The PCS telephone number you've dialed is temporarily not in service.
Message 116-3.
The telephone keeps ringing, so I ripped it off the wall.
I cut myself while shaving, now I can't make a cough.
We couldn't get much worse, but if they could, they would.
Bum Diddly Bum, for the best, it's back the worst.
I hope that's understood.
Bum Diddly Bum!
Bum Diddly Bum.
Bum Diddly Bum.
And a very good evening to everybody.
The program is Off the Hook.
Emmanuel Goldstein here with you on this Wednesday evening, joined tonight by Kyle.
Hello.
Out in Signal Land, we have Rob T. Firefly.
Good evening.
We have Gila.
Good evening.
And we have Alex.
You do.
Good evening.
Well, this has been a fun, eventful week.
All sorts of things happening, obviously, throughout the world.
And we're going to try and give our perspective on the technological developments and where hackers fit in and all that.
You know, there's something that has been talked about increasingly over the past few months.
And that is all this age verification that all of a sudden we're obsessed with.
It's starting to become of concern, I think, to those of us that care about privacy and First Amendment rights and things like that.
And, you know, at least one of us is a parent here, so, you know, let's get some perspective on that.
But I'm seeing more and more pushback to all of this age verification obsession that is basically hitting us.
And a bunch of academics about a week ago said that governments should stop their plans to roll out all these age checks on online services until the privacy and security concerns are addressed.
The warning comes as countries around the world, and it's happening everywhere, move to bar children from social media, which requires some way of checking users' ages to decide if they can access online services.
In an open letter, 371 security and privacy academics across 29 countries said that technologies being rolled out are not effective and carry significant risks.
Now, companies, including OpenAI, Roblox, I believe I said that right?
Roblox.
Roblox.
I don't know how to pronounce the new words.
I'm sorry.
And Discord, implement age checks in anticipation of being obliged to the signatories.
Oh, I'm sorry.
I read that wrong.
In anticipation of being obliged to.
Didn't see the comma.
The signatories said it is dangerous and socially unacceptable to introduce a large-scale access control mechanism
without a clear understanding of the implications for security, privacy, and people's freedom and autonomy.
They're calling instead for a global pause until the scientific consensus settles on the benefits and harms that age assurance technologies can bring and on the technical feasibility.
Now, France is planning to ban kids under 15 from social media as soon as September, while Germany, Denmark, and Spain are also accelerating efforts.
Australia became the first country in the world to introduce a ban in December 2025.
So, if you're talking to a kid under 15 in Australia, they're either very smart or, I don't know, I don't exactly know how they're getting around it.
But, many leaders have expressed support on the basis it would protect children's physical and mental health.
But, countries have yet to decide how bans will be implemented or enforced.
We share the concerns about the negative effects that exposure to harmful content online has on children.
And, the academics, right?
But, current plans would require all users, minors and adults, to prove their age, to converse with friends and family,
confirm their age to read news, confirm their age to search for information.
I mean, you know, you start adding this up and all of a sudden, anonymity is no longer a thing.
A robust age verification system would require checking government-issued IDs with strong cryptographic protection for every single interaction with the service.
That's according to the academics.
Such infrastructure is not only hard to build and maintain on a global scale, but would add friction in services, meaning many providers would simply refuse to install age checks.
And, using technologies like cryptography to sign the problem, risks centralizing tools in the hands of the few companies that can deploy them at scale.
And, they also warn of the risks that governments would ban virtual private networks to stop people from getting around age bans.
And, BPNs, as we know, are frequently used by people looking to protect their identities from authoritarian regimes, as we're becoming more and more familiar with.
All right.
So, you know, this is something that is definitely of concern.
Of course, we want to protect children from harm of any sort.
But, at what stage does that outweigh our rights as individuals to communicate freely?
Who would like to begin?
Go ahead, Alex.
Yeah, sure.
I mean, I think, you know, like any good lawyer, I could argue both sides on this, right?
I mean, from a child safety perspective, you know, some reduction in access to content that's very clearly harmful is definitely positive here, right?
But then the downside to that is, well, kids are very easily routed around this, right?
I mean, they know how to get around this.
These protections are extremely leaky.
They're easy to navigate around.
And then, therefore, they're ineffective and the risks still remain, right?
It gives lawmakers, on the other hand, something to latch on to and say, hey, we're doing something to protect children here, even though if it is completely form over substance, as we know.
And I've come into contact with these age verification laws during my travels around the world.
The more places I go, the more times I see these age verification requirements popping up.
And it's interesting to see jurisdiction from jurisdiction.
I mean, and going back to the pros and cons here, I think, you know, parents, and as a parent, it's important to have some kind of safety tool to steer kids away from some spaces.
But those same safety tools can then disproportionately block access for marginalized communities to have access to these types of sites and networks.
So I think there's a way around this.
You know, if the issue is harmful content, and it depends on the context here, but if we're talking about, let's say, social media sites,
you know, I'm constantly seeing advertisements now on Instagram for teen accounts for Instagram, which, coincidentally, I'm about to have a teenager.
So it's really weird to see all these ads popping up for Instagram.
I absolutely do not want my 12 about to be 13-year-old on Instagram, though.
But if we're talking about the addictiveness and the harmful content associated with social media sites, well, there's an easy fix for that.
Why don't we just tame the addictiveness?
Why don't we limit things like infinite scrolling and these reels that automatically play and limit the amount of casino-style notifications that are dopamine-inducing for these kids and get them addicted?
So I think there are design flaws.
Well, maybe they're not flaws at all.
These are design components to ensure addictiveness and ensure that our teens and our young people get addicted to these particular social media sites
and then become the new products, the new generation of surveillance capitalism.
Why don't we tame that before we institute age verification laws across the board?
You know, I think you've hit upon something here because they are indeed design flaws for individuals,
for people that want to think and not get distracted and not get lured into the next post
and spend all of their time just following what somebody is saying and getting lured into all kinds of arguments and hatefulness and things like that.
It's a design flaw for people, but it's a design feature for these companies
because that is how they get people to stay on their sites forever and get more and more involved in what is being said,
what is being peddled to them.
So I think that is the key right there.
If social media behavior that they encourage is seen as the problem, not the age,
because there are very insightful 12-year-olds out there, as I'm sure you know, having one,
that can be part of a conversation or something online.
We're talking about operating systems that will require age verification.
I mean, how do you even justify that, saying you can't configure a Linux machine unless you're a minimum age?
It's not like drinking alcohol.
It's something that really can be extremely beneficial to a child.
And basically closing them out of that is, I think, a lot more harmful than it is good.
But the social media networks, you know, it's bad for grown-ups as well as kids.
What are we doing for the grown-ups that are basically facing the same problems?
You know, I think all these congressional hearings that they have occasionally
where they, you know, drag somebody running, you know, running Facebook or Twitter or whatever
and ask them hard questions and then they just go back and keep doing it.
They need to actually have people who know what they're talking about ask them these questions
and say, look, do it this way and that lessens the problem on children, on adults,
and we don't have to talk about something so draconian as requiring government ID to use the internet.
Rob, go ahead.
Yeah, this all bears thinking about, I mean, not all of us here are parents,
but I think all of us here remember being children, tinkering with technology and things.
And it's pretty safe to say that one thing that does not stop a curious kid from looking at something,
obtaining something, messing with something is being told you're not allowed to.
But the sheer volume of kids who are doing terribly clever things to get around the age verification tools
that are out there continues to entertain me.
But you touched on something that I'm finding really scary about all this,
and that's that these rules are being extended to software providers,
including operating system vendors, including things like distributions of Linux,
a free and open source operating system for computers.
And people, the general population, are used to things like Windows or Apple's OS
where you create an account and you're already tied to this commercial entity
and you're doing things that require they know you're an adult or at least know what age you are.
And you try and apply that same rule to something like Linux
where people just download and circulate the software freely.
And a lot of Linux projects are becoming very concerned with what they're going to have to do
to verify anything about their users when that's simply never been a factor in the past.
And the operating system is not objectionable content.
It is not adult content or kid content.
It is the basic software required to use your computer to do anything.
And so the rules are very sort of vague and wide-ranging and put into law
without any real concern or understanding for the technological realities
beyond what it is they want to do.
Kyle?
I will say that I've actually had a lot of conversations.
Anyone who has older adults in their lives, aging parents, that kind of thing,
they have brought up and I find many different people, a lot of cross-sections of life
are talking about and thinking about more consciously their amount of time using a lot of these platforms.
And they really are not the same type of blog platform that the early web people might have experienced
in the early web.
They're much, much different.
And I think people who have been using the internet a long time and so on and so forth,
as this conversation has emerged with younger adults and the harmful effects of some of these things,
older adults as well, and I'm really glad that that was pointed out in this conversation,
are really thinking about how they spend time online.
And it's, I think, as important that we talk about how we're all using,
and the behaviors, how we're all using these devices and these social media platforms,
what we're saying, of course, but also how much of our daily life is being consumed by it
and the types of messaging that we're ingesting consciously and subconsciously.
And that topic of conversation is incredibly important, especially as we age.
And I think if it doesn't make sense to regulate an older age limit,
it probably shouldn't be the same way on the younger spectrum,
especially when people are starting to use tools to read and to write.
And computing power can enable that to an incredible degree with all we have now at our fingertips.
So could you just imagine, and I think it's silly, but could you imagine,
okay, we have an age restriction.
You can't actually install Linux if you're older than a certain age.
Oh, wow.
Yeah, you're cut off.
And you can't join the social media platform.
You can't talk about anything.
You can't post.
You can't comment after another period of time where you're just, you're aged out.
You're not allowed on the network.
Can you imagine how absurd that sounds?
Careful, Kyle, because Congress people do listen to this show and they might get ideas.
Well, maybe it's applicable to them.
Oh, to them, yes.
Okay, Congress, stay away.
Go ahead, Alex.
I love the idea of having an age ceiling on installing Linux, though.
I just think that's absolutely hilarious, Kyle.
I want to go back to what Rob said, though, as you mentioned, that he doesn't have children.
I just want to say, Rob, you know, just don't underestimate yourself.
It's amazing what a man can create in three or four minutes if you do put your mind to it.
Put it that way.
Just, you know, kind of amazing.
More seriously, though, I do think there is some low-hanging fruit here when it comes to protecting children, though, because we know how they're harmed, right?
Like it's the same pattern over and over and over again.
So you can have really risk-based regulation of these platforms if we think about it.
I mean, I don't even think you have to think about it, like, too deeply, right?
If the law was focused on things like the most harmful features of social media, like getting direct messages from strangers, going live on various things, taking selfies, nude selfies of yourself and sending them over to strangers.
And also micro-targeting ads to kids.
I don't know if you guys remember, but several years ago, during one of the midterm election cycles, when we were spending a lot of time in Pennsylvania, one of my children came over to me and said, you know, Daddy, is this true?
You know, if so, if this Democrat is elected in Congress in Pennsylvania, are they going to really release everybody from prison?
I said, what the hell are you talking about?
And it turns out they were getting these micro-targeted ads on YouTube kids or politics, which was just to me unbelievably inappropriate and unethical to target these things, these political ads at kids.
And maybe it was accidental, maybe it was unintentional, or maybe it was deliberate in the sense that they're hoping that there's an adult in the room that would hear these advertisements when they came on during kids' YouTube.
That type of stuff is horrible.
That's the type of stuff that, to my mind, is the low-hanging fruit for regulation.
And we can actually have substance over form if we think about these things even minimally.
I have an idea.
What if social media sites are forbidden from running advertisements?
Would that not get all the billionaires out of the business?
And maybe we'd actually have some conversation between people?
Go ahead, Gila.
I mean, we would, but in the world we're in right now, if you can't monetize it, then what is the point?
And the other thing that I was thinking about was what Kyle was saying in terms of kids reading and writing and what that can...
I remember being four years old and typing out things on our home computer and spending hours playing computer games with my cousin.
We did really well on Where in the USA is Carmen Sandiego one summer.
And the whole idea of where does it extend to, and it's not just going to be about social networks.
It's going to be about operating systems.
And because everything in the house is becoming a smart item, we were notified on Mastodon, actually, just a little bit ago, that the California law can also affect refrigerators and calculators.
If you have to age verify to get a snack, I think we have kind of overstepped into a bit of a nanny state situation.
I kind of want to see that happen just to see how that plays out.
Oh, my God.
Okay, so clearly this is the wrong path to be going down.
I mean, I think anyone intelligent can see that.
Left, right, you name it, this is not something that serves us.
But there is a problem.
There is a big problem with the way we communicate these days.
And, you know, Alex, you pointed it out earlier, just the annoying ways that they get you to engage.
For me, it's, you know, as someone who's older, it's almost impossible to figure out how to find, you know, if I'm on, occasionally I look at Facebook.
I don't go on there on a regular basis, and I'm not going to.
But occasionally I go on there, and I'm looking for something because someone says that you're tagged, I can never find it.
Or I'm reading something, and the page refreshes, and it's gone, and I can never find it again.
Things like that, it just makes you all jittery.
And I guess that's how they want you.
But it's unhealthy.
I know it's unhealthy.
I feel it's unhealthy.
Other people must feel this as well.
And I think if we just maybe introduce some standards and some basic requirements that prevent people from falling victim to the crass commercialization of these social media networks, that might do more good than any age verification could.
Because I really don't see how shutting out a whole category of people who might well have something to contribute serves anybody.
Rob?
And this whole concept of crass commercialization is, I think, a major factor in this sort of thing.
Because in this current age in which the technological media environment is full of all these huge companies trying to push people away from even nominally owning anything,
your data is in the cloud.
It's on someone else's machine.
The video games you're playing are streamed from the cloud.
The, you know, your very identity is tied to so much of what you're doing back and forth over the internet.
And, you know, when the basic, I think the biggest threat to that sort of thing is, like, putting Linux on a computer and just using it for what you want to do,
not necessarily having to connect to the greater net with it.
I think this sort of plays into that.
Let's make it more difficult to actually own and control your own things.
Let's run everything you're doing through these massive monoliths.
And, you know, this think of the children aspect, I think, is just pushing governments and such toward that.
Well, it's scary.
And to think that a country like Australia already has implemented something like this.
I just, has anyone heard how it's going down there?
No?
We have no idea what's happening in Australia.
Okay.
Well, if you're from Australia, please write to us, OTH at 2600.com.
We want to hear how that's working out for you.
It just seems like a really bad idea.
You know, here's a site that we just found called agelesslinux.org.
This is really kind of fun because they have the right attitude, I think.
They're just listing all kinds of hardware, software.
I'm just going to read you some excerpts here.
The pamphlet, minimum viable violation, a bootable Linux device with a display network connectivity and an app store.
No battery, no keyboard, just proof that this constitutes a regulated device under AB1043.
Good for bulk handout at conferences.
I'm not exactly sure what it is I'm describing here.
But here's something else.
This is, I believe, a micro SD cable.
Legal status arguable.
No, I think this is an actual computer.
The 128 by 64 display introduces fuzziness.
The AG could claim it's a dev board.
That's fine.
Ambiguity is instructive, too.
How about this?
This is a computer with a color display, keyboard, Wi-Fi, Linux, and an app store.
It does not collect age data.
It is handed to a child.
The maximum fine is $7,500.
Or a self-contained battery-powered pocket Linux computer.
The educational device Angle, a modern descendant of the Acorn BBC Micro and the original Raspberry Pi.
Or a pocket computer with a color screen, keyboard, battery, Wi-Fi, 8 gigabytes of storage, and an AI accelerator.
Costs less than a large pizza, and it fits in a child's hand.
I don't know exactly what they're doing here, but they've got the right spirit.
I can tell.
AgelessLinux.org.
See if you can figure it out.
But we're going to have more and more conversations about this sort of thing, and it's going to really involve all of us.
It is.
And, you know, I think the best thing we can do is to just keep playing with these things.
I mean, this Ageless Linux project is incredibly entertaining, even to just read the site and what they're doing.
But, yeah, I'm curious to get hold of one of these now.
And, yeah, this is the sort of reaction I want to see.
I want to see things that call out, you know, people making bad decisions on what they're doing and having some fun at their expense.
You have to challenge them.
You have to challenge bad laws, bad ideas.
You have to show the absurdity.
Kyle, go ahead.
I love this idea of not having ads in certain parts of the web.
I mean, I think that commercializing everything and monetizing everything, that speaks to a broader sense of maybe consumerism itself becoming out of control and just in too many aspects of people's life or the marketplace or however you look at it.
And I'm not saying that that's not something we should have at all.
This isn't like anti-ads.
Like, yes, okay, sharing that, you know, good or service is available is an important part of our economy.
Right.
I'm anti-ad.
But the sites where we're socializing and creating individual content don't necessarily cost so much that we can't support the infrastructure of them hosting or whatever it costs and whatever hassle it is to not have those kinds.
Not to base it around a model that's not in your control, which is a big part of this, but also that requires some sort of advertising from a third party.
That's something we're, we're, we've been conditioned to accept and it's not necessarily requisite for us to have a thriving discourse on private platforms.
We've talked about federated systems and even as I was talking about a little bit earlier, the blogs of yesteryear, yes, the old web, as we might talk about it, they, and, and even early host hosted sites didn't really have a lot, maybe banner ads, I guess.
And that, of course, blocking battles ensued, but there are ways of creating your own webpage and stuff like that without, if you can afford, and, and, and I would say it's remarkably more available as far as different types of ways to host your own website.
And, um, it's worth taking a look at if you want to model this.
And that's my last point, uh, just in observing our conversation here is we can also, um, call out, but model good behavior.
Like let's model, like show off, show examples of like, yeah, this is a cool way to do it.
This is how I do it and be playful and have fun with it.
Um, and I think that's a really good thing because the conversation often is like, well, it's this bad thing, this evil thing of advertising or being a self promoter.
Trying to come up with your own individual brand while, uh, you know, and being endorsed and all that, like kind of social, social media climbing where you've kind of, um, lauded.
It doesn't have to be that way.
And boom, here's an example of somebody that's kind of carved out their own niche.
They run their own stuff.
They, they do it in a unique and interesting way and, and are open about it.
There's plenty and plenty of examples and we can be playful and model that and show people like, this is another way to use the,
the network and the tools and the services that we have online.
Yeah, I, I think you raise some really good points there, but the whole concept of monetization, I just think is unhealthy as the goal.
And I think way too many of us focus on that.
I mean, look at us.
We are on a radio station that has no commercials.
We, we, we put out a magazine that has no ads.
We, we help out with a conference that encourages people to speak their minds and, and, and not advertise things.
Uh, you know, that is our, that is our, our life.
We're used to that.
Uh, and we believe that that's how you have good communication and, and the people who communicate with us seem to bear that out.
Uh, but there are other entities that have so many more listeners, so many more readers, so many more, uh, huge numbers, and they're making tons of money.
Uh, and, uh, that's what's driving them.
But I honestly think that the conversations we have here in WBAI and, and throughout all the other, uh, areas that we're involved with, uh, I think those are better conversations.
And I think that, you know, when you take away the whole monetization aspect of it, uh, you get more sincerity.
Unfortunately, that doesn't appeal to the people that are into the latest fad and, and whatever else, um, uh, it is driving whatever YouTube channel you're watching.
Uh, I just think that is part of the problem because people are thinking about, um, uh, being an influencer and what they can say and do to be trending.
And it's not really, it's not really soul searching.
It's not really, um, um, thinking, uh, outside the box.
Uh, it's not really expanding who you are as a person.
Some of it's quite good.
Some of it is interesting, but when monetization is the goal is, is, is the main aspect of it all.
It's no better than commercial TV where it's just about selling advertisements and not about content.
True content shouldn't require advertising.
The content should speak for itself.
And I think a lot of us are afraid to let the content speak for itself because of what it might say, what it might say about us, what it might say.
We, to, to other people out there who might object.
And, you know, we get that all the time.
People are always upset at us for, for saying one thing or another.
Uh, in fact, you know, I think we, uh, did we get a letter today?
Um, yeah, here's a letter that we just got today.
I'm not going to, I'm not going to read the, uh, the name.
I'm doing you a favor.
Believe me.
Uh, please stop crying about Trump.
No one cares.
Well, I've got some bad news for you, sunshine.
Trump isn't well.
He's going straight to hell.
And if anybody else wants to finish it, go ahead.
But, but, you know, we talk about things that are happening and we're not going to ignore what's happening.
And, uh, you know, maybe that loses us some listeners.
Fine.
But, you know, it's, um, it's, it's, it's something that needs to be addressed.
And when something is happening right in front of you, and we've had things happen right in front of us at this radio show that we felt compelled to report on.
Um, you know, we're not going to ignore it, uh, because that is part of the whole experience.
And I think that should extend to social media.
That should extend, uh, to YouTube channels, to whatever it is that you're expressing.
And we shouldn't be so obsessed with how much money we're making or how we monetize this or what ads go where.
Or God forbid we piss off Google or Facebook and, and, and get banned in one way or another.
Um, we are the ones in control and we have to maintain that control and never give that away to advertisers, to, uh, to, to massive tech companies, to governments, uh, to intimidating people, um, to, to, to pissed off Trump followers.
We want you to stop talking about all the things that are wrong these days.
Um, basically we need individuals to be out there.
I think that's the solution to this whole thing was individuals being individuals.
Rob also, I've, I've been told on many occasions that nobody cares about something or other.
I don't think they've even once been correct in that, in that, uh, assessment.
No, the people who, uh, who say nobody cares are the people who care the most, uh, about looking bad or about somebody they like looking bad.
Uh, because, uh, yeah, obviously if things aren't going well, they want you to shut up and not bring attention to it.
I I've heard it a million times, Alex.
I mean, I, I wonder, uh, I, I saw that email and I wonder about the, the listener that wrote it in.
And would they be complaining if we were talking about Biden, if we were talking about Clinton, if we were talking about Janet Reno, we go back to our shows.
You know, we talked about all of them just as critically as well, but we're in this weird situation right now where the controller of the surveillance state apparatus happens to be somebody acting like the bastard operator from hell.
I mean, I mean, I even wrote an article about this, about Trump basically centralizing powers unto himself and acting like an evil sysadmin, you know, the, and, and those of you who don't know who the bastard operator from hell is, he's kind of a nineties text file.
Um, I don't know, Rob, how would you describe it as kind of like a nineties text file extraordinaire?
I mean, there were all these tales, you go ahead.
You probably know more about this than I do.
Yeah, no, it's, it's pretty much, as you were saying this, it was almost a mythical figure and these adventures and crazy things that were happening to this person, almost a literary figure, like, like Zorro or Robin Hood.
Yeah, totally.
And, and what he always did was, you know, he, he undermined everybody around him, threw people under the bus, he manipulated people and he was constantly centralizing powers unto himself and abusing the systems around him for his own personal gain.
I mean, that's what we have happening right now to our government.
So of course, we're going to have to talk about it.
It would be negligent if we didn't.
And, um, I think we always try and tie it to our main interest of technology and liberty and freedom of speech, uh, anonymity, consumer rights, all of that.
It's, it's all related.
And you may not like the conclusions.
You may not like the questions.
You may not like the criticism, but it's part of the dialogue.
And, um, you know, we welcome people to be a part of that dialogue as well.
We don't care about advertisers because we don't have any, we don't care about influencers because we're not influencers.
We don't claim to be.
And maybe we, uh, only get 60 people on YouTube as opposed to a million people on YouTube.
We don't care.
You know, it's, it's, the dialogue is, is what we are invested in and we're happy to be able to do that.
Go ahead, Alex.
And the other thing to note too, is listen to the archives here, please, because, you know, we're not all singing from the same hymnal, right?
It's not, we're not all of the same exact political persuasion.
We have differing views on lots of different topics and we often get into arguments and debate them.
And yet we continue to be civil with each other.
We continue to be friends and it's totally okay that we disagree on, on many, many different topics on this show.
I mean, over the last 10 years that I've been on here, I mean, I, I can't count the amount of times, Emmanuel, that you and I have gotten into it on various topics.
Yeah, it's probably best not to bring it up.
This is going to get me upset.
And we're still, you know, very, very close friends, the best of friends.
And I've, you know, I think that's something to be said for that.
I think it's, it's very symbolic.
And I, and I think should be, you know, used as an exemplar for how people should respect each other and respectfully disagree with each other.
So, you know, we are going to continue talking about Trump.
We'll talk about all the other politicians that we think in our own personal opinions are doing stupid and idiotic things or things that are wrong.
That's what we're here to do.
And may I say good use of the word hymnal.
You don't hear that one often enough.
No, you don't.
I agree.
Thank you.
Okay, so now we have this situation where a billion identity records have been exposed in an ID verification data leak.
Yeah, you knew this was coming.
A billion identity.
Can you even wrap your brain around that?
We're talking about names, home addresses, date of birth, social security numbers, all of it.
And it may have been sitting on the open internet.
And it's a company called ID Merit, which I think they need to lose the last part of that.
And it's a company that claims to help businesses verify identities.
And they left a billion sensitive records across 26 countries just lying out there.
And if you knew the address, you could just access all of it.
The United States, we're talking about 203 million records left unsecured.
How many people are in the United States?
It's not many more than that, is it?
It's like 300 million, right?
Yeah.
So that's, we're probably, at least a couple of us are probably affected by that.
It involves the exact documents and details companies use to confirm you are really you.
But now anybody can be really you because they have the same information.
You feel more secure now giving out all that information to these companies?
This is what happens inevitably.
Well, so I did get a, your information has been found on the dark web, notice from my bank a couple days ago.
So I think I know why.
But also, very importantly, can the last person in the United States who hasn't yet had their ID leaked in one of these just turn out the lights on the way out?
I don't know anyone who hasn't been ID leaked at this point.
And it's, it's getting to the point where it's not funny, but it's funny because it has to be because this just keeps happening.
And, you know, my alerts on my bank app are like, hey, we found your stuff on the dark web.
We found your stuff on the dark web.
Like 15 notifications going back across a few years.
And they don't say where.
They're just like, hey, dude, it's out there if you want to go look for it.
I'm good.
Mm-hmm.
Yeah, okay.
And like I said, it's inevitable.
If you give out your information to these companies, they will mishandle it at some point.
Which is why I think it's wise to have a public persona and a private persona.
Information you don't mind getting out.
And that's what you give to the companies that demand information.
And information you want to keep to yourself.
And that only is given to people that you genuinely trust.
Sure, accidents can happen with them as well, but not on such a scale as with banks.
A good example.
Back in the day when everybody had a landline, many of us had unlisted phone numbers.
Somehow you'd have to pay the phone company for an unlisted phone number.
I won't get into that.
But at least they didn't give out your phone number.
If somebody called information or looked in the phone book, they wouldn't be able to find your phone number.
However, if you gave that number to a bank, well, not only could they lose it or have it exposed in a data breach of one sort or another, they could sell it.
They could just sell that information to another bank, a credit reporting agency, whatever.
And there's your private phone number, no longer private.
So, you know, your privacy is only as good as the trust of the entities you give it to.
And that has not changed.
It hasn't.
And one thing that my dad did when he was alive, which I'm sure a lot of folks who are listening do or have done, is whenever he signed up for a list, he would tweak his name just a tiny bit.
So then he could track who was selling his information to whom by what tweak appeared on what junk mail, which I kind of loved.
Yeah.
And then, you know, people looking for him won't find him if they use that particular spelling or, yeah, it's just one other degree of privacy.
It's ingenious.
It's only mildly problematic.
He passed away eight years ago, and there's still junk mail for random misspellings of his name arriving at my mom's house.
I have to think he's laughing about that somewhere.
Hope so.
Anyway, researchers at Cyber News, which is a great name, a cybersecurity news and research publication, discovered an exposed MongoDB database on November 11th of last year that they believe belongs to ID Merit, which is a global identity verification provider that serves banks.
FinTech firms and other financial services companies.
ID Merit uses artificial intelligence tools to help businesses perform KYC.
Who knows what KYC means?
Go ahead, Alex.
You got to say it out loud.
Yeah.
I got to give me a second to unmute here.
You know, jeez.
Can I beat him to it?
Why don't you raise your hand after you're on mute?
Can I beat him to it?
You're like the guy at the stoplight.
Don't you even start.
I said it like five times.
As soon as the light turns green.
I will honk my horn.
Yes.
If you're in front of me, I'm going to do it.
Will you say what KYC means?
Unbelievable.
Yeah, I'll take my time.
Thank you.
It's know your customer.
As you can see, the tension between us is just growing by the week.
Yes, you're correct, Alex.
This time you are correct.
That is the identity verification process required when you open financial accounts.
It's like basically, did you live on 8th Street or 10th Street or 12th Street?
You got to pick the right one.
And somehow they know where you used to live or what kind of car you used to have.
So they have all this information if they were able to access that particular bit of data.
The database was not protected by a password.
No password.
Anyone who knew where to look could access it.
Inside were full names, home addresses, postal codes, dates of birth, national ID numbers, phone numbers, email addresses, gender information.
Some records also included telecom-related metadata and internal flags that may have referenced past breaches.
And as I mentioned, they affected people in 26 countries.
The United States had the highest number of exposed records.
Go USA.
More than 203 million.
But coming up behind us, Mexico, Philippines, Germany, Italy, France.
Yeah, researchers notified the company.
The database was secured the following day.
And there is currently no public evidence that criminals downloaded the data.
So maybe we're okay, but we don't know.
And it's that uncertainty, you know?
You never really know.
Alex?
Well, you don't know because the only people in possession of information about whether or not this data was actually accessed or downloaded would be the people that were in charge of actually securing that data.
Because they're the ones that have the log files about whether it was accessed.
But I think we have to assume that a lot of this data probably was accessed.
And if a billion records were out there in the open, whether it were breached or not, I mean, we've also just, I think, gotten past the point now where our identity verification systems are just totally broken.
This is why we have this proliferation of SIM swapping attacks that are hitting people, account takeovers that are easier.
Because just like you said, Emmanuel, these guys are completely in charge of all this information about our personal lives.
They know where we live.
They know where our first address was, what our first car was, et cetera.
So, you know, and they have copies of our driver's licenses now because of all these idiotic age verification and know your customer requirements, supposedly keeping us secure.
They're not.
They're keeping businesses compliant with silly rules.
That's what they're doing most of the time.
But this is why I think this battle over who owns your identity and how we authenticate ourselves is going to come to a head sometime soon.
You know, whether we're going to sign in continually with Google, with Facebook, we're going to use Meta's products, or are we going to do it ourselves?
And this is why I think we need to do it with cryptography.
We need to take back control of our own identity because you can rotate your keys and you can rotate these types of credentials if they're compromised.
You can't rotate your date of birth.
You can't rotate your social security number without extreme hassle, right?
You know, once they're dumped in a breach, you're kind of screwed.
Yeah.
But you can rotate your private cryptographic keys.
And these are the types of things we should think continuously about in terms of how we evolve our notion and understanding of identity.
Well, you know, key in that is making it simple for people who are not technically inclined.
And I think that's the mistake many of us always make is we come up with a great solution, but you have to do all kinds of, you know, jumping through hoops to get it to work properly.
And even those of us who are technically inclined have difficulty and there's complications.
But, you know, imagine explaining it to your grandmother.
If you can't do that, it's not going to work.
So that's what I think we should definitely focus our attention on.
Anyway, I just want to continue making people insecure and uncomfortable by saying that today an Iranian-linked hacking group claimed responsibility for a destructive cyber attack on U.S.-based medical device and services provider Striker, according to messages posted to the group's Telegram channel.
The Michigan-based company, with 56,000 employees and operations in 61 countries, said in a filing with the SEC that the attack caused disruptions and limitations of access to some systems and that the timeline for a full restoration is not yet known.
Staff and contractors said in social media posts that the logo of an Iran-linked hacking group has appeared on the company's login pages.
Wow, hacking groups with logos.
We have no indication of ransomware or malware and believe the incident is contained, the company's spokesperson said.
They tend to say things like that, though.
They did not comment on who may have been behind the attack.
Calls to the company's global headquarters in Portage, Michigan were answered with a recording that said the company is currently experiencing a building emergency.
Wow.
Okay.
Fears have mounted that Iran, which has sophisticated cyber espionage capabilities,
might retaliate against U.S. or Israeli entities after the two countries began bombing it.
Well, who could have thought that would happen?
Wow.
All right.
So there might be some Iranian retaliation using digital access and various companies.
So Striker, S-T-R-Y-K-E-R, U.S.-based medical device and services provider.
It's going to be an interesting next few days, I guess, with that company.
Any thoughts?
Go ahead, Alex.
I think it's interesting that we haven't seen more cyber-related retaliation from Iran in this instance.
You know, and maybe some of it relates to the fact that perhaps a lot of their infrastructure was taken out.
I think the fact that there's an Internet blackout in Iran itself probably contributes to a decrease in this type of cyber retaliation activity that we would ordinarily see.
We know that the Iranian APTs, the advanced persistent threat groups that have been out there, have used some, you know,
I would say less sophisticated means for compromising companies and things like lots of spray and pray types of approaches on things.
I think there are, you know, very sophisticated actors there.
But I do think that there's a risk calculus here that that's involved, because if there was some kind of truly destructive cyber attack against U.S. critical infrastructure,
well, that would risk major escalation.
And I think that they want to stay in the gray zone here.
So I think they're going to use things like wipers, ransomware, extortion against these softer types of commercial targets,
just like we see with Striker, as well as some nuisance DDoS attacks or distributed denial of service attacks.
Maybe some light espionage, some trade secret theft, some business interruption.
But other than that, I don't think we're going to see major escalation, because they know it probably will not go well for them.
Well, I don't know if that line of thinking necessarily holds.
I think, you know, people all over the world might be trying to do various things.
I'm surprised more hasn't happened, as you are as well.
And I'm sure there are more things afoot than we'll find out about.
Here's something, though, that's kind of interesting.
Hackers have reportedly broken into the networks of the FBI Thursday, citing an anonymous source.
CNN reported the breach affected a system used to manage wiretaps and foreign intelligence surveillance warrants.
Yeah, that's kind of a big deal.
The FBI identified and addressed suspicious activities on FBI networks,
and we have leveraged all technical capabilities to respond, said a Bureau of Spokesperson to TechCrunch.
Boy, if the FBI isn't secure, who is?
That is something.
But, of course, considering who's running it these days, I'm not surprised.
Oh, did I get political?
I'm sorry.
Didn't mean to.
Okay, we are out of time, just about.
We are going to continue on Overtime on YouTube, channel 2600, or just go to the link that's on the 2600.com webpage.
I wanted to close with an important news story.
Our good friend and hope keynote, Jello Biafra, you might have heard about this,
was rushed to the hospital over the weekend after suffering a stroke.
The punk rocker reassured fans he's in stable condition and recovering in the hospital.
I still have a lot of great stuff in me, but right now I got a lot of rehabbing to do, he says.
Biafra shared that the stroke, which caused the left side of his body to go completely numb,
was a result of high blood pressure.
It happened when he tried to get out of bed on Saturday night.
My left leg just collapsed under me and I fell to the floor, he said.
I couldn't even break the fall with my left arm because it wasn't working either.
I tried to hop back up again and couldn't.
The fact that he's talking about it, though, is a very good sign.
His record label, Alternative Tentacles, is speaking for the Alternative Tentacles family.
We're all just very thankful he is okay in getting the care that he needs.
As you may know, Jello Biafra was the lead singer and co-founder of the San Francisco punk band
Dead Kennedys from 1978 until when the band split in 1986.
And any current versions of that band are not the same thing, so just remember that.
I hope Jello is improving.
Definitely look forward to hearing from him again.
He has so much to say, so much to do.
And please keep an eye on high blood pressure.
It's important.
It's important to keep an eye on your health.
And that goes for all of us.
All right, we're moving on to Channel 2600 on YouTube at 8 o'clock.
Write to us, OTH at 2600.com.
Let's go out with a Jello Biafra song and wish him the best.
Good night, everyone.
Good night, everyone.
Good night, everyone.
Good night, everyone.
I'm looking at my job, I'm so happy, for going by the day, Monday, baby.
Now it's time to take a break.
Come straight to far or you'll be late.
Thank you for your service and a long career.
Glad you gave us your best years.
Thank you for your service and a long career.
Thank you.