an increasingly weakened democratic society=
=2C with the government and its patrons enjoying freedom to pursue their o= bjectives. Over the long term=2C this can mean a changed society as more c= onformist and compliant speech and culture become more widely accepted and=
entrenched.

* NOT INEVITABLE

In our view=2C this future is not inevitable=2C just as the McCarthy era=
=E2=80=9CRed Scare=E2=80=9D and violent civil rights era repression were=
not. In both cases=2C fear and chilling effects were resisted in law and=
civil society=2C as they can be today.

But the central mechanisms -- surveillance=2C uncertainty=2C personal thre=
ats and abuse of power -- would need to be addressed [https://doi.org/10.= 1017/9781108641784]. For instance=2C new legislation could ensure justice=
for lawless government actors and constrain surveillance. Courts can bloc=
k abuses of federal power=2C including illegal arrests=2C detentions and m=
ass citizen databases.

The media=2C lawyers and civil society can hold the government accountable=
=2E And students=2C teachers=2C universities and cultural institutions can r= esist the tendency to self-censor and conform.

The citizen mobilization in Minnesota and the No Kings rallies are example=
s of that. But to resist chilling effects and their dangers over the long=
term=2C this would have to be the norm=2C not the exception.

_This essay was written with Jon Penney=2C and originally appeared in The=
Conversation [https://theconversation.com/chilling-effects-of-trumps-war= -on-free-speech-extend-far-beyond-campus-walls-and-thats-the-point-283113]= =2E_

** *** ***** ******* *********** *************

** VULNERABILITY DISCLOSURE IN THE AGE OF AI ------------------------------------------------------------

[2026.06.01] [https://www.schneier.com/blog/archives/2026/06/vulnerabili= ty-disclosure-in-the-age-of-ai.html] New article: =E2=80=9CResponsible Dis= closure in the Age of AI: A Call for Urgent Action [https://cyberdefenser= eview.army.mil/Portals/6/Documents/2026-vol11-iss2/CDR_V11_N2_Hathaway.pdf= ]=2C=E2=80=9D by Melissa Hathaway.

Abstract: Artificial intelligence is fundamentally reshaping the balance=

between vulnerability discovery and remediation. Frontier AI models are n=
ow capable of autonomously identifying exploitable software vulnerabilitie=
s at unprecedented speed and scale. This development exposes decades of ac= cumulated technical debt created by a software industry that prioritized r= apid deployment over secure-by-design engineering practices. Drawing on th=
e evolution of software assurance=2C vulnerability disclosure frameworks=
=2C and U.S. cyber policy=2C this perspective argues that the current mome=
nt represents a strategic inflection point for governments=2C industry=2C=
and critical infrastructure operators. The author examines the growing te= nsion between offensive and defensive equities in cyberspace=2C the emerge=
nce of AI-enabled vulnerability discovery capabilities in both the U.S. an=
d China=2C and the increasing risks posed by unsupported legacy systems an=
d AI-assisted code generation practices. Responsible disclosure can no lon=
ger remain a reactive or fragmented process=2C but must become a coordinat=
ed national and international resilience effort involving governments=2C s= oftware vendors=2C infrastructure operators=2C and emergency response orga= nizations. The article concludes with an urgent call for accelerated remed= iation=2C large-scale patch management coordination=2C and sustained inves= tment in automated vulnerability repair capabilities before adversaries ex= ploit this rapidly narrowing window of opportunity.

** *** ***** ******* *********** *************

** MICROSOFT THREATENING SECURITY RESEARCHER ------------------------------------------------------------

[2026.06.02] [https://www.schneier.com/blog/archives/2026/06/microsoft-t= hreatening-security-researcher.html] An anonymous security researcher call=
ed =E2=80=9CNightmare Eclipse=E2=80=9D has been publishing [https://deade= clipse666.blogspot.com/] a series of significant security exploits against=
Microsoft Windows -- including one that breaks [https://arstechnica.com/= security/2026/05/zero-day-exploit-completely-defeats-default-windows-11-bi= tlocker-protections/] BitLocker. Microsoft has threatened [https://www.mi= crosoft.com/en-us/msrc/blog/2026/05/a-shared-responsibility-protecting-cus= tomers-through-coordinated-vulnerability-disclosure] legal action against=
the researcher. Lots of recriminations are being traded [https://techcru= nch.com/2026/05/29/microsoft-under-fire-for-threatening-security-researche= r-with-criminal-investigation/] back and forth.

** *** ***** ******* *********** *************

** THE INTERSECTION OF ENCRYPTION AND AI ------------------------------------------------------------

[2026.06.02] [https://www.schneier.com/blog/archives/2026/06/the-interse= ction-of-encryption-and-ai.html] _As part of their 20th Anniversary celebr= ation=2C _Dark Reading_ [https://www.darkreading.com/cyberattacks-data-br= eaches/cybersecurity-pioneers-ponder-past-prologue] asked five cybersecuri=
ty industry leaders who wrote blogs or columns for them over the years to=
select their favorite piece and share their reflections on the topic toda=
y. This is my section._

Renowned technologist and author Bruce Schneier contributed a column on Ju=
ne 20=2C 2010=2C warning about cryptography=E2=80=99s inability to secure=
modern networks [https://www.darkreading.com/cyber-risk/the-failure-of-c= ryptography-to-secure-modern-networks]=2C a point he says he has been tryi=
ng to argue since 2000.

=E2=80=9CFor a while now=2C I=E2=80=99ve pointed out that cryptography is=
singularly ill-suited to solve the major network security problems of tod=
ay: denial-of-service attacks=2C website defacement=2C theft of credit car=
d numbers=2C identity theft=2C viruses and worms=2C DNS attacks=2C network=
penetration=2C and so on.

=E2=80=9CRecently=2C I talked to a former NSA employee at a conference. He=
told me that back in the 1990s=2C he had a copy of my book _Applied Crypt= ography_ [https://www.schneier.com/books/applied-cryptography] by his des=
k=2C as did many other cryptographers working at Ft. Meade. People were al= lowed to refer to it=2C but they were not allowed to cite it.

=E2=80=9CThe 1990s were an important decade for cryptography. This was bef=
ore the internet went mass market=2C when cryptography was just emerging f=
rom a niche academic discipline to a mainstream engineering one. There was= n=E2=80=99t much that programmers could read. The NSA used my book for the=
same reason it became a bestseller: because it collected all the academic=
cryptography of the time in one place and made it understandable to peopl=
e who weren=E2=80=99t mathematicians. They feared it for exactly the same=
reason.

=E2=80=9CI=E2=80=99ve been thinking about that conversation as I revisit a=
2010 essay I wrote for Dark Reading=2C =E2=80=98The Failure of Cryptograp=
hy to Secure Modern Networks [https://www.darkreading.com/cyber-risk/the-= failure-of-cryptography-to-secure-modern-networks].=E2=80=99 Cryptography=
has inherent mathematical properties that greatly favor the defender. Add=
ing a single bit to the length of a key adds only a slight amount of work=
for the defender but doubles the amount of work the attacker has to do. D= oubling the key length doubles the amount of work the defender has to do (=
if that -- I=E2=80=99m being approximate here) but increases the attacker= =E2=80=99s workload exponentially. For many years=2C we have exploited tha=
t mathematical imbalance.

=E2=80=9CComputer security is much more balanced. There=E2=80=99ll be a ne=
w attack=2C and a new defense=2C and a new attack=2C and a new defense. It= =E2=80=99s an arms race between attacker and defender. And it=E2=80=99s a=
very fast arms race. New vulnerabilities are discovered all the time. The=
balance can tip from defender to attacker overnight=2C and back again the=
night after. Computer security defenses are inherently very fragile.

=E2=80=9CThat isn=E2=80=99t a new idea. I said much the same thing in the=
preface to my 2000 book=2C _Secrets and Lies_:

=E2=80=9C=E2=80=98Cryptography is a branch of mathematics. And like all ma= thematics=2C it involves numbers=2C equations=2C and logic. Security=2C re=
al security that you or I might find useful in our lives=2C involves peopl=
e: things people know=2C relationships between people=2C people and how th=
ey relate to machines. Digital security involves computers: complex=2C uns= table=2C buggy computers.=E2=80=99

=E2=80=9CI especially like how I phrased it in 2016: =E2=80=98Cryptography=
is harder than it looks=2C primarily because it looks like math. Both alg= orithms and protocols can be precisely defined and analyzed. This isn=E2= =80=99t easy=2C and there=E2=80=99s a lot of insecure crypto out there=2C=
but we cryptographers have gotten pretty good at getting this part right.=
However=2C math has no agency; it can=E2=80=99t actually secure anything.=
For cryptography to work=2C it needs to be written in software=2C embedde=
d in a larger software system=2C managed by an operating system=2C run on=
hardware=2C connected to a network=2C and configured and operated by user=
s. Each of these steps brings with it difficulties and vulnerabilities.=E2= =80=99

=E2=80=9CIt=E2=80=99s a lesson we have all learned over the decades. Crypt= ography is still necessary for cybersecurity -- although I wouldn=E2=80=99=
t have used that word back then -- but is not sufficient. There are partic= ular attack and forms of mass surveillance that cryptography prevents. But=
as computers have infused throughout our lives=2C and networks have conne= cted all those computers=2C those aspects of cybersecurity have become inc= reasingly important=2C and vulnerable.

=E2=80=9CToday=2C the cybersecurity world is changing yet again=2C this ti=
me due to the capabilities of artificial intelligence. AI isn=E2=80=99t ad= vancing cryptography=2C but it=E2=80=99s changing cybersecurity. AI has de= monstrated a superhuman ability to find vulnerabilities in software and to=
write exploits. A similar ability to write patches is probably coming. Th=
is has profound implications for both attackers and defenders=2C and it is=
unclear who will win the particular arms race [https://www.csoonline.com= /article/4152133/cybersecurity-in-the-age-of-instant-software.html] in a w= orld of what I call instant software.=E2=80=9D

** *** ***** ******* *********** *************

** AI USED TO DECRYPT MEDIEVAL CIPHERS ------------------------------------------------------------

[2026.06.03] [https://www.schneier.com/blog/archives/2026/06/ai-used-to-= decrypt-medieval-ciphers.html] Researchers are using machine learning algo= rithms to decrypt [https://www.bbc.com/future/article/20260527-plots-love= -letters-and-diplomacy-the-medieval-secrets-being-revealed-by-ai] historic=
al pencil-and-paper ciphers.

** *** ***** ******* *********** *************

** HACKING META=E2=80=99S AI CHATBOT ------------------------------------------------------------

[2026.06.04] [https://www.schneier.com/blog/archives/2026/06/hacking-met= as-ai-chatbot.html] Hackers are convincing [https://techcrunch.com/2026/0= 6/01/hackers-hijacked-instagram-accounts-by-tricking-meta-ai-support-chatb= ot-into-granting-access/] Meta=E2=80=99s AI support chatbot to let them ta=
ke over other peoples=E2=80=99 accounts:

A video [https://x.com/DarkWebInformer/status/2061253599758315527] post=

ed on X showed the step-by-step process to hack someone=E2=80=99s Instagra=
m account. The hacker allegedly used a VPN to spoof the targets=E2=80=99 p= resumed location to avoid triggering Instagram=E2=80=99s automated account=
protections. Then=2C the hacker opened a chat with Meta AI Support Assist=
ant and asked the bot to add a new email address to the target=E2=80=99s a= ccount. The chatbot can be seen sending a verification code to the email a= ddress provided by the hacker; the hacker then shares the verification cod=
e with the chatbot=2C which prompts the chatbot to show a button to =E2=80= =9CReset Password.=E2=80=9D The hacker enters a new password and takes ove=
r the victim=E2=80=99s account.

[...]

On Monday=2C Instagram spokesperson Andy Stone said in a reply [https:/=

/x.com/andymstone/status/2061489833441145103] to Wong=E2=80=99s post and o= thers that the issue was now fixed. It=E2=80=99s unclear how many Instagra=
m users had their accounts improperly accessed.

It=E2=80=99s not that easy. Probably this particular tactic is now blocked=
=2E But there are others=2C many others=2C and they cannot be blocked as a c= lass. The real problem is that LLM chatbots are not trustworthy enough for=
this application.

Another news article [https://www.404media.co/hackers-simply-asked-meta-a= i-to-give-them-access-to-high-profile-instagram-accounts-it-worked/].

** *** ***** ******* *********** *************

** AI WORM
------------------------------------------------------------

[2026.06.05] [https://www.schneier.com/blog/archives/2026/06/ai-worm.htm=
l] Researchers have prototyped [https://cleverhans.io/worm] an AI-powered=
internet worm [https://www.nytimes.com/2026/06/02/technology/scientists-= find-way-to-supercharge-dangerous-computer-worms-with-ai.html].

The coolest thing about the prototype is that it carries its own LLM with=
it=2C and runs it on computers that have been broken into.

This is the closest to John Brunner=E2=80=99s original 1975 conception [h= ttps://en.wikipedia.org/wiki/The_Shockwave_Rider] of a computer worm that=
I=E2=80=99ve seen.

** *** ***** ******* *********** *************

** ANTHROPIC=E2=80=99S PROJECT GLASSWING UPDATE ------------------------------------------------------------

[2026.06.08] [https://www.schneier.com/blog/archives/2026/06/anthropics-= project-glasswing-update.html] In April=2C Anthropic initated Project Glas= swing [https://www.anthropic.com/glasswing]. The idea was to let companie=
s use their new model to find and fix vulnerabilities in their own softwar=
e. It was a fantastic PR move=2C and so many press outlets have uncritical=
ly parroted Anthropic=E2=80=99s claims that it=E2=80=99s now common wisdom=
that Mythos is better at finding software vulnerabilities than other mode=
ls. Which is just not [https://www.theguardian.com/commentisfree/2026/may= /08/how-dangerous-is-anthropics-mythos-ai] true [https://spectrum.ieee.or= g/ai-cybersecurity-mythos].

In any case=2C Anthropic has published [https://www.anthropic.com/researc= h/glasswing-initial-update] a Project Glasswing status report. It=E2=80=99=
s finding a lot [https://www.securityweek.com/anthropic-mythos-detected-2= 3000-potential-vulnerabilities-across-1000-oss-projects/] of vulnerabiliti=
es in software -- yay! Some of them are even dangerous. But almost none of=
them has been patched. It=E2=80=99s weird [https://www.flyingpenguin.com= /mythos-grading-mythos-got-patches-yet/]. There=E2=80=99s something fishy=
about the data that I don=E2=80=99t understand. That Anthropic refuses to=
release details -- that it just says =E2=80=9Ctrust us=E2=80=9D -- is a b=
ig problem [https://www.schneier.com/blog/archives/2026/04/mythos-and-cyb= ersecurity.html] here.

** *** ***** ******* *********** *************

** CRITICAL ZCASH VULNERABILITY FOUND AND FIXED ------------------------------------------------------------

[2026.06.08] [https://www.schneier.com/blog/archives/2026/06/critical-zc= ash-vulnerability-found-and-fixed.html] If you=E2=80=99re a user -- owner?=
-- of this cryptocurrency=2C this [https://securityaffairs.com/193224/ha= cking/claude-opus-found-a-four-year-old-hole-in-zcashs-privacy-layer-nobod= y-knows-if-someone-already-used-it.html] is important:

On May 29=2C the security researcher Taylor Hornby found a critical vuln=

erability in Zcash Orchard privacy pool using Claude Opus 4.8. The Zcash t=
eam hired Hornby specifically to look for this kind of issue. He found one=
fast enough to be embarrassing.

The Orchard pool is the newest and most advanced shielded transaction sy=

stem in the cryptocurrency Zcash. Introduced in 2022=2C it allows users to=
send and receive ZEC while keeping transaction details private. It uses z= ero-knowledge proofs to validate transactions without revealing amounts or=
participants. The bug: a specific check that was supposed to validate tra= nsaction inputs wasn=E2=80=99t actually enforcing the rules it appeared to=
enforce. An attacker could have exploited the flaw to feed false inputs i=
nto that check and generate ZEC from nothing=2C with the zero-knowledge pr=
oof system blessing the fraudulent transaction as valid.

It=E2=80=99s fixed; that=E2=80=99s the good news. The bad news is that the= re=E2=80=99s no way of knowing if anyone exploited the vulnerability to st=
eal money. And this fragility is the fundamental problem that makes blockc= hain such a bad idea.

** *** ***** ******* *********** *************

** GPS AS A KEY DISTRIBUTION PLATFORM ------------------------------------------------------------

[2026.06.09] [https://www.schneier.com/blog/archives/2026/06/gps-as-a-ke= y-distribution-platform.html] This [https://www.404media.co/the-u-s-milit= ary-quietly-turned-gps-into-a-global-numbers-station-evidence-suggests/] i=
s interesting:

The U.S. military has likely been quietly broadcasting codes for its glo=

bal encryption network using public GPS for nearly 20 years=2C turning eac=
h satellite into a hidden =E2=80=9Cnumbers station=2C=E2=80=9D according t=
o Steven Murdoch...

That means every device that uses GPS has been receiving hidden governme=

nt information for years=2C and nobody outside the military knew it until=
now.

[...]

Murdoch discovered that this particular sentinel was transmitted by all=

31 operational satellites within a window of a few hours on May 26=2C 201= 1=2C potentially heralding the activation of a new operational system. He=
confirmed that this timeline coincided with the rollout of the military= =E2=80=99s Over-the-Air Distribution (OTAD) and the Over-the-Air Rekeying=
(OTAR) by cross-referencing declassified documents=2C including a 2015 pr= esentation about the dates of the operation.

=E2=80=9CThere was a perfect match between the timeline and that present=

ation and the change points that were automatically identified from the da= ta=2C=E2=80=9D Murdoch said. =E2=80=9CThat was the smoking gun that made m=
e think: This is what it=E2=80=99s for.=E2=80=9D

These automated systems replaced the cumbersome manual distribution of c=

ryptographic keying material=2C allowing military GPS receivers around the=
world to be rekeyed remotely through satellite broadcasts rather than thr= ough onsite procedures.

** *** ***** ******* *********** *************

** NSO GROUP HACKING WHATSAPP DESPITE COURT ORDER ------------------------------------------------------------

[2026.06.10] [https://www.schneier.com/blog/archives/2026/06/nso-group-h= acking-whatsapp-despite-court-order.html] WhatsApp has caught [https://ww= w.securityweek.com/whatsapp-catches-spyware-firm-nso-defying-no-hacking-co= urt-order/] the NSO Group phishing its users=2C in violation of a court or= der.

** *** ***** ******* *********** *************

** ENHANCED LICENSE PLATE TRACKING ------------------------------------------------------------

[2026.06.11] [https://www.schneier.com/blog/archives/2026/06/enhanced-li= cense-plate-tracking.html] The surveillance company Leonardo wants more da=
ta [https://www.404media.co/this-company-will-add-phone-airpod-and-smartw= atch-trackers-to-license-plate-readers/]:

A surveillance company plans to add sensors to automatic license plate r=

eaders (ALPRs) that would mean the devices=2C as well as capture the licen=
se plate of passing vehicles=2C would also sweep up unique identifiers of=
mobile phones=2C wearables=2C and other Bluetooth-enabled devices in thos=
e cars=2C potentially letting law enforcement identify specific drivers or=
passengers.

The technology=2C called SignalTrace=2C would turn ALPR cameras from dev=

ices focused on tracking cars to ones that can more readily track the loca= tion of particular people. ALPR cameras have become a commonly deployed te= chnology all across the U.S.; SignalTrace would make some of those cameras=
capable of collecting much more data.

Yes=2C it=E2=80=99s bad that more companies are collecting this level of s= urveillance data. But all of this pales in comparison to the type and quan= tity of data our smartphones already collect about us.

Alternate link [https://archive.ph/zdl0s#selection-633.18-633.25].

** *** ***** ******* *********** *************

** BERNIE SANDERS=E2=80=99 AI SOVEREIGN WEALTH FUND PLAN ------------------------------------------------------------

[2026.06.12] [https://www.schneier.com/blog/archives/2026/06/bernie-sand= ers-ai-sovereign-wealth-fund-plan.html] Let no one accuse Bernie Sanders o=
f ducking the big questions. Writing in the New York Times last week=2C th=
e senator asked [https://www.nytimes.com/2026/06/01/opinion/artificial-in= telligence-bernie-sanders.html]: =E2=80=9CWill the future of humanity be d= etermined by a handful of billionaires who have promoted and developed AI=
=2C with virtually no democratic input=2C who stand to become even richer=
and more powerful than they are today?=E2=80=9D

We agree entirely that this is one of the most potent questions facing glo=
bal democracy today. Our book=2C Rewiring Democracy [https://mitpress.mit= =2Eedu/9780262049948/rewiring-democracy/]=2C surveys the emerging uses for a= nd impacts of AI in democracy around the world and reaches the same conclu= sion: that the most urgent risk posed by AI is the concentration [https:/= /www.contrariannews.org/p/how-to-build-ai-for-democracy] of power=2C wealt=
h and control among tech oligarchs.

And yet we reached a vastly different conclusion than Sanders on what to d=
o about it.

The senator points to a once radical but increasingly popular solution: cr= eating a US sovereign wealth fund by taking 50% stock in AI companies such=
as Anthropic=2C OpenAI and xAI. The argument in favor of this is twofold.=
One: it would establish democratic control over the AI companies=2C givin=
g the government =E2=80=9Cthe power=2C through its voting shares and an eq=
ual representation on each company=E2=80=99s board=2C to block decisions t=
hat hurt our citizens and to push for policies that help them.=E2=80=9D Tw=
o: it would return a big chunk of the economic rewards of soaring AI valua= tions to the public=2C ensuring =E2=80=9Ctrillions of dollars potentially=
generated by AI are used to improve the lives of all of us.=E2=80=9D

We laud both these goals unreservedly.

We wholeheartedly agree that there must be public influence over the devel= opment and use of AI=2C just as we demand the government intervene to ensu=
re that automakers=2C drugmakers=2C airlines and other industries balance=
profitability with public safety and the public interest. And we credit t=
he senator with recognizing that there are more levers for the government=
to pull beyond the promulgation of regulation to achieve this.

And we also agree that the obscene=2C dangerous accumulation of wealth amo=
ng AI companies needs to be disrupted. As OpenAI and Anthropic race [http= s://www.nbcnews.com/business/corporations/anthropic-files-ipo-openai-rcna3= 47897] to be minted as the world=E2=80=99s latest trillion-dollar AI compa= nies=2C we should recognize that -- whether or not it constitutes a bubble=
[https://www.fastcompany.com/91551762/stock-market-ai-bubble-recent-warn= ing-sign-sp-500-mag-seven] -- these staggering market capitalizations repr= esent a transfer of wealth. The flow of money goes from the smaller busine= sses and actual people using AI=2C and being subjected to it=2C to the own=
ers of these tech companies.

That includes the world=E2=80=99s 86 AI billionaires [https://www.forbes.= com/sites/phoebeliu/2026/03/10/meet-the-45-ai-newcomers-to-forbes-2026-bil= lionaires-list/] =E2=80=9Cseeking to maximize their power and profit=E2=80=
=9D aiming to decide the =E2=80=9Cfate of humanity... behind closed doors=
in Silicon Valley=2C=E2=80=9D as Sanders said.

And yet=2C while we do not outright oppose the taking of AI company stock=
=2C or of a US sovereign wealth fund=2C there are better ways to achieve S= anders=E2=80=99 stated goals.

Public ownership of these companies entangles corporate profit and valuati=
on with the public interest. It would incentivize the government to clear=
regulations=2C permit the exploitation of workers and users=2C suppress c= ompetition=2C encourage AI adoption regardless of the responsibleness of t=
he implementation or appropriateness of the use case=2C and otherwise act=
on behalf of corporate interests.

After all=2C if growing=2C say=2C Nvidia from its first $5tn in value to i=
ts next $5tn also represents a doubling in value of this segment of the so= vereign wealth fund=2C then you can expect the fund managers to support ch=
ip sales=2C foreign and domestic=2C with the same zeal as the company=E2= =80=99s private investors.

This is not an effective way to influence corporations to act in the publi=
c interest. In fact=2C it makes corporate influence on the government more=
likely.

We should be wary of this possibility because we=E2=80=99ve seen it before=
=2E Ownership of substantial stakes in oil companies by the Norwegian sovere= ign wealth fund=2C the world=E2=80=99s largest [https://www.swfinstitute.= org/fund-rankings/sovereign-wealth-fund]=2C does not seem to have steered=
those corporations to pro-environmental policies. Instead=2C the Norwegia=
n government=E2=80=99s dependence on those companies has inhibited [https= ://www.sciencedirect.com/science/article/pii/S221462962600201X] them from=
taking climate action. Here in the US=2C public employee pension funds me=
rit the same criticism [https://jacobin.com/2018/10/sovereign-wealth-fund= -social-bruenig-socialism%5C]: the fiduciary duty to generate wealth overw= helms any intention to direct their corporate holdings in the public inter= est.

A better answer is to separate the two goals. The standard way to share pr= ivate rewards with the broader society that made them possible is taxation=
=2E Senator Elizabeth Warren has proposed [https://time.com/article/2026/05= /27/why-we-need-to-tax-ai/] an excise tax on datacenters=E2=80=99 energy u=
se. Others have proposed an AI token tax [https://finance.yahoo.com/econo= my/policy/articles/shark-tank-billionaire-mark-cuban-220000476.html]=2C wh=
ich has much the same effect.

As to the goal of reshaping AI in the public interest=2C we have proposed=
[https://foreignpolicy.com/2023/06/12/ai-regulation-technology-us-china-= eu-governance/] an AI Public Option. The concept [https://www.brookings.e= du/articles/how-public-ai-can-strengthen-democracy/] is for governments=2C=
be it federal or state [https://www.techpolicy.press/why-us-states-are-t= he-best-labs-for-public-ai/]=2C to establish publicly developed and operat=
ed AI models run by public institutions under democratic control. The idea=
is not to eliminate corporate AI or to seize it as a public asset=2C but=
rather for government to provide a competitive baseline that private AI o= fferings must meet or exceed to win business -- just like the notion of a=
healthcare [https://www.cbo.gov/publication/57125] public option.

The Swiss have trailblazed this approach. Apertus [https://therenovator.s= ubstack.com/p/rewiring-democracy-now-switzerland] is a large language mode=
l built by Swiss public servants=2C researchers at Swiss universities=2C u= sing appropriately licensed training data and pre-existing Swiss public su= percomputing infrastructure powered by renewable energy.

While Apertus doesn=E2=80=99t seriously compete with the latest OpenAI and=
Anthropic models on performance benchmarks=2C it blows them out of the wa=
ter in transparency=2C sustainability and compliance with EU regulations i= ncluding adherence to copyright. It=E2=80=99s a nascent project=2C but sug= gestive of how public institutions can apply competitive pressure for corp= orate actors to behave responsibly.

Don=E2=80=99t confuse public AI with =E2=80=9Csovereign AI [https://blogs= =2Envidia.com/blog/what-is-sovereign-ai/]=2C=E2=80=9D the notion that every=
country needs to invest in domestic AI infrastructure. Sovereign AI is of=
ten invoked as a marketing scheme [https://www.theglobeandmail.com/busine= ss/commentary/article-openai-tumbler-ridge-chatgpt/] for big tech companie=
s looking to sell to governments; it demands public investment without gua= ranteeing public control.

Sanders is a bold and savvy political operator. So why is he pursuing the=
sovereign wealth fund strategy when he must be aware of these risks? It m=
ay be due to another argument he makes in his op-ed: that the Trump admini= stration and the billionaire owners of AI are aligned to the idea.

It=E2=80=99s expedient to capitalize on rare moments of seeming alignment=
across diverse political factions=2C but it also behooves us to ask why t=
he AI billionaires are open to this extraordinary intervention. The answer=
=2C of course=2C is that they believe that for every dollar ceded to gover= nment stock expropriation=2C they will get back more in favorable governme=
nt policies to protect that newfound investment.

Energy taxation is a straightforward way to make AI companies pay for the=
social disruption of their technologies. Public AI represents a non-monet=
ary mechanism for governments to shape the development of AI=2C complement=
ary to direct regulation of private actors=2C one with a far greater chanc=
e of influencing corporate behavior towards the public interest. We urge S= anders and other political leaders to consider them.

_This essay was written with Nathan E. Sanders=2C and originally appeared=
in The Guardian [https://www.theguardian.com/commentisfree/2026/jun/08/b= ernie-sanders-ai-sovereign-wealth-fund-plan]._

** *** ***** ******* *********** *************

** UPCOMING SPEAKING ENGAGEMENTS ------------------------------------------------------------

[2026.06.14] [https://www.schneier.com/blog/archives/2026/06/upcoming-sp= eaking-engagements-57.html] This is a current list of where and when I am=
scheduled to speak:

* I=E2=80=99m giving a keynote at Cybernation 2026 [https://wirtscha= ftsrat.de/de/hoehepunktveranstaltungen/wir-bauen-die-cybernation-von-der-v= ision-zur-wirkung/] in Berlin=2C Germany=2C on June 24=2C 2026.
* I=E2=80=99m speaking at the Potsdam Conference on National Cybersec= urity [https://potsdamer-sicherheitskonferenz.de/] at the Hasso Plattner=
Institut in Potsdam=2C Germany. The event runs June 24-25=2C 2026=2C and=
my talk will be the evening of June 24.
* I=E2=80=99m participating in a panel discussion at the Austrian Ins= titute for International Affairs [https://www.oiip.ac.at/en/events/disrup= tion-or-singularity-ai-security-and-governance-in-the-21st-century/] in Vi= enna on Thursday=2C June 25=2C 2026.
* I=E2=80=99m speaking at the Digital Humanism Conference [https://d= ighum.wien/] in Vienna=2C Austria=2C on Friday=2C June 26=2C 2026.
* I=E2=80=99m giving a fireside chat for Epicenter Works=2C to be hel=
d at Kaffee Alt Wien [https://pretix.eu/epicenter-works/Fireside-Chat-Bru= ce-Schneier/] in Vienna=2C Austria=2C on Friday=2C June 26=2C 2026.
* I=E2=80=99m participating (via Zoom) in a panel discussion at Quant= um.Tech World [https://www.alphaevents.com/events-quantumtechus/] in Bost= on=2C Massachusetts=2C USA=2C on Friday=2C June 26=2C 2026. The topic is=
=E2=80=9CQ-Day=E2=80=99s Shortening Deadline: Immediate Solutions.=E2=80=
=9D
* I=E2=80=99m speaking at Czech Technical University [https://akce.c= vut.cz/?node=3Dcal_item&idevent=3D10047&lang=3Den] in Prague=2C Czechia=2C=
on Monday=2C June 29=2C 2026.
* I=E2=80=99m speaking at the Nuremberg Digital Festival [https://nu= ernberg.digital/de/] in Nuremburg=2C Germany=2C on Wednesday=2C July 1=2C=
2026.
* I=E2=80=99m speaking at CanSecWest 2026 [https://www.secwest.net/]=
in Vancouver=2C Canada. The conference runs September 30-October 1=2C 202=
6; the time of my talk is TBD.

The list is maintained on this page [https://www.schneier.com/events/].

** *** ***** ******* *********** *************

Since 1998=2C CRYPTO-GRAM has been a free monthly newsletter providing sum= maries=2C analyses=2C insights=2C and commentaries on security technology.=
To subscribe=2C or to read back issues=2C see Crypto-Gram's web page [ht= tps://www.schneier.com/crypto-gram/].

You can also read these articles on my blog=2C Schneier on Security [http= s://www.schneier.com].

Please feel free to forward CRYPTO-GRAM=2C in whole or in part=2C to colle= agues and friends who will find it valuable. Permission is also granted to=
reprint CRYPTO-GRAM=2C as long as it is reprinted in its entirety.

Bruce Schneier is an internationally renowned security technologist=2C cal=
led a security guru by the _Economist_. He is the author of over one dozen=
books -- including his latest=2C _Rewiring Democracy_ [https://www.schne= ier.com/books/rewiring-democracy/] -- as well as hundreds of articles=2C e= ssays=2C and academic papers. His newsletter and blog are read by over 250= =2C000 people. Schneier is a fellow at the Berkman Klein Center for Intern=
et & Society at Harvard University; a Lecturer in Public Policy at the Har= vard Kennedy School; a board member of the Electronic Frontier Foundation=
=2C AccessNow=2C and the Tor Project; and an Advisory Board Member of the=
Electronic Privacy Information Center and VerifiedVoting.org. He is the C= hief of Security Architecture at Inrupt=2C Inc.

Copyright (c) 2026 by Bruce Schneier.

** *** ***** ******* *********** *************

Mailing list hosting graciously provided by MailChimp [https://mailchimp.= com/]. Sent without web bugs or link tracking.

This email was sent to: cryptogram@toolazy.synchro.net

_You are receiving this email because you subscribed to the Crypto-Gram ne= wsletter._

Unsubscribe from this list: https://schneier.us18.list-manage.com/unsubscr= ibe?u=3Df99e2b5ca82502f48675978be&id=3D22184111ab&t=3Db&e=3D70f249ec14&c=3Dd= 73370a38e

Update subscription preferences: https://schneier.us18.list-manage.com/pro= file?u=3Df99e2b5ca82502f48675978be&id=3D22184111ab&e=3D70f249ec14&c=3Dd73370= a38e

Bruce Schneier
Harvard Kennedy School
1 Brattle Square
Cambridge=2C MA 02138
USA
--_----------=_MCPart_2124438569
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html><html lang=3D"en"><head><meta charset=3D"UTF-8"><title>Cryp= to-Gram=2C June 15=2C 2026</title></head><body>
<div class=3D"preview-text" style=3D"display:none !important;mso-hide:all;= font-size:1px;line-height:1px;max-height:0px;max-width:0px;opacity:0;overf= low:hidden;">A monthly newsletter about cybersecurity and related topics.<= /div>
<h1 style=3D"font-size:140%">Crypto-Gram 
June 15=2C 20= 26</h1>

by Bruce Schneier
 Fellow and Lecturer=2C Harvard Kennedy School
 schneier@schneier.com
 <a href=3D"https://www.schneier.com">https://www.schneier.com</a>

A free monthly newsletter providing summaries=2C analyses=2C insights=
=2C and commentaries on security: computer and otherwise.

For back issues=2C or to subscribe=2C visit <a href=3D"https://www.schn= eier.com/crypto-gram/">Crypto-Gram's web page</a>.

<a href=3D"https://www.schneier.com/crypto-gram/archives/2026/0615.html= ">Read this issue on the web</a>

These same essays and news items appear in the <a href=3D"https://www.s= chneier.com/">Schneier on Security</a> blog=2C along with a lively and int= elligent comment section. An RSS feed is available.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"toc"><a name=3D"toc">I=
n this issue:</a></h2>

If these links don't work in your email client=2C try <a href=3D"ht= tps://www.schneier.com/crypto-gram/archives/2026/0615.html">reading this i= ssue of Crypto-Gram on the web.</a>

<li><a href=3D"#cg1">Bypassing On-Camera Age-Verification Checks</a></li> <li><a href=3D"#cg2">Zero-Day Exploit Against Windows BitLocker</a></li>
<li><a href=3D"#cg3">Laurie Anderson Is Quoting Me</a></li>
<li><a href=3D"#cg4">On AI Security</a></li>
<li><a href=3D"#cg5">macOS Kernel Memory Corruption Exploit</a></li>
<li><a href=3D"#cg6">CISA Security Leak</a></li>
<li><a href=3D"#cg7">Identifying People Using Wi-Fi Routers</a></li>
<li><a href=3D"#cg8">FBI=E2=80=99s 2025 Internet Crime Report</a></li>
<li><a href=3D"#cg9">Chilling Effects</a></li>
<li><a href=3D"#cg10">Vulnerability Disclosure in the Age of AI</a></li>
<li><a href=3D"#cg11">Microsoft Threatening Security Researcher</a></li>
<li><a href=3D"#cg12">The Intersection of Encryption and AI</a></li>
<li><a href=3D"#cg13">AI Used to Decrypt Medieval Ciphers</a></li>
<li><a href=3D"#cg14">Hacking Meta=E2=80=99s AI Chatbot</a></li>
<li><a href=3D"#cg15">AI Worm</a></li>
<li><a href=3D"#cg16">Anthropic=E2=80=99s Project Glasswing Update</a></li=

<li><a href=3D"#cg17">Critical Zcash Vulnerability Found and Fixed</a></li=

<li><a href=3D"#cg18">GPS As a Key Distribution Platform</a></li>
<li><a href=3D"#cg19">NSO Group Hacking WhatsApp Despite Court Order</a></=

<li><a href=3D"#cg20">Enhanced License Plate Tracking</a></li>
<li><a href=3D"#cg21">Bernie Sanders=E2=80=99 AI Sovereign Wealth Fund Pla= n</a></li>
<li><a href=3D"#cg22">Upcoming Speaking Engagements</a></li>
</ol>

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg1"><a name=3D"cg1">B= ypassing On-Camera Age-Verification Checks</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/05/bypassing-on-= camera-age-verification-checks.html">[2026.05.15]</a> So=
me AI-based video age-verification checks can be fooled with a <a href=3D"= https://techcrunch.com/2026/05/06/some-kids-are-bypassing-age-verification= -checks-with-a-fake-mustache/">fake mustache</a>.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg2"><a name=3D"cg2">Z= ero-Day Exploit Against Windows BitLocker</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/05/zero-day-expl= oit-against-windows-bitlocker.html">[2026.05.18]</a> It= =E2=80=99s <a href=3D"https://arstechnica.com/security/2026/05/zero-day-ex= ploit-completely-defeats-default-windows-11-bitlocker-protections/">nasty<= /a>=2C but it requires physical access to the computer:

<blockquote>The exploit=2C named YellowKey=2C was <a href=3D"https://gi= thub.com/Nightmare-Eclipse/YellowKey">published</a> earlier this week by a=
researcher who goes by the alias Nightmare-Eclipse. It reliably bypasses=
default Windows 11 deployments of BitLocker=2C the full-volume encryption=
protection Microsoft provides to make disk contents off-limits to anyone=
without the decryption key=2C which is stored in a secured piece of hardw=
are known as a trusted platform module (TPM). BitLocker is a mandatory pro= tection for many organizations=2C including those that contract with gover= nments.</blockquote>

Slashdot <a href=3D"https://tech.slashdot.org/story/26/05/14/0554201/my= stery-microsoft-bug-leaker-keeps-the-zero-days-coming">thread</a>. And <a=
href=3D"https://github.com/Nightmare-Eclipse">here=E2=80=99s</a> Nightmar= e-Eclipse=E2=80=99s GitHub account.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg3"><a name=3D"cg3">L= aurie Anderson Is Quoting Me</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/05/laurie-anders= on-is-quoting-me.html">[2026.05.19]</a> Not by name=2C b=
ut Laurie Anderson <a href=3D"https://www.youtube.com/watch?v=3DfBKdCzmcj_= 0">quotes me</a> in one of the tracks of her new album:

<blockquote>My favorite quote is from a cryptologist who said =E2=80=9C=
If you think technology will solve your problems=2C you don=E2=80=99t unde= rstand technology and you don=E2=80=99t understand your problems.=E2=80=9D= </blockquote>

Also in <a href=3D"https://www.cbc.ca/arts/q/laurie-anderson-on-the-fan= tastic-and-catastrophic-uses-of-ai-in-art-1.7206120">interviews</a>:

<blockquote>=E2=80=9COf course=2C it=E2=80=99s ridiculous=2C outrageous=
=2C blah=2C blah=2C blah=2C=E2=80=9D Anderson says about the ad. =E2=80=98= But=2C I mean=2C my favorite quote on this is from a cryptologist who said=
=2C =E2=80=98If you think technology will solve your problems=2C you don= =E2=80=99t understand technology =C3=82 and you don=E2=80=99t understand y=
our problems.=E2=80=99 And I think I=E2=80=99m completely on board with th= at.=E2=80=9D</blockquote>

People are telling me that she has been reciting this quote in performa= nces for years. (I lost track of her since college and her 1981 hit =E2=80= =9C<a href=3D"https://www.youtube.com/watch?v=3DVkfpi2H8tOE">O Superman</a= >.=E2=80=9D)

The origins of the quote is from <a href=3D"https://www.instagram.com/r= eel/DON4jlfjJIT/">Roger Needham</a>:

<blockquote>If you think cryptography can solve your problem=2C you don= =E2=80=99t understand your problem and you don=E2=80=99t understand crypto= graphy.</blockquote>

I modified the quote in the preface to my 2000 book <a href=3D"https://= www.schneier.com/books/secrets-and-lies/">Secrets and Lies</a>:

<blockquote>A few years ago I heard a quotation=2C and I am going to mo= dify it here: If you think technology can solve your security problems=2C=
then you don=E2=80=99t understand the problems and you don=E2=80=99t unde= rstand the technology.</blockquote>

I can=E2=80=99t tell you why me in 2000 didn=E2=80=99t credit Needham b=
y name. I should have.

I have used the quote pretty consistently since then. Somewhere along t=
he line I dropped =E2=80=9Csecurity=E2=80=9D from the phrase=2C and now sa=
y it more like Anderson quotes me:

<blockquote>If you think technology will solve your problem=2C you don= =E2=80=99t understand your problem and you don=E2=80=99t understand techno= logy.</blockquote>

I sometimes use singular and sometimes use plural. Sometimes I say =E2= =80=9Cthe problem=E2=80=9D and =E2=80=9Cthe technology.=E2=80=9D But I thi=
nk the quote flows better ending with just the word =E2=80=9Ctechnology.= =E2=80=9D

EDITED TO ADD (5/12): It gets weirder. A friend sent me some 1997 email=
s that talk about this. Roger Needham wrote: =E2=80=9CButler Lampson and I=
each attribute to the other the remark.=E2=80=9D I wrote: =E2=80=9CRoger=
Needham claims that Robert Morris said it. Robert Morris claims that Roge=
r Needham said it. No one knows who the originator is.=E2=80=9D I said it=
from stage at Defcon that year -- definitely not the originator.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg4"><a name=3D"cg4">O=
n AI Security</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/05/on-ai-securit= y.html">[2026.05.20]</a> Good <a href=3D"https://berryvi= lleiml.com/docs/no-security-meter-ai.pdf">report</a>:

<blockquote>Executive Summary: Let=E2=80=99s say you wanted to m=
ake sure that your AI is secure. Can you just maximize the security and pr= ivacy benchmark and call it a day? Nope=2C because benchmarks don=E2=80=99=
t actually work for measuring AI capabilities (even when they are NOT emer= gent systemic properties like security). So let=E2=80=99s take a step back=
: how do you measure security in the first place? Good question. Over the=
last 30 years=2C security engineering for software evolved from black box=
penetration testing=2C through whitebox code analysis and architectural r=
isk analysis to de facto process-driven standards like the Building Securi=
ty In Maturity Model (BSIMM). Software had a very deep impact on business=
operations=2C and it appears that AI is going to have an even deeper impa=
ct. Will a software security-like measurement move work for AI? Probably.=
In the meantime we can make real progress in AI security by cleaning up o=
ur WHAT piles and managing risk by identifying and applying good assurance=
processes. (Spoiler alert: no matter what we do=2C we still don=E2=80=99t=
get a security meter for AI=2C so we need to be extra vigilant about secu= rity.)</blockquote>

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg5"><a name=3D"cg5">m= acOS Kernel Memory Corruption Exploit</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/05/macos-kernel-= memory-corruption-exploit.html">[2026.05.21]</a> A group=
used Anthropic=E2=80=99s Mythos AI model to <a href=3D"https://blog.calif= =2Eio/p/first-public-kernel-memory-corruption">help find</a> a kernel memory=
corruption vulnerability and exploit on Apple=E2=80=99s M5.

News <a href=3D"https://9to5mac.com/2026/05/14/calif-team-details-how-a= nthropic-mythos-helped-build-a-working-macos-exploit-in-five-days/">articl= e</a>.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg6"><a name=3D"cg6">C=
ISA Security Leak</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/05/cisa-security= -leak.html">[2026.05.22]</a> Crazy <a href=3D"https://kr= ebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/">= story</a>:

<blockquote>Until this past weekend=2C a contractor for the Cybersecuri=
ty & Infrastructure Security Agency (CISA) maintained a public GitHub=
repository that exposed credentials to several highly privileged AWS GovC= loud accounts and a large number of internal CISA systems. Security expert=
s said the public archive included files detailing how CISA builds=2C test=
s and deploys software internally=2C and that it represents one of the mos=
t egregious government data leaks in recent history.</blockquote>

News <a href=3D"https://gizmodo.com/the-worst-leak-that-ive-witnessed-u= -s-cybersecurity-agency-leaves-its-digital-keys-out-in-public-on-github-20= 00760330">article</a>.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg7"><a name=3D"cg7">I= dentifying People Using Wi-Fi Routers</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/05/identifying-p= eople-using-wi-fi-routers.html">[2026.05.26]</a> Not ide= ntifying people based on their use of Wi-Fi routers=2C but identifying peo=
ple <a href=3D"https://gizmodo.com/researchers-issue-warning-about-tech-th= at-could-turn-every-router-into-a-potential-means-for-surveillance-2000763= 181">using Wi-Fi signals</a>.

<blockquote>This is accomplished through what is known as <a href=3D"ht= tps://wballiance.com/wi-fi-sensing-101-an-introduction/">WiFi sensing</a>=
=2C or the use of WiFi signals to infer information about a physical envir= onment. When radio signals like WiFi travel through a space=2C they intera=
ct with the objects and people around them. Those signals can be reflected=
=2C scattered=2C or absorbed. By analyzing how the signal is expected to b= ehave compared with how it is actually received=2C researchers can infer d= etails about the surrounding environment.

=E2=80=9CBy observing the propagation of radio waves=2C we can create a=
n image of the surroundings and of persons who are present=2C=E2=80=9D sai=
d Thorsten Strufe=2C a KIT professor and study co-author=2C in a <a href= =3D"https://www.kit.edu/kit/english/pi_2025_069_the-spy-who-came-in-from-t= he-wifi-beware-of-radio-network-surveillance.php">press release</a>. =E2= =80=9CThis works similar to a normal camera=2C the difference being that i=
n our case=2C radio waves instead of light waves are used for the recognit= ion.=E2=80=9D</blockquote>

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg8"><a name=3D"cg8">F= BI=E2=80=99s 2025 Internet Crime Report</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/05/fbis-2025-int= ernet-crime-report.html">[2026.05.27]</a> The 2025 <a hr= ef=3D"https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf">Interne=
t Crime Report</a> was published a few weeks ago=2C but I only just saw it= =2E
Lots of interesting statistics.

<a href=3D"https://www.fbi.gov/news/press-releases/cryptocurrency-and-a= i-scams-bilk-americans-of-billions">Press release</a>. <a href=3D"https://= www.wsj.com/tech/cybersecurity/internet-crime-fbi-report-fd7c16e8">News</a=

<a href=3D"https://www.governing.com/key-findings/report-how-cyber-crime=

-affected-the-u-s-in-2025">articles</a>.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg9"><a name=3D"cg9">C= hilling Effects</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/05/chilling-effe= cts.html">[2026.05.29]</a> Younger Americans have <a hre= f=3D"https://thehill.com/homenews/campaign/5759759-young-voters-trump-appr= oval-rating-economy/">soured on the second Donald Trump presidency</a>=2C=
but they are not protesting it.

Despite <a href=3D"https://www.pbs.org/newshour/show/new-poll-shows-gro= wing-number-of-americans-disapprove-of-trumps-handling-of-iran-war">an unp= opular Iran war</a> and an even more <a href=3D"https://www.cnn.com/2026/0= 5/05/politics/trump-approval-rating-analysis-vis">unpopular Trump administ= ration</a>=2C college campus protests nationwide <a href=3D"https://www.bo= stonglobe.com/2026/04/03/metro/campus-protests-student-activists-no-kings/= ">have gone silent</a>. And at many schools=2C <a href=3D"https://www.thea= tlantic.com/ideas/2026/03/campus-protests-trump-iran/686518/">student acti= vism</a> is virtually <a href=3D"https://www.thebulwark.com/p/the-campus-p= rotest-culture-that-targeted-biden-goes-silent-for-trump-iran-anti-war">no= nexistent</a>.

This silence comes in the wake of a relentless Trump administration <a=
href=3D"https://www.insidehighered.com/news/deep-dives/2026/02/24/war-stu= dent-speech">war on campus speech</a> that has involved <a href=3D"https:/= /www.usnews.com/news/national-news/articles/trumps-higher-education-crackd= own-visa-revocations-dei-bans-lawsuits-and-funding-cuts">lawsuits</a>=2C <=
a href=3D"https://www.theguardian.com/us-news/2026/apr/17/tufts-rumeysa-oz= turk-trump-administration">arrests</a>=2C <a href=3D"https://abcnews.com/P= olitics/foreign-college-students-targeted-deportation/story?id=3D120210587= ">deportations</a> and <a href=3D"https://www.aljazeera.com/news/2026/2/13= /court-orders-trump-administration-to-facilitate-deported-students-return"= >expulsions</a>.

<a href=3D"https://www.nytimes.com/2026/04/14/opinion/trump-protest-ai-= phones-social-media.html">Reports cite a range of complicated factors</a>=
for the restraint=2C from apathy to technology-induced incapacity. But as=
<a href=3D"https://www.belfercenter.org/person/bruce-schneier">public pol= icy</a> and <a href=3D"https://cyber.harvard.edu/people/jpenney">law and s= ocial science experts</a>=2C we believe students aren=E2=80=99t protesting=
for a very simple reason: They are afraid. They are self-censoring and di= sengaging from campaign activism to avoid punitive measures.

In law and social science=2C we call this impact <a href=3D"https://fir= stamendment.mtsu.edu/article/chilling-effect/">a chilling effect</a> -- th=
e behavioral tendency for people in face of a threat to self-censor and re= strain their activities for self-protection.

It=E2=80=99s increasingly clear to us that these impacts are not incide= ntal or ancillary to Trump administration policy. Rather=2C the chilling e= ffects are the point. This is the closest thing to a consistent governing=
strategy in Trump=E2=80=99s second term.

<h3 style=3D"font-size:110%;font-weight:bold">The broader chill of Trump t= hreats</h3>

Chilling effects can be subtle=2C but today they are everywhere. And it= =E2=80=99s not just students who are chilled by Trump administration threa= ts.

Professors are <a href=3D"https://www.nytimes.com/2026/03/16/us/profess= ors-change-teaching-trump.html">censoring themselves in lectures and rewri= ting syllabuses</a>. Researchers are stripping grant applications of <a hr= ef=3D"https://www.wsj.com/health/scientists-are-removing-dei-language-to-k= eep-federal-grants-d092833b">words that might attract federal scrutiny</a>=
=2C or abandoning the topics entirely. <a href=3D"https://www.theguardian.= com/commentisfree/2026/mar/17/trump-iran-fcc-brendan-carr">Media outlets a=
re modifying</a> their <a href=3D"https://www.theguardian.com/media/2025/n= ov/27/bbc-donald-trump-corruption-line-removed-from-rutger-bregman-reith-l= ecture">news coverage</a> to avoid Trump lawsuits or sanctions.

<a href=3D"https://www.theguardian.com/us-news/2026/jan/18/justice-depa= rtment-ice-renee-good-george-floyd-minneapolis">Law enforcement</a> and <a=
href=3D"https://www.reuters.com/business/finance/us-secs-ex-enforcement-c= hief-clashed-with-bosses-before-leaving-sources-say-2026-03-23/">regulator=
y agencies</a> are refusing to investigate Trump-aligned actors inside or=
outside government=2C and major national <a href=3D"https://www.washingto= npost.com/national-security/2025/10/26/smaller-law-firms-struggle-trump-ad= ministration-initiatives/">law firms</a> are declining cases challenging T= rump administration policies.

Publishers are =E2=80=9C<a href=3D"https://www.lgbtqnation.com/2026/01/= publishers-are-stepping-back-from-lgbtq-books-amid-bans-the-current-gop-pr= esident/">stepping back</a>=E2=80=9D from LGBTQ+ books and other progressi=
ve subjects. Many in targeted immigrant communities are <a href=3D"https:/= /www.ksbw.com/article/ice-raids-central-coast-immigrant-home-work/65107406= ">afraid to leave home to go to work</a> or <a href=3D"https://abcnews.com= /Politics/heres-immigration-enforcement-affecting-school-enrollment-distri= cts/story?id=3D128057477">school</a>.

In most cases=2C these people and institutions are not being specifical=
ly targeted or threatened by Trump. But they are afraid=2C and their fear=
is doing the administration=E2=80=99s work for it. They stay silent=2C av=
oid attention and confrontation=2C and look the other way. In other cases=
=2C they change their speech and behavior to accommodate or conform to the=
administration=E2=80=99s worldview.

Of course=2C there are counterexamples=2C such as the winter <a href=3D= "https://www.pbs.org/newshour/nation/watch-live-noem-holds-news-conference= -after-deadly-shooting-by-ice-in-minneapolis">protests in Minneapolis in r= esponse to brutality</a> by agents with U.S. Immigration and Customs Enfor= cement=2C and the recent =E2=80=9C<a href=3D"https://www.youtube.com/short= s/36Ac2RZIbF4">No Kings</a>=E2=80=9D rallies. But even here=2C the broader=
but less visible trend -- chilling effects -- is evident.

For instance=2C in recent reporting on the latest No Kings rallies=2C <=
a href=3D"https://prospect.org/2026/04/08/mass-protest-where-are-the-kids/= ">many</a> <a href=3D"https://murraystatenews.org/206247/opinion/opinion-w= hy-are-there-no-students-at-no-kings/">media outlets</a> observed that <a=
href=3D"https://www.nytimes.com/2026/04/14/opinion/trump-protest-ai-phone= s-social-media.html">students were noticeably missing</a>=2C despite the T= rump administration=E2=80=99s unpopularity among younger Americans.

<h3 style=3D"font-size:110%;font-weight:bold">A persistent strategy</h3>

We believe none of this is by accident.

In a new book=2C =E2=80=9C<a href=3D"https://doi.org/10.1017/9781108641= 784">Chilling Effects: Repression=2C Conformity=2C and Power in the Digita=
l Age</a>=2C=E2=80=9D one of us -- Jon Penney -- explains how law=2C techn= ology=2C and state and corporate power are weaponized to chill and repress=
=2C and the dangers this poses for the United States and other democratic=
societies. The other -- Bruce Schneier -- has <a href=3D"https://dl.acm.o= rg/doi/abs/10.5555/2685412">extensively studied</a> the security infrastru= cture enabling this.

What we see isn=E2=80=99t <a href=3D"https://www.theatlantic.com/ideas/= archive/2018/10/the-cruelty-is-the-point/572104/">gratuitous government cr= uelty</a>=2C <a href=3D"https://news.wttw.com/2026/01/20/365-days-chaos-il= linois-democrats-reflect-1st-year-trump-s-2nd-term">chaos</a> or <a href= =3D"https://www.theguardian.com/us-news/2026/jan/21/trump-retribution-camp= aign">vengeance</a>. Instead=2C we see a persistent strategy to maximize f=
ear and chilling effects in ways that are corrosive to freedom and democra= cy.

Research suggests that <a href=3D"https://papers.ssrn.com/sol3/papers.c= fm?abstract_id=3D2769645">surveillance</a>=2C <a href=3D"https://doi.org/1= 0.1080/1369118X.2023.2289978">personal threats</a>=2C <a href=3D"https://d= oi.org/10.1111/risa.16112">uncertainty</a> and <a href=3D"https://protectd= emocracy.org/work/punishing-corporate-expression/">abuse of power</a> are=
<a href=3D"https://www.cambridge.org/core/books/abs/chilling-effects/conf= ormity-theory-of-chilling-effects/15CB1957C3C94076BAF2325678AF1376">key fa= ctors in doing so</a>. The federal government has a clear and systematic p= attern of employing these very mechanisms across a number of domains far b= eyond campuses.

They are evident in <a href=3D"https://www.nytimes.com/2026/01/28/us/ic= e-agent-weapons-minneapolis.html">militarized raids by Immigration and Cus= toms Enforcement</a> and in <a href=3D"https://apnews.com/article/don-lemo= n-arrest-minnesota-church-service-d3091fe3d1e37100a7c46573667eb85c">journa= lists being arrested</a> and <a href=3D"https://amnesty.ca/urgent-actions/= usa-journalists-face-charges-for-covering-minnesota-protest/">indicted</a>=
for reporting on protests. They are made clear in the <a href=3D"https://= abcnews.com/US/list-individuals-including-lisa-cook-targeted-trump-adminis= tration/story?id=3D124968309">long list of political enemies</a> the Trump=
administration has investigated or threatened=2C <a href=3D"https://www.n= ytimes.com/2026/04/24/business/doj-investigation-federal-reserve-powell.ht= ml">including the Federal Reserve chairman</a>. And they can also be seen=
in the weaponization of technology=2C including ramping up surveillance t=
o <a href=3D"https://www.nytimes.com/2026/02/13/technology/dhs-anti-ice-so= cial-media.html">target critics</a> and <a href=3D"https://www.npr.org/202= 6/03/04/nx-s1-5717031/ice-dhs-immigrants-surveillance-confrontation-deport= ation-mobile-fortify">protestors</a>.

<h3 style=3D"font-size:110%;font-weight:bold">Corrosive to freedom and dem= ocracy</h3>

History offers some guidance on impacts.

During <a href=3D"https://millercenter.org/the-presidency/educational-r= esources/age-of-eisenhower/mcarthyism-red-scare">the McCarthy era</a>=2C <=
a href=3D"https://levin-center.org/joe-mccarthys-oversight-abuses/">overre= aching laws</a>=2C <a href=3D"https://www.bbc.com/news/world-us-canada-482= 18827">surveillance</a>=2C and <a href=3D"https://firstamendment.mtsu.edu/= article/mccarthyism/">public and private sector reprisals</a> ostensibly t= argeted alleged communists. But <a href=3D"https://www.archives.gov/public= ations/prologue/2006/fall/agloso.html">the real aim was often to suppress<=

progressive journalists=2C trade unions and political opposition.

In the 1960s=2C these same tactics were <a href=3D"https://digitalcommo= ns.library.uab.edu/cgi/viewcontent.cgi?article=3D1317&context=3Dvulcan">re= used by Southern states</a> to chill the Civil Rights Movement. Historians=
<a href=3D"https://press.uchicago.edu/ucp/books/book/chicago/N/bo28241907= =2Ehtml">have</a> <a href=3D"https://writing.upenn.edu/%7Eafilreis/50s/schre= cker-legacy.html">written about</a> how the widespread fear and conformity=
of these periods reshaped American society in enduring ways=2C including=
the <a href=3D"https://press.uchicago.edu/ucp/books/book/chicago/N/bo2824= 1907.html">destruction</a> of progressive political movements and <a href= =3D"https://www.bunkhistory.org/resources/how-mccarthyism-and-the-red-scar= e-hurt-the-black-freedom-struggle">both delaying and muting</a> the Civil=
Rights Movement itself.

When such state threats are systematized=2C they can foment a broader c= limate of fear=2C self-censorship and conformity. In that climate=2C disse= nting speech=2C political opposition=2C democratic mobilization and other=
checks on power become increasingly difficult=2C even dangerous. It is no=
surprise=2C for instance=2C that Trump critics regularly admit to self-ce= nsorship=2C <a href=3D"https://www.nytimes.com/2025/03/06/us/politics/trum= p-democracy.html">fearing for their safety</a>.

Chilling effects are thus not only repressive -- causing self-censorshi=
p -- but productive. They produce conforming and compliant speech and beha= vior=2C which can have longer-term social impacts. They not only undermine=
protected rights and suppress accountability but can promote social chang=
e -- even without a popular mandate to do so.

This latter point is often missed. It explains Trump=E2=80=99s assaults=
on universities and cultural institutions such as <a href=3D"https://www.= theguardian.com/us-news/2026/feb/08/trump-kennedy-center-washington-dc">th=
e Kennedy Center for the Arts</a> and <a href=3D"https://www.pbs.org/newsh= our/politics/trump-amplifies-attacks-on-out-of-control-smithsonian-museums= -for-including-negative-parts-of-american-history">the Smithsonian</a>. Of=
ten dismissed as <a href=3D"https://www.theguardian.com/commentisfree/2025= /mar/20/donald-trump-kennedy-center-takeover-arts">peculiar Trump obsessio= ns</a>=2C they are fully consistent with <a href=3D"https://static.heritag= e.org/project2025/2025_MandateForLeadership_FULL.pdf">Project 2025</a> --=
the sweeping policy blueprint for Trump=E2=80=99s second term <a href=3D"= https://www.heritage.org/press/project-2025-reaches-100-coalition-partners= -continues-grow-preparation-next-president">authored by a coalition of con= servative groups</a> and <a href=3D"https://static.heritage.org/project202= 5/2025_MandateForLeadership_FULL.pdf">its call</a> to target the =E2=80=9C= institutions of American civil society=E2=80=9D and =E2=80=9Cwield federal=
power=E2=80=9D to =E2=80=9Creverse=E2=80=9D decades of progressive cultur=
al advancements.

In the near term=2C this means an increasingly weakened democratic soci= ety=2C with the government and its patrons enjoying freedom to pursue thei=
r objectives. Over the long term=2C this can mean a changed society as mor=
e conformist and compliant speech and culture become more widely accepted=
and entrenched.

<h3 style=3D"font-size:110%;font-weight:bold">Not inevitable</h3>

In our view=2C this future is not inevitable=2C just as the McCarthy er=
a =E2=80=9CRed Scare=E2=80=9D and violent civil rights era repression were=
not. In both cases=2C fear and chilling effects were resisted in law and=
civil society=2C as they can be today.

But the central mechanisms -- surveillance=2C uncertainty=2C personal t= hreats and abuse of power -- <a href=3D"https://doi.org/10.1017/9781108641= 784">would need to be addressed</a>. For instance=2C new legislation could=
ensure justice for lawless government actors and constrain surveillance.=
Courts can block abuses of federal power=2C including illegal arrests=2C=
detentions and mass citizen databases.

The media=2C lawyers and civil society can hold the government accounta= ble. And students=2C teachers=2C universities and cultural institutions ca=
n resist the tendency to self-censor and conform.

The citizen mobilization in Minnesota and the No Kings rallies are exam= ples of that. But to resist chilling effects and their dangers over the lo=
ng term=2C this would have to be the norm=2C not the exception.

This essay was written with Jon Penney=2C and originally appeared i=
n <a href=3D"https://theconversation.com/chilling-effects-of-trumps-war-on= -free-speech-extend-far-beyond-campus-walls-and-thats-the-point-283113">Th=
e Conversation</a>.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg10"><a name=3D"cg10"= >Vulnerability Disclosure in the Age of AI</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/06/vulnerability= -disclosure-in-the-age-of-ai.html">[2026.06.01]</a> New=
article: =E2=80=9C<a href=3D"https://cyberdefensereview.army.mil/Portals/= 6/Documents/2026-vol11-iss2/CDR_V11_N2_Hathaway.pdf">Responsible Disclosur=
e in the Age of AI: A Call for Urgent Action</a>=2C=E2=80=9D by Melissa Ha= thaway.

<blockquote>Abstract: Artificial intelligence is fundamentally r= eshaping the balance between vulnerability discovery and remediation. Fron= tier AI models are now capable of autonomously identifying exploitable sof= tware vulnerabilities at unprecedented speed and scale. This development e= xposes decades of accumulated technical debt created by a software industr=
y that prioritized rapid deployment over secure-by-design engineering prac= tices. Drawing on the evolution of software assurance=2C vulnerability dis= closure frameworks=2C and U.S. cyber policy=2C this perspective argues tha=
t the current moment represents a strategic inflection point for governmen= ts=2C industry=2C and critical infrastructure operators. The author examin=
es the growing tension between offensive and defensive equities in cybersp= ace=2C the emergence of AI-enabled vulnerability discovery capabilities in=
both the U.S. and China=2C and the increasing risks posed by unsupported=
legacy systems and AI-assisted code generation practices. Responsible dis= closure can no longer remain a reactive or fragmented process=2C but must=
become a coordinated national and international resilience effort involvi=
ng governments=2C software vendors=2C infrastructure operators=2C and emer= gency response organizations. The article concludes with an urgent call fo=
r accelerated remediation=2C large-scale patch management coordination=2C=
and sustained investment in automated vulnerability repair capabilities b= efore adversaries exploit this rapidly narrowing window of opportunity.</p= ></blockquote>

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg11"><a name=3D"cg11"= >Microsoft Threatening Security Researcher</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/06/microsoft-thr= eatening-security-researcher.html">[2026.06.02]</a> An a= nonymous security researcher called =E2=80=9CNightmare Eclipse=E2=80=9D ha=
s been <a href=3D"https://deadeclipse666.blogspot.com/">publishing</a> a s= eries of significant security exploits against Microsoft Windows -- includ=
ing one that <a href=3D"https://arstechnica.com/security/2026/05/zero-day-= exploit-completely-defeats-default-windows-11-bitlocker-protections/">brea= ks</a> BitLocker. Microsoft has <a href=3D"https://www.microsoft.com/en-us= /msrc/blog/2026/05/a-shared-responsibility-protecting-customers-through-co= ordinated-vulnerability-disclosure">threatened</a> legal action against th=
e researcher. Lots of recriminations are being <a href=3D"https://techcrun= ch.com/2026/05/29/microsoft-under-fire-for-threatening-security-researcher= -with-criminal-investigation/">traded</a> back and forth.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg12"><a name=3D"cg12"= >The Intersection of Encryption and AI</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/06/the-intersect= ion-of-encryption-and-ai.html">[2026.06.02]</a> As p=
art of their 20th Anniversary celebration=2C <a href=3D"https://www.darkre= ading.com/cyberattacks-data-breaches/cybersecurity-pioneers-ponder-past-pr= ologue"><cite>Dark Reading</cite></a> asked five cybersecurity industry le= aders who wrote blogs or columns for them over the years to select their f= avorite piece and share their reflections on the topic today. This is my s= ection.

Renowned technologist and author Bruce Schneier contributed a column on=
June 20=2C 2010=2C warning about <a href=3D"https://www.darkreading.com/c= yber-risk/the-failure-of-cryptography-to-secure-modern-networks">cryptogra= phy=E2=80=99s inability to secure modern networks</a>=2C a point he says h=
e has been trying to argue since 2000.

=E2=80=9CFor a while now=2C I=E2=80=99ve pointed out that cryptography=
is singularly ill-suited to solve the major network security problems of=
today: denial-of-service attacks=2C website defacement=2C theft of credit=
card numbers=2C identity theft=2C viruses and worms=2C DNS attacks=2C net= work penetration=2C and so on.

=E2=80=9CRecently=2C I talked to a former NSA employee at a conference.=
He told me that back in the 1990s=2C he had a copy of my book <a href=3D"= https://www.schneier.com/books/applied-cryptography"><cite>Applied Cryptog= raphy</cite></a> by his desk=2C as did many other cryptographers working a=
t Ft. Meade. People were allowed to refer to it=2C but they were not allow=
ed to cite it.

=E2=80=9CThe 1990s were an important decade for cryptography. This was=
before the internet went mass market=2C when cryptography was just emergi=
ng from a niche academic discipline to a mainstream engineering one. There=
wasn=E2=80=99t much that programmers could read. The NSA used my book for=
the same reason it became a bestseller: because it collected all the acad= emic cryptography of the time in one place and made it understandable to p= eople who weren=E2=80=99t mathematicians. They feared it for exactly the s=
ame reason.

=E2=80=9CI=E2=80=99ve been thinking about that conversation as I revisi=
t a 2010 essay I wrote for Dark Reading=2C =E2=80=98<a href=3D"https://www= =2Edarkreading.com/cyber-risk/the-failure-of-cryptography-to-secure-modern-n= etworks">The Failure of Cryptography to Secure Modern Networks</a>.=E2=80=
=99 Cryptography has inherent mathematical properties that greatly favor t=
he defender. Adding a single bit to the length of a key adds only a slight=
amount of work for the defender but doubles the amount of work the attack=
er has to do. Doubling the key length doubles the amount of work the defen=
der has to do (if that -- I=E2=80=99m being approximate here) but increase=
s the attacker=E2=80=99s workload exponentially. For many years=2C we have=
exploited that mathematical imbalance.

=E2=80=9CComputer security is much more balanced. There=E2=80=99ll be a=
new attack=2C and a new defense=2C and a new attack=2C and a new defense.=
It=E2=80=99s an arms race between attacker and defender. And it=E2=80=99s=
a very fast arms race. New vulnerabilities are discovered all the time. T=
he balance can tip from defender to attacker overnight=2C and back again t=
he night after. Computer security defenses are inherently very fragile.</p=

=E2=80=9CThat isn=E2=80=99t a new idea. I said much the same thing in t=
he preface to my 2000 book=2C <cite>Secrets and Lies</cite>:

=E2=80=9C=E2=80=98Cryptography is a branch of mathematics. And like all=
mathematics=2C it involves numbers=2C equations=2C and logic. Security=2C=
real security that you or I might find useful in our lives=2C involves pe= ople: things people know=2C relationships between people=2C people and how=
they relate to machines. Digital security involves computers: complex=2C=
unstable=2C buggy computers.=E2=80=99

=E2=80=9CI especially like how I phrased it in 2016: =E2=80=98Cryptogra=
phy is harder than it looks=2C primarily because it looks like math. Both=
algorithms and protocols can be precisely defined and analyzed. This isn= =E2=80=99t easy=2C and there=E2=80=99s a lot of insecure crypto out there=
=2C but we cryptographers have gotten pretty good at getting this part rig=
ht. However=2C math has no agency; it can=E2=80=99t actually secure anythi=
ng. For cryptography to work=2C it needs to be written in software=2C embe= dded in a larger software system=2C managed by an operating system=2C run=
on hardware=2C connected to a network=2C and configured and operated by u= sers. Each of these steps brings with it difficulties and vulnerabilities.= =E2=80=99

=E2=80=9CIt=E2=80=99s a lesson we have all learned over the decades. Cr= yptography is still necessary for cybersecurity -- although I wouldn=E2=80= =99t have used that word back then -- but is not sufficient. There are par= ticular attack and forms of mass surveillance that cryptography prevents.=
But as computers have infused throughout our lives=2C and networks have c= onnected all those computers=2C those aspects of cybersecurity have become=
increasingly important=2C and vulnerable.

=E2=80=9CToday=2C the cybersecurity world is changing yet again=2C this=
time due to the capabilities of artificial intelligence. AI isn=E2=80=99t=
advancing cryptography=2C but it=E2=80=99s changing cybersecurity. AI has=
demonstrated a superhuman ability to find vulnerabilities in software and=
to write exploits. A similar ability to write patches is probably coming.=
This has profound implications for both attackers and defenders=2C and it=
is unclear who will win the <a href=3D"https://www.csoonline.com/article/= 4152133/cybersecurity-in-the-age-of-instant-software.html">particular arms=
race</a> in a world of what I call instant software.=E2=80=9D

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg13"><a name=3D"cg13"=

AI Used to Decrypt Medieval Ciphers</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/06/ai-used-to-de= crypt-medieval-ciphers.html">[2026.06.03]</a> Researcher=
s are using machine learning algorithms to <a href=3D"https://www.bbc.com/= future/article/20260527-plots-love-letters-and-diplomacy-the-medieval-secr= ets-being-revealed-by-ai">decrypt</a> historical pencil-and-paper ciphers.=

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg14"><a name=3D"cg14"= >Hacking Meta=E2=80=99s AI Chatbot</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/06/hacking-metas= -ai-chatbot.html">[2026.06.04]</a> Hackers are <a href= =3D"https://techcrunch.com/2026/06/01/hackers-hijacked-instagram-accounts-= by-tricking-meta-ai-support-chatbot-into-granting-access/">convincing</a>=
Meta=E2=80=99s AI support chatbot to let them take over other peoples=E2= =80=99 accounts:

<blockquote>A <a href=3D"https://x.com/DarkWebInformer/status/206125359= 9758315527">video</a> posted on X showed the step-by-step process to hack=
someone=E2=80=99s Instagram account. The hacker allegedly used a VPN to s= poof the targets=E2=80=99 presumed location to avoid triggering Instagram= =E2=80=99s automated account protections. Then=2C the hacker opened a chat=
with Meta AI Support Assistant and asked the bot to add a new email addre=
ss to the target=E2=80=99s account. The chatbot can be seen sending a veri= fication code to the email address provided by the hacker; the hacker then=
shares the verification code with the chatbot=2C which prompts the chatbo=
t to show a button to =E2=80=9CReset Password.=E2=80=9D The hacker enters=
a new password and takes over the victim=E2=80=99s account.

[...]

On Monday=2C Instagram spokesperson Andy Stone said in <a href=3D"https= ://x.com/andymstone/status/2061489833441145103">a reply</a> to Wong=E2=80=
=99s post and others that the issue was now fixed. It=E2=80=99s unclear ho=
w many Instagram users had their accounts improperly accessed.</blockq= uote>

It=E2=80=99s not that easy. Probably this particular tactic is now bloc= ked. But there are others=2C many others=2C and they cannot be blocked as=
a class. The real problem is that LLM chatbots are not trustworthy enough=
for this application.

Another news <a href=3D"https://www.404media.co/hackers-simply-asked-me= ta-ai-to-give-them-access-to-high-profile-instagram-accounts-it-worked/">a= rticle</a>.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg15"><a name=3D"cg15"=

AI Worm</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/06/ai-worm.html"= >[2026.06.05]</a> Researchers have <a href=3D"https://cl= everhans.io/worm">prototyped</a> an AI-powered <a href=3D"https://www.nyti= mes.com/2026/06/02/technology/scientists-find-way-to-supercharge-dangerous= -computer-worms-with-ai.html">internet worm</a>.

The coolest thing about the prototype is that it carries its own LLM wi=
th it=2C and runs it on computers that have been broken into.

This is the closest to John Brunner=E2=80=99s original <a href=3D"https= ://en.wikipedia.org/wiki/The_Shockwave_Rider">1975 conception</a> of a com= puter worm that I=E2=80=99ve seen.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg16"><a name=3D"cg16"= >Anthropic=E2=80=99s Project Glasswing Update</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/06/anthropics-pr= oject-glasswing-update.html">[2026.06.08]</a> In April=
=2C Anthropic initated <a href=3D"https://www.anthropic.com/glasswing">Pro= ject Glasswing</a>. The idea was to let companies use their new model to f=
ind and fix vulnerabilities in their own software. It was a fantastic PR m= ove=2C and so many press outlets have uncritically parroted Anthropic=E2= =80=99s claims that it=E2=80=99s now common wisdom that Mythos is better a=
t finding software vulnerabilities than other models. Which is just <a hre= f=3D"https://www.theguardian.com/commentisfree/2026/may/08/how-dangerous-i= s-anthropics-mythos-ai">not</a> <a href=3D"https://spectrum.ieee.org/ai-cy= bersecurity-mythos">true</a>.

In any case=2C Anthropic has <a href=3D"https://www.anthropic.com/resea= rch/glasswing-initial-update">published</a> a Project Glasswing status rep= ort. It=E2=80=99s finding <a href=3D"https://www.securityweek.com/anthropi= c-mythos-detected-23000-potential-vulnerabilities-across-1000-oss-projects= /">a lot</a> of vulnerabilities in software -- yay! Some of them are even=
dangerous. But almost none of them has been patched. It=E2=80=99s <a href= =3D"https://www.flyingpenguin.com/mythos-grading-mythos-got-patches-yet/">= weird</a>. There=E2=80=99s something fishy about the data that I don=E2=80= =99t understand. That Anthropic refuses to release details -- that it just=
says =E2=80=9Ctrust us=E2=80=9D -- is a <a href=3D"https://www.schneier.c= om/blog/archives/2026/04/mythos-and-cybersecurity.html">big problem</a> he= re.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg17"><a name=3D"cg17"= >Critical Zcash Vulnerability Found and Fixed</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/06/critical-zcas= h-vulnerability-found-and-fixed.html">[2026.06.08]</a> I=
f you=E2=80=99re a user -- owner? -- of this cryptocurrency=2C <a href=3D"= https://securityaffairs.com/193224/hacking/claude-opus-found-a-four-year-o= ld-hole-in-zcashs-privacy-layer-nobody-knows-if-someone-already-used-it.ht= ml">this</a> is important:

<blockquote>On May 29=2C the security researcher Taylor Hornby found a=
critical vulnerability in Zcash Orchard privacy pool using Claude Opus 4.=
8. The Zcash team hired Hornby specifically to look for this kind of issue=
=2E He found one fast enough to be embarrassing.

The Orchard pool is the newest and most advanced shielded transaction s= ystem in the cryptocurrency Zcash. Introduced in 2022=2C it allows users t=
o send and receive ZEC while keeping transaction details private. It uses=
zero-knowledge proofs to validate transactions without revealing amounts=
or participants. The bug: a specific check that was supposed to validate=
transaction inputs wasn=E2=80=99t actually enforcing the rules it appeare=
d to enforce. An attacker could have exploited the flaw to feed false inpu=
ts into that check and generate ZEC from nothing=2C with the zero-knowledg=
e proof system blessing the fraudulent transaction as valid.</blockquo=

It=E2=80=99s fixed; that=E2=80=99s the good news. The bad news is that=
there=E2=80=99s no way of knowing if anyone exploited the vulnerability t=
o steal money. And this fragility is the fundamental problem that makes bl= ockchain such a bad idea.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg18"><a name=3D"cg18"= >GPS As a Key Distribution Platform</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/06/gps-as-a-key-= distribution-platform.html">[2026.06.09]</a> <a href=3D"= https://www.404media.co/the-u-s-military-quietly-turned-gps-into-a-global-= numbers-station-evidence-suggests/">This</a> is interesting:

<blockquote>The U.S. military has likely been quietly broadcasting code=
s for its global encryption network using public GPS for nearly 20 years=
=2C turning each satellite into a hidden =E2=80=9Cnumbers station=2C=E2=80=
=9D according to Steven Murdoch...

That means every device that uses GPS has been receiving hidden governm=
ent information for years=2C and nobody outside the military knew it until=
now.

[...]

Murdoch discovered that this particular sentinel was transmitted by all=
31 operational satellites within a window of a few hours on May 26=2C 201= 1=2C potentially heralding the activation of a new operational system. He=
confirmed that this timeline coincided with the rollout of the military= =E2=80=99s Over-the-Air Distribution (OTAD) and the Over-the-Air Rekeying=
(OTAR) by cross-referencing declassified documents=2C including a 2015 pr= esentation about the dates of the operation.

=E2=80=9CThere was a perfect match between the timeline and that presen= tation and the change points that were automatically identified from the d= ata=2C=E2=80=9D Murdoch said. =E2=80=9CThat was the smoking gun that made=
me think: This is what it=E2=80=99s for.=E2=80=9D

These automated systems replaced the cumbersome manual distribution of=
cryptographic keying material=2C allowing military GPS receivers around t=
he world to be rekeyed remotely through satellite broadcasts rather than t= hrough onsite procedures.</blockquote>

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg19"><a name=3D"cg19"= >NSO Group Hacking WhatsApp Despite Court Order</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/06/nso-group-hac= king-whatsapp-despite-court-order.html">[2026.06.10]</a>=
WhatsApp has <a href=3D"https://www.securityweek.com/whatsapp-catches-spy= ware-firm-nso-defying-no-hacking-court-order/">caught</a> the NSO Group ph= ishing its users=2C in violation of a court order.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg20"><a name=3D"cg20"= >Enhanced License Plate Tracking</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/06/enhanced-lice= nse-plate-tracking.html">[2026.06.11]</a> The surveillan=
ce company Leonardo wants <a href=3D"https://www.404media.co/this-company-= will-add-phone-airpod-and-smartwatch-trackers-to-license-plate-readers/">m=
ore data</a>:

<blockquote>A surveillance company plans to add sensors to automatic li= cense plate readers (ALPRs) that would mean the devices=2C as well as capt=
ure the license plate of passing vehicles=2C would also sweep up unique id= entifiers of mobile phones=2C wearables=2C and other Bluetooth-enabled dev= ices in those cars=2C potentially letting law enforcement identify specifi=
c drivers or passengers.

The technology=2C called SignalTrace=2C would turn ALPR cameras from de= vices focused on tracking cars to ones that can more readily track the loc= ation of particular people. ALPR cameras have become a commonly deployed t= echnology all across the U.S.; SignalTrace would make some of those camera=
s capable of collecting much more data.</blockquote>

Yes=2C it=E2=80=99s bad that more companies are collecting this level o=
f surveillance data. But all of this pales in comparison to the type and q= uantity of data our smartphones already collect about us.

Alternate <a href=3D"https://archive.ph/zdl0s#selection-633.18-633.25">= link</a>.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg21"><a name=3D"cg21"= >Bernie Sanders=E2=80=99 AI Sovereign Wealth Fund Plan</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/06/bernie-sander= s-ai-sovereign-wealth-fund-plan.html">[2026.06.12]</a> L=
et no one accuse Bernie Sanders of ducking the big questions. Writing in t=
he New York Times last week=2C the senator <a href=3D"https://www.nytimes.= com/2026/06/01/opinion/artificial-intelligence-bernie-sanders.html">asked<= /a>: =E2=80=9CWill the future of humanity be determined by a handful of bi= llionaires who have promoted and developed AI=2C with virtually no democra=
tic input=2C who stand to become even richer and more powerful than they a=
re today?=E2=80=9D

We agree entirely that this is one of the most potent questions facing=
global democracy today. Our book=2C <a href=3D"https://mitpress.mit.edu/9= 780262049948/rewiring-democracy/">Rewiring Democracy</a>=2C surveys the em= erging uses for and impacts of AI in democracy around the world and reache=
s the same conclusion: that the most urgent risk posed by AI is the <a hre= f=3D"https://www.contrariannews.org/p/how-to-build-ai-for-democracy">conce= ntration</a> of power=2C wealth and control among tech oligarchs.

And yet we reached a vastly different conclusion than Sanders on what t=
o do about it.

The senator points to a once radical but increasingly popular solution:=
creating a US sovereign wealth fund by taking 50% stock in AI companies s=
uch as Anthropic=2C OpenAI and xAI. The argument in favor of this is twofo=
ld. One: it would establish democratic control over the AI companies=2C gi= ving the government =E2=80=9Cthe power=2C through its voting shares and an=
equal representation on each company=E2=80=99s board=2C to block decision=
s that hurt our citizens and to push for policies that help them.=E2=80=9D=
Two: it would return a big chunk of the economic rewards of soaring AI va= luations to the public=2C ensuring =E2=80=9Ctrillions of dollars potential=
ly generated by AI are used to improve the lives of all of us.=E2=80=9D</p=

We laud both these goals unreservedly.

We wholeheartedly agree that there must be public influence over the de= velopment and use of AI=2C just as we demand the government intervene to e= nsure that automakers=2C drugmakers=2C airlines and other industries balan=
ce profitability with public safety and the public interest. And we credit=
the senator with recognizing that there are more levers for the governmen=
t to pull beyond the promulgation of regulation to achieve this.

And we also agree that the obscene=2C dangerous accumulation of wealth=
among AI companies needs to be disrupted. As OpenAI and Anthropic <a href= =3D"https://www.nbcnews.com/business/corporations/anthropic-files-ipo-open= ai-rcna347897">race</a> to be minted as the world=E2=80=99s latest trillio= n-dollar AI companies=2C we should recognize that -- whether or not it con= stitutes a <a href=3D"https://www.fastcompany.com/91551762/stock-market-ai= -bubble-recent-warning-sign-sp-500-mag-seven">bubble</a> -- these staggeri=
ng market capitalizations represent a transfer of wealth. The flow of mone=
y goes from the smaller businesses and actual people using AI=2C and being=
subjected to it=2C to the owners of these tech companies.

That includes the world=E2=80=99s 86 <a href=3D"https://www.forbes.com/= sites/phoebeliu/2026/03/10/meet-the-45-ai-newcomers-to-forbes-2026-billion= aires-list/">AI billionaires</a> =E2=80=9Cseeking to maximize their power=
and profit=E2=80=9D aiming to decide the =E2=80=9Cfate of humanity... beh=
ind closed doors in Silicon Valley=2C=E2=80=9D as Sanders said.

And yet=2C while we do not outright oppose the taking of AI company sto= ck=2C or of a US sovereign wealth fund=2C there are better ways to achieve=
Sanders=E2=80=99 stated goals.

Public ownership of these companies entangles corporate profit and valu= ation with the public interest. It would incentivize the government to cle=
ar regulations=2C permit the exploitation of workers and users=2C suppress=
competition=2C encourage AI adoption regardless of the responsibleness of=
the implementation or appropriateness of the use case=2C and otherwise ac=
t on behalf of corporate interests.

After all=2C if growing=2C say=2C Nvidia from its first $5tn in value t=
o its next $5tn also represents a doubling in value of this segment of the=
sovereign wealth fund=2C then you can expect the fund managers to support=
chip sales=2C foreign and domestic=2C with the same zeal as the company= =E2=80=99s private investors.

This is not an effective way to influence corporations to act in the pu= blic interest. In fact=2C it makes corporate influence on the government m=
ore likely.

We should be wary of this possibility because we=E2=80=99ve seen it bef= ore. Ownership of substantial stakes in oil companies by the Norwegian sov= ereign wealth fund=2C the world=E2=80=99s <a href=3D"https://www.swfinstit= ute.org/fund-rankings/sovereign-wealth-fund">largest</a>=2C does not seem=
to have steered those corporations to pro-environmental policies. Instead=
=2C the Norwegian government=E2=80=99s dependence on those companies has <=
a href=3D"https://www.sciencedirect.com/science/article/pii/S2214629626002= 01X">inhibited</a> them from taking climate action. Here in the US=2C publ=
ic employee pension funds merit the same <a href=3D"https://jacobin.com/20= 18/10/sovereign-wealth-fund-social-bruenig-socialism%5C">criticism</a>: th=
e fiduciary duty to generate wealth overwhelms any intention to direct the=
ir corporate holdings in the public interest.

A better answer is to separate the two goals. The standard way to share=
private rewards with the broader society that made them possible is taxat= ion. Senator Elizabeth Warren has <a href=3D"https://time.com/article/2026= /05/27/why-we-need-to-tax-ai/">proposed</a> an excise tax on datacenters= =E2=80=99 energy use. Others have proposed an <a href=3D"https://finance.y= ahoo.com/economy/policy/articles/shark-tank-billionaire-mark-cuban-2200004= 76.html">AI token tax</a>=2C which has much the same effect.

As to the goal of reshaping AI in the public interest=2C we have <a hre= f=3D"https://foreignpolicy.com/2023/06/12/ai-regulation-technology-us-chin= a-eu-governance/">proposed</a> an AI Public Option. The <a href=3D"https:/= /www.brookings.edu/articles/how-public-ai-can-strengthen-democracy/">conce= pt</a> is for governments=2C be it federal or <a href=3D"https://www.techp= olicy.press/why-us-states-are-the-best-labs-for-public-ai/">state</a>=2C t=
o establish publicly developed and operated AI models run by public instit= utions under democratic control. The idea is not to eliminate corporate AI=
or to seize it as a public asset=2C but rather for government to provide=
a competitive baseline that private AI offerings must meet or exceed to w=
in business -- just like the notion of a <a href=3D"https://www.cbo.gov/pu= blication/57125">healthcare</a> public option.

The Swiss have trailblazed this approach. <a href=3D"https://therenovat= or.substack.com/p/rewiring-democracy-now-switzerland">Apertus</a> is a lar=
ge language model built by Swiss public servants=2C researchers at Swiss u= niversities=2C using appropriately licensed training data and pre-existing=
Swiss public supercomputing infrastructure powered by renewable energy.</=

While Apertus doesn=E2=80=99t seriously compete with the latest OpenAI=
and Anthropic models on performance benchmarks=2C it blows them out of th=
e water in transparency=2C sustainability and compliance with EU regulatio=
ns including adherence to copyright. It=E2=80=99s a nascent project=2C but=
suggestive of how public institutions can apply competitive pressure for=
corporate actors to behave responsibly.

Don=E2=80=99t confuse public AI with =E2=80=9C<a href=3D"https://blogs.= nvidia.com/blog/what-is-sovereign-ai/">sovereign AI</a>=2C=E2=80=9D the no= tion that every country needs to invest in domestic AI infrastructure. Sov= ereign AI is often invoked as a marketing <a href=3D"https://www.theglobea= ndmail.com/business/commentary/article-openai-tumbler-ridge-chatgpt/">sche= me</a> for big tech companies looking to sell to governments; it demands p= ublic investment without guaranteeing public control.

Sanders is a bold and savvy political operator. So why is he pursuing t=
he sovereign wealth fund strategy when he must be aware of these risks? It=
may be due to another argument he makes in his op-ed: that the Trump admi= nistration and the billionaire owners of AI are aligned to the idea.

It=E2=80=99s expedient to capitalize on rare moments of seeming alignme=
nt across diverse political factions=2C but it also behooves us to ask why=
the AI billionaires are open to this extraordinary intervention. The answ= er=2C of course=2C is that they believe that for every dollar ceded to gov= ernment stock expropriation=2C they will get back more in favorable govern= ment policies to protect that newfound investment.

Energy taxation is a straightforward way to make AI companies pay for t=
he social disruption of their technologies. Public AI represents a non-mon= etary mechanism for governments to shape the development of AI=2C compleme= ntary to direct regulation of private actors=2C one with a far greater cha=
nce of influencing corporate behavior towards the public interest. We urge=
Sanders and other political leaders to consider them.

This essay was written with Nathan E. Sanders=2C and originally app= eared in <a href=3D"https://www.theguardian.com/commentisfree/2026/jun/08/= bernie-sanders-ai-sovereign-wealth-fund-plan">The Guardian</a>.

** *** ***** ******* *********** *************<=

<h2 style=3D"font-size:125%;font-weight:bold" id=3D"cg22"><a name=3D"cg22"= >Upcoming Speaking Engagements</a></h2>

<a href=3D"https://www.schneier.com/blog/archives/2026/06/upcoming-spea= king-engagements-57.html">[2026.06.14]</a> This is a cur=
rent list of where and when I am scheduled to speak:

<li>I=E2=80=99m giving a keynote at <a href=3D"https://wirtschaftsrat.= de/de/hoehepunktveranstaltungen/wir-bauen-die-cybernation-von-der-vision-z= ur-wirkung/">Cybernation 2026</a> in Berlin=2C Germany=2C on June 24=2C 20= 26.</li>

<li>I=E2=80=99m speaking at the <a href=3D"https://potsdamer-sicherhei= tskonferenz.de/">Potsdam Conference on National Cybersecurity</a> at the H= asso Plattner Institut in Potsdam=2C Germany. The event runs June 24-25=2C=
2026=2C and my talk will be the evening of June 24.</li>

<li>I=E2=80=99m participating in a panel discussion at the <a href=3D"= https://www.oiip.ac.at/en/events/disruption-or-singularity-ai-security-and= -governance-in-the-21st-century/">Austrian Institute for International Aff= airs</a> in Vienna on Thursday=2C June 25=2C 2026.</li>

<li>I=E2=80=99m speaking at the <a href=3D"https://dighum.wien/">Digit=
al Humanism Conference</a> in Vienna=2C Austria=2C on Friday=2C June 26=2C=
2026.</li>

<li>I=E2=80=99m giving a fireside chat for Epicenter Works=2C to be he=
ld at <a href=3D"https://pretix.eu/epicenter-works/Fireside-Chat-Bruce-Sch= neier/">Kaffee Alt Wien</a> in Vienna=2C Austria=2C on Friday=2C June 26=
=2C 2026.</li>

<li>I=E2=80=99m participating (via Zoom) in a panel discussion at <a h= ref=3D"https://www.alphaevents.com/events-quantumtechus/">Quantum.Tech Wor= ld</a> in Boston=2C Massachusetts=2C USA=2C on Friday=2C June 26=2C 2026.=
The topic is =E2=80=9CQ-Day=E2=80=99s Shortening Deadline: Immediate Solu= tions.=E2=80=9D</li>

<li>I=E2=80=99m speaking at <a href=3D"https://akce.cvut.cz/?node=3Dca= l_item&idevent=3D10047&lang=3Den">Czech Technical University</a> in Prague=
=2C Czechia=2C on Monday=2C June 29=2C 2026.</li>

<li>I=E2=80=99m speaking at the <a href=3D"https://nuernberg.digital/d= e/">Nuremberg Digital Festival</a> in Nuremburg=2C Germany=2C on Wednesday=
=2C July 1=2C 2026.</li>

<li>I=E2=80=99m speaking at <a href=3D"https://www.secwest.net/">CanSe= cWest 2026</a> in Vancouver=2C Canada. The conference runs September 30-Oc= tober 1=2C 2026; the time of my talk is TBD.</li>
</ul>

The list is maintained on <a href=3D"https://www.schneier.com/events/">= this page</a>.

** *** ***** ******* *********** *************<=

Since 1998=2C CRYPTO-GRAM has been a free monthly newsletter providing=
summaries=2C analyses=2C insights=2C and commentaries on security technol= ogy. To subscribe=2C or to read back issues=2C see <a href=3D"https://www.= schneier.com/crypto-gram/">Crypto-Gram's web page</a>.

You can also read these articles on my blog=2C <a href=3D"https://www.s= chneier.com">Schneier on Security</a>.

Please feel free to forward CRYPTO-GRAM=2C in whole or in part=2C to co= lleagues and friends who will find it valuable. Permission is also granted=
to reprint CRYPTO-GRAM=2C as long as it is reprinted in its entirety.

Bruce Schneier is an internationally=
renowned security technologist=2C called a security guru by the <cite sty= le=3D"font-style:normal">Economist</cite>. He is the author of over one do=
zen books -- including his latest=2C <a href=3D"https://www.schneier.com/b= ooks/rewiring-democracy/"><cite style=3D"font-style:normal">Rewiring Democ= racy</cite></a> -- as well as hundreds of articles=2C essays=2C and academ=
ic papers. His newsletter and blog are read by over 250=2C000 people. Schn= eier is a fellow at the Berkman Klein Center for Internet & Society at Har= vard University; a Lecturer in Public Policy at the Harvard Kennedy School=
; a board member of the Electronic Frontier Foundation=2C AccessNow=2C and=
the Tor Project; and an Advisory Board Member of the Electronic Privacy I= nformation Center and VerifiedVoting.org. He is the Chief of Security Arch= itecture at Inrupt=2C Inc.

Copyright © 2026 by Bruce Schneier.

** *** ***** ******* *********** *************<=

Mailing list hosting graciously provided by <a href=3D"https://mailchim= p.com/">MailChimp</a>. Sent without web bugs or link tracking.
This email was sent to: cryptogram@toolazy.synchro.net
 You are receiving this email because you subscribed to the Crypto-= Gram newsletter.

<a style=3D"display:inline-block" href=3D"https://schneier.us18.list-ma= nage.com/unsubscribe?u=3Df99e2b5ca82502f48675978be&id=3D22184111ab&t=3Db&e= =3D70f249ec14&c=3Dd73370a38e">unsubscribe from this list</a>  &nbs= p; <a style=3D"display:inline-block" href=3D"https://schneier.us18.li= st-manage.com/profile?u=3Df99e2b5ca82502f48675978be&id=3D22184111ab&e=3D70f249ec14&c=3Dd73370a38e">update subscription preferences</a>
 Bruce Schneier · Harvard Kennedy School · 1 Brattle Squa=
re · Cambridge=2C MA 02138 · USA

</body></html>
--_----------=_MCPart_2124438569--

Who's Online
Recent Visitors
- Rixter
  Mon Jul 20 10:27:16 2026
  from Madison, Nc via Telnet
- Geek2
  Mon Jul 20 07:36:40 2026
  from Euclid, Oh via Telnet
- Rixter
  Sun Jul 19 22:10:01 2026
  from Madison, Nc via Telnet
- Geek2
  Sun Jul 19 10:50:34 2026
  from Euclid, Oh via Telnet

System Info

Sysop:	Amessyroom
Location:	Fayetteville, NC
Users:	71
Nodes:	6 (0 / 6)
Uptime:	17:25:50
Calls:	1,009
Calls today:	2
Files:	1,330
Messages:	275,670

CRYPTO-GRAM, June 15, 2026

Who's Online

Recent Visitors

System Info