Congress Comes For VPNs, Plus FBI & Pentagon Hacks, and Chat Control Defended

On My Radar 🎯

Two Bills, One Goal: Court-Ordered Website Blocking In The US

There are two bills in Congress that do similar things:

1. The first, the American Copyright Protection Act (ACPA) starts as a copyright issue. A copyright owner asks a court to label a foreign website a "piracy site." The court can then order internet service providers, DNS providers, and yes, VPNs, to block Americans from reaching it.
2. The second, the DEFEND IP Act, came shortly after and has sponsors from both parties in the House and Senate. It's a little bit better because it exempts VPN providers and encrypted-only DNS, but regular DNS is still blockable.

The problem with both bills is the precedent set by forcing private companies to block traffic, it's a slippery slope. And who decides what counts as "piracy"? For context, the second bill with momentum is backed by the film and music industry—historically the good guys! 🫥 The EFF shared some nice case studies of this not working out:

• Italy's Piracy Shield blocked 510 harmless sites, including a telehealth platform.
• Spain blocked more than 550,000 domains during soccer broadcasts, including sites belonging to Greenpeace and Harvard.

What you can do: Support the EFF! They oppose both bills and will keep covering them. And it goes without saying: Tell your representative to oppose H.R. 10364 (ACPA) and H.R. 10575 (DEFEND IP).

Bits & Bytes 🤖

~ Story 1: First the FBI, then the Pentagon
ShinyHunters claimed they hacked the FBI, and the bureau has since declared a cybersecurity incident. They stole names, Social Security numbers, home addresses, and assignments for almost all FBI agents, plus records on the FBI's own hacking team! Days later, Pentagon personnel records for over 3 million people were stolen in a very similar breach, though no one has claimed that yet.

My take: The FBI and the Pentagon are two places that get casually hacked in movies but rarely in real life. If there's a lesson here, it's that nobody's safe!

~ Story 2: Chat Control 2.0 Temporarily Fought Off
Patrick Breyer reported that the "dirty deal" to legalize mass scanning of private messages failed, thanks to pressure from civil society and a firm stance from the European Parliament. Technical negotiations continue, with a final push for a political deal in November. The Council still wants to keep Chat Control 1.0, voluntary mass scanning, as a loophole.

My take: Just as Breyer has said: this is a defense, not a final victory! In general, I think everyone reading this should find a healthy, sustainable way to follow news. Something that allows you to stay engaged for years to come, which typically means something that's the right balance of 'active'! Whether that's following Patrick directly over RSS or a podcast/newsletter like this one, or yes—short form content...gasp...I just want you all to find the medium that keeps you active in these fights.

~ Story 3: Meta's Muse Knows Everyone You Know
Mark Zuckerberg says Meta's new AI agent, Muse, was built from the ground up for privacy and security. 🥴 Within weeks, researcher Patrick Wardle found a zero-day that let any app hijack the agent's login token. It traced back to design choices like doing dictation in the cloud instead of on the device. Meta patched it within 12 hours. Now Wired reports that Muse builds detailed profiles of your friends and family.

My take: What an AI tool does reflects the culture of the company running it, and Meta has one of the worst track records out there. If you want to experiment with AI agents, you should be proceeding extremely carefully. Use something open source (Hermes is a common one), run it in a container or VM, and only give it access to what it absolutely needs. Even with these precautions I'd consider this risky—but certainly safer than anything out of Meta.

This Week on Techlore 📺

Go Incognito v2 is HERE! The course, completely rebuilt for 2026: 66 lessons, real demos, and new lessons on AI threats, data brokers, passkeys and more. Section 1 opens Monday, and I'm running a 25% pre-launch discount + an exclusive pre-launch badge, so make sure to hop on that to join the internet's most comprehensive privacy course! The free version starts rolling out shortly after.

Meet Go Incognito V2

Hi everyone 👋 Go Incognito, our flagship course teaching anyone about security, privacy & anonymity, has been rebuilt for 2026 & beyond. Section 1 of Go Incognito V2 opens Monday, October 5, and pre-launch starts now. What it is. A self-guided experience taught by me, 66 lessons across 9 sections, rebuilt

TechloreHenry Fisher

And last thing: I think this was one of the most beloved interviews of the year. The comments (and Signal messages!) sent overwhelming praise to Quad9, who is dealing with some similar blocking I shared earlier. This is a must-listen Techlore Talks, check it out here:

DNS Privacy, Encryption, Funding, and Lawsuits (Quad9 CTO Interview)

Techlore Talks brings you in-depth conversations with the experts at the forefront of digital rights, privacy and security.

TechloreTori

Action Item ✅

A few things this week:

• It didn't make the newsletter, but if you're on iOS, either update to 26.7.1 or 27.0.1 for important security fixes.
• Audit your news consumption, and make sure you have a healthy balance between 'time off' and 'time on'—it's going to be important these next few months!
• Consider Go Incognito for yourself or friends/family to go on the learning journey, it's designed for anyone & everyone.

Until next week 🫡

Written by

Share

Copied