Just as we don't know how to make knives that only cut in beneficial ways, we also don't know how to make computers that only run desirable programs.

Every computer can run every program, including ones that the user doesn't want (viruses), or that the manufacturer doesn't want (ad-blockers). No one knows how to make a computer that is *almost* Turing-complete. There's no such thing as "Turing-complete minus one."

3/

We can't make a computer that only runs the programs the manufacturer has authorized - all we can do is criminalize the act modifying your own computer to do what you tell it to, even if the manufacturer objects:

memex.craphound.com/2012/01/10…

I've devoted a lot of my life to exploring the policy implications of this amazing fact, but that's not the only amazing, exceptional thing about technology.

4/

There's another way in which digital technology has produced something genuinely, civilizationally novel: encryption.

Encryption - scrambling data so that it can only be read by its intended recipient - is an age-old project for both the authorities (who used ciphers to keep their secrets safe since the time of the Caesars) and for those who would overthrow them (revolutionary movements have always used codes to protect themselves from the authorities they sought to dethrone).

5/

But WWII ushered in a new era, in which encryption (and attempts to break it) went digital, as Alan Turing and the codebreakers of Bletchley Park turned themselves to a computer-aided mathematics of scrambling and descrambling. In the decades that followed, a modern form of encryption emerged, one that was powerful beyond the wildest dreams of the Caesars and their revolutionary adversaries.

6/

Modern, computerized encryption can scramble data to the point where it is literally *unscramblable* by an unauthorized party. In the eyeblink moment between you pressing the camera button on your phone and the resulting image being saved to its mass storage, the bits that make up that image are scrambled.

7/

That scrambling is so thorough that even if every hydrogen atom in the universe were made into a computer, and even if all those computers were put to work guessing at the key, we would run out of time and universe before we ran out of keys.

Even futuristic, experimental technologies like quantum computing that may revolutionize codebreaking are also revolutionizing scrambling itself:

signal.org/blog/pqxdh/

8/

Quantum Resistance and the Signal Protocol

The Signal Protocol is a set of cryptographic specifications that provides end-to-end encryption for private communications exchanged daily by billions of people around the world.

^{Signal Messenger}

The history of encryption is seriously fraught. Until the early 1990s, the NSA classed working encryption as a munition and banned civilian access to a whole branch of mathematics. It wasn't until Cindy Cohn - then a lawyer for the Electronic Frontier Foundation, now its executive director - convinced a court that the First Amendment protected the right to publish computer code, that we were all able to gain access to this essential technology.

9/

Today, this safeguards your messages, files, banking transactions, and the software updates for your car's brakes, your pacemaker, and the informatics on airplanes. Cohn has announced her retirement from EFF in 2026, and while she will be sorely missed, we do have her memoir, *Privacy's Defender*, to look forward to:

mitpress.mit.edu/9780262051248…

Book Details - MIT Press

MIT Press - Book Details

^{The MIT Press, Massachusetts Institute of Technology}

The legalization of encryption was a starting gun for the internet itself, as true information security entered the picture and pervaded every part of service design. Every security crisis, every scandal (e.g. Snowden), jolted the effort to encrypt the internet forward, and in this way, much of the internet lurched into a state we can call "encrypted by default."

11/

But even as this privacy-preserving technology was perfected and made ubiquitous, something weird and contradictory happened: mass surveillance *also* took off online. The ad-tech industry - and its handmaidens, the data-broker industry - rigged the game so that our private activities were only encrypted in such a way as to defend *their* privacy, but not ours.

12/

Our data is encrypted in transit to the servers we interact with, and when it is at rest on those servers' mass storage devices, but it is *not* encrypted in a way that prevents companies from data-mining it, or decrypting it and selling it on or giving it away or combining it with surveillance data purchased or traded from others.

This isn't an inevitability: it's a *choice*. The ubiquity of surveillance in the age of encryption is a policy choice.

13/

The reason companies don't encrypt our data so that they can't use it against us is because *they don't have to*. Congress hasn't updated American consumer privacy law since 1988, when they passed a law that prohibits video store clerks from disclosing our VHS rentals:

pluralistic.net/2025/02/20/pri…

Why hasn't Congress updated our privacy rights since *Die Hard* was in theaters?

14/

Because American cops and spies *love* commercial internet surveillance. Tech companies and data brokers are a source of fine-grained, off-the-books, warrantless surveillance data that the American state is totally dependent on. There is no difference between "commercial surveillance" and "government surveillance" - they are a fused symbiote and neither could survive without the other:

pluralistic.net/2021/04/13/pub…

15/

Governments have hated encryption since the Clinton era, and have been attempting to subvert it since computers came in beige boxes and modems screamed in agony every time you tried to look at the internet:

eff.org/deeplinks/2015/04/clip…

It's no mystery why we don't have federal bans on facial recognition - if we did, ICE wouldn't be able to nonconsensually, warrantlessly steal your face and store it for 15 years (at least):

404media.co/you-cant-refuse-to…

16/

On the Clipper Chip's Birthday, Looking Back on Decades of Key Escrow Failures

On this day in 1993, the Clinton White House introduced the Clipper Chip, a plan for building in hardware backdoors to communications technologies.

^{Electronic Frontier Foundation}

404 Media

2025-10-31 13:47:10

You Can't Refuse To Be Scanned by ICE's Facial Recognition App, DHS Document Says

📄
This article was primarily reported using public records requests. We are making it available to all readers as a public service. FOIA reporting can be expensive, please consider subscribing to 404 Media to support this work. Or send us a one time donation via our tip jar here.

Immigration and Customs Enforcement (ICE) does not let people decline to be scanned by its new facial recognition app, which the agency uses to verify a person’s identity and their immigration status, according to an internal Department of Homeland Security (DHS) document obtained by 404 Media. The document also says any face photos taken by the app, called Mobile Fortify, will be stored for 15 years, including those of U.S. citizens.

The document provides new details about the technology behind Mobile Fortify, how the data it collects is processed and stored, and DHS’s rationale for using it. On Wednesday 404 Media reported that both ICE and Customs and Border Protection (CBP) are scanning peoples’ faces in the streets to verify citizenship.

“ICE does not provide the opportunity for individuals to decline or consent to the collection and use of biometric data/photograph collection,” the document, called a Privacy Threshold Analysis (PTA), says. A PTA is a document that DHS creates in the process of deploying new technology or updating existing capabilities. It is supposed to be used by DHS’s internal privacy offices to determine and describe the privacy risks of a certain piece of tech.

“CBP and ICE Privacy are jointly submitting this new mobile app PTA for the ICE Mobile Fortify Mobile App (Mobile Fortify app), a mobile application developed by CBP and made accessible to ICE agents and officers operating in the field,” the document, dated February, reads. 404 Media obtained the document (which you can see here) via a Freedom of Information Act (FOIA) request with CBP.

💡
Do you know anything else about Mobile Fortify or any of the other tools ICE and CBP are using? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.

The document says CBP is supporting ICE as a “technical service provider” to carry out requirements in President Trump’s executive order “Protecting the American People Against Invasion.” After an ICE agent takes a photo of a subject using their work-issued Android or iOS device, the tool queries a wide range of CBP and other databases, including CBP’s Traveler Verification Service. For that system CBP takes photos of peoples’ faces when they enter the U.S. 404 Media previously revealed the app runs images against a bank of 200 million images, then pulls up information such as their name, date of birth, nationality, alien number (a unique identifier the government gives to non-citizens), and whether a judge has ordered they should be deported.

“The photograph shown [...] is the photograph that was taken during the individual’s most recent encounter with CBP, however the matching will be against all pictures CBP may maintain on the individual,” the new document continues. The app can also scan peoples’ fingerprints and provide information based on those, and uploads location data “so ICE can identify where the encounter took place.”

“Although the intended purpose of the Mobile Fortify Application is to identify aliens who are removable from the United States, users may use Mobile Fortify to collect information in identifiable form about individuals regardless of citizenship or immigration status. It is conceivable that a photo taken by an agent using the Mobile Fortify mobile application could be that of someone other than an alien, including U.S. citizens or lawful permanent residents,” the document continues. “ICE agents do not know an individual’s citizenship at the time of initial encounter and will use the Mobile Fortify mobile application to determine or verify the individual's identity, and confirm that they are a match to the Fortify the Border Hotlist.” If a subject’s photo doesn’t match one of those on the hotlist, no additional information will be returned, according to the document.

Even if the photo does not provide a match, “CBP saves the new photographs and fingerprints, taken using Mobile Fortify [...] and retained for 15 years,” the document says. “ICE will take no action on individuals who are not a match to the hotlist, unless operational circumstances indicate other violations of law.”

On Wednesday, ranking member of the House Homeland Security Committee Bennie G. Thompson told 404 Media in a statement that ICE will prioritize the results of the app over birth certificates. “ICE officials have told us that an apparent biometric match by Mobile Fortify is a ‘definitive’ determination of a person’s status and that an ICE officer may ignore evidence of American citizenship—including a birth certificate—if the app says the person is an alien,” he said. “ICE using a mobile biometrics app in ways its developers at CBP never intended or tested is a frightening, repugnant, and unconstitutional attack on Americans’ rights and freedoms.”

The document says that access to the Mobile Fortify app is limited to ICE agents and officers, some CBP administrative users, and “select CBP Officers that are assisting with removal operations.” Since the document’s creation, the government has diverted tens of thousands of officers from their jobs to assist ICE’s Enforcement and Removal Operations (ERO) division, according to data obtained by the Cato Institute. That includes hundreds from various components of CBP, such as Border Patrol.

The Trump administration is making dramatic changes to ICE leadership, with plans to replace senior leaders with officials from Border Patrol, part of CBP, multiple news outlets reported. CBP has been leading the aggressive crackdown in cities like Chicago, including rappelling from Black Hawk helicopters. In response to a video showing Border Patrol commander Gregory Bovino throwing tear gas into a crowd, a judge ordered the official to meet with her daily to provide details on who has been arrested for non-immigration-related reasons.

DHS did not immediately respond to a request for comment.

“By using the Mobile Fortify app to provide real-time responses to biometric queries, ICE officers and agents can reduce the time and effort to identify targets compared to existing manual processes,” the document says.

Judge orders Border Patrol Cmdr. Gregory Bovino to meet with her daily, inform her of non-immigration arrests in Chicago

A federal judge in Chicago has ordered Border Patrol Commander Gregory Bovino to meet with her daily in person after numerous alleged violations of a use of force restraining order.

^{Sabrina Franza (CBS Chicago)}

Why did the EU allow Ireland to facilitate mass surveillance for a decade after the GDPR's passage? Because European authorities *also* hate encryption and say that it is a "totally erroneous perception that it is everyone's civil liberty to communicate on encrypted messaging services":

eff.org/deeplinks/2025/09/chat…

The internet *could* be the most privacy-preserving communications medium in history. Instead, it has ushered in an era of nightmarish surveillance.

17/

Chat Control Is Back on the Menu in the EU. It Still Must Be Stopped

The European Union Council is once again debating its controversial message scanning proposal, aka “Chat Control,” that would lead to the scanning of private conversations of billions of people.

^{Electronic Frontier Foundation}

This isn't a technology problem. It's a *policy* problem. Criminals spy on us online because our governments wanted to spy on us online, so they let corporations spy on us online.

Imagine what the internet would look like today if, in its early regulatory moments, our elected representatives had *demanded* privacy, rather than trying to ban it. Sure, some corporations would have spied on us anyway, and criminals would have done their best to compromise our privacy.

18/

But criminals and rogue firms wouldn't have been able to attract capital to engage in conduct that was likely to give rise to massive fines and criminal prosecutions for violating the privacy laws Congress never bothered to write for us.

Think of it this way: sure, there are e-commerce sites that are just scams, that take your money and never ship you goods. Those sites don't have IPOs, they're not listed on stock exchanges, and they get shut down or blocked.

19/

They exist in the shadows, not in the light. Imagine if that was the kind of commercial surveillance industry we'd gotten: marginal, shadowy, illegal, forever on the run. There would still have been some bad privacy invasions, but these would have been *crimes*, not Harvard Business Review case-studies:

hbs.edu/faculty/Pages/item.asp…

20/

(And before you email me about that one time Paypal closed your account and kept your money or Ebay wouldn't give you a refund, sure, that's right, those things suck, and the companies should face penalties for them, but their *business model* isn't stealing money from their customers; but Google and Meta and Apple's business model is 100% stealing *data* from their customers.)

21/

Instead of treating data theft the way we treat monetary theft, we're now increasingly treating monetary theft like data theft. The legislative formalization of cryptocurrency will now allow companies to steal your money with the same blissful lack of consequence as Google faced for stealing your private information:

citationneeded.news/issue-89/

22/

Issue 89 – Crypto wins in Washington with midnight calls, chocolate bars, and a $141 million threat

Trump stands to profit from a $2 billion bitcoin bet as the crypto industry pushes through bills aimed at bolstering the sector

^{Molly White (Citation Needed)}

We're rounding the corner on a decade of the fight against Big Tech, and the efforts to cut it down to size. These keep foundering on the political economy of crushing an all-powerful monopolist - namely, that it is all-powerful.

You can't tax Big Tech:

canada.ca/en/department-financ…

You can't break it up:

thebignewsletter.com/p/a-judge…

Donald Trump has made it clear that he'd rather let Putin annex Brussels than allow the EU to fine tech companies:

cnn.com/2025/09/05/tech/google…

23/

A Judge Lets Google Get Away with Monopoly

Judge Amit Mehta had a chance to restore some semblance of the rule of law when he handed down a remedy decision in the Google case. He didn't. Google won this round. And Wall Street is rejoicing.

^{Matt Stoller (BIG by Matt Stoller)}

Breakups, taxes and fines are all forms of *redistribution*, which seek to address the harms of monopoly *after* the monopoly has been formed. The failure to make privacy protections as inviolable as financial protections is a missed opportunity for *predistribution*. Bans on data collection, mining, and sale would have prevented these monopolies from forming in the first place. Predistribution is *far* more effective than *redistribution*:

jacobin.com/2025/10/predistrib…

24/

It's amazing to realize that the privacy-invading internet has somehow beaten the encrypted internet. It's crazy that the only entity that will promise to encrypt your data beyond the reach of a data broker, an ad-tech giant, or a government is a *ransomware criminal*, who will also encrypt your data beyond *your* reach:

wired.com/story/state-of-ranso…

25/

It didn't have to be this way. This wasn't a technology failure. It wasn't a commercial failure. It was a policy failure. Since the 1990s, whenever push came to shove, governments decided that they would rather preserve *their* ability to spy on us than keep us safe from *private* spying.

26/

I'm on a tour with my new book, the international bestseller *Enshittification*!

Catch me next in #Miami, #Burbank and #Libson!

Full schedule with dates and links at:

pluralistic.net/tour

27/