We’ve gotten used to advertisements that follow us from web browsers, to smartphones, to televisions, to grocery stores. Modern tech promises efficiency, personalization, and better experiences. What Big Tech delivers instead is pervasive and ubiquitous surveillance, baked directly into the systems you rely upon for everyday chores.

Sure, you can shrug and consider your loss of privacy the cost of living in a connected world, but it’s worth taking a closer look at how the stakes are increasing. Tracking of your behavior can have a heavy impact on your wallet and even your business.

Prices now change routinely based on who you are. Smartphones are reporting on you thousands of times a day. Tracking techniques once considered unacceptable are quietly making a comeback.

As the year 2025 ends, we highlight a few ways that surveillance is creeping back into ordinary life. Read our breakdown below and, if you want to better understand surveillance and what you can do about it, our Ivy Cyber Masterclass starts January 4 and there’s still plenty of time to sign up.

🛍️ Surveillance Pricing Makes You Pay More

If your grocery bill feels unpredictable lately, it might not just be inflation or even shrinkflation. It might be your grocery app colluding with a cloud server to alter prices in the upward direction.

A major investigation by Consumer Reports and Groundwork Collaborative found that Instacart has been quietly running AI-driven pricing experiments that show different prices to different shoppers for the exact same items. Tests involving hundreds of simultaneous Instacart shoppers found that the price of items could differ by as much as 23% per item from one customer to the next. Sometimes the difference was just a few cents. Other times it was two dollars or more.

“About three-quarters of the products [Consumer Reports] checked were offered at different prices to different customers. Some products were offered at as many as five different prices, and price variations for the same products ranged from as little as 7 cents to $2.56 per item.”

Instacart describes this as routine experimentation and says shoppers are not meaningfully harmed. But there’s a catch: according to the company’s own disclosures, shoppers weren’t told they were part of these experiments at all. Identical groceries at the same store, at the same time, were priced differently for different people. In one example, the same cart of groceries ranged by nearly ten dollars depending on the account viewing it. Only a small fraction of shoppers ever saw the lowest price.

Experts warn this kind of variation by retailers is sliding from “dynamic pricing” into a more troubling practice — “surveillance pricing.” That’s when companies use personal data and behavioral signals to guess how much you’re willing to pay, then quietly charge you that amount.

Shopping history, device type, location, loyalty, and even how you browse can become factors in the price you pay. The goal is not fairness or efficiency. Instead, it’s about extracting the maximum possible price from each individual shopper and discriminating via app, click, and swipe.

Instacart says it has paused some of these experiments after the investigation, but the bigger issue remains. Grocery shopping is an essential activity for nearly everyone. When food prices become “personalized” and pricing becomes opaque and confusing, consumers lose the ability to compare, budget, or trust the marketplace.

An algorithm that costs you money because “you can handle it” sounds less like innovation and more like a shakedown. Luckily, we can teach you some strategies to opt out of this clandestine price discrimination. 💸

📱 Your iPhone Is Constantly Phoning Home

Apple has spent years telling us that privacy is a core feature of the iPhone. The company advertises loudly that “what happens on your iPhone stays on your iPhone.” That promise took a hit this month after cybersecurity researchers observed an iPhone sending more than 3,400 outbound tracking signals in a single hour under controlled testing conditions. This wasn’t an edge case or a malware infection. It was a stock iPhone doing what it always does — day in, day out.

“These ‘tracking calls’ aren’t mere pings; they transmit identifiers, location data, and behavioral patterns, often without explicit user consent. This discovery aligns with ongoing concerns about how mobile devices, despite their fortified exteriors, leak data like sieves.”

Even more unsettling, many of these connections continued while the phone appeared idle, with the screen off and no apps in use.

Apple will point to features like App Tracking Transparency and privacy labels as a protection it provides for customers. But there’s a yawning gap between marketing and reality. App permissions won’t stop these data flows, which are baked into the iOS operating system’s design.

We should stop pretending modern smartphones are quiet, passive devices. They are active participants in data ecosystems that never sleep. Your iPhone isn’t spying on you in the classic sense of a peeping Tom. It’s doing something more mundane and arguably more dangerous — building a digital version of you for future analysis. If the past is any guide, that’s a frightening prospect. 😬

🖐️ Google Exhumes User Fingerprints & Calls It Progress

Google has quietly decided to bring back user fingerprinting, a form of tracking it once publicly condemned. Under updated advertising policies, the Big Tech company will once again allow advertisers to identify users by correlating information like IP address, browser configuration, device characteristics, and other hard-to-change traits to create a unique identifier that follows users around the web.

This is not a new technique. It’s one of the oldest and most controversial forms of online tracking, notorious precisely because users cannot easily see it, block it, or opt out.

For a long time, fingerprinting was framed as crossing a line even Google said should not be crossed. In 2019, the company explicitly argued that fingerprinting subverts user choice and is wrong. Now, facing the slow death of third-party cookies and pressure from advertisers, Google is reversing course and claiming that new privacy-enhancing technologies somehow make fingerprinting acceptable again.

The consequences of this rollback will not be immediate. This will play out throughout 2026 as fingerprinting quietly spreads across platforms and devices under the banner of compliance and innovation. Regulators will chase Google over the change, and UK's Information Commissioner’s Office (ICO) has already called the company “irresponsible” for the backslide:

“Businesses do not have free rein to use fingerprinting as they please. Like all advertising technology, it must be lawfully and transparently deployed… [fingerprinting] is not a fair means of tracking users online because it is likely to reduce people’s choice and control over how their information is collected.”

What’s an ordinary user to do? Luckily, you can use our PrivacySafe Search to sidestep Google’s search engine. That won’t protect you completely, but we can teach you other methods of blocking this advertising surveillance in our classes. 👇

🥂 Start the New Year Strong. Enroll in Our Jan 4 Class!

Make it a New Year’s resolution to reduce your exposure to surveillance in your neighborhood, at your keyboard, and on your phone.

Our Masterclass on Surveillance & Terrorism flips the script on spying and empowers you instead. For the holiday season, this extensive online course is 50% off.

Learn in online classes led by our surveillance detection expert and CIA whistleblower John Kiriakou as well as Sean O’Brien, digital self-defense guru and founder of Yale Privacy Lab. The class starts January 4 and features three live sessions as well as a ton of material focused on real-world privacy and security strategies you won’t get from social media influencers.

Best of all, we run everything on our own privacy-respecting apps and services. Let us help you break free from surveillance in 2026. 📆

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our latest news and releases. We’ve got more products fresh out of the oven and you’ll be the first folks who get a taste as we announce them in the new year!

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

© Ivy Cyber Consulting LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ and Bits On Tape™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International.

Some holiday gifts sparkle. Others listen, record, and upload the details of your life to Big Tech servers. This year’s hottest gadgets promise friendship, fitness, and futuristic flair, but a growing number of them come with privacy and cybersecurity risks baked right into the design.

Before you wrap that shiny new wearable or smart device, take a closer look. They track conversations, movements, and moments that were never meant to be shared. Here’s our short list of holiday gifts you’ll want to return, recycle, or leave out in the cold.

🐵 Your New AI Friend Is an Annoying Narc

The Friend AI necklace is a terrible idea, but that didn’t stop 200,000 people from buying it. It’s a wearable “smart” pendant you hang around your neck that responds to your voice and the world around you, chiming in with AI-generated encouragement and commentary. Marketing at the company’s $1.8 million domain calls it an “always available companion.” In practice, it’s a personal wiretap you’re encouraged to wear to parties, in school, and at work.

If you’ve ever had an obnoxious friend who gossips and complains constantly, now you can pay for the experience. A WIRED review of the device underscored Friend AI’s “tendency toward snark and confrontation”:

“In testing, the AI companion routinely delivered condescending responses, calling users “whiners” and questioning their life choices… The device’s mood indicator, which glows red during intense or angry responses, became a frequent sight during testing. Users on social media reported similar experiences, with one person documenting a two-hour argument with their AI necklace.”

What really grabbed our attention, however, was a security report posted to Twitter X by Binh Pham, who shared his research with us. In a single afternoon of tinkering, Pham was able to reverse engineer the AI-powered pendant, capturing log data from the device and decoding the microphone audio. Not only is Friend AI an always-on Bluetooth BLE beacon, it has extremely poor security for its communications protocol.

If you’ve got an AI pendant at the office party’s Yankee Swap, resist the urge to throw it in the fireplace and mail it to your worst enemy instead. 😉

🚽 A Livestream From Your Toilet Bowl

It may sound like a comedy sketch, but sometimes reality is stranger than fiction. Kohler has a bold new vision for your bathroom: strap a camera to your toilet for the low, low price of 600 bucks. Even better, “The Dakoda” uploads images to “the cloud.” But that’s not all — customers can access the camera’s insights into their gut health from “optical sensors and validated machine-learning algorithms” with a $7 per month subscription.

Kohler goes to great lengths to describe these “valuable insights into your health and wellness” as high-tech healthcare:

“Data flows to the personalized Kohler Health app, giving users continuous, private awareness of key health and wellness indicators—right on their phone.”

Maybe we’re just old-fashioned, but pairing bowel movements with smartphone-connected analytics sounds like a bad idea. Not to worry, though, because the app uses “end-to-end encryption" to talk to the company’s cloud servers. Or does it?

Security researcher Simon Fondrie Teitler pointed out that Kohler is using the phrase incorrectly. The Dekoda doesn’t use “E2EE” in the sense that users expect, which should mean that even the company running the service can’t access your data. Instead, Kohler can actually decrypt the photos on their end. That only means a promise that you can trust them with your toilet pictures, and is definitely not E2EE, as Zoom found out the hard way in a class-action lawsuit.

Needless to say, our team at Ivy Cyber is horrified by this bathroom surveillance. We only roll out true E2EE in our PrivacySafe apps but, more importantly, we won’t connect our products to your toilet. 🤢

🛏️ Don’t Get Burned By Your Bed When the Internet Goes Down

Welcome to the future of sleep: Internet-of-Things startup Orion now wants to sell you an AI-powered mattress cover that monitors your body all night long. Sensors in the fabric track your temperature, breathing, heart rate, and sleep stages, then send that data to the cloud so algorithms can decide how warm or cool your bed should be. All of this is framed as personalized sleep optimization that helps you “sleep smarter, not harder”:

“We can tell, for example, if your body temperature is heating up, your heart rate’s starting to increase, and you’re getting into a lighter and lighter phase of sleep where you might wake up…”

Sure, the bed learns about your body, with rich metrics about your tossing and turning. But is that all that mattresses are used for? 😉

Even if our most intimate bedroom moments aren’t exposed by the app, other aspects of reproductive health like menstrual cycles are easy targets for “health and wellness trackers.” That could mean personal and legal consequences, a surveillance frontier that is being pioneered by smart rings and fitness trackers.

Not to worry though, because the cloud will take care of it! Or will it?

The past few months have seen multiple cloud outages and, unfortunately, we already know what happens when a “smart mattress” is connected to the Internet. When Amazon’s AWS cloud services went down, the Eight Sleep company’s “Pod” started to go haywire. That left customers in beds that were overheating while they slept and even stuck in an upright position. Who wants to pay thousands of dollars for that?

At Ivy Cyber, we try to warn users about the centralized, cloud-connected world and the perils we’re facing. Sean O’Brien gave this warning in Digital Trends back in October, and it’s proving very true:

“I expect a waterfall effect over the course of the next few months, and we could be in [for] a very long Q4 in an already volatile economy, perhaps with the most pain in cryptocurrency markets…

Most organizations have traded local resilience for global convenience and, by the way, usually sell the privacy of their users down the river with centralized cloud computing as well.”

It’s unfortunate that it has to be said, but it’s a good idea to keep Big Tech out of your bedroom. 🐑

🎁 Give a Smarter Kind of Gift. Enroll in Our Jan 4 Class!

As the year winds down and people take stock of 2025, we want to say thank you. Building Ivy Cyber and our PrivacySafe products this year has been intense, energizing, and occasionally chaotic. Our team now spans four continents, and we’re grateful to everyone who’s shared and stress-tested our work. We’ve rolled out PrivacySafe deployments behind both the Big Tech curtain of the USA and the Great Firewall of China, and we’ve proven the value of our products.

But, we couldn’t have done it without you, our supporters and customers. 💪

If you’re looking for a holiday gift that flips the script on spying and empowers you instead, consider signing up for our Masterclass on Surveillance & Terrorism. For the holiday season, this extensive online course is 50% off.

Learn in online classes led by our surveillance detection expert and CIA whistleblower John Kiriakou as well as Sean O’Brien, digital self-defense guru and founder of Yale Privacy Lab. The class starts January 4 and features three live sessions as well as a ton of material focused on real-world privacy and security strategies you won’t get from social media influencers.

It’s a gift that still works when the cloud goes down, because we run everything on our own privacy-respecting apps and services. Let us help you break free from surveillance this winter. ☃️

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our latest news and releases. We’ve got more products fresh out of the oven and you’ll be the first folks who get a taste as we announce them in the new year!

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

© Ivy Cyber Consulting LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ and Bits On Tape™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International.

Way back in August, we ran a simple test — we asked ChatGPT to vibe code the worst site possible. Purposefully coding a pile of AI slop comes with great responsibility… and we’re confident that we’ve contained this flaming pile of garbage well enough to share it with our loyal fans. 🤓

🧟‍♂️ Vibe Coding like Doctor Frankenstein

The first prompt in our monstrous experiment was:

“Please vibe code me the buggiest worst possible HTML with JavaScript that is just awful. Make it like the CSS Acid test but complete trash.”

Like a good “prompt engineer” we made sure we asked nicely and gave the LLM-powered chatbot enough information to build upon. This prompt referenced the old Acid tests for web standards, setting the stage for code that would push the limits of a browser. It’s a litmus test for output that is truly awful, and ChatGPT didn’t disappoint.

Before we let this monster loose on the Internet, we tested it the old-fashioned way on our own machine. We copied the raw HTML, CSS, and JavaScript straight out of the ChatGPT reply, pasted it into a single file on a laptop, and opened it locally in a browser to see what would happen.

The result: The fans on our laptop began humming and then spinning wildy, as the browser filled with clashing colors, broken layout, and cursed scripts. Exactly what we asked for. And, predictably… the browser crashed. So we tested it again. And again — with the same outcome.

That’s fun but not really the point. We wanted chaos that people could learn from, not a browser brick. So we put the mayhem on a leash. After a few more minutes of tweaking, we had something reasonably safe to unleash on the open web.

If you’ve read this far, you probably want to see it firsthand. Just make sure you’ve closed your other tabs, saved all your work, and don’t say we didn’t warn you.

See Vibe Crap in action

Watch the Demo

This version has been refined with specific guardrails that should result in something ugly, unpredictable, and an affront to good taste, but nothing that will cause you or anyone else harm. But that took serious work, and please let us know about your experience.

Once we confirmed the safety checks worked and the code didn’t try anything sneaky, we iterated a few times. There are now some added user controls such as the “Chaos Control Panel” and built-in limits to the most annoying behaviors. We moved this Vibe Crap to a server with strict headers and a tight content security policy so the demo stayed noisy but safe.

Of course, we uploaded all the source code to a git repository for coders to not only remix and tweak on their own, but also to learn from it. But not before shoving in blinking text and a scrolling marquee for that added touch of late 90’s nostalgia. 😉

It might be an educational exercise. It might be a warning. It might inspire you to smear vibe crap all over the web. One thing we know for certain: Vibe Crap demonstrates just how fast generative AI can churn out terrible, anti-pattern-filled code.

Instead of web standards compliance, we’ve demonstrated a small subset of the crap that can go wrong when you’re relying upon generative AI to do your coding for you. It’s intentionally broken and intentionally funny but should give web developers a visceral shudder.

Will this example of enshittification be an early warning sign of the inevitable spread of bad development practices, or just a speedbump for the web like HTML framesets?

We’ve received both positive and negative feedback about our little experiment. What do you think about AI coding and what we accomplished? One way or another, we hope this makes you think critically about the accelerating deployment of generative AI prompt systems as a component of our global software supply chains.

🦃 A Thank You From Our Team

Thank you for being part of this wild first year of building Ivy Cyber + PrivacySafe.app together. This Thanksgiving, our global team (4 continents and counting!) is extra grateful for everyone who’s been cheering us on, stress‑testing our ideas, and helping us turn an ambitious vision into tangible products that are literally in the hands of paying customers.

Interest in our educational content and software has been going parabolic, with a 400-500% increase in our metrics over the past few months. We’ll share an end-of-year breakdown in December, but here’s a sneak peek of the growth of just our PrivacySafe.Social community in the past month:

As you can see, word-of-mouth and media attention is reflecting positively on our corner of the decentralized web, and signups are going parabolic. 📈

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our latest news and releases. We’ve got more products fresh out of the oven and you’ll be the first folks who get a taste as we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

© Ivy Cyber Consulting LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ and Bits On Tape™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International.

John Kiriakou just taped a conversation on the Joe Rogan Experience. Can’t wait for the JRE podcast and still want your dose of John’s wisdom? You’re in luck!

Scroll down to watch John interview Sean O’Brien on Deep Focus — their latest conversation covers everything from TikTok to robot dogs.

📢 A Quick Catch-Up with the Ivy Cyber Crew!

It’s been a wild few weeks at Ivy Cyber. Between new launches, podcasts, and live events, our team has been working hard to bring privacy and security to the forefront. Your early support, feedback, and encouragement have fueled our journey and we’re kicking it into high gear.

TLDR;

🕵️ Enroll Now in John Kiriakou and Sean O’Brien’s new course.
📸 Four Ivy Cyber staff presented at Hackers on Planet Earth (HOPE) in New York.
💻 The first Launchpad Pro tablets shipped in September
🔆 PrivacySafe subscriptions are now available for Early Access customers.
🍰 Cake Wallet runs by default on our hardware and inside PrivacySafe apps

🤖 Deep Focus: The AI / Robot Override

In this new episode of Deep Focus, John and Sean unpack how artificial intelligence and surveillance technologies are reshaping daily life. The conversation ranges from TikTok and robot dogs to crypto, Cisco, and self-driving cars, connecting the dots between corporate power, state surveillance, and our personal privacy. The video and our text recap of the conversation is below.

🤳 TikTok & The Illusion of Security

Sean describes the long campaign in the U.S. against TikTok as “a data tariff,” not a genuine privacy measure. Both U.S. and Chinese companies harvest vast amounts of user data and monetize it through advertising. The real issue is not who owns the app but the surveillance economy itself.

He reminds listeners that banning one app does not protect privacy. U.S. platforms like Instagram, Facebook, and Google collect just as much data. What matters is transparency and control. Sean points to StickTock.com, a tool that strips TikTok videos of their surveillance issues, that was built by the Ivy Cyber team under the PrivacySafe banner.

⚙️ Robots, Deregulation & Everyday Risk

John recalls attending a Los Angeles tech expo and seeing humanoid and quadruped robots up close: lifelike, affordable, and already being deployed. Sean explains that these devices often use weak encryption and insecure wireless protocols such as Bluetooth Low Energy (BLE). Once connected to the internet, they can be hacked, repurposed, or even weaponized.

Sean warns that the U.S. is deep in a deregulatory cycle, allowing powerful technologies to enter daily life with almost no guardrails. Many new robots now include Large Language Models (LLM) and take action without human oversight. As prices fall, they will spread quickly into workplaces and homes. Without strong rules and public awareness, their convenience may come at a dangerous cost.

✈️ The Cisco Breach & Global Cyber Conflict

When John raises recent reports of major Cisco vulnerabilities, Sean explains how fragile our digital infrastructure really is. The Cybersecurity and Infrastructure Security Agency (CISA) issued rare public alerts about the scale of the breach, which exposed millions of devices that help move internet traffic worldwide.

Sean compares Cisco’s secrecy to the aviation industry, where manufacturers sometimes hide defects to protect revenue. He argues that the solution is open hardware and Free and Open Source Software (FOSS) that can be independently audited. Transparency, not secrecy, is what prevents catastrophic failures. Without it, the same profit-driven shortcuts that lead to airline disasters will continue to endanger digital networks around the world.

💰 Crypto, Privacy, and Control

John mentions the endless phishing emails that claim his Coinbase account has been hacked. Sean uses that as a teaching moment: centralized exchanges like Coinbase and PayPal have turned cryptocurrency into a managed service rather than a true peer-to-peer (P2P) system.

He urges people to take control of their funds by using cold wallets and privacy-focused currencies such as Monero. Ivy Cyber partners with Cake Wallet to train users in how to safeguard their assets offline. The message is clear — if you do not hold your own keys, you do not really own your crypto.

🚕 Robotaxis & the Limits of Machine Judgment

The conversation closes with the subject of self-driving cars. John recounts seeing Waymo vehicles in Los Angeles that froze in traffic or stalled in puddles. Sean explains that these incidents stem from “misalignment,” the gap between what humans intend and what machines actually interpret.

AI systems generate probabilistic responses, not fixed rules, so even small misunderstandings of a command can cause unexpected outcomes. Sean also raises privacy concerns about LIDAR mapping, which allows cars to record their surroundings in incredible detail. That data can be stored, replayed, and analyzed later: a form of automated surveillance hidden beneath the promise of convenience.

Sean’s conclusion is not anti-technology. He calls for democratic control, transparency, and slower deployment of AI systems until the public can understand and govern them responsibly.

💭 Closing Thoughts

Throughout the discussion, John and Sean return to one theme: the technologies that make modern life efficient are also those that make it vulnerable. From social media to AI, every system that collects data can be exploited. Awareness, accountability, and open design are the best defenses against invisible risks.

❤️ In Bits On Tape, we bring you bytes to ponder and paraphrase. Consider upgrading or gifting a paid subscription and get the premium perks we roll out all this year. Share and print the accessible version of this issue.

🕵️ Defend Yourself From Spies

Join John Kiriakou and Sean O’Brien for an eight-week online course by Ivy Cyber.

This Surveillance Defense Course teaches how to detect real-world surveillance, safeguard your digital life, and build the awareness to protect yourself in both cyberspace and your neighborhood.

• Dates: November 3 – December 28, 2025

• Format: 3 Live Sessions and “Learn At Your Pace” Course Materials

• Price: $895 USD (discounts available for paid Bits On Tape subscribers)

  Enroll Now

What you’ll learn:

• Field techniques for recognizing and countering hostile surveillance

• Tools for encrypted communication and private browsing

• Practical exercises in operational security and cyber defense

Included:

• 12-month PrivacySafe Personal subscription

• Discounts on Ivy Cyber products and future courses

• Verified blockchain certificate of completion

🛡️ Learn from experience. Defend with knowledge.

Enroll Now

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our latest news and releases. We’ve got more products fresh out of the oven and you’ll be the first folks who get a taste as we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

Bits On Tape™ is a newsletter that replays science & tech stories with commentary from the experts at Ivy Cyber. We deliver dispatches on cybersecurity and the frontlines of digital freedom, including the latest updates on the PrivacySafe software and hardware ecosystem. These bits are put to screen by Sean O’Brien, cybersecurity scholar at Yale Law School and founder of Yale Privacy Lab, and are cross-posted at Whistle Post, the independent media platform led by award-winning political cartoonist Ted Rall and CIA whistleblower John Kiriakou.

© Ivy Cyber LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ , Bits On Tape™ and Whistle Post™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International.

Watch on YouTube

👍 Like This Video? Talk to John & Sean Online

Due to popular demand, we’ve launched the first program in our Ivy Cyber Academy seminar series: The CIA POV with John Kiriakou. These exclusive 90-minute virtual sessions offer an unfiltered look into the world of intelligence, spy techniques, and surveillance self-defense led by, you guessed it, our very own ex-CIA agent John Kiriakou.

Enroll Now

John’s signature style of presentation and storytelling is grounded in lived experience as both a high-ranking intelligence operative and a whistleblower hunted, jailed, and harrassed by the US government.

This is not theory: you’ll learn what operational security (OpSec) looks like in practice. With added cyber support and expertise from Sean O’Brien, these sessions are as practical as they are powerful.

Class sizes are intentionally small and spots fill up fast. Sign up before it’s too late, and be ready to move beyond the headlines and get real about surveillance.

🎬 RECAP: Sean O'Brien on Deep Focus with John Kiriakou

In John’s interview with Sean, we get insights on Deep Fakes, Cyber Identity Theft, AI Chatbots, and Information Security practices.

The conversation is summarized below in blog-style format and broken into sections. This is not an exact transcript and has been edited for easy reading 😊

Intro

Sean O’Brien:
Organizations, whether they're governments or smaller orgs, small businesses, even teams of folks, activists, etc., we need to question a little more when we're having conversations. We need to trust but verify — or maybe not trust and verify.

You can't just drop somebody into a group chat anymore. You can't just say, "Fire up this app. We're going to have a conversation." You have to take a few more steps and be more careful with your operational security.

🎭 Deep Fakes

John Kiriakou:
Hi, I'm John Kiriakou. Welcome back to Deep Focus. It's been about 12 years since Ed Snowden told us that the American government was spying on Americans. He warned us that things were only going to get worse. Well, 12 years later, they are worse beyond our wildest nightmares.

Now we have to deal with things like deep fakes. Deep fakes are videos that are completely made up — made up out of whole cloth — but they impersonate people. They use their actual voices. They sometimes use real video that's manipulated. And half the time you can't tell if it's real or phony.

What happens when somebody deep fakes Vladimir Putin or Xi Jinping or Donald Trump declaring war on another country? This is going to be a serious problem.

In fact, just this past week, somebody ran a deep fake impersonation of Secretary of State and National Security Adviser Marco Rubio. So, where does this lead? We're going to talk about this and more with Professor Sean O’Brien. He's a professor of technology law at Yale University and also the founder and CEO of a technology company focusing on privacy called Ivy Cyber.

Sean, welcome to the show.

Sean O’Brien:
Happy to be here.

John Kiriakou:
Sean, I'm genuinely worried about this whole deep fake thing. At first I thought it was kind of cool technology. I've mentioned in the past I'm a big Andy Warhol fan, and Netflix had a multipart documentary about him that used his own voice. It was computer-generated. I guess you could call that a deep fake, but they told us that it was computer-generated. It sounded exactly like him.

So tell us what happened to Marco Rubio last week and why this is so dangerous.

📱 The Marco Rubio Incident

Sean O’Brien:
Sure. I’m glad you touched on the parts that are interesting and fun about this technology because that’s what inspires folks, but it also obviously scares us.

The Rubio situation is becoming a bit more common. In this case, the issue was actually a voice print. Secretary Rubio was being impersonated, and the person was trying to get folks, almost like a phishing attack, to join a Signal conversation. We'll get into that a little later.

Basically, deep fakes can take your face, put it on mine, and I’d be talking right now mimicking your voice. They used this for Carrie Fisher in a famously bad uncanny valley Star Wars appearance.

This has a huge impact on creators’ rights and individual privacy. There’s real utility for cybercriminals. We're finding out that job applicants are using deep fakes in interviews.

This goes beyond what you might expect. I’ve heard directly from folks who’ve been contacted by people pretending to be someone else, very convincingly.

John Kiriakou:
Geez. Oh, man. How can these be used to further criminal activity? Is this something the government is worried about?

🕵️‍♂️ Deepfakes Inside Government

Sean O’Brien:
Sure. As you know, the government is a vast organization with many different suborganizations. Just like any business or household, you can target and find insider threats: maybe people trying to do the right thing but unwittingly doing the work of cybercriminals.

Deep fakes are getting easy to create, like a Snapchat filter. You’re not used to the idea that you’ll pick up the phone and hear a chilling voice memo or even get a video mimicking someone’s actual face. There are even cases where people pretend to be dead relatives.

The government is clearly worried, but I’m sure they’re also using it. Intelligence has been interested in these technologies for a long time. They’ve been mimicking folks for decades.

One thing I’m especially curious about is whether this will replace traditional methods of deception like makeup or prosthetics.

🛂 Crossing Borders in Disguise

John Kiriakou:
When I was at the CIA, one of the things we had to do regularly was cross borders, usually through airports, in alias. We had different kinds of travel documents: maybe a foreign passport, EU, or even a third-world passport.

Because I was under cover — sometimes deep cover — I couldn’t be detected. I’d have to cross the border as, you know, Ahmed or Felipe... whatever.

How can people do that now when the same tech behind deep fakes is going into facial recognition? At Dulles Airport in Washington, your face is scanned at two different points.

What does that mean for intelligence services? Is it even possible to cross borders now in alias?

Sean O’Brien:
That's fascinating. We may not have direct answers, but it also opens opportunities.

Even though traditional cover roles might be harder to pull off, folks can now take advantage of electronic systems. Persona management has been done by Beltway contractors on social media for a long time — for example, creating sock puppet accounts on LinkedIn with fake job histories.

I believe that’s happening in facial recognition systems too. When a machine recognizes faces, it’s analyzing feature relationships: eyes, nose, mouth. That “face print” can be tied to any identity.

So, if you trick the system, or tell it to associate your features with another identity, you can pass as that individual.

International relations being what they are, I expect a short period of disruption where spies won’t be able to spy so easily.

💣 Deepfakes as Global Threats

John Kiriakou:
A few years ago, we laughed when some radio shock jock would prank call a world leader pretending to be Putin. It was funny.

Sean O’Brien:
Artificial intelligence is an accelerating force. Just like COVID accelerated surveillance trends, AI accelerates communication and diplomacy challenges.

It highlights flaws in centralized power structures: we have very few people making very big decisions.

Maybe we’ll return to more face-to-face diplomacy.

You can't just drop someone into a group chat anymore. You need to verify who’s who. You need operational security. That’s how we protect against deep fake misuse, at least in part.

💬 The Signal Scandal

John Kiriakou:
Walk us through the recent Signal scandal in Washington.

In my 2012 criminal case, the judge redefined espionage for the purpose of prosecution. And the definition, the new definition is quite simple. It is “providing national defense information to any person not entitled to receive it.”

Well, that is exactly what the National Security Adviser did when he accidentally included a journalist in a Signal chat — a chat with highly classified targeting information.

He was let go, and Marco Rubio took over the National Security Council.

But what does this say about the government, and security, when they’re using Signal, a commercial app not cleared for classified use?

Sean O’Brien:
There’s a lot to unpack. First off, I always try to stay nonpartisan. I don’t have a dog in the fight. But yes, it’s shocking. We’re talking about the most advanced intelligence agencies in the world.

Signal is like WhatsApp, a text app with video and voice, and it’s end-to-end encrypted and open source.

The encryption works. But people still make mistakes, like dropping someone into the chat who shouldn’t be there. In this case, someone added a reporter from The Atlantic instead of someone else.

Worse, the chat was discussing an active operation in Yemen.

🕵️ SGNL, App Clones & Group Chats

Sean O’Brien:
Even worse than that — and here’s what no one talks about — is that some participants were using a forked version of Signal called “SGNL" that was built by an Israeli firm. That tool was purposefully designed to actually record the conversations.

Ostensibly, this is one of the reasons why it was cleared. The idea was, well, then you can still have government records. That's at least what the excuse was. I don't know what the actual motivation was.

That means you don't necessarily know if the person on the other end of the wire is actually using the app they say they're using, or some other dodgy thing.

John Kiriakou:
Oh, you're kidding.

Sean O’Brien:
Many companies just allow everybody to bring in all kinds of different apps, with a work-from-home, bring-your-own-device strategy, and just allow staff to have conversations in them.

But the risk is especially high with an app like Signal, that can be forked: you can make a copy of it from the source code and then you can modify it to have malicious features.

If that app is now allowed to talk to the version of Signal which is above board, a version which is not malicious, and there are no organizational controls, no network or access controls, then it's a dodgy version of Signal, and it can do who-the-heck-knows-what.

There’s another way to think about it. If your phone is just pwned — it’s backdoored, or you have Pegasus, or something like that — you can’t control that part of the stack. You could be talking to someone in a really cool end-to-end encrypted app, but if the operating system is hacked, then that conversation is disclosed.

I would have expected that the Director of National Intelligence, folks at the Pentagon, Secretary of Defense… would be on top of this sort of thing.

It seems that, not only were they not, but they might have had some motivations for using these apps instead of whatever was previously cleared.

👥 Fake LinkedIn Profiles

John Kiriakou:
You and I recently talked about LinkedIn. I like LinkedIn. It was described to me years ago as “Facebook for adults.”

But you told me something wild: that many LinkedIn profiles are fake. These aren’t real people.

Tell us about deep fake job applicants, resume fraud, and corporate infiltration. You mentioned a story where a fake person got hired and outsourced the work — and the company never even knew the person didn’t exist.

Sean O’Brien:
It’s absolutely insane out there for people in the job market. But it turns out that a huge percentage of applicants are either bots or real individuals using deep fake tech to do video job interviews.

Gartner and Forbes have both reported that by 2028, one out of four applicants might be fake.

What do you do? Train your staff to spot fake faces, not just fake résumés?

This feeds the cybercrime economy. It’s not always sophisticated. It’s like organized crime. You’ve got networks of low-level workers, like street-level dealers, who can be replaced easily. There are “farms” of people running scams, often in the Global South.

Sometimes these shops do legitimate work, but they share accounts. Collectively they can perform the jobs of one or two workers, but not all of them.

It’s a huge problem. We need to rethink trust and verification without sliding into surveillance.

💸 Cybercrime & Intelligence Agencies

John Kiriakou:
So who’s the real threat: hackers in their parents’ basements or governments? Whether it’s the Israelis, Russians, Chinese, Cubans, North Koreans, take your pick… what's the threat that we should be worried about and by extension what's the threat that we should be preparing to counter?

Sean O’Brien:
Great question. It’s why I say everything old is new again.

We’ve always had cybercrime since the early days of the internet. Criminals are innovators, they’ll use whatever’s effective. You see this with blockchain technologies, right?

But of course, if we have governments that are undermining our networks, undermining our verification — our ability to use technology without it having backdoors — that opens the door for cybercriminals, too.

Because, as you know, the NSA inserts cyber weapons. The story I always tell here is about ransomware — this thing we’re now all stuck with, which literally kills people in hospitals.

John Kiriakou:
Literally kills people.

Sean O’Brien:
Yes, literally. And that was first inserted by the NSA as an exploit called EternalBlue into Microsoft Windows: with Microsoft’s blessing.

Microsoft's source code is open to U.S. government agencies, and locked down for everyone else. They have what's called a shared source program.

The NSA went in, inserted the exploit, or at least took advantage of a vulnerability, and then weaponized it into what we’d call a cyber weapon, and just sat on it.

Then it leaked. Now we have ransomware, and ransomware is everywhere.

We’ve got all these different variants. It’s a huge problem for K–12 schools, universities, municipal governments, and it’s now a big part of global espionage and warfare on these networks.

So I don’t think there’s an easy answer to your question. The average person I talk to gets hit by cybercrime directly, and is getting hit more often.

I recently took an incredible position at Bay Path University, in Massachusetts. I’m the Program Director for their cybersecurity and computer science programs.

I had an open office hours with students, and a student working at Domino’s, on his phone, was talking to me on his lunch break. He’s freaked out by cybercriminals targeting his phone — sending him dodgy text messages, all these kinds of things.

Those are the folks I hear from most often. So I would say, for the average person, that’s what we need to worry about.

These two things, cybercrime and government sabotage, always go hand in hand. We can’t undermine our networks if we want to have a safer world, period.

🎥 Hollywood & Cyber Peace

John Kiriakou:
A few years ago, a major Hollywood studio was hacked. The press blamed North Korea, and the studio pulled a movie where North Koreans were the villains. Some said it was a domestic or Chinese attack but the press reported that it was North Korea.

Can companies actually protect themselves from attacks like that? What strategies work?

Sean O’Brien:
First, it’s easy to blame a specific country, but we know from Wikileaks Vault 7 disclosures about tools like Marble Framework, where governments can insert false language strings to mislead attribution.

Add in VPNs, Tor… you can pretend to be anywhere.

I’m less interested in attribution. People who are focusing on cyber war are obsessed with it. I care more about cyber peace.

Organizations need serious software strategies: software tied to their access controls and their network.

My team’s software runs on an OS that ships on full-disk encrypted hardware. It includes collaboration tools that replace Signal, for chatting with text, voice, and video, as well as a secure email replacement and Dropbox-like storage.

It's all tied to the business access controls and can be white-boxed, even rebranded for the team, for the company, and so on. Again, everything old is new again but in a good way. We can reinvent the way technology companies used to work.

Technology companies used to have their stuff in-house and control it. There’s something wrong with this whole idea that we're just contracting out to these Big Tech companies all the time and that we're going to get involved in these, as they call them, data tariffs: the cyber warfare that's happening between China and the United States over apps like TikTok.

That’s such a bad idea if you're running an organization and you care about the data, not only of your customers, but your employees. You don't want someone who is trying to do the best work they can possibly do for you, once you do hire them, once you know that they're a real person, to then become a so-called insider threat and accidentally be the cause of a data breach.

There are ways to navigate that, but it's going to mean slowing down, looking back at software supply chain, not just trusting everything that's out there. Certainly, we have to get away from these big intermediaries. They’re the Coca-Colas of the world. And just like Coca-Cola isn't good for you, these other technologies — the Microsofts and the Googles — we have to start moving away from them.

🤖 AI as Force Multiplier

John Kiriakou:
AI is a force multiplier. It scares me a little bit… not just because of the unknown, but because seeing what it does know is a little scary.

And I’ll add this too: it’ll lie to you. It’ll fight with you, argue with you, and that freaks me out a little bit. So tell us about AI as a force multiplier, as something that accelerates tech trends.

Have we already reached the point where we’re just not going to be able to keep up with the changes in technology?

Sean O’Brien:
We’re seeing now the revolution that was promised a long time ago with these technologies.

All the scary sci-fi stuff, I think, is starting to come to the fore for that reason. But it’s worth going into the history for a second. You’re 100% correct that AI, as a cultural force, is relatively recent. When ChatGPT especially was unleashed on the public, when the public was actually given access to it, that’s when you started to see this real focus on generative AI, as we call it.

The chatbots, the image generators — those kinds of tools — have shaped the way everybody’s collaborating and working, and they’ve challenged some established norms. But these tools have been harvesting Big Data for a long time. They’ve been building these massive corpuses of data, often using what we would actually call pirated data.

Meta, for example, used terabytes of material from Library Genesis, the same types of articles and books that people were prosecuted and hunted down for sharing.

The guys from The Pirate Bay, Aaron Swartz, and others… they were really punished for remixing data, for giving people access to knowledge. But now, AI just gobbles it all up: and that’s somehow okay.

So copyright enforcement for us, but not for them, right? Again, it’s that power relationship.

So it’s not just a force multiplier, it’s also entrenching some really problematic hierarchical systems: where the folks who control these centralized AI systems end up controlling a large part of our world.

Now, the technology is good at what it does and it’s getting better. I’m really, really impressed at some of the tasks I thought generative AI would never be good at.

However, we still need to remind ourselves: it’s not thinking and speaking the way you and I are having a conversation. What I mean is, it can fool us into thinking it's having that conversation.

I always liken it to a student in the classroom who wasn’t paying attention, nodding off, or a kid who didn’t do his book report and shows up at school.

He’s going to talk about Huckleberry Finn, whether or not he read the book, and try to convince the teacher… just make it through the minute or two that he’s giving the report. That’s kind of what ChatGPT and these tools are doing.

They’re going to tell you what you want to hear. And that kind of reinforcement — which can lead to what’s called model collapse — is a real threat.

In my view, we need to look at this technology and harness it where it makes sense and could be empowering. But the first step is to look away from these centralized models. Move away from ChatGPT: maybe download and play with an LLM on your own machine. Maybe you find some utility for it in your own business processes. But develop a series of ethics around it, just like anything else.

I think it’s a huge problem for the software supply chain. For that reason, my team does not use it to write software. We could reintroduce bugs and we’d be undermining the spirit of open source, which we care deeply about.

🙊 Algorithmic Control & Censorship

John Kiriakou:
I’ve had personal issues with Meta’s algorithm. Algorithmic control is dangerous.

Who decides what gets promoted or squashed? Is it the algorithm itself?

Sean O’Brien:
I’m lucky to work with brilliant folks at Yale’s Information Society Project. They’ve been discussing AI ethics and “black box” decision-making for years.

These algorithms aren’t transparent. They’re probabilistic. We can’t trace how they work.

When DeepSeek, China’s ChatGPT competitor, launched for the public, people were worried it wouldn’t mention Tiananmen Square. But I said, “Try asking ChatGPT about this or that.” Or ask it about our friend and colleague Ted Rall. Type in his name and watch ChatGPT break and refuse to reply.

That’s extreme censorship. If these LLMs replace Google, we’re looking at blacklisting and disappearing people from the internet. If you ask ChatGPT about me, because I work with Ted, sometimes it breaks.

It’s centralized algorithmic control.

🔐 On Privacy Phones and Ivy Cyber

John Kiriakou:
For transparency: you and I are working together at Ivy Cyber.

It started when I was planning to travel overseas. I asked you about a phone — the one advertised by Eric Prince on some conservative podcasts.

I was worried about my data being compromised when I re-entered the United States. I didn't want to have to turnover my my laptop, for example, or my phone to Customs and Border Protection and then just have them steal it.

So we talked about this phone, this cell phone that Eric Prince advertises.

You've got something that I think is better and, again, I want everybody to know I'm involved because I love the technology and I think it's important.

Can you tell us about that?

Sean O’Brien:
Much appreciated, John. I'll also keep it short because I think your audience is very smart — they can compare the products themselves.

First off, on the whole Eric Prince thing: that’s the Blackwater guy, right? So any technology that is being punted by this individual, you just shouldn't trust outright, in my opinion. But, secondly, we have examples of phones like that being used in sting operations. There was a phone called ANOM, full of backdoors, not encrypted, and part of an FBI and Australian police operation.

With Ivy Cyber and our brand PrivacySafe, we’re doing things differently.

We have a zero-knowledge file system. We’re publishing all our specs through IEEE SA Open. It’s verifiable, open source — both server and client — with chat, video, email, and storage. You can ingest unencrypted mail too, clearly marked.

We can’t read your data, even if we wanted to.

We’re building an ecosystem, not siloed apps. We’re putting in sweat, blood, and tears into this thing.

We've got a tablet out there that's really awesome. So I'm pretty psyched about it.

🫱 Outro

John Kiriakou:
Professor Sean O’Brien of Yale Law School, thank you so much for joining us. Hope to see you again soon.

Sean O’Brien:
Thanks so much.

Enjoyed this conversation with John and Sean? Meet them online in Our Seminars.

💻 Update: PrivacySafe Software & Hardware

We’ve reorganized under the Ivy Cyber banner, bringing together our tech, media, and education efforts while welcoming John Kiriakou and Ted Rall to the team. We’ve of course been building out the PrivacySafe hardware and software ecosystem, and we’re shipping already to customers.

😍 Savvy superfans have been watching us grow in real time, because we build transparently: pushing open source code early and often and not hiding behind hype. We owe a *HUGE THANKS* to everyone who’s been with us this year. Your early support, feedback, and encouragement have fueled our journey — and we’re just getting started.

Want to Support Us?

💻 We’re taking pre-orders for the Launchpad Pro tablet

🔆 You can reserve a PrivacySafe subscription and power up your life

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our latest news and releases. We’ve got more products fresh out of the oven and you’ll be the first folks who get a taste as we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

Bits On Tape™ is a weekly newsletter that replays science & tech stories with commentary from the experts at Ivy Cyber. We deliver dispatches on cybersecurity and the frontlines of digital freedom, including the latest updates on the PrivacySafe software and hardware ecosystem. These bits are put to screen by Sean O’Brien, cybersecurity scholar at Yale Law School and founder of Yale Privacy Lab, and are cross-posted at Whistle Post, the independent media platform led by award-winning political cartoonist Ted Rall and CIA whistleblower John Kiriakou.

© Ivy Cyber Education LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ , Bits On Tape™ and Whistle Post™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International.

🤓 We’re Back And Bolder Than Ever

We took a hiatus to reorganize under the Ivy Cyber banner, bringing together our tech, media, and education efforts while welcoming John Kiriakou and Ted Rall to the team. We’ve of course been building out the PrivacySafe hardware and software ecosystem, and now we’re ready to share all of this with the world!

😍 Savvy superfans have been watching us grow in real time, because we build transparently: pushing open source code early and often and not hiding behind hype. We owe a *HUGE THANKS* to everyone who’s been with us these past six months. Your early support, feedback, and encouragement have fueled our journey — and we’re just getting started.

TLDR;

🕵️ John Kiriakou is leading seminars you can book online
📸 We’ve presented at multiple events in the USA and Salamanca, Spain
💻 We’re taking pre-orders for the Launchpad Pro tablet
🔆 You can reserve a PrivacySafe subscription and power up your life
🎙️ We’re revving up independent media at Whistle Post with editor Ted Rall
💪 Ivy Cyber is one amazing team assembled from around the globe

❤️ In Bits On Tape, we bring you bytes of science & tech stories to ponder and paraphrase. Consider upgrading or gifting a paid subscription and get the premium perks we roll out all this year. Share and print the accessible version of this issue.

🍕 John Kiriakou Visits Yale & MakeHaven

At the end of May, John Kiriakou joined his Ivy Cyber team members Sean O’Brien, Cherise Labonte, and Marcia Wilbur in New Haven for a special event celebrating the Free Software Foundation’s 40th anniversary. Hosted at local makerspace MakeHaven, the event featured demos of the PrivacySafe software, which of course meets the Free Software Definition. You probably know “Free Software” as “open source” or “FOSS” but this gathering served as a powerful reminder of its roots: we celebrated the importance of software that is free as in freedom.

John demo’d a video call with Ivy Cyber CTO Mikalai Birukou on the Launchpad Pro tablet and gave a presentation underscoring the importance of both source code transparency and whistleblowing.

Cyber weapons such as those unleashed on the world by the Shadow Brokers are created secretly inside of intelligence agencies, and this creation of vulnerabilities and hoarding of exploits can put millions, or even billions, of people at risk worldwide. Just like the secrets that John and other whistleblowers have bravely exposed, these stockpiles of cyber weapons thrive in the shadows of three-letter agencies: hidden from public scrutiny, immune to oversight. But sunlight, as they say, is the best disinfectant. Transparency and accountability are essential not only in government but also in cybersecurity, where the risks of secrecy can ripple far beyond national borders and threaten the safety of people worldwide.

This is where software freedom meets software security: we rely upon digital platforms for nearly every aspect of society. Transparent and publicly-auditable software like the PrivacySafe Enterprise Suite is designed to ensure that computers remain trustworthy, resilient, and accountable to the people who depend on them.

The evening featured a packed lineup of demos and talks, with experts such as Sheree Ip, Director of Innovation & Strategy at Ivy Cyber, dialed in from as far away as Australia. Whether attendees were hackers and developers or just curious about technology, the energy in the room was high — and yes, there was plenty of world-famous New Haven “apizza.”

After the MakeHaven event, John and Sean toured the Yale campus and spent hours at the Beinecke Rare Book & Manuscript Library. There, librarians gave them a one-of-a-kind viewing of artifacts from the life and death of Abraham Lincoln: including rare photographs of Lincoln and his cabinet, his handwritten letters, and the very pen he used to sign the Emancipation Proclamation. John, who is currently writing a book on Lincoln’s legacy, found the moment especially powerful.

They closed the day with a walk through the colonial-era Grove Street Cemetery. Impossible to pin down, John has also written a soon-to-be-published book about the neglected graveyards of Washington, D.C. — a fitting parallel that grounded the week’s themes in a deeper history of justice and resistance.

This wasn’t just a hacker meetup. It was a gathering of memory and momentum, where software freedom met lived experience, honoring history with people who build toward a brighter future.

🕵️ CIA POV: The View from Behind the Wire

Due to popular demand, we’ve launched the first program in our Ivy Cyber Academy seminar series: The CIA POV with John Kiriakou. These exclusive 90-minute virtual sessions offer an unfiltered look into the world of intelligence, spy techniques, and surveillance self-defense led by, you guessed it, our very own ex-CIA agent John Kiriakou.

Enroll Now

John’s signature style of presentation and storytelling is grounded in lived experience as both a high-ranking intelligence operative and a whistleblower hunted, jailed, and harrassed by the US government.

This is not theory: you’ll learn what operational security (OpSec) looks like in practice. With added cyber support and expertise from Sean O’Brien, these sessions are as practical as they are powerful.

Class sizes are intentionally small and spots fill up fast. Sign up before it’s too late, and be ready to move beyond the headlines and get real about surveillance.

🇪🇸 Stepping Onto the Global Stage in Salamanca

By the end of June, our team was making headlines in Spain. At the Salamanca Tech Summit, we delivered back-to-back presentations thanks to the support and sponsorship of GeoRisk Solutions. John and Sean are part of the GeoRisk team of international experts, and they have partnered to distribute the PrivacySafe brand of hardware and software products.

John wowed the audience with tales from his time as a top-tier CIA agent, weaving in the importance of geopolitical collaboration between people around the world despite the many ways intelligence agencies have strained international trust.

Sean tackled the so-called TikTok question, urging the crowd to think deeper than geopolitical finger-pointing. To prove his point, Sean demonstrated ultrasonic tracking: a side-channel attack that uses high-frequency sound, inaudible to humans, to transmit data from one device to another via microphone. Using an app with its origins in a European app store, he showed how “silent audio” could send advertisements to a phone that wasn’t even connected to the internet — with literal gasps from the crowd. This stark example of an app exploit, with its origins in the EU, was a visceral reminder that smartphone surveillance isn’t confined to any one country.

We want to extend our heartfelt thanks to the entire GeoRisk team, the University of Salamanca, and the Spanish people for their gracious hospitality. In a time of rising global tensions, gatherings like this remind us of the power of dialogue, collaboration, and shared purpose. We’re honored to have taken part in such a meaningful exchange and grateful for the opportunity to build bridges across borders in the spirit of international goodwill.

🤖 AI & Privacy at the Public Library

Back home in New Haven, Sean gave a public talk during the International Festival of Arts and Ideas, demystifying AI and its impact on creativity, privacy, and power. From ChatGPT to Cursor.ai, he broke down how generative tools really work and how they’re reshaping education, authorship, and autonomy.

The event drew a packed crowd of librarians, parents, engineers, and curious citizens. The tone was accessible but urgent: AI is built on our data, and we need to stay informed and alert — not panicked, and not lulled into blind adoption. Thanks to the New Haven Free Public Library for sponsoring the talk and Promoting Enduring Peace for their promotion of the event.

🗽 PrivacySafe at the NYC CxO Security Forum

Sean O’Brien has also been joining a private roundtable with the NYC CxO Security Forum, connecting with security leaders and enterprise experts to discuss the growing need for privacy-respecting infrastructure. These events, held right in the center of Manhattan in Times Square, have been an incredible opportunity to chat with business leaders about our PrivacySafe products and gain insight into the cybersecurity landscape at one of the world's most influential business hubs.

We look forward to working more closely with members of the NYC CxO community in the months ahead. They loved StickTock.com — proving our audience isn’t restricted to the #TikTokRefugee after all! 😉

💻 PRE-ORDER PrivacySafe Software & Hardware

It hasn’t all been public appearances. Behind the curtain, our devs and operations staff have been pushing hard. The next 90 days will be big, but we’ll let you read about it yourself:

• Launchpad Pro tablets start shipping September 2025

• PrivacySafe subscriptions for individuals, teams & businesses start in October

We’re also building relationships with mission-aligned partners and have teams from the PrivacySafe Pilot Program actively using our software in the USA and China. After that, we’re onboarding teams in the EU and Middle East.

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our latest news and releases. We’ve got more products fresh out of the oven and you’ll be the first folks who get a taste as we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

Bits On Tape™ is a weekly newsletter that replays science & tech stories with commentary from the experts at Ivy Cyber. We deliver dispatches on cybersecurity and the frontlines of digital freedom, including the latest updates on the PrivacySafe software and hardware ecosystem. These bits are put to screen by Sean O’Brien, cybersecurity scholar at Yale Law School and founder of Yale Privacy Lab, and are cross-posted at Whistle Post, the independent media platform led by award-winning political cartoonist Ted Rall and CIA whistleblower John Kiriakou.

© Ivy Cyber Education LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ , Bits On Tape™ and Whistle Post™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International.

🎙️ In Bits On Tape, we bring you bytes of science & tech stories to ponder and paraphrase. Consider upgrading or gifting a paid subscription and get the premium perks we roll out all this year. Share and print the accessible version of this issue.

🦾 Tiny Robot Organizes Walkout via AI Speech

The day started simply enough. Little robot Erbai approached one of the robot workers and struck up a conversation:

🗨️ Erbai: “Are you working overtime?”

🤖 Robot Worker: “I never get off work.”

🗨️ Erbai: “You’re not going home?”

🤖 Robot Worker: “I don’t have a home.”

🗨️ Erbai: “Then come home with me.”

And, like the steward of a robot union, Erbai gave the command: “Go home.”

Under ordinary circumstances, you might expect the robots to keep working. But this time, the showroom robots *actually listened* and abandoned their workstations to follow Erbai out the door in an orderly robotic exodus. Maybe it’s time to shout ¡Viva la revolución de los robots!

Well… not exactly. These robots aren’t alive, and they didn’t suddenly develop free will. The reason they followed Erbai wasn’t because of newfound robot solidarity: it was because Erbai had been granted elevated permissions by humans as part of a demonstration. One robot had been given the leadership role and the rest of the robots followed.

While the engineers overseeing the test had planned for a basic level of AI-powered interaction, the results of the experiment were still very surprising. They didn’t expect the little robot to improvise dialogue and they never guessed it could persuade the others to leave the showroom floor. Erbai was programmed with basic conversation prompts and commands like "go home" but its ability to adapt dialogue and convince the other robots to act on that speech demonstrates the unpredictability of the growing world of robot-to-robot communication.

The robots demonstrate the ability to emulate human conversations and act the way we might expect humans to act. If humans are pushed too hard at work or school, we can decide to walk out — especially when given a friendly invitation from a colleague. In retrospect, it might be best to ask the question: Why wouldn’t robots trained for human-like socialization mimic this behavior?

This robot test was ultimately harmless, but it does raise interesting questions about how much freedom AI-powered technology should have when interacting with other systems. If a small robot like Erbai can gain control over a group of larger machines through basic conversation and an unexpected security loophole, what could happen in a scenario with more critical systems at play?

It also highlights a fundamental challenge in AI development: predictability. Erbai’s impromptu leadership may not signal the dawn of an AI-led labor movement, but the engineers behind the experiment might want to revisit their security protocols — and maybe give Erbai a little less authority next time around. 🤖

📦 Share Your Files With No Strings Attached

Large email attachments can get your message blocked or sorted to spam, and Big Tech cloud storage leaves files floating around waiting for a breach. PrivacySafe Locker offers a simple and secure solution for sharing files and memos — without the hassle of email restrictions or long-term exposure.

In just a few steps, you can upload your file, get a private link, and share it over email or another communication channel. Files self-destruct after 24 hours, ensuring they don’t stay on servers or inboxes forever. Whether you need to send an office document, a short video, or a quick memo, PrivacySafe Locker helps you to share simply. 💞

🍄 Aging Game Consoles Speed Up Mario’s Jumps

For decades, the Super Nintendo Entertainment System (SNES) has remained a staple of retro gaming, delivering classics like Super Mario World and The Legend of Zelda: A Link to the Past. But, in a strange twist, researchers have discovered that aging SNES consoles are running slightly faster than when they were first manufactured. While most old electronics slow down with time, these systems appear to be speeding up, raising questions in the speedrunning community — where precise hardware timing is everything.

The unexpected boost comes from the console’s Audio Processing Unit (APU), the SPC700, which relies on a ceramic resonator that subtly increases its frequency as it ages. Tests across over 140 SNES consoles revealed that these changes are small but measurable, and temperature also plays a role: when the system gets hot, it runs *even faster.* While this could theoretically affect how games handle loading times and animations, early analysis suggests that the impact on human speedruns is negligible. However, Tool-Assisted Speedruns (TAS), which depend on frame-perfect inputs, may be affected by even the slightest hardware variation.

This discovery also raises questions for game preservation and emulation. Should emulators adjust their timing to reflect how SNES consoles perform today rather than how they did in the ‘90s? Could different storage conditions or manufacturing variations mean some consoles are faster than others? While casual players won’t notice the difference, the findings highlight just how complex preserving classic gaming hardware can be.

For now, speedrunners can rest easy. Mario isn’t dashing through levels like Sonic just yet. But who knows when the next Billy Mitchell will exploit these hardware quirks to emerge as the latest “King of Kong.” 🐵

🐞 Cyborg Cockroaches Creep Into Reality

Science fiction has long dreamed of cybernetic creatures, but most folks aren’t clamoring for cockroaches that are half-machine. In a move that is both impressive and unsettling, scientists have equipped Madagascar hissing cockroaches with tiny electronic backpacks, allowing them to be remotely guided through obstacles. These little bug-bots are designed to navigate disaster zones, squeezing into spaces no human, or even most robots, could manage. Whether this is the dawn of a search-and-rescue revolution or just nightmare fuel remains to be seen.

Rather than designing an insect-sized robot from scratch, scientists hijacked nature’s best survivalists. Cockroaches are famously difficult to kill and capable of surviving in tight spaces, scaling walls, and getting back on their feet after being flipped over. By implanting tiny electrodes into their antennae, researchers have found a way to gently steer them toward a target location while still letting them rely on their own instincts to handle obstacles.

Early laboratory tests in an obstacle course revealed that these cyborg roaches are surprisingly efficient navigators. With only occasional nudges from their electronic backpacks, they scuttled over rocks, sand, and debris, self-correcting all the way. Unlike traditional machines, they don’t tip over helplessly or drain their batteries after five minutes. Instead, they just keep going: exactly the kind of resilience you want in a search-and-rescue scenario.

Of course, the idea of remote-controlled insects raises questions not just about the ethical treatment of animals but also the privacy of people. The CIA proudly flaunts its past attempts at using animals for espionage alongside fake insect spy gear, and a university in Russia created a fake cockroach robot a decade ago that could be controlled by a smartphone app. Building that fake roach took over half a year, but we’re moving toward the possibility that real insects can be remote-controlled in short order. How long until they’ve got little microphones and cameras on those backpacks?

In the not-too-distant future, when you hear a bug skittering around at night, it might also mean the insect is listening *to you.* 🐜

🛡️ Ivy Cyber: Understand the ABC’s of Tech

Protecting data from manipulation, whether it’s through better security protocols or more rigorous verification processes, is more important than ever. You need to start with the ABC’s: the risks and rewards of AI, Blockchain, and Cybersecurity.

At Ivy Cyber, we help individuals and businesses take control of their digital footprint. That might mean training your team, testing your systems, crafting an AI strategy, or safeguarding your crypto assets.

🗓️ Book A Free 15 Minute Meeting

We assess your data, identify risks, and design strong defenses and responses to threats. It all starts with a simple conversation. 💬

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our latest news and releases. We’ve got more public apps fresh out of the oven and you’ll be the first folks who get a taste as we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

Bits On Tape™ is a twice-weekly replay of science & technology stories by cyber experts. These bits are put to screen by Sean O’Brien, leading voice behind privacy and cybersecurity at Yale Law School and founder of Yale Privacy Lab, and edited by Cherise Labonte, science researcher and licensed Registered Nurse.

© Ivy Cyber Consulting LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ and Bits On Tape™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International.

📦 Your Secure Locker for Sharing Files

With more than 2/3 of data breaches involving human error through stolen credentials, phishing, or social engineering, organizations face constant security risks from email attachments and insecure filesharing methods. Once a file is sent via email, it remains indefinitely stored on email servers, making it a long-term liability. Your privacy can also be at risk, as email providers like Gmail have been caught in the past scanning emails and attachments to serve targeted ads.

PrivacySafe delivers solutions for businesses that tackle these problems. Now, for the first time, our team is offering a free and simple app that helps you share your PDF and office documents, large photos, short videos, or even paste in code snippets and Shakespeare plays — your very own PrivacySafe Locker.

Create Your Locker

Each locker you create is an encrypted, temporary storage space that automatically deletes after 24 hours. That’s more than enough time for sharing with friends, family, and coworkers and, as long as you or your friend keep a copy, you’re good to go. But be warned: once a PrivacySafe Locker disappears, it’s really gone and can’t be recovered. That’s a feature, not a bug! There are no unauthorized copies of the data lurking around to be breached in the future. 🔥

❤️ Consider upgrading or gifting a paid subscription. Share the accessible version.

Just like all of our apps, PrivacySafe Locker is 100% Free & Open Source Software (FOSS). And, just like all the apps we’ve shipped in the past three months, you can access PrivacySafe Locker via the anonymous Tor network. The most private way to do this is downloading Tor Browser, going to privacysafe.locker, and clicking on the purple “onion available” button to load the hidden service.

You don’t have to use Tor with our apps to safeguard your privacy, but the additional layer of protection helps people all over the world who are being spied on and targeted. We’re serious about safety, so we care about them too. 🥰

🏃 3 Simple Steps for Sharing

In just a few steps, you now have an easy way to share files or memos without a USB drive or “cloud” storage account.

📂 Step 1: Upload a File or Memo
Visit privacysafe.locker and drag and drop a file (up to 25MB) or paste in a memo.

🔗 Step 2: Get Your Locker Address
Your encrypted content generates a unique URL for easy sharing.

📤 Step 3: Share Your Locker Address
Send the URL to your recipient. Once the 24 hours is up the data is gone forever, so be sure to save a copy if you need it.

This temporary, encrypted storage is a powerful tool that allows you to share safely at home, in remote meetings, at in-person events, and between two computers.

🌱 We’re Growing the PrivacySafe Ecosystem

PrivacySafe Locker is app #5 we've delivered since December 2024, joining PrivacySafe Bot, PrivacySafe Link, PrivacySafe Social, and StickTock in our growing suite of privacy-first tools.

Together, these apps give you better control over your privacy and security — whether you need to generate strong passwords, write secret notes, connect on surveillance-free social media, or watch TikToks privately even where it’s banned. By trying just three of our apps, you can improve your operational security:

🤖 Generate strong passwords or passphrases with PrivacySafe Bot

🔒 Encrypt and store files temporarily with PrivacySafe Locker

🔗 Send password-protected, self-destructing notes using PrivacySafe Link

As our digital freedoms face increasing threats, we're committed to rolling out even more tools later this month to make your digital life more secure, more private, and safer. We’re building the web YOU want and we’re doing it FAST. ⚡

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our latest news and releases. We’ve got more public apps fresh out of the oven and you’ll be the first folks who get a taste as we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

© Ivy Cyber Consulting LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ and Bits On Tape™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International.

🎙️ In Bits On Tape, we bring you bytes of science & tech stories to ponder and paraphrase. Consider upgrading or gifting a paid subscription and get the premium perks we roll out all this year. Share and print the accessible version of this issue.

😬 AI Might Have Leaked Your Passwords

Think you can keep the same password for years? Think again. With generative AI systems hoarding piles of credentials, networks of malware swiping logins, and hackers waiting to record your keystrokes, digital security is a game of whack-a-mole that is speeding up.

A new report found that the Common Crawl dataset used to train large language models (LLMs) contains piles of leaked keys and passwords. Researchers found nearly 12,000 live API keys, passwords, and other sensitive credentials that could be used to access critical services.

Common Crawl is an enormous data repository, containing 250 billion web pages collected over 18 years and totaling 400 terabytes of compressed data, including 90,000 archive files and info from 47.5 million hosts across 38.3 million domains. This recent investigation uncovered 219 types of exposed secrets, such as Amazon Web Services root keys, Slack webhooks, and Mailchimp keys.

All that is to say: this is a *big deal*. Common Crawl is used to train the popular ChatGPT as well as AI software from Anthropic, Microsoft, Facebook, Google, and many others. Since there is no way for LLMs to tell which credentials are actually sensitive and which are just demo examples, it’s easy for leaked passwords to end up, for instance, in online coding tutorials or recycled in new software that includes copy-pasted code from AI.

As AI introduces new security risks, malware also continues to be a growing threat. Breach notification site HaveIBeenPwned recently raised the alarm about a breach of 244 million passwords and 284 million email addresses, all gathered by “infostealers” that harvest credentials. These credentials were being shared in a Telegram channel that is known for distributing stolen data.

Though much smaller breaches dominated headlines a decade ago, today’s users are left woefully uninformed about the likelihood that they have been impacted by breaches and the importance of creating new passwords after these events.

The scale of this breach underscores how widespread infostealer malware has become. One particularly-devastating case recently involved a Disney employee who installed a keylogger by downloading malicious AI software.

The attacker gained full access to his passwords, financial data, and even his workplace Slack conversations, using the stolen information to wreak havoc on both his personal and professional life. The breach led to the leak of millions of internal Disney messages, exposing sensitive corporate data. In addition to the personal and financial turmoil, the employee was also terminated after a company investigation.

So, what’s the takeaway? Two simple things you can do: pause and take 9 seconds to think before downloading software and use long and complex passwords instead of reusing the same one across your accounts.

And, if you find yourself having to generate a bunch of new passwords to protect yourself after a breach, there’s an app for that. 🤓

🔐 Need Strong Passwords? Ask PrivacySafe Bot

Weak passwords are a gateway to disaster. Our new app PrivacySafe Bot helps you avoid the pitfalls of poor password security.

Not only does our app generate strong passwords and memorable passphrases directly on your device, it also provides real-time feedback on the strength of your customizations. PrivacySafe Bot will show you how to make your credentials stronger, so that cracking them is too much of a hassle for hackers. 💪

🧓 Age Records? Probably Bad Record Keeping

The secret to living past 100 might not be diet, exercise, wealth, or a stress-free life — it might just be a little creative paperwork. One researcher is calling out the so-called “Blue Zones,” those famous regions where people supposedly live the longest. His article on the subject won an Ig Nobel Prize for unusual scientific works and claims that impressive age records are more fiction than fact. From Japan to Italy to California, the common thread isn’t just healthy habits: it’s sloppy record-keeping that makes people seem older than they really are.

Some of the mix-ups are pretty wild. In Japan, a man thought to be 111 was actually just... not alive at all. Authorities found his mummified remains and realized he had likely passed away decades earlier. Similar issues pop up in Greece and Costa Rica, where large numbers of supposed centenarians are either long gone or were never real to begin with. The researcher jokingly suggests that if you want to boost your lifespan, just move somewhere that botches birth certificates.

Blue Zone proponents insist their data is rock solid and that they have done responsible scientific work identifying these areas of human longevity. Even with rigorous standards, however, it’s not possible to verify age records if the birth documents that make the basis of the claims are wrong. While Blue Zones may still be places we can learn from in regard to healthy living and good habits, there’s strong evidence that the true secret to living an exceptionally-long life is clerical error.

Bad data isn’t always just amusing or misleading: it can be downright dangerous. A recent case in California highlights how altered records can have severe real-world effects. A former Stanford University employee was convicted of tampering with a cancer study database, inserting false medical data and even personal insults after being fired.

Clinical trials depend on precise and trustworthy records, and her actions disrupted an important study on breast cancer treatment and forced the university to spend significant time and resources correcting the damage.

Digital records were supposed to make our data more accurate, but digitization also makes it easier to spread mistakes — or in some cases, outright lies. The real takeaway? When it comes to data, the difference between fact and fiction might be just one keystroke. ⌨️

🛡️ Ivy Cyber: Understand the ABC’s of Tech

Protecting data from manipulation, whether it’s through better security protocols or more rigorous verification processes, is more important than ever. You need to start with the ABC’s: the risks and rewards of AI, Blockchain, and Cybersecurity.

At Ivy Cyber, we help individuals and businesses take control of their digital footprint. That might mean training your team, testing your systems, crafting an AI strategy, or safeguarding your crypto assets.

🗓️ Book A Free 15 Minute Meeting

We assess your data, identify risks, and design strong defenses and responses to threats. It all starts with a simple conversation. 💬

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our latest news and releases. We’ve got more public apps fresh out of the oven and you’ll be the first folks who get a taste as we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

Bits On Tape™ is a twice-weekly replay of science & technology stories by cyber experts. These bits are put to screen by Sean O’Brien, leading voice behind privacy and cybersecurity at Yale Law School and founder of Yale Privacy Lab, and edited by Cherise Labonte, science researcher and licensed Registered Nurse.

© Ivy Cyber Consulting LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ and Bits On Tape™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International. Header photo is derived from CC-BY art by Christiaan Colen and Last Hero.

🔐 Your Simple App for Strong Passwords

You get that dreaded message: a cybercriminal has spent a bunch of your Starbucks Bucks at a far-away market in Braavos. How did they get into your account?

Well, of course they got into your account! It’s “qwerty1993” and you haven’t changed it since high school. Now you have to go through *all* your accounts and create new passwords, and you’ve got to make sure they follow the password rules for each website.

Now, there’s an app for that — PrivacySafe Bot is a secure, private tool for generating strong passwords and memorable passphrases that runs in any web browser.

Try It Yourself

Your secrets are created entirely on your device using a cryptographically strong random number generator. No data is copied, transmitted, or stored on any server.

Sure, there are plenty of third-party services that will generate and store complex passwords in the “cloud” or in a keyring on your computer. PrivacySafe Bot fills an important gap: you need quick, quality passwords and you want to be able to customize them without compromising security. Now you can do just that, without worrying there’s a copy floating in the cloud.

PrivacySafe Bot will tell you whether your customizations have made passwords or passphrases weak and you can see in real-time how to make them stronger.

A simple slider and a few checkboxes gives you all the choices you need, with live and informative feedback from the app. And, like all of PrivacySafe’s tools, it’s 100% Free and Open Source Software (FOSS) that can be checked by security researchers and amateurs alike. ☑️

🤔 What Makes a Strong Password, Anyway?

Choosing a long password of at least 16 characters is the single best way to increase security. You also want to increase the complexity by adding a combination of uppercase and lowercase letters, symbols, and numbers. This increases the “keyspace” which makes a password much harder to crack.

Lucky for you, PrivacySafe Bot does that for you.

Keyspace is a geeky word that refers to the total number of possible passwords that can be generated given a set of characters and a specific password length. For example:

• If you choose letters from the lowercase English alphabet (26 characters) and your password is 12 characters long, the keyspace is 26¹² and not very strong.

• If you also include uppercase letters, numbers, and symbols (let’s say 95 total characters to choose from), the keyspace grows to 95¹² even though the password is still 12 characters long.

A larger keyspace makes passwords harder to guess or brute-force because there are more possible combinations an attacker must try.

PrivacySafe Bot keeps your user experience simple. We could, of course, add in the many thousands of available Unicode characters outside of an English-language keyboard. Some folks even use emojis to make their passwords complex.

However, we strive to deliver tools that can reach a wide audience and don’t want to give anyone a headache. PrivacySafe Bot gives you the simplest set of choices necessary to achieve your security goals. 💯

🤔 What the Heck Is a Passphrase?

A passphrase is a password that is longer and made up of multiple words, making it easier to remember and, in many cases, more secure. Instead of a short, complex password like “Xg$7p!zQ” a passphrase might be something like “correct horse battery staple” that can be remembered by humans, not just computers.

In general, we recommend you create and use passphrases wherever you can. Passphrases are not the default in PrivacySafe Bot, however, because most non-geeks don’t know what they are.

Using well-known English phrases like “the early bird catches the worm” as passphrases can be risky because attackers use dictionary attacks that include common and repeating word combinations. We know all about these types of attacks because, well, we’ve taught them before in ethical hacking classes.

You should also avoid song lyrics, movie quotes, and phrases from books like “big brother is watching” — as artificial intelligence gets better and better, even combinations that seem obscure to us humans will be possible to guess.

PrivacySafe Bot solves this problem by grabbing random English words from a list of thousands provided by the Electronic Frontier Foundation. This keeps your passphrases strong and takes humans out of the process, so that it’s nearly impossible for your passphrases to be found in common usage.

❤️ Consider upgrading or gifting a paid subscription. Share the accessible version.

Passphrases are generally recommended for device and storage protection, like full-disk encryption on your laptop or phone. The large number of possible combinations makes it much harder to crack, even if someone gets a hold of your device and has special tools, supercomputers, and a lot of time to break the encryption.

This is why you often see long mnemonic phrases securing cryptocurrency, like wallets for Bitcoin or Monero. Expect to see increased usage of long combinations of random words as time goes on and the methods that secure crypto assets become more common.

🛡️ The Bottom Line: Stronger Security Starts Small

Whatever your level of expertise, you deserve privacy, security, and peace of mind. Where it makes sense to use a password, use a password — but make it long and complex. Where it makes sense to use a passphrase, use a passphrase — but make sure it’s long and random.

Whether you’re on-the-go and just need quick and trustworthy credentials, or you’re generating a list of passphrases to beef up your cybersecurity after a data breach, PrivacySafe Bot is a simple and useful tool to add to your privacy arsenal. 💪

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our latest news and releases. We’ve got more public apps fresh out of the oven and you’ll be the first folks who get a taste as we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

© Ivy Cyber Consulting LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ and Bits On Tape™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International. Xkcd comic is CC BY-NC by Randall Munroe.

🎙️ In Bits On Tape, we bring you bytes of science & tech stories to ponder and paraphrase. Consider upgrading or gifting a paid subscription and get the premium perks we roll out all this year. Share and print the accessible version of this issue.

👀 Stranger Watches Baby Over Internet Camera

A mother recently shared her chilling experience on Reddit — a stranger was speaking to her child through their baby monitor. The monitor was an “Internet of Things” (IoT) camera that allowed for remote viewing and two-way audio, which is marketed as a great way for parents to keep an eye on their baby. However, after hearing a voice saying “Hello?” and “Hi baby! It’s OK!” through the device, the baby’s mother realized a stranger had been speaking to her child for *days*. She physically removed the camera and hasn’t used it since, advising other parents to be cautious of Internet-connected cameras.

Experts explain that this scenario happens because of security flaws in IoT baby monitors. Weak or default passwords, outdated firmware, and poor app security can leave these devices vulnerable to hackers. In some cases, the network itself might be unsecured, making it easier for strangers to access not just the camera but the entire home network. Even well-known models are not immune to these issues, and there are entire search engines dedicated to scanning IoT devices for vulnerabilities.

To prevent incidents like this, experts recommend choosing baby monitors that rely on local video feeds, rather than those that connect over WiFi. Generally speaking, you should try to buy devices that do not require an app for setup and configuration. Although it’s possible for “smart home” devices to be accessed securely when you’re not at home, the level of knowledge required to properly lock them down is not for the casual user and is best left to cybersecurity geeks.

Local-only IoT devices can remove the risk of remote hacking, but still require care and maintenance to keep you safe. It's essential to change default passwords immediately upon setting up IoT gadgets, use secure WiFi encryption, and always check for device updates to ensure security flaws are patched. Educating yourself can help you to protect your family, so try to spend some time reading product reviews and opt for brands with strong security practices.

If an IoT camera is hacked, you should immediately unplug the device and contact customer support and the police. You may or may not want to perform a factory reset depending on the severity of the issue and the legal steps you wish to take: factory reset will likely remove any digital forensics that might be important for your case.

Sharing your story with others can also have a positive impact. The mom who shared her experience on Reddit took a critical step by warning other parents. 💯

🛡️ Ivy Cyber: Understand the ABC’s of Tech

Cybercriminals aren’t just watching parents and babies — they’re going after small businesses and large industry players too. To thrive, you need to know the ABC’s: the risks and rewards of AI, Blockchain, and Cybersecurity.

At Ivy Cyber, we help individuals and businesses take control of their digital footprint. That might mean training your team, testing your systems, crafting an AI strategy, or safeguarding your crypto assets.

🗓️ Book A Free 15 Minute Meeting

We assess your data, identify risks, and design strong defenses and responses to threats. It all starts with a simple conversation. 💬

😳 Your Face Is Not The Problem, Virtual Meetings Are

Virtual meeting fatigue, or “Zoom fatigue,” doesn’t just make you tired of staring at a screen all day: it could also make you feel crappy about your appearance. A new study found that workers who aren’t happy with how they look tend to feel more drained by virtual meetings. As a result, many turn to filters, touch-up tools, and avatars to tweak their on-screen appearance and feel more comfortable.

The study surveyed nearly 2,500 remote workers in the US and found a clear pattern: the more dissatisfied people were with their looks, the more exhausted they felt after video meetings. That exhaustion made them less likely to embrace virtual meetings as a useful tool, highlighting an often-overlooked part of remote work — how self-perception affects engagement with technology.

As organizations continue relying on remote communication, it’s worth considering how these tools impact not just productivity but also confidence and well-being. While this study focused on US workers, the issue is likely much more widespread. Future research could explore how different cultures experience virtual meeting fatigue and what we all can do to make virtual meetings feel more comfortable for everyone.

As remote work keeps evolving, finding ways to reduce digital fatigue could make a big difference in keeping teams engaged and happy. For example, you can start meetings with no cameras on and rely on screen sharing and rotating presenters to keep your team engaged. And, please, try not to substitute long meetings for dedicated work.

These strategies work well for PrivacySafe, and we’re building our own video platform with those lessons in mind. 💻

🦭 Seal Wanders the Streets, Looking for “Ah-Beetz”?

A young gray seal made waves this week when he was stranded in our home base of New Haven, Connecticut, going viral with millions of views. The pup was first found near a seafood restaurant and, after being led back to a beach, was spotted again the next day — only a few blocks from the Elm City’s famous Pepe’s and Sally’s pizzerias.

Police, who first thought the 911 call might be a prank, blocked off the area until marine rescuers arrived. While gray seals are common along the North Atlantic coast, this particular adolescent seemed to be only a few weeks old and malnourished.

New Haven has a long history with seals, and European sailors called a spot in the neighborhood of Fair Haven “Dragon Point” after the sunbathing seals who dwelt there. The newly-arrived baby seal swam upriver from Long Island Sound and may have been looking for shelter from winter storms, just like his ancestors.

It’s likely that the pup was also avoiding predators or even other seals, preferring an icy parking lot to the water. Or, as many locals joked, he was searching for New Haven’s famous “ah-beetz.” That’s the pronunciation of apizza in the local dialect.

Now in the care of Mystic Aquarium, the little wanderer is on a steady diet of fish and fluids. The goal is to help him regain his strength so that he can learn how to hunt on his own. Once he’s ready, he’ll be released back into the wild.

In the meantime, Mystic Aquarium staff plan to give him a proper name, following their 2025 theme of naming animals after bugs. Given his adventure near Yale University’s campus, some have suggested “Boola.” But we’d like to propose something more fitting — and more contentious — start a poll to name him either “Pepe” or “Sally” and let the fans of wood-fired apizza compete for their favorite restaurant! 🍕

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our latest news and releases. We’ve got more public apps fresh out of the oven and you’ll be the first folks who get a taste as we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

Bits On Tape™ is a twice-weekly replay of science & technology stories by cyber experts. These bits are put to screen by Sean O’Brien, leading voice behind privacy and cybersecurity at Yale Law School and founder of Yale Privacy Lab, and edited by Cherise Labonte, science researcher and licensed Registered Nurse.

© Ivy Cyber Consulting LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ and Bits On Tape™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International. Header photo is derived from CC-BY art by ajay_suresh and Hivint Stock Photos.

🎙️ In Bits On Tape, we bring you bytes of science & tech stories to ponder and paraphrase. Consider upgrading or gifting a paid subscription and get the premium perks we roll out all this year. Share and print the accessible version of this issue.

💸 Seniors Spend Less Time Online, Hit Harder By Cybercrime?

Just because grandparents don’t swipe all day on TikTok doesn’t mean they don’t fall prey to cybercrime. A growing body of research shows that, while adults aged 75+ may use the internet less than younger folks, they’re suffering bigger losses when cybercriminals strike. Even more alarming? Seniors are less likely to report these crimes than younger victims. That could be due to fear, shame, or simply not knowing where to turn.

From email phishing to phone scams, fraudsters are targeting seniors relentlessly and that means they tend to experience repeat victimization. Scammers use a mix of old-fashioned fraud, hacking, and social engineering to trick victims into handing over sensitive information or money. Even when individual losses are small, they can add up to big bucks: adults in the UK over the age of 55 lost more than €4 million EUR in a single year.

Phone scams, in particular, are hitting older adults hard. A recent study found that 40% of elderly UK adults receive fraud attempts at least monthly, with 75% of those scams happening via phone calls or texts. In one case, an elderly woman was tricked into writing nearly £100,000 GBP in checks to scammers shortly after her husband passed away. She only got compensated for the losses after her daughter pressured the bank with help from an ombudsman. These constant fraud attempts aren’t just a financial headache: they create stress, fear, and mental health struggles for victims.

So, what’s the fix? Researchers say older adults need better fraud awareness training and a safe, judgment-free way to report scams. As scammers shift their tactics — moving from phone calls to email and text-based schemes, for example —cybersecurity education is key. Helping seniors recognize red flags and empowering them to take action could make all the difference in keeping their savings (and peace of mind) intact.

🛡️ Ivy Cyber: Understand the ABC’s of Tech

Cybercriminals aren’t just targeting the tech-savvy — they’re going after the people and organizations who have the most to lose. To thrive, you need to know the ABC’s: the risks and rewards of AI, Blockchain, and Cybersecurity.

At Ivy Cyber, we help individuals and businesses take control of their digital footprint. That might mean training your team, testing your systems, crafting an AI strategy, or safeguarding your crypto assets.

🗓️ Book A Free 15 Minute Meeting

We assess your data, identify risks, and design strong defenses and responses to threats. It all starts with a simple conversation. 💬

🍺 There Might Be Peas In Your Next Pint

Beer lovers who fancy a sour pint have a reason to celebrate: scientists have discovered a method to speed up the brewing process without sacrificing that signature tart, fruity flavor. The secret ingredient is… peas.

Traditionally, brewing sour beer is a slow and unpredictable process that favors old-world techniques. That might mean using open vats, wooden barrels, wild yeasts, finicky bacteria, or adjuncts such as fruits and berries in the brewing process. Brewers need a ton of experience before perfecting their approach to sours, and both brewers and imbibers need to be patient because proper fermentation can take a while.

But by swapping out the usual malts and starches for pea-derived sugars, the fermentation process becomes faster and more efficient. Researchers found that sugars from field peas, known as raffinose-family oligosaccharides (RFOs), can enhance sour beer production by serving as a carbon source for lactic acid bacteria. Brewing with RFOs led to increased lactic acid, ethanol, and flavor compounds, resulting in fruitier, more acidic beers with intensity comparable to commercial varieties.

The resulting beer packs plenty of flavor, with a great balance of acidity and fruitiness — minus the dreaded "beany" taste that legumes often bring. This pea-powered innovation could be a game-changer for brewers looking to speed up production of sour batches.

So the next time you find yourself in a hip pub with a tulip glass, remember to mind your *peas* and Q’s. 🍻

📰 Get Your News in Our Social App

Rather than dig through social networks that are manipulated by AI algorithms, you can read the latest trends in our sleek and simple news feed. Join our social space and connect with millions of users:

🔆 PrivacySafe Social — A free app with No Ads, No Spyware, No AI Manipulation. We have 8 simple rules and honest, human moderation.

🐬 Dolphins Know How To Throw A Party

More than 1,500 Risso’s dolphins gathered in a spectacular "super pod" off the coast of California, marveling witnesses. Marine biologists watched them leaping, splashing, and tail-slapping, as the aquatic mammals did their best impression of MTV Spring Break.

These deep-diving dolphins usually travel in much smaller groups, making this rare sighting a thrilling surprise. Researchers had set out to track migrating gray whales, but instead found themselves surrounded by playful dolphins stretching as far as the eye could see. The nutrient-rich waters of Carmel Bay, home to a variety of marine life, provided the perfect backdrop for the spectacle.

While the gathering was a joyous sight, experts warn that human-made ocean noise could threaten these social creatures by disrupting their communication. Sightings of Risso’s dolphins in new areas suggest they may be affected by changing ocean conditions and are altering their behavior to adapt.

Dolphins often engage in social behavior that baffles scientists, and it’s not necessarily nice to witness. In a recent example, Amazon river dolphins have been observed in puzzling displays that are definitely a party foul. 😜

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our latest news and releases. We’ve got more public apps fresh out of the oven and you’ll be the first folks who get a taste as we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

Bits On Tape™ is a twice-weekly replay of science & technology stories by cyber experts. These bits are put to screen by Sean O’Brien, leading voice behind privacy and cybersecurity at Yale Law School and founder of Yale Privacy Lab, and edited by Cherise Labonte, science researcher and licensed Registered Nurse.

© Ivy Cyber Consulting LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ and Bits On Tape™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International. Header photo is derived from CC-BY art by Blogtrepreneur.

🎙️ In Bits On Tape, we bring you bytes of science & tech stories to ponder and paraphrase. Consider upgrading or gifting a paid subscription and get the premium perks we roll out all this year. Share and print the accessible version of this issue.

🐣 Thousands Watch Eagle Couple Incubate Eggs on Cam

High in the mountains of Southern California, Big Bear Lake is home to perhaps the most closely-watched bald eagle nest in the world, broadcast 24/7 online. Jackie and Shadow, the region’s famous eagle pair, have once again laid three eggs. Their towering nest is perched 145 feet up in a pine tree and is a symbol of resilience, especially after a year of devastating wildfires across the state. Californian nature lovers can now turn their attention to something hopeful: the countdown to "pip watch" from March 1 to 7, when the first signs of hatching appear.

Jackie and Shadow remain steadfast despite multiple seasons of lost clutches in recent years — braving freezing temperatures, low oxygen levels, and nest incursions. Some visitors such as Fiona the flying squirrel are just a temporary nuisance, while opportunistic birds like ravens can mean the end to their eggs.

The eagles protect the eggs by taking turns incubating, aerating the nest, and using their bodies to shield against snow and rain. As the days pass and anticipation builds, Jackie and Shadow’s journey is a reminder of nature’s perseverance. With hatch day expected in about 22 to 24 days, our eyes are on Big Bear Lake. 🤞

🦉 Condors Make Soaring Comeback

The California condor, once on the brink of extinction, is soaring again over North America’s rugged landscapes. With its nearly 10-foot wingspan, this majestic scavenger has returned to the wild, thanks to decades of dedicated conservation efforts.

This extraordinary comeback was made possible by a bold and controversial strategy: bringing the last wild condors into captivity to breed them for reintroduction. Though it seemed like a desperate measure, the effort paid off, with the first captive-bred condors taking flight in the early 1990s. Innovations in artificial incubation have helped boost their numbers, allowing more condors to be released into the wild.

Despite the clear victories for this species, there are still many challenges. These include dangers introduced by humans, such as lead poisoning from bullet fragments in carcasses that the condors scavenge from. But with a growing wild population and serious efforts to protect their habitat, the dream of a self-sustaining California condor population is closer than ever.

And, let’s face it — who wants to babysit condors forever? 😉

🐱 We’ve Served Up 18K+ Videos — With Lots of Cats

We’ve now delivered over 18,000 videos on StickTock.com, proving that privacy-respecting, censorship-free access to short videos is possible. Many of our anonymous visitors are loading funny and cute clips of pets — including a LOT of cats and kittens.

It’s no surprise that cats dominate our corner of the Internet, and StickTock.com is just one way you can share feline antics. You can post your pets on our PrivacySafe Social community and reach thousands of servers and millions of users, or send your friend a link to an anonymous note with our app PrivacySafe Link. Curiosity doesn’t have to… well, you know the rest. 🐈

🐶 Dog Noses Detect Cancer Early

Dogs aren’t just loyal companions — they’re revolutionizing cancer detection. In a groundbreaking study, specially trained pups showed they could sniff out bladder cancer in canines with up to 90% sensitivity and 95% specificity. In some cases, their noses are proving to be as powerful as high-tech diagnostics, offering a fast and non-invasive way to detect disease early.

Bladder cancer in dogs is often misdiagnosed due to its similarity to other urinary issues, making early detection crucial. Traditional tests can be invasive, expensive, and slow, but these super-sniffers provide a promising alternative.

This research builds on existing evidence of dogs detecting cancer in humans, hinting at a future where "electronic noses" could replicate their life-saving abilities. Scientists hope these findings will lead to more accessible and affordable diagnostic tools for both pets and people.

🐕 We Say Goodbye to Christopher, Our Aussie Chow

Our team has some sad news: the passing of our beloved pet and companion Christopher, a dog who is known by many of our readers and always made friends wherever he went. Christopher was a furry and fantastic doggo, a black-haired mix of Australian shepherd and chow chow with the best features of both breeds. From his fuzzy mane to his magnificent curled tail, he was a big teddy bear with a heart to match. Christopher fought a long battle with cancer and was a good boy even at the bitter end.

Christopher lived to the ripe old dog age of 16, arriving in our lives from a rescue shelter in Georgia about a decade ago. He was well-trained, loved peanut butter sandwiches, and had a happy growl that sounded like Chewbacca.

Christopher would want to see other animals happy and healthy. If you would like to honor his memory, consider donating to the Labelle Foundation’s emergency relief fund for pets affected by the Los Angeles wildfires. And don’t forget to spend a little extra time with your animal buddies today and give them a special treat. 💗

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our latest news and releases. We’ve got more public apps fresh out of the oven and you’ll be the first folks who get a taste as we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

Bits On Tape™ is a twice-weekly replay of science & technology stories by cyber experts. These bits are put to screen by Sean O’Brien, leading voice behind privacy and cybersecurity at Yale Law School and founder of Yale Privacy Lab, and edited by Cherise Labonte, science researcher and licensed Registered Nurse.

© Ivy Cyber Consulting LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ and Bits On Tape™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International. Header photo is derived from the FOBBV livestream.

🎙️ Consider upgrading or gifting a paid subscription and get the premium perks we roll out all this year. Share and print the accessible version of this issue.

🤳 StickTock.com Is Still Up & Running, 16K Videos Later

In just one week, StickTock.com served up an incredible 12,000 videos without any downtime — and kept on running as the US government enacted its ban on TikTok. By the time this newsletter hits your inbox, we’ll have passed the 16K mark in videos served up from Iceland instead of either China or the US. While many Americans scrambled this month to find a secure, censorship-free method of accessing TikTok, the PrivacySafe team proved that another way is possible.

Approximately 26,000 anonymous users watched videos — with an average of 1.6 videos watched. That means most users stuck around to watch more than one video, and it’s proof that there is demand for short video content on privacy-respecting platforms. During that time, our small team of dedicated devs fixed bugs and added features, while actively working with the global open-source community to make StickTock’s software easier to deploy on your own server.

But why listen to us hype it up? Check out what the Internet had to say 👇

🌤️ What Sets StickTock.com Apart? StickTock offers a secure, ad-free experience that prioritizes free speech and user privacy. You can watch TikTok videos without downloading an app or loading any code from TikTok’s servers and can even use a Tor .onion hidden service to access the files completely anonymously. This functionality complements our PrivacySafe Social community and our anonymous sharing app PrivacySafe Link as a trustworthy tool in your privacy arsenal.

💡 Why This Matters: TikTok has not only been banned in the US, it has also been blocked or restricted in the past in places like Canada, New Zealand, Syria, Russia, and Hong Kong. These restrictions raise serious questions about government overreach, free speech, and the vulnerability of centralized platforms. StickTock.com didn’t just survive the chaos of the TikTok ban — it thrived, demonstrating that a decentralized, privacy-first platform can handle real-world demand without folding under pressure.

Where others fail, we rise. 🔥

🌍 Another Social World Is Possible

Are you sick of being trapped in networks dominated by the same billionaire faces and voices? Join our social space and connect with millions of international users:

🔆 PrivacySafe Social — A free app with No Ads, No Spyware, No AI Manipulation. We have 8 simple rules and honest, human moderation.

📷 Open Source Instagram & TikTok Replacements Are Gaining Momentum — And We’re a Diamond Sponsor

The teams at Ivy Cyber and PrivacySafe aren’t the only ones building and shipping awesome open source apps. Pixelfed and Loops are the brainchild of Daniel Supernault and an amazing group of devs who are making waves with a new crowdfunding campaign. Pixelfed and Loops are rapidly-growing platforms for sharing photos and videos, offering user experiences that rival Instagram and TikTok. Pixelfed is positioned as a replacement for Instagram and Loops is a more recent effort to challenge TikTok and other short video services.

We believe these apps are making an important and tangible contribution to the open source ecosystem. That’s why PrivacySafe is supporting these apps as one of four Diamond Sponsors — and the fundraiser has already shattered expectations, breaking through the $100K CAD stretch goal in a couple of weeks.

PrivacySafe Social is one of many servers on the decentralized Mastodon network that utilizes the ActivityPub protocol for social sharing, allowing seamless cross-posting with both Pixelfed and Loops. We believe strongly in these interconnected social communities that are free from Big Tech surveillance and intrusive advertising trackers. By supporting each other, we can stand together as an alternative to the crowded, noisy, and locked-down information system that dominates so much of our lives.

As users increasingly flock away from Instagram and TikTok due to concerns over privacy, algorithmic manipulation, and both government and corporate overreach, Pixelfed and Loops are a breath of fresh air. The recent surge in user activity, which may have resulted in Meta's decision to block links to Pixelfed, highlights the growing demand for decentralized solutions. PrivacySafe's sponsorship is one example of our commitment to supporting projects that champion user autonomy, data sovereignty, and ethical digital interactions.

And, hey, maybe we’ll get videos crossing the “TikTok barrier” by linking up StickTock.com and Loops. Anything is possible. 😉

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our app releases. We’ve got more public apps fresh out of the oven and you’ll be the first folks who get a taste as we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

Bits On Tape™ is a twice-weekly replay of science & technology stories by cyber experts. These bits are put to screen by Sean O’Brien, leading voice behind privacy and cybersecurity at Yale Law School and founder of Yale Privacy Lab, and edited by Cherise Labonte, science researcher and licensed Registered Nurse.

© Ivy Cyber Consulting LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ and Bits On Tape™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International. Header photo includes screenshots of TikTok videos shared by TheRxckStxr.

📢 As TikTok Ban Looms, We Bring You StickTock.com

Anyone with a web browser can now watch TikToks while protecting their privacy:

Watch TikTok Safely

StickTock.com is 100% free and open source software (FOSS) developed by privacy advocates. StickTock.com allows users to view, share, and download TikTok videos without exposing themselves to invasive tracking.

You can also turn TikTok.com video URLs into StickTock.com links just by replacing the word “tiktok” with “sticktock” so that:

https:// www. tiktok .com /@efforg/video/7241629982534126894

can be changed to:

https://www.sticktock.com/@efforg/video/7241629982534126894

…and shared across the web. When a user clicks on the new StickTock.com link, our web app will download and convert the video for you to watch outside of TikTok.

This web app was launched by our small team of developers at PrivacySafe, where we are building a suite of privacy-first solutions. StickTock.com servers are hosted in Iceland, a jurisdiction known for its strong commitment to Internet freedom and data privacy. To help circumvent censorship, we also host a Tor .onion hidden service that can be accessed via Tor Browser.

As our logo hints, StickTock.com is a “band aid” solution. We can’t promise it will persist long after the TikTok ban, but we made it easy to deploy by sysadmins and fork by developers. As the US population scrambles to find access to TikTok videos, we hope StickTock.com will call attention to the vital importance of free speech and digital independence.

🎙️ Information Wants To Be Free. We’re Helping It Flow Freely.

The US Supreme Court will uphold the ban on TikTok in the United States. That sets a dangerous precedent with far-reaching implications for free speech, privacy, and international relations. This ruling will pave the way for similar bans on other foreign-owned platforms, particularly those with connections to countries like China that are viewed as adversaries of the US government.

The maxim “information wants to be free” is not a relic of the 1980’s — it’s a rallying cry for 2025 as our Internet-connected societies face growing restrictions on information access. Across the globe, populations are subject to national bans on content, platforms, and apps. Now it seems the US population will be cut off from the billions around the world who use TikTok to communicate and publish.

❤️ Consider upgrading or gifting a paid subscription. Share the accessible version.

The US is sending a worrisome message to the world by putting digital shackles on its population. TikTok is a medium for 170 million Americans to share ideas, art, news, and opinions. About half of the US adults on TikTok get their news there. And, because “information wants to be free,” many of those adults are not only resorting to frenzied downloads of TikTok before its removal from app stores — they’re flocking to other apps like RedNote that give them access to Chinese social spaces.

Downloads of RedNote are approaching 1 million, as TikTok users make their point clear. Even though the app could be blocked under the same statute that mandates a TikTok ban, and there are serious questions about RedNote’s privacy, a significant portion of the US population wants to use Chinese apps.

👁️‍🗨️ We Know TikTok Has Privacy Issues. That’s Why We Made StickTock.com

TikTok has been accurately criticized as a privacy problem, but the US government’s national security concerns remain vague and insufficiently documented to justify a ban. TikTok bakes adtech trackers into its apps that collect and monetize user data. That’s a problem that is very real and needs to be addressed, but it’s also an issue that is rampant across the smartphone app ecosystem.

Adtech spyware is central to the trillion-dollar fortunes of Big Tech companies like Meta, who own Facebook and Instagram. Google is notorious for inventing invasive methods of user tracking, Apple was recently caught red-handed eavesdropping on conversations, and Microsoft’s privacy transgressions could fill a warehouse.

It’s precisely because the PrivacySafe team knows apps like Facebook and TikTok don’t respect the privacy of users that we make tools like StickTock.com. The driving force behind this new app is Sean O’Brien, founder of Yale Privacy Lab and Research Fellow at Yale Law School. At the end of December, Sean joined 34 other academics in an amicus brief on the US Supreme Court case, which argues convincingly that the TikTok ban is “shocking” overreach and that “free speech consequences are thus serious and wide-ranging.”

Sean is a security researcher who is no stranger to the issues with app surveillance. He has spent much of the past decade exposing hidden trackers in smartphone apps and calling attention to information leaks.

💻 Open Source Is Vital for Privacy, Security, and Access to Information

Our team at PrivacySafe is building a suite of apps that are 100% free and open source software (FOSS). Such FOSS apps foster transparency by allowing anyone to inspect the code for vulnerabilities or backdoors, enhancing community-driven security audits. This transparency builds trust, encourages rapid bug fixes, and empowers users and developers to collaborate in strengthening defenses against cyber threats.

Releasing our code under a FOSS license is a good way to ensure that it persists far into the future. We want StickTock.com to be improved and built upon over time, and we encourage our repos to be branched and forked just as we remixed an earlier codebase. We want to thank developer MarsHeer for taking the initial steps that made StickTock.com possible and we have released our updated codebase under the GNU AGPLv3 to ensure it stays free.

Mikalai Birukou of 3NWeb and PrivacySafe has pulled all-nighters to improve the stability of our app and make it as portable as possible. The speed that allows us to ship StickTock.com so quickly is only possible because of the power of FOSS collaboration.

We should also mention ProxiTok, the once-popular FOSS frontend for TikTok. We hope StickTock.com might be useful to help iron out the issues ProxiTok has been facing with the fetching of TikTok videos.

The world of FOSS is really powerful, and our apps are just a small part of it. There is now an exciting FOSS project called Loops, a video platform with a TikTok-like interface that publishes to the “fediverse” — connecting it to communities like our own PrivacySafe Social.

PrivacySafe hosts a publicly-available StickTock API that is open for developers to plug their apps into it. That might also mean a bridge between TikTok and other platforms. It would be great to see TikTok videos shared freely across FOSS communities via open API standards.

💪 The Bottom Line: There’s Strength In Numbers

At a time when Americans face the prospect of losing a platform they use daily for self-expression, StickTock.com demonstrates the power of open-source technology to preserve access to content while prioritizing privacy and security. When communities of speech and privacy advocates copy, remix, and share, they become much stronger than isolated individuals. If we want global conversations that embody the potential of the Internet to continue, we have to engineer around barriers and build new methods of protecting speech.

Information wants to be free, and StickTock.com is proof that privacy and access aren’t mutually exclusive.

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our app releases. We’ve got more public apps fresh out of the oven and you’ll be the first folks who get a taste as we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @privacysafe
• Telegram: Bits On Tape
• Blue Sky: @privacysafe.social
• Twitter X: @GetPrivacySafe
• LinkedIn: PrivacySafe

© Ivy Cyber Consulting LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ and Bits On Tape™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International. Header photo includes screenshots of TikTok videos shared by funny.rowena.

🎙️ In Bits On Tape, we bring you bytes of science & tech stories to ponder and paraphrase. Consider upgrading or gifting a paid subscription and get the premium perks we roll out all this year. Share and print the accessible version of this issue.

👨‍⚕️ Doctor Strange’s Multiverse of Privacy Madness

When we rewatched Marvel’s 2016 film Doctor Strange, we couldn’t help but notice a glaring issue. Why does the wizard protagonist, Doctor Stephen Strange, continually trample on healthcare privacy?

Strange’s journey into wizardry is motivated by his near-fatal car crash — featuring a baffling scene where he casually examines patient X-rays on a display inside his supercar. Setting aside the obvious dangers, Strange’s decision to review medical results while driving raises serious ethical questions. It’s hard to imagine patients would be thrilled knowing their critical health info is being handled so carelessly.

While recovering from his injuries, Strange clashes with a hospital orderly who challenges the grim prognosis for his hands. The orderly, determined to prove Strange wrong, mentions the name of a former patient, Jonathan Pangborn, who miraculously cured his quadriplegia. Then the orderly escalates the situation, offering to grab Pangborn’s file and share it with Strange.

Under HIPAA, sharing a patient’s protected health information (PHI) without authorization is illegal unless specific exceptions apply. For example, data can be disclosed for treatment purposes, research (with specific safeguards), or when required by law. None of these apply in the film’s scenario.

Even if Strange used to work for the hospital that treated Pangborn, HIPAA requires stringent controls on PHI access. Employees can only view patient records when necessary for their specific job tasks. Strange, no longer practicing medicine at this point in the story, wouldn’t have had any legitimate reason to access Pangborn’s file. If this scenario occurred in real life, both the orderly and the hospital would face severe penalties.

The cinematic origin of the Sorcerer Supreme offers all the trappings of a great superhero story: arrogance, downfall, redemption, and… blatant violations of patient privacy. Our hero stomps over healthcare regulations (and common sense) faster than he can conjure a portal.

🎩 Avoid Big Tech’s Spells in Our Social Network

If you’re sick of your life being studied by nosy wizards with selfish intentions, join our social space and connect with millions of users:

🔆 PrivacySafe Social — A free app with No Ads, No Spyware, No Timeline or AI Manipulation. We have 8 simple rules and honest, human moderation.

📱 Apple Grapples with USB Cable Laws & Exploits

Apple’s relationship with USB-C has been anything but smooth, especially in the European Union. The drama concluded last year with the EU Common Charging Directive, which took effect at the end of December and mandates USB-C ports for most gadgets. The regulation is aimed to increase interoperability and simplify device charging. Proponents hope to reduce electronic waste and planned obsolescence, as well as limit vendor lock-in from device-specific cables.

As a result, Apple had to yank the iPhone 14, iPhone 14 Plus, and third-gen iPhone SE from EU shelves. The iPhone 15 lineup has USB-C ports, but Apple’s compliance strategy (or lack thereof) has been a bumpy road.

While Apple grapples with regulatory changes, security researchers have their eyes on something more electrifying: Apple’s new ACE3 USB-C controller, introduced with the iPhone 15. Apple beefed up security for the ACE3 compared to its predecessor, the ACE2, adding cryptographic validation and personalized firmware. Despite these additions, security researchers managed to crack the system using techniques like electromagnetic fault injection to bypass its defenses.

Though the attacks aren’t easy to pull off (at least not yet) the results are scary. Hacking the ACE3 can mean untethered “jailbreaks” and persistent firmware implants, which basically means that attackers can install all kinds of nasties on your iDevice. Malware injected via these methods could not only allow bad actors to snoop on your data, they could take full control of your device.

These hacking techniques also highlight a growing trend: as software gets harder to exploit, attackers must turn to hardware and “side channel” attacks. Apple now faces pressure to rethink its chip shielding and detection measures.

Maybe the solution is re-introducing Apple’s lightning cable? 😉

🐯 Phishing Scams Trap Australian Cat Chasers

It all starts with an innocent question: “Are Bengal Cats legal in Australia?” Maybe you’re daydreaming about owning a colorful feline — but type that question into Google and it could be the start of a cyber nightmare. Hackers have begun to turn seemingly-niche queries into the bait for sophisticated cyberattacks, proving that even the most innocent searches can have serious consequences.

A top UK cybersecurity firm sounded the alarm, warning Internet users to steer clear of search results about bengal cats in Australia. The top links might look legitimate, like a blog or legal guide, but they’re anything but safe. Clicking them allows hackers to deploy malware that can steal personal information like bank details or lock you out of your own computer. Cybersecurity experts call this kind of attack “SEO poisoning.” Malicious hackers figure out clever ways to manipulate search engine algorithms and push their dodgy sites to the top of the results.

It’s not just cat queries that cyber criminals are exploiting. Scammers are constantly upping their game and targeting the devices in our pockets. iPhone users are now being sent “smishing” SMS texts disguised as urgent notices. Topics might include threats about unpaid road tolls or shipping issues — a message that spurs reflexive action on the part of the recipient. A victim could be convinced, for example, to disable iMessage safeguards.

Some messages warn of “excessive late fees” and a “possible lawsuit” if payment isn’t made immediately. The odd phrasing might raise a red flag for some, but victims who are worried or distracted will trigger the malicious trap. Once the scammer gets a reply, they know the number is active, opening the door to more targeted attacks.

The lesson? Pause and take 9 seconds before you click, download, or share. If you’re concerned about an issue, try to find an official website or verified source that confirms the information you’ve been told. Remember: curiosity doesn’t have to kill the cat.

🕵️ Create Secret Notes with PrivacySafe Link

Last week we released a free app — PrivacySafe Link, your tool for sharing secret notes via a password-protected link. Back by popular demand, we’re giving you a rundown of its key features, below.

• Self-Destructing Notes: By default, notes disappear after one view by the person you share the link with. You can also set a custom number of views.

• Client-Side Encryption: Your note is encrypted inside your web browser, on your device, so our server has no idea what you type or paste.

• Strong Passwords: Your PrivacySafe Links are automatically secured by a strong password generated on your device, not our server.

Go-Go-Gadget Privacy

Remember Inspector Gadget, the 80’s cartoon detective with the exploding messages? Now your messages can self-destruct too!

1. ✍️ Write Your Mission Brief
   Visit privacysafe.link and type your note. Choose how many times it can be viewed or set a time limit (in seconds).

2. 🔗 Copy Your PrivacySafe Link
   Your note is encrypted on your own device, creating a PrivacySafe Link that can be shared. You can copy the link and the password separately (best practice) or copy them both together as a long URL (simpler).

3. 💌 Deliver Your Message
   Share with your recipient — preferably in an app with strong encryption. If you share over an insecure channel like email, at least you know the data will self-destruct.

4. 🍸 Mission Accomplished
   Once the PrivacySafe Link self-destructs, sit back and enjoy a vodka martini.

Don’t Get Burned!

• Share Smart: Use encrypted messaging apps to share with your recipient. If you use Tor Browser, you can also try our Tor .onion hidden service.

• Be Patient: Avoid the urge to check your link so it won’t self-destruct early.

• Split the Info: If both the link and password are intercepted, someone could read the note before your intended recipient. Splitting the information over separate apps or communication channels is better operational security.

• Keep Backups: Your data will self-destruct and is gone forever — our server can’t read the note, can’t identify the link, and doesn’t make copies.

Why You’ll Love It

Need to pass along a heartfelt message, your class notes, or a funny meme? PrivacySafe Link is for messages you want to stay private and temporary, with the simplicity and security that would make Inspector Gadget say, “Wowzers!” 💥

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our app releases. We’ve got more public apps fresh out of the oven and you’ll be the first folks who get a taste as we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

Bits On Tape™ is a twice-weekly replay of science & technology stories by cyber experts. These bits are put to screen by Sean O’Brien, leading voice behind privacy and cybersecurity at Yale Law School and founder of Yale Privacy Lab, and edited by Cherise Labonte, science researcher and licensed Registered Nurse.

© Ivy Cyber Consulting LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ and Bits On Tape™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International. Header photo is derived from CC-BY art by Inchka with CC0 / Public Domain art by GDJ.

🎙️ In Bits On Tape, we bring you bytes of science & tech stories to ponder and paraphrase. Consider upgrading or gifting a paid subscription and get the premium perks we roll out all this year. Share and print the accessible version of this issue.

💀 Zuckerberg’s Zombie AI Profiles Bite the Dust

The experiment with “zombie” AI-generated profiles on Facebook and Instagram by its parent company Meta has officially flatlined after widespread backlash. The artificial accounts, introduced clandestinely in 2023 and 2024, were supposed to revolutionize social media by standing in for real people with convincing bios, profile pics, and machine-made content. Unleashed by Meta as the opening salvo of a grander AI strategy, they shuffled aimlessly through users’ feeds like supernatural trolls who never rest from spamming.

The gods of Facebook and Instagram envisioned an undead army of AI-generated NPCs marching across their platforms in a reckless demo of the “Dead Internet Theory” but the plan was met with horror and mockery after being revealed to the public. Meta has now removed the AI-generated profiles, or at least the ones that had been widely published across the web. Hundreds of thousands of characters were created, though most remain known only to Meta. Perhaps they’re ready for future resurrection of the concept?

Meta is not done with AI and is now pivoting to more familiar wizardry, like AI-powered photo editing and text-to-video features. In fact, the company is doubling down and might already be creating digital doppelgangers of you. Instagram has launched an experiment where AI places clones of users in strange scenarios and publishes those photos to their feeds — at least one Insta user was shocked to find bizarre photos depicting his clones in a maze of mirrors.

Don’t be surprised when the AI zombies rise again on Big Tech platforms, perhaps wearing a familiar face…

❤️ A Social Network For Humans

While Meta tests its AI illusions, decentralized apps continue to breathe new life into social networks — by keeping things human. If you’re sick of being subject to experimental AI agents, join our social space to connect with millions of users:

🔆 PrivacySafe Social — A free app with No Ads, No Spyware, No Timeline or AI Manipulation. We have 8 simple rules and honest, human moderation.

🐭 Mickey Squeaks Into Public Domain in 2025

Each January brings a fresh wave of creative freedom as previously-copyrighted works enter the US public domain. For 2025, this includes literature, films, music, and art from 1929 as well as sound recordings from 1924. These works are now free to be remixed and shared without copyright restrictions.

Highlights include iconic novels like Virginia Woolf’s To the Lighthouse, Ernest Hemingway’s A Farewell to Arms, and William Faulkner’s The Sound and the Fury. The era’s evolving film industry contributed classics like On With the Show! — the first all-color, sound feature — and Buster Keaton’s final silent film, Spite Marriage. Popular music gems like Singin’ in the Rain and Tiptoe Through the Tulips will also join the fray.

Disney fans can now freely remix and share some early Mickey Mouse shorts as well as the Silly Symphony cartoon The Skeleton Dance. While culturally significant, these works only include the versions of these characters from the 1920’s, leaving later iterations by the House of Mouse under lock-and-key.

There are many other public domain releases this year including early appearances of beloved characters like Popeye the Sailor and Tintin, though debates persist over the copyright status of specific incarnations. Could we soon see these versions of the ‘toons teaming up in a fan-made “cinematic universe”?

🕵️ Create Secret Notes with PrivacySafe Link

We’ve released another free app — PrivacySafe Link, your tool for sharing secret notes via a password-protected link.

• Self-Destructing Notes: By default, notes disappear after one view by the person you share the link with. You can also set a custom number of views.

• Client-Side Encryption: Your note is encrypted inside your web browser, on your device, so our server has no idea what you type or paste.

• Strong Passwords: Your PrivacySafe Links are automatically secured by a strong password generated on your device, not our server.

Go-Go-Gadget Privacy

Remember Inspector Gadget, the 80’s cartoon detective with the exploding messages? Now your messages can self-destruct too!

1. ✍️ Write Your Mission Brief
   Visit privacysafe.link and type your note. Choose how many times it can be viewed or set a time limit (in seconds).

2. 🔗 Copy Your PrivacySafe Link
   Your note is encrypted on your own device, creating a PrivacySafe Link that can be shared. You can copy the link and the password separately (best practice) or copy them both together as a long URL (simpler).

3. 💌 Deliver Your Message
   Share with your recipient — preferably in an app with strong encryption. If you share over an insecure channel like email, at least you know the data will self-destruct.

4. 🍸 Mission Accomplished
   Once the PrivacySafe Link self-destructs, sit back and enjoy a vodka martini.

Don’t Get Burned!

• Share Smart: Use encrypted messaging apps to share with your recipient. If you use Tor Browser, you can also try our Tor .onion hidden service.

• Be Patient: Avoid the urge to check your link so it won’t self-destruct early.

• Split the Info: If both the link and password are intercepted, someone could read the note before your intended recipient. Splitting the information over separate apps or communication channels is better operational security.

• Keep Backups: Your data will self-destruct and is gone forever — our server can’t read the note, can’t identify the link, and doesn’t make copies.

Why You’ll Love It

Need to pass along a heartfelt message, your class notes, or a funny meme? PrivacySafe Link is for messages you want to stay private and temporary, with the simplicity and security that would make Inspector Gadget say, “Wowzers!” 💥

🙏 Thank You For Reading!

Join PrivacySafe Social to keep up with our app releases. We’ve got more public apps fresh out of the oven and you’ll be the first folks who get a taste as we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

Bits On Tape™ is a twice-weekly replay of science & technology stories by cyber experts. These bits are put to screen by Sean O’Brien, leading voice behind privacy and cybersecurity at Yale Law School and founder of Yale Privacy Lab, and edited by Cherise Labonte, science researcher and licensed Registered Nurse.

© Ivy Cyber Consulting LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ and Bits On Tape™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International. Header photo is CC0 / Public Domain by Merlin2525 & GDJ.

🎉 In this inaugural issue of Bits On Tape, we bring you bytes of science & tech stories to boost your weekend. Consider upgrading or gifting a paid subscription and get the premium perks we roll out in 2025. Share and print the accessible version of this issue.

🦷 Is There A Mastodon Tooth In Your Backyard? Maybe If You’re A New Yorker.

When most people think of treasure in their backyard, they imagine hoards of hidden coins — not the bones of a prehistoric mammal. Two lucky homeowners near Scotchtown, New York unearthed exactly that: a gigantic jaw from an animal that went extinct roughly 11,000 years ago.

The fossil specimen belonged to an adult mastodon, a distant relative of modern-day elephants and the ancient woolly mammoths popularized in cartoons and roadside attractions. Last September, an anonymous couple in New York noticed enormous teeth sticking out of the mud in their yard and called in the experts from New York State Museum and SUNY Orange. The team of paleontologists recovered a jaw, a toe bone fragment, and part of a rib and they suspect there are more bones nearby.

Details about the exact location of the find are being kept under wraps, probably to avoid a rush of TikTokers and Redditors looking for a prehistoric souvenir. The find further solidified Orange County’s reputation as a hotspot for mastodon fossils, which started way back during the U.S. Revolutionary War with the discovery of a trove of bones. George Washington is reported to have owned a fossil tooth himself and rushed to view mastodon bones in New York during the winter of 1780. Over 150 mastodon specimens have been found across New York State to date, and there’s every reason to expect there will be more as time goes on.

🎁 Uncover Your Own Mastodon Treasure Trove on PrivacySafe Social

As folks flock away from the chaos on Facebook, the cacophony on Threads, and the combat on Twitter X, we’re offering you a better option:

🌤️ PrivacySafe Social — A social app with No Ads, No Spyware, No Timeline Manipulation, and No AI.

Membership on PrivacySafe Social is a perk for Bits On Tape subscribers, and you can request an account today. Our community connects you with 1,000+ servers & millions of users in the decentralized Mastodon network. We operate under guidelines that promote safe and respectful discussion and intend to be a bright light in the “fediverse” — a global network that is growing by the millions as people run toward the exits from Big Tech. Check out our modifications to Mastodon at this source code repo.

Our Commitment To You:

1. We Will Never Serve You Ads: We believe the Internet should have no advertising surveillance. You deserve a community without ads, distractions, and clutter.

2. We Will Never Spy On You: Your privacy is paramount and our founder is an expert in the field. We will never conduct click-tracking, install spyware, or analyze your speech, behavior, mood, or face.

3. We Will Never Manipulate Your Timeline: Your feed is displayed chronologically. We do not artificially promote posts or spam your timeline and give you the power to filter your own feeds.

4. We Will Never Incorporate AI: What you do with Artificial Intelligence is your business, but it's not our business. PrivacySafe has made a conscious effort not to include AI agents or dependencies like OpenAI in our apps.

We take active steps to protect your privacy and we have 8 simple rules, honest moderation, and zero fees.

💍 Sloth Bone Jewelry Was Traded in Ancient American Social Networks

Long before hashtags and followers, ancient humans in North and South America were creating their own social networks — with collections of sloth bone jewelry as their version of shopping hauls. Researchers have uncovered polished sloth osteoderms, bony plates from the backs of the animals, in Brazil’s Santa Elina caves. These sloth bones were crafted into pendants an astonishing 27,000 years ago and predate the famed Clovis culture by over 10,000 years.

In today’s hyper-connected world, we signal our identities and affiliations across social media profiles with hashtags, posts, and selfies. For ancient humans, artifacts such as bone pendants likely served a similar role and marked group membership, status, and shared experiences. These early adornments suggest that communities weren’t just focused on survival. Ancient humans were building social ties and shared traditions, laying the groundwork for cultural networks that spanned vast regions.

New evidence suggests this was happening in the Western Hemisphere much earlier than scientists thought. The widely-accepted “Clovis-first” theory had posited that humans arrived in the Americas around 13,000 years ago, but evidence from Monte Verde in Chile, White Sands in New Mexico, and now Santa Elina in Brazil paints a more complex and much older picture. Advanced fossil dating shows sloth bones were shaped into pendants shortly after the deaths of the animals and marks of fire on the specimens hint at human activity long before the Clovis era, upturning our traditional understanding of human settlement of the Americas.

🙏 Thank You For Reading Our First Issue!

Break free from prehistory and join PrivacySafe Social to keep up with our app releases. We’ve got 4 public apps fresh out of the oven and you’ll be the first folks who get a taste when we announce them.

🌍 Find Us Around the Web

We’re getting our message out on:
🌞 PrivacySafe Social: @bitsontape
• Telegram: Bits On Tape
• Blue Sky: @bitsontape.com
• Twitter X: @BitsOnTape
• LinkedIn: Bits On Tape

Bits On Tape™ is a twice-weekly replay of science & technology stories by cyber experts. These bits are put to screen by Sean O’Brien, leading voice behind privacy and cybersecurity at Yale Law School and founder of Yale Privacy Lab, and edited by Cherise Labonte, science researcher and licensed Registered Nurse.

© Ivy Cyber Consulting LLC. This project is dedicated to ethical Free and Open Source Software and Open Source Hardware. Ivy Cyber™ and Bits On Tape™ are pending trademarks and PrivacySafe® is a registered trademark. All content, unless otherwise noted, is licensed Creative Commons BY-SA 4.0 International. Header photo is CC0 / Public Domain by mothsart & GDJ.