[Plura-list] Autodoxing

Mon Nov 2 03:22:03 EST 2026

Read today's issue online at: https://pluralistic.net/2026/11/02/agony-verification/

Today's links

* Autodoxing: The road to hell is paved with badly thought-through tech policy.

* Hey look at this: Delights to delectate.

* Object permanence: Shakespeare programming language; DeCSS is "pure speech"; Blue Coat sold surveillance tools to Syrian secret police; "Extraordinary Catalog of Peculiar Inventions"; Cable prices rose at double the rate of inflation for 20 years; Supercuts; Antivax x Trump.

* Upcoming appearances: Kilkenny, Courtenay, Vancouver, Folkestone, Oxford, Sheffield, Virtual, Oxford, Montreal.

* Recent appearances: Where I've been.

* Latest books: You keep readin' em, I'll keep writin' 'em.

* Upcoming books: Like I said, I'll keep writin' 'em.

* Colophon: All the rest.

->->->->->->->->->->->->->->->->->->->->->->->->->->->->->->

🏤 Autodoxing

After 25 years of fighting for human rights amid the wreckage of bad tech policy, I'm here to tell you that the road to hell is paved with badly thought-through tech policy.

The most galling thing about this wreckage is that it was both foreseeable *and* foreseen. Back when Sun Microsystems CEO Scott McNealy was telling the world "Privacy is dead, get over it," digital rights advocates were saying, "Not only are digital tools pretty dang good at helping you protect your privacy, but a society-wide abolition of privacy sets us up for infinite harms long into the future":

https://pluralistic.net/2025/10/31/losing-the-crypto-wars/#surveillance-monopolism

It wasn't just business leaders who hated privacy, it was also our political classes. Bill Clinton tried to put a backdoor into *every* microchip (no, really):

https://en.wikipedia.org/wiki/Clipper_chip

The NSA managed to enact a total prohibition on civilian access to working encryption, on the grounds that we're all safer if our spooks can spy on "bad guys" even if that means that every creep, petty crook, corporate or state-sponsored spy, and mafia can spy on *us*:

https://pluralistic.net/2026/04/09/bernstein-2/#win-some-lose-some

Even after that ban was overturned, governments encouraged the private sector to spy on us without limit, precaution or permission. Those private-sector troves of intimate, compromising data about every person alive constitute a warrantless, off-the-books surveillance system that cops, spies and government agencies can tap at will:

https://pluralistic.net/2026/10/13/petards-r-us/#nobus

To protect these surveillance capabilities, private firms and governments colluded to pass "anticircumvention" laws that make it illegal to reverse engineer our devices and apps to add privacy blockers to them, with the effect that every device we own and every app we use spies on us constantly:

https://pluralistic.net/2024/03/12/market-failure/#car-wars

At the same time, states either failed to pass new privacy laws (as in the USA, where federal consumer privacy law was last updated in 1988), or passed privacy laws that went unenforced (as in the EU, where "pretending to be Irish" allows US tech giants to flout EU privacy law):

https://pluralistic.net/2023/05/15/finnegans-snooze/#dirty-old-town

Our surveillance free-for-all world is objectively very bad. Over and over, companies and agencies who have been permitted to nonconsensually harvest and retain our data demonstrate that they are not capable of keeping that data safe, and no matter how badly they fuck up, nothing changes. It's been nearly a decade since Equifax doxed *148 million* Americans and not only is the company still in business, they've been permitted to buy up and absorb *more* commercial surveillance firms.

US regulators let Equifax buy Teletrack in 2021. Canadian regulators let them buy the Food Industry Credit Bureau in 2023. The same year, Brazilian regulators let Equifax buy Boa Vista Serviços. This all despite the fact that Equifax blamed its breach on shitty security practices after a string of mergers that led to it haphazardly combining databases from newly acquired surveillance companies.

Data isn't the new oil. Data is the new oily rag: profitable only if you can warehouse it in vast quantities under unsafe conditions and have society pick up the bill for every conflagration:

https://locusmag.com/feature/cory-doctorow-zucks-empire-of-oily-rags/

Equifax is a serial reoffender, but rather than getting the corporate death-penalty, they've been made to pay coins-down-the-back-of-the-sofa fines that amount to a fraction of a fraction of a fraction of the costs they imposed on society by amassing these vast, flaming storehouses of oily rags.

Why *wouldn't* Equifax reoffend? Our policymakers keep demanding *less* privacy, not more, and their indifference to the consequences is (almost) comical.

Take Malcolm Turnbull, the former Australian Prime Minister who uttered what remains, without a doubt, the single stupidest thing anyone anywhere has *ever* said about tech policy. Like many of his peers before, during, and since his reign, Turnbull had been trying to outlaw working encryption, insisting that every device have a Bill Clinton-esque back-door for the purpose of spying on "bad guys." When told that the laws of mathematics dictated that any measure that let Australia's cops spy on "bad guys" would also let bad guys spy on Australians, Turnbull replied, "The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia":

https://www.newscientist.com/article/2140747-laws-of-mathematics-dont-apply-here-says-australian-pm/

We could laugh Turnbull off...if he was an outlier. But while Turnbull had the world's stupidest rejoinder to the scientifically irrefutable fact that banning encryption will let bad guys hack *everything*, he was hardly alone in wanting to ban encryption. Banning encryption is *current* policy in Canada:

https://blog.mozilla.org/netpolicy/2026/10/08/canadas-bill-c-22-threatens-encryption-users-privacy-and-the-security-of-digital-economies/

It's also current policy in the UK:

https://pluralistic.net/2023/03/05/theyre-still-trying-to-ban-cryptography/

And in the EU:

https://fightchatcontrol.eu/

The difference between Malcolm Turnbull and, say, Canadian PM Mark Carney is that Turnbull was stupid enough to try to defend his ban on encryption, while Carney simply shakes his head at his critics' naivete and continues to press forward with his catastrophic proposal to welcome every cybercriminal in the world to hack every morsel of Canadian data.

When it comes to bad privacy policy, our political classes aren't content to rest on their laurels: hardly a week goes by without news of a new way to encourage (or even *require*) the private sector to recklessly collect and retain our data, despite the *dead certainty* that this data will eventually end up breaching and getting plastered all over the internet.

Take "age verification" laws. There's no such thing as "age verification" - there's just spying on *everyone*, all the time, creating (even more) records of all of our internet activities:

https://pluralistic.net/2026/05/19/shes-dead-of-course/#consensus-hallucination

Every promise of "privacy preserving" age verification is bullshit:

https://pluralistic.net/2025/08/14/bellovin/#wont-someone-think-of-the-cryptographers

If you think kids are experiencing internet harms today, just wait until we expose them to the harms of having even more of their data harvested, stored, breached, and weaponized against them:

https://pluralistic.net/2026/06/23/destroy-the-village/#to-save-it

If you want to protect kids from algorithmic manipulation and targeting by bad actors, what about *banning spying on kids* so no one can target them?

https://made-not-found-by-danah-boyd.ghost.io/no-one-paid-me-to-disagree-with-jonathan-haidt-it-was-teenagers-who-taught-me-that-he-was-wrong/

Now, at this point, you might be thinking, "How can we know who the kids are so we know who not to spy on?" You can't. In order to not spy on kids, you'd just have to not spy on *anyone*:

https://pluralistic.net/2023/04/09/how-to-make-a-child-safe-tiktok/

"Don't spy on anyone" is the kind of thing that has a reasonable chance of enhancing online privacy. But in the time-honored tradition of "we've tried nothing and we're all out of ideas," governments keep finding ways to make digital privacy *worse*, for example, by procuring Flock cameras for every lamp-post:

https://www.eff.org/deeplinks/2026/09/high-crime-lmao-how-cops-are-treating-mass-surveillance-joke

And then there's UK Labour: after the success of a pilot program for an incredibly effective and safe privacy-preserving way of analyzing the country's health records for research processes, they commissioned the Goldacre Report to evaluate the possibility of making this permanent:

https://pluralistic.net/2024/03/08/the-fire-of-orodruin/#are-we-the-baddies

After that report was completed and had a chance to be metabolized by policymakers, Labour acted upon it...by throwing it out and handing all of the country's health data to Palantir, a serial mishandler of data and violator of privacy:

https://www.theguardian.com/technology/2026/sep/30/legal-objections-palantir-nhs-platform-handling-data

Here's the scariest thing about bad privacy policy: it has a long fuse. The harms of commercial and private-sector digital surveillance can occur years or even *decades* after the decision to permit it.

There's a straight line from the post-9/11 decision to encourage public agencies to gather, merge and warehouse data on every person in America, and the ability of ICE ethnic cleansing squads to break down people's doors and drag them off to concentration camps; just as there's a straight line from the decision to do nothing about the breach of every Social Security Number and the later theft of all Social Security data by adolescent DOGE criminals:

https://www.pcmag.com/news/is-your-ssn-in-the-national-public-data-breach-heres-how-to-find-out

But despite how obvious these connections are, the fact that they're separated by a lot of time and space provides our policymakers with cover for making terrible decisions with foreseeably terrible outcomes. As a society, we lack object permanence, the ability to connect acts in the past with present-day phenomena.

When the press reports on a "Black October" of catastrophic, AI-fueled data breaches and hack attacks, they don't mention a generation of policymakers' indifference and hostility to information security:

https://pluralistic.net/2026/09/12/god-in-the-box/#llms-are-fake

Policymakers benefit from politics' eternal *now*, in which disasters simply *befall* us, without any history or precedent or cause. Remember the One Big Beautiful Bill? Its architects designed it to wreak its worst harms after the midterms, with Medicaid work rules and food aid restrictions starting in December, and cuts to affordable housing and rural hospitals phasing in through the year:

https://www.tumblr.com/mostlysignssomeportents/832146932089700352

Black October is going to give way to Black November, Black December, Black 2027, and the Black 2030s - a string of cybersecurity catastrophes that will befall us until policymakers decide that keeping us safe is more important than making it easy for them to attack their chosen "bad guys."

Here's a preview of Black November: there's a new strain of the Volta infostealer malware that uses AI tools to dox you even as it hacks you:

https://www.wired.com/story/kernel-panic-volta-autodoxer-ai-infostealer-malware/

How that works: your computer gets hacked and your data gets stolen, then it gets merged with breach data from Ticketmaster, Disney, AT&T and other companies that have recklessly compiled vast troves of data on all of us, stored it insecurely, and leaked it onto the internet where it will live forever.

Volta's makers prompt their LLM "to act like an intelligence analyst and produce structured citation-backed assessment of the victim." This lets the criminals prioritize their victims based on the expected return from exploiting them. It augments this dossier by combing through your Gmail as well as your Doordash and Uber Eats profiles. This merged data makes it much easier for criminals to call you up or email you (or have a chatbot call you up or email you) and trick you into giving up even *more* data:

https://pluralistic.net/2024/02/05/cyber-dunning-kruger/#swiss-cheese-security

Volta seems especially interested in *younger* internet users, targeting "Discord, Telegram, Steam, and Roblox sessions." Of course, once our "age verification" services breach vast, eternally persistent, detailed troves of data on young internet users, this kind of AI-supercharged malware will be able to target kids with *much* greater fidelity and efficacy.

AI capabilities have made infostealers *much* worse, but the *reason* for that new potency lies in how AI capabilities are supercharged by breach data that is the foreseeable *and* foreseen consequence of generations of hostility to privacy on the part of policymakers and corporations who responded to the incentives policymakers created.

We are living in the age of oily rags. For decades we fucked around with letting the private sector warehouse our data and weaken our security so that public sector agencies could plunder our data and our computers at will. Now, we keep finding out that everything is on fire.

It's going to take a long time to fix this, but we can do it. We can build more secure systems. We can make it *much* more of a legal ball-ache for companies to gather our data in the first place, and we can legalize and promote the creation of privacy blockers for browsers, phones, computers, cars, thermostats and smart speakers. We can enact corporate death-penalties for breaches that reflect the *true* societal cost of warehousing our data. We can ban Flock cameras and tear down the post-9/11 "fusion centers" that neatly package up our data for use by DOGE fascists and ICE thugs. We can ban our spy agencies from hoarding defects in widely used software, and instead require them to divulge these bugs so vendors can fix them:

https://en.wikipedia.org/wiki/NOBUS

And before we do any of that, we can *just stop making it worse* by ending the campaigns to *require* companies to spy on us and deliberately introduce security defects into their products.

->->->->->->->->->->->->->->->->->->->->->->->->->->->->->->

🏤 Hey look at this

* ICE wants its mask back, and hired a company to ask https://blog.flokinet.is/2026/10/29/ice-wants-its-mask-back-and-hired-a-company-to-ask/

* Is There Life After AI? Cory Doctorow Thinks So. https://jacobin.com/2026/10/ai-bubble-labor-copyright-competition

* Online censorship is crushing indie webcomics https://xtramagazine.com/culture/online-censorship-indie-webcomics-284463

* Fascists Thrive On Bad Economics https://economicpopulist.substack.com/p/fascists-thrive-on-bad-economics

* PrivacySafe Foundation Releases Free Security Tools to Combat Global Cyber Threats https://www.einpresswire.com/article/952907125/privacysafe-foundation-releases-free-security-tools-to-combat-global-cyber-threats

->->->->->->->->->->->->->->->->->->->->->->->->->->->->->->

🏤 Object permanence

#25yrsago NY Post blames pagans from Indianapolis for spam malware https://web.archive.org/web/20011103073038/http://www.nypost.com/news/regionalnews/33077.htm

#25yrsago The Shakespeare Programming Language https://web.archive.org/web/20011207071324/http://shakespearelang.sourceforge.net/report/shakespeare/

#25yrsago Appeals court: DeCSS is "pure speech" https://web.archive.org/web/20011102003502/https://www.wired.com/news/business/0,1367,48075,00.html

#20yrsago Apple drops Trusted Computing https://web.archive.org/web/20070106150844/https://www.osxbook.com/book/bonus/chapter10/tpm/

#20yrsago Microsoft threatens China pull-out over jailed bloggers http://news.bbc.co.uk/1/hi/technology/6102180.stm

#15yrsago Righthaven copyright troll’s victims send in US marshals to seize its assets https://arstechnica.com/tech-policy/2011/11/us-marshals-turned-loose-to-collect-6372080-from-righthaven/

#15yrsago Supercuts: rapid-cut videos that collect repetition https://web.archive.org/web/20111103190737/http://www.wired.com/epicenter/2011/11/supercut/

#15yrsago Study: why parents help their underage kids pretend to be 13 in order to use Internet sites https://firstmonday.org/ojs/index.php/fm/article/view/3850/3075

#15yrsago Blue Coat “deep packet inspection” tools used by Syrian secret police and other repressive regimes https://www.eff.org/deeplinks/2011/10/blue-coat-acknowledges-syrian-government-use-its-products

#15yrsago Extraordinary Catalog of Peculiar Inventions: awesomely dangerous pranks from the age of fraternal lodges https://memex.craphound.com/2011/11/01/extraordinary-catalog-of-peculiar-inventions-awesomely-dangerous-pranks-from-the-age-of-fraternal-lodges/

#10yrsago Cable prices have risen at more than double the rate of inflation for 20 years https://cordcutting.com/news/cable-prices-have-risen-faster-than-inflation-for-each-of-the-past-20-years/

#10yrsago Typical English village mystified by its cult status among Chinese tourists https://www.bbc.com/news/uk-england-oxfordshire-37820663

#10yrsago Nebraska’s billionaire governor couldn’t preserve the death penalty through the law, so now he’s buying a ballot initiative https://www.motherjones.com/politics/2016/11/ricketts-nebraska-death-penalty/

#10yrsago Anti-vaxx conspiracy leaders back Donald Trump, claim it’s mutual https://scienceblogs.com/insolence/2016/11/02/donald-trump-and-disgraced-antivaccine-scientist-andrew-wakefield-best-buds-forever

#10yrsago New, fast-spreading IoT botnet hybridizes two less-effective strains to achieve quick dominance https://arstechnica.com/information-technology/2016/11/new-iot-botnet-that-borrows-from-notorious-mirai-infects-3500-devices/

#1yrago There's one thing EVERY government can do to shrink Big Tech https://pluralistic.net/2025/11/01/redistribution-vs-predistribution/#elbows-up-eurostack

->->->->->->->->->->->->->->->->->->->->->->->->->->->->->->

🏤 Upcoming appearances

* Kilkenny (Kilkenomics), Nov 6-8
https://kilkenomics.com/

* Courtenay: Enshittification (Sid Williams Theatre Society), Nov 10
https://www.sidwilliamstheatre.com/events/cory-doctorow-talks-enshittification/

* Vancouver: BC Policy Solutions Gala, Nov 12
https://bcpolicy.ca/gala/

* Folkestone Writers Festival, Nov 16
https://www.creativefolkestone.org.uk/whats-on/cory-doctorow-the-internet-is-broken-now-what/

* Oxford: Ministry of the Future, Nov 23
https://ministryforthefuture.co.uk/events.html

* Sheffield: Reverse Centaur at Juno Books, Nov 25
https://www.outsavvy.com/event/40274/cory-doctorow-in-conversation

* Virtual: Enshittification, AI, and the Future of Technology (UBC Master of Educational Technology), Nov 28
https://met.ubc.ca/2026/09/met-speaker-series-cory-doctorow-enshittification-ai-and-the-future-of-technology/

* Oxford: Bennett Oxford Symposium on Open Code in Science, Dec 9
https://www.bennett.ox.ac.uk/events/2026-bennett-institute-symposium/

* Montreal: World Science Fiction Convention, Sep 2-6
https://montreal2027.ca/en

->->->->->->->->->->->->->->->->->->->->->->->->->->->->->->

🏤 Recent appearances

* Clint Eastwood (No Gods No Mayors)
https://www.patreon.com/NoGodsNoMayors/posts/clint-eastwood-173008088

* Life After AI (Brain Bar)
https://www.youtube.com/watch?v=IPPa43-n0vI

* Terms of Service with Clare Duffy (CNN)
https://www.cnn.com/audio/podcasts/terms-of-service-with-clare-duffy/episodes/458ce968-af5d-11f0-b539-13ed2afe25f8

* AI, Work, and Power (Software Engineering Daily)
AI, Work, and Power https://softwareengineeringdaily.com/podcasts/cory-doctorow-on-ai-work-and-power/

* AI, Corporate Power, and the Fight for Worker Control (Plutopia)
https://plutopia.io/cory-doctorow-ai-corporate-power-and-the-fight-for-worker-control/

->->->->->->->->->->->->->->->->->->->->->->->->->->->->->->

🏤 Latest books

* "The Reverse-Centaur's Guide to AI," a short book about being a better AI critic, Farrar, Straus and Giroux, June 2026
https://us.macmillan.com/books/9780374621568/thereversecentaursguidetolifeafterai/

* "Canny Valley": A limited edition collection of the collages I create for Pluralistic, self-published, September 2025 https://pluralistic.net/2025/09/04/illustrious/#chairman-bruce

* "Enshittification: Why Everything Suddenly Got Worse and What to Do About It," Farrar, Straus, Giroux, October 7 2025
https://us.macmillan.com/books/9780374619329/enshittification/

* "Picks and Shovels": a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books (US), Head of Zeus (UK), February 2025 (https://us.macmillan.com/books/9781250865908/picksandshovels).

* "The Bezzle": a sequel to "Red Team Blues," about prison-tech and other grifts, Tor Books (US), Head of Zeus (UK), February 2024 (thebezzle.org).

* "The Lost Cause:" a solarpunk novel of hope in the climate emergency, Tor Books (US), Head of Zeus (UK), November 2023 (http://lost-cause.org).

* "The Internet Con": A nonfiction book about interoperability and Big Tech (Verso) September 2023 (http://seizethemeansofcomputation.org). Signed copies at Book Soup (https://www.booksoup.com/book/9781804291245).

* "Red Team Blues": "A grabby, compulsive thriller that will leave you knowing more about how the world works than you did before." Tor Books http://redteamblues.com.

* "Chokepoint Capitalism: How to Beat Big Tech, Tame Big Content, and Get Artists Paid, with Rebecca Giblin", on how to unrig the markets for creative labor, Beacon Press/Scribe 2022 https://chokepointcapitalism.com

->->->->->->->->->->->->->->->->->->->->->->->->->->->->->->

🏤 Upcoming books

* "The Post-American Internet," a geopolitical sequel of sorts to *Enshittification*, Farrar, Straus and Giroux, 2027

* "Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, April 20, 2027

* "Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2027

* "The Memex Method," Farrar, Straus, Giroux, 2027

->->->->->->->->->->->->->->->->->->->->->->->->->->->->->->

🏤 Colophon

Today's top sources:

Currently writing:

* “Once Is Enemy Action,” a science fiction novel about the origins of modern technofascism. Today's words: 574 (7730 total).

* "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America. Fourth draft completed. Submitted to editor.

* A Little Brother short story about DIY insulin PLANNING

This work - excluding any serialized fiction - is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.

->->->->->->->->->->->->->->->->->->->->->->->->->->->->->->

🏤 How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/@pluralistic

Bluesky (no ads, possible tracking and data-collection):

https://bsky.app/profile/doctorow.pluralistic.net

Medium (no ads, paywalled):

https://doctorow.medium.com/

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"*When life gives you SARS, you make sarsaparilla*" -Joey "Accordion Guy" DeVilla

READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.

ISSN: 3066-764X