The US Wants To Block Websites, And Your VPN Won't Help

Summary of the Video: Surveillance Report

1) US site-blocking bills could expand beyond “piracy” and threaten VPNs / DNS

The episode centers on two linked US Congress proposals that would allow courts to order blocking of “foreign piracy” websites, with enforcement potentially reaching major network intermediaries.

ACPA (American Copyright Protection Act) — broader reach

Introduced by Rep. Darrell Issa, ACPA would let a copyright owner seek a court ruling labeling a foreign site as piracy-related. Courts could then order ISPs, DNS providers, and VPNs to block access for Americans.

Key concerns raised:

• Unclear definition of what qualifies as a “foreign piracy website.”
• Overblocking risk: cited examples (via EFF) show that large-scale blocking can hit non-piracy or legitimate sites (e.g., Italy and Spain blocking many domains, including groups and educational entities).
• A slippery slope: blocking “piracy” could become broader censorship.

DEFEND IP Act — similar goal, partial exemptions

The DEFEND IP Act targets the same general court-ordered blocking approach and is described as having more pass-through support, but it includes partial exemptions:

• VPN providers are exempt
• Encrypted DNS is exempt (while standard DNS remains blockable)

The presenter argues:

• ACPA is broader and could directly reach VPNs and encrypted DNS.
• Lawmakers could later amend DEFEND IP to close those gaps.

Case study: Quad9

The presenter uses a real example to show this isn’t theoretical:

• Quad9, a nonprofit privacy-focused encrypted DNS resolver, previously faced blocking orders in France.
• Because Quad9 doesn’t track users, it couldn’t block only locally—so it had to block globally.
• The presenter notes later orders even named VPN providers (e.g., Proton, ExpressVPN, CyberGhost), reinforcing the view that DNS/VPN enforcement is becoming a practical compliance pathway across countries.

Related “good news” (US / Utah)

• A federal judge temporarily blocked Utah SB 73 (described as an anti-VPN age-verification law) via a preliminary injunction.

---

2) Claims of hacking: “Shiny Hunters” hits the FBI, followed by a major Pentagon personnel breach

The episode reports two major cyber incidents close together.

“Shiny Hunters” claims it hacked the FBI

• Shiny Hunters claims it hacked the FBI (with 404 Media verification mentioned).
• The presenter says the FBI later classified it as a cybersecurity incident after stolen personal data was confirmed.
• Reported theft includes terabytes of data such as:
  • names
  • Social Security numbers
  • home addresses
  • employment-related information including details for personnel tied to hacking operations.

Additional claims:

• Shiny Hunters allegedly says it was not financially motivated
• It claims it did not plan to publish or extort (the presenter questions whether this “marketing” angle is still a motivation).

Pentagon personnel records allegedly stolen (3+ million affected)

• Shortly after, hackers allegedly stole Pentagon personnel records impacting over 3 million people
• Reported sensitive details include:
  • DOBs
  • contact information
  • sex, race
  • military personnel details

The presenter notes:

• There’s no formal attribution yet connecting the events to Shiny Hunters
• But the similarity suggests a possible link.

Conclusion / lesson: even highly protected institutions (FBI / Pentagon) are not safe.

---

3) Chat Control 2.0 stalls in the EU, but the fight is ongoing

The host frames Chat Control 2.0 as an attempted “dirty deal” intended to legalize mass scanning of private communications.

What happened:

• A Council push to advance broad private-chat scanning failed for now
• The presenter attributes this to:
  • pressure from civil society
  • a firm European Parliament negotiation stance

But the presenter stresses it’s not a final victory:

• Negotiations are expected to continue at technical levels through October
• A more political attempt may come in November
• The Council may try to preserve Chat Control 1.0 as a “loophole”

Key takeaway: any final outcome should fully end the system, not preserve partial versions.

---

4) Meta’s “Muse” AI agent: security flaws + allegations about profiling

The episode covers Meta’s AI assistant “Muse”, which Mark Zuckerberg claims is privacy/security-oriented—though the presenter is skeptical.

ClickFix attack (privileged zero-day)

A researcher reports a zero-day capable of hijacking Muse so that other apps/terminal commands can access the token authenticating users to their Muse account.

• The presenter says Meta issued a patch about 12 hours after disclosure.
• Criticism includes design choices, such as:
  • cloud-based dictation (more visibility for Meta)
  • broad/undocumented settings control by apps, potentially enabling exploitation

Privacy and policy concerns (Wired referenced)

A Wired report (paywalled) is referenced claiming Muse can create detailed profiles of friends/family, described as having “privacy costs.”

Unsolicited notification involving Apple Messages

A columnist (Jason Aden mentioned) alleges Muse triggered an unsolicited notification referencing his Apple Messages thread despite claiming he never granted message-reading permissions.

Responsibility debate (Meta CTO vs Apple)

• Meta’s CTO allegedly claims Muse requires users to explicitly grant two privileges for Messages access:

  1. Full Disk Access on macOS
  2. enabling a Messages connector setting within Muse

• Apple counters that full disk access can be misused in ways users may not understand (e.g., exposure beyond intended content such as files, mail, browsing history), impacting both the user and people they communicate with.

• Apple says it will introduce new controls requiring more explicit user action.

Additional Apple defense mentioned

The presenter also describes an undocumented macOS “Golden Gate” behavior that silently restricts which apps can access certain sensitive folders—even when full disk access is granted. It’s described as part of system security mechanisms (including restrictions relevant to browsers, Discord, and crypto wallet/credentials storage).

Presenter’s recommendation

• Be cautious with agentic AI tools that request broad device permissions.
• Consider experimenting with open-source alternatives in controlled environments (e.g., Docker/VM).

---

5) “Defense Bulletin”: breaches and threats (quick hit roundup)

The news segment ends with categorized items.

Data breaches / exposures

• 16,000+ Supabase-based databases exposed with personal data, passwords, and auth tokens (presenter urges checking the show notes)

• Times Car: about 6.6 million user accounts compromised

• Truffle Security: 543,000+ credentials exposed in public GitHub repos
• Flock camera hack: alleged exposure of how an ALPR/tracking system works (privacy implications noted)
• Flink extortion: exposure of data for ~1 million customers (Netherlands-based, per presenter)

Threats / vulnerabilities

• Apple zero-click security patch: urged updates (specific iOS guidance given; some uncertainty about iOS 27 sub-versions)
• WordPress core vulnerability fixed in WordPress 7.1.2 (severity noted as high)
• Elementor plugin vulnerability mentioned separately
• MacSync malware: macOS info-stealing malware delivering payloads via public iCloud calendar events
• Reddit RSS/API changes: described as ending RSS feeds and public API access, framed as platform control / lock-in to reduce alternatives

---

6) Open source updates (Signal, privacy tooling, OS/platform news)

The episode highlights several positive updates.

Signal

• Register without a phone number on Android using key-based setup and a $2.99 one-time fee (pay via Apple/Google Pay mentioned)
• Expanded on-device backups
• Cross-platform backup/export improvements

Other privacy & open source tooling

• F-Droid UI update (rebranded app UI mentioned)
• KeePassXC beta: Sync, Wayland, AutoType, ARM64 support
• Obscura VPN: moved to GPLv3 and expanded Linux availability
• Firefox redesign moved to stable/public: vertical tabs and refreshed settings
• Tails 7.14, PostmarketOS/Nira rebrand, EOS 4.3, AdGuard Home 1.0 beta, Waterfox 6.7.5
• Nextcloud + Tuta integration:
  • Tuta inbox accessible via Nextcloud UI and vice versa
  • Nextcloud Academy for contributors
• Snapdragon X2 Linux support and Windows 11 container improvements discussed

Training promotion

The presenter promotes a rebuilt course:

• Go Incognito V2 (2026) Includes phased release plans and a pre-launch discount code expiry.

---

Presenters / Contributors

• Presenter / Host: (Unnamed in the subtitles; hosting Surveillance Report)
• Interview / referenced guest: Quad9 (the host says they interviewed Quad9 on a sister podcast)

Referenced researchers / journalists / authors

• Patrick Breyer (Chat Control 2.0 coverage)
• Wardle (ClickFix attack disclosure)
• Zach Whittaker (Apple patch coverage referenced)
• Jason Aden (Muse notification allegation)
• Mark Zuckerberg (Muse privacy/security claim referenced)
• Meta CTO (rebuttal referenced)

Organizations / companies mentioned

EFF, Congress / Rep. Darrell Issa, Quad9, Proton / ExpressVPN / CyberGhost, Windscribe, Signal, Apple, Meta, Wired, European Parliament / Council, FBI, Pentagon, Shiny Hunters, Supabase, Times Car, Truffle Security, Flock, Flink, Nextcloud, Tuta, F-Droid, KeePassXC, Obscura, Tails, PostmarketOS / Nira, EOS, AdGuard Home, Waterfox, Qualcomm, Microsoft.