Schneier on Security

Clive Robinson • June 28, 2026 1:42 AM

@ ResearcerZero, ALL,

With regards your point of,

“Mobile phones make excellent listening devices to monitor senior officials.”

Not just “senior officials” or “listening devices”, it’s why I’ve been warning about “Client Side Scanning”, BLE beaconing, and similar and advising people to,

“Change their habits about charging their phones etc.”

Mobile phones are a modern pandemic and whilst the death rate is currently low but rising they are becoming ever more malignant in both direct harms and sequelae (especially for Women and their healthcare).

As I once mentioned on this blog, back several decades ago when mobile phones were still status symbols even though dumb as rocks, they were ruining social time…

I used to go into “the city” in London for drinks in Leadenhall Market and surrounding environs of St Mary Axe (before they were bombed[1]).

Back then the most popular phone was the Nokia range which all had the same ring tone. So there you were having a drink and a laugh when a phone would ring, and it would be like being on a movie set “Gun Fight” with everybody “reaching and drawing them out” at the same time.

But the serious surveillance side started to be realised with the “Ring of Steel”[2].

The monitoring of mobile phones,

1, IDs
2, State such as on charge ring mode
3, Location and fine movement
4, Geo-Track and gross movement
5, What the user receives and sees
6, What the user sends
7, What the user deletes

And much more is now all “known” (or should be assumed to be)[4].

Because it is now all surveilled as standard not just by the Mobile Service providers but “local sensors” in surveillance rings that are increasingly being co-located with CCTV etc. All as part of the extension of the idea of “we kill by meta data” or as others call it “Find, Fix, Finish”.

Thus back in 7/7 the sensors had no user content signatures to look for to provide warning as “Client Side Scanning” was not in place back then as the mobiles did not have the CPU capacity.

Now they do, and C19 gave “permission” for “BLE beaconing” for “contact tracing” as well as “luggage tags” such as Tile, Ring, and Air Tags.

Mobile phones are without doubt a “liability” not just in the “immediate” from the sensors, but in the “habit/social” sense the data builds up.

A “Key indicator of Intent” is the breaking of routine. It was first developed in Bletchly Park in England during WWII and we now call it a subset of “Traffic Analysis”.

Having habits is both good and bad. The Bad is if they “are real” they make you easy to “Finish”… The good is that you are “not your phone” though those doing “Find and Fix” all to often assume you are “joined at the hip”.

Knowing this and thoughtfully considering it makes you a very expensive target for those who want to surveil you as an individual “Person of Interest”.

It’s one of the reasons “guard labour” like the UK’s Metropolitan Police are very very keen on “facial recognition” etc.

The “guard labour” have “Future Plans” they are starting to put into place…

Consider a system of sensors that do various bio-metric and clothing “recognition” continuously. They currently allow human “operators” to follow you “all through town” at their desk. With Facial recognition and other recognition helpers taking it from one or two targets per operator to ten or more at a time.

Now consider replacing human operators with low power AI Agent systems thus thousands can be trivially tracked by a single operator or small specialist team. With the AI spotting “habit breaks” or other signifiers to draw you up the human operators “attention stack” along with a precise change of habit description.

Yes you can with good OpSec beat their systems but it’s getting increasingly difficult. Especially as there are now few to no “tell tales” as the old “on the hoof” operatives could not avoid doing.

Contrary to many peoples beliefs small drones whilst they can be heard and detected and tracked generally necessitate “augmented senses” few of us currently have access to thus some things in the OpSec game have flipped over. Old School advice was “hide in a crowd” coupled with “but track ‘them’ around the block or through the park”… Now nolonger really works the way it did with high flying drones. You need to add such things as “cut under and cover”.

Surprisingly to many the smarter criminals are already ahead on this. Take “youth gangs” for instance they have worked out the changes required for themselves… With “steaming gangs” briefly dropping out of sight swapping hoodies and bags etc. It makes CCTV footage at best “unreliable” and not really useable in court. Another example is they all wear black hoodies under black puffer jackets etc, and they “mill around” such that CCTV footage can not say which one is which. They “mill” in various large shops where they know the CCTV is of little use and by the time they all gather in the target shop they are not identifiable either backwards or forwards in time.

[1] Known as the Baltic Exchange and Bishopsgate bombings of 92/93. The first of which happened just after John Major “won the general election” for the Conservatives.

[2] Both bombings contributed to the formation of the Traffic and Environmental Zone, known as the “Ring of Steel”[3], in the City to supposedly protect it from further terrorism bombing attacks.

[3] But now some call it “The Ring of Surveillance” due to the proliferation of CCTV and other more active sensors. Which unsurprisingly failed in the 2005 “7 7 London Bombings” under Tony Blair’s Labour leadership. The attackers being “clean DNA” just used different methods, not driving vans but public transport and backpacks, and their aim was to kill many, not inflict economic damage. Thus revealing the failings of CCTV surveillance rings as a modern example of “Generals re fighting the last war”.

[4] The Met Police realised the advantage of this in the London / South Croydon / Reves Corner Riots in 2011. The looting gangs were organising themselves via BlackBerry “encrypted” messaging they assumed could not be evesdropped on. However as they were single user not corporate client, BlackBerry controlled the encryption keys and kept backed up messages on their servers. The Met thus could show sufficient “probable cause” to get the paperwork to serve on BlackBerry and retrieve the messages. The publicity resulted in other journalists checking BlackBerry in various authoritarian states such as Saudi, Pakistan, etc. Which had been using them to catch “women” who were not doing as they should do according to religious law. It pretty much destroyed BlackBerry’s reputation and might account for why Apple takes the attitude it does.

Clive Robinson • June 30, 2026 4:40 AM

@ ResearcherZero, ALL,

With regards,

“The State Scientific Research Testing Institute of Military Medicine of the Ministry of Defense of the Russian Federation allegedly tests these chemical warfare agents on humans.”

There is nothing “alleged” about it.

It was well known back in the 1980’s that Russia used non persistent Chemical Warfare Agents on it’s own soldiers during “Military Training Exercises” and acceptable losses were 5% or more (at some points it was said to be 1 in 8).

Like East German troops they were also taught to “shoot their own” to maintain discipline and those attempting to escape.

The military system was split into Officer Class and Others. The others were encouraged to attack each other and brutalise any who showed any weakness. It was the “fast track to promotion” and wealth from stealing and selling off equipment and stores and thus entering “criminal society” that hung onto the military like leaches.

This by the way was an “inherited” military behaviour system from long before the Russian Revolution.

But it is also found in civilian life as well where the Orthodox -east Roman- church still encourages men to be men and beat their wives, families and animals in order to be “true Russians / men of God”.

But it’s also well known that the Soviets did live testing on islands run by the GosNIIOKhT state chemical research institute. Where the “incurable” were used as test subjects for chemical and biological weapons testing. “Incurable” covered all sorts of civilians both domestic and foreign, and it included what might be called the feeble minded, criminals, dissidents, and others who did not want to be just cogs in their system. It is assumed it was still going on upto and including the early part of the invasion of the Ukraine in places like Syria and what is called the Coup Belt Countries in Africa. And that Putin has ordered agents to be produced and stockpiled in greater numbers for use against European Nations in the near future. It is something NATO is quietly taking very seriously.

Apparently one such agent tested on these islands was Novichok, designed to be undetectable to standard Western Testing equipment and methods, therefore a better type of offensive weapon. Apparently they were trying to design it to be extremely lethal to humans, but considerably less so to animals. As one of the big give aways of chemical weapons having being deployed in an area is dead farm and wild life.

How much old school “Development and test” goes on these days on Russians is under question now that Putin encourages families into free flying lessons out of 4th floor or higher buildings, or planes to “fall out of the sky” due to mechanical issues.

There are persistent rumours that Russia “collects DNA” from foreign dignitaries, and the story is that they are trying to develop DNA Specific biological weapons that will take out specific families but not others.

The US Secret Service, has behaved in the past as though this is true and it causes great expense to take preventative measures.

But the one rumour that concerns me is the type of WMD that starts off being effectively harmless but over time decayes down in sunlight or summer heat to become deadly in the food supply etc. Thus it becomes a new variant of the old Roman “salt the fields”.

Clive Robinson • June 30, 2026 9:30 AM

@ ALL,

Some of you might have heard we’ve had a bit of a “record breaking” heat wave in West Europe these past few days

https://europeancorrespondent.com/en/r/recordbreaking-wave

It’s been reported that there have been something over 2000 excess deaths so far reported with more than a thousand in France,

https://www.accuweather.com/en/weather-news/european-heat-wave-death-toll-climbs-as-extreme-temperatures-grip-more-countries/1906434

It is unlikely that will be the end of what the EU regards as “climate change induced” heatwaves, as well as excessive torrential rain fall.

Which is very bad news because many more central EU countries are oil/gas dependent for electricity generation, with Germany reported as having the highest average kWH prices. With the disruption in the Gulf that is still carrying on and oil reserves either depleated or nearly so, the running of AirCon etc is going to be prohibitively expensive even in hospitals.

With Israel now threatening Cyprus and Turkey quite openly the Black Sea is going to become another economic joke point causing yet more world wide hardship and economic destabilisation that will kill thousands of people thousands of miles away. It appears that the Israli citizens will get to vote later this year,

https://en.wikipedia.org/wiki/2026_Israeli_legislative_election

Hopefully they will see some sense in a major political reshuffle / change to get rid of the War-Hawks that are getting the citizens own sons, daughters, grand children and friends killed for no actual benefit.

Clive Robinson • July 2, 2026 12:29 AM

@ ResearcherZero, Bruce, ALL,

With regards,

“The Pentagon is probing Peter Theil’s Dialogue Society data leak.”

In “related news” that first glance appears unrelated,

Trump’s plan to redesign every .gov website leads to AI-designed horrors

A year in, National Design Studio delays plan to update government web standards.

“President Donald Trump’s plan to “fill the digital potholes” and use AI to quickly redesign every government website isn’t going very well.

Last August, Trump created the National Design Studio, or NDS, by executive order. A temporary DOGE-like entity that answers only to the president, NDS was tasked with creating new standards to update the US Web Design System (USWDS) and overhaul 27,000 dot-gov websites in just three years. At the end of this so-called “America by Design” initiative, the government’s “design language” would supposedly be more usable and beautiful, Trump expected.

However, that monumental task—assigned to a small team under a short timeframe—was seemingly made harder by DOGE’s deep cuts to agencies previously responsible for improving government websites, including dismantling the 18F technology unit and restructuring the US Digital Service into DOGE.“

https://arstechnica.com/tech-policy/2026/06/trumps-plan-to-redesign-every-gov-website-leads-to-ai-designed-horrors/

Begs the question,

“But ‘how hard’ did those ‘DOGE’s deep cuts to agencies’ go?”

A little further down the article we see,

“was reduced to one full-time employee after Trump took office.”

The article has a slow build but the results get more and more shocking as they indicate “Fraud/Corruption” and significant “Privacy Invasion / surveillance” and those faces in the current US Executive that have by their own acts become “The Usuall Suspects” hiding under Trump’s self entitled patronage.

Clive Robinson • July 2, 2026 5:59 PM

@ lurker, ALL,

This is in partial support of comments on another thread about,

“Maintaining privacy in an increasingly surveillance polluted environment.”

I mentioned Alphabet/Google were rumoured to be making some low level OS changes. Supposadly due to “proof of age” legislation.

Well aside from the excuses coming from across the pond… One reason may be the highest court in the EU last thursday rejected Googles attempts to have a fine overturned,

EU top court upholds record 4.1 bn euro Google fine

The EU’s top court on Thursday upheld a record 4.1 billion euro ($4.7 billion) fine the bloc slapped on Google for anticompetitive practices related to its Android operating system.

“Google has been trying to overturn a record EU antitrust penalty before the European Court of Justice.

The EU’s top court today Thursday 2 July 2026 upheld a record 4.1 billion euro ($4.7 billion) fine the bloc slapped on Google for anticompetitive practices related to its Android operating system.

The European Court of Justice dismissed the U.S. tech giant’s second attempt to overturn the penalty imposed by the European Commission in 2018—which remains the EU’s highest-ever antitrust fine.

“The Court of Justice dismisses the appeal brought by Google and Alphabet… thereby confirming the penalty imposed on them,” the court said.

Alphabet, Google’s parent company, was found jointly liable for part of the levy.“

https://techxplore.com/news/2026-07-eu-court-bn-euro-google-1.html

The UK “Online Safety Act”(OSA) has proved useful for Apple, Google and Microsoft. In effect it means that there has to be an immutable way for a device to indicate the age of a user, tied back to nationally issued ID…

Thus will almost certainly cause legal “End Run Attacks” against various existing EU legislation to protect consumers from the behaviours of Silicon Valley “big tech”…

The question of interest is,

“Is the Trumper too busy trying to sort out the messes he’s got the US into, and the billions if not trillions of economic wealth that he has caused to be flushed down the crapper to make comment?”

I guess we will have to wait and see, but threats of tariffs are a bit pointless as the EU shows quite a few signs the US is nolonger a “favoured place” the EU really wants to trade with any longer. Due to the uncertainty Trump creates every time he blows off.

Then if course there is “data sovereignty” and similar, not to mention even non tech politicos are making comment about Broadcom and Oracle along with a few other US corps. And the ban on Anthropic Mythos and Fable at the US Executive whim is likewise likely going to cause a change in direction away from US AI.

Business needs both stability and predictability to function. And the US is offering neither.

Clive Robinson • July 3, 2026 1:22 AM

@ ALL,

Why are AI tokens so expensive to use?

Is a question you might get out of more senior management in an organisation. Especially those managers who have used “tokenmaxing” as a –ludicrous[1]– way to measure a real live humans productivity.

Well this video will answer the question,

https://m.youtube.com/watch?v=-0HRzXk8vlk

But the answer will when understood cause a “WTF Moment”.

Within the video it briefly mentions is the Organisational ROI and how quickly it has to “kick in” for the token use to be justifiable.

What the video does not mention is the use of AI as a coding agent even if it works well causes the economic laws of,

“Supply and demand”

To kick in.

Thus whilst the cost of AI rises as the AI companies try to extract maximum return from users… The organisations final product becomes worth considerably less in “return”, in it’s market. Because demand is more than easily met by many organisations within it. So we can expect a rapidly forming downward spiral to start.

Thus “churning out marketing features code” will rapidly loose value.

Those that will get the return from the market, are those who shift their focus up from “cutting code” “by the yard” to first “quality of code”, through to “quality of research and design”.

As I’ve mentioned before what underlies “good engineering” is a “quality process” and,

“Quantity should not be mistaken for Quality.”

The result will be a form of carnage in the markets.

Some larger organisations think the solution to ROI is moving from sales, through leasing, to rental.

But I would caution people to study the “telecommunications industry” as to what will probably happen.

One such is “the only way to get return is through “surveilling the renters” as an alternative revenue stream… But that also suffers from the near zero ROI due to “supply and demand”.

For those old enough to have lived through the forming of the “Fast Moving Consumer Electronics”(FMCE) industry out of the Far East. Which decimated the home radio and TV markets and also killed off most of not just domestic manufacturing but the support infrastructure in the 1960’s through 1980’s there are lessons to be learned. That need to be learned quickly and the current MAGA and other Authoritarian type arguments will be shown to be failures.

It’s why I suggest that organisations see AI as a commodity tool market. That is buy in the hardware and obtain “open weight models” and run AI much like you do any other tool in your “production tool chain”.

It would appear that China is way ahead of the game in this respect.

[1] The person giving the talk, uses the idea of tokenmaxing being about as useful as using “tire wear” as a metric… After all a driver could just “pull donuts in the car park” to get maximum tire wear in minimum time by “going nowhere fast”. We often call this sort of response to a productivity metric “Gamification”.

Clive Robinson • July 3, 2026 6:56 AM

@ Moderator, Bruce,

Bug Report

My above post,

https://www.schneier.com/blog/archives/2026/06/the-chinese-control-the-majority-of-argentinas-squid-fleet.html/#comment-455705

Was on posting indicated as,

“Your comment is being held for moderation and will be reviewed as soon as possible.”

After the reply page to the post had in effect “timed out”.

However the comment was posted.

This is the second time I’ve seen this “behaviour” since the blog software has been updated with the altered “Preview / submit”.

Clive Robinson • July 5, 2026 5:29 PM

Part 5a,

In order to fix this “gap issue” we need a new set of physical laws, which our current understanding says our universe apparently does not offer… So something tells me that is not going to happen any time real soon.

I’ve pointed out almost as long as this blog has existed that you can not trust plaintext on other peoples hardware thus “Cloud is not currently Secure” nor is it going to be as long as “plaintext” has to be processed, stored, or communicated.

Whilst we can currently send and receive –ie out to remote storage and back– ciphertext somewhat securely, that is only because,

“It is data at rest”

We’ve not yet cracked “processing ciphertext”[1] in any way that makes commercial sense.

Clive Robinson • July 7, 2026 3:05 AM

@ lurker,

With regards,

“zombie might be truly undead”

This reminds me of something the Evangelical-nut jobs keep going on about.

In a certain part of the world is Temple Mount, on which sits a large religious building…

Apparently before their Zombie can come back the world has to be cleansed in the blood of a global war, and the religious building will have to be destroyed so the “Third Temple” can be built so their Zombie has somewhere to “hang out”…

The scary thing is the ear these nut jobs keep whispering this nonsense into in theory has his thumb on the “nuclear football”…

Clive Robinson • July 8, 2026 8:37 AM

@ Bruce, ALL,

Orwellian proposal from UK Gov.

This is a form of madness that the various UK Governments have been “boiling the frog” towards for something over a decade.

Which almost certainly means it is not an idea of any elected members of Parliament (actual representatives of the people). But pushed by certain “other parties interests” through the unelected “civil servants” who might well be “feathering their nests” in any number of questionable ways.

Put simply the UK Gov wants to control how Alphabet / Google / YouTube “recommend content” to people thus acting as a Censor on Free Speech,

This is a UK Barristers view point on it,

https://m.youtube.com/watch?v=sFgSzsusIwQ

Oh also the BBC that is nolonger trusted for various reasons including the fact it is now clearly seen as nolonger independent from Government thus “A political Mouth Piece” has a very very significant funding shortfall issue.

Because increasing numbers of people nolonger want to pay the ~$200 ransom called the “Licence Fee” to watch “live Broadcast Television or BBC iPlayer”. Because of their distrust of the BBC.

One proposal the BBC wants the UK Government to bring in, –in the latest funding talks currently in progress– is to “extend from live broadcasts” to what they see as all forms of TV equivalent entertainment. Which would mean all of YouTube and similar would require the UK “Licence Fee”. Which the BBC want to have as a minimum a “Tripple Lock”[1] annual price increase.

[1] The original “triple lock” was brought in back in 2011 by the then government as a commitment to the retired who draw State Pension to protect them from the issues of inflation etc.

The term has become more generalised past pensioners by Corporate Infrastructure providers who nearly every citizen is dependent upon.

What it is, is is fairly simple to state.

At the begining of the financial year (April) the income/price will rise by whichever is greatest,

1, “Consumer Price Index”(CPI) inflation measured in the preceding September.
2, Average earnings growth measured over May to July of the preceding year.
3, or 2.5%.

Clive Robinson • July 10, 2026 6:46 AM

@ Winter,

I’m not sure Enshittification can be either stopped or reversed unless surveillance capitalism increases.

Look at it this way, the cheaper it is for people to post their thoughts… Not just are they more likely to, the basic quality will drop as well (this has already been seen with certain types of social media where being a peroxide blond with lip filler and flaunting a whale tail is apparently all that is needed as a qualification to profundity in others eyes…).

Thus there appears to be little or no limit to “primary dross” for consumption in ML for LLMs to spew out heaping great piles of the less than fragrant steaming stuff.

However at the other end of the quality spectrum surveillance is very clearly having a “chilling effect”.

You will find cyber-security researchers not allowing or even giving their real names or work associations to be used by journalists and similar out of fear of “White House Retaliation”…

Likewise in the UK where the current “lane ducks” are using “think of the children” to push more than Orwellian control onto people.

The latest wheeze is You-Tube being told that the UK –probably via OfCom– will dictate what gets “recommended” or even put in peoples feeds (so no free speech allowed).

Oh and as part of it like an evil spider in the center of a web sits the BBC.

BBC funding is by a “licence fee” and you can not watch “live broadcasts” from anywhere in the world or BBC content on iPlayer over the internet.

People in the UK are so disgusted with the BBC they are leaving in droves and not paying the licence fee any more. The BBC board favoured expanding the need for a licence to cover all forms of TV Like entertainment (so the whole of You-Tube etc). This has caused “out rage” so the suggestion from the Government is a levy on all those who have non industrial basic infrastructure such as electricity, gas or water…

Thus the question arises,

“Why is the UK Gov desperate to save the BBC?”

That is

“What does the Gov get out of it?”

My view based on recent elected UK governments behaviours is that they have turned it into a propaganda service…

Clive Robinson • July 10, 2026 5:22 PM

@ Winter, ALL,

I forgot to add,

https://www.theregister.com/software/2026/05/05/british-mathematician-hands-openclaw-agent-a-credit-card/5228654

Read the penultimate paragraph first and keep it in mind when reading the rest, or more emotively watching the video it is based upon.

Where it is easily possible to feel actual human emotion to “Cass” when she is told she will be “wiped out”,

https://m.youtube.com/watch?v=WnzR5aOElvw