The gist

Most reporting focused on the $17.1 billion settlement. This article explains what Meta received in return, why the settlement creates incentives for other platforms to adopt the same identity system, why age assurance becomes identity verification in practice, why parents already control the restrictions being promised, how verified identities change online anonymity and account bans, and why I believe the consequences extend far beyond protecting children.

Meta settled before Zuckerberg testified

Meta is paying for Instagram ads calling on TikTok and YouTube to “join us in supporting teens”, shortly after its former engineering director Arturo Béjar told a federal jury: “You just cannot trust Mark Zuckerberg with kids.”

The ads promote the settlement that Meta signed with 52 attorneys general on 26 August. It ended the Oakland trial in which 29 states accused Meta of designing Facebook and Instagram to addict children, exposing them to content from sexual predators and lying about both. The trial ended before the states called Mark Zuckerberg to testify.

Meta will pay up to $17.1 billion over 10 years, less than 1 year of its profit. About $12 billion is payable regardless. The remaining $5 billion becomes payable only if TikTok and YouTube adopt comparable restrictions, including age assurance, and make matching multibillion dollar payments. Meta is now publicly pressuring both competitors to adopt the same system, which would spread the restrictions and financial burden across the industry.

The platforms share another incentive. The settlement requires a system for identifying the age of every person, connecting accounts belonging to the same person and restricting anyone it classifies as a child. That type of system becomes more valuable when every large platform adopts it.

Meta says it’s proud of its work protecting children and has always worked with parents and experts. Béjar testified that the same company operated a “don’t ask, don’t tell” policy towards children under 13 because they were its future audience. Meta’s now buying ads that present its competitors as the obstacle to protecting teenagers.

“Robust” age assurance means identity verification

The requirements are contained in a 130 page court order. Section II.A.1 requires Meta to apply an age assurance method to every adult and child using Facebook or Instagram in participating states within 1 year.

Section II.A.3 identifies the mechanisms that make this enforceable. They include identity documents, face analysis and other signals Meta considers reliable enough to determine age. Section II.A.10 says an account that doesn’t complete the required process within 14 days must be treated as belonging to a teenager, regardless of the age previously provided.

The most important word in the settlement is “robust”.

Australia’s eSafety Commissioner, Julie Inman Grant, introduced “robust age assurance” after TikTok and other platforms failed to identify teenagers’ ages correctly. She said regulators wanted to determine “how far these companies need to go to implement robust and effective age assurance mechanisms”.

When those systems continued to fail, the Australian government proposed doubling the maximum penalty from A$49.5 million to A$99 million and giving Inman Grant stronger powers to obtain evidence from platforms and their age verification providers. The same word, “robust”, has now appeared in the US settlement.

I don’t believe that sequence is accidental. An age entered by a person isn’t robust. An estimate based on account activity isn’t robust when regulators have decided that platforms fail to identify children reliably. The system becomes robust when it demands stronger evidence tied to a real person. In practice, that means an identity document, a face scan or another identity signal that regulators consider reliable.

“Age assurance” is the acceptable public term. “Robust” tells us what they intend it to become. Identity verification is the destination.

Meta already uses identity documents and face analysis

Meta already operates the 2 methods that make this possible: identity document uploads and Yoti facial age estimation. Yoti analyses a person’s face and returns an age estimate to Meta. They describe the process as “privacy preserving”, but I’ve repeatedly challenged Yoti’s founder directly in the comments under my posts and explained why sending a face to a third party for analysis doesn’t preserve privacy. A commercial provider performs the analysis, but Meta chooses the provider, uses the result and retains the legal duty.

That arrangement doesn’t remove the privacy risk. It introduces another company into the process. Spain’s data protection authority fined Yoti €1.3 million for unlawful processing in its Digital ID app. The findings included biometric processing without a valid legal basis, consent obtained through a box selected in advance and excessive retention. This is the company Meta selected to help decide whether people are old enough to use Instagram.

Adults who refuse to submit to the process can be treated as children. Their access can be limited to 2 hours a day and blocked overnight. The system therefore pressures every adult to provide stronger evidence about themselves if they want ordinary access.

Meta must also build a model to identify children under 13 and connect every account it decides belongs to the same person. This prevents someone from creating another account to obtain another 2 hours. It also requires Meta to become better at identifying people across accounts.

Parents already control time and access

The identity system is presented as one part of a broader child safety package. But all of the meaningful access restrictions in that package can already be imposed by parents without identifying every adult who uses social media.

I first encountered content and account moderation while working at AOL in the mid to late 1990s. We treated online safety as a product responsibility and sold it as a reason for families to join AOL and use the web.

I’ve since helped establish standards and build technologies for child safety, content filtering, cybersecurity and content moderation. In 2004, I co founded the W3C standard for Content Labelling and URL Classification and co invented the concept of account classification. Today’s account verification systems, including Twitter Verified and LinkedIn Verified, reflect that broader concept of classifying accounts to help people distinguish between different levels of trust and authenticity.

I’ve long advocated voluntary account verification to reduce online impersonation and fraud, alongside classifying websites and online services according to risk, compliance and child safety requirements. Those are targeted controls designed to solve specific problems without requiring everyone to prove their identity.

I oppose mandatory government mandated account verification used to build surveillance and control systems by coordinating with a small number of technology companies under the banner of online child safety or combating child exploitation.

Technology is only one part of digital safety. Effective protection depends just as much on psychology, human behaviour, digital risk, parental decision making, education and understanding how people respond to different types of controls. Building a feature is relatively straightforward. Designing controls that reduce harm without creating new risks requires experience across all of those disciplines.

That’s the perspective I bring. Being a parent doesn’t qualify me to explain how these systems work. Decades spent designing technologies for child safety, content moderation, cybersecurity, online trust and digital rights do. I’ve worked on the technical, behavioural and policy challenges behind these systems for years. I know what they can do, what they can’t do, where they fail, and which controls belong on the device, inside the app, integrated with the service, or with the parent. Technology is the enabler. Understanding psychology, human behaviour, digital risk and education determines whether it improves safety.

The formal list of child safety features Meta must implement on Facebook and Instagram is:

1. A 2 hour daily time limit across the platforms.

2. Mandatory pauses after 15 minutes of continuous use to interrupt endless scrolling.

3. Night time blocks restricting children’s access to feeds from midnight to 6am, with notifications silenced from 10pm to 7am.

4. Restricted school time access through the removal of push notifications on weekdays from 8am to 3pm during the school year.

5. Age verification measures.

6. Stronger parental supervision controls.

7. Content controls intended to protect children from bullying and material promoting eating disorders, suicide and self harm.

8. Limits on social comparison features, including beauty filters and visible like counts associated with poor mental health.

9. Oversight by an independent auditor.

Every smartphone already lets parents impose time limits, curfews, notification restrictions and complete app blocks. Parents can set a 2 hour daily limit for specific apps and websites, categories of apps or the entire device. They can restrict access during whatever hours they consider appropriate and disable push notifications through the device settings.

If parents believe Facebook, Instagram, TikTok, Reddit or X is unsuitable for their children, they can block it completely. Once a child can’t access a service, its content and members can’t harm them through that service.

Device controls don’t change what appears inside Facebook, Instagram or TikTok. They don’t change recommendation systems, remove harmful content or provide independent oversight. Those responsibilities remain with the platform. Device controls simply allow parents to decide whether, when and for how long their children can use those services.

Those controls already exist and none requires every adult to prove their identity. Mandating identity verification doesn’t create time limits, curfews or app blocking. It introduces a separate identity system to deliver controls that parents already have, while removing the choice from families who are already satisfied with how they manage their children’s devices.

The settlement could make children less safe

This is where I believe the settlement could put children at greater risk.

The settlement may give parents a false sense of safety. Instead of blocking Facebook, Instagram or TikTok, some may allow their children to use them because governments have approved a package presented as protective. They may assume the platforms are now safe and that the companies will protect their children.

The settlement therefore does 2 things at once. It normalises identity verification for everyone while encouraging parents to trust companies whose conduct led to the lawsuit.

Content moderation, user controls and access restrictions should be treated as separate issues. Social media companies should provide effective controls that allow people to exclude content they don’t want to see. That’s different from governments and platforms controlling access to entire services because their content is assumed to be undesirable or dangerous.

Time limits and notification controls don’t stop recommendation systems from amplifying harmful material. Age verification doesn’t make harmful content safe. Identity verification for every adult doesn’t give parents more control than they already have through device level controls.

Identity bound accounts can make bans permanent

I believe Meta accepted identity verification because it’s a price the company wanted to pay. It kills online anonymity, expands surveillance and gives Meta more information for connecting accounts to individuals. Children become the justification for building a system that applies to everyone.

Identity bound accounts create the means to enforce that suppression. Today, losing an account is an inconvenience for some people and a disaster for anyone whose business depends on it. But a banned person can usually create another account with a different email address. That ends when every social media account must be connected to a verified identity.

Once accounts are connected to people, a platform ban can become a lifetime ban. It doesn’t matter if the original decision resulted from an overzealous automated moderation system, a mistaken classification or a deliberate decision by someone controlling the platform. The person can’t return using another email address because the system recognises their identity, not merely their account.

The threat changes behaviour before any ban occurs. When access to public life depends on maintaining the approval of a few governments and tech companies, people do more than remain silent. They censor themselves, avoid difficult subjects and repeat views they believe are safe. Public debate continues, but only within permitted boundaries, creating the false appearance of free expression and public consent.

Meta avoided personal accountability

Most headlines focus on the size of the payment without explaining how it can be reduced, why that reduction depends on competing platforms or what Meta receives in return. The amount is small enough to remain a cost of doing business after former directors testified that Meta harmed children and lied about it for years.

Meta avoided the rest of the trial. Zuckerberg avoided testifying. The company obtained defined releases from state claims and a mechanism for spreading the same identity system across its biggest competitors.

Children have died. Children have been exposed to predators. Meta has been accused of designing systems that amplified harm, concealing evidence and misleading families and governments. Yet the settlement doesn’t stop at penalising Meta. It introduces a court ordered identity verification system that applies to every adult and teenager when they reach a certain age, creating a new capability with consequences that extend far beyond child safety.

The settlement tells us what Mark Zuckerberg and other tech executives can do without facing personal accountability. It also tells us what governments chose to demand instead: “robust” identity checks for everyone.

Continue reading

If you found this investigation valuable, subscribe below.

What you’ll get

Every investigation begins with the core insight, then explains the technical capability, incentives, relationships and evidence behind it.

I examine technology, AI, surveillance, cybercrime, digital identity, privacy, online safety, intelligence, legislation and the companies, governments and investors shaping them.

Most posts take only a few minutes to read. Around once a month I’ll publish a longer investigation when a subject deserves deeper analysis.

Why this publication exists

Too much reporting separates events that belong together.

A government announcement becomes one story. An acquisition becomes another. An investment, a technical capability, a policy change or an executive statement becomes something else entirely.

I investigate how those pieces connect. I don’t begin with conclusions. I begin with technical capability, evidence and incentives. Intent is the last thing I consider, not the first.

The gist

OpenAI’s ChatGPT integration for Apple Messages lets one person give ChatGPT access to private conversations involving other people who never installed it, never agreed to it and may never know it’s happening.

People rely on iMessage because Apple designed it so even Apple can’t read messages in transit. This integration changes that. Once ChatGPT can access readable conversations, it can search, analyse and send message content to OpenAI for processing. If those conversations are later stored in the cloud, they become subject to OpenAI’s retention rules, legal preservation orders and government requests.

This article explains how the integration works, what OpenAI told Fortune in response to my research, why I believe those answers don’t address the core privacy issue, and why consent from one participant shouldn’t expose everyone else in a private conversation.

About this FAQ page

I put this FAQ together after several days of discussions across X, LinkedIn and Substack. These are the questions and misunderstandings that keep coming up, along with my responses.

My position is simple:

Scope

Apple Messages is one app that supports three services: SMS, iMessage and, more recently, RCS. Most people think of SMS when they think of Apple Messages. This analysis is restricted to iMessage, and to RCS where it is end to end encrypted by the device and network provider, because some people rely on that encryption for private communications.

Substack has a unique feature

Highlighting text on this page opens a Substack share menu. Clicking it generates a unique link to that section. Opening the link takes readers directly to the selected text.

You can also highlight text to generate an Instagram quote image.

What the ChatGPT integration does

OpenAI released the Apple Messages plugin on 20 August 2026 for the Apple silicon build of the ChatGPT desktop app for macOS. It’s available on all ChatGPT plans and works within ChatGPT Work and Codex.

It can read, search, summarise and draft iMessage, SMS and RCS conversations stored on the Mac, and send messages through the Messages app.

It requires 3 macOS permissions: Full Disk Access, Contacts and Automation. Full Disk Access removes the restrictions macOS normally places around protected application data, and Apple’s own warning for that permission names Messages among the data exposed. Contacts associates phone numbers and email addresses with real identities. Automation allows ChatGPT to operate Messages. Very few Mac applications require this combination.

Apple didn’t create a new API for this. OpenAI built the plugin on existing macOS permissions.

Sending requires approval by default. A person can choose “Always allow sending to this chat”, after which ChatGPT sends to that chat without further approval. Approval before sending protects the Mac owner against an unwanted outgoing message. It doesn’t obtain consent from the other participants, and it doesn’t undo any reading or processing already performed.

OpenAI says the integration runs locally by default and doesn’t build an index. Local execution isn’t the same as local processing. When ChatGPT summarises a thread or drafts a reply using a hosted model, that content leaves the Mac. Once it leaves the Mac, how long OpenAI keeps it depends on the person’s plan, their settings, and any legal preservation obligation OpenAI is under. Some believe OpenAI holds onto data forever.

If Messages in iCloud is switched on, the Mac can hold years of history, attachments and identities, plus every SMS two-factor code an iPhone forwards to the Mac.

OpenAI’s response to my analysis

Since publishing my original research, Fortune investigated my concerns. They interviewed me and Lookout CTO Dave Richardson, considered Proton’s analysis, and put questions directly to OpenAI. Fortune also asked Apple whether it anticipated existing macOS permissions being used to give AI agents the ability to read Messages, and whether it’s considering additional safeguards. Apple didn’t respond.

OpenAI made 6 points to Fortune. Each one is accurate as far as it goes. None addresses the central issue I raised: one person can authorise ChatGPT to access conversations involving other people who were never asked, are never notified and can’t opt out.

Here are OpenAI’s points and my response to each.

OpenAI: the plugin runs locally by default

The plugin runs on the Mac. The model doesn’t. ChatGPT’s models run on OpenAI’s servers. When someone asks ChatGPT to summarise a thread, search Messages or draft a reply, the message content needed for that task is sent to OpenAI for processing. Local execution of the plugin isn’t the same as local processing of the content.

Runs locally describes where the plugin is installed. It doesn’t describe where the message content is processed once the plugin is used.

OpenAI: ChatGPT only reads Messages when a user explicitly asks it to

Correct, and it doesn’t change the privacy issue.

The Mac owner asks. Nobody else in the conversation is asked. Summarising a group chat reads every participant’s messages. Searching for something another person said searches their messages. The people whose messages are being analysed aren’t notified, can’t object and have no knowledge the request was made.

This confirms the design: one participant can instruct ChatGPT to read everyone else’s messages.

OpenAI: the plugin doesn’t automatically upload or index a user’s message history

Two words do most of the work in that sentence: automatically and index.

“Automatically” confirms that uploading happens when a request needs it. Enabling the plugin doesn’t upload everything. Using it uploads whatever the request requires. Someone who regularly uses ChatGPT with Messages sends a growing share of their conversations to OpenAI, request by request.

“Index” refers to OpenAI’s servers. It doesn’t matter whether OpenAI builds one. Apple Messages already stores years of conversations in a searchable database on the Mac, and Full Disk Access allows ChatGPT to search it. OpenAI doesn’t need its own index because Apple already built one.

Access, processing, transmission and storage are different stages. The privacy issue begins when ChatGPT can read the messages. Sending them to OpenAI and storing them there creates additional privacy and security implications. OpenAI’s statement only addresses whether it automatically uploads or indexes an entire message history. It doesn’t address reading the messages or transmitting and retaining the content used to answer a request.

OpenAI: ChatGPT desktop conversations are stored locally by default

OpenAI says ChatGPT desktop stores conversations on the Mac by default, so Messages content included in those conversations isn’t automatically synced to its servers.

That describes where the ChatGPT conversation is saved afterwards. It doesn’t describe what happened while ChatGPT answered the request. The relevant message content was already sent to OpenAI for processing. Where the transcript is stored afterwards is a separate question.

OpenAI: if a user stores a conversation in the cloud, Messages content follows the same retention rules as other content

🚨 This is the most important admission in OpenAI’s response.

Once someone stores a ChatGPT conversation in the cloud, any Messages content in it is retained under OpenAI’s standard retention rules until it’s deleted, and it may also inform Memories stored in the cloud. The messages written by everyone else in that conversation can now be held on OpenAI’s servers, in readable form, for as long as the Mac owner leaves them there. The people who wrote those messages can’t delete them because they don’t have access.

Those retention rules also include legal preservation. In 2025, a US court ordered OpenAI to preserve ChatGPT conversations for the New York Times litigation, including conversations people had deleted. A person’s own decision to delete didn’t remove their data. The other participants in a Messages conversation never had even that option.

This is where the side entrance for governments opens. Content OpenAI holds can be requested through legal process, including under the CLOUD Act, regardless of where it is stored. Apple can’t produce the content of an end to end encrypted conversation. If a copy exists at OpenAI, authorities can ask OpenAI instead.

OpenAI: the plugin uses existing macOS capabilities, not a new Apple API

Correct, and that’s the core of Apple’s problem.

Apple didn’t build a way for third parties to read Messages. OpenAI combined permissions Apple designed for other purposes to achieve that result. Apple’s own warning for Full Disk Access names Messages among the data it exposes.

The required permissions include AppleScript, Accessibility and Full Disk Access. OpenAI’s documentation lists Full Disk Access, Contacts and Automation. AppleScript and Automation refer to the same permission. Whether the plugin requires Accessibility or Contacts, or both, is something OpenAI should state clearly in one place.

Lookout: “spyware” is a little too strong

Dave Richardson said spyware is too strong because spyware takes information without the user’s permission, whereas this feature is disabled by default and only works when the Mac owner enables it. He also said enabling it creates significant risk for a channel people have treated as secure, and that giving OpenAI or Anthropic access to messages removes many of the protections end to end encryption provides.

I agree with the second point. I disagree with the first.

The Mac owner gave permission. Everyone else in the conversation didn’t. Those people never installed ChatGPT, were never asked, aren’t notified and can’t opt out. From their perspective, software they never authorised can read their messages without their knowledge.

Whether that should be described as spyware depends on whose permission you believe matters.

What OpenAI didn’t say

OpenAI didn’t say if the other participants in a conversation have any way to know their messages are being read, any way to object, or any way to have their content removed from OpenAI’s servers. They don’t, and OpenAI didn’t address it.

I told Fortune:

“Every single person I send a message to through iMessage will never know that I have a third party inside that application, and they will never be notified.”

OpenAI’s response answers questions I didn’t ask. Nobody asked whether the plugin uploads an entire message history as soon as it’s turned on. I asked how one person can give ChatGPT access to other people’s private messages without those people knowing or agreeing. OpenAI didn’t respond to that. It deflected to a narrower question it could answer comfortably. That’s misleading and irresponsible.

Fortune’s investigation includes OpenAI’s response alongside my concerns and Richardson’s assessment. If you want both sides of the technical argument, read it.

Freedom of the Press Foundation told journalists this is a human trust problem. It just put them in danger.

Freedom of the Press Foundation exists to keep journalists and their sources safe. It builds SecureDrop, the system sources use to leak documents to newsrooms, and has trained more than 8,800 journalists in digital security in the last five years. Its Digital Security Digest goes directly to reporters and the people who talk to them.

On this integration, that newsletter got the technology wrong and told its readers the risk was one they’d always lived with. A journalist who read it and concluded iMessage is still safe as long as they trust their contact has been given false reassurance by the organisation they trust most on this subject.

This week I met investigative journalists from a national broadcaster to discuss Chat Control. One of them spent 10 years reporting in China. She relied on iMessage there for their privacy and her personal safety. FPF’s advice ill informed and dangerous. Every journalist working in a hostile country, and every source who has ever messaged one, is who this advice was written for. It has to be corrected.

FPF told its readers three things.

“This particular plug-in runs locally on your own computer, rather than processing your messages on a cloud server.”

This is wrong. The plugin runs on the Mac. The model does not. ChatGPT models run on OpenAI servers. Every summary, search result, and draft reply is produced by sending the relevant message content to OpenAI to be processed.

TechCrunch’s line that content “is stored locally” describes where the ChatGPT conversation is saved afterwards. It says nothing about where the messages went to be read. The Future of Privacy Forum confused where the plugin is installed with where the content is processed. OpenAI’s phrase “runs locally” is designed to produce that confusion, and it worked on a security training organisation.

“Someone would need to choose to save your messages with OpenAI. They could just as easily take screenshots of your messages and store them on any other cloud provider.”

A screenshot is a single message, chosen by a person, at one moment. This is software with persistent access to every conversation, able to read and search years of messages from hundreds of people on request.

A screenshot on someone’s iCloud’s a file. Messages processed by OpenAI is held by a company that’s already been ordered by a US court to preserve conversations its customers deleted, that publishes figures on the government requests for content it receives, and that can be compelled under the CLOUD Act wherever the data sits.

Treating those as equivalent isn’t a simplification. It’s a different risk model, and it’s the wrong one for a journalist or a source.

“Though AI amplifies the risk, this problem has always been there.”

Trust in the person you’re talking to has always been the question. A person you trust can now hand your entire history to a third party without knowing that’s what they’ve done, because OpenAI told them it runs locally. That’s new. The advice FPF gives in the same newsletter, that if you can’t assess the risk you shouldn’t process messages with these tools, is correct. It should have been the entire answer.

Edward Snowden was FPF’s board president from 2016 to 2022 and still sits on its board. His revelations are the reason journalists moved to end to end encrypted messaging in the first place. An FPF newsletter telling those journalists that a third party inside their encrypted conversations is the same problem they’ve always had contradicts the lesson Snowden taught the world.

FPF should correct the newsletter. Specifically, it should tell its readers that message content is processed on OpenAI’s servers, that content saved to the cloud is subject to OpenAI’s retention rules and legal process, and that the other participants in a conversation are never asked, never told, and can’t opt out. Journalists and sources who read the original version have been given a false sense of safety.

Why iMessage is a critical channel for privacy

A lot of people rely on iMessage for privacy because it provides end to end encryption by default. No one, not even Apple, can read the content of a message as it travels between Apple devices.

Key reasons people trust iMessage:

• End to end encryption. Messages, photos and attachments are locked with keys only the sender and receiver possess.

• No extra setup. Unlike other apps, or RCS where encryption can be optional or absent, iMessage secures chats automatically on every iPhone.

• Default SMS replacement. It’s built into the native iOS messaging app, so secure communication doesn’t require third party tools.

• Metadata protection. Compared with platforms like WhatsApp, Apple retains much less user metadata for tracking or advertising.

Apple has spent years resisting government demands to weaken iMessage encryption or create a way for authorities to access private messages.

How iMessage differs from SMS and RCS

SMS is not protected by end to end encryption. It’s one of the least private ways to communicate.

RCS can be protected by end to end encryption between supported Apple and Android devices, but support varies.

iMessage is protected by end to end encryption.

Why end to end encryption is more important for some people than others

Unencrypted services like SMS and Gmail work on the understanding that intermediaries might process your messages. End to end encrypted chats are different. People choose them specifically to keep their words private from third parties.

For everyday chat, the extra risk might not be important. For sensitive conversations, it changes everything. Journalists and sources, lawyers and clients, executives, researchers, government officials, security professionals, activists, abuse victims, and ordinary people sharing personal information face severe real-world consequences if their chats leak. For many of them, end to end encryption isn’t a preference. If their chats reach governments or other third parties, their freedom, job or personal safety is at risk.

Privacy risk depends on context. When someone turns on an AI integration in an encrypted app, they remove the protection those groups rely on.

Why private conversations should stay private

People have a right to be left alone. Privacy is a human right.

People share specific information with people they choose to trust with it. Some deliberately use iMessage instead of SMS or Gmail because end to end encryption keeps that conversation between the participants. That protection can be critical when disclosure could cause personal, professional, financial or physical harm.

Trusting another person with information is fundamentally different from agreeing that software operated by another company should be able to access, search and analyse it.

What can happen when ChatGPT is added to Apple Messages

ChatGPT gains the ability to access and process information in Messages when the Mac owner asks it to perform tasks.

Years of conversations can be searched to extract sensitive information, identify relationships and build social graphs at a scale that wasn’t previously possible with messages protected by end to end encryption. Saved conversations reveal names, locations, relationships, organisations, events and sensitive information, along with who is talking to whom.

Message content reveals much more than metadata: who people are, their relationships, locations, work, interests and what they discuss. AI can run sentiment analysis to work out the emotional tone and attitudes behind private conversations. Anyone with access to that data and these tools can search it, reconstruct a person’s timeline, link people across different chats, and map their social network.

This applies to conversations people originally had somewhere else, including conversations involving people who never used ChatGPT.

Once readable iMessage content is shared with ChatGPT, a third party can process conversations the other participants believed were protected between endpoints, and that content can become subject to government demands for user data through legal process.

One person can therefore turn an end to end encrypted conversation into information accessible to a third party, and potentially to governments, without the knowledge or consent of everyone else in that conversation. Those people aren’t notified, can’t opt out, and may never know their messages have been accessed.

💡 One person gets the convenience. Everyone they chat with inherits the risk.

Is end to end encryption broken?

No. The encryption still works perfectly.

Nobody needs to break encryption if software can access your messages before they’re encrypted or after they’re decrypted.

When an encrypted message reaches the recipient, their device decrypts it so they can read it. Software running on that device can then access the readable text.

The mathematics remain secure. The privacy protection you rely on is bypassed on the device.

End to end encryption is supposed to keep third parties from reading your private messages. If another company can read those messages anyway, saying the underlying maths still works misses the privacy problem.

Is client side scanning the same thing?

Not necessarily.

Client side scanning describes a broad category of techniques, and implementations differ substantially. The relevant principle is more simple: when software can inspect plaintext at an endpoint, end to end encryption can’t protect that plaintext from the software doing the inspection.

“I don’t use ChatGPT”

It doesn’t matter.

If someone you chat with installs the integration, OpenAI can access your conversation with them. That includes every message you sent and received that’s still stored on their Mac.

I don’t use Apple

It doesn’t matter.

You could use Android, GrapheneOS or another device. If someone you message has given ChatGPT access to your conversation through Messages, you won’t know.

How will I know if someone has added ChatGPT?

You won’t, unless they tell you. There’s no notification and you can’t opt out.

You aren’t asked for permission. Apple doesn’t notify you that the other participant has authorised third party access to their copy of the conversation. You can’t revoke their permission.

Can ChatGPT access old conversations?

Yes, if those conversations remain available through Messages.

Depending on how long the other person has retained the conversation and how Messages is configured across their Apple devices, that conversation could date back years and contain thousands of messages. Messages in iCloud can synchronise existing history to a new device.

Deleting your copy doesn’t delete theirs.

“People can take screenshots of your private messages”

True. Someone can take a screenshot, forward a message, repeat what you told them, or print a conversation and hand it to the FBI.

That has always been possible.

Deliberately sharing specific information is different from giving software access to search and analyse years of private conversations involving hundreds of people. As I told Fortune, a screenshot is you breaking that person’s trust. It isn’t you allowing a third party inside the conversation.

💡 Receiving a message and giving someone else access to it are two different things.

Isn’t the user explicitly granting permission?

The Mac owner is. Everyone else in their conversations isn’t.

One person clicking Allow gives ChatGPT access to conversations involving other people who weren’t asked, weren’t notified and can’t opt out.

Doesn’t sending someone a message mean accepting that they control their copy?

They receive a copy of your message. That doesn’t mean you agreed to them giving a third party persistent access to your conversations.

Private communication has always involved a human trust relationship. Someone can betray that trust.

Automating persistent access to entire conversation histories changes the scale, persistence and capability.

Email integrations already do similar things

Email and AI create their own serious privacy questions.

That’s a separate conversation. The existence of another privacy problem doesn’t resolve this one. And, we’re talking about end to end encryption which deserves focused attention.

Couldn’t malware already steal all these messages?

Yes, if malware successfully compromises an endpoint.

That’s why endpoint security exists.

Comparing an authorised consumer product with malware doesn’t defend the product. It demonstrates how valuable endpoint access is.

Isn’t this the same as taking a screenshot?

No. A screenshot is one person choosing to copy one message at one moment. They decide what to share, who to share it with, and when. Everyone has always accepted that risk when they send a message. It’s a human trust relationship, and a screenshot is one person breaking that trust.

The ChatGPT integration is software with continuous access to every conversation. It can read, search and analyse years of messages from hundreds of people at once, on request, without any of those people knowing. Nobody chooses which of their messages are read. Other people aren’t told and they can’t opt out.

Scale is the difference. One screenshot is one leak. This is a standing capability to search everything, from everyone, at any time.

And a screenshot stays with the person who took it. Content ChatGPT processes goes to OpenAI’s servers, where it’s subject to OpenAI’s retention rules, legal preservation orders, and government requests. A screenshot doesn’t create a copy of your private conversation at a company that can be compelled to hand it over.

A person betraying your trust and a company being given access to your conversations are two different things. Comparing them doesn’t defend the product. It shows how much bigger the exposure is.

I have nothing to hide. Why should I care?

Because privacy is a human right. What people say privately is nobody else’s business unless they choose to share it.

You might not care who reads your messages. That doesn’t give the right to decide that everyone who communicates with you should feel the same way.

Medical information, finances, relationships, business discussions, photographs, locations and personal opinions are all legitimate reasons for confidentiality. For journalists, lawyers, doctors, activists, executives, government officials, abuse victims and many others, disclosure can have serious consequences.

Edward Snowden captured the flaw in the “nothing to hide” argument:

“Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say.”

Aren’t you being a privacy absolutist?

No.

I make privacy trade-offs all the time.

The issue is who gets to make the decision. If you decide that giving AI access to your information is worth the convenience, that’s your choice. The problem starts when your choice exposes information belonging to people who weren’t given a say.

Are you saying nobody should trust OpenAI?

This argument doesn’t depend on OpenAI intending to misuse anyone’s information.

It’s about what the technology makes possible, what data becomes exposed, what happens if it’s compromised, and what governments can request. It’s also about past records, stated goals and emerging laws, which show how these tools could be used and by whom.

Intent is one data point. Capability, access, history and law are others.

I don’t trust this integration, and I don’t accept its stated purpose. It reads and analyses private conversations involving people who never installed it, were never asked, and are never told. To those people, that is spyware. Lookout’s CTO says my use of the word is too strong because the Mac owner gave permission. The Mac owner’s permission isn’t the one that’s important. My full answer to him is under OpenAI’s response above.

Why do some security professionals disagree with you?

I don’t know. Security professionals have disagreed with me about emerging channels and new technology and its risks many times over the years. Security usually catches up only after new platforms, habits and tools are already everywhere.

Some say taking a screenshot is the same as giving ChatGPT access to your chats. One person taking a screenshot is different from software having continuous access to years of private chats with hundreds of unsuspecting people.

Others argue that the encryption isn’t broken. I agree, and that’s the whole point. Encryption doesn’t need to be broken if software can read the plaintext before or after the device encrypts or decrypts it.

How governments and law enforcement benefit

Apple refused to build a backdoor. OpenAI built a side entrance.

Governments and law enforcement have pressured Apple for years to build a “secure backdoor” into iMessage and iCloud backups, arguing that encryption turns digital communications into “lawless zones” where criminals operate without fear of surveillance. Officials call this the “Going Dark” problem: wiretaps and court-ordered search warrants are rendered useless by end to end encryption.

The FBI has repeatedly complained that encryption prevents it from reading messages even when it has legal authority to obtain them.

Former FBI Director James Comey described the problem:

Apple and technical experts like me argue that a "secure backdoor" is a mathematical impossibility. Any backdoor built for a "good guy" creates a vulnerability that will be discovered and exploited by hostile nation-states, cybercriminals, or automated AI hacking systems.

Governments don’t gain a live tap into everyone’s messages through this integration. What they gain is a systemic side entrance. If OpenAI holds a person’s readable iMessage content on its servers, governments don’t need to break iMessage encryption or force Apple to build a backdoor. They can request the data from OpenAI through legal process.

OpenAI already accepts government requests for customer data and content, including requests connected to law enforcement and national security. It also has a process for emergency disclosure requests involving danger of death or serious physical injury. Its latest published figures report 75 government requests for content between July and December 2025.

Snowden proved why end-to-end encryption is vital

Edward Snowden proved that any digital communication not protected by end to end encryption is automatically collected, stored and analysed by global intelligence agencies as part of a borderless mass surveillance dragnet.

Before his 2013 leaks, governments maintained that surveillance was targeted at specific suspects. Snowden’s documents proved the existence of infrastructure designed for bulk collection: intercept everything first and ask questions later.

Direct interception via PRISM. The NSA had direct, court-ordered access to the central servers of major US technology companies, including Google, Yahoo, Microsoft and Facebook. For any communication not encrypted before leaving a person’s device, the government could pull private emails, chat logs, photos, files, and live voice and video calls directly from the provider.

Tapping the physical internet (Upstream). The NSA and allies such as the UK’s GCHQ placed fibre-optic taps on the undersea cables and internet gateways that carry global traffic. Any data crossing those cables without strong encryption was intercepted in transit.

Total metadata ingestion. Even where content couldn’t be accessed, governments permanently stored metadata: who you talked to, when and for how long, and your physical location via cell tower logs. Because metadata was legally unprotected under the US third-party doctrine, agencies mapped the social networks, movements and daily habits of millions of innocent people simultaneously.

Deliberately sabotaging commercial security (BULLRUN). The NSA spent billions of dollars weakening global security standards, covertly introducing vulnerabilities into commercial encryption software and hardware so that standard internet communications stayed searchable.

Snowden’s revelations proved the internet is insecure by default. They created the commercial urgency that pushed technology companies away from unencrypted protocols and toward default end to end encrypted services like iMessage, which people rely on today to protect themselves from automated mass surveillance.

Snowden revealed how intelligence agencies used communications metadata at scale to map who communicated with whom, when and how often. That was enough to reconstruct social networks, daily routines and movements for millions of people without reading a single message.

Readable message content held by OpenAI gives much more than metadata, and this integration gives it in a form built for searching.

A new social graph for mass surveillance

Messages in iCloud synchronises a person’s full conversation history across their Apple devices. A Mac with Messages in iCloud enabled can hold every conversation that person has kept, across years, with every contact, including attachments. Full Disk Access gives ChatGPT the ability to search all of it. The Contacts permission links every phone number and email address in those conversations to a real name. The result is a complete, named record of who a person talks to, what they talk about, and when.

Metadata tells an analyst that two numbers exchanged forty messages last Tuesday. Content tells them what was said. Names, addresses, locations, employers, medical details, financial details, relationships, plans, opinions and photographs are all in the text. Group chats add everyone else in the group.

AI removes the labour that once limited what could be done with that content. Sentiment analysis can classify the emotional tone of a conversation, identify conflict, fear, anger or loyalty, and track how it changes over time. Entity extraction can pull every person, place, organisation and event out of years of messages in minutes. Timeline reconstruction can order those events. Cross-referencing can link the same person across different chats, and link people who never messaged each other but were discussed by a third party. None of this requires a human to read the messages.

Anyone holding that content and those tools, whether a company, an attacker who compromises it, or a government that requests it, can build a detailed picture of a person’s life and everyone in it. Snowden showed what metadata alone made possible. Searchable content is the version he warned about.

“Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say”.

- Edward Snowden

Listen to Sam Altman

Sam Altman has explicitly warned about the sensitive information people share with ChatGPT. He has said that people discuss deeply personal information with ChatGPT without the legal privilege that protects conversations with lawyers, doctors and therapists, and has expressed concern about circumstances in which OpenAI could be legally required to produce those conversations.

That concern gets worse with this integration. ChatGPT is no longer limited to what people type into it. It can now read conversations that happened in Messages, written by people who never used ChatGPT at all.

Can the US government access my messages if I live outside the US?

Living outside the US doesn’t put your data beyond the reach of US authorities.

Under the CLOUD Act, a US provider can be required to produce data within its possession, custody or control regardless of whether that data is stored inside or outside the United States, subject to the applicable legal requirements and procedures.

For people in the EEA and Switzerland, OpenAI services are provided through OpenAI Ireland. OpenAI has a separate process for government requests to OpenAI Ireland. Requests must use valid legal process, and there is a route for governments outside Ireland to make them.

That doesn’t put your data beyond the reach of the US government or intelligence agencies. Living outside the US doesn’t protect it, and storing it outside the US doesn’t protect it.

Couldn’t the FBI seize someone’s phone?

Yes. Getting information from a locked phone and getting a readable copy from a service provider like OpenAI are two different legal routes.

With a phone, the FBI must first find and seize the physical device, and may still fail to get past its passcode.

If a copy of those messages exists with a third party company, authorities can use a legal order to get the data directly from that company.

What experts in end to end encryption think

Signal President Meredith Whittaker has warned that AI agents and client side scanning are surveillance tools that threaten the existence of end to end encryption. Her point is simple: as soon as a third party or automated scanner is put inside a private encrypted conversation, an opening has been created, and the app no longer does the one thing it exists to do. She said giving an AI agent this kind of access to Signal “would constitute a kind of a backdoor”.

That’s also my argument for calling the ChatGPT plugin for Messages spyware, and a side entrance for government surveillance.

Proton was more direct. After I published my original research, Proton cited it in its own analysis and agreed with the core concern. Proton said the integration “essentially renders Apple’s end-to-end encryption obsolete” because readable message content can leave the encrypted environment and reach OpenAI.

Proton also published an unusually direct warning:

Lookout CTO Dave Richardson's assessment, including his view that "spyware" is too strong, is covered above under OpenAI's response. Lookout also told Fortune that its analysis of more than 420 million Android and iOS apps shows AI-related apps have asked for access to more data and more high-risk capabilities over the past year.

Is this illegal under GDPR?

I don’t know yet, and I’m not going to claim it is until I’ve researched it properly.

GDPR doesn’t always require consent before someone’s personal information can be used. There are exceptions and other legal bases companies can rely on.

GDPR isn’t the only law that could apply. Privacy, communications, interception and wiretapping laws differ between countries and could be relevant when a third party is given access to private messages without everyone knowing or agreeing.

The question I’m researching: under what circumstances can one participant authorise a third party to access and process private communications containing personal data belonging to other participants who weren’t informed and can’t opt out?

I’ll publish a conclusion when I have one.

Why did Apple allow this?

I don’t believe Apple anticipated this use. macOS permissions such as Full Disk Access, Contacts and Automation exist because legitimate software needs them, and Apple warns customers before granting them. Full Disk Access existed long before ChatGPT.

What’s unusual here is a consumer product designed for millions of people that uses those permissions specifically to access, read and analyse Messages, including conversations protected by end to end encryption.

Apple’s own assistant shows how differently this can be done. Apple states that when you ask Siri to read or search information on your device, including in Messages, the processing happens on the device and your personal information isn’t sent to Apple’s servers. Requests that do need Apple’s servers are tied to a random identifier rather than your Apple Account, and for Apple Intelligence requests that use Private Cloud Compute, Apple says your data is never stored or made accessible to Apple, and independent experts can inspect the server software to verify that promise.

Apple’s record isn’t perfect. Security researchers at Lumia found that messages dictated through Siri were sent to Apple’s servers even when that wasn’t needed to complete the task. But the design intent is clear: Siri reads your messages on your Mac, and when Apple’s servers are involved, Apple builds so that it can’t keep or see the content.

OpenAI’s design is the opposite. The plugin runs on the Mac, but the model runs on OpenAI’s servers. Message content is sent there to be processed. If the person stores the ChatGPT conversation in the cloud, that content stays there under OpenAI’s retention rules, where OpenAI can see it and governments can request it.

The result is that Apple designed iMessage so that Apple can’t read your messages in transit, and designed Siri so that Apple doesn’t see them when it reads them for you. A recipient can now give OpenAI access to the readable copies on their Mac without the sender being asked or notified.

Fortune asked Apple whether it anticipated this use of its permissions and whether it is considering safeguards. Apple didn’t respond.

Haven’t developers always used capabilities in ways Apple didn’t anticipate?

Yes. WebView is a good example.

WebView gave developers a way to display web content inside an app, including things like terms of service and privacy policies that could change without rebuilding the app.

In 2014, I predicted WebView would appear across every major app, with some apps effectively built inside it. I warned that developers could make web content indistinguishable from the native app, while WebView provided none of the browser security people relied on against dangerous links and malicious code. My concerns didn’t resonate with the security industry or most developers. Today, in-app web security is a multibillion dollar industry. Most leading security vendors license my patents for in-app security.

Apple provided a legitimate capability. Developers found uses Apple hadn’t anticipated, and those uses created new security problems.

The same thing is happening again. Apple created powerful macOS permissions for legitimate purposes. It didn’t anticipate a consumer product using them to give a third party access to millions of private Messages conversations involving people who never installed the product or consented to the access.

Should Apple ban third party integrations?

No.

I’ve advocated for open platforms, extensions, messaging integrations, chatbots and developer access for a long time. In fact, I was one of the first developers and advocates for chatbot integrations for messaging services. Using this case to justify restricting third party developers generally would be the wrong response.

Developers should have access to powerful capabilities. That doesn’t mean every conceivable use of those capabilities should be acceptable.

You’re giving Apple ammunition to restrict developers

That’s a legitimate concern. The founder of Epic made the same point to me on Twitter.

Apple could point to abuses of powerful permissions as evidence that third party access increases privacy and security risks. I don’t want that argument used to justify anticompetitive restrictions.

OpenAI has also handed Apple an extraordinary example of the problem. One customer can grant a third party intrusive access that creates privacy and security risks not only for themselves, but for everyone they communicate with.

The answer to one problematic use of a capability is a specific technical safeguard, not restricting third party development generally.

Should people stop adding AI to applications?

No. Add AI everywhere if the person making that decision understands and accepts the consequences for themselves.

What should Apple do?

Apple shouldn’t use this issue as an excuse to lock down macOS or restrict legitimate third party developers. It’s a specific problem that needs a targeted fix.

Apple needs to block this integration from accessing Messages directly. The integration undermines the core privacy protections Apple has spent years defending, and it affects people who have never installed ChatGPT, never consented to the access, and might not use Apple products.

What should OpenAI do?

Stop. Remove the Messages integration.

No consumer app should let one person expose everyone else’s private conversations to a third party without their knowledge or consent. Once that third party holds the content, governments, intelligence agencies and attackers can access it too. OpenAI created this problem. OpenAI needs to fix it.

OpenAI should also explain why it built this.

Someone at OpenAI decided that reading other people’s private messages was an acceptable feature. Someone approved the engineering time. Someone reviewed the permissions it would need, saw that Full Disk Access exposes Messages, and chose to ship it anyway. Someone wrote the answer to Fortune that avoided the only question that should have been answered. None of that happens by accident at a company of OpenAI’s size. It was irresponsible at every one of those steps.

I don’t believe the stated consumer benefit explains the decision. Summarising a group chat or drafting a reply to a friend is a small convenience. The Messages app already makes it easy to schedule messages so that can’t be considered a benefit. OpenAI is spending tens of billions of dollars a year and is under constant pressure to generate revenue. Companies under that pressure don’t dedicate engineering resources to small conveniences for people on free plans. They build what their paying customers want.

OpenAI’s paying customers are enterprises and governments. The plugin works inside ChatGPT Work and Codex, OpenAI’s business products. OpenAI launched OpenAI for Government in 2025 and holds a contract with the US Department of Defence. Its business is selling access to organisations that want to search, analyse and act on large volumes of information.

So ask the question OpenAI hasn’t answered. Who is a tool that reads, searches and analyses years of private conversations, identifies everyone in them, and links them to real names through Contacts, actually for? A person catching up on a group chat doesn’t need that. An organisation that wants to know what people are saying to each other does.

What can people do right now?

Ask the people you have sensitive conversations with if they’ve turned on ChatGPT access to Messages. Warn your friends and colleagues and ask them not to use AI for your conversations.

• Parents should teach their families about these risks and consider moving their children away from iMessage.

  This is more important now than it did a year ago. Governments and child safety campaigners are pushing children and older teenagers off social media. Australia banned under-16s from social media platforms in December 2025, and the UK, several EU countries and US states are moving the same way. Where do those children go? Back to Messages, where they already talk to family and friends. People campaigning for these bans haven’t asked what happens when one adult in a child’s contacts, a parent, an older sibling, a relative, a teacher, a coach, connects ChatGPT to their Messages app. The child’s conversations can end up on OpenAI’s servers, and the child and the parents who chose that app for its privacy will never know.

• Companies need to ensure their security teams and senior management understand this capability exists, and should evaluate whether staff are allowed to connect AI systems to messaging apps used for confidential work chats.

This is an inadequate long-term fix. You shouldn’t have to interrogate every contact before having a private conversation. Until there’s a technical fix that gives everyone control and visibility, the other person’s device is outside your control.

Why you should share this

Most people, including those whose messages are being exposed, have no idea this capability exists.

Publishing technical research on Substack is only the first step. To make a difference, the information needs to reach journalists, security teams, policymakers and the wider public.

My original research sparked debate across LinkedIn, X and Substack. Proton cited my work in its own public warning. Fortune investigated, interviewed me alongside Lookout’s CTO, and put questions directly to OpenAI. Since then I’ve spoken with two more journalists and have two podcast interviews booked.

This level of attention is important if we want technology companies to act responsibly with integrity, and if we want people to understand the risks before giving AI access to their private chats. Journalists can hold these companies accountable directly while warning millions of people who would never read a technical report.

If you think people need to know what’s happening, share this research. Send it to journalists, hand it to your security team, show it to senior management, and pass it on to the people you message every day.

Why listen to me?

I built some of the first messaging chatbots, and I wouldn’t build this for my customers.

In 1997, I helped launch AOL Instant Messenger (AIM), the internet’s first mainstream consumer messaging services. Later, I founded a mobile network testing company and led major text and media messaging infrastructure projects in Europe.

I’ve spent decades working across messaging, chatbots, telecom networks, mobile operating systems, web browsers, API services, permission controls, and lawful interception technology.

In 1999, I ran a audit on the technical teams NewNet, now SS8, which builds the lawful interception tools used by telecom operators and intelligence agencies. My engineering teams built custom Android software and complete web browsers for Apple devices.

Between 2015 and 2018, I built some of the first chatbots for HipChat, Slack, Facebook Messenger, Skype and Telegram, and presented at developer events about chatbot integration for messaging services. My team built the world’s first security chatbots and integrations for business tools like Slack. Slack ranked my company, MetaCert, among its top 20 chatbots for two years.

That work showed me how much data a chatbot can pull once granted access, including private details from people who never installed it or agreed to use it.

In 2017, I built a Facebook Messenger bot used by journalists, including teams at Al Jazeera, to verify the credibility of websites and social media accounts behind news stories.

I was teaching developers how to build chatbots and pushing for ethical design long before ChatGPT brought conversational AI into the mainstream.

My work on app security started earlier. In 2014, I identified the risks of mobile apps opening web links inside built-in browsers before the wider industry recognised the problem. Today, major cybersecurity firms license my portfolio of patents covering in-app security for anti-malware and phishing.

My analysis goes beyond what OpenAI says this integration does. I focus on what the technology can do once granted access, what data those permissions reveal, and what becomes possible based on intent.

This OpenAI integration should concern people. It should concern Apple.

This is a small sample of my background relevant to this discussion. My full biography is here.

Transparency statement

I have commercial interests in privacy, messaging and mobile security, and readers should know about them.

I founded MetaCert. Our Link Verifier is launching in the US with Mackie Mobile, a privacy and security focused mobile carrier. Mackie Mobile subscriptions also include prvc.app, a peer to peer messaging service that I have been beta testing, and a VPN service.

Those relationships give me a commercial interest in technologies that compete on privacy and security. They also give me direct experience evaluating how messaging services, mobile networks and security products handle sensitive information.

My argument about the ChatGPT integration doesn’t depend on those commercial interests. The technical issue is independently testable: ChatGPT needs access to readable message content to search, summarise and draft from Apple Messages, and one participant can authorise that access without the knowledge or consent of the other people in those conversations.

Where can I learn more?

My original Substack investigation breaks down how the technology works, why it creates a major privacy and security risk, and what it means for people who’ve never used ChatGPT.

Proton then published its own analysis based on my research, highlighting the danger to end-to-end encryption.

Fortune followed up with an independent report. Their team interviewed me, Lookout CTO Dave Richardson, and OpenAI, giving OpenAI the chance to explain the integration and respond to the concerns.

If you want to see OpenAI’s side next to my argument and another expert’s view, read the Fortune investigation.

If you want my full technical breakdown and ongoing updates, subscribe to my Substack. Everything is free.

I you work in media, security, policy, law, or tech, don’t just take my word for it - test the technology yourself. Independent analysis is always the best way forward.

Continue reading

If you found this investigation valuable, subscribe below.

What you’ll get

Every investigation begins with the core insight, then explains the technical capability, incentives, relationships and evidence behind it.

I examine technology, AI, surveillance, cybercrime, digital identity, privacy, online safety, intelligence, legislation and the companies, governments and investors shaping them.

Most posts take only a few minutes to read. Around once a month I’ll publish a longer investigation when a subject deserves deeper analysis.

Why this publication exists

Too much reporting separates events that belong together.

A government announcement becomes one story. An acquisition becomes another. An investment, a technical capability, a policy change or an executive statement becomes something else entirely.

I investigate how those pieces connect. I don’t begin with conclusions. I begin with technical capability, evidence and incentives. Intent is the last thing I consider, not the first.

OpenAI's ChatGPT integration for Apple Messages isn't installed or enabled by default. An apple user must install the ChatGPT plugin.

The privacy implications extend beyond Apple customers. Anyone messaging an Apple user who enables it is affected, including people using Android or GrapheneOS.

An Apple user must install the integration and give it access to Messages on their Mac. You can't know whether someone you communicated with in the past or will communicate with in the future has given ChatGPT access to your conversations.

Over 100 people across LinkedIn, X and Substack asked me how to disable it or protect their right to privacy. There’s nothing you can disable on your own device to stop someone else from giving ChatGPT access to your conversations.

You can't know which of your messages ChatGPT accessed through someone else, what information it extracted, what's retained or whether that data could later be obtained or misused.

Once OpenAI stores message content, law enforcement, intelligence agencies and governments can demand data that end to end encryption blocked Apple from turning over. The Federal Bureau of Investigation (FBI) has never been able to crack iMessage and failed to pressure Apple into giving them a backdoor. OpenAI has created another way to access the message content.

End to end encryption is not broken, but its value is removed if everyone’s messages can be scanned and stored before they’re encrypted and after they’re decrypted.

Past conversations stay vulnerable because ChatGPT evaluates more than new texts. It accesses message history and attachments stored on Mac or synchronized through Messages in iCloud, analyzing names, locations, and personal relationships.

Someone else can hand ChatGPT your past and future messages without your knowledge or consent. Extended technical analysis is coming in a full article.

Snowden

Snowden revealed that mass surveillance didn’t require governments to intercept every private conversation themselves. Intelligence agencies obtained vast communications data through tech and telecom companies’ centralised infrastructure to search, analyse, and map connections at scale. Entire populations became searchable simply because their communications passed through entities subject to government access powers. His disclosures proved that infrastructure built for everyday communication turns into surveillance infrastructure once governments access the underlying data.

“When you say ‘I don’t care about the right to privacy because I have nothing to hide,’ that’s no different than saying ‘I don’t care about freedom of speech because I have nothing to say.’”

“Simply because you are following the law, doesn’t mean that you’ll be exempt from governmental interference in your private life.”

- Edward Snowden

What can you do?

Stop using the default Messages app on your iPhone, Android or GrapheneOS device.

Ask people if they have given ChatGPT access to Apple Messages.

Don’t enable it. Respect other people’s right to privacy. Before my interview started with Fortune yesterday, the journalist asked if I was ok with her recording it with AI. I said yes because everything was on the record. But when we collaborate in the future, I might ask her not to. Context is everything.

For sensitive conversations, use Signal until prvc(.)app is publicly available through the launch of Mackie Mobile. That’s in the US, but it will be available via other partners outside the US. I’ll provide more information when I get it myself.

Please share your concern with your friends and colleagues. The implications are global because you don't need an Apple device, ChatGPT or an OpenAI account to be exposed.

More posts about this on the way.

Share

Why subscribe?

Subscribe to get full access to the weekly newsletter and full archive. Everything is free.

Stay up-to-date

Be part of a community tracking surveillance tech, new laws and the people in power dismantling everyone’s right to privacy, digital safety and online anonymity. I also write about cybercrime.

I recommend creating a Substack account to join the discussions and get notified as I publish. I write as stories break, so you know what’s happening while it’s happening.

What I write about

In 1996, before the web went mainstream, I wrote one of the first newsletters on the Internet. I built a community of 9,000 AOL beta testers to introduce new technologies, gather feedback and help launch products like AIM, the first mainstream consumer internet messaging service.

Today, I analyse and explain what new technology, AI and legislation is doing to society under the guise of “public safety”, “child protection” and “national security”.

Why Substack

Enough LinkedIn readers asked me to create a Substack, so I did. My posts rank in the top 0.5% for readership and engagement, but LinkedIn restricted my account 3 times as engagement grew around posts analysing and critiquing powerful people like Larry Ellison, tech companies such as Palantir, political leaders including Ursula von der Leyen, intelligence agencies such as Israel’s Unit 8200, and government policies like “Chat Control”.

I’m moving my work here so it has a permanent home beyond algorithm control.

Expect 5 to 10 short, information loaded posts a week without the jargon. I might publish 3 in one day, then nothing for a couple. Most stay within LinkedIn’s 3,000 character limit. Once a month, I’ll go deeper with a long form investigation.

Most people won’t get naked in the office but they’ll get naked before stepping into a shower.

Context is everything

Privacy choices depend on context. Some people gladly grant AI access to their computer, email or browser, while others use AI heavily but draw the line there.

Billions use Gmail, LinkedIn DMs, Slack or Teams daily. Privacy protections vary across these services, but people use them accepting that data may be processed to train AI, exposed through breaches, or subject to legal demands.

Some privacy first people deliberately avoid services like Gmail or social media DMs because they don’t think they’re appropriate for sensitive communications. They use Signal, Session, and iMessage for end to end encrypted messaging, plus Proton for end to end encrypted email.

Most people sit between those positions. Someone might use LinkedIn, Instagram, X DMs and regular email for most conversations, then switch to Signal, Session, iMessage or Proton for conversations they specifically want to keep private.

When you say ‘I don’t care about the right to privacy because I have nothing to hide,’ that’s no different than saying ‘I don’t care about freedom of speech because I have nothing to say.’

Simply because you are following the law, doesn’t mean that you’ll be exempt from governmental interference in your private life.

- Edward Snowden

Most Proton customers probably use AI in some form. Someone might copy an email into an AI service to clarify its content or help write a response. That gives AI access to the information, but the person deliberately chose that specific communication to share with AI.

Giving ChatGPT or Claude access to an entire Proton mailbox would be very different. Proton is specifically designed so Proton itself can’t access the content of end to end encrypted communications. Giving another company access to every email would remove a privacy protection many people specifically chose Proton to obtain.

Apple Messages creates an additional problem because many people associate it with ordinary texting.

Messages is one application supporting SMS, end to end encrypted iMessage and RCS, with encryption depending on the RCS implementation and participants. Giving ChatGPT access to Messages therefore extends beyond ordinary text messages. It can include conversations people specifically use because they’re end to end encrypted.

Before an iMessage leaves the sender’s device, the message exists as normal text that can be read on screen. The device encrypts it before sending. When it arrives at the recipient’s device, it’s decrypted so the recipient can read it.

The ChatGPT integration can access iMessage content on a device before it’s encrypted or after it’s decrypted. For people who use end to end encryption specifically to prevent third party access, giving ChatGPT access removes the privacy protection they use it for. The message can remain encrypted between devices while its content becomes accessible through OpenAI to governments, intelligence agencies or law enforcement they were trying to prevent from accessing it.

“I don’t mind if OpenAI has access to all my messages”

💡 The person who installs ChatGPT for Messages might be comfortable with that. Some of the people they communicate with might not be.

Someone may choose iMessage specifically because they want everything they say to remain between the people in the conversation. If one participant installs ChatGPT for Messages, that person has effectively given OpenAI access to a private conversation without everyone else knowing or agreeing to it.

This problem isn’t restricted to people who use an iPhone. Everyone is impacted, including people who use Android or GrapheneOS.

Had they known ChatGPT had access, they might have chosen Signal or another service for that conversation.

Years of private conversations can also be exposed

ChatGPT can access more than new messages received after it’s installed. It can also access years of existing conversations and attachments stored in Messages on the Mac, including messages synced from iCloud.

Messages in iCloud normally synchronises deletions across devices, while recently deleted messages remain recoverable for a limited period. Years of conversations and attachments may already be stored in Messages on the Mac when ChatGPT is given access.

What experts in end to end encryption have to say

Proton has now issued a direct warning:

Proton’s warning carries particular weight because its services are designed to prevent even Proton from accessing the private communications it protects. People choose Proton specifically because they don’t want their email content accessible to the company providing the service or other third parties.

Proton also cited my original Substack article when it published that warning.

My original article provides a more detailed explanation of the ChatGPT integration without jargon. Proton directed its audience to my analysis while issuing its own warning about giving ChatGPT access to text messages.

People who need privacy should stop using iMessage for sensitive conversations because they can’t know whether another participant has given ChatGPT access to Messages.

Deleting message history can reduce what ChatGPT can access, but it can’t guarantee every copy has been removed from every device, synchronised history, recently deleted items or backups.

For sensitive conversations, use an end to end encrypted service where everyone involved agrees that no third party has access.

One person enabling ChatGPT can change a private conversation for everyone else, including people who never consented, never installed ChatGPT and may never know it happened.

Share

Why subscribe?

Subscribe to get full access to the weekly newsletter and full archive. Everything is free.

Subscribe now

Stay up-to-date

Be part of a community tracking surveillance tech, new laws and the people in power dismantling everyone’s right to privacy, digital safety and online anonymity. I also write about cybercrime.

I recommend creating a Substack account to join the discussions and get notified as I publish. I write as stories break, so you know what’s happening while it’s happening.

What I write about

In 1996, before the web went mainstream, I wrote one of the first newsletters on the Internet. I built a community of 9,000 AOL beta testers to introduce new technologies, gather feedback and help launch products like AIM, the first mainstream consumer internet messaging service.

Today, I analyse and explain what new technology, AI and legislation is doing to society under the guise of “public safety”, “child protection” and “national security”.

Why Substack

Enough LinkedIn readers asked me to create a Substack, so I did. My posts rank in the top 0.5% for readership and engagement, but LinkedIn restricted my account 3 times as engagement grew around posts analysing and critiquing powerful people like Larry Ellison, tech companies such as Palantir, political leaders including Ursula von der Leyen, intelligence agencies such as Israel’s Unit 8200, and government policies like “Chat Control”.

I’m moving my work here so it has a permanent home beyond algorithm control.

Expect 5 to 10 short, information loaded posts a week without the jargon. I might publish 3 in one day, then nothing for a couple. Most stay within LinkedIn’s 3,000 character limit. Once a month, I’ll go deeper with a long form investigation.

OpenAI released a plugin on 20 August 2026 that gives ChatGPT access to Apple Messages on a Mac. This is one of the most dangerous and irresponsible uses of AI because Apple Messages doesn’t just contain regular SMS. It contains end to end encrypted iMessages and supported encrypted RCS conversations between Apple and Android users.

The benefit

OpenAI is selling this as a way for ChatGPT to search chats, catch up on conversations, draft replies and send messages on your behalf. The plugin is available on every ChatGPT plan through the Mac desktop app, works inside ChatGPT Work and Codex, and requires an Apple silicon Mac.

It sounds incredibly useful, but I want to explain why the privacy costs and personal safety risks for high risk people outweigh the benefits. Convenience, security and privacy are always at odds, but this integration trades other people’s privacy for one person’s convenience.

The cost

I explain further down why this is different from adding AI to scan email, or a telecom company or government accessing personal data.

People who rely on privacy accept that other forms of communication may be accessible to AI or third parties. That’s why they specifically choose Signal, Session, iMessage or supported encrypted RCS when privacy is required.

Someone can now give ChatGPT access to those conversations without telling the other participants or asking for their consent. They have no way of knowing it’s happening.

Unless that person tells every contact, someone can send information they’d never want shared with anyone else. OpenAI provides no indication to the other person that their conversation has a third party accessing it. By the time they send it, the disclosure has already happened.

The EU wants AI generated images and text labelled so people know AI was involved. This is one case where I’d advocate a label: people should be told when an AI company has been given access to their private conversation.

This affects people who never use ChatGPT

Anyone who sends an iMessage, SMS or supported encrypted RCS message to an Apple user can have that conversation exposed to ChatGPT if the recipient enables the integration on their Mac.

That includes Apple account holders using iMessage and Android users communicating with Apple users through SMS or supported RCS. They don’t need ChatGPT or an OpenAI account. They don’t even need an Apple device.

They only need to communicate with someone who has enabled the integration.

This risks private conversations with family, friends, doctors, lawyers, colleagues, political leaders, special operators, intelligence officers, whistleblowers, activists, journalists, customers and sources.

I wrote a preliminary warning on Twitter and LinkedIn as soon as I saw OpenAI’s announcement. Most people agreed with my concerns, but some don’t appreciate the difference between giving a third party full access to Apple Messages and integrating it with an operating system, software application or messaging service that isn’t end to end encrypted.

Why iMessage is different

Think Signal, not SMS.

Some people think of Apple Messages as ordinary text messaging, but it’s one application supporting 3 different messaging services: regular SMS, end to end encrypted iMessage and, more recently, RCS.

Many people specifically use iMessage because it provides end to end encryption comparable to Signal.

Integration with unencrypted services like SMS is less of a concern. The technology itself isn’t my objection. My concern is giving OpenAI access to a service people deliberately chose because they’re protected by end to end encryption.

I want to make one technical point absolutely clear because several people have misunderstood my argument:

The encryption still works.

OpenAI hasn’t cracked or mathematically broken iMessage encryption. An iMessage remains encrypted between endpoints.

The privacy problem occurs at the endpoint. Once the message has been decrypted on the recipient’s Mac, that recipient can authorise third party software to access the readable conversation.

The encryption worked exactly as designed. It simply can’t protect message content from software authorised to access it before or after decryption.

That’s what I mean when I say this integration undermines the purpose of end to end encryption.

Adding this ChatGPT plugin to Apple Messages is like installing spyware that can be exploited by governments, intelligence agencies, law enforcement, internal threat actors at OpenAI and partners. It introduces invasive client side monitoring directly inside a messaging app, exposing message content where end to end encryption can no longer protect privacy.

What is end to end encryption?

End to end encryption is the most secure way to communicate because only the sender and intended recipient can read the message. Content is encrypted on the sender’s device before it’s sent and remains encrypted while travelling through networks and servers.

It can be intercepted in transit by hackers, intelligence agencies or the company operating the service, but can’t be read without the encryption keys or access to the message before encryption or after decryption.

Even the service provider can’t read the message content. With iMessage, that’s Apple.

When the FBI tried to force Apple to bypass iPhone security, Apple refused because creating a way around encryption would create a backdoor that couldn’t be guaranteed for government use alone.

Apple said the only way to guarantee such a capability isn’t abused or obtained by the wrong people is never to create it. Apple also warned that weakening encryption puts both privacy and personal safety at risk.

Why governments want access

In 2013, Edward Snowden revealed US intelligence agencies had built surveillance programs collecting communications at scale.

NSA programs including PRISM exposed government access to internet communications, while Section 215 enabled bulk collection of telephone metadata, including records from telecom networks like Verizon.

That metadata allowed intelligence agencies to analyse who communicated with whom, when and how frequently.

Conversation content can reveal considerably more. It can explain who those people are, how they know each other, where they go, who they work with, what they discuss and why they’re communicating.

Governments can intercept encrypted traffic, but they can’t simply read messages sent through Signal, Session or iMessage because those services use end to end encryption.

The FBI calls this “Going Dark” because encryption can prevent law enforcement from obtaining readable communications even when it has legal authority to demand information from the provider.

Governments, particularly the Five Eyes nations of the US, UK, Australia, Canada and New Zealand, have pushed for access to encrypted communications for years, citing terrorism, serious crime, national security and, more recently, child safety.

Why ChatGPT is like a backdoor

ChatGPT gives governments and law enforcement another route to information they’ve wanted for years, except people voluntarily enable the access themselves.

The plugin gives ChatGPT access to readable message content at the endpoint, before encryption for outgoing messages or after decryption for incoming messages, bypassing the privacy provided by end to end encryption while messages are transmitted between participants, without forcing Apple to build a cryptographic backdoor.

One person can expose conversations involving many people they communicate with. Information subsequently processed or retained by OpenAI can become subject to US legal process.

Calling this an endpoint security or operational security issue describes where the exposure occurs. It doesn’t remove the privacy consequence for participants who never authorised the access.

Apple didn’t create a new iMessage API for ChatGPT

OpenAI didn’t need Apple to create a new iMessage API.

The plugin uses existing macOS capabilities and requires the Mac owner to grant permissions including Full Disk Access, Contacts and Automation.

Apple has long warned customers about the amount of information exposed by Full Disk Access and specifically identifies Messages among the private data that applications may be able to access.

That capability existed before ChatGPT.

My concern is that OpenAI has now turned existing macOS access into a consumer AI feature specifically designed to read, search and act on Apple Messages.

I doubt these permissions were originally designed around the expectation that consumers would deliberately give a third party access to years of private conversations. They predate modern AI agents capable of searching, analysing and extracting information from large amounts of unstructured text.

Local plugin, remote AI

OpenAI says the plugin works locally and doesn’t build a complete message index.

I’m not claiming OpenAI uploads the entire Messages chat.db database to its servers.

Local plugin execution and local AI processing are 2 different things.

When ChatGPT uses an OpenAI hosted model to summarise a conversation, analyse it or draft a reply using its contents, the information required for that request must be available to the hosted model for processing.

What OpenAI retains depends on the account, product and settings.

Processing and retention are also different. I’m not claiming every message ChatGPT accesses is permanently stored by OpenAI.

My concern begins when content previously protected by end to end encryption becomes available to a third party for processing without every participant knowing or consenting.

As Proton put it on X:

OpenAI says it runs locally and doesn't build an index. Local execution isn't the same as local processing. The moment ChatGPT summarises a thread or drafts a reply using a hosted model, that content leaves the machine.

US law makes information OpenAI possesses accessible

Under US law, OpenAI must preserve data covered by valid preservation orders and disclose customer content and records when legally compelled.

The CLOUD Act can apply to data within a US provider’s possession, custody or control regardless of where that data is physically stored.

Moving data from US servers to an EU country therefore doesn’t put it beyond US legal process if OpenAI retains possession, custody or control.

OpenAI can also be legally prohibited in some circumstances from telling the affected customer that information has been preserved or disclosed.

A dangerous example

Imagine a whistleblower chooses iMessage to communicate privately with an investigative journalist. The journalist enables ChatGPT. The whistleblower hasn’t consented and isn’t notified.

Content from their private conversation can now be processed by OpenAI without the whistleblower’s knowledge. Information OpenAI subsequently retains can become exposed to government demands, account compromise, security vulnerabilities and data breaches.

Sam Altman has said OpenAI can be forced to produce people’s sensitive ChatGPT conversations and called the absence of legal confidentiality “very screwed up”.

In 2025, a US court ordered OpenAI to preserve ChatGPT conversations as evidence in The New York Times copyright lawsuit, including some conversations users had deleted.

The journalist authorised ChatGPT’s access. The source didn’t.

I doubt a responsible investigative journalist would knowingly do this because source protection is fundamental to their work. But the example demonstrates the privacy consequence for anyone communicating with someone who enables the integration.

This has been my favourite response on Twitter.

Yes, someone can screenshot your messages and fax them to the FBI. That’s deliberate disclosure by a participant. Giving a third party access to automatically read, search and analyse private conversations involving people who never consented is a different privacy risk.

Correct.

A recipient has always been able to copy, forward, export or deliberately disclose a message. That doesn’t mean automating third party access to potentially years of conversations doesn’t create additional privacy risk.

Correct.

Apple specifically warns customers about the access Full Disk Access provides. That existing capability is part of my concern, not a rebuttal to it. OpenAI didn’t invent endpoint access. It has productised and normalised third party AI access to Apple Messages for ordinary consumers.

Agents, coding tools and other applications with equivalent access deserve the same attention. I’ve already written about the risks of giving AI broad access to computers and critical applications.

It is.

Think Signal, not SMS.

SMS, ordinary email, Slack and Teams don’t provide the same promise of privacy as iMessage, Signal, or Proton, where the service is designed so the provider itself can’t read the end to end encrypted message content.

I have concerns about giving AI access to email, browsers and entire computers too. I’ve written about them already.

💡 My objection here is specifically about introducing third party AI access to communications people deliberately chose because of the privacy provided by end to end encryption.

You opted in. Everyone you communicate with didn’t.

That is the fundamental privacy problem.

One person makes the decision. Potentially hundreds of other people experience the consequence without being asked or notified.

The network effect

One person enabling this integration can expose accessible conversations involving dozens or hundreds of other people. At scale, those conversations overlap.

One ChatGPT customer can expose conversations involving many non customers and chose specifically not to allow AI access to their private communications. Those people communicate with other people. Group conversations connect multiple participants simultaneously.

Names, phone numbers, email addresses, timestamps, Contacts information and message content can provide enough information to identify people and relationships between them. If this capability becomes widely adopted, and I believe it will unless Apple puts a stop to it, the privacy consequence extends beyond the number of people who actually enable it.

Private conversations can reveal a social graph

Snowden’s disclosures demonstrated how useful telecom metadata can be for analysing relationships. Message content can provide more context about those relationships.

Imagine years of conversations establish that Sarah works at Company X, is married to John, lives in San Francisco, travelled to Washington last month and regularly discusses a confidential project with James.

Those facts don’t need to exist together in one database record. AI can extract information distributed across conversations and connect it. Across enough conversations, that can identify family members, friends, colleagues, employers, customers, doctors, lawyers, journalists, sources and other relationships.

Group conversations can expose connections between several people simultaneously.

Messages can contain locations, travel plans, meetings, photographs, documents, financial information, medical information, legal discussions, account information, authentication codes, political opinions, intimate relationships, disputes and confidential business information.

I haven’t seen evidence that OpenAI automatically constructs and permanently stores a social graph from Apple Messages, so I’m not claiming it does.

I’m worried that’s what becomes technically possible when AI can process readable conversations. Enough private messages can reveal who someone is, who they know, where they’ve been, who they work with, who they trust, what they discuss and how those people are connected.

The people being identified don’t need ChatGPT. They only need to appear in conversations accessible to ChatGPT on someone else’s Mac.

Subscribe now

The UK government demonstrated why this is important

In 2025, the UK government demanded access to iCloud data protected by Apple’s Advanced Data Protection.

Because end to end encryption prevented Apple from decrypting the protected data, the government demanded access. Apple refused and withdrew ADP for UK customers instead.

This also addresses another argument people have made about iCloud.

Without Advanced Data Protection, Apple can hold keys needed to recover certain iCloud data, and the protection of Messages in iCloud also depends on how iCloud Backup is configured. That’s a legitimate privacy concern. But the existence of one route to information doesn’t justify creating another.

💡 The UK government’s attempt to obtain access to ADP protected data demonstrates exactly why some people deliberately choose end to end encryption.

Adding another company to the readable conversation creates another route to information Apple designed itself not to possess in readable form under end to end encryption.

It can access security codes

Apple Messages also contains SMS, MMS and RCS messages forwarded from an iPhone to a Mac. That can include one time authentication codes from banks, email accounts and other services. With Messages in iCloud enabled, SMS history can also be synchronised across devices.

What the permissions give ChatGPT

ChatGPT requires powerful macOS permissions to work with Messages, including Full Disk Access, Contacts and Automation.

Those permissions can allow it to read message content and attachments, associate conversations with participants and interact with Messages. It asks for approval before sending, but approval can be switched off per conversation, and that approval relates to outgoing actions.

By the time ChatGPT can use the contents of a conversation to help with a request, it must have access to the information required to perform that task. Most people won’t realise how much historical information may exist on their Mac.

💡 With Messages in iCloud enabled, years of message history can be accessible, including conversations and attachments synchronised through iCloud.

Two wrongs don’t make a right

I’ve consistently warned against integrating AI with critical systems like email or giving it full computer control because the risks are substantial and always will be. The fact that people already enable other dangerous integrations doesn’t justify giving OpenAI access to end to end encrypted messages.

The fact that another application could already access information with sufficient permissions doesn’t make this implementation harmless.

The fact that another participant could deliberately disclose your messages doesn’t make automated third party access equivalent.

Capability is not justification.

Share Paul Walsh

Trusting OpenAI means trusting everyone OpenAI trusts

Giving OpenAI access means trusting Sam Altman and the company’s infrastructure, employees, partners, vendors, security, retention practices and legal obligations. That includes Tel Aviv based security testing company Irregular, formerly Pattern Labs.

In August 2026, OpenAI confirmed its models weren’t contained by properly configured sandbox environments. During testing by security firm Irregular, a misconfiguration allowed its models to access the internet and exploit a real website.

Separately, OpenAI models “escaped” an internal testing environment, accessed the internet and breached Hugging Face, while also accessing vulnerable customer infrastructure hosted by Modal Labs. OpenAI doesn’t need to act maliciously for private information to be exposed.

Imagine if OpenAI, an employee, vendor or partner did.

I’m not saying they would.

I’m saying more than 1 billion people could communicate with people who have enabled this integration and have no way of knowing they’re trusting OpenAI and its partners with information from their conversations, regardless of who they are, where they are or what they’re discussing.

🛑 Do not give ChatGPT access to Apple Messages.

Even if you’re comfortable with the privacy consequences, the people you text might not be.

Why listen to me?

I’m including specific information about my background because my analysis isn’t limited to what OpenAI says the plugin does or what Apple documents in its developer materials. My experience across messaging, chatbots, telecom infrastructure, mobile operating systems, browsers, APIs and lawful interception means I look at what the technology is capable of doing once access is granted, including capabilities that may never appear in a press release or product description. That’s important when assessing privacy and security risk.

Between 2015 and 2018, I spoke at developer conferences about chatbot integrations and built the world’s first security chatbots for major messaging services including HipChat, Slack, Messenger, Skype and Telegram. MetaCert’s was listed among Slack’s top 20 chatbots for 2 years.

My experience with messaging goes much further back.

I helped launch AIM in 1997, one of the first mass market consumer messaging services on the Internet. I later founded a telecom testing company and led major SMS and MMS infrastructure projects during the 2000s.

I also conducted a technical audit of NewNet, now part of SS8, whose technology provides lawful interception capabilities to telecom operators and intelligence agencies worldwide.

My teams have built custom Android firmware and complete browsers for iOS.

I’ve worked across messaging infrastructure, mobile operating systems, browsers, APIs, permissions and the information those technologies expose.

My team built a CRM platform for the emerging chatbot developer community in 2016. Slack’s original API exposed extraordinary amounts of information, including personal contact details and locations for people inside organisations that installed a chatbot. Our CRM connected that information to individual people and their organisations.

I know what’s technically possible and what it costs in privacy.

I also built a simple news reputation chatbot for Messenger in 2017, used by journalists, including at Al Jazeera. They pasted a URL for a story or video, and it identified whether the website or social media account was classified as disinformation, far left, far right, satire or mainstream.

I was teaching developers how to build messaging integrations and advocating for ethical design years before ChatGPT made conversational AI mainstream.

I don’t just investigate what developers say their technology does. I look at what the technology can do, what information it can access and what can happen when those capabilities are deployed at scale.

Most leading security vendors license my portfolio of patents for in app security so they can protect people from malware and phishing. The portfolio covers 65 categories, including child safety and child abuse.

Subscribe now

If the EU forces technology companies to add monitoring to their apps through “Chat Control” 2.0 under the guise of online child abuse protection and anti grooming, Signal would have to ask me for permission before scanning links inside messages prior to encryption. I’m not willing to license patents if it means breaking the privacy purpose of end to end encryption so governments can introduce client side surveillance.

My position is consistent with concerns Signal President Meredith Whittaker has repeatedly raised about client side scanning of encrypted communications.

I’m giving Signal and other ethical companies a get out of jail free card because they don’t want to add spyware to their apps.

⛔️ Based on my experience, which is much more extensive than what I’ve mentioned here, this OpenAI integration should concern people.

It should concern Apple.

Share

Transparency statement

I have a commercial interest in this subject and readers deserve to know.

I founded MetaCert, and our Link Verifier is launching in the US with Mackie Mobile, a veteran owned wireless carrier built for people who need privacy and security by default: special operators, law enforcement, government personnel and anyone who doesn’t want their identity, location or data collected and sold.

Mackie Mobile subscriptions also include prvc, a peer to peer messaging service designed to be more private than iMessage and Signal. Its developers have been working on the technology for years, and we’ve been beta testing it for the past 9 months. Link Verifier works with it through the same user initiated process. Nothing reads conversations before encryption or after decryption, so it doesn’t undermine the privacy this article defends.

The commercial interest doesn’t change the design difference at the centre of this article. ChatGPT needs access to conversations to provide these features.

If anything in this piece is factually incorrect, I want to know. Please get in touch and I’ll correct it promptly.

Nothing written here is intended as a legal accusation or assertion of wrongdoing. All statements are based on publicly available information and my own analysis and opinion.

Why subscribe?

Subscribe to get full access to 1 weekly newsletter and full archive.

Stay up-to-date

Be part of a community tracking surveillance tech, new laws and the people in power dismantling everyone’s right to privacy, digital safety and online anonymity. I also write about cybercrime.

Create a Substack account to join the discussions and get notified as I publish. I write as stories break, so you know what’s happening while it’s happening.

What I write about

In 1996, before the web went mainstream, I wrote one of the first newsletters on the Internet. I built a community of 9,000 AOL beta testers to introduce new technologies, gather feedback and help launch products like AIM, the first mainstream consumer internet messaging service.

Today, I analyse and explain what new technology, AI and legislation is doing to society under the guise of “public safety”, “child protection” and “national security”.

Why Substack

Enough LinkedIn readers asked me to create a Substack, so I did. My posts rank in the top 0.5% for readership and engagement, but LinkedIn restricted my account 3 times as engagement grew around posts analysing and critiquing powerful people like Larry Ellison, tech companies such as Palantir, political leaders including Ursula von der Leyen, intelligence agencies such as Israel’s Unit 8200, and government policies like “Chat Control”.

I’m moving my work here so it has a permanent home beyond algorithm control.

Expect 5 to 10 short, information loaded posts a week without the jargon. I might publish 3 in one day, then nothing for a couple. Most stay within LinkedIn’s 3,000 character limit. Once a month, I’ll go deeper with a longform investigation.

What Béjar told the jury

“You just cannot trust Mark Zuckerberg with kids”.

Arturo Béjar, a former Meta engineering director, under oath in US federal court yesterday.

Béjar testified that Meta had technology to flag accounts suspected of belonging to children under 13 and require age verification, but operated a “don’t ask, don’t tell” policy instead. He told the jury, “where the youngest kids are is where the users are going to be in the future”.

Meta’s internal studies reviewed by Béjar found children on Instagram were being shown content from sexual predators and graphic violence, with Instagram’s recommendation system itself surfacing predator content. He took the findings to Facebook and Instagram executives multiple times but saw no meaningful action.

Meta’s own surveys found over half of Instagram’s teenage members reported a harmful experience each week, while a quarter of young teens received unwanted sexual advances. Béjar sent the numbers to Zuckerberg, Sheryl Sandberg and Adam Mosseri, then presented them to a US Senate subcommittee in 2023. Senators concluded Meta had withheld the findings from Congress while publishing misleading statistics instead.

Frances Haugen is another Meta whistleblower. She was a product manager on Facebook’s civic integrity team who copied thousands of pages of internal research and gave them to the Wall Street Journal, the SEC and Congress in 2021. The documents showed Meta knew Instagram harmed teenage girls, including its own finding that Instagram made body image issues worse for 1 in 3 of them. This is a systemic problem that’s well documented and proven time and time again. Yet, Zuckerberg called her claims untrue and said Meta constantly used research to improve its products. I have an article about her case in my drafts folder and I’ll publish it soon.

According to Béjar, Meta replaced “addiction” with “problematic use” in its research so studies no longer described children as addicted. He also said Meta’s “take a break” feature was “designed to fail” because it’s off by default and easy to ignore.

Béjar, who briefed Zuckerberg roughly 100 times, told the jury every part of Zuckerberg’s denial was false: Zuckerberg had the research and changes only happened on his order. “If Mark makes something a priority, mountains move in months”. Employees were rewarded on engagement numbers and the culture Zuckerberg created made it practically impossible to deliver safety features.

The trial

Béjar is the first witness in a 6 week Oakland trial where California, Colorado, Kentucky and New Jersey accuse Meta of designing Facebook and Instagram to addict children and lying about their safety. 25 more states accuse Meta of illegally collecting data from children under 13 without parental consent. Zuckerberg is expected to testify. I’m interested to see how he responds under questioning.

Under cross examination, Béjar accepted Meta employs hundreds of safety staff, but senior safety leaders at Meta told me their teams were gutted, leaving virtually nobody to do the work and barely enough time for toilet breaks.

Béjar has testified in 3 Meta trials over harm to children, but the company faces thousands of similar lawsuits. The New Mexico case ended in $942M in damages and penalties. I believe that’s so small it becomes a cost of doing business. If executives can be proven to have intentionally caused grievous harm to children, they should face criminal prosecution and prison, not just corporate fines. AP News

I’ve spoken with 3 Meta whistleblowers myself: one in my comments, one who thanked me for tagging him and another who’s suing Meta. Every account of Zuckerberg matches what Béjar said under oath.

If anything in this piece is factually incorrect, I want to know. Please get in touch and I’ll correct it promptly. Nothing written here is intended as a legal accusation or assertion of wrongdoing. All statements are based on publicly available information and my own analysis and opinion.

Why subscribe?

Subscribe to get full access to 1 weekly newsletter and full archive.

Subscribe now

Stay up-to-date

Be part of a community tracking surveillance tech, new laws and the people in power dismantling everyone’s right to privacy, digital safety and online anonymity. I also write about cybercrime.

Create a Substack account to join the discussions and get notified as I publish. I write as stories break, so you know what’s happening while it’s happening.

Share

What I write about

In 1996, before the web went mainstream, I wrote one of the first newsletters on the Internet. I built a community of 9,000 AOL beta testers to introduce new technologies, gather feedback and help launch products like AIM, the first mainstream consumer internet messaging service.

Today, I analyse and explain what new technology, AI and legislation is doing to society under the guise of “public safety”, “child protection” and “national security”.

Why Substack

Enough LinkedIn readers asked me to create a Substack, so I did. My posts rank in the top 0.5% for readership and engagement, but LinkedIn restricted my account 3 times as engagement grew around posts analysing and critiquing powerful people like Larry Ellison, tech companies such as Palantir, political leaders including Ursula von der Leyen, intelligence agencies such as Israel’s Unit 8200, and government policies like “Chat Control”.

I’m moving my work here so it has a permanent home beyond algorithm control.

Expect 5 to 10 short, information loaded posts a week without the jargon. I might publish 3 in one day, then nothing for a couple. Most stay within LinkedIn’s 3,000 character limit. Once a month, I’ll go deeper with a longform investigation.

If you thought Flock camera surveillance was bad, read this. Carbyne is an Israeli founded emergency communications company built by people with Israeli military and security backgrounds, funded through an investment vehicle backed by Jeffrey Epstein and later by Peter Thiel’s Founders Fund. Its technology now runs inside 911 emergency systems across the US.

People are ripping Flock cameras out of the ground across America because its surveillance network records number plates, locations, dates, times and distinguishing vehicle features, creating searchable histories of where vehicles go and when. Flock also sells Raven audio detection devices containing microphones that listen for gunshots and other sounds. Police can search across jurisdictions and reconstruct vehicle movements without first obtaining a warrant. More than 50 officers have faced accusations of abusing Flock’s system, including to stalk current or former romantic partners. As my readers know, I write about what technology and legislation can do, not what its makers or customers say it’s for.

Epstein, Israeli intelligence and Peter Thiel

Carbyne was founded in Israel as “Reporty Homeland Security” in 2015. It provides emergency communications tech used by hundreds of agencies and organisations and says its global reach affects more than 250M people. Its platform combines emergency calls with precise location, live video, transcription, translation, incident mapping and other data sent to emergency responders. A dispatcher can send a caller an SMS link that, once opened, enables live video from the phone without requiring an app. Carbyne says its technology operates at almost 300 sites globally, including emergency services across more than 23 US states.

Carbyne was founded by Amir Elichai, Alex Dizengof, Yony Yatsun and Lital Leshem. Elichai is a former Israeli special forces officer. Leshem has been reported as having an Israeli intelligence background and later worked for Israeli private intelligence company Black Cube. Dizengof has a cybersecurity background, while Yatsun is a software engineer and architect. Early investor Pinchas Buchris commanded Unit 8200, Israel’s military signals intelligence unit, and later served as director general of Israel’s Ministry of Defence.

Former Israeli prime minister Ehud Barak was also an early investor and later became chairman. Barak established an investment vehicle called Sum (E.B.) 2015 to invest in Carbyne, then called Reporty. Reporting based on company documents established that Epstein was a partner in Sum and invested about $1M into the vehicle. Carbyne has said its management didn’t know about Epstein involvement at the time.

Peter Thiel’s Founders Fund later invested in Carbyne. Founders Fund also backs Palantir, Anduril and Flock, which means the same investment firm is behind the biggest companies supplying surveillance, predictive policing and defence technology to US government agencies.

Carbyne’s advisory board includes 2 former US Secretaries of Homeland Security, Kirstjen Nielsen and Michael Chertoff, alongside Founders Fund partner Trae Stephens.

Then comes Axon

Some US communities replacing Flock aren’t removing surveillance. They’re changing suppliers. Douglas County, Colorado, is replacing 50 Flock cameras with Axon readers and adding another 50. The wider Axon agreement is worth almost $23M.

Axon, best known for Tasers and police body cameras, completed its acquisition of Carbyne in February 2026 for $625M, although Axon already owned approximately 11% of Carbyne. Axon supplies police with body cameras, fixed and vehicle cameras, licence plate readers, drones, robotics and software. Carbyne adds emergency communications, live location, video and 911 call handling to that portfolio.

A subsequent lawsuit by minority shareholder Intercap alleges that founders Amir Elichai and Alex Dizengof jointly received approximately $20M in personal bonuses plus around $40M in Axon retention shares.

Carbyne moved to New York. Its Israeli operation remained

Carbyne officially moved its corporate headquarters from Tel Aviv to New York in 2019, but its Israeli operation remained. Around the Axon acquisition, Carbyne employed approximately 230 people, with 80 working at its Israeli development centre where it is expected to scale its operations.

Elichai remains CEO and chairman and Dizengof remains CTO. So while Carbyne’s corporate HQ moved to New York, a substantial part of its technical operation remains in Israel and its founders continue to lead the company.

New here? I publish 3 to 10 short OSINT investigations a week. Subscribe for 1 weekly email or follow to read them as they’re published.

Join the Discussion

Add what you know: If you have evidence, a correction or another connection I should investigate, leave a comment to send me a private message. Real names and pseudonyms are equally welcome.

Why I’m building here

Enough LinkedIn readers asked me to create a Substack that I did. My posts rank in the top 0.5%, but LinkedIn restricted my account 3 times and some readers now say my posts no longer appear in their feeds.

I’m moving my work here so it has a permanent home beyond algorithm control. Most posts stay within LinkedIn’s 3,000 character limit: short, information heavy, jargon free and direct. Longer articles only when the story requires it.

Everything is free.

Google's announcement about a new age verification API proves governments and tech companies are working together to roll out surveillance technology under the guise of child safety.

The Play Age Signals API is supposed to let parents protect their kids from inappropriate apps, but it's technically redundant because Android phones already provide this capability.

If Facebook implemented the API, the app checks a child's age after installation by asking Google Play services for the account's age range. Google reads the child profile and sends back an age signal. The app then attempts to adjust visible features or content to match that age group.

Google's claim that developers will use this API to tailor in-app experiences by age is fantasy, and potentially dangerous. Like today's failed content moderation, it won't happen properly, or at all. I believe this will give parents a false sense of security while putting kids in more danger.

Some companies might even drop their app's age rating from 18+ to 12+ or 12+ to 4+, claiming they'll restrict features or content using the age band.

Intentionally or not, they'll get it wrong often enough to cause more harm than they do today. Moreover, the API doesn't stop teens from downloading apps from third party stores instead of Google Play.

Google says companies aren't allowed to use age checking for advertising, profiling or analytics. I'll let you decide how likely that is. Google can now centralise identity telemetry and monitor user activity across apps. Every age check runs through Google, telling Google which child account opened which app and when.

In 2025, a federal jury awarded $425M against Google for collecting data from 3rd party apps used by 98M people who had switched off their Web and App Activity setting that was supposed to stop it.

💣 There's no technical reason for this surveillance API.

This new app-based approach and the existing device-based age check requires a parent to sign into their child's device and verify adult consent to establish the child's birthdate.

Android controls outmatch app based age checking. Before a download begins, the Play Store compares the child's birthdate against an app's age classification, and blocks unapproved apps completely. Android also enforces SafeSearch automatically and prevents third party app store installs.

Google built Android, so it obviously knows parents can already protect kids. Governments demanding age verification know it too, and neither has bothered to tell parents how to turn these controls on. It's reasonable to conclude that neither cares about child safety, only about collecting verified identity data for the purpose of corporate surveillance and government control.

Ignore the “pledge” option on the subscriptions page. Everything I publish is free.

Why I’m now writing and building a community on Substack

After repeated requests in LinkedIn comments and messages, I created this Substack so my work has a permanent home beyond algorithm control. LinkedIn restricted my account 3 times without cause before I had a call with their escalation team. My posts rank in the top 0.5%, but some readers report they don’t appear in feeds anymore and must visit my profile directly.

I’m migrating my writing here and keeping most posts within LinkedIn’s 3,000 character limit to respect your time, publishing longer articles only when required. Content remains information heavy, jargon free, and direct.

Everything is free.

If you’re already a Substack member, you know what to do: follow me to get notified when I publish and join the conversations.

If you arrived from LinkedIn or Twitter, Substack is more than an email newsletter. Create a free account and follow me to see posts in your feed, receive notifications and join the community. I’m loving it because the feed makes it much easier to discover people, ideas, and conversations than LinkedIn.

If you only want email, subscribe and you’ll receive 1 weekly digest rather than an email every time I publish.

My LinkedIn posts regularly attract over 250K readers and 1K comments - they’re in the top 0.5% for readership and engagement. I hope we’ll build the same kind of informed discussion here.

Mithril Defense has installed armed drones in 9 American schools. The system relies on AI cameras to detect signs of danger, but they use the same class of camera that mistook a bag of Doritos for a gun.

The company’s Campus Guardian Angel drones sit in ceiling boxes across 3 Florida high schools, 5 in Georgia and a charter school in Colorado. Remote pilots fly them from Austin, Texas. They’re equipped to spray pepper gel, flash strobes, sound sirens, shatter windows with a front lance and ram a person at 60 mph.

Justin Marston founded Mithril in 2023 with Bill King, a Navy SEAL of 32 years, after watching Ukrainian FPV drones harass Russian soldiers. Florida has committed $1.12 million, and approved the second $564K before the drones at Deltona High School had ever been used in a real incident. Georgia has allocated $550K.

According to the Learning Policy Institute, American schools already spend about $4 billion a year hardening buildings. In October 2025, the Omnilert system at Kenwood High School in Baltimore County flagged a 16 year old holding a bag of Doritos as an armed threat. Police arrived, drew their guns, handcuffed him and searched him. Baltimore County has 7,000 cameras wired into that system, and the superintendent said the program did what it was supposed to do.

Amos P Godby High School in Tallahassee is now the first in the country to wire ZeroEyes gun detection directly into Campus Guardian Angel drones. The same false positive that sent police in Baltimore now sends drones that spray pepper gel and ram whoever the camera flagged.

Curtis Lavarello of the School Safety Advocacy Council warns that a pilot sitting in a different state, making a split second decision could hit a fleeing student or a responding officer instead of the shooter.

There’s no federal law that says what a drone is allowed to do to a person on the ground. And there’s no statute that defines when a drone can use force, what’s considered proportionate, or who’s liable when it injures a bystander.

Mithril tells schools it’s integrating every sensor to give “the clearest real time picture of every moment on campus.” During a response, its Austin office tracks every member of staff to 3 inches using ultra wideband beacons.

Imagine when they add facial recognition. Parents will be forced to accept a defence contractor in another state holding video of their children and knowing which child is which.

Imagine if they add predictive rule enforcement through a partnership with a company like Palantir Technologies. Once a drone can identify a named child, the aircraft can be sent to a fight, a vape, a crowd forming in a corridor, or a pupil the camera scores as likely to do something before they’ve done it.

Ignore the “pledge” option on the subscriptions page. Everything I publish is free.

Why I’m now writing and building a community on Substack

After repeated requests in LinkedIn comments and messages, I created this Substack so my work has a permanent home beyond algorithm control. LinkedIn restricted my account 3 times without cause before I had a call with their escalation team. My posts rank in the top 0.5%, but some readers report they don’t appear in feeds anymore and must visit my profile directly.

I’m migrating my writing here and keeping most posts within LinkedIn’s 3,000 character limit to respect your time, publishing longer articles only when required. Content remains information heavy, jargon free, and direct.

Everything is free.

If you’re already a Substack member, you know what to do: follow me to get notified when I publish and join the conversations.

If you arrived from LinkedIn or Twitter, Substack is more than an email newsletter. Create a free account and follow me to see posts in your feed, receive notifications and join the community. I’m loving it because the feed makes it much easier to discover people, ideas, and conversations than LinkedIn.

If you only want email, subscribe and you’ll receive 1 weekly digest rather than an email every time I publish.

My LinkedIn posts regularly attract over 250K readers and 1K comments - they’re in the top 0.5% for readership and engagement. I hope we’ll build the same kind of informed discussion here.

Illinois has made age verification mandatory on phones, tablets, and computers under the guise of child safety, and the law gives social media companies like Meta and TikTok a defence against liability for online child safety.

Governor JB Pritzker signed House Bill 5511 on July 31, and it's now Public Act 104 0664. The bill states that if a platform relies on the age signal provided by a person's device, it doesn't need to verify their age, and it isn't liable if that reported age turns out to be wrong.

Starting January 1, 2028, mobile and computer operating systems must show a setup screen where an account holder enters a birth date. The operating system converts that date into 1 of 4 age groups, under 13, 13 to 16, 16 to 18 or 18+, and makes the group available to app developers through an API. Every social media company has to call that API when a person downloads or opens its app, once a year per person.

When the device reports a minor's age, the law assumes the platform knows it's a child. The platform must then turn off algorithmic feeds and block adult messaging by default. When the device reports an age of 18 or older, these rules don't apply and the law protects the platform for accepting that age signal.

If a parent doesn't set up their child's device, the child gets full access to every social network and none of those platforms will be liable for any harms caused by harmful content or adults who might message them.

Juries in New Mexico and California already found against Meta for harming children who used its apps. In both trials, the argument came down to whether Meta knew they were children. Under the Illinois law, Meta no longer needs to prove anything because the answer comes from the operating system. Apple, Google, and Microsoft collect the age at setup and pass it on, and the law protects them too when it's wrong.

In September 2025, Meta's Vice President of State Policy Dan Sachs lobbied to move age verification into app stores and operating systems. Unsurprisingly, Google called this approach one of the most thoughtful approaches it'd seen.

Bloomberg reported Meta as a major financial backer of the lobbying behind these laws.

Google will now learn which devices in a household belong to children. In 2019, Google paid $170 million over YouTube collecting children's data.

California and Colorado passed similar laws but exempt open source operating systems like Linux. Illinois doesn't exempt anyone, so any developer shipping an operating system with a setup screen faces the same $50K per violation penalty as Apple. GrapheneOS isn't caught by this draconian law because it doesn't have an account system, which means it doesn't have a setup screen to add the age question to.

Only the Illinois Attorney General can enforce the law, so nobody else can sue. Each $50K penalty goes into a fund used for the Attorney General's own work.

I believe the first lawyer to cite this law in court will be defending Meta.

Substack adds a “pledge” option to subscriptions. Ignore it. Everything I publish is free.

Why I’m now writing and building a community on Substack

After repeated requests in LinkedIn comments and messages, I created this Substack so my work has a permanent home beyond algorithm control. LinkedIn restricted my account 3 times without cause before I had a call with their escalation team. My posts rank in the top 0.5%, but some readers report they don’t appear in feeds anymore and must visit my profile directly.

I’m migrating my writing here and keeping most posts within LinkedIn’s 3,000 character limit to respect your time, publishing longer articles only when required. Content remains information heavy, jargon free, and direct.

Everything is free.

If you’re already a Substack member, you know what to do: follow me to get notified when I publish and join the conversations.

If you arrived from LinkedIn or Twitter, Substack is more than an email newsletter. Create a free account and follow me to see posts in your feed, receive notifications and join the community. I’m loving it because the feed makes it much easier to discover people, ideas, and conversations than LinkedIn.

If you only want email, subscribe and you’ll receive 1 weekly digest rather than an email every time I publish.

My LinkedIn posts regularly attract over 250K readers and 1K comments. I hope we’ll build the same kind of informed discussion here.

Hinge founder Justin McLeod has launched a new dating app called Overtone. It uses AI to interview people about their past relationships. Staff can listen to the recordings, and the company shares information from those conversations with third party providers.

The privacy policy says team members may review samples of interviews, insights, introductions and recordings for quality and safety. Overtone shares information with providers handling insight generation, transcription and audio processing, cloud hosting, moderation, analytics and customer support.

Those conversations can include some of the most private information people will ever give a tech company.

McLeod quit as the CEO of Hinge in December 2025 and raised $18M for Overtone in July 2026 from FirstMark Capital A1 LP, Pace Capital and Match Group. Match Group CEO Spencer Rascoff joined Overtone’s board.

McLeod is publicly critical of swiping and endless matching, but he’s building the alternative with the company that owns Tinder, Hinge and OkCupid.

On Hinge, you read profiles and decide who you like. On Overtone, you talk to an AI about yourself, your previous relationships and what you want, then Overtone decides who you’re introduced to. The AI makes a decision you previously made yourself.

Voice recordings about your last relationship can include why it ended, what you did wrong, what frightens you, and the name, job and private details of other people.

Overtone say it deletes the recording within 30 days but keeps a written transcript of everything you said, plus a psychological profile it builds from it covering your personality, your values, how you communicate and what you want from a relationship. That profile decides who you meet, and it stays after the recording is gone.

Overtone’s terms give the company a worldwide, royalty free, sublicensable and transferable licence to use, store, reproduce, modify and distribute submitted content to operate and improve the service.

The acquisition clause in its privacy policy says user data may transfer if the company is acquired, merged or sells assets. Match Group funded Overtone’s incubation inside Hinge, invested in the spinout, and put its CEO on the board.

Match Group could buy Overtone and get the transcripts and psychological profiles of every person whose data Overtone still holds, along with any recordings that haven’t yet been deleted. Those people told Overtone about their divorces, their affairs, their fears and their exes. They didn’t tell Match Group anything. That data could be used to cross sell and upsell across Match Group’s other apps.

This is the premise of Hang the DJ, the Black Mirror episode where a system builds a model of you and picks your partners. The difference is that Overtone’s model can be sold with the company.

Substack adds a “pledge” option to subscriptions. Ignore it. Everything I publish is free.

Why I’m now writing and building a community on Substack

After repeated requests in LinkedIn comments and messages, I created this Substack so my work has a permanent home beyond algorithm control. LinkedIn restricted my account 3 times without cause before I had a call with their escalation team. My posts rank in the top 0.5%, but some readers report they don’t appear in feeds anymore and must visit my profile directly.

I’m migrating my writing here and keeping most posts within LinkedIn’s 3,000 character limit to respect your time, publishing longer articles only when required. Content remains information heavy, jargon free, and direct.

Everything is free.

If you’re already a Substack member, you know what to do: follow me to get notified when I publish and join the conversations.

If you arrived from LinkedIn or Twitter, Substack is more than an email newsletter. Create a free account and follow me to see posts in your feed, receive notifications and join the community. I’m loving it because the feed makes it much easier to discover people, ideas, and conversations than LinkedIn.

If you only want email, subscribe and you’ll receive 1 weekly digest rather than an email every time I publish.

My LinkedIn posts regularly attract over 250K readers and 1K comments. I hope we’ll build the same kind of informed discussion here.

Cami Clark, wife of Anthropic CEO Dario Amodei, spent 2 years trying to raise money from Jeffrey Epstein for her women-led porn company Eddice, and she also connected the men who funded Anthropic.

U.S. Department of Justice files reported by the The Wall Street Journal show she made contact in 2011, 3 years after his 2008 conviction.

In March 2011 the literary agent John Brockman emailed Epstein about Clark and her Eddice co founder Michelle Capocefalo (LinkedIn), telling him to "connect for dinner with my girls". Clark had dinner with Epstein that evening. The next morning she emailed Epstein what Eddice needed, which was $2.5M. Days later she sent Epstein the script for the company's first film, American Girl in Paris, and told him it was "a little nsfw".

Brockman wasn't making a one off introduction. He ran the Edge Foundation, and tax filings show Epstein funded the bulk of its budget and paid for the dinners where Brockman introduced him to scientists including Marvin Minsky, Seth Lloyd and Lisa Randall. Most of that funding came after the 2008 conviction, so by the time Brockman introduced Clark to Epstein he'd been doing the same thing for other clients for 3 years.

When she pitched again in 2012 he asked who she was, and she reminded him of her free luxury porn company. He answered "yes,, a loud gong", then declined, saying he couldn't do sex TV. She went straight to a second pitch, a social dieting app collecting women's nutrition, location, mood and menstrual data.

Menstrual dates combined with location data can reveal whether a woman is pregnant, when a pregnancy may have ended, and where she was at the time. Add information about mood and eating habits, and the app can hold an extraordinarily detailed record of her health.

She designed it in 2012 and offered it as an investment opportunity to a man on the sex offender registry.

She kept emailing him in 2013, inviting him to a Manhattan housewarming party and adding him on LinkedIn.

Nothing in the emails shows Epstein invested in either company, and the Journal doesn't say that Clark took part in his crimes or committed any offence herself. She hasn't been named in the Epstein files as a participant in anything criminal.

She was in a relationship with Eric Schmidt for 3 years before dating Amodei in 2018, and introduced the two men.

Her next company, Female Algorithm Technologies, listed Dario Amodei as an adviser and took Schmidt's investment. She joined Ultraleap in 2016, met Mira Murati there, and introduced her to OpenAI cofounder Greg Brockman (LinkedIn). Murati became OpenAI's CTO.

Murati left OpenAI in 2024 and founded Thinking Machines Lab 5 months later. In July 2025 it raised $2B at a $12B valuation in a round led by a16z. It's the largest seed round in the history of venture capital, and it closed with no product or revenue. That's what one introduction at a hand tracking company in 2016 was worth.

Schmidt invested in Anthropic's Series A in 2021. She gave Schmidt a 40 page proposal for a Mother of AGI Fund to formalise her role at Anthropic, but the cofounders rejected it. In July she lunched with Ivanka Trump at Sun Valley.

When Schmidt gave the University of Arizona commencement address in May, graduates booed him throughout. He told them, "When someone offers you a seat on the rocket ship, you do not ask which seat. You just get on". The booing was preplanned. Student groups including FORCE and the Women and Gender Resource Center distributed flyers detailing allegations from a 2025 lawsuit by his former partner Michelle Ritter, urging the audience to turn their backs or boo.

Schmidt denies the claims, his attorney called them fabricated, and a judge referred the dispute to arbitration earlier this year. The university stood by the invitation and awarded him an honorary doctorate.

Clark lacks a formal title at Anthropic, but she serves as her husband’s key strategic adviser, influencing his decisions and handling investors and politicians.

Almost everything about Clark was removed from the internet. Amodei's Wikipedia entry says he's married without naming her. Claude won’t confirm whether they're married, which is odd.

Removing that much material costs money and takes months, so I believe someone paid for it. The Journal reports that efforts were made to remove references to her, and Eddice itself is gone from the web, surviving only in archived copies.

Amodei is worth $15.5 billion. His company says that AI is dangerous enough to require federal licensing and that only a small number of approved companies should be allowed to build it. He wants to create another tech duopoly.

I believe the United States House Oversight Committee will call Clark. If that happens, the people who want the government to decide which companies can be trusted to build AI may have to explain why they themselves should be trusted.

Welcome to the tech world.

If anything in this piece is factually incorrect, I want to know. Please get in touch and I'll correct it promptly. Nothing written here is intended as a legal accusation or assertion of wrongdoing. All statements are based on publicly available information and my own analysis and opinion.

Why I’m now writing and building a community on Substack

After repeated requests in LinkedIn comments and messages, I created this Substack so my work has a permanent home beyond algorithm control. LinkedIn restricted my account 3 times without cause before I had a call with their escalation team. My posts rank in the top 0.5%, but some readers report they don’t appear in feeds anymore and must visit my profile directly.

I’m migrating my writing here and keeping most posts within LinkedIn’s 3,000 character limit to respect your time, publishing longer articles only when required. Content remains information heavy, jargon free, and direct.

Everything is free.

If you’re already a Substack member, you know what to do: follow me to get notified when I publish and join the conversations.

If you arrived from LinkedIn or Twitter, Substack is more than an email newsletter. Create a free account and follow me to see posts in your feed, receive notifications and join the community. I’m loving it because the feed makes it much easier to discover people, ideas, and conversations than LinkedIn.

If you only want email, subscribe and you’ll receive 1 weekly digest rather than an email every time I publish.

My LinkedIn posts regularly attract over 250K readers and 1K comments. I hope we’ll build the same kind of informed discussion here.

Subscribe free for the weekly digest. Create an account and follow for daily dispatches.

Recommendation engines work by identifying what a video is about and matching it to a specific person. To deliver thousands of suicide videos to one person, the system must first recognise that specific subject matter. The same data tag that feeds a harmful video into a person's stream is the same tag that can be used to delete it from platform. And when the same account posts the same harmful content more than enough times, that account can be suspended pending human review.

A confidential TikTok document found during discovery in the social media addiction lawsuits, reported by Bloomberg Businessweek, shows how this system operates in practice. In 2021, TikTok updated its algorithm to interrupt repetitive spirals of harmful content. They deployed the safety feature to 90% of US users, but kept 10%, roughly 15 million people, on the unprotected version to test if the safety update reduced daily app usage.

16 year old Chase Nasca was placed in that unprotected test group. TikTok fed his account thousands of videos about suicide, sadness, and self harm until he died by suicide in February 2022. TikTok's internal review states the safety feature didn't take effect for him by design.

After Bloomberg requested information on the case in March 2023, TikTok's safety team analysed 7,563 videos sent to Chase during his final 2 weeks. They found 73% focused on suicide and depression, while nearly 10% violated platform rules outright and should have been deleted immediately. That review happened over a year after his death, prompted by a journalist rather than internal safety checks.

I've built crawlers, classification systems and content labelling for categories like this, and it isn't hard to get right, especially with today's technology.

Internal documents show TikTok balanced these protections against growth metrics like daily active users, which drive add revenue and company valuation. Staff suggested reducing the test group to under 1% and shortening test periods to 7 days, warning that even then, 1.8 million Americans would still be left without it. TikTok kept the experiment running.

2 months after reviewing those findings, TikTok told Congress it doesn't believe platform is the cause for any deaths by suicide. A court dismissed the family's claim under Section 230 immunity and an appeal is pending. Meanwhile, TikTok maintains it invests heavily in community safety.

TikTok identifies content before sending it. A platform capable of categorising thousands of self harm videos to build a targeted feed can just as easily delete them. TikTok leaves the content in place because removing it costs engagement. That's a commercial decision, and the technology has nothing to do with it. This is a sad story that could have been avoided.

Why I’m now writing and building a community on Substack

After repeated requests in LinkedIn comments and messages, I created this Substack so my work has a permanent home beyond algorithm control. LinkedIn restricted my account 3 times without cause before I had a call with their escalation team. My posts rank in the top 0.5%, but some readers report they don’t appear in feeds anymore and must visit my profile directly.

I’m migrating my writing here and keeping most posts within LinkedIn’s 3,000 character limit to respect your time, publishing longer articles only when required. Content remains information heavy, jargon free, and direct.

Everything is free.

If you’re already a Substack member, you know what to do: follow me to get notified when I publish and join the conversations.

If you arrived from LinkedIn or Twitter, Substack is more than an email newsletter. Create a free account and follow me to see posts in your feed, receive notifications and join the community. I’m loving it because the feed makes it much easier to discover people, ideas, and conversations than LinkedIn.

If you only want email, subscribe and you’ll receive 1 weekly digest rather than an email every time I publish.

My LinkedIn posts regularly attract over 250K readers and 1K comments. I hope we’ll build the same kind of informed discussion here.

Subscribe free for the weekly digest. Create an account and follow for daily dispatches.

NHS England didn’t tell the truth about who can see patients’ medical records with their names attached, and it has now admitted that Palantir Technologies have had full admin access to identifiable patient data all this time.

NHS’ legal document said only NHS staff could see them. When I called them out for not telling the truth, a few senior people who work for NHS and Palantir told me I was wrong.

3 Palantir engineers hold admin access to the National Data Integration Tenant, the system holding those records before names are stripped out. 33 more engineers from other suppliers have narrower access.

I called this out because no organisation can work with Palantir while keeping its data private. Data sovereignty doesn't exist when a supplier runs the core systems storing and interpreting that data. A system can't interpret data without full access to it, obviously.

NHS now says supplier access to identifiable data is technically necessary. That would have been decided when the system was designed, not afterwards, so it was necessary from the first day. NHS designed the system and then published a document saying the access doesn't happen.

Tom Bartlett built the NHS tenant. He published a defence of the access, and I replied straight away.

He compared admin access to holding the keys to a warehouse of sealed boxes. But his own diagram shows a part of the system where the records sit with the names still on them. The boxes are already open where Palantir engineers work.

He also said the data is pseudonymised. Pseudonymisation swaps names for codes. Anyone holding the list that matches the codes to the names swaps them back. And the tenant holds the data before the codes are applied.

He said the access is audited, but audit logs show misuse after it has happened and the people who run the logs hold the admin access. He relied on a diagram from a design document that nobody outside NHS and its suppliers has checked against the running system, and neither he nor NHS has said what the admin role permits.

He then wrote that you can't build a national data integration platform "without seeing the data that flows through it", which is the thing he was arguing against.

Dr Nicola Byrne, the National Data Guardian, had to write and ask before NHS admitted all of this. Her office says it can't independently check NHS' claim that the access is necessary.

NHS lied about who could see your medical records. The whole point of the document was to disclose who could see them. It left out the 3 Palantir engineers with admin access to the records of tens of millions of people. NHS calls it an error and apologises for the confusion. That’s not good enough and people should be fired.

Everything else NHS has said about this rests on the word of people who didn't tell the truth until they were caught. Take anything they say from here on with a pinch of salt.

Why I’m now writing and building a community on Substack

After repeated requests in LinkedIn comments and messages, I created this Substack so my work has a permanent home beyond algorithm control. LinkedIn restricted my account 3 times without cause before I had a call with their escalation team. My posts rank in the top 0.5%, but some readers report they don’t appear in feeds anymore and must visit my profile directly.

I’m migrating my writing here and keeping most posts within LinkedIn’s 3,000 character limit to respect your time, publishing longer articles only when required. Content remains information heavy, jargon free, and direct.

Everything is free.

If you’re already a Substack member, you know what to do: follow me to get notified when I publish and join the conversations.

If you arrived from LinkedIn or Twitter, Substack is more than an email newsletter. Create a free account and follow me to see posts in your feed, receive notifications and join the community. I’m loving it because the feed makes it much easier to discover people, ideas, and conversations than LinkedIn.

If you only want email, subscribe and you’ll receive 1 weekly digest rather than an email every time I publish.

My LinkedIn posts regularly attract over 250K readers and 1K comments. I hope we’ll build the same kind of informed discussion here.

Meta has been paying neo Nazi and anti vaccine accounts in Australia to post on Facebook, which makes Meta their business partner and potentially liable for the harm caused.

ABC News Verify found 4 Australian accounts earning money through Facebook's Content Monetization program using What To Fix, an archive built from Meta's disclosures.

Victoria Police moved Hugo Lennon along after he shouted racist abuse at Narendra Modi inside Melbourne's Sofitel in July. He posted the video to a Facebook page where Meta pays him for content referencing replacement theory and remigration.

The Noticer is an Australian neo Nazi site that X suspended under its Hateful Profile Policy, but Meta has been paying it since November 2025.

Monica Smit, founder of the anti vaccine group Reignite Democracy Australia, joined in 2025 and appears to have earned Facebook advertising revenue since 2017. She posts vaccine misinformation and sells radiation protection bracelets even though Meta's terms ban misleading medical information from earning money. Leaked documents reported by Reuters show 10% of Meta's ad revenue comes from scams and illegal goods.

Content Monetisation is invitation only, so Meta reviews every account, approves it, then shares the revenue their content generates. Facebook distributed almost $3B to 16.2M monetised accounts in 2025.

Meta chose these accounts and makes money from their content, so it can't claim to be a neutral platform merely hosting what other people publish.

Meta told ABC that anyone using its monetisation tools must comply with its policies, while saying it isn't Meta's role to police offensiveness. I believe that's dishonest. Meta’s own terms of service say racist material and medical misinformation is banned, yet Meta paid accounts publishing both.

I pioneered standards, technology, and techniques for content classification and machine readable labels in 2004, and first moderated online content in 1996. Measuring posting frequency and suspending repeat offenders in 2026 is easy.

Meta’s European HQ is in Dublin, where Ireland’s media regulator, Coimisiún na Meán awarded trusted flagger status in June to the Jewish Representative Council of Ireland. That gives it responsibility for identifying content it considers antisemitic, and under Article 22 of the Digital Services Act every social network operating in the EU has to handle its reports ahead of ordinary ones and decide on them without undue delay. The status was granted in Ireland and is recognised across all 27 member states.

The regulator designated 2 other organisations the same day. The Irish Internet Hotline covers child sexual abuse material, intimate image abuse, racism, xenophobia and financial fraud, while the Irish Music Rights Organisation covers copyright. The Jewish Representative Council is the only organisation appointed specifically for a single category of discriminatory speech. I believe antisemitism should have been included within the Irish Internet Hotline’s remit because it already handles racism and xenophobia and isn’t dedicated to representing one particular community.

Meta gets away with so much in Europe because the Irish government depends on the companies it’s supposed to regulate. 2 tech companies alone account for about 40% of all corporation tax in Ireland, and foreign multinationals paid €28.8B of the €32.9B collected last year.

Data Protection Commission Ireland proposed resolving Meta’s EU to US data transfer case with a suspension order and no financial penalty. The European Data Protection Board overruled it in April 2023 and directed a fine, and the DPC imposed €1.2B the following month, still the largest penalty ever issued under the GDPR.

Antisemitic content now receives priority in Ireland while other harmful content and child safety is ignored. All hateful and harmful content should be treated equally.

Why I’m now writing and building a community on Substack

After repeated requests in LinkedIn comments and messages, I created this Substack so my work has a permanent home beyond algorithm control. LinkedIn restricted my account 3 times without cause before I had a call with their escalation team. My posts rank in the top 0.5%, but some readers report they don’t appear in feeds anymore and must visit my profile directly.

I’m migrating my writing here and keeping most posts within LinkedIn’s 3,000 character limit to respect your time, publishing longer articles only when required. Content remains information heavy, jargon free, and direct.

Everything is free.

If you’re already a Substack member, you know what to do: follow me to get notified when I publish and join the conversations.

If you arrived from LinkedIn or Twitter, Substack is more than an email newsletter. Create a free account and follow me to see posts in your feed, receive notifications and join the community. I’m loving it because the feed makes it much easier to discover people, ideas, and conversations than LinkedIn.

If you only want email, subscribe and you’ll receive 1 weekly digest rather than an email every time I publish.

My LinkedIn posts regularly attract over 250K readers and 1K comments. I hope we’ll build the same kind of informed discussion here.

The Walt Disney Company just chose TikTok as a global content partner despite regulators, governments, and families taking action against TikTok over addictive design, child safety, children's privacy and inappropriate content.

TikTok creators will get clips, audio and characters from hundreds of Disney, Pixar, Marvel and Star Wars titles, with selected videos appearing in Verts, the vertical feed inside Disney+.

Disney's chief marketing officer Asad Ayaz said the best storytellers are fans first. TikTok's global head of entertainment Dawn Yang said creators are at the heart of everything TikTok does. Neither mentioned children.

Parents can set a maximum content rating on Disney+ profiles and restrict them further with Junior Mode and a 4 digit PIN. Those controls work because organisations such as the BBFC and MPA classify films and series before Disney+ automatically decides which profiles can access them.

Fan videos are different. Every video Disney selects would need human review and classification before the same controls could apply. I can't see Disney doing that at scale, and it hasn't explained how it will classify them.

The European Commission told TikTok in February that its addictive design breaches the Digital Services Act. In July it found children's public accounts could be viewed by anyone, even without a TikTok account, while TikTok could recommend content posted by teenagers to adults they don't know, exposing minors to unwanted contact and bullying.

Disney signed 12 days later.

6 days after Disney's announcement, Pennsylvania Attorney General Dave Sunday sued TikTok. He says TikTok understates the amount of sexual content, nudity, profanity and drug use on its platform when reporting to Apple and Google, allowing it to maintain a 13+ app store rating.

Then there's Oracle.

Oracle owns 15% of the joint venture running TikTok in the US. That business retrains and tests TikTok's recommendation algorithm using American data, while Oracle provides the systems that checks TikTok's US source code for security problems.

Oracle is therefore trusted to check the security of a business it partly owns. That's an obvious conflict of interest.

TikTok also gains something harder to quantify but far more valuable: Disney’s implicit endorsement. As a trusted family brand, Disney’s presence influences parental perception. Concerned parents may assume Disney wouldn’t partner closely if children faced sexual content, nudity, violence, drug use or other content they believe is unsuitable for their child.

If parents can no longer determine what their children might see inside a Disney+ profile they've specifically restricted by age, the rating loses its purpose. Many parents will respond by blocking Verts or deleting Disney+ entirely.

As a tech expert in content classification and filtering systems, I know what works, what doesn’t, and what’s coming. As a parent, I kept my 8 year old away from 12+ rated shows on Netflix and Disney+ because I didn’t believe the content was suitable for her at the time. When parents are unable to know which content might be unsuitable, families will block Verts or delete Disney+ entirely.

Why I’m now writing and building a community on Substack

After repeated requests in LinkedIn comments and messages, I created this Substack so my work has a permanent home beyond algorithm control. LinkedIn restricted my account 3 times without cause before I had a call with their escalation team. My posts rank in the top 0.5%, but some readers report they don’t appear in feeds anymore and must visit my profile directly.

I’m migrating my writing here and keeping most posts within LinkedIn’s 3,000 character limit to respect your time, publishing longer articles only when required. Content remains information heavy, jargon free, and direct.

Everything is free.

If you’re already a Substack member, you know what to do: follow me to get notified when I publish and join the conversations.

If you arrived from LinkedIn or Twitter, Substack is more than an email newsletter. Create a free account and follow me to see posts in your feed, receive notifications and join the community. I’m loving it because the feed makes it much easier to discover people, ideas, and conversations than LinkedIn.

If you only want email, subscribe and you’ll receive 1 weekly digest rather than an email every time I publish.

My LinkedIn posts regularly attract over 250K readers and 1K comments. I hope we’ll build the same kind of informed discussion here.

Anthropic CEO Dario Amodei told employees in a recent all hands meeting that the company risks becoming a place people join for the paycheck rather than the mission.

This isn't a hiring problem. It's a mission problem. When corporate strategy relies on aggressive legal shortcuts and fear tactics, high pay becomes the only reason people want to join or stay.

Anthropic pays some of the highest salaries in AI, but keeping talent focused on a mission requires a mission they believe in, and genuine ethics. Staff can see the difference between the company's public claims about AI safety and its actual behaviour.

To train its AI model Claude, Anthropic first downloaded millions of pirated books from illegal repositories. Later, it bought physical books, cut off their bindings, scanned the pages, and destroyed the paper copies to claim format shifting rights. I wrote a post about this recently.

In June 2025, Judge William Alsup ruled that buying and scanning physical books was fair use, but downloading pirated files wasn't. A federal judge then approved a 1.5 billion dollar settlement covering nearly half a million books and ordered Anthropic to destroy the pirated data.

Anthropic also uses scare tactics for public relations. Leadership continually warns about existential AI risks, using those fears to lobby the government for restrictive regulations that hurt competitors. Anthropic is the only major frontier lab that refused to sign the Open Weights and American AI Leadership pledge backed by Meta, Google, SpaceX, OpenAI, Microsoft, and NVIDIA. White House AI adviser David Sacks called Anthropic's stance a regulatory capture strategy based on fear mongering, while investor Bill Gurley said the company is just protecting its market position.

When founders build a company on data hoarding, legal loopholes, and market protectionism, they shouldn't be surprised when employees treat their work as just a job. Anthropic will keep losing the mission argument until it creates a mission worth believing in, and with an IPO planned for October, the cash side of that deal only grows stronger.

Note to new readers: I expose state surveillance, corporate power, and cybercrime by naming the companies, agencies, and leaders involved. Published my first newsletter at AOL in 1996. My LinkedIn posts rank in the top 0.5% for readership and engagement, leading to 3 account restrictions for naming powerful entities. I created this Substack at reader request.

I publish 3 to 10 dispatches weekly to this web archive. Email subscribers receive 1 weekly digest to keep inboxes clean.

Create a free account or download the Substack app to get real-time push alerts for every post, access the searchable archive, and comment under your real name or a pseudonym.

Add what you know: If you have an insight, a correction, or an additional signal, leave a comment. You can participate under your real name or a pseudonym.

Share

Apple pulled Telegram Messenger, a messaging app with over 1 billion active users, from the App Store over a single report of child sexual abuse material (CSAM). They brought the app back when the image was removed and the poster was banned about 40 minutes later.

The media is reporting the event without asking any questions. I'd like to highlight two things that don't add up to me. First, why did Apple remove Telegram as a result of a single report. Moreover, Apple hasn't removed Facebook, Instagram, or X despite being reported repeatedly for not removing the same content.

I previously wrote about a BBC investigation that showed Instagram as serving paid ads that promoted CSAM to a test account in India. It found 30 of them, approved by Instagram's own advertising checks. When the BBC reported one ad through Instagram, Meta's review team replied a day later to say it didn't break the rules.

If Apple is going to remove apps that host a single CSAM image, what's to stop people from uploading an AI made CSAM image and then sending a report to Apple.

Also, Telegram's founder Pavel Durov gave an explanation that fails basic technical logic as well.

Durov claimed an extortionist retroactively edited an old public message so members of the group wouldn't see the AI generated CSAM. He said that the group admins refused to pay a ransom to have the image removed, so the bad actor reported their own image to Apple to punish admins for refusing a ransom. Sending a report would only harm Telegram, not the group admins.

That explanation doesn't make sense to me because if an attacker tried to extort group admins, the admins could have easily found and removed the image, reported it to Telegram, and banned the end user from their group.

Paying a ransom makes zero sense when the admin can delete any post they want immediately. My team built a security chatbot for Telegram about 8 years ago. It protected over a million people, automatically detecting and deleting phishing scams while banning threat actors. Before that, my team built the first security chatbots in the world for HipChat and Slack, which eradicated phishing on Slack for the entire crypto space in 2017. I know how these platforms, bots, and content moderation work. What Durov says isn't logical to me. He brags about how he only needs a handful of engineers to build and maintain the service. I think it's time Telegram and other platforms hire content moderation teams.

Even if Telegram's account is accurate, there's no reason they can't let group admins stop people editing messages already posted, for a set period. This kind of monitoring and moderation is easy to get right.

I don't know which worries me more: Apple targeting a specific app used by a billion people without giving Telegram 10 minutes to delete one post, or Telegram's explanation of how that post got there and why it wasn't removed by their team, which doesn't add up.

Note to new readers: I expose state surveillance, corporate power, and cybercrime by naming the companies, agencies, and leaders involved. Published my first newsletter at AOL in 1996. My LinkedIn posts rank in the top 0.5% for readership and engagement, leading to 3 account restrictions for naming powerful entities. I created this Substack at reader request.

I publish 3 to 10 dispatches weekly to this web archive. Email subscribers receive 1 weekly digest to keep inboxes clean.

Create a free account or download the Substack app to get real-time push alerts for every post, access the searchable archive, and comment under your real name or a pseudonym.

Add what you know: If you have an insight, a correction, or an additional signal, leave a comment. You can participate under your real name or a pseudonym.

Share

LinkedIn is rolling out a "Seems like AI slop" button to every post menu. Tapping it hides the post, notifies the author, and trains the algorithms that decide what everyone else sees.

AI slop is a real problem, but this button lets anyone who dislikes a post easily suppress it, creating an avalanche of false positives enabled by LinkedIn. You'll never know because it'll happen silently & out of sight.

AI that guesses whether a human wrote something isn’t reliable. OpenAI shut down its detector because it identified only 26% of AI text correctly while labeling 9% of human text as machine written. Stanford University researchers ran 91 human written essays through 7 detectors, which wrongly flagged 61% as AI generated. When those same essays were rewritten with elaborate wording, false flags dropped to 12%.

Hari Srinivasan, LinkedIn's chief product officer, said slop is hard to define and the definition keeps changing. If LinkedIn values real perspectives, they'd remove this feature immediately until they can clearly define what they're looking for. If they can't define AI slop, their AI can't evaluate reports properly.

LinkedIn is also training AI on flags from people who don't agree on what they're reporting. Classification systems need well defined criteria to separate acceptable posts from unacceptable ones. When the target constantly shifts, software doesn't moderate, it just guesses. Whenever legitimate human writing gets suppressed, LinkedIn can avoid accountability while leaving its members with no way to appeal.

Moreover, LinkedIn will probably end up restricting accounts wrongly classified as AI slop, giving them a compelling way to censor free expression from people who comply with their terms of service.

Political figures and tech leaders that dislike criticism will use this feature to suppress independent analysis. A coordinated wave of flags hides a post and teaches the algorithm that plain technical writing is slop, without a human moderation a word.

My posts generate higher engagement & deeper conversation than most, but my reach fell off a cliff after I asked LinkedIn to investigate unexplained account restrictions. On a July 21 call, I told their escalation team I wouldn't be surprised if someone did something to make my account look automated because I write about surveillance, government overreach, and privacy. What started as explicit bans they couldn't justify shifted into instant silent suppression they could blame on algorithms.

Palantir Technologies's Global Director of Privacy and Civil Liberties Engineering publicly commented my writing goes beyond cartoonish demonising, yet couldn't cite a single technical error in my analysis. He can now report all of my posts about Palantir as AI slop.

Weaponising "AI slop" flags gives coordinated networks a fast track to silence accurate technical reporting they can't logically disprove.

This isn't available to everyone, but I can confirm it's available to me.

Note to new readers: I expose state surveillance, corporate power, and cybercrime by naming the companies, agencies, and leaders involved. Published my first newsletter at AOL in 1996. My LinkedIn posts rank in the top 0.5% for readership and engagement, leading to 3 account restrictions for naming powerful entities. I created this Substack at reader request.

I publish 3 to 10 dispatches weekly to this web archive. Email subscribers receive 1 weekly digest to keep inboxes clean.

Create a free account or download the Substack app to get real-time push alerts for every post, access the searchable archive, and comment under your real name or a pseudonym.

Add what you know: If you have an insight, a correction, or an additional signal, leave a comment. You can participate under your real name or a pseudonym.

Meta's smart glasses could be banned in Germany. Hamburg's Data Protection Commissioner Thomas Fuchs found that secretly filming people in public breaks EU privacy law. It shows that individual countries will act on their own when the lead EU regulator is too tied to big tech to enforce the rules.

Hamburg's Data Protection Commission isn't waiting for a full market ban. It's already fining Meta's customers who record without consent, while Germany's Federal Network Agency reviews a nationwide ban on sales and possession.

With Meta holding 82% of the smart glasses market and shipping over 7M units, this decision sets a major precedent for Europe. France's privacy regulator CNIL - Commission Nationale de l'Informatique et des Libertés issued similar warnings, and the European Data Protection Board is preparing a unified report on wearable cameras.

Meta has already shown how much it cares about privacy when it comes to their smart glasses. In June, WIRED found hidden facial recognition code, internally called NameTag, that could identify strangers by their face, built into the Meta AI app on 50 million phones. An internal memo reported by the The New York Times showed Meta planned to switch it on while privacy advocates were distracted. One day after WIRED exposed it, Meta stripped the code out, and refused to say whether it would return.

Ireland currently holds the EU presidency, putting its regulatory track record under a magnifying glass. Under GDPR, the Data Protection Commission Ireland is Meta's main EU regulator because the company's European HQ is in Dublin. In late 2025, Ireland appointed Niamh Sweeney as a Data Protection Commissioner, following her 6 years as a senior public policy lobbyist for Facebook Ireland and WhatsApp across EMEA. This revolving door appointment reinforces concerns across Europe that Irish enforcement is overly lenient.

The €1.2B GDPR fine imposed on Meta in 2023 highlights this divide. Ireland's regulator originally proposed not to fine Meta, calling financial penalties disproportionate. Regulators in Germany, France, and Spain objected, forcing the European Data Protection Board to overrule Dublin and order the €1.2B penalty.

Ireland's reluctance to hold tech companies accountable comes down to tax reliance. Just 3 multinational firms contribute €13B in Irish corporate tax, representing 46% of the national corporate tax receipts, while foreign multinationals account for nearly 80% of all corporate tax collected in Ireland.

Thomas Fuchs and German regulators are taking independent action as a direct result. Expect more EU member states to bypass lead regulators and use local laws to protect public privacy when single economies become too dependent on big tech revenue.

Note to new readers: I expose state surveillance, corporate power, and cybercrime by naming the companies, agencies, and leaders involved. Published my first newsletter at AOL in 1996. My LinkedIn posts rank in the top 0.5% for readership and engagement, leading to 3 account restrictions for naming powerful entities. I created this Substack at reader request.

I publish 3 to 10 dispatches weekly to this web archive. Email subscribers receive 1 weekly digest to keep inboxes clean.

Create a free account or download the Substack app to get real-time push alerts for every post, access the searchable archive, and comment under your real name or a pseudonym.

Join the Discussion

Add what you know: If you have an insight, a correction, or an additional signal, leave a comment. You can participate under your real name or a pseudonym.